EduCloud

h1. Ambiente de Desenvolvimento

h2. Lista de Servidores

* educloud00 - 200.145.46.166

* educloud01 - 200.145.46.167

* educloud02 - 200.145.46.168

* educloud03 - 200.145.46.169

* educloud04 - 200.145.46.170

* educloud05 - 200.145.46.174

* educloud06 - 200.145.46.175

* educloud07 - 200.145.46.173

h3. Desabilitados

* educloud05 - 200.145.46.171

* educloud06 - 200.145.46.172

h1. Installing OpenStack Identity Service - Keystone

O Keystone é um projeto que provê serviços de "Identidade", "Token", "Catalog" and "Policy" para os componentes do OpenStack. O pacote *_keystone_* foi instalado no servidor _educloud01_.

Este software é feito em python, e por sua vez instala a dependencia *_keystone-python_*, uma biblioteca em python para uso do próprio keystone.

Os arquivos de configuração do keystone ficam em /etc/keystone e hoje ele está utilizando como um backend para armazenar os usuários uma base sqlite3, mas ele também permite que seja utilizado uma base LDAP.

Além do daemon (servidor) foi instalado o cliente (também feito em python) *_python-keystoneclient_*.

h2. Instalando e configurando o keystone

<pre>

# apt-get install keystone

</pre>

Delete the keystone.db file created in the /var/lib/keystone directory.

<pre>

# rm /var/lib/keystone/keystone.db

</pre>

Install mysql:

<pre>

# apt-get install python-mysqldb mysql-server

</pre>

Use sed to edit /etc/mysql/my.cnf to change bind-address from localhost

(127.0.0.1) to any (0.0.0.0) and restart the mysql service, as root:

<pre>

# sed -i 's/127.0.0.1/0.0.0.0/g' /etc/mysql/my.cnf

# service mysql restart

</pre>

To configure the MySQL database, create the keystone database.

<pre>

# mysql -u root -p

mysql> CREATE DATABASE keystone;

mysql> GRANT ALL ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystonepass';

mysql> FLUSH PRIVILEGES;

mysql> quit;

</pre>

Edit _*keystone.conf*_ to use mysql:

<pre>

[sql]

connection = mysql://keystone:keystonepass@192.168.69.1/keystone

</pre>

Change in _*keystone.conf*_ the ADMIN_TOKEN:

<pre>

admin_token = 012345SECRET99TOKEN012345

</pre>

Restarte o keystone e inicialize o banco:

<pre>

# service keystone restart

# keystone-manage db_sync

</pre>

h2. Configuring Services to work with Keystone

Crie o arquivo _*/root/openstackrc*_, com o seguinte conteudo:

<pre>

export SERVICE_ENDPOINT=http://192.168.69.1:35357/v2.0/

export SERVICE_TOKEN=012345SECRET99TOKEN012345

</pre>

Estas variaveis de ambiente sao uteis para evitar ficar passando as opcoes --token e --endpoint para os utilitarios de linha de comando. 

Carrege o arquivo:

<pre>

# source /root/openstackrc

</pre>

Crie os *tenants* _openstackDemo_ e _service_:

<pre>

# keystone tenant-create --name openstackDemo --description "Default Tenant"  --enabled true

# keystone tenant-create --name service --description "Service Tenant"  --enabled true

</pre>

Crie o *user* _admin_, substitua o tenant_id pelo tentant_id do openstackDemo, criado no item anterior:

<pre>

# keystone user-create --tenant_id 9c401c9d2b9d41bcabda6919d4aec63a --name admin --pass adminpass --enabled true

</pre>

Crie os *roles* _admin_ e _user_:

<pre>

# keystone role-create --name admin

# keystone role-create --name user

</pre>

Adicione o *user* _admin_ ao *role* _admin_, fazendo as devidas substituicoes:

<pre>

# keystone user-role-add --user [admin_user_id] --tenant_id [openstackDemo_tenant_id] --role [admin_role]

</pre>

Crie um usuario para cada servico, e substitua o tenant_id pelo id do tenant *service*:

<pre>

# keystone user-create --tenant_id 92920816c7704a8a95c916d34dc7a05c --name glance --pass glancepass --enabled true

# keystone user-create --tenant_id 92920816c7704a8a95c916d34dc7a05c --name nova --pass novapass --enabled true

# keystone user-create --tenant_id 92920816c7704a8a95c916d34dc7a05c --name swift --pass swiftpass --enabled true

</pre>

Adicione os users acima ao *role* _admin_, fazendo as devidas substituicoes:

<pre>

# keystone user-role-add --user [glance_user_id] --tenant_id [service_tenant_id] --role [admin_role]

# keystone user-role-add --user [nova_user_id] --tenant_id [service_tenant_id] --role [admin_role]

# keystone user-role-add --user [swift_user_id] --tenant_id [service_tenant_id] --role [admin_role]

</pre>

h2. Definindo os servicos:

Ate agora, apenas criamos: tenants, users e roles. O Keystone tambem gerencia os servicos e seus endpoins. Desta forma os componentes do openstack consulta o keystone onde determinado servico encontra-se.

Crie os servicos:

<pre>

# keystone service-create --name keystone --type identity --description "Keystone Identity Service" 

# keystone service-create --name nova --type compute --description "Nova Compute Service"

# keystone service-create --name volume --type volume --description "Nova Volume Service"

# keystone service-create --name glance --type image --description "Glance Image Service"

# keystone service-create --name swift --type object-store --description "Object Storage Service"

</pre>

Crie os endpoints para os respectivos servicos:

<pre>

# keystone endpoint-create --region RegionOne --service_id [keystone_service_id] --publicurl http://192.168.69.1:5000/v2.0 --internalurl http://192.168.69.1:5000/v2.0 --adminurl http://192.168.69.1:35357/v2.0

# keystone endpoint-create --region RegionOne --service_id [compute_service_id] --publicurl 'http://192.168.69.1:8774/v2/%(tenant_id)s' --internalurl 'http://192.168.69.1:8774/v2/%(tenant_id)s' --adminurl 'http://192.168.69.1:8774/v2/%(tenant_id)s'

# keystone endpoint-create --region RegionOne --service_id [volume_service_id] --publicurl 'http://192.168.69.1:8776/v1/%(tenant_id)s' --internalurl 'http://192.168.69.1:8776/v1/%(tenant_id)s' --adminurl 'http://192.168.69.1:8776/v1/%(tenant_id)s'

# keystone endpoint-create --region RegionOne --service_id [glance_service_id] --publicurl http://192.168.69.1:9292/v1 --internalurl http://192.168.69.1:9292/v1 --adminurl http://192.168.69.1:9292/v1

# keystone endpoint-create --region RegionOne --service_id [swift_service_id] --publicurl 'http://192.168.69.1:8888/v1/AUTH_%(tenant_id)s' --adminurl 'http://192.168.69.1:8888/' --internalurl 'http://192.168.69.1:8888/v1/AUTH_%(tenant_id)s'

</pre>

h2. Verificando a instalacao:

<pre>

# sudo apt-get install curl openssl

</pre>

Faca uma requisicao REST para a API do keystone usando o curl:

<pre>

# curl -d '{"auth": {"tenantName": "openstackDemo", "passwordCredentials": {"username": "admin", "password": "adminpass"}}}' -H "Content-type: application/json" http://192.168.69.1:35357/v2.0/tokens  | python -mjson.tool

</pre>

O retorno deve conter todos os servicos, endpoins e um token que expira em 24 horas:

<pre>

{

    "access": {

        "serviceCatalog": [

            {

                "endpoints": [

                    {

                        "adminURL": "http://192.168.69.1:8776/v1/9c401c9d2b9d41bcabda6919d4aec63a", 

                        "internalURL": "http://192.168.69.1:8776/v1/9c401c9d2b9d41bcabda6919d4aec63a", 

                        "publicURL": "http://192.168.69.1:8776/v1/9c401c9d2b9d41bcabda6919d4aec63a", 

                        "region": "RegionOne"

                    }

                ], 

                "endpoints_links": [], 

                "name": "volume", 

                "type": "volume"

            }, 

            {

                "endpoints": [

                    {

                        "adminURL": "http://192.168.69.1:9292/v1", 

                        "internalURL": "http://192.168.69.1:9292/v1", 

                        "publicURL": "http://192.168.69.1:9292/v1", 

                        "region": "RegionOne"

                    }

                ], 

                "endpoints_links": [], 

                "name": "glance", 

                "type": "image"

            }, 

            {

                "endpoints": [

                    {

                        "adminURL": "http://192.168.69.1:8774/v2/9c401c9d2b9d41bcabda6919d4aec63a", 

                        "internalURL": "http://192.168.69.1:8774/v2/9c401c9d2b9d41bcabda6919d4aec63a", 

                        "publicURL": "http://192.168.69.1:8774/v2/9c401c9d2b9d41bcabda6919d4aec63a", 

                        "region": "RegionOne"

                    }

                ], 

                "endpoints_links": [], 

                "name": "nova", 

                "type": "compute"

            }, 

            {

                "endpoints": [

                    {

                        "adminURL": "http://192.168.69.1:35357/v2.0", 

                        "internalURL": "http://192.168.69.1:5000/v2.0", 

                        "publicURL": "http://192.168.69.1:5000/v2.0", 

                        "region": "RegionOne"

                    }

                ], 

                "endpoints_links": [], 

                "name": "keystone", 

                "type": "identity"

            }, 

            {

                "endpoints": [

                    {

                        "adminURL": "http://192.168.69.1:8888/", 

                        "internalURL": "http://192.168.69.1:8888/v1/AUTH_9c401c9d2b9d41bcabda6919d4aec63a", 

                        "publicURL": "http://192.168.69.1:8888/v1/AUTH_9c401c9d2b9d41bcabda6919d4aec63a", 

                        "region": "RegionOne"

                    }

                ], 

                "endpoints_links": [], 

                "name": "swift", 

                "type": "object-store"

            }

        ], 

        "token": {

            "expires": "2012-06-08T15:31:46Z", 

            "id": "05b818ff23564d5599c97ea5e1df7bbe", 

            "tenant": {

                "description": "Default Tenant", 

                "enabled": true, 

                "id": "9c401c9d2b9d41bcabda6919d4aec63a", 

                "name": "openstackDemo"

            }

        }, 

        "user": {

            "id": "1fcfbe778fc3428aa30db782056b34d7", 

            "name": "admin", 

            "roles": [

                {

                    "id": "a2d6da77c0a54105aab94484e0d2088b", 

                    "name": "admin"

                }

            ], 

            "roles_links": [], 

            "username": "admin"

        }

    }

}

</pre>

Voce pode tambem listar usuarios, roles, tenants e services:

<pre>

# keystone user-list

+----------------------------------+---------+-------+--------+

|                id                | enabled | email |  name  |

+----------------------------------+---------+-------+--------+

| 029c5749548946f7b560b2706d31d488 | True    | None  | glance |

| 1fcfbe778fc3428aa30db782056b34d7 | True    | None  | admin  |

| 4b75079aeb1b408ebdb286bfb85e719f | True    | None  | swift  |

| e25f81d50eb84bdb92907adbd0e41f25 | True    | None  | nova   |

+----------------------------------+---------+-------+--------+

</pre>

<pre>

# keystone role-list

+----------------------------------+-------+

|                id                |  name |

+----------------------------------+-------+

| 845e83e4d9bf4d8d8188b1e261dfe103 | user  |

| a2d6da77c0a54105aab94484e0d2088b | admin |

+----------------------------------+-------+

</pre>

<pre>

# keystone tenant-list

+----------------------------------+---------------+---------+

|                id                |      name     | enabled |

+----------------------------------+---------------+---------+

| 92920816c7704a8a95c916d34dc7a05c | service       | True    |

| 9c401c9d2b9d41bcabda6919d4aec63a | openstackDemo | True    |

+----------------------------------+---------------+---------+

</pre>

<pre>

# keystone service-list

+----------------------------------+----------+----------------+---------------------------+

|                id                |   name   |      type      |        description        |

+----------------------------------+----------+----------------+---------------------------+

| 00486163c7c64c6a86f577627071aafc | nova     | compute        | Nova Compute Service      |

| 69d3a6b21c9348acb1042d7d9386ff81 | volume   | volume         | Nova Volume Service       |

| 7b09782f9faf448781f5a460acabe258 | swift    | object-store   | Object Storage Service    |

| d6b32583a6694e9b828b2a50037623ba | keystone | identity       | Keystone Identity Service |

| f7f964a71e2a45119dcaede68fafbd78 | glance   | image          | Glance Image Service      |

+----------------------------------+----------+----------------+---------------------------+

</pre>

h1. Installing OpenStack Object Storage - Swift

[Descrever o Swift aqui]

Como neste ambiente de desenvolvimento temos apenas um no para storage e este sera o mesmo no que estara instalado o swift-proxy, todos os passos abaixo, sao executados na mesma maquina: _educloud01_.

Em um ambiente de producao aconselha-se ter pelo menos 05 object storage nodes e 01 object proxy node.

h2. Instalando e configurando o swift

<pre>

# apt-get install swift python-xattr python-memcache rsync memcached python-netifaces

</pre>

Infelizmente no momento da escrita deste manual o pacote do swift nao automatiza algumas tarefas, como por exemplo, a criacao dos arquivos de configuracao. Teremos que fazer isso manualmente:

<pre>

# mkdir /etc/swift

</pre>

Crie o arquivo de configuracao _/etc/swift/swift.conf_:

<pre>

[swift-hash]

# random unique string that can never change (DO NOT LOSE)

swift_hash_path_suffix = fLIbertYgibbitZ

</pre>

h2. Instalando e configurando os "object nodes"

<pre>

# apt-get install swift-account swift-container swift-object xfsprogs

</pre>

Cada "Object node" pode ter muitos dispositivos ligados a eles. 'E necessario que seja utilizado o sistema de arquivos xfs. 

<pre>

# fdisk /dev/sdb (set up a single partition)

# mkfs.xfs -i size=1024 /dev/sdb1

</pre>

Este dispositivo deve estar montando em /srv/node/

<pre>

echo "/dev/sdb1 /srv/node/sdb1 xfs noatime,nodiratime,nobarrier,logbufs=8 0 0" >> /etc/fstab

mkdir -p /srv/node/sdb1

mount /srv/node/sdb1

chown -R swift:swift /srv/node

</pre>

h2. Configure o _rsyncd.conf_

<pre>

uid = swift

gid = swift

log file = /var/log/rsyncd.log

pid file = /var/run/rsyncd.pid

address = 192.168.69.1

[account]

max connections = 2

path = /srv/node/

read only = false

lock file = /var/lock/account.lock

[container]

max connections = 2

path = /srv/node/

read only = false

lock file = /var/lock/container.lock

[object]

max connections = 2

path = /srv/node/

read only = false

lock file = /var/lock/object.lock

</pre>

Edite o _/etc/default/rsync_:

<pre>

RSYNC_ENABLE = true

</pre>

Restarte o rsync:

<pre>

service rsync restart

</pre>

Crie o _/etc/swift/account-server.conf_:

<pre>

[DEFAULT]

bind_ip = 192.168.69.1

workers = 2

[pipeline:main]

pipeline = account-server

[app:account-server]

use = egg:swift#account

[account-replicator]

[account-auditor]

[account-reaper]

</pre>

Crie o _/etc/swift/container-server.conf_:

<pre>

[DEFAULT]

bind_ip = 192.168.69.1

workers = 2

[pipeline:main]

pipeline = container-server

[app:container-server]

use = egg:swift#container

[container-replicator]

[container-updater]

[container-auditor]

</pre>

Crie o _/etc/swift/object-server.conf_:

<pre>

[DEFAULT]

bind_ip = 192.168.69.1

workers = 2

[pipeline:main]

pipeline = object-server

[app:object-server]

use = egg:swift#object

[object-replicator]

[object-updater]

[object-auditor]

</pre>

h2. Instale e configure o swift-proxy

<pre>

# apt-get install swift-proxy memcached

</pre>

Crie o certificado SSL auto assinado:

<pre>

cd /etc/swift

openssl req -new -x509 -nodes -out cert.crt -keyout cert.key

</pre>

Modifique o memcached para ouvir na interface da sua rede interna. Edite a seguinte linha no /etc/memcached.conf, mudando

<pre>

-l 127.0.0.1

to

-l 192.168.69.1

</pre>

Restart o memcached:

<pre>

service memcached restart

</pre>

Crie o arquivo _/etc/swift/proxy-server.conf_:

<pre>

[DEFAULT]

bind_port = 8888

user = swift

[pipeline:main]

pipeline = catch_errors healthcheck cache authtoken keystone proxy-server

[app:proxy-server]

use = egg:swift#proxy

account_autocreate = true

[filter:keystone]

paste.filter_factory = keystone.middleware.swift_auth:filter_factory

operator_roles = admin, swiftoperator

[filter:authtoken]

paste.filter_factory = keystone.middleware.auth_token:filter_factory

# Delaying the auth decision is required to support token-less

# usage for anonymous referrers ('.r:*').

delay_auth_decision = 10

service_port = 5000

service_host = 192.168.69.1

auth_port = 35357

auth_host = 192.168.69.1

auth_token = 012345SECRET99TOKEN012345

admin_token = 012345SECRET99TOKEN012345

auth_protocol = http

[filter:cache]

use = egg:swift#memcache

set log_name = cache

[filter:catch_errors]

use = egg:swift#catch_errors

[filter:healthcheck]

use = egg:swift#healthcheck

</pre>

Altere as permissoes dos arquivos de configuracao:

<pre>

# chown -R swift:swift /etc/swift/

</pre>