EduCloud

h1. Ambiente de Desenvolvimento

h2. Lista de Servidores

* educloud00 - 200.145.46.166

* educloud01 - 200.145.46.167

* educloud02 - 200.145.46.168

* educloud03 - 200.145.46.169

* educloud04 - 200.145.46.170

* educloud05 - 200.145.46.174

* educloud06 - 200.145.46.175

* educloud07 - 200.145.46.173

h3. Desabilitados

* educloud05 - 200.145.46.171

* educloud06 - 200.145.46.172

h1. Installing OpenStack Identity Service - Keystone

O Keystone é um projeto que provê serviços de "Identidade", "Token", "Catalog" and "Policy" para os componentes do OpenStack. O pacote *_keystone_* foi instalado no servidor _educloud01_.

Este software é feito em python, e por sua vez instala a dependencia *_keystone-python_*, uma biblioteca em python para uso do próprio keystone.

Os arquivos de configuração do keystone ficam em /etc/keystone e hoje ele está utilizando como um backend para armazenar os usuários uma base sqlite3, mas ele também permite que seja utilizado uma base LDAP.

Além do daemon (servidor) foi instalado o cliente (também feito em python) *_python-keystoneclient_*.

h2. Instalando e configurando o keystone

<pre>

# apt-get install keystone

</pre>

Delete the keystone.db file created in the /var/lib/keystone directory.

<pre>

# rm /var/lib/keystone/keystone.db

</pre>

Install mysql:

<pre>

# apt-get install python-mysqldb mysql-server

</pre>

Use sed to edit /etc/mysql/my.cnf to change bind-address from localhost

(127.0.0.1) to any (0.0.0.0) and restart the mysql service, as root:

<pre>

# sed -i 's/127.0.0.1/0.0.0.0/g' /etc/mysql/my.cnf

# service mysql restart

</pre>

To configure the MySQL database, create the keystone database.

<pre>

# mysql -u root -p

mysql> CREATE DATABASE keystone;

mysql> GRANT ALL ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystonepass';

mysql> FLUSH PRIVILEGES;

mysql> quit;

</pre>

Edit _*keystone.conf*_ to use mysql:

<pre>

[sql]

connection = mysql://keystone:keystonepass@192.168.69.1/keystone

</pre>

Change in _*keystone.conf*_ the ADMIN_TOKEN:

<pre>

admin_token = 012345SECRET99TOKEN012345

</pre>

Restarte o keystone e inicialize o banco:

<pre>

# service keystone restart

# keystone-manage db_sync

</pre>

h2. Configuring Services to work with Keystone

Crie o arquivo _*/root/openstackrc*_, com o seguinte conteudo:

<pre>

export SERVICE_ENDPOINT=http://192.168.69.1:35357/v2.0/

export SERVICE_TOKEN=012345SECRET99TOKEN012345

</pre>

Estas variaveis de ambiente sao uteis para evitar ficar passando as opcoes --token e --endpoint para os utilitarios de linha de comando. 

Carrege o arquivo:

<pre>

# source /root/openstackrc

</pre>

Crie os *tenants* _openstackDemo_ e _service_:

<pre>

# keystone tenant-create --name openstackDemo --description "Default Tenant"  --enabled true

# keystone tenant-create --name service --description "Service Tenant"  --enabled true

</pre>

Crie o *user* _admin_, substitua o tenant_id pelo tentant_id do openstackDemo, criado no item anterior:

<pre>

# keystone user-create --tenant_id 9c401c9d2b9d41bcabda6919d4aec63a --name admin --pass adminpass --enabled true

</pre>

Crie os *roles* _admin_ e _user_:

<pre>

# keystone role-create --name admin

# keystone role-create --name user

</pre>

Adicione o *user* _admin_ ao *role* _admin_, fazendo as devidas substituicoes:

<pre>

# keystone user-role-add --user [admin_user_id] --tenant_id [openstackDemo_tenant_id] --role [admin_role]

</pre>

Crie um usuario para cada servico, e substitua o tenant_id pelo id do tenant *service*:

<pre>

# keystone user-create --tenant_id 92920816c7704a8a95c916d34dc7a05c --name glance --pass glancepass --enabled true

# keystone user-create --tenant_id 92920816c7704a8a95c916d34dc7a05c --name nova --pass novapass --enabled true

# keystone user-create --tenant_id 92920816c7704a8a95c916d34dc7a05c --name swift --pass swiftpass --enabled true

</pre>

Adicione os users acima ao *role* _admin_, fazendo as devidas substituicoes:

<pre>

# keystone user-role-add --user [glance_user_id] --tenant_id [service_tenant_id] --role [admin_role]

# keystone user-role-add --user [nova_user_id] --tenant_id [service_tenant_id] --role [admin_role]

# keystone user-role-add --user [swift_user_id] --tenant_id [service_tenant_id] --role [admin_role]

</pre>

h2. Definindo os servicos:

Ate agora, apenas criamos: tenants, users e roles. O Keystone tambem gerencia os servicos e seus endpoins. Desta forma os componentes do openstack consulta o keystone onde determinado servico encontra-se.

Crie os servicos:

<pre>

# keystone service-create --name keystone --type identity --description "Keystone Identity Service" 

# keystone service-create --name nova --type compute --description "Nova Compute Service"

# keystone service-create --name volume --type volume --description "Nova Volume Service"

# keystone service-create --name glance --type image --description "Glance Image Service"

# keystone service-create --name swift --type object-store --description "Object Storage Service"

</pre>

Crie os endpoints para os respectivos servicos:

<pre>

# keystone endpoint-create --region RegionOne --service_id [keystone_service_id] --publicurl http://192.168.69.1:5000/v2.0 --internalurl http://192.168.69.1:5000/v2.0 --adminurl http://192.168.69.1:35357/v2.0

# keystone endpoint-create --region RegionOne --service_id [compute_service_id] --publicurl 'http://192.168.69.1:8774/v2/%(tenant_id)s' --internalurl 'http://192.168.69.1:8774/v2/%(tenant_id)s' --adminurl 'http://192.168.69.1:8774/v2/%(tenant_id)s'

# keystone endpoint-create --region RegionOne --service_id [volume_service_id] --publicurl 'http://192.168.69.1:8776/v1/%(tenant_id)s' --internalurl 'http://192.168.69.1:8776/v1/%(tenant_id)s' --adminurl 'http://192.168.69.1:8776/v1/%(tenant_id)s'

# keystone endpoint-create --region RegionOne --service_id [glance_service_id] --publicurl http://192.168.69.1:9292/v1 --internalurl http://192.168.69.1:9292/v1 --adminurl http://192.168.69.1:9292/v1

# keystone endpoint-create --region RegionOne --service_id [swift_service_id] --publicurl 'http://192.168.69.1:8888/v1/AUTH_%(tenant_id)s' --adminurl 'http://192.168.69.1:8888/' --internalurl 'http://192.168.69.1:8888/v1/AUTH_%(tenant_id)s'

</pre>

h2. Verificando a instalacao:

<pre>

# sudo apt-get install curl openssl

</pre>

Faca uma requisicao REST para a API do keystone usando o curl:

<pre>

# curl -d '{"auth": {"tenantName": "openstackDemo", "passwordCredentials": {"username": "admin", "password": "adminpass"}}}' -H "Content-type: application/json" http://192.168.69.1:35357/v2.0/tokens  | python -mjson.tool

</pre>

O retorno deve conter todos os servicos, endpoins e um token que expira em 24 horas:

<pre>

{

    "access": {

        "serviceCatalog": [

            {

                "endpoints": [

                    {

                        "adminURL": "http://192.168.69.1:8776/v1/9c401c9d2b9d41bcabda6919d4aec63a", 

                        "internalURL": "http://192.168.69.1:8776/v1/9c401c9d2b9d41bcabda6919d4aec63a", 

                        "publicURL": "http://192.168.69.1:8776/v1/9c401c9d2b9d41bcabda6919d4aec63a", 

                        "region": "RegionOne"

                    }

                ], 

                "endpoints_links": [], 

                "name": "volume", 

                "type": "volume"

            }, 

            {

                "endpoints": [

                    {

                        "adminURL": "http://192.168.69.1:9292/v1", 

                        "internalURL": "http://192.168.69.1:9292/v1", 

                        "publicURL": "http://192.168.69.1:9292/v1", 

                        "region": "RegionOne"

                    }

                ], 

                "endpoints_links": [], 

                "name": "glance", 

                "type": "image"

            }, 

            {

                "endpoints": [

                    {

                        "adminURL": "http://192.168.69.1:8774/v2/9c401c9d2b9d41bcabda6919d4aec63a", 

                        "internalURL": "http://192.168.69.1:8774/v2/9c401c9d2b9d41bcabda6919d4aec63a", 

                        "publicURL": "http://192.168.69.1:8774/v2/9c401c9d2b9d41bcabda6919d4aec63a", 

                        "region": "RegionOne"

                    }

                ], 

                "endpoints_links": [], 

                "name": "nova", 

                "type": "compute"

            }, 

            {

                "endpoints": [

                    {

                        "adminURL": "http://192.168.69.1:35357/v2.0", 

                        "internalURL": "http://192.168.69.1:5000/v2.0", 

                        "publicURL": "http://192.168.69.1:5000/v2.0", 

                        "region": "RegionOne"

                    }

                ], 

                "endpoints_links": [], 

                "name": "keystone", 

                "type": "identity"

            }, 

            {

                "endpoints": [

                    {

                        "adminURL": "http://192.168.69.1:8888/", 

                        "internalURL": "http://192.168.69.1:8888/v1/AUTH_9c401c9d2b9d41bcabda6919d4aec63a", 

                        "publicURL": "http://192.168.69.1:8888/v1/AUTH_9c401c9d2b9d41bcabda6919d4aec63a", 

                        "region": "RegionOne"

                    }

                ], 

                "endpoints_links": [], 

                "name": "swift", 

                "type": "object-store"

            }

        ], 

        "token": {

            "expires": "2012-06-08T15:31:46Z", 

            "id": "05b818ff23564d5599c97ea5e1df7bbe", 

            "tenant": {

                "description": "Default Tenant", 

                "enabled": true, 

                "id": "9c401c9d2b9d41bcabda6919d4aec63a", 

                "name": "openstackDemo"

            }

        }, 

        "user": {

            "id": "1fcfbe778fc3428aa30db782056b34d7", 

            "name": "admin", 

            "roles": [

                {

                    "id": "a2d6da77c0a54105aab94484e0d2088b", 

                    "name": "admin"

                }

            ], 

            "roles_links": [], 

            "username": "admin"

        }

    }

}

</pre>

Voce pode tambem listar usuarios, roles, tenants e services:

<pre>

# keystone user-list

+----------------------------------+---------+-------+--------+

|                id                | enabled | email |  name  |

+----------------------------------+---------+-------+--------+

| 029c5749548946f7b560b2706d31d488 | True    | None  | glance |

| 1fcfbe778fc3428aa30db782056b34d7 | True    | None  | admin  |

| 4b75079aeb1b408ebdb286bfb85e719f | True    | None  | swift  |

| e25f81d50eb84bdb92907adbd0e41f25 | True    | None  | nova   |

+----------------------------------+---------+-------+--------+

</pre>

<pre>

# keystone role-list

+----------------------------------+-------+

|                id                |  name |

+----------------------------------+-------+

| 845e83e4d9bf4d8d8188b1e261dfe103 | user  |

| a2d6da77c0a54105aab94484e0d2088b | admin |

+----------------------------------+-------+

</pre>

<pre>

# keystone tenant-list

+----------------------------------+---------------+---------+

|                id                |      name     | enabled |

+----------------------------------+---------------+---------+

| 92920816c7704a8a95c916d34dc7a05c | service       | True    |

| 9c401c9d2b9d41bcabda6919d4aec63a | openstackDemo | True    |

+----------------------------------+---------------+---------+

</pre>

<pre>

# keystone service-list

+----------------------------------+----------+----------------+---------------------------+

|                id                |   name   |      type      |        description        |

+----------------------------------+----------+----------------+---------------------------+

| 00486163c7c64c6a86f577627071aafc | nova     | compute        | Nova Compute Service      |

| 69d3a6b21c9348acb1042d7d9386ff81 | volume   | volume         | Nova Volume Service       |

| 7b09782f9faf448781f5a460acabe258 | swift    | object-store   | Object Storage Service    |

| d6b32583a6694e9b828b2a50037623ba | keystone | identity       | Keystone Identity Service |

| f7f964a71e2a45119dcaede68fafbd78 | glance   | image          | Glance Image Service      |

+----------------------------------+----------+----------------+---------------------------+

</pre>

h1. Installing OpenStack Object Storage - Swift

[Descrever o Swift aqui]

Como neste ambiente de desenvolvimento temos apenas um no para storage e este sera o mesmo no que estara instalado o swift-proxy, todos os passos abaixo, sao executados na mesma maquina: _educloud01_.

Em um ambiente de producao aconselha-se ter pelo menos 05 object storage nodes e 01 object proxy node.

h2. Instalando e configurando o swift

<pre>

# apt-get install swift python-xattr python-memcache rsync memcached python-netifaces

</pre>

Infelizmente no momento da escrita deste manual o pacote do swift nao automatiza algumas tarefas, como por exemplo, a criacao dos arquivos de configuracao. Teremos que fazer isso manualmente:

<pre>

# mkdir /etc/swift

</pre>

Crie o arquivo de configuracao _/etc/swift/swift.conf_:

<pre>

[swift-hash]

# random unique string that can never change (DO NOT LOSE)

swift_hash_path_suffix = fLIbertYgibbitZ

</pre>

h2. Instalando e configurando os "object nodes"

<pre>

# apt-get install swift-account swift-container swift-object xfsprogs

</pre>

Cada "Object node" pode ter muitos dispositivos ligados a eles. 'E necessario que seja utilizado o sistema de arquivos xfs. 

<pre>

# fdisk /dev/sdb (set up a single partition)

# mkfs.xfs -i size=1024 /dev/sdb1

</pre>

Este dispositivo deve estar montando em /srv/node/

<pre>

echo "/dev/sdb1 /srv/node/sdb1 xfs noatime,nodiratime,nobarrier,logbufs=8 0 0" >> /etc/fstab

mkdir -p /srv/node/sdb1

mount /srv/node/sdb1

chown -R swift:swift /srv/node

</pre>

h2. Configure o _rsyncd.conf_

<pre>

uid = swift

gid = swift

log file = /var/log/rsyncd.log

pid file = /var/run/rsyncd.pid

address = 192.168.69.1

[account]

max connections = 2

path = /srv/node/

read only = false

lock file = /var/lock/account.lock

[container]

max connections = 2

path = /srv/node/

read only = false

lock file = /var/lock/container.lock

[object]

max connections = 2

path = /srv/node/

read only = false

lock file = /var/lock/object.lock

</pre>

Edite o _/etc/default/rsync_:

<pre>

RSYNC_ENABLE = true

</pre>

Restarte o rsync:

<pre>

service rsync restart

</pre>

Crie o _/etc/swift/account-server.conf_:

<pre>

[DEFAULT]

bind_ip = 192.168.69.1

workers = 2

[pipeline:main]

pipeline = account-server

[app:account-server]

use = egg:swift#account

[account-replicator]

[account-auditor]

[account-reaper]

</pre>

Crie o _/etc/swift/container-server.conf_:

<pre>

[DEFAULT]

bind_ip = 192.168.69.1

workers = 2

[pipeline:main]

pipeline = container-server

[app:container-server]

use = egg:swift#container

[container-replicator]

[container-updater]

[container-auditor]

</pre>

Crie o _/etc/swift/object-server.conf_:

<pre>

[DEFAULT]

bind_ip = 192.168.69.1

workers = 2

[pipeline:main]

pipeline = object-server

[app:object-server]

use = egg:swift#object

[object-replicator]

[object-updater]

[object-auditor]

</pre>

h2. Instale e configure o swift-proxy

<pre>

# apt-get install swift-proxy memcached

</pre>

Crie o certificado SSL auto assinado:

<pre>

cd /etc/swift

openssl req -new -x509 -nodes -out cert.crt -keyout cert.key

</pre>

Modifique o memcached para ouvir na interface da sua rede interna. Edite a seguinte linha no /etc/memcached.conf, mudando

<pre>

-l 127.0.0.1

to

-l 192.168.69.1

</pre>

Restart o memcached:

<pre>

service memcached restart

</pre>

Crie o arquivo _/etc/swift/proxy-server.conf_:

<pre>

[DEFAULT]

bind_port = 8888

user = swift

[pipeline:main]

pipeline = catch_errors healthcheck cache authtoken keystone proxy-server

[app:proxy-server]

use = egg:swift#proxy

account_autocreate = true

[filter:keystone]

paste.filter_factory = keystone.middleware.swift_auth:filter_factory

operator_roles = admin, swiftoperator

[filter:authtoken]

paste.filter_factory = keystone.middleware.auth_token:filter_factory

# Delaying the auth decision is required to support token-less

# usage for anonymous referrers ('.r:*').

delay_auth_decision = 10

service_port = 5000

service_host = 192.168.69.1

auth_port = 35357

auth_host = 192.168.69.1

auth_token = 012345SECRET99TOKEN012345

admin_token = 012345SECRET99TOKEN012345

auth_protocol = http

[filter:cache]

use = egg:swift#memcache

set log_name = cache

[filter:catch_errors]

use = egg:swift#catch_errors

[filter:healthcheck]

use = egg:swift#healthcheck

</pre>

Create the account, container and object rings. The builder command is basically creating a builder file with a few parameters. The parameter with the value of 18 represents 2 ^ 18th, the value that the partition will be sized to. Set this "partition power" value based on the total amount of storage you expect your entire ring to use. The value of 1 represents the number of replicas of each object, with the last value being the number of hours to restrict moving a partition more than once.

<pre>

cd /etc/swift

swift-ring-builder account.builder create 18 1 1

swift-ring-builder container.builder create 18 1 1

swift-ring-builder object.builder create 18 1 1

</pre>

For every storage device on each node add entries to each ring:

<pre>

swift-ring-builder account.builder add z<ZONE>-<STORAGE_LOCAL_NET_IP>:6002/<DEVICE> 100

swift-ring-builder container.builder add z<ZONE>-<STORAGE_LOCAL_NET_IP_1>:6001/<DEVICE> 100

swift-ring-builder object.builder add z<ZONE>-<STORAGE_LOCAL_NET_IP_1>:6000/<DEVICE> 100

</pre>

Como no nosso caso, apenas temos uma zona, em um storage node e com um device (sdb1), o comando acima ficaria:

<pre>

swift-ring-builder account.builder add z1-192.168.69.1:6002/sdb1 100

swift-ring-builder container.builder add z1-192.168.69.1:6001/sdb1 100

swift-ring-builder object.builder add z1-192.168.69.1:6000/sdb1 100

</pre>

Verify the ring contents for each ring:

<pre>

swift-ring-builder account.builder

swift-ring-builder container.builder

swift-ring-builder object.builder

</pre>

Rebalance the rings:

<pre>

swift-ring-builder account.builder rebalance

swift-ring-builder container.builder rebalance

swift-ring-builder object.builder rebalance

</pre>

Altere as permissoes dos arquivos de configuracao:

<pre>

# chown -R swift:swift /etc/swift/

</pre>

Inicie o swift-proxy:

<pre>

swift-init proxy start

</pre>

Inicie todos os servicos:

<pre>

swift-init main start

swift-init rest start

</pre>

h2. Verificando a instalacao

O arquivo _/root/openstackrc_ vai receber novas variaveis de ambiente, ele deve ficar assim:

<pre>

# Used for Keystone

export SERVICE_ENDPOINT=http://192.168.69.1:35357/v2.0/

export SERVICE_TOKEN=012345SECRET99TOKEN012345

# Used for swift

export ST_AUTH=http://192.168.69.1:5000/v2.0

export ST_USER=openstackDemo:admin

export ST_KEY=adminpass

export OS_REGION_NAME=RegionOne

</pre>

Carregue o arquivo:

<pre>

# source /root/openstackrc

</pre>

Tente obter status do swift:

<pre>

# swift -V 2.0 stat

</pre>

# Liste os containers:

<pre>

# swift -V 2.0 list

</pre>

<pre>