openstack/openstack-manuals
Code Issues Proposed changes

Merge "Restructured Compute chapter in Cloud Admin Guide"

Browse Source
This commit is contained in:
Jenkins
2014-04-29 15:00:28 +00:00
committed by Gerrit Code Review
parent 9458a8ecc2 f481a0a4dc
commit cad430d764
3 changed files with 476 additions and 478 deletions
Download Patch File Download Diff File Expand all files Collapse all files

781
doc/admin-guide-cloud/ch_compute.xml
View File

@@ -66,269 +66,266 @@
controller using AMQP (advanced message queueing protocol). To avoid blocking a controller using AMQP (advanced message queueing protocol). To avoid blocking a
component while waiting for a response, Compute uses asynchronous calls, with a callback component while waiting for a response, Compute uses asynchronous calls, with a callback
that is triggered when a response is received.</para> that is triggered when a response is received.</para>
</section> <section xml:id="section_hypervisors">
<section xml:id="section_hypervisors"> <title>Hypervisors</title>
<title>Hypervisors</title> <para xlink:href="https://www.docker.io/">Compute controls hypervisors through an API
<para xlink:href="https://www.docker.io/">Compute controls hypervisors through an API server. Selecting the best hypervisor to use can be difficult, and you must take budget,
server. Selecting the best hypervisor to use can be difficult, and you must take budget, resource constraints, supported features, and required technical specifications into
resource constraints, supported features, and required technical specifications into account. However, the majority of OpenStack development is done on systems using KVM and
account. However, the majority of OpenStack development is done on systems using KVM and Xen-based hypervisors. For a detailed list of features and support across different
Xen-based hypervisors. For a detailed list of features and support across different hypervisors, see <link xlink:href="http://wiki.openstack.org/HypervisorSupportMatrix"
hypervisors, see <link xlink:href="http://wiki.openstack.org/HypervisorSupportMatrix" >http://wiki.openstack.org/HypervisorSupportMatrix</link>.</para>
>http://wiki.openstack.org/HypervisorSupportMatrix</link>.</para> <para>You can also orchestrate clouds using multiple
<para>You can also orchestrate clouds using multiple hypervisors in different availability zones. Compute
hypervisors in different availability zones. Compute supports the following hypervisors:</para>
supports the following hypervisors:</para> <itemizedlist>
<itemizedlist> <listitem>
<listitem> <para><link xlink:href="https://wiki.openstack.org/wiki/Baremetal">Baremetal</link>
<para><link xlink:href="https://wiki.openstack.org/wiki/Baremetal">Baremetal</link> </para>
</para> </listitem>
</listitem> <listitem>
<listitem> <para><link xlink:href="https://www.docker.io">Docker</link></para>
<para><link xlink:href="https://www.docker.io">Docker</link></para> </listitem>
</listitem> <listitem>
<listitem> <para><link
<para><link xlink:href="http://www.microsoft.com/en-us/server-cloud/hyper-v-server/default.aspx"
xlink:href="http://www.microsoft.com/en-us/server-cloud/hyper-v-server/default.aspx" >Hyper-V</link>
>Hyper-V</link> </para>
</para> </listitem>
</listitem> <listitem>
<listitem> <para><link xlink:href="http://www.linux-kvm.org/page/Main_Page">Kernel-based
<para><link xlink:href="http://www.linux-kvm.org/page/Main_Page">Kernel-based Virtual Machine (KVM)</link>
Virtual Machine (KVM)</link> </para>
</para> </listitem>
</listitem> <listitem>
<listitem> <para><link xlink:href="http://lxc.sourceforge.net/">Linux Containers (LXC)</link>
<para><link xlink:href="http://lxc.sourceforge.net/">Linux Containers (LXC)</link> </para>
</para> </listitem>
</listitem> <listitem>
<listitem> <para><link xlink:href="http://wiki.qemu.org/Manual">Quick Emulator (QEMU)</link>
<para><link xlink:href="http://wiki.qemu.org/Manual">Quick Emulator (QEMU)</link> </para>
</para> </listitem>
</listitem> <listitem>
<listitem> <para><link xlink:href="http://user-mode-linux.sourceforge.net/">User Mode Linux
<para><link xlink:href="http://user-mode-linux.sourceforge.net/">User Mode Linux (UML)</link>
(UML)</link> </para>
</para> </listitem>
</listitem> <listitem>
<listitem> <para><link
<para><link xlink:href="http://www.vmware.com/products/vsphere-hypervisor/support.html"
xlink:href="http://www.vmware.com/products/vsphere-hypervisor/support.html" >VMWare vSphere</link>
>VMWare vSphere</link> </para>
</para> </listitem>
</listitem> <listitem>
<listitem> <para><link xlink:href="http://www.xen.org/support/documentation.html">Xen</link>
<para><link xlink:href="http://www.xen.org/support/documentation.html">Xen</link> </para>
</para> </listitem>
</listitem> </itemizedlist>
</itemizedlist> <para>For more information about hypervisors, see the <link
<para>For more information about hypervisors, see the <link xlink:href="http://docs.openstack.org/trunk/config-reference/content/section_compute-hypervisors.html"
xlink:href="http://docs.openstack.org/trunk/config-reference/content/section_compute-hypervisors.html" >Hypervisors</link> section in the
>Hypervisors</link> section in the <citetitle>OpenStack Configuration
<citetitle>OpenStack Configuration Reference</citetitle>.</para>
Reference</citetitle>.</para> </section>
</section> <section xml:id="section_users-and-projects">
<section xml:id="section_users-and-projects"> <title>Tenants, users, and roles</title>
<title>Tenants, users, and roles</title> <para>The Compute system is designed to be used by different
<para>The Compute system is designed to be used by different consumers in the form of tenants on a shared system, and
consumers in the form of tenants on a shared system, and role-based access assignments. Roles control the actions
role-based access assignments. Roles control the actions that a user is allowed to perform.</para>
that a user is allowed to perform.</para> <para>Tenants are isolated resource containers that form the
<para>Tenants are isolated resource containers that form the principal organizational structure within the Compute
principal organizational structure within the Compute service. They consist of an individual VLAN, and volumes,
service. They consist of an individual VLAN, and volumes, instances, images, keys, and users. A user can specify the
instances, images, keys, and users. A user can specify the tenant by appending <literal>:project_id</literal> to
tenant by appending <literal>:project_id</literal> to their access key. If no tenant is specified in the API
their access key. If no tenant is specified in the API request, Compute attempts to use a tenant with the same ID
request, Compute attempts to use a tenant with the same ID as the user.</para>
as the user.</para> <para>For tenants, you can use quota controls to limit the:</para>
<para>For tenants, you can use quota controls to limit the:</para> <itemizedlist>
<itemizedlist> <listitem>
<listitem> <para>Number of volumes that may be launched.</para>
<para>Number of volumes that may be launched.</para> </listitem>
</listitem> <listitem>
<listitem> <para>Number of processor cores and the amount of RAM that can be allocated.</para>
<para>Number of processor cores and the amount of RAM that can be allocated.</para> </listitem>
</listitem> <listitem>
<listitem> <para>Floating IP addresses assigned to any instance when it launches. This allows
<para>Floating IP addresses assigned to any instance when it launches. This allows instances to have the same publicly accessible IP addresses.</para>
instances to have the same publicly accessible IP addresses.</para> </listitem>
</listitem> <listitem>
<listitem> <para>Fixed IP addresses assigned to the same instance when it launches. This allows
<para>Fixed IP addresses assigned to the same instance when it launches. This allows instances to have the same publicly or privately accessible IP addresses.</para>
instances to have the same publicly or privately accessible IP addresses.</para> </listitem>
</listitem> </itemizedlist>
</itemizedlist> <para>Roles control the actions a user is allowed to perform.
<para>Roles control the actions a user is allowed to perform. By default, most actions do not require a particular role,
By default, most actions do not require a particular role, but you can configure them by editing the
but you can configure them by editing the <filename>policy.json</filename> file for user roles.
<filename>policy.json</filename> file for user roles. For example, a rule can be defined so that a user must
For example, a rule can be defined so that a user must have the <parameter>admin</parameter> role in order to be
have the <parameter>admin</parameter> role in order to be able to allocate a public IP address.</para>
able to allocate a public IP address.</para> <para>A tenant limits users' access to particular images. Each
<para>A tenant limits users' access to particular images. Each user is assigned a username and password. Keypairs
user is assigned a username and password. Keypairs granting access to an instance are enabled for each user,
granting access to an instance are enabled for each user, but quotas are set, so that each tenant can control
but quotas are set, so that each tenant can control resource consumption across available hardware
resource consumption across available hardware resources.</para>
resources.</para> <note>
<note> <para>Earlier versions of OpenStack used the term
<para>Earlier versions of OpenStack used the term <systemitem class="service">project</systemitem>
<systemitem class="service">project</systemitem> instead of <systemitem class="service"
instead of <systemitem class="service" >tenant</systemitem>. Because of this legacy
>tenant</systemitem>. Because of this legacy terminology, some command-line tools use
terminology, some command-line tools use <parameter>--project_id</parameter> where you
<parameter>--project_id</parameter> where you would normally expect to enter a tenant ID.</para>
would normally expect to enter a tenant ID.</para> </note>
</note> </section>
</section> <section xml:id="section_storage-and-openstack-compute">
<xi:include href="compute/section_compute-images-instances.xml"/> <title>Block storage</title>
<xi:include href="../common/section_compute_config-firewalls.xml"/> <para>OpenStack provides two classes of block storage:
<section xml:id="section_storage-and-openstack-compute"> ephemeral storage and persistent volumes. Volumes are
<title>Block storage</title> persistent virtualized block devices independent of any
<para>OpenStack provides two classes of block storage: particular instance.</para>
ephemeral storage and persistent volumes. Volumes are <para>Ephemeral storage is associated with a single unique
persistent virtualized block devices independent of any instance, and it exists only for the life of that
particular instance.</para> instance. The amount of ephemeral storage is defined by
<para>Ephemeral storage is associated with a single unique the flavor of the instance. Generally, the root file
instance, and it exists only for the life of that system for an instance will be stored on ephemeral
instance. The amount of ephemeral storage is defined by storage. It persists across reboots of the guest operating
the flavor of the instance. Generally, the root file system, but when the instance is deleted, the ephemeral
system for an instance will be stored on ephemeral storage is also removed.</para>
storage. It persists across reboots of the guest operating <para>In addition to the ephemeral root volume, all flavors
system, but when the instance is deleted, the ephemeral except the smallest, <filename>m1.tiny</filename>, also
storage is also removed.</para> provide an additional ephemeral block device of between 20
<para>In addition to the ephemeral root volume, all flavors and 160&nbsp;GB. These sizes can be configured to suit your
except the smallest, <filename>m1.tiny</filename>, also environment. This is presented as a raw block device with
provide an additional ephemeral block device of between 20 no partition table or file system. Cloud-aware operating
and 160&nbsp;GB. These sizes can be configured to suit your system images can discover, format, and mount these
environment. This is presented as a raw block device with storage devices. For example, the <systemitem
no partition table or file system. Cloud-aware operating class="service">cloud-init</systemitem> package
system images can discover, format, and mount these included in Ubuntu's stock cloud images format this space
storage devices. For example, the <systemitem as an <filename>ext3</filename> file system and mount it
class="service">cloud-init</systemitem> package on <filename>/mnt</filename>. This is a feature of the
included in Ubuntu's stock cloud images format this space guest operating system you are using, and is not an
as an <filename>ext3</filename> file system and mount it OpenStack mechanism. OpenStack only provisions the raw
on <filename>/mnt</filename>. This is a feature of the storage.</para>
guest operating system you are using, and is not an <para>Persistent volumes are created by users and their size
OpenStack mechanism. OpenStack only provisions the raw is limited only by the user's quota and availability
storage.</para> limits. Upon initial creation, volumes are raw block
<para>Persistent volumes are created by users and their size devices without a partition table or a file system. To
is limited only by the user's quota and availability partition or format volumes, you must attach them to an
limits. Upon initial creation, volumes are raw block instance. Once they are attached to an instance, you can
devices without a partition table or a file system. To use persistent volumes in much the same way as you would
partition or format volumes, you must attach them to an use external hard disk drive. You can attach volumes to
instance. Once they are attached to an instance, you can only one instance at a time, although you can detach and
use persistent volumes in much the same way as you would reattach volumes to as many different instances as you
use external hard disk drive. You can attach volumes to like.</para>
only one instance at a time, although you can detach and <para>You can configure persistent volumes as bootable and use them to provide a persistent
reattach volumes to as many different instances as you virtual instance similar to traditional non-cloud-based virtualization systems.
like.</para> Typically, the resulting instance can also still have ephemeral storage depending on the
<para>You can configure persistent volumes as bootable and use them to provide a persistent flavor selected, but the root file system can be on the persistent volume and its state
virtual instance similar to traditional non-cloud-based virtualization systems. maintained even if the instance is shut down. For more information about this type of
Typically, the resulting instance can also still have ephemeral storage depending on the configuration, see the <link
flavor selected, but the root file system can be on the persistent volume and its state xlink:href="http://docs.openstack.org/trunk/config-reference/content/">
maintained even if the instance is shut down. For more information about this type of <citetitle>OpenStack Configuration Reference</citetitle></link>.
configuration, see the <link </para>
xlink:href="http://docs.openstack.org/trunk/config-reference/content/"> <note>
<citetitle>OpenStack Configuration Reference</citetitle></link>. <para>Persistent volumes do not provide concurrent access
</para> from multiple instances. That type of configuration
<note> requires a traditional network file system like NFS or
<para>Persistent volumes do not provide concurrent access CIFS, or a cluster file system such as GlusterFS.
from multiple instances. That type of configuration These systems can be built within an OpenStack cluster
requires a traditional network file system like NFS or or provisioned outside of it, but OpenStack software
CIFS, or a cluster file system such as GlusterFS. does not provide these features.</para>
These systems can be built within an OpenStack cluster </note>
or provisioned outside of it, but OpenStack software </section>
does not provide these features.</para> <section xml:id="instance-mgmt-ec2compat">
</note> <title>EC2 compatibility API</title>
</section> <para>In addition to the native compute API, OpenStack provides an EC2-compatible API. This
<section xml:id="instance-mgmt-ec2compat"> API allows EC2 legacy workflows built for EC2 to work with OpenStack. The
<title>EC2 compatibility API</title> <link
<para>In addition to the native compute API, OpenStack provides an EC2-compatible API. This xlink:href="http://docs.openstack.org/trunk/config-reference/content/">
API allows EC2 legacy workflows built for EC2 to work with OpenStack. The <citetitle>OpenStack Configuration Reference</citetitle></link>
<link lists configuration options
xlink:href="http://docs.openstack.org/trunk/config-reference/content/"> for customizing this compatibility API on your OpenStack cloud.</para>
<citetitle>OpenStack Configuration Reference</citetitle></link> <para>Numerous third-party tools and language-specific SDKs
lists configuration options can be used to interact with OpenStack clouds, using both
for customizing this compatibility API on your OpenStack cloud.</para> native and compatibility APIs. Some of the more popular
<para>Numerous third-party tools and language-specific SDKs third-party tools are:</para>
can be used to interact with OpenStack clouds, using both <variablelist>
native and compatibility APIs. Some of the more popular <varlistentry>
third-party tools are:</para> <term>Euca2ools</term>
<variablelist> <listitem>
<varlistentry> <para>A popular open source command-line tool for
<term>Euca2ools</term> interacting with the EC2 API. This is
<listitem> convenient for multi-cloud environments where
<para>A popular open source command-line tool for EC2 is the common API, or for transitioning
interacting with the EC2 API. This is from EC2-based clouds to OpenStack. For more
convenient for multi-cloud environments where information, see the <link
EC2 is the common API, or for transitioning xlink:href="http://open.eucalyptus.com/wiki/Euca2oolsGuide"
from EC2-based clouds to OpenStack. For more >euca2ools site</link>.</para>
information, see the <link </listitem>
xlink:href="http://open.eucalyptus.com/wiki/Euca2oolsGuide" </varlistentry>
>euca2ools site</link>.</para> <varlistentry>
</listitem> <term>Hybridfox</term>
</varlistentry> <listitem>
<varlistentry> <para>A Firefox browser add-on that provides a
<term>Hybridfox</term> graphical interface to many popular public and
<listitem> private cloud technologies, including
<para>A Firefox browser add-on that provides a OpenStack. For more information, see the <link
graphical interface to many popular public and xlink:href="http://code.google.com/p/hybridfox/"
private cloud technologies, including > hybridfox site</link>.</para>
OpenStack. For more information, see the <link </listitem>
xlink:href="http://code.google.com/p/hybridfox/" </varlistentry>
> hybridfox site</link>.</para> <varlistentry>
</listitem> <term>boto</term>
</varlistentry> <listitem>
<varlistentry> <para>A Python library for interacting with Amazon
<term>boto</term> Web Services. It can be used to access
<listitem> OpenStack through the EC2 compatibility API.
<para>A Python library for interacting with Amazon For more information, see the <link
Web Services. It can be used to access xlink:href="https://github.com/boto/boto">
OpenStack through the EC2 compatibility API. boto project page on GitHub</link>.</para>
For more information, see the <link </listitem>
xlink:href="https://github.com/boto/boto"> </varlistentry>
boto project page on GitHub</link>.</para> <varlistentry>
</listitem> <term>fog</term>
</varlistentry> <listitem>
<varlistentry> <para>A Ruby cloud services library. It provides
<term>fog</term> methods for interacting with a large number of
<listitem> cloud and virtualization platforms, including
<para>A Ruby cloud services library. It provides OpenStack. For more information, see the <link
methods for interacting with a large number of xlink:href="https://rubygems.org/gems/fog"
cloud and virtualization platforms, including > fog site</link>.</para>
OpenStack. For more information, see the <link </listitem>
xlink:href="https://rubygems.org/gems/fog" </varlistentry>
> fog site</link>.</para> <varlistentry>
</listitem> <term>php-opencloud</term>
</varlistentry> <listitem>
<varlistentry> <para>A PHP SDK designed to work with most
<term>php-opencloud</term> OpenStack- based cloud deployments, as well as
<listitem> Rackspace public cloud. For more information,
<para>A PHP SDK designed to work with most see the <link
OpenStack- based cloud deployments, as well as xlink:href="http://www.php-opencloud.com">
Rackspace public cloud. For more information, php-opencloud site</link>.</para>
see the <link </listitem>
xlink:href="http://www.php-opencloud.com"> </varlistentry>
php-opencloud site</link>.</para> </variablelist>
</listitem> </section>
</varlistentry> <section xml:id="section_instance-building-blocks">
</variablelist> <title>Building blocks</title>
</section> <para>In OpenStack the base operating system is usually copied
<section xml:id="section_instance-building-blocks"> from an image stored in the OpenStack Image Service. This
<title>Building blocks</title> is the most common case and results in an ephemeral
<para>In OpenStack the base operating system is usually copied instance that starts from a known template state and loses
from an image stored in the OpenStack Image Service. This all accumulated states on shutdown. It is also possible to
is the most common case and results in an ephemeral put an operating system on a persistent volume in the
instance that starts from a known template state and loses Nova-Volume or Cinder volume system. This gives a more
all accumulated states on shutdown. It is also possible to traditional persistent system that accumulates states,
put an operating system on a persistent volume in the which are preserved across restarts. To get a list of
Nova-Volume or Cinder volume system. This gives a more available images on your system run:
traditional persistent system that accumulates states, <screen><prompt>$</prompt> <userinput>nova image-list</userinput>
which are preserved across restarts. To get a list of
available images on your system run:
<screen><prompt>$</prompt> <userinput>nova image-list</userinput>
<?db-font-size 50%?><computeroutput>+--------------------------------------+-------------------------------+--------+--------------------------------------+ <?db-font-size 50%?><computeroutput>+--------------------------------------+-------------------------------+--------+--------------------------------------+
| ID | Name | Status | Server | | ID | Name | Status | Server |
+--------------------------------------+-------------------------------+--------+--------------------------------------+ +--------------------------------------+-------------------------------+--------+--------------------------------------+
@@ -336,53 +333,52 @@
| 0b27baa1-0ca6-49a7-b3f4-48388e440245 | Ubuntu 12.10 cloudimg amd64 | ACTIVE | | | 0b27baa1-0ca6-49a7-b3f4-48388e440245 | Ubuntu 12.10 cloudimg amd64 | ACTIVE | |
| df8d56fc-9cea-4dfd-a8d3-28764de3cb08 | jenkins | ACTIVE | | | df8d56fc-9cea-4dfd-a8d3-28764de3cb08 | jenkins | ACTIVE | |
+--------------------------------------+-------------------------------+--------+--------------------------------------+</computeroutput></screen> +--------------------------------------+-------------------------------+--------+--------------------------------------+</computeroutput></screen>
</para> </para>
<para>The displayed image attributes are:</para> <para>The displayed image attributes are:</para>
<variablelist> <variablelist>
<varlistentry> <varlistentry>
<term><literal>ID</literal></term> <term><literal>ID</literal></term>
<listitem> <listitem>
<para>Automatically generated UUID of the <para>Automatically generated UUID of the
image</para> image</para>
</listitem> </listitem>
</varlistentry> </varlistentry>
<varlistentry> <varlistentry>
<term><literal>Name</literal></term> <term><literal>Name</literal></term>
<listitem> <listitem>
<para>Free form, human-readable name for <para>Free form, human-readable name for
image</para> image</para>
</listitem> </listitem>
</varlistentry> </varlistentry>
<varlistentry> <varlistentry>
<term><literal>Status</literal></term> <term><literal>Status</literal></term>
<listitem> <listitem>
<para>The status of the image. Images marked <para>The status of the image. Images marked
<literal>ACTIVE</literal> are available <literal>ACTIVE</literal> are available
for use.</para> for use.</para>
</listitem> </listitem>
</varlistentry> </varlistentry>
<varlistentry> <varlistentry>
<term><literal>Server</literal></term> <term><literal>Server</literal></term>
<listitem> <listitem>
<para>For images that are created as snapshots of <para>For images that are created as snapshots of
running instances, this is the UUID of the running instances, this is the UUID of the
instance the snapshot derives from. For instance the snapshot derives from. For
uploaded images, this field is blank.</para> uploaded images, this field is blank.</para>
</listitem> </listitem>
</varlistentry> </varlistentry>
</variablelist> </variablelist>
<para>Virtual hardware templates are called
<para>Virtual hardware templates are called <literal>flavors</literal>. The default installation
<literal>flavors</literal>. The default installation provides five flavors. By default, these are configurable
provides five flavors. By default, these are configurable by admin users, however that behavior can be changed by
by admin users, however that behavior can be changed by redefining the access controls for
redefining the access controls for <parameter>compute_extension:flavormanage</parameter>
<parameter>compute_extension:flavormanage</parameter> in <filename>/etc/nova/policy.json</filename> on the
in <filename>/etc/nova/policy.json</filename> on the <filename>compute-api</filename> server.</para>
<filename>compute-api</filename> server.</para> <para>For a list of flavors that are available on your
<para>For a list of flavors that are available on your system:</para>
system:</para> <screen><prompt>$</prompt> <userinput>nova flavor-list</userinput>
<screen><prompt>$</prompt> <userinput>nova flavor-list</userinput>
<computeroutput>+----+-----------+-----------+------+-----------+------+-------+-------------+ <computeroutput>+----+-----------+-----------+------+-----------+------+-------+-------------+
| ID | Name | Memory_MB | Disk | Ephemeral | Swap | VCPUs | RXTX_Factor | | ID | Name | Memory_MB | Disk | Ephemeral | Swap | VCPUs | RXTX_Factor |
+----+-----------+-----------+------+-----------+------+-------+-------------+ +----+-----------+-----------+------+-----------+------+-------+-------------+
@@ -393,82 +389,97 @@
| 5 | m1.xlarge | 16384 | 160 | N/A | 0 | 8 | | | 5 | m1.xlarge | 16384 | 160 | N/A | 0 | 8 | |
+----+-----------+-----------+------+-----------+------+-------+-------------+ +----+-----------+-----------+------+-----------+------+-------+-------------+
</computeroutput></screen> </computeroutput></screen>
</section>
<section xml:id="section_compute-service-arch">
<title>Compute service architecture</title>
<para>The following basic categories describe the service architecture and what's going
on within the cloud controller.</para>
<simplesect>
<title>API server</title>
<para>At the heart of the cloud framework is an API server. This API server makes
command and control of the hypervisor, storage, and networking programmatically
available to users.</para>
<para>The API endpoints are basic HTTP web services
which handle authentication, authorization, and
basic command and control functions using various
API interfaces under the Amazon, Rackspace, and
related models. This enables API compatibility
with multiple existing tool sets created for
interaction with offerings from other vendors.
This broad compatibility prevents vendor
lock-in.</para>
</simplesect>
<simplesect>
<title>Message queue</title>
<para>A messaging queue brokers the interaction
between compute nodes (processing), the networking
controllers (software which controls network
infrastructure), API endpoints, the scheduler
(determines which physical hardware to allocate to
a virtual resource), and similar components.
Communication to and from the cloud controller is
by HTTP requests through multiple API
endpoints.</para>
<para>A typical message passing event begins with the API server receiving a request
from a user. The API server authenticates the user and ensures that the user is
permitted to issue the subject command. The availability of objects implicated in
the request is evaluated and, if available, the request is routed to the queuing
engine for the relevant workers. Workers continually listen to the queue based on
their role, and occasionally their type host name. When an applicable work request
arrives on the queue, the worker takes assignment of the task and begins its
execution. Upon completion, a response is dispatched to the queue which is received
by the API server and relayed to the originating user. Database entries are queried,
added, or removed as necessary throughout the process.</para>
</simplesect>
<simplesect>
<title>Compute worker</title>
<para>Compute workers manage computing instances on
host machines. The API dispatches commands to
compute workers to complete these tasks:</para>
<itemizedlist>
<listitem>
<para>Run instances</para>
</listitem>
<listitem>
<para>Terminate instances</para>
</listitem>
<listitem>
<para>Reboot instances</para>
</listitem>
<listitem>
<para>Attach volumes</para>
</listitem>
<listitem>
<para>Detach volumes</para>
</listitem>
<listitem>
<para>Get console output</para>
</listitem>
</itemizedlist>
</simplesect>
<simplesect>
<title>Network Controller</title>
<para>The Network Controller manages the networking
resources on host machines. The API server
dispatches commands through the message queue,
which are subsequently processed by Network
Controllers. Specific operations include:</para>
<itemizedlist>
<listitem>
<para>Allocate fixed IP addresses</para>
</listitem>
<listitem>
<para>Configuring VLANs for projects</para>
</listitem>
<listitem>
<para>Configuring networks for compute
nodes</para>
</listitem>
</itemizedlist>
</simplesect>
</section>
</section> </section>
<xi:include href="../common/section_cli_nova_customize_flavors.xml"/> <xi:include href="compute/section_compute-images-instances.xml"/>
<section xml:id="admin-password-injection">
<?dbhtml stop-chunking?>
<title>Admin password injection</title>
<para>You can configure Compute to generate a random administrator (root) password and
inject that password into the instance. If this feature is enabled, a user can
<command>ssh</command> to an instance without an <command>ssh</command> keypair. The
random password appears in the output of the <command>nova boot</command> command. You
can also view and set the <literal>admin</literal> password from the dashboard.</para>
<simplesect>
<title>Dashboard</title>
<para>The dashboard is configured by default to display the <literal>admin</literal>
password and allow the user to modify it.</para>
<para>If you do not want to support password injection, we
recommend disabling the password fields by editing
your Dashboard <filename>local_settings</filename>
file (file location will vary by Linux distribution,
on Fedora/RHEL/CentOS: <filename>
/etc/openstack-dashboard/local_settings</filename>,
on Ubuntu and Debian:
<filename>/etc/openstack-dashboard/local_settings.py</filename>
and on openSUSE and SUSE Linux Enterprise Server:
<filename>/srv/www/openstack-dashboard/openstack_dashboard/local/local_settings.py</filename>)
<programlisting language="ini">OPENSTACK_HYPERVISOR_FEATURE = {
...
'can_set_password': False,
}</programlisting></para>
</simplesect>
<simplesect>
<title>Libvirt-based hypervisors (KVM, QEMU, LXC)</title>
<para>For hypervisors such as KVM that use the libvirt backend, <literal>admin</literal>
password injection is disabled by default. To enable it, set the following option in
<filename>/etc/nova/nova.conf</filename>:</para>
<para>
<programlisting language="ini">[libvirt]
inject_password=true</programlisting>
</para>
<para>When enabled, Compute will modify the password of
the root account by editing the
<filename>/etc/shadow</filename> file inside of
the virtual machine instance.</para>
<note>
<para>Users can only ssh to the instance by using the
admin password if:</para>
<itemizedlist>
<listitem>
<para>The virtual machine image is a Linux
distribution</para>
</listitem>
<listitem>
<para>The virtual machine has been configured to allow users to
<command>ssh</command> as the root user. This is not the case for
<link xlink:href="http://cloud-images.ubuntu.com/">Ubuntu cloud
images</link>, which disallow <command>ssh</command> to the root
account by default.</para>
</listitem>
</itemizedlist>
</note>
</simplesect>
<simplesect>
<title>XenAPI (XenServer/XCP)</title>
<para>Compute uses the XenAPI agent to inject passwords into guests when using the
XenAPI hypervisor backend. The virtual-machine image must be configured with the
agent for password injection to work.</para>
</simplesect>
<simplesect>
<title>Windows images (all hypervisors)</title>
<para>To support the <literal>admin</literal> password for Windows virtual machines, you
must configure the Windows image to retrieve the <literal>admin</literal> password
on boot by installing an agent such as <link
xlink:href="https://github.com/cloudbase/cloudbase-init"
>cloudbase-init</link>.</para>
</simplesect>
</section>
<xi:include href="../common/section_cli_nova_volumes.xml"/>
<xi:include href="compute/section_compute-networking-nova.xml"/> <xi:include href="compute/section_compute-networking-nova.xml"/>
<xi:include href="compute/section_compute-system-admin.xml"/> <xi:include href="compute/section_compute-system-admin.xml"/>
<xi:include href="../common/section_support-compute.xml"/> <xi:include href="../common/section_support-compute.xml"/>

171
doc/admin-guide-cloud/compute/section_compute-system-admin.xml
View File

@@ -83,94 +83,6 @@
</listitem> </listitem>
</itemizedlist> </itemizedlist>
</para> </para>
<section xml:id="section_compute-service-arch">
<title>Compute service architecture</title>
<para>The following basic categories describe the service architecture and what's going
on within the cloud controller.</para>
<simplesect>
<title>API server</title>
<para>At the heart of the cloud framework is an API server. This API server makes
command and control of the hypervisor, storage, and networking programmatically
available to users.</para>
<para>The API endpoints are basic HTTP web services
which handle authentication, authorization, and
basic command and control functions using various
API interfaces under the Amazon, Rackspace, and
related models. This enables API compatibility
with multiple existing tool sets created for
interaction with offerings from other vendors.
This broad compatibility prevents vendor
lock-in.</para>
</simplesect>
<simplesect>
<title>Message queue</title>
<para>A messaging queue brokers the interaction
between compute nodes (processing), the networking
controllers (software which controls network
infrastructure), API endpoints, the scheduler
(determines which physical hardware to allocate to
a virtual resource), and similar components.
Communication to and from the cloud controller is
by HTTP requests through multiple API
endpoints.</para>
<para>A typical message passing event begins with the API server receiving a request
from a user. The API server authenticates the user and ensures that the user is
permitted to issue the subject command. The availability of objects implicated in
the request is evaluated and, if available, the request is routed to the queuing
engine for the relevant workers. Workers continually listen to the queue based on
their role, and occasionally their type host name. When an applicable work request
arrives on the queue, the worker takes assignment of the task and begins its
execution. Upon completion, a response is dispatched to the queue which is received
by the API server and relayed to the originating user. Database entries are queried,
added, or removed as necessary throughout the process.</para>
</simplesect>
<simplesect>
<title>Compute worker</title>
<para>Compute workers manage computing instances on
host machines. The API dispatches commands to
compute workers to complete these tasks:</para>
<itemizedlist>
<listitem>
<para>Run instances</para>
</listitem>
<listitem>
<para>Terminate instances</para>
</listitem>
<listitem>
<para>Reboot instances</para>
</listitem>
<listitem>
<para>Attach volumes</para>
</listitem>
<listitem>
<para>Detach volumes</para>
</listitem>
<listitem>
<para>Get console output</para>
</listitem>
</itemizedlist>
</simplesect>
<simplesect>
<title>Network Controller</title>
<para>The Network Controller manages the networking
resources on host machines. The API server
dispatches commands through the message queue,
which are subsequently processed by Network
Controllers. Specific operations include:</para>
<itemizedlist>
<listitem>
<para>Allocate fixed IP addresses</para>
</listitem>
<listitem>
<para>Configuring VLANs for projects</para>
</listitem>
<listitem>
<para>Configuring networks for compute
nodes</para>
</listitem>
</itemizedlist>
</simplesect>
</section>
<section xml:id="section_manage-compute-users"> <section xml:id="section_manage-compute-users">
<title>Manage Compute users</title> <title>Manage Compute users</title>
<para>Access to the Euca2ools (ec2) API is controlled by <para>Access to the Euca2ools (ec2) API is controlled by
@@ -182,6 +94,82 @@
<para>To begin using Compute, you must create a user with <para>To begin using Compute, you must create a user with
the Identity Service.</para> the Identity Service.</para>
</section> </section>
<xi:include href="../../common/section_cli_nova_volumes.xml"/>
<xi:include href="../../common/section_cli_nova_customize_flavors.xml"/>
<xi:include href="../../common/section_compute_config-firewalls.xml"/>
<section xml:id="admin-password-injection">
<?dbhtml stop-chunking?>
<title>Inject administrator password</title>
<para>You can configure Compute to generate a random administrator (root) password and
inject that password into the instance. If this feature is enabled, a user can
<command>ssh</command> to an instance without an <command>ssh</command> keypair. The
random password appears in the output of the <command>nova boot</command> command. You
can also view and set the <literal>admin</literal> password from the dashboard.</para>
<simplesect>
<title>Dashboard</title>
<para>The dashboard is configured by default to display the <literal>admin</literal>
password and allow the user to modify it.</para>
<para>If you do not want to support password injection, we
recommend disabling the password fields by editing
your Dashboard <filename>local_settings</filename>
file (file location will vary by Linux distribution,
on Fedora/RHEL/CentOS: <filename>
/etc/openstack-dashboard/local_settings</filename>,
on Ubuntu and Debian:
<filename>/etc/openstack-dashboard/local_settings.py</filename>
and on openSUSE and SUSE Linux Enterprise Server:
<filename>/srv/www/openstack-dashboard/openstack_dashboard/local/local_settings.py</filename>)
<programlisting language="ini">OPENSTACK_HYPERVISOR_FEATURE = {
...
'can_set_password': False,
}</programlisting></para>
</simplesect>
<simplesect>
<title>Libvirt-based hypervisors (KVM, QEMU, LXC)</title>
<para>For hypervisors such as KVM that use the libvirt backend, <literal>admin</literal>
password injection is disabled by default. To enable it, set the following option in
<filename>/etc/nova/nova.conf</filename>:</para>
<para>
<programlisting language="ini">[libvirt]
inject_password=true</programlisting>
</para>
<para>When enabled, Compute will modify the password of
the root account by editing the
<filename>/etc/shadow</filename> file inside of
the virtual machine instance.</para>
<note>
<para>Users can only ssh to the instance by using the
admin password if:</para>
<itemizedlist>
<listitem>
<para>The virtual machine image is a Linux
distribution</para>
</listitem>
<listitem>
<para>The virtual machine has been configured to allow users to
<command>ssh</command> as the root user. This is not the case for
<link xlink:href="http://cloud-images.ubuntu.com/">Ubuntu cloud
images</link>, which disallow <command>ssh</command> to the root
account by default.</para>
</listitem>
</itemizedlist>
</note>
</simplesect>
<simplesect>
<title>XenAPI (XenServer/XCP)</title>
<para>Compute uses the XenAPI agent to inject passwords into guests when using the
XenAPI hypervisor backend. The virtual-machine image must be configured with the
agent for password injection to work.</para>
</simplesect>
<simplesect>
<title>Windows images (all hypervisors)</title>
<para>To support the <literal>admin</literal> password for Windows virtual machines, you
must configure the Windows image to retrieve the <literal>admin</literal> password
on boot by installing an agent such as <link
xlink:href="https://github.com/cloudbase/cloudbase-init"
>cloudbase-init</link>.</para>
</simplesect>
</section>
<section xml:id="section_manage-the-cloud"> <section xml:id="section_manage-the-cloud">
<title>Manage the cloud</title> <title>Manage the cloud</title>
<para>A system administrator can use the <command>nova</command> client and the <para>A system administrator can use the <command>nova</command> client and the
@@ -250,16 +238,15 @@
</para> </para>
</step> </step>
</procedure> </procedure>
<simplesect> <section xml:id="section_euca2ools">
<title>Use the euca2ools commands</title> <title>Use the euca2ools commands</title>
<para>For a command-line interface to EC2 API calls, use the <para>For a command-line interface to EC2 API calls, use the
<command>euca2ools</command> command-line tool. See <link <command>euca2ools</command> command-line tool. See <link
xlink:href="http://open.eucalyptus.com/wiki/Euca2oolsGuide_v1.3" xlink:href="http://open.eucalyptus.com/wiki/Euca2oolsGuide_v1.3"
>http://open.eucalyptus.com/wiki/Euca2oolsGuide_v1.3</link></para> >http://open.eucalyptus.com/wiki/Euca2oolsGuide_v1.3</link></para>
</simplesect> </section>
<xi:include href="../../common/section_cli_nova_usage_statistics.xml"/>
</section> </section>
<xi:include
href="../../common/section_cli_nova_usage_statistics.xml"/>
<section xml:id="section_manage-logs"> <section xml:id="section_manage-logs">
<title>Manage logs</title> <title>Manage logs</title>
<simplesect> <simplesect>

2
doc/common/section_cli_nova_volumes.xml
View File

@@ -5,7 +5,7 @@
xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:xlink="http://www.w3.org/1999/xlink"
version="5.0" version="5.0"
xml:id="nova_cli_volumes"> xml:id="nova_cli_volumes">
<title>Volumes</title> <title>Manage Volumes</title>
<para>Depending on the setup of your cloud provider, they may give you an endpoint to use to <para>Depending on the setup of your cloud provider, they may give you an endpoint to use to
manage volumes, or there may be an extension under the covers. In either case, you can use the manage volumes, or there may be an extension under the covers. In either case, you can use the
<command>nova</command> CLI to manage volumes:</para> <command>nova</command> CLI to manage volumes:</para>