Breaking the Kubernetes Kill Chain: Host Path Mount
Intro to Cloudstack
1. Intro to Cloudstack
Sebastien Goasguen
July 10th, Ecole des Mines de Nantes,
France
2. Info
• Apache incubator project
• http://www.cloudstack.org
• #cloudstack on irc.freenode.net
• @cloudstack on Twitter
• http://cloudstack.org/discuss/mailing-lists.html
Welcoming contributions and feedback, Join the
fun !
4. Terminology
Zone: Availability zone,
aka Regions. Could be
worldwide. Different data
centers
Pods: Racks or aisles in a
data center
Clusters: Group of
machines with a common
type of Hypervisor
Host: A Single server
Primary Storage: Shared
storage across a cluster
Secondary Storage:
Shared storage in a single
Zone
5. Storage
• Primary Storage:
– Anything that can be mounted on the node of a cluster.
– Cluster LVM…iSCSI…
– Holds disk images of running VMs
• Secondary Storage:
– Available across the zone
– Holds snapshots and templates (image repo)
– Can use Openstack swift or any object store (Gluster FS…)
• Can use NFS for both to start
6. Physical Network
Operations
Users
Admin and
Cloud API
CloudStack
Mgmt Server
Cluster Router
MySQL
Load Balancer
Availability Zone
L3 Core Switch
Access
Layer
Switches
…
Secondary
Servers
Storage
… … … …
Pod 1 Pod 2 Pod 3 Pod N
Slide from Chiradeep Vittal, http://www.slideshare.net/cloudstack/cloudstack-networking
7. Cloud Interactions OVM Cluster Primary
Storage
Ap i
Xen vcenter
Monitoring Primary
CS API Clu I
ste AP vSphere Cluster
Storage
r
rM nte
End gm vCe
t
User UI
Primary
XS Cluster Storage
Admin
UI
Clustered
CloudStack XAPI
Domain CS Admin & CloudStack
CloudStack
End-user API Primary
Admin
UI Management JSON KVM Cluster Storage
Server
NetConf
Juniper SRX
Cloud user Nitro API
{API client (Fog/etc)} VNC
JSON
ec2 API JSON Netscaler
Cloud user Console
Console
{ec2 API client } Proxy VM
Proxy VM NFS
MySQL Server
Sec. Storage NFS NFS
{Proxied} SSH Sec. Storage
VM
Ajax HTTPS VM
Console
Router VM HTTP (Template Download)
Router VM HTTP (Template Copy)
Router VM
Cloud user HTTP (Swift)
http://www.slideshare.net/cloudstack/cloudstack-architecture
8. Inside a Management Server
• Tomcat application
• Async jobs, ESB, REST API
Plugins
cmd.execute() Plugins
CloudStack Commands
Async Plugins
API API Job
Ser Queu Serv
vlet e ices Kernel
Responses
Mgr API
Agent Mess Resource
API age
(Cmds) Local s
Bus
Or
Remote
Agent
Manager
Hypervisor Network
Native Device
APIs API
MySQL
http://www.slideshare.net/cloudstack/cloudstack-architecture
9. Layer-2 Guest Virtual Network
CS Virtual Router provides Network Services External Devices provide Network Services
Network Hardware exposing API can be controlled
Guest Virtual Network 10.1.1.1/8 Guest Virtual Network 10.1.1.1/8
VLAN 100 VLAN 100
Public Public
Network/Inter Network/Inter
net Guest net Guest
Public IP Private IP 10.1.1.1
10.1.1.1 VM 1 10.1.1.111 VM 1
Gateway 65.37.141.11 Juniper
Public IP 1 SRX
address
65.37.141.11 CS Firewall
10.1.1.1 Guest Guest
Virtual
10.1.1.3 VM 2 10.1.1.3 VM 2
Router
Public IP Private IP
DHCP, DNS 65.37.141. NetScaler 10.1.1.112
NAT Guest 112 Load Guest
Load Balancing 10.1.1.4 VM 3 Blancer VM 3
10.1.1.4
VPN
Guest Guest
10.1.1.5 VM 4 10.1.1.5 VM 4
CS
DHCP, Virtual
Router
DNS
Slide from Chiradeep Vittal, http://www.slideshare.net/cloudstack/cloudstack-networking
10. Other Topologies
No services [Static Ips] Dedicated VLAN with DHCP and DNS
User can request specific IP[s] for NIC
Guest Virtual Network 10.1.1.0/24 Guest Virtual Network 10.1.1.0/24
VLAN 100 VLAN 100
Guest Guest
VM 1 10.1.1.1 VM 1
10.1.1.1
Gateway address
10.1.1.1
Guest Guest
10.1.1.3 VM 2 Gateway 10.1.1.3 VM 2
address
10.1.1.1
Guest Guest
Core switch 10.1.1.4 VM 3 VM 3
10.1.1.4
Guest
Core switch Guest
10.1.1.5 VM 4 10.1.1.5 VM 4
DHCP, CS
DNS Virtual
Router
User-data
Slide from Chiradeep Vittal, http://www.slideshare.net/cloudstack/cloudstack-networking
12. A very extensive API
http://download.cloud.com/releases/3.0.3/api_3.0.3/TOC_Root
_Admin.html
13. Making API calls
Can be authenticated or not.
HTTP call.
User Keys can be generated via the GUI
Base url: http://<manager-host>:8080/client/api?….
def make_request(requests, secretKey):
request = zip(requests.keys(), requests.values())
request.sort(key=lambda x: str.lower(x[0]))
requestUrl = "&".join(["=".join([r[0], urllib.quote_plus(str(r[1]))]) for r in request])
hashStr = "&".join(["=".join([str.lower(r[0]),
str.lower(urllib.quote_plus(str(r[1]))).replace("+", "%20")]) for r in request])
sig = urllib.quote_plus(base64.encodestring(hmac.new(secretKey, hashStr,
hashlib.sha1).digest()).strip())
print "Signature: %s"%sig
requestUrl += "&signature=%s"%sig
print requestUrl
if __name__ == '__main__':
requests = {
"apiKey": "BRZ5j4E8O4di2MZWnQsYBLThCrTGO-LGeZaMjsnvelkHuY5P8FdTnluNZTDQhCUy-
wqeJzk8EAc_NbcZxTF_FA",
"response" : "json",
"command" : "listZones"
}
secretKey = "bFlx2llt3OmM4AiHzfwV1ZbuJ5tsv6hAx6IeM32CkM-obCA77BRwBr3_yQ0bO1-kdZyfD3-lY6khsXCx18n3Mw"
make_request(requests, secretKey)
14. EC2 compatibility via Cloudbridge
• Significant development work happening to
make Cloudstack highly compatible with EC2
API.
• http://wiki.cloudstack.org/display/RelOps/EC2+AP
• Euca tools, boto etc…should work with
cloudstack.
• Lots of potential for contributions…
15. Note: System VMs
• When a Zone is enabled some system VMs get
started:
– Router for instances
– Proxy for console access
– Manage secondary storage
• Different from Opennebula and Nimbus,
needs to get used to.
• 3 IP addresses need to be reserved for those.
16. Note: Highly Scalable
• See:
– http://www.slideshare.net/cloudstack/scalability-1281
– From Alex Huang. 10k “resources” managed per
Mgt server. 30k resources with 30k VM in
simulation.
• Management server can be setup in a multi-
node configuration with a load-balancer and
replicated MySQL.
17. Note: DevCloud
• A Virtual box appliance packaged to provide a
working Cloudstack environment.
• Available since last week , from Edison Su
• Aimed at developers but has other use cases:
– Xen PV hosts gives nested virtualization
– Local EC2 Cloud on your laptop
– Networking experiments ?
• http://wiki.cloudstack.org/display/comm/DevClou
18. Note: VM Placement
• Scheduling of VMs
• Stack them, spread them, random…
• Configurable