41
A one stop solution for Puppet and Openstack Daniel Lobato Garcia daniel.lobato.garcia@cern,ch @eLobatoss

A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

  • Upload
    others

  • View
    7

  • Download
    0

Embed Size (px)

Citation preview

Page 1: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

A one stop solution

for Puppet and Openstack

Daniel Lobato Garcia

daniel.lobato.garcia@cern,ch

@eLobatoss

Page 2: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,
Page 3: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

What is CERN

Between Geneva and the Jura mountains, straddling the Swiss-French border

Mission: learn what is the universe made of and how does it work?

3

Page 4: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Fundamental

questions in

physics

Why do particles have mass?

What is 96% of the universe made of?

Why isn’t there anti-matter in the universe?

What was the state of matter after the Big Bang?

4

Page 5: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

8/12/2013 Document reference 5

Page 6: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

8/12/2013 Document reference 6

Page 7: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

8/12/2013 Document reference 7

Page 8: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

8/12/2013 Document reference 8

Page 9: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Current status

• 270 Openstack hypervisors

• 2900 virtual machines

• 300 users

• 14 Puppet masters

• 6 Foreman backend nodes

• Some production services migrating to our

cloud – early birds

9

Page 10: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Goals

• Ramp up to 15K hypervisors – 150-200K

vms in 2015

• Multi-site (Hungary)

10

Page 11: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

8/12/2013 Document reference 11

Page 12: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

8/12/2013 Document reference 12

Page 13: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Why?

• Unnecessary homebrew stack of tools

• Shift to cloud standards with minimal

customizations

• High turnover – can’t teach new tools

13

Page 14: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Why?

• Symbiotic relationship with the community

14

Page 15: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Openstack?

• Modular IaaS free open source project

• APIs ~compatible with those of Amazon

15

Page 16: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Openstack Nova

(compute)

Cloud fabric controller

16

Page 17: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Openstack

Keystone (Identity)

RBAC

Integrated with LDAP

Multiple auth* methods

17

Page 18: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Openstack Glance

(Images)

Discovery, registration,

delivery of images

18

Page 19: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Openstack Horizon

(Dashboard)

19

Page 20: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Modules

• Puppet definitions for every use case you

can imagine.

• Dynamic environments

• Hadoop node

• Openstack hypervisor

• … you name it

20

Page 21: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

21

Workflow..?

Page 22: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Modules and Git

• Manifests and hieradata are version

controlled

22

Page 23: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

23

Git workflow

Puppet masters

Page 24: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

24

Easy cherry pick

Page 25: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

25

Git workflow

Page 26: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

26

Git workflow

Jens

‘Puppetfiles’

Separate repositories

Makes environments from

YAML config files

Puppet master

rsync

Page 27: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

27

upstream.yaml --- default: production notifications: [email protected] overrides: modules: foreman: upstream puppet: upstream

‘Puppetfiles’

Page 28: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Foreman

• Lifecycle management tool for VMs and

physical servers

• External Node Classifier – tells the puppet

master what a node should look like

28

Page 29: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

29

Page 30: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

30

Page 31: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Power operations & Foreman

8/12/2013 Document reference 31

Foreman Proxy

Physical

box IPMI

Physical

box IPMI

Physical

box IPMI

VM VM VM

Openstack

Nova API

Page 32: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Openstack VM creation

8/12/2013 Document reference 32

Page 33: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Openstack VM creation

8/12/2013 Document reference 33

Page 34: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Openstack VM creation

8/12/2013 Document reference 34

Page 35: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Scalability experiences

• Split up services

• Puppet – critical vs non critical

35

12 backend nodes

Batch

4 backend nodes

Interactive

Page 36: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Scalability experiences

• Foreman – split into different services

36

ENC Reports

processing UI/API

Load balancer

9443 – UI/API

9444 – Reports

9445 – ENC

Page 37: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Scalability experiences

• Autoscale via alarms (Heat)

• Define situations (i.e: load threshold..)

• Spin up VMs as needed

37

Page 38: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

Scalability guidelines

38

Page 39: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

github.com

/

cernops

39

Page 40: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,

40

Page 41: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,