11. Open Source
Apache 2.0 license, NO ‘enterprise’ version
Open Design
Open Design Summit
Open Development
Anyone can involve development process Open development management via
Launchpad & Github
Open Community
OpenStack Foundation in 2012
12. OpenStack Mission
"To produce the ubiquitous Open Source
cloud computing platform that will meet the
needs of public and private cloud providers
regardless of size, by being simple to
implement and massively scalable."
16. Where to Get Started?
Ubuntu 12.04 server 集成OpenStack
Trystack.org申请测试账号
devstack.sh一键安装
17. OpenStack Development
Authorization Hosting code &
(group membership) Bug tracking formal docs
Feature planning Mailing lists
(Blueprints)
User support
(Answers)
Wiki
Informal docs
Continuous
integration
18. Nova Key Features
ReST-base API
Asynchronous communication
Horizontally scalable
Shared nothing architecture*
Distribute everything
Test everything
100% Python Based
* http://en.wikipedia.org/wiki/Shared_nothing_architecture
* http://wiki.openstack.org/BasicDesignTenets
19. OpenStack Compute: Nova
nova-api
Compute API Server
OpenStack API, EC2 compatibility API
nova-compute
Compute worker
Manage compute host and VMs
Libvirt(QEMU,KVM,LXR), XenServer and XCP, ESX(i)*
nova-network
Network controller
Manage network resources: IPAM, VLAN, NAT
*http://wiki.openstack.org/HypervisorSupportMatrix
20. OpenStack Compute: Nova(cont.)
nova-scheduler
Determines the placement of new resources
nova-volume
Block storage, remote attach a LVM volume using iSCISI protocol
Like Amazon EBS, but far way from mature
RabbitMQ
Message Queue
Cast and RPC Call for services
23. Nova Network
L2
FLAT, FLATDHCP, VLAN
L3
IPAM(IP Address Management)
Fixed IP, Floating IP
Gateway, NAT, VPN
24. Quantum
Quantum Basics
Nova: virtual server
Quantum: virtual network
Quantum :
Expose a API for creating virtual networks and attaching
instances(e.g.,novaservers) to those networks
Manage switches(virtual or physical) in the data center to
implement connectivity described via API
Provide a“plugin” architecture to leverage support using different
back-end technologies
26. Quantum: available plugins
Open vSwitch
- Builds isolated networks with OVS and L2-in-L3 tunnel
Cisco UCS
- Isolation based on VLAN and net-profiles applied to Cisco
UCS converged network adapters
Linux Bridge
- Build isolated networks with VLAN interfaces and linux
bridges
- Works with every Linux Distro
NTT-Data Ryu
- Acts as a proxy for the NTT Ryu platform
Nicira NVP
- Acts as a proxy for the Nicira NVP platform
27. Swift: Storage Types
Types Protocol Application
Block Storage SATA, SCISI, iSCISI SAN, NAS, EBS
File Storage Ext3/4, XFS, NTFS PC, Servers, NFS
Object Storage HTTP, REST Amazon S3,
Google Cloud Storage,
Rackspace Cloud Files
Specific Storage Specific protocol MySQL, MongoDB,
based on tcp HDFS
We want a Object Storage like Amazon S3.
28. Features Swift Amazon S3
object/bucket CRUD √ √
account/bucket/object ACL √ √
object metadate √ √
large object √ √
rate limit √ √
Swift expiring object √ √
vs static web √ √
REST API √ √
Amazon S3 Account support √ X
Account metadata √ X
Bucket metadata √ X
Bucket sync across cluster √ X
Object versioning X √
Log to bucket X √
Notification X √
Reduced Redundancy Storage X √
SOAP API X √
Server Side Encryption X √
BitTorrent protocol X √
29. Swift Evaluation
Extremely Durable and Highly Available
Superior Scalability
Linear Growth of Performance
Symmetric Architecture
No Single-failure
Simple & Reliable
30. Swift Components
The Ring: Mapping of names to entities (accounts,containers,
objects) on disk.
Stores data based on zones, devices, partitions, and replicas
Weights can be used to balance the distribution of partitions
Used by the Proxy Server for many background processes
Proxy Server: Request routing, exposes the public API
Replication: Keep the system consistent, handle failures
Updaters: Process failed or queued updates
Auditors: Verify integrity of objects, containers, and account
31. Swift Architecture
• 1 Zone = 1 Physical Server with 12x2T disk
GET abc.png • Write/Read applies quorum protocol
PUT abc.png
Load Balancer
Zone1 Zone2 Zone3 Zone4 Zone5
Proxy Server Proxy Server Proxy Server Proxy Server Proxy Server
Object Server Object Server Object Server Object Server Object Server
Container Container Container Container Container
Server Server Server Server Server
Account Server Account Server Account Server Account Server Account Server
31
32. Swift Installation
Swift packages
Proxy Server
Account Server
Container Server
Object Server Physical Deployment
Storage Nodes
OS installation
sda sdb sdc sdd sdk
raid 1 ……
disk1 disk2 disk3 disk4 disk5 disk12
35. Infrastructure & Platform
Physical Servers
Traditional Operation
Virtualization Platform(IaaS)
●VM Management System(VMMS) → Sina Web
Service(SWS)
●VMMS is private solution developed in-house
●SWS is based on OpenStack
新浪云计算
Application Platform(PaaS)
●Virtual Host → Sina App Engine(SAE)
●SAE provides both Public and Private Service.
●Proved to be Efficient and Robust
36. Nova Network
Networking is the biggest challenges for IaaS
Network Topology:
• VLAN
• FlatDHCP
• FlatDHCP & Multihost
37. Network Topology (VLAN)
Capability:
• Accessibility of VMs within one tenant
• Isolation of VMs from different tenants
• VM is able to access public network
• VM can be accessible from public network
• Isolation between virtual network and
internal network
Drawback:
• Pre-allocate network for future projects
• Hard-limit of vlan 4096
• Traffic bottleneck in the gateway/NAT
38. Network Topology(Flat)
Capability:
• Accessibility of all VMs in the fixed IP
range
• VM is able to access public network
• VM can be accessible from public network
• Full isolation between virtual network and
internal network
Bonus:
• Do not need pre-allocate for new projects
• Eliminating bottleneck between tenants
Drawback:
• Tenant isolation has gone
• Traffic bottleneck still exists in NAT
39. Network Topology(Flat & Multihost)
Capability:
• Accessibility of all VMs in the fixed IP range
• VM is able to access public network
• VM can be accessible from public network
Bonus:
• Totally distributed architecture avoid single-
point failure.
• Multiple gateway eliminates NAT bottleneck
• High speed between OS regions
Drawback:
• Tenant isolation lessens
• Need security facility(SWS-filter) to protect
intranet
If security problems were solved, this would be our best choice!
40. Security in OpenStack
Security Group --- L3 Filter Static filters --- L2 Filter
Role-based firewall MAC, IP, and ARP spoofing protection
One security group is a Role Not configurable
Ingress filtering Defined in /etc/libvirt/nwfilter/*.xml
Target is the instance Implemented by ebtables
Source can be CIDR or another group ebtables -t nat --list
Implemented by iptables
See details: iptables -t filter -n -L
Whitelist mechanism(ACCEPT rules)
41. Security Enhancement
SWS Filter
Prevent Intranet Penetration
• Intranet is the internal network outside of
OpenStack
Egress filtering
• Target is internal network
• Source is instances in OpenStack
Implementation
• Whitelist mechanism(ACCEPT rules)
• On the top of nova-filter-top Forward
Chain
Rational
• SWS filter is managed by cloud manager
• Only explicit authorized packets can reach Internal network C
• Packet should be controlled within Compute Node
43. Load Balancer
Goals
Load Balance
• Dispatch request DNS Acceleration Design
• Support multiple routing algorithm
• Health check
Smart DNS
Acceleration
• Reality: narrow bandwidth between ISPs
• Building fiber channels from ISPs to pivot Public Network
• Given the same endpoint within user’s ISP
Telecom Unicom Mobile Others ISP
IPv4 Shortage
• Reality: dozens of public IPs support
hundreds of VMs High speed fiber channel
• IPv4 has been exhausted
• IPv6 is not realistic yet in China
Pivot
49. Sina Contributions
Sina creating open source project “Dough” to contribute
metering & billing capability
Present in OpenStack Design Summit & Conference
49
![Conclusion
核心功能基本可用，但稳定性需要加强
云服务(web service)比较丰富
起步虽晚，但发展飞快，OpenStack生态系统正
在形成
逻辑结构清晰、文档丰富、源码规范易懂，便
于二次开发
Open [Source | Desgin | Development |
Community]](https://image.slidesharecdn.com/openstackinsinaen-120519213832-phpapp01/85/Open-stack-in-sina-33-320.jpg)
