How do I?

User Tools

Site Tools

You are here: start » cloud » intro
cloud:intro

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
Next revisionBoth sides next revision
cloud:intro [2019/12/06 15:21] – [Annotated Example] chudlercloud:intro [2020/01/17 11:51] – kauffman
Line 1: Line 1:
 === SCOPE OF THIS DOCUMENT === === SCOPE OF THIS DOCUMENT ===
  
-This guide will cover a common subset of tasks that a user would need to perform to have a set of clustered computer instances and associated resources, isolated from others, and accessible to a project for any general purpose, both long-term and short. We are catering heavily to short-term usage, perhaps lasting a few quarters.+This guide covers the common subset of tasks that users would need to perform to have a set of clustered computer instances and associated resources, isolated from others, and accessible to a project for any general purpose, both long-term and short. We are catering heavily to short-term and periodic usage, perhaps lasting no more than a few quarters.
  
-Some things that are not here but perhaps should be covered elsewhere+Some things that are not written about here but perhaps should be covered elsewhere
  
-  * Theory of operations (everything is by example) +  * Theory of operations (everything here is by example) 
-  * Tasks accomplished from the Web Interface+  * Accomplishing tasks from the Web Interface
   * Background and History   * Background and History
-  * Organizational Policy, such as who can do what.+  * Alternative Services within CS and without 
 +  * Organizational Policy, such as who can do what
   * Deployment Architecture   * Deployment Architecture
-  * Limitations +  * Systemic Limitations
-  * User management, Group management, and similar concepts+
   * Good Practices (because they are nascent, at best)   * Good Practices (because they are nascent, at best)
   * Cloud init, Fog, Terraform, Heat, and other operational tools   * Cloud init, Fog, Terraform, Heat, and other operational tools
-  * Security+  * Network and Information Security
   * Backup and Restore   * Backup and Restore
  
Line 26: Line 26:
 === INTRODUCTION AND NOTES === === INTRODUCTION AND NOTES ===
  
-This cluster can spring into being computer resources, easily, and without any involvement of other personnel. The software has some exotic capabilities, but almost everyone will use this common subset:+This cluster can spring into being computer resources, easily, and without the involvement of other personnel. The software has some exotic capabilities, but almost everyone will use a common subset:
  
   * L2 and L3 Network   * L2 and L3 Network
   * Router (SNAT and DNAT devices, etc)   * Router (SNAT and DNAT devices, etc)
   * Compute, and all that it entails such as RAM, CPU, Disk, ...   * Compute, and all that it entails such as RAM, CPU, Disk, ...
-  * Block Storage (volume mounts)+  * Additional Block Storage (volume mounts)
   * Security groups (firewall service)   * Security groups (firewall service)
  
Line 42: Line 42:
   * NFS   * NFS
   * Rancher Kubernetes (among others)   * Rancher Kubernetes (among others)
 +  * Lots more
  
 == Web Access and Certificates == == Web Access and Certificates ==
  
-The cloud is named **Overcloud**. The web interface at [[https://overcloud.cs.uchicago.edu]] uses a non-public certificate authority. You will have to accept it for all purposes: API, HTTPS, and CLI clients.+The cloud is named **Overcloud**. The web interface uses a non-public certificate authority and can be reached at [[https://overcloud.cs.uchicago.edu]]. You will have to accept the certificate for all purposes: API, HTTPS, and CLI clients.
  
 NOTE: Our cloud DNS service might not meet your needs. Please test it anyway if you know how (TODO: document) NOTE: Our cloud DNS service might not meet your needs. Please test it anyway if you know how (TODO: document)
Line 81: Line 82:
 Use your favorite package manager on your own computer. Pip is preferred because the upstream packages it for themselves and it is in pure python. The general CS infrastructure will become a managed client for you to use in the near future (e.g., linux.cs.uchicago.edu). However, our experience has been that the software installs cleanly and is free from dependency problems. Use your favorite package manager on your own computer. Pip is preferred because the upstream packages it for themselves and it is in pure python. The general CS infrastructure will become a managed client for you to use in the near future (e.g., linux.cs.uchicago.edu). However, our experience has been that the software installs cleanly and is free from dependency problems.
  
-Try: <code>pip install python-openstackclient</code>+Try: <code>python3 -m pip install --user python-openstackclient</code>
  
 == PRELIMINARY SETUP == == PRELIMINARY SETUP ==
Line 166: Line 167:
 After creating your own network and subnet(s), a router is also needed. However, a router is **not** needed if your instances only talk to each other. The router will take the gateway of your subnet automatically, and allow clients to access the internet via outbound NAT. Much more is possible, and a router is a prerequisite for the next step, which is inbound NAT (DNAT). After creating your own network and subnet(s), a router is also needed. However, a router is **not** needed if your instances only talk to each other. The router will take the gateway of your subnet automatically, and allow clients to access the internet via outbound NAT. Much more is possible, and a router is a prerequisite for the next step, which is inbound NAT (DNAT).
 <code>openstack router create --enable myrouter <code>openstack router create --enable myrouter
-openstack router add subnet mysubnet</code>+openstack router add subnet myrouter mysubnet</code>
  
-With the router created and attached to your subnet, develop it further. First, you need to obtain a free IP address on the UC Campus. We call this network __campus37__. +With the router created and attached to your own subnet, develop it further. You need to obtain a free IP address on the UC Campus. We call this network __campus37__. The Internet-connected subnet on that network is called __public37__. 
-<code>openstack floating ip create campus37</code> + 
-The output of the command is shown below. Take not of the IP Address: +After this command, the router will have one leg in your subnet and one leg in the public campus network (and internet).
-<code> +
-+---------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ +
-| Field               | Value                                                                                                                                                                                       | +
-+---------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ +
-| created_at          | 2019-12-06T16:49:29Z                                                                                                                                                                        | +
-| description         |                                                                                                                                                                                             | +
-| dns_domain          |                                                                                                                                                                                             | +
-| dns_name            |                                                                                                                                                                                             | +
-| fixed_ip_address    | None                                                                                                                                                                                        | +
-| floating_ip_address | 128.135.37.244                                                                                                                                                                              | +
-| floating_network_id | f6a5f729-d5bf-4fa7-9cd9-e4ed23c7d48f                                                                                                                                                        | +
-| id                  | 7110ea40-8c32-4f99-8454-9a091bcd4623                                                                                                                                                        | +
-| location            | Munch({'project': Munch({'domain_name': 'Default', 'domain_id': None, 'name': 'admin', 'id': u'8fa4efd231fa4cfc886b3c55f9efdfa1'}), 'cloud': '', 'region_name': 'regionOne', 'zone': None}) | +
-| name                | 128.135.37.244                                                                                                                                                                              | +
-| port_details        | None                                                                                                                                                                                        | +
-| port_id             | None                                                                                                                                                                                        | +
-| project_id          | 8fa4efd231fa4cfc886b3c55f9efdfa1                                                                                                                                                            | +
-| qos_policy_id       | None                                                                                                                                                                                        | +
-| revision_number     | 0                                                                                                                                                                                           | +
-| router_id           | None                                                                                                                                                                                        | +
-| status              | DOWN                                                                                                                                                                                        | +
-| subnet_id           | None                                                                                                                                                                                        | +
-| tags                | []                                                                                                                                                                                          | +
-| updated_at          | 2019-12-06T16:49:29Z                                                                                                                                                                        | +
-+---------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+</code>+
  
 Only you will be able to use this address until you destroy it. **DONT ever take more than you need and free this resource as soon as you project ends.** Only you will be able to use this address until you destroy it. **DONT ever take more than you need and free this resource as soon as you project ends.**
- 
-Give this address to your Router, on a new interface. After this command, the router will have one leg in your subnet and one leg in the public campus network (and internet). The example above gave us 128.135.37.244. 
  
 <code> <code>
-openstack router set --fixed-ip subnet=$(openstack subnet show --format value --column id public37),ip-address=128.135.37.244 --external-gateway campus37 --enable-snat mynet+openstack router set myrouter --external-gateway campus37 --enable-snat
 </code> </code>
  
Line 222: Line 196:
 The command executed asynchronously, check the status: The command executed asynchronously, check the status:
  
-<code>openstack server list --name myserver +<code> 
-openstack server show myserver</code>+openstack server list --name myserver 
 +openstack server show myserver 
 +</code>
  
 Here's an example for creating 10 of them, as promised (only the change at the end of the command) Here's an example for creating 10 of them, as promised (only the change at the end of the command)
-<code>openstack server create --image bionic-server-cloudimg-amd64.raw --boot-from-volume=32 --flavor m1.small --config-drive=true --user-data=/home/chudler/openstack/cluster_test/cloud-init.yml --network mynet moar --min 10 --max 10</code>+<code> 
 +openstack server create \ 
 +  --image bionic-server-cloudimg-amd64.raw \ 
 +  --boot-from-volume=32 \ 
 +  --flavor m1.small \ 
 +  --config-drive=true \ 
 +  --user-data=/home/chudler/openstack/cluster_test/cloud-init.yml \ 
 +  --network mynet \ 
 +  --min 10 \ 
 +  --max 10 \ 
 +  myserver 
 +</code>
  
 Here's a nasty thing I use to determine what the security group is for a server (it can be determined also by looking at security groups directly) [ITS BRITTLE, BEWARE] Here's a nasty thing I use to determine what the security group is for a server (it can be determined also by looking at security groups directly) [ITS BRITTLE, BEWARE]
  
-<code>SEC_GROUP=$(openstack port list --server `openstack server show --format value --column id myserver` --long --column "Security Groups" --format json | jq '.[]."Security Groups"[]')</code>+<code> 
 +SEC_GROUP=$(openstack port list \ 
 +  --server `openstack server show --format value --column id myserver` \ 
 +  --long \ 
 +  --column "Security Groups" \ 
 +  --format json \ 
 +  | jq '.[]."Security Groups"[]' \ 
 +  | sed 's/"//g') 
 +</code>
  
 If I learned the security group successfully, I can let in SSH. By default, **no communication is possible**. If I learned the security group successfully, I can let in SSH. By default, **no communication is possible**.
/var/lib/dokuwiki/data/pages/cloud/intro.txt · Last modified: 2021/04/15 17:50 by chudler
Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki