![Page 1: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/1.jpg)
A one stop solution
for Puppet and Openstack
Daniel Lobato Garcia
daniel.lobato.garcia@cern,ch
@eLobatoss
![Page 2: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/2.jpg)
![Page 3: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/3.jpg)
What is CERN
Between Geneva and the Jura mountains, straddling the Swiss-French border
Mission: learn what is the universe made of and how does it work?
3
![Page 4: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/4.jpg)
Fundamental
questions in
physics
Why do particles have mass?
What is 96% of the universe made of?
Why isn’t there anti-matter in the universe?
What was the state of matter after the Big Bang?
4
![Page 5: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/5.jpg)
8/12/2013 Document reference 5
![Page 6: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/6.jpg)
8/12/2013 Document reference 6
![Page 7: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/7.jpg)
8/12/2013 Document reference 7
![Page 8: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/8.jpg)
8/12/2013 Document reference 8
![Page 9: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/9.jpg)
Current status
• 270 Openstack hypervisors
• 2900 virtual machines
• 300 users
• 14 Puppet masters
• 6 Foreman backend nodes
• Some production services migrating to our
cloud – early birds
9
![Page 10: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/10.jpg)
Goals
• Ramp up to 15K hypervisors – 150-200K
vms in 2015
• Multi-site (Hungary)
10
![Page 11: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/11.jpg)
8/12/2013 Document reference 11
![Page 12: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/12.jpg)
8/12/2013 Document reference 12
![Page 13: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/13.jpg)
Why?
• Unnecessary homebrew stack of tools
• Shift to cloud standards with minimal
customizations
• High turnover – can’t teach new tools
13
![Page 14: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/14.jpg)
Why?
• Symbiotic relationship with the community
14
![Page 15: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/15.jpg)
Openstack?
• Modular IaaS free open source project
• APIs ~compatible with those of Amazon
15
![Page 16: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/16.jpg)
Openstack Nova
(compute)
Cloud fabric controller
16
![Page 17: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/17.jpg)
Openstack
Keystone (Identity)
RBAC
Integrated with LDAP
Multiple auth* methods
17
![Page 18: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/18.jpg)
Openstack Glance
(Images)
Discovery, registration,
delivery of images
18
![Page 19: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/19.jpg)
Openstack Horizon
(Dashboard)
19
![Page 20: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/20.jpg)
Modules
• Puppet definitions for every use case you
can imagine.
• Dynamic environments
• Hadoop node
• Openstack hypervisor
• … you name it
20
![Page 21: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/21.jpg)
21
Workflow..?
![Page 22: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/22.jpg)
Modules and Git
• Manifests and hieradata are version
controlled
22
![Page 23: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/23.jpg)
23
Git workflow
Puppet masters
![Page 24: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/24.jpg)
24
Easy cherry pick
![Page 25: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/25.jpg)
25
Git workflow
![Page 26: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/26.jpg)
26
Git workflow
Jens
‘Puppetfiles’
Separate repositories
Makes environments from
YAML config files
Puppet master
rsync
![Page 27: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/27.jpg)
27
upstream.yaml --- default: production notifications: [email protected] overrides: modules: foreman: upstream puppet: upstream
‘Puppetfiles’
![Page 28: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/28.jpg)
Foreman
• Lifecycle management tool for VMs and
physical servers
• External Node Classifier – tells the puppet
master what a node should look like
28
![Page 29: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/29.jpg)
29
![Page 30: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/30.jpg)
30
![Page 31: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/31.jpg)
Power operations & Foreman
8/12/2013 Document reference 31
Foreman Proxy
Physical
box IPMI
Physical
box IPMI
Physical
box IPMI
VM VM VM
Openstack
Nova API
![Page 32: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/32.jpg)
Openstack VM creation
8/12/2013 Document reference 32
![Page 33: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/33.jpg)
Openstack VM creation
8/12/2013 Document reference 33
![Page 34: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/34.jpg)
Openstack VM creation
8/12/2013 Document reference 34
![Page 35: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/35.jpg)
Scalability experiences
• Split up services
• Puppet – critical vs non critical
35
12 backend nodes
Batch
4 backend nodes
Interactive
![Page 36: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/36.jpg)
Scalability experiences
• Foreman – split into different services
36
ENC Reports
processing UI/API
Load balancer
9443 – UI/API
9444 – Reports
9445 – ENC
…
![Page 37: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/37.jpg)
Scalability experiences
• Autoscale via alarms (Heat)
• Define situations (i.e: load threshold..)
• Spin up VMs as needed
37
![Page 38: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/38.jpg)
Scalability guidelines
38
![Page 39: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/39.jpg)
github.com
/
cernops
39
![Page 40: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/40.jpg)
40
![Page 41: A one stop solution for Puppet and Openstack · Openstack Keystone (Identity) RBAC Integrated with LDAP Multiple auth* methods 17 . Openstack Glance (Images) Discovery, registration,](https://reader035.vdocuments.us/reader035/viewer/2022063018/5fdbce5954d5774cc944ffb8/html5/thumbnails/41.jpg)