Alert.png The wiki is deprecated and due to be decommissioned by the end of September 2022.
The content is being migrated to other supports, new updates will be ignored and lost.
If needed you can get in touch with EGI SDIS team using operations @ egi.eu.

Difference between revisions of "MAN10"

From EGIWiki
Jump to navigation Jump to search
 
(307 intermediate revisions by 9 users not shown)
Line 2: Line 2:


{{Ops_procedures
{{Ops_procedures
|Doc_title = Setting up Cloud Resource Centre
|Doc_title = Cloud Resource Centre Installation Manual
|Doc_link = [[MAN09|https://wiki.egi.eu/wiki/MAN10]]
|Doc_link = [[MAN09|https://wiki.egi.eu/wiki/MAN10]]
|Version =  19 August 2014
|Version =  19 May 2017
|Policy_acronym = OMB
|Policy_acronym = OMB
|Policy_name = Operations Management Board
|Policy_name = Operations Management Board
Line 10: Line 10:
|Doc_status = DRAFT
|Doc_status = DRAFT
|Approval_date =  
|Approval_date =  
|Procedure_statement = This manual provides information on how to set up Cloud Resource Centre.
|Procedure_statement = This manual provides information on how to set up a Resource Centre providing cloud resources in the EGI infrastructure.
}}  
}}  


{{Template:Block-comment
| name=Warning
| text=The installation manual is now available at https://docs.egi.eu/. Information below just points to the relevant sections of that manual
}}


= Introduction  =
EGI cloud supports 3 middlewares. It means you can base your cloud site installation on one of the following cloud software:
*OpenNebula
*OpenStack
*Synnefo
If you want to install an EGI Cloud Site please have a look at our EGI Cloud Site Installation Manuals below.
''<span style="color: rgb(51,102,255);">Note: EGI Cloud Site Installation Manual is a step-by-step instruction for Cloud Site Admin. The manual is not meant to be a comprehensive on topics related to the installation, it is a collection of steps taken by someone to install an EGI cloud site starting from a scratch. Commands executed should be made available for someone to copy&amp;paste and easily follow up. At some initial stage the manual may not cover all cases, but it is meant to be extended by other site admins while following up the manual. It is a living document.
</span>''
<br>
= The manuals  =
<span style="color: rgb(51,102,255);">'''''Current issues:'''''</span>
*<span style="color: rgb(51,102,255);">''Documentation for cloud components is written with assumption that the admin knows where (machine, neighbour components) this components should be installed. It is missing the general cloud site deployment context''</span>
*<span style="color: rgb(51,102,255);">''Documentation should address the prerequsities part.''</span><span style="color: rgb(51,102,255);">&nbsp;</span>
*<span style="color: rgb(51,102,255);">''Documentation should address the constraints and limitations part i.e. supported operating systems, software versions.''</span>
*<span style="color: rgb(51,102,255);">''Documentation should provide a contact person (per component) which can be contacted in case of questions/problems.&nbsp;''</span><span style="color: rgb(51,102,255);">&nbsp;</span>
*<span style="color: rgb(51,102,255);">''Documentation should provide commands for checking validity of installation.''</span><span style="color: rgb(51,102,255);">
</span>
== Prerequisities &amp; Limitations  ==
Whatever cloud stack you choose you need to prepare some things at the begining:
#Hardware (minimal hw requirements for small cloud site e.g up to 100 VMs): <br>
##number of physical machines, performance/capacity requirements: RAM size
##disk space - how big, where must be connected, performance of network links (images are heavy!)
#DNS names, X.509 certificates
#Register in fedcloud VO
#Registration in AppDB to have access to private EGI VM image repository
#What operating systems are supported
=Cloud management frameworks=
== OpenStack  ==
EGI Cloud site can be based on OpenStack software with some EGI extensions. See deployment schema (''Note: <span style="color: rgb(51,102,255);">high level description on what modules are to be put on which machines.</span>'')
=== OpenStack installation ===
Integration with FedCloud requires a working OpenStack installation. Follow the general documentation at http://docs.openstack.org/, there are packages ready to use for most distributions (check for example [https://openstack.redhat.com/Main_Page RDO] for RedHat based distributions).
OpenStack integration with FedCloud is known to work with the following versions of OpenStack:
* ''Havana'' (EOL by OpenStack, should not be used in production)
* '''Icehouse'''
* '''Juno'''
Suggested list of services to provide FedCloud integration:
* Keystone service must be available in any case.
* If providing OCCI access (VM management):
** Nova
** Cinder
** Glance
** Neutron (nova-network can also be used for legacy installations), [http://docs.openstack.org/havana/install-guide/install/yum/content/section_networking-routers-with-private-networks.html Per-tenant routers with private networks] configuration is known to work.
* If providing CDMI access (Object storage):
** Swift
=== OpenStack integration ===
==== Integration Prerequirements ====
* Working OpenStack installation.
* Valid IGTF-trusted host certificates for Keystone. You may also use host certificates for OCCI if serving nova-api via https.
==== EGI User Management/AAI ====
Every FedCloud site must support authentication of users with X.509 certificates with VOMS extensions. The [https://ifca.github.io/keystone-voms Keystone-VOMS] extension enables this kind of authentication on Keystone.
* Installation: documentation on the installation is available at [https://keystone-voms.readthedocs.org/ Keystone-voms documentation]. Make sure to use the correct documentation for your OpenStack version.
* Take into account that using keystone-voms plugin will enforce the use of https for your Keystone service, you will need to update your URLs at the Keystone catalog and in the configuration of your services:
** You will probably need to include your CA to your system's CA bundle to avoid certificate validation issues: <code>/etc/ssl/certs/ca-certificates.crt</code> from the <code>ca-certificates</code> package on Debian/Ubuntu systems or <code>/etc/pki/tls/certs/ca-bundle.crt</code> from the <code>ca-certificates</code> on RH and derived systems. Check the packages documentation to add a new CA to those bundles.
** replace http with https in <code>auth_[protocol|uri|url]</code> and <code>auth_[host|uri|url]</code> in the nova, cinder, glance and neutron config files (<code>/etc/nova/nova.conf</code>, <code>/etc/nova/api-paste.ini</code>, <code>/etc/neutron/neutron.conf</code>, <code>/etc/neutron/api-paste.ini</code>, <code>/etc/neutron/metadata_agent.ini</code>, <code>/etc/cinder/cinder.conf</code>, <code>/etc/cinder/api-paste.ini</code>, <code>/etc/glance/glance-api.conf</code>, <code>/etc/glance/glance-registry.conf</code>, <code>/etc/glance/glance-cache.conf</code>) and any other service that needs to check keystone tokens.
** You can update the URLs of the services directly in the database:
<pre>
mysql> use keystone;
mysql> update endpoint set url="https://<keystone-host>:5000/v2.0" where url="http://<keystone-host>:5000/v2.0";
mysql> update endpoint set url="https://<keystone-host>:35357/v2.0" where url="http://<keystone-host>:35357/v2.0";
</pre>
* VOs: Every FedCloud site is expected to support [http://operations-portal.egi.eu/vo/view/voname/fedcloud.egi.eu fedcloud.egi.eu], [http://operations-portal.egi.eu/vo/view/voname/dteam dteam] and [http://operations-portal.egi.eu/vo/view/voname/ops ops] VOs. You should configure this VO in your <code>/etc/keystone/voms.json</code> file. Make sure that the tenant you are mapping the VO to exists. Below there is a sample <code>voms.json</code> file, adapt it with the appropriate names of your tenants:
{
    "fedcloud.egi.eu": {
        "tenant": "VO:fedcloud.egi.eu"
    },
    "dteam": {
        "tenant": "VO:dteam"
    },
    "ops": {
        "tenant": "VO:ops"
    }
}
You also need to include the appropriate <code>.lsc</code> files for each VO at <code>/etc/grid-security/vomsdir/</code>:
<pre>
mkdir -p /etc/grid-security/vomsdir/fedcloud.egi.eu
cat > /etc/grid-security/vomsdir/fedcloud.egi.eu/voms1.egee.cesnet.cz << EOF
/DC=org/DC=terena/DC=tcs/OU=Domain Control Validated/CN=voms1.egee.cesnet.cz
/C=NL/O=TERENA/CN=TERENA eScience SSL CA
EOF
cat > /etc/grid-security/vomsdir/fedcloud.egi.eu/voms2.grid.cesnet.cz << EOF
/DC=org/DC=terena/DC=tcs/OU=Domain Control Validated/CN=voms2.grid.cesnet.cz
/C=NL/O=TERENA/CN=TERENA eScience SSL CA
EOF
mkdir -p /etc/grid-security/vomsdir/dteam
cat > /etc/grid-security/vomsdir/dteam/voms.hellasgrid.gr << EOF
/C=GR/O=HellasGrid/OU=hellasgrid.gr/CN=voms.hellasgrid.gr
/C=GR/O=HellasGrid/OU=Certification Authorities/CN=HellasGrid CA 2006
EOF
cat > /etc/grid-security/vomsdir/dteam/voms2.hellasgrid.gr << EOF
/C=GR/O=HellasGrid/OU=hellasgrid.gr/CN=voms2.hellasgrid.gr
/C=GR/O=HellasGrid/OU=Certification Authorities/CN=HellasGrid CA 2006
EOF
mkdir -p /etc/grid-security/vomsdir/ops
cat > /etc/grid-security/vomsdir/dteam/lcg-voms2.cern.ch << EOF
/DC=ch/DC=cern/OU=computers/CN=lcg-voms2.cern.ch
/DC=ch/DC=cern/CN=CERN Grid Certification Authority
EOF
cat > /etc/grid-security/vomsdir/dteam/voms2.cern.ch << EOF
/DC=ch/DC=cern/OU=computers/CN=voms2.cern.ch
/DC=ch/DC=cern/CN=CERN Grid Certification Authority
EOF
</pre>
* VOMS-Keystone configuration: most sites should enable the <code>autocreate_users</code> option in the <code>[voms]</code> section of [https://keystone-voms.readthedocs.org/en/latest/configuration.html Keystone-VOMS configuration]. This will enable that new users are automatically created in your local keystone the first time they login into your site.
==== EGI Virtual Machine Management Interface -- OCCI ====
OCCI is the EGI-approved access method for computing resources that VM management cloud services must expose. [https://github.com/EGI-FCTF/occi-os OCCI-OS] is the recommended software to provide this capability.
OCCI-OS can be installed from the github repo (recommended) or by using pip (packages may not be up-to-date!). The module must be installed on the machines hosting your nova-api. Installation instructions are available in the <code>README.md</code> file of the repo. Before installing OCCI-OS, you should manually install pyssf (<code>pip install pyssf</code>). If installing from the github repo, '''be sure to select the appropriate branch for your OpenStack installation''', e.g. for an OpenStack Icehouse installation:
<pre>
$ pip install pyssf
$ git clone https://github.com/EGI-FCTF/occi-os.git -b stable/icehouse
Cloning into 'occi-os'...
remote: Counting objects: 1312, done.
remote: Total 1312 (delta 0), reused 0 (delta 0), pack-reused 1312
Receiving objects: 100% (1312/1312), 357.53 KiB | 0 bytes/s, done.
Resolving deltas: 100% (752/752), done.
Checking connectivity... done.
$ cd occi-os
$ python setup.py install
running install
running bdist_egg
running egg_info
creating openstackocci_icehouse.egg-info
...
Finished processing dependencies for openstackocci-icehouse==1.0
</pre>
Configuration is also detailed in the [https://github.com/EGI-FCTF/occi-os/#configuration OCCI-OS readme file].
==== EGI Accounting ====
Every cloud site must publish utilization data to the EGI accounting database. You will need to install [https://github.com/IFCA/caso cASO], a pluggable extractor of Cloud Accounting Usage Records from OpenStack.
* Latest version is available at PyPi: (https://pypi.python.org/pypi/caso/), you can install it with <code>pip install caso</code>.
* Check the [http://caso.readthedocs.org/en/latest/ cASO documentation] includes how to install and configure OpenStack for generating the accounting records.
* Source code available at [https://github.com/IFCA/caso cASO github repo]
* Packages for Ubuntu distributions are build at [https://build.opensuse.org/project/show/home:aloga:cloud:integration OpenSUSE build service home:aloga:cloud:integration project]
In order to send the records to the accounting database, you will also need to configure SSM. Follow the [https://wiki.egi.eu/wiki/Fedcloud-tf:WorkGroups:Scenario4#Publishing_Records publishing records documentation at the accounting scenario]
==== EGI Information System ====
Sites must publish information to EGI information system which is based on BDII. There is a common [https://github.com/EGI-FCTF/cloud-bdii-provider bdii provider] for all cloud management frameworks. Information on installation and configuration is available in [https://github.com/EGI-FCTF/cloud-bdii-provider/blob/master/README.md the cloud-bdii-provider README.md] and in the [[Fedclouds BDII instructions]], there is a [[Fedclouds_BDII_instructions#OpenStack|specific section with OpenStack details]].
==== EGI Image Management ====
Sites in FedCloud offering VM management capability must give access to VO-endorsed VM images. This functionality is provided with vmcatcher (that is able to subscribe to the image lists available in AppDB) and a set of tools that are able to push the subscribed images into the glance catalog. Information on installation of the software is available at [[Fedcloud-tf:WorkGroups:Scenario8:Configuration#VMcatcher|FedCloud Scenario 8 wiki]], there is a [[Fedcloud-tf:WorkGroups:Scenario8:Configuration#OpenStack|specific section on OpenStack]] to install and configure the event handlers.
In order to subscribe to VO-wide image lists, you need to have a valid access token to the AppDB. Check [https://wiki.appdb.egi.eu/main:faq:how_to_get_access_to_vo-wide_image_lists how to access to VO-wide image lists] and [https://wiki.appdb.egi.eu/main:faq:how_to_subscribe_to_a_private_image_list_using_the_vmcatcher how to subscribe to a private image list] documentation for more information.
==== Registration of services in GOCDB ====
Site cloud services must be registered in [https://goc.egi.eu EGI Configuration Management Database (GOCDB)]. If you are creating a new site for your cloud services, check the [[PROC09|PROC09 Resource Centre Registration and Certification]] procedure. Services can also coexist within an existing (grid) site.
If offering OCCI interface, sites should register the following services:
* eu.egi.cloud.vm-management.occi for the OCCI endpoint offered by the site. Please note the special endpoint URL syntax described at [[Fedcloud-tf:WorkGroups:Scenario5#GOCDB]]
* eu.egi.cloud.accounting (host should be your OCCI machine)
* eu.egi.cloud.vm-metadata.vmcatcher (also host is your OCCI machine)
* Site should also declare the following properties using the ''Site Extension Properties'' feature:
*# Max number of virtual cores for VM with parameter name: <code>cloud_max_cores4VM</code>
*# Max amount of RAM for VM with parameter name: <code>cloud_max_RAM4VM</code> using the format: value+unit, e.g. "16GB".
*# Max amount of storage that could be mounted in a VM with parameter name: <code>cloud_max_storage4VM</code> using the format: value+unit, e.g. "16GB".
If offering CDMI interface, site should register:
* eu.egi.cloud.storage-management.cdmi. Note also the enpoint URL syntax described at [[Fedcloud-tf:WorkGroups:Scenario5#GOCDB]]
Once the site services are registered in GOCDB and set as monitored they will be checked by the [https://cloudmon.egi.eu/nagios Cloud SAM instance].
=== Installation Validation  ===
You can check your installation following these steps:
#Check in [https://cloudmon.egi.eu/nagios Cloudmon] that your services are listed and are passing the tests. If all the tests are OK, your installation is already in good shape.
#Check that you are publishing cloud information in your site BDII:<br><code>ldapsearch -x -h &lt;site bdii host&gt; -p 2170 -b Glue2GroupID=cloud,Glue2DomainID=&lt;your site name&gt;,o=glue</code>
#Check that all the images listed in the [https://appdb.egi.eu/store/vo/fedcloud.egi.eu AppDB&nbsp;page for fedlcoud.egi.eu VO&nbsp; ]are listed in your BDII. This sample query will return all the VM ids registered in your BDII:<br><code>ldapsearch -x -h &lt;site bdii host&gt; -p 2170 -b Glue2GroupID=cloud,Glue2DomainID=&lt;your site name&gt;,o=glue objectClass=GLUE2ApplicationEnvironment GLUE2ApplicationEnvironmentRepository</code>
#Try to start one of those images in your cloud (you can do it with nova or OCCI) commands, the result should be the same. <br>
#Execute the [[HOWTO04_Site_Certification_Manual_tests#Check_the_functionality_of_the_cloud_elements|site certification manual tests]] against your endpoints.<br>
#Check in the [http://accounting-devel.egi.eu/cloud.php accounting portal] that your site is listed and the values reported look consistent with the usage of your site.
== OpenNebula  ==
{| style="border:1px solid black; background-color:yellow; color: black; padding:5px; font-size:140%; width: 90%; margin: auto;"
| style="padding-right: 15px; padding-left: 15px;" |
|[[File:Baustelle.png]] This part is '''under construction'''.
|}
EGI Cloud Site based on OpenNebula is an ordinary OpenNebula installation with some EGI-specific integration components. There are no additional requirements placed on internal site architecture.
CDMI storage endpoints are currently not supported for OpenNebula-based sites.
=== OpenNebula Installation ===
Follow [http://opennebula.org/documentation/ OpenNebula Documentation] and install OpenNebula with enabled X.509 authentication support.
The following OpenNebula versions are supported:
* OpenNebula v4.4.x (legacy)
* OpenNebula v4.6.x
* OpenNebula v4.8.x
* OpenNebula v4.10.x
* OpenNebula v4.12.x
=== OpenNebula Integration ===
==== Integration Prerequisites ====
* Working OpenNebula installation with X.509 support enabled.
* Valid IGTF-trusted host certificates for selected hosts.
==== EGI User Management/AAI ====
See [[Fedcloud-tf:ResourceProviders:OpenNebula#Integration_with_Perun|Integration with Perun]].
==== EGI Virtual Machine Management Interface -- OCCI ====
See [[rOCCI:ROCCI-server_Admin_Guide|rOCCI-server Installation Guide]] and [[Fedcloud-tf:WorkGroups:Scenario1:OpenNebulaInstallation|rOCCI-server in EGI Federated Cloud]].
==== EGI Accounting ====
See [[Fedcloud-tf:WorkGroups:Scenario4#OpenNebula_Accounting_Scripts|OpenNebula Accounting Scripts]].
==== EGI Information System ====
Sites must publish information to EGI information system which is based on BDII. There is a common [https://github.com/EGI-FCTF/cloud-bdii-provider bdii provider] for all cloud management frameworks. Information on installation and configuration is available in the cloud-bdii-provider [https://github.com/EGI-FCTF/cloud-bdii-provider/blob/master/README.md README.md] and in the [[Fedclouds BDII instructions]], there is a [[Fedclouds_BDII_instructions#OpenNebula_.2B_rOCCI|specific section with OpenNebula details]].
==== EGI Image Management ====
Sites in FedCloud offering VM management capability must give access to VO-endorsed VM images. This functionality is provided with vmcatcher (that is able to subscribe to the image lists available in AppDB) and a set of tools that are able to push the subscribed images into the glance catalog. Information on installation of the software is available at [[Fedcloud-tf:WorkGroups:Scenario8:Configuration#VMcatcher|FedCloud Scenario 8 wiki]], there is a [[Fedcloud-tf:WorkGroups:Scenario8:Configuration#OpenNebula|specific section on OpenNebula]] to install and configure the event handlers.
In order to subscribe to VO-wide image lists, you need to have a valid access token to the AppDB. Check [https://wiki.appdb.egi.eu/main:faq:how_to_get_access_to_vo-wide_image_lists how to access to VO-wide image lists] and [https://wiki.appdb.egi.eu/main:faq:how_to_subscribe_to_a_private_image_list_using_the_vmcatcher how to subscribe to a private image list] documentation for more information.
==== Registration of services in GOCDB ====
Site cloud services must be registered in [https://goc.egi.eu EGI Configuration Management Database (GOCDB)]. If you are creating a new site for your cloud services, check the [[PROC09|PROC09 Resource Centre Registration and Certification]] procedure. Services can also coexist within an existing (grid) site.
If offering OCCI interface, sites should register the following services:
* eu.egi.cloud.vm-management.occi for the OCCI endpoint offered by the site. Please note the special endpoint URL syntax described at [[Fedcloud-tf:WorkGroups:Scenario5#GOCDB]]
* eu.egi.cloud.accounting (host should be your OCCI machine)
* eu.egi.cloud.vm-metadata.vmcatcher (also host is your OCCI machine)
* Site should also declare the following properties using the ''Site Extension Properties'' feature:
*# Max number of virtual cores for VM with parameter name: <code>cloud_max_cores4VM</code>
*# Max amount of RAM for VM with parameter name: <code>cloud_max_RAM4VM</code> using the format: value+unit, e.g. "16GB".
*# Max amount of storage that could be mounted in a VM with parameter name: <code>cloud_max_storage4VM</code> using the format: value+unit, e.g. "16GB".
Once the site services are registered in GOCDB and set as monitored they will be checked by the [https://cloudmon.egi.eu/nagios Cloud SAM instance].
=== Installation Validation ===
#<span style="color: rgb(51,102,255);">Installation validaton - this is a new step: ''<span style="color: rgb(51,102,255);"><span style="color: rgb(51,51,51);"><span style="color: rgb(51,102,255);">describe steps performed by site admin that confirms the site installation is working well according to EGI requirements</span></span></span>''<span style="color: rgb(51,102,255);">.&nbsp;''It is better to have it as a separate, final step for all checks''</span></span>
##<span style="color: rgb(51,51,51);">Nagios step - ''<span style="color: rgb(51,102,255);">missing</span>''</span>
##<span style="color: rgb(51,102,255);"><span style="color: rgb(51,51,51);">check accounting <span style="color: rgb(51,102,255);"><span style="color: rgb(51,51,51);">''<span style="color: rgb(51,102,255);">- missing</span>''</span></span><br></span></span>
##<span style="color: rgb(51,102,255);"><span style="color: rgb(51,51,51);">check vmcatcher subscription <span style="color: rgb(51,102,255);"><span style="color: rgb(51,51,51);">''<span style="color: rgb(51,102,255);">- missing</span>''</span></span><br></span></span>
##<span style="color: rgb(51,102,255);"><span style="color: rgb(51,51,51);">check BDII publishing ''<span style="color: rgb(51,102,255);">- missing</span>''<br></span></span>
##<span style="color: rgb(51,102,255);"><span style="color: rgb(51,51,51);">check OCCI ''[https://wiki.egi.eu/wiki/HOWTO04_Site_Certification_Manual_tests#Cloud_Compute_.28OCCI.29_checks It is possible to reuse https://wiki.egi.eu/wiki/HOWTO04_Site_Certification_Manual_tests#Cloud_Compute_.28OCCI.29_checks]''</span></span>
== Synnefo  ==
<span style="color: rgb(51,102,255);">''There are installation guides e.g. [https://www.synnefo.org/docs/synnefo/latest/install-guide-debian.html#install-guide-debian <span style="color: rgb(51,102,255);">https://www.synnefo.org/docs/synnefo/latest/install-guide-debian.html#install-guide-debian</span>] but it seems there is no EGI-specific installation guides.''</span>
<br>
= Revision History  =
{| border="3"
|-
! Version
! Authors
! Date
! Comments
|-
|
|
|
|
|}


[[Category:Operations_Manuals]]
[[Category:Operations_Manuals]]

Latest revision as of 16:15, 12 April 2021

Main EGI.eu operations services Support Documentation Tools Activities Performance Technology Catch-all Services Resource Allocation Security


Documentation menu: Home • Manuals • Procedures • Training • Other • Contact ► For: VO managers • Administrators



Title Cloud Resource Centre Installation Manual
Document link https://wiki.egi.eu/wiki/MAN10
Last modified 19 May 2017
Policy Group Acronym OMB
Policy Group Name Operations Management Board
Contact Group operations-support@mailman.egi.eu
Document Status DRAFT
Approved Date
Procedure Statement This manual provides information on how to set up a Resource Centre providing cloud resources in the EGI infrastructure.
Owner Owner of procedure


Warning:
The installation manual is now available at https://docs.egi.eu/. Information below just points to the relevant sections of that manual

Retrieved from "https://wiki.egi.eu/w/index.php?title=MAN10&oldid=112877"