Guides on Documentation

Adjutant

Mon, 01 Jan 0001 00:00:00 +0000

Overview

OpenStack Adjutant is a service that allows users to manage projects and their users directly from Horizon.

User management

TIP: If you wish to enable MFA for your accounts, you can opt-in to use Elastx IDP. See here for more information.
Please note that you still need to invite the users with their specific roles before opting for Elastx IDP.

Users can be managed directly from the management tab within the dashboard in Horizon.

Affinity Policy

Mon, 01 Jan 0001 00:00:00 +0000

Overview

Here is how to avoid that groups of instances run on the same compute node. This can be relevant when configuring resilience.

Create an anti affinity group.
Take note of the group UUID that is displayed when created. It is needed when deploying the instance.
openstack server group create --policy anti-affinity testgroup

https://docs.openstack.org/python-openstackclient/yoga/cli/command-objects/server-group.html
(Optional) Read out the affinity policies.
openstack server group list | grep -Ei "Policies|affinity"
Add the instance to the group when deploying.
openstack server create --image ubuntu-20.04-server-latest --flavor v1-small-1 --hint group=<server_group_uuid> test-instance

API access

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

OpenStack provides REST APIs for programmatic interaction with the various services (compute, object storage, etc.). These APIs are used by automation tools such as HashiCorp Terraform and the OpenStack CLI utility.

For advanced programmatic usage, there exist freely available SDKs and software libraries for several languages which are maintained by the OpenStack project or community members.

This guides describes the initial steps required for manual usage of the OpenStack REST APIs.

Authentication

Usage of an application credential for API authentication is recommend due to their security and operational benefits.

Application credentials

Mon, 01 Jan 0001 00:00:00 +0000

Overview

This guide will help you getting started with OpenStack application credentials. Application credentials are designed to be used by automation and CLI tools, such as Terraform and the OpenStack command-line client.

Create application credential using web dashboard

Navigate to “Identity” → “Application Credentials” in your target project and press “Create Application Credential”. Once created, you’ll be offered to download the generated credential configuration as an OpenStack RC file (“openrc” version 3) or in the “clouds.yaml” format.

Application credentials - Access Rules

Mon, 01 Jan 0001 00:00:00 +0000

Overview

This guide will help you get started with how to create different access rules for various resources in OpenStack. The access rules are applied to application credentials and enables a way to set more fine-grained access control for applications to specific resources.

Good to know

Access rules are only applicable to application credentials and not to users of a project. As an example, a user can create an application credential that has read-only access to a specific container in Swift. This type of credentials can later be used by an application to read information from that container. The users within the project can still access all containers with read/write access, if they are a member of the swift operator role. The users also has access to other types of resources, such as virtual machines. If you want to completely separate user access from virtual machines and swift, you can opt-in for a separate swift project. Please see here for more information.

Barbican

Mon, 01 Jan 0001 00:00:00 +0000

Overview

OpenStack Barbican is a key management service for storing highly sensitive data like private keys for certificates and passwords which needs to be available for applications during runtime.

ELASTX Barbican service is backed by physical HSM appliances to ensure that all data is securely stored.

REST API reference can be found here
OpenStack Barbican client can be found here

Secrets in Barbican have a special design with regards to ID, they are always referenced by a “secret href” instead of a UUID! (This will change in a later release!)

Billing

Mon, 01 Jan 0001 00:00:00 +0000

Overview

We use OpenStack CloudKitty for billing purposes and with it’s open API it is possible to get detailed information about the cost of resources.

NOTE: The billing data engine is ALWAYS 4 hours behind so it is only possible to retrieve rating data up until 4 hours ago! This is to ensure that all billing data is in place before calculating costs.

Prerequisites

To fetch data from cloudkitty using the OpenStack CLI it is neccessary to install the openstack python client and the openstack cloudkitty python client.

Detach & Attach interface on a Ubuntu instance

Mon, 01 Jan 0001 00:00:00 +0000

Overview

If you need to change interface on a Ubuntu instance, then this is the procedure to use.

Run the following command in the instance.
```
 sudo cloud-init clean
```
Shut down the instance
Detach / Attach the network interface
Start the instance
Reassociate Floating IP with the instance

EC2 Credentials

Mon, 01 Jan 0001 00:00:00 +0000

Overview

For using the OpenStack S3 API:s you need to generate an additional set of credentials. These can then be used to store data in the Swift Object store for applications that don’t have native Swift support but do support the S3 interfaces.

NOTE: If the application does support Swift natively, using Swift will provide superior performance and generally a better experience.

Create and fetch credentials using openstack cli

Make sure you have installed the openstack python client.

Getting started with OpenStack

Mon, 01 Jan 0001 00:00:00 +0000

This guide goes through the initial steps on how to get started with creating instances and accessing them via ssh.
In this example we use an ubuntu image and restrict SSH access.

Create Network

Go to “Project” > “Network” > “Networks”
Select “Create Network” > set a network name > “Next”
Set subnet name and network address (10.0.1.0/24 for example) > “Next”
Make sure that “Enable DHCP” is checked.
Add “DNS Name Servers” > “Create” (ip of a resolver e.g. dns4eu, Cloudflare, or other depending on your privacy and policy preferences).

Create Router

Go to “Project” > “Network” > “Routers”
Select “Create Router” > set a router name and select the public network “elx-public1” > “Create Router”
Select the router you just created > “Interfaces” > “Add Interface” > select the subnet you created > “Add Interface”

Now the network is up and ready for you to create the first instance.

Octavia

Mon, 01 Jan 0001 00:00:00 +0000

This is an example of a minimal setup that includes a basic HTTP loadbalancer. Here is a short explanation of a minimal (configuration) setup from GUI (Horizon).

Network -> Loadbalancer -> Create loadbalancer
Load Balancer Details: Subnet: Where your webservers live
Listener Details: Select HTTP, port 80.
Pool Details: This is your “pool of webservers”. Select Algoritm of preference.
Pool members: Select your webservers.
Finally, proceed to “Create Loadbalancer”.

Note, the loadbalancer will not show up in the Network Topology graph. This is expected.

Swift getting started

Mon, 01 Jan 0001 00:00:00 +0000

Overview

Swift is Elastx object storage in OpenStack. Swift provides high availability by utilizing all availability zones and is encrypted at rest. This guide will help you get started with the basics surrounding Swift object storage.

Swift/S3 Compatibility

Swift has an s3 compatible API for applications that don’t natively support the Swift API. You can find a S3/Swift support matrix here.
To get started with Swift/S3, See our guide here for more information.

Swift projects

Mon, 01 Jan 0001 00:00:00 +0000

Overview

There are two main options for access separation in Swift:

You can use Access rules to manage access to specific containers using application credentials. This alone will not stop the ability for users to create/remove virtual machines. See more information here on how to get started with access rules.
Dedicated Swift project. Dedicated Swift projects are basically OpenStack projects with reduced access to any resource except swift. This is sometime needed due to the current limitation of how privilege/role management works for users in OpenStack.

Swift Project

In this guide we will go through how to manage user permissions for Swift containers using ACLs in a Swift project.

Swift S3 compatibility

Mon, 01 Jan 0001 00:00:00 +0000

Overview

Swift provides an S3 compatible API for applications that don’t support the Swift API. Note that you need to create EC2 credentials for this to work.

NOTE: The S3 region must be set to “us-east-1” for compatibility with “AWS Signature Version 4”

NOTE: If the application does support Swift natively, using Swift will provide superior performance and generally a better experience.

Example s3cmd configuration

The configuration below works with s3cmd:

Terraform Backend

Mon, 01 Jan 0001 00:00:00 +0000

Overview

Swift is accessable with the s3 backend. To get the access and secret key follow this guide. EC2 credentials

Example configuration

This is what you need to get the s3 backend to work with swift.

backend "s3" {
  bucket = "<The bucket you want to use>"
  key    = "<Path and name to tf state file>"
  endpoint   = "https://swift.elastx.cloud"
  sts_endpoint = "https://swift.elastx.cloud"
  access_key = "<Puth your access key here>"
  secret_key = "<Put your secret key here>"
  region = "us-east-1"
  force_path_style = "true"
  skip_credentials_validation = "true"
}

key variable example: “path/to/tf-state-file”.

This is the path in the bucket.

Volume Attachment Limits

Mon, 01 Jan 0001 00:00:00 +0000

Overview

If you need to attach more than the default limitation of volume attachments, then this is possible by using a custom image and changing the properties of the image to use a non-default scsi driver.

Please note that any servers created before the image properties are set need to be re-created in order to use the updated driver.

The following properties need to be set in order to achieve this.

Volume Backup & Restore

Mon, 01 Jan 0001 00:00:00 +0000

Overview

Volume backups in Elastx OpenStack uses Swift as the storage backend. This means that your backups will automatically be placed in all availability zones. This guide will help you get started with how to create volume backups and how to restore them using OpenStack’s Horizon and CLI.

Backup and restrore from Horizon

Backup from Horizon

Navigate to “Project” → “Volumes” pick the volume you want to backup and choose Create Backup

Volume migration

Mon, 01 Jan 0001 00:00:00 +0000

Overview

To migrate volume data between Availability Zones (sto1|sto2|sto3) you can use Openstacks backup functionality. This backup process uses our Swift object storage, which is available across all Availability Zones.

Shutdown the instance whose volume will change Availability Zone. Let’s say it’s in sto1 now.
Take a backup of the volume (this may take some time, depending on the size of the volume).
Create a new volume in Availability Zone sto2 and select the backup as the source.
Create a new instance in Availability Zone sto2 and attach the newly created volume.

To get a more in-depth look at how to perform backup and restore of a volume, follow our Volume Backup & Restore guide.

Volume Retype

Mon, 01 Jan 0001 00:00:00 +0000

Overview

This guide will help you getting started with changing volume type in OpenStack.

Note

For v2 volumes as well as the deprecated ’enc’ volume types you will need to detach the volume from your server before retyping. Either shut down your server or unmount the volume in your operating system before detaching the volume in Openstack.

You cannot change a volume type from v1 to v2 if it has an existing snapshot.

Windows volume offline after restart

Mon, 01 Jan 0001 00:00:00 +0000

Issue description

In certain circumstances, extra disks can be marked as offline after a hard reboot is performed and have to be manually brought online again.

By default Windows machines will have the SAN policy set to be “Offline Shared”, thus in most virtualization platforms this issue will occur when a disk is completely shut down and started again.

The reason behind this is that the disk may be assigned to a different virtual PCI device in the underlying host which causes the OS to block the volume from going online automatically when using the default policy.