Course Outline
1. Introduction to OpenStack - 2h
● History of cloud computing and OpenStack
● Key cloud features
● Cloud deployment models
○ Private, public, and hybrid clouds
○ On-premise, IaaS, PaaS, and SaaS
● Public and private cloud deployments using OpenStack
● Open source and commercial OpenStack distributions
● OpenStack deployment architectures
● The OpenStack ecosystem
○ Core modules
○ Underlying tools
○ Integration capabilities
● OpenStack lifecycle management
● OpenStack certification paths
● OpenStack lab environment (VM) for this course
2. Hands-on OpenStack administration workshop
● Introduction to OpenStack ~0.5h
○ Overview of OpenStack components (Keystone, Glance, Nova, Neutron, Cinder, Swift, Heat)
○ Interacting with the OpenStack cloud
○ OpenStack daemons and API communication flow
● Keystone - Identity management service ~1h
○ Keystone architecture
○ Authentication methods and supported backends
○ Token types and token lifecycle management
○ Authorization in OpenStack - roles and oslo.policy
○ Keystone resources - domains, projects, and users
○ Configuring CLI clients with openrc and clouds.yaml
○ OpenStack service catalog
○ Registering new OpenStack services
○ OpenStack quota system
● Glance - Image service ~1.5h
○ Cloud-optimized image formats
○ Image attributes (properties, metadata, format, container)
○ Uploading and downloading images
○ Image sharing mechanisms
○ Glance image storage options
○ Protected images
○ Managing quotas for the image service
○ Verifying Glance service health
● Neutron - Networking ~2-3h
○ Architecture and Neutron services
○ The ML2 plugin
○ Networking analysis on compute nodes
○ Networking concepts and tools utilized by Neutron
○ Basic Neutron network resource types
○ Managing tenant networks and subnets
○ Configuring security groups and rules
○ East-West routing
○ Network namespaces
○ Managing external/provider networks
○ North-South routing
○ Floating IP management
○ Managing network quotas
○ Basic network troubleshooting (namespaces, tcpdump, etc.)
○ Networking quotas
○ Verifying Neutron service health
● Nova - Compute service ~2-3h
○ Interfaces to hypervisors
○ Keypair management
○ Flavour management
○ Flavors and CPU topology
○ Instance parameter configuration
○ Creating an instance
○ Verifying spawned instances
○ Snapshotting
○ Instance lifecycle management
○ Resizing instances
○ Assigning floating IPs
○ Interactive console and console log access
○ Assigning security groups
○ Compute quotas
○ Retrieving statistics from Nova
○ Placement API and Nova Cells v2
○ Placement API and instance scheduling
○ Placement API client commands
○ Verifying Nova service health
● Cinder - Block Storage ~2-3h
○ Volume parameters
○ Creating volumes
○ Managing volumes
○ Attaching volumes to Nova instances
○ Managing volume snapshots
○ Managing volume backups
○ Internal mechanics of Cinder snapshots and backups
○ Transferring volumes between projects
○ Restoring backups
○ Managing volume quotas
○ Adding new storage backends
○ QoS (limits) in Cinder
○ LVM, storage arrays, and Ceph storage backends
○ Integrating Ceph with OpenStack
○ Integrating Ceph and Cinder
○ Best practices for Ceph deployments
○ Verifying Cinder service health
● Barbican - Key Management Service ~2h
○ Barbican architecture
○ Storing passphrases
○ Generating and storing symmetric encryption keys
○ Volume encryption mechanisms
○ Configuring Cinder storage types for volume encryption
○ Limitations of volume encryption
○ Storing X.509 certificate bundles
● Swift - Object Storage (overview for the COA exam) <1h
○ Swift components and processes
○ Managing containers and objects
○ Managing access control lists
○ Setting up object expiration
○ The Ring and storage policies
○ Monitoring available storage space
○ Setting up quotas
○ Verifying Swift service health
● Octavia - Load Balancing-as-a-service ~2-3h
○ Architecture
○ Objects and request flow
○ Octavia flavors
○ Octavia Availability Zones
○ Creating HTTP load balancers
○ Creating TCP load balancers
○ Creating HTTPS passthrough load balancers
○ Listeners, Pools, and Health Monitors
○ Layer 7 load balancing in Octavia
○ Building the Amphora image
○ Load Balancer Failover
○ Networking and monitoring details
○ Troubleshooting Octavia
● Heat - Orchestration ~1-2h
○ Heat Orchestration Template (HOT) and its components
○ Creating Heat stacks
○ Verifying Heat stacks
○ Updating Heat stacks
○ Verifying Heat service health
● Basic troubleshooting ~2h
○ Analyzing log files
○ Centralized logging
○ Debugging OpenStack client queries
○ Managing OpenStack databases
○ Backing up OpenStack
○ Analyzing compute node status
○ Analyzing instance status
○ Analyzing the AMQP broker (RabbitMQ)
○ Metadata services
○ General methodology for diagnosing OpenStack issues
○ Troubleshooting network problems
○ Troubleshooting network performance
○ Instance backup and recovery
3. Advanced Topics
● Hardware considerations and capacity planning ~2h
○ Compute hardware requirements
○ Network design
○ Storage design
○ Flavour sizing
○ Resource overcommitment
● Role system - authorization in OpenStack ~2h
○ Creating new roles as member role extensions
○ policy.yaml - API call authorization
● Highly Available control plane ~1h
○ HA in OpenStack services
○ HA database configuration
○ HA message queue configuration
● Cloud partitioning and scheduler filters ~1h
○ Rationale and implementation of cloud partitions (host-aggregates)
○ Nova scheduler filters
● Workload migration ~1h
○ Cold and live migration
○ Fine-tuning live migration
● OpenStack monitoring and telemetry <1h
○ Ceilometer service
○ External monitoring tools
● Advanced cloud/hypervisor features <1h
○ CPU pinning and NUMA architecture
○ SR-IOV
● Cloud-init and image customization <1h
○ Metadata Service
● Block storage backends <1h
○ LVM
○ Ceph RBD
○ Physical appliances
○ Storage network considerations
● Upgrading OpenStack <1h
○ Upgrade strategies and procedures
○ Zero-downtime upgrade methods
● Bare-metal provisioning with OpenStack <1h
○ Ironic module
○ Undercloud and overcloud concepts
● The future of OpenStack
4. Deep-dive into Neutron and OVN backend - ~6-8h
● OVN architecture
● OVN components
● ML2-OVN vs. OvS driver comparison
● Top-down OVN networking approach
○ OpenStack logic (Neutron database)
○ Northbound database
○ Southbound database
○ Logical datapath pipelines
○ Logical flows
○ OpenFlow flows
● Neutron network and OVN logical switch
○ Logical ports and their types
○ Switching flows
● Neutron router and OVN logical router
○ NAT types
○ Routing flows
● Neutron subnet and native DHCP
○ DHCP flows
● Security groups in OVN
○ ACLs and Port Groups
○ Security group flows
○ Port security in OVN
● Summary of OVN Northbound tables
● Information flow in OVN
○ Neutron DB, OVN NB and SB DB, OpenFlow at OvS
● Logical flow tracing
○ Defining microflows
○ L2 tracing
○ L3 tracing
○ DHCP tracing
● Physical flows - OpenFlow
○ Physical lifecycle of VM-originated packets
● Physical tracing
○ Tracing for hypothetical packets
○ Tracing for real packets
● Displaying Open vSwitch database and resources
Testimonials (3)
I found new things.
Cristian
Course - OpenStack Security
communication, knowledge from experience, solve problems,
Marcin Walewski - Intel Technology Poland Sp. z o.o.
Course - OpenStack Bootcamp
The varied topics
