Summit Held in Hong Kong, 1 st time in Asia –Beijing is the city with the most OpenStack developers Attendance 3,500 up from 3,000 in Portland –45% APAC, 40% Americas, 450 from Europe 10 parallel streams –Conference for users and companies –Developer sessions Next Summits –Spring 2014 – Atlanta –Autumn 2014 – Paris OpenStack Design Summit Hong Kong 2013

OpenStack Board New gold members –Aptira –Huawei –Hitachi Individual board election process –Propose to move to Single Transferable Vote or Condorcet –Need vote of membership as it is a change to the bylaws What is OpenStack core ? –What projects must be provided by an OpenStack cloud ? –How to check it is compliant ? –Key for trademark and interoperability Legal Affairs Committee –Join OIN for patent protection Budget for 2014 approved Agile Infrastructure : OpenStack2

User Stories New Deployments –DigitalFilm Tree, Concur, Shutterstock –Ctrip (ebookers), iQiyi (youtube), Qihoo 360 (Yahoo), Alibaba (Yahoo/Amazon) Some Production Stories – too many to attend –Yahoo! Japan – 50K VMs –eBay/Paypal – payment systems now all OpenStack based –Workday – SaaS finance/HRWorkday –Liveperson – SaaS user profilingLiveperson –Guangzhou National Supercomputer Center – 6,400 hypervisors –Sony – cloud behind the Play Station 4 –CloudWatt & Numergy – French Public Clouds (Government partial ownership) Agile Infrastructure : OpenStack3

Some Statistics on Havana New Projects included in release –Ceilometer – Metering/Monitoring –Heat – Orchestration 910 contributors (70% increase) >400 new features 20,000 commits merged during cycle 700 clouds spun up per day as part of continuous integration testing Agile Infrastructure : OpenStack7

As Usual – Wifi Problems Agile Infrastructure : OpenStack8

"Deep Dive into the CERN Cloud Infrastructure" Agile Infrastructure : OpenStack9

Design Summit Sessions Agile Infrastructure : OpenStack10

Design Summit Sessions Havana release notes – Notes/Havanahttps://wiki.openstack.org/wiki/Release Notes/Havana Ice House discussion – cehouse/Etherpadshttps://wiki.openstack.org/wiki/Summit/I cehouse/Etherpads Agile Infrastructure : OpenStack11

Glance (Havana) New registry API More backend stores Multiple image locations Configurable containers and disk images Storage Quota Agile Infrastructure : OpenStack12

Glance (Ice House) Image status consistency with Nova Properties/status per location Deprecate API v1 in J* Agile Infrastructure : OpenStack13

Ceilometer (Havana) Alarms support New and improved DB drivers UDP based publisher Added support for HyperV Agile Infrastructure : OpenStack14

Ceilometer (Ice House) Central agent improvement Better integration with ironic Improve alarming Agile Infrastructure : OpenStack15

Cinder (Havana) Volume migration to different backend Ability to extend the size of existing volume Transfer volumes between tenants Support to TSM backup driver Agile Infrastructure : OpenStack16

Nova (Havana) Cells –Cell scheduler improvements –Live migration supported –Cinder support Quota –Default values editable –Quotas can be defined by user Notifications –More actions generate notifications Agile Infrastructure : OpenStack17

Nova (Havana) API –More information in "show" action –Cell capabilities support –Better EC2 API support Scheduler –Better performance for requests with multiple instances Storage –Attached volumes can be encrypted Agile Infrastructure : OpenStack18

Nova (Ice House) Scheduler improvements Nova Objects Live Upgrades Nova API v3 Cells as scalability solution Agile Infrastructure : OpenStack19

Nova Hyper-V (Havana) Support for Windows Server 2012 R2 New features –VHDX format –Dynamic memory –Ephemeral storage Compute metrics for Ceilometer OpenStack Design Summit Hong Kong 2013

Nova Hyper-V (Icehouse) Maintenance release Features –Remote Desktop Protocol –RemoteFX USB redirection GPU capabilities –Generation 2 virtual machines Windows 2012 R2 UEFI Synthetic devices SCSI boot OpenStack Design Summit Hong Kong 2013

Horizon (Havana) Full control of Heat stacks Initial support for Ceilometer Identity v3 (domains, groups, trusts, …) Improve Nova and Neutron feature support Security groups templates Role-Based Access Controls OpenStack Design Summit Hong Kong 2013

Horizon (Icehouse) Split website from library –Library (Extensions to django) –Horizon (Website) UX improvements –Avoid duplicity of information –Provide consistent UI Solve scaling issues (>1000 instances) –Context and filter search OpenStack Design Summit Hong Kong 2013

Keystone (Havana) Identity Assignment 1 st class support for deployment on httpd Granular RBAC rules –Attribute based Pluggable external authentication Caching driver calls Delegated role-based authorization Event notifications OpenStack Design Summit Hong Kong 2013

Keystone (Icehouse) CLI architecture –Allow external authentication mechanisms Audit authentication on services API deprecation (user-list) Quota centralized store –Quota for domain, project and user –Extension to services using notifications Federation OpenStack Design Summit Hong Kong 2013

Clouds Federation Federation: Ability to use single set of credentials to access multiple services across multiple clouds.

Clouds Federation - use cases Sharing resources between organisations Delegation of resources Better flexibility for adjusting the workload (not limited by the cloud infrastructure size)

Clouds Federation During the summit PTL accepts roadmap for the project First markdowns accepted (work still in progress) After the summit Coding from scratch First reviews to be completed

Clouds Federation Identified 2 (main) solutions: Keystone acts as a SP only (external IdP) - IceHouse release Keystone acts as an IdP and SP

Clouds Federation - UC1 Clouds Federation UseCase 1 (IceHouse)

Federation - assertion attributes mapping Map assertion attributes into users/roles –VOMS-like mapping –Map assertions into groups of assignments Agreed solution (2 steps): 1.SAML assertion -> predefined groups -> roles 2.SAML assertion -> trusts delegations -> roles

Collaboration among organisations/companies Main contributors: Rackspace&CERN IBM RedHat University of Kent HP

Keystone token revocation Starting from Grizzly: PKI tokens replace UUID tokens Advantage: No need to ask Keystone for token’s validity. A service checks whether it’s signed by CA

Token revocation(Icehouse) Plan for the IceHouse release: An API for listing revocation related events user deleted or changed project deleted role assignment was changed token was revoked all of the above

Questions OpenStack Design Summit Hong Kong 2013

Clouds federation UC2 author: Joe Savak (RAX)