Cloud Computing at IFCA

1. Introduction

This is a beta service, since the deployment and development is ongoing. However, access is granted to certain users to test the functionality.

Check this document for updates frequenlty, since changes in the service may occur.

IFCA uses OpenStack for managing the cloud service, which provides several ways to access:

• Web dashboard

• OpenStack API, that can be used with the nova command line interface.

• Amazon EC2 API, available with the euca commands.

This documents focuses on the usage of the euca tools in the GRIDUI Cluster.

2. Credentials

You need a valid account for accessing the cloud services. The username and password of that account may not be the same you are using in the GRIDUI Cluster. Contact the helpdesk if you need further information on your account.

Once you have a valid user and password, you can obtain your credentials in the dashboard of OpenStack. Login into Web portal and go to your settings area (Link in the upper right corner). There you two different kind of credentials:

• The OpenStack Credentials that can be used with the nova command

• The EC2 Credentials can be used with euca tools.

Download the zip with the EC2 Credentials and unzip it into your GRIDUI home before attempting any of the commands. Once you have the files in the UI, source the ec2rc.sh file in order to have the environment ready

. ec2rc.sh

Now you should be able to execute the commands to access the resources.

3. Creating machines

The cloud service lets you instantiate virtual machines (VM) on demand. When you request the creation of a new VM, you can select the operating systems and the size (RAM, Disk, CPUs) that will be used to run the machine. In this section we will show how to discover which software and sizes are available and how to start a new virtual machine.

3.1. Keypairs

Before attempting to start a new virtual machine, you should have a keypair that will allow you to login into the machine once it is running. Normally you just need to create one keypair that can be reused for all your virtual machines (although you can create as much SSH credentials as you want).

The euca-describe-keypairs list your current keypairs. Initially the command should not return anything.

In order to create a new key, use the euca-add-keypair with the name you want to use redirecting the ouput to the file where you want to store that key. For example, for creating a key named cloudkey that will be stored in cloudkey.pem:

$ euca-add-keypair cloudkey > cloudkey.pem

Your recently created keypair should now appear in the list of available keypairs:

$ euca-describe-keypairs 
KEYPAIR cloudkey        cc:2a:af:56:8a:a9:36:2c:75:fe:ce:b7:98:fc:62:64

Make sure that you keep safe the file cloudkey.pem, since it will contain the private key needed to access your cloud machines.

3.2. Images

The

$ euca-describe-images 
IMAGE   ami-00000001    None (IFCA Scientific Linux 5.5 JeOS)           available       public                  machine                 instance-store
IMAGE   ami-00000002    None (IFCA Scientific Linux 5.5 + ROOT v5.30.00)                available       public          machine                 instance-store
IMAGE   ami-00000003    None (IFCA Ubuntu Server 10.04 JeOS)            available       public                  machine                 instance-store
IMAGE   ami-00000004    None (IFCA Debian Wheezy (2011-08) JeOS)                available       public                  machine                 instance-store
IMAGE   ami-00000005    None (cloudpipe)                available       public                  machine          instance-store
IMAGE   ami-00000006    None (IFCA Scientific Linux 5.5 + PROOF v5.30.00)               available       public          machine                 instance-store
IMAGE   ami-00000007    None (IFCA Ubuntu Server 10.04 JeOS)            available       public                  machine                 instance-store
IMAGE   ami-00000008    None (IFCA openSUSE 11.4 JeOS)          available       public                  machine  instance-store
IMAGE   ami-00000009    None (IFCA openSUSE 11.4 + Compilers)           available       public                  machine                 instance-store
IMAGE   ami-0000000a    None (IFCA openSUSE 11.4 + Compilers + Mathematica)             available       public          machine                 instance-store
IMAGE   ami-0000000b    None (IFCA Ubuntu Server 11.10 JeOS)            available       public                  machine                 instance-store
IMAGE   ami-0000000c    None (Fedora 15)                available       public                  machine aki-0000000d    ari-0000000e    instance-store
IMAGE   aki-0000000d    None (Fedora 15 kernel)         available       private                 kernel           instance-store
IMAGE   ari-0000000e    None (Fedora 15 initrd)         available       private                 ramdisk          instance-store
IMAGE   ari-00000011    None (Fedora 17 initrd)         available       private                 ramdisk          instance-store
IMAGE   aki-00000010    None (Fedora 17 kernel)         available       private                 kernel           instance-store
IMAGE   ami-0000000f    None (Fedora 17)                available       public                  machine aki-00000010    ari-00000011    instance-store
IMAGE   ami-00000012    None (Fedora 17 old glibc)              available       public                  machine aki-00000010    ari-00000011    instance-store
IMAGE   ami-00000017    None (IFCA Scientific Linux 6.2 JeOS)           available       public                  machine                 instance-store
IMAGE   aki-00000023    None (ubuntu 12.04 kernel)              available       public                  kernel   instance-store
IMAGE   ami-00000022    None (Ubuntu 12.04 JeOS)                available       public                  machine  instance-store
IMAGE   aki-00000025    None (Ubuntu 11.10 kernel)              available       public                  kernel   instance-store
IMAGE   ami-00000024    None (Ubuntu Server 11.10 JeOS)         available       public                  machine aki-00000025            instance-store

4. Create a machine

To create a machine you have to perform several steps:

• Decide which of the pre-built images you are going to use.
• Decide which with of the available sizes is suitable for you.
• Decide (and create if not ready) with keypair should be used to connect to the machine.

4.1. Image and size selection

4.1.1. Image selection

There are several pre-built images available. To check them, use the euca-describe-images command:

$ euca-describe-images 
IMAGE   ami-00000008    None (cloudpipe)                available       public                  machine                 instance-store
IMAGE   ami-00000007    None (Debian Wheezy (2011-08))          available       public                  machine                 instance-store
IMAGE   ami-00000006    None (lucid-server-uec-amd64.img)               available       public                  machine                 instance-store
IMAGE   ami-00000003    None (Scientific Linux 5.5)             available       public                  machine                 instance-store
IMAGE   ami-00000001    None (Scientific Linux 5.5)             available       public                  machine                 instance-store

Once you have decided with image to use, write down its identifier (ami-XXXXXXXX).

4.1.2. Instance types

You can choose the size of your machine (i.e. how many CPUs and how much memory) from the following instance types:

4.1.2.1. Standard machines

4.1.2.2. High-memory machines

4.2. Create SSH credentials

For most of the users this is a one-time step (although you can create as much SSH credentials as you want). You have to create an SSH-keypair so as to inject it to the newly created machine with the following command (it will create a keypair named cloudkey and store it under ~/.cloud/cloudkey.pem):

$ euca-add-keypair cloudkey > ~/.cloud/cloudkey.pem

Make sure that you keep safe the file ~/.cloud/cloudkey.pem, since it will contain the private key needed to access your cloud machines. You can check the name later with the euca-describe-keypairs command.

4.3. Launching the instance

To launch the instance, you have to issue euca-run-instances, specifying:

• wich keypair to use (in the example cloudkey).

• wich size should be used (in the example m1.tiny).

• with image should be used (in the example ami-00000001).

$ euca-run-instances -k cloudkey -t m1.tiny ami-00000001
RESERVATION     r-1zdwog0m      ACES    default
INSTANCE        i-00000048      ami-00000001                    scheduling      cloudkey (ACES, None)   2011-09-02T12:19:41Z    None    None

You can check its status with euca-describe-instances

$ euca-describe-instances i-00000048
RESERVATION     r-vmfu1xq2      ACES    default
INSTANCE        i-00000048      ami-00000001    172.16.1.8      172.16.1.8      blocked         cloudkey (ACES, cloud01)        0       m1.tiny         2011-09-02T12:15:32Z    nova

4.4. Connect to the server

4.5. Authorize SSH connections and ping

If you decide not to use a VPN, but connect to your machines trough the GRIDUI cluster, you have to authorize such connections with:

$ euca-authorize -P tcp -p 22 default
$ euca-authorize -P icmp -t -1:-1 default

4.5.1. SSH Connection

You have to use the private identify file that you created before (~/.cloud/cloudkey.pem) and pass it to the SSH client. To check the IP to with you should connect, check it with euca-describe-instances

$ ssh -i ~/.cloud/cloudkey.pem root@172.16.1.8

4.6. Stopping the server

Images can be stopped with euca-terminate-instances

$ euca-terminate-instances i-00000048

5. Creating a Machine with OpenStack

Go to http://portal.cloud.ifca.es to access to OpenStack system, which lets you to create a new image in the cloud.

5.1. Image and size selection

You should launch the image that you want to use (within a list of OS) and click “Launch”. A new popup window will be shown and you have to choose the configuration of the system (requirements, name of the server...).

5.2. Create SSH credentials

You must import or create a new key in order to access to that image. To do so go to “Access & Security” tab and click on Create or Import Keypair.

5.3. Connect to the server

In order to access throw ssh to the image, you must asign an IP to the instance. Click on “Access & Security” again and select “Allocate IP to project”. Choose the type of IP that you want to use and click “Allocate IP”. After that, you need to link that IP with your new image. Click on the button “Associate IP” of your new IP and select the instance that you have just created.

5.3.1. SSH Connection

Last step is to download the keypair that you have created or imported and move it to the machine that you will use to conect to the isntance. Change permission to 600 and use the following command to connect:

$ Ssh -i clave.pem root@cloud.image.IP

Done

6. Using Cloud Storage

The storage in the cloud use volumes. Volumes are raw block devices that can be created dynamically with a desired size and associated with cloud images to be used as data disk. After use the data in the volume you can detach from the image and save for a later use of the persisted data.

6.1. Creating a Volume

To create a volume you have to run euca-create-volume command. For instance, to create a volume that is 100GB in size:

$ euca-create-volume -s 100 -z nova
VOLUME  vol-00000001    10      creating        2015-11-29

6.2. Using a Volume in an instance

You may attach block volumes to instances using euca-attach-volume. You will need to specify the local block device name (this will be used inside the instance) and the identified instance. Currently the devices to attach the volume should be /dev/xvdc, /dev/xvdd,... /dev/xvdz. Attaching volume vol-00000001 to image i-00000001 in device /dev/xvdc si done with:

$ euca-attach-volume -i i-00000001 -d /dev/xvdc vol-00000001

You can see the volume attached to the image with the command euca-describe-volumes.

$ euca-describe-volumes 
VOLUME  vol-00000001     100            nova    in-use  2015-11-29
ATTACHMENT      vol-0000000c    i-00000051      /dev/xvdc       

You can then use the new volume inside your running instance. As an example, the usage of the volume as an ext4 filesystem in a Ubuntu image is described below.

1. log into the image and check that the device is visible (as either root or as ubuntu user and use sudo for commands):

2. server-1 $ sudo fdisk -l | grep Disk
   Disk /dev/xvda doesn't contain a valid partition table
   Disk /dev/xvdb doesn't contain a valid partition table
   Disk /dev/xvdc doesn't contain a valid partition table
   Disk /dev/xvda: 10.7 GB, 10737418240 bytes
   Disk identifier: 0x00000000
   Disk /dev/xvdb: 21.5 GB, 21474836480 bytes
   Disk identifier: 0x00000000
   Disk /dev/xvdc: 107.4 GB, 107374182400 bytes
   Disk identifier: 0x00000000

3. Create a single ext4 partition on the device, an mount in the /srv mount point (-o sync is safe in case of image crashs):

4. server-1 $ sudo mkfs.ext4 /dev/xvdc
   (...)
   server-1 $ sudo mount -t ext4 -o sync /dev/xvdc /srv

5. Check that the volume is visible as a mounted filesystem:

6. server-1 $ df -h
   Filesystem            Size  Used Avail Use% Mounted on
   /dev/xvda             9.9G  622M  8.8G   7% /
   none                  996M  144K  995M   1% /dev
   none                 1001M     0 1001M   0% /dev/shm
   none                 1001M   48K 1001M   1% /var/run
   none                 1001M     0 1001M   0% /var/lock
   none                 1001M     0 1001M   0% /lib/init/rw
   /dev/xvdb              20G  173M   19G   1% /mnt
   /dev/xvdc              99G  188M   94G   1% /srv

After you are done with the volume yo can detach from image with (you should umount it first on your instance):

$ euca-detach-volume vol-00000001

You must detach a volume before terminating an instance or deleting a volume. If you fail to detach a volume, it may leave the volume in an inconsistent state and you risk losing data.

6.3. Reusing an Old Volume

Attach with the new image:

$ euca-attach-volume -i i-00000002 -d /dev/xvdc vol-00000001

Because the filesystem is already created on the volume, you only need to mount it to access:

server-1 $ sudo mount -t ext4 -o sync /dev/xvdc /srv

After you are done with the volume yo can detach from image:

$ euca-detach-volume vol-00000001

6.4. Other uses of Volumes

With volume you can create snapshots of the data, recover it, delete volumes,...etc. More on volumes http://open.eucalyptus.com/wiki/Euca2oolsStorage

7. Advanced topics

7.1. Attach to the project's VPN

Each project has a VPN assigned to it. You can attach any computer to it, thus having it connected to your project's internal network. So as to do so, you have to perform several steps (instructions only for GNU/Linux):

1. Copy your ~.cloud to the machine that you want to attach to your project's VPN.

2. Install OpenVPN on that machine.

3. Launch openvpn with the nova-vpn.conf configuration file.

# cd cloud_credentials
# openvpn --config nova-vpn.conf

Please note that there are several paths in the nova-vpn.conf configuration file that are relative to the directory in which it is located. Should you wish to use different/separated paths, please edit nova-vpn.conf and adjust the cert, key and ca parameters.

MacOS users may use Tunnelblick (a GUI interface to OpenVPN) that can use the nova-vpn.conf and certificate files without any changes.

7.1.1. VPN with Ubuntu 10.04

1. Install network-manager-openvpn package

2. Add to /etc/dbus-1/system.d/nm-openvpn-service.conf between policy root and policy default:

<policy user=”at_console”>
<allow own=”org.freedesktop.NetworkManager.vpnc”/>
<allow send_destination=”org.freedesktop.NetworkManager.vpnc”/>
</policy>

3. With the network configuration in gnome bar, add new VPN conection importing nova-vpn.conf
4. Edit VPN conection, inside routing options, use this conection only for own resource.
5. Restart computer to get all changes in.

Now you can activate/deactivate VPN from gnome bar.

7.1.2. VPN with Windows

1. Install OpenVPN Connect Client from http://openvpn.net.

2. Rename nova-vpn.conf to nova-vpn.ovpn.

3. From Access -> Profiles -> Import from Local File, load the file nova-vpn.ovpn.

4. To connect, press on new nova-vpn button.

# === Manage multiple credentials === # and checking that NOVA_API, NOVA_CERT, NOVA_PROJECT, NOVA_URL, NOVA_USERNAME,