The term ‘Load Balancer’ is quite self-explanatory, it balances the load on application servers behind it. There can be ‘n’ number of application servers behind the Load Balancer (LB) which would not be directly facing the end users.
“ To produce the ubiquitous Open Source Cloud Computing platform that will meet the needs of public and private cloud providers regardless of size, by being simple to implement and massively scalable.”
OpenStack is a collection of open source software projects that enterprises/service providers can use to setup and run their cloud compute and storage infrastructure.Rackspace and NASA are the key initial contributors to the stack. Rackspace contributed their “Cloud Files” platform (code) to power the Object Storage part of the OpenStack, while NASA contributed their “Nebula” platform (code) to power the Compute part. OpenStack consortium has managed to have more than 150 members including Canonical, Dell, Citrix etc.
• Nova – Compute Service
• Swift – Storage Service
• Glance – Imaging Service
• Keystone – Identity Service
• Horizon – UI Service
Nova is the Computing Fabric controller for the OpenStack Cloud. All activities needed to support the life cycle of instances within the OpenStack cloud are handled by Nova. This makes Nova a Management Platform that manages compute resources, networking, authorization, and scalability needs of the OpenStack cloud. But, Nova does not provide any virtualization capabilities by itself; instead, it uses libvirt API to interact with supported hypervisors. Nova exposes all its capabilities through a web services API that is compatible with the EC2 API of Amazon Web Services.
• Instance life cycle management
• Management of compute resources
• Networking and Authorization
• REST-based API
• Asynchronous eventually consistent communication
• Hypervisor agnostic : support for Xen, XenServer/XCP, KVM, UML, VMware vSphere and Hyper-V
Swift provides a distributed, eventually consistent virtual object store for OpenStack. It is analogous to Amazon Web Services – Simple Storage Service (S3). Swift is capable of storing billions of objects distributed across nodes. Swift has built-in redundancy and fail-over management and is capable of archiving and media streaming. It is extremely scalable in terms of both size (several petabytes) and capacity (number of objects).
• Storage of large number of objects
• Storage of large sized objects
• Data Redundancy
• Archival capabilities – Work with large datasets
• Data container for virtual machines and cloud apps
• Media Streaming capabilities
• Secure storage of objects
• Backup and archival
• Extreme scalability
OpenStack Imaging Service is a lookup and retrieval system for virtual machine images. It can be configured to use any one of the following storage backends:
• Local filesystem (default)
• OpenStack Object Store to store images
• S3 storage directly
• S3 storage with Object Store as the intermediate for S3 access.
• HTTP (read-only)
• Provides imaging service
Keystone provides identity and access policy services for all components in the OpenStack family. It implements it’s own REST based API (Identity API). It provides authentication and authorization for all components of OpenStack including (but not limited to) Swift, Glance, Nova. Authentication verifies that a request actually comes from who it says it does. Authorization is verifying whether the authenticated user has access to the services he/she is requesting for.
Keystone provides two ways of authentication. One is username/password based and the other is token based. Apart from that, keystone provides the following services:
• Token Service (that carries authorization information about an authenticated user)
• Catalog Service (that contains a list of available services at the users’ disposal)
• Policy Service (that let’s keystone manage access to specific services by specific users or groups).
Horizon the web based dashboard can be used to manage /administer OpenStack services. It can be used to manage instances and images, create keypairs, attach volumes to instances, manipulate Swift containers etc. Apart from this, dashboard even gives the user access to instance console and can connect to an instance through VNC. Overall, Horizon
• Instance Management – Create or terminate instance, view console logs and connect through VNC, Attaching volumes, etc.
• Access and Security Management – Create security groups, manage keypairs, assign floating IPs, etc.
• Flavor Management – Manage different flavors or instance virtual hardware templates.
• Image Management – Edit or delete images.
• View service catalog.
• Manage users, quotas and usage for projects.
• User Management – Create user, etc.
• Volume Management – Creating Volumes and snapshots.
• Object Store Manipulation – Create, delete containers and objects.
• Downloading environment variables for a project.
We can install open stack ESSEX very easily using StackGeek script. Login to your box and install git with apt-get. We’ll become root and do an update first.
sudo su
apt-get update
apt-get install git
Now checkout the StackGeek scripts from Github:
git clone git://github.com/StackGeek/openstackgeek.git
cd openstackgeek
Be sure to take a look at the scripts before you run them. Keep in mind the scripts will periodically prompt you for input, either for confirming installation of a package, or asking you for information for configuration.
Start the installation by running the first script:
./openstack_base_1.sh
When the script finishes you’ll see instructions for manually configuring your network. You can edit the interfaces file by doing a:
vim /etc/network/interfaces
Copy and paste the network code provided by the script into the file and then edit:
auto eth0 iface eth0 inet static address 192.168.1.48 network 192.168.1.0 netmask 255.255.255.0 broadcast 192.168.1.255 gateway 192.168.1.124 dns-nameservers 8.8.8.8 auto eth1
Change the settings for your network configuration and then restart networking and run the next script:
/etc/init.d/networking restart Then run the second script : ./openstack_base_2.sh
After the second script finishes, you’ll need to set up a logical volume for Nova to use for creating snapshots and volumes. Nova is OpenStack’s compute controller process.
Here’s the output from the format and volume creation process:-
root@manager-System-Product-Name:/openstackgeek# fdisk /dev/sda Device contains neither a valid DOS partition table,nor Sun,SGI or OSF disklabel Building a new DOS disklabel with disk identifier 0xb39fe7af. Changes will remain in memory only, until you decide to write them. After that, of course, the previous content won't be recoverable. Warning: invalid flag 0x0000 of partition table 4 will be corrected by w(rite) Command (m for help): n Partition type: p primary (0 primary, 0 extended, 4 free) e extended Select (default p): p Partition number (1-4, default 1): 3 First sector (2048-62914559, default 2048): Using default value 2048 Last sector,(2048-62914559,default 62914559): Using default value 62914559 Command (m for help): w The partition table has been altered! Calling ioctl() to re-read partition table. Syncing disks. root@manager-System-Product-Name:/openstackgeek# pvcreate -ff /dev/sda3 Physical volume "/dev/sda3" successfully created root@manager-System-Product-Name:/openstackgeek# vgcreate nova-volumes /dev/sda3 Volume group "nova-volumes" successfully created
Note: Your device names may vary.
The OpenStack components use MySQL for storing state information. Start the install script for MySQL by entering the following:
./openstack_mysql.sh You’ll be prompted for a password used for each of the components to talk to MySQL: Enter a password to be used for the OpenStack services to talk to MySQL (users nova, glance, keystone): redhat Note(Here “redhat” is the password given to nova,glance,keystone)
During the installation process you will be prompted for a root password for MySQL. In our install example we use the same password, ‘redhat’. At the end of the MySQL install you’ll be prompted for your root password again.
mysql start/running, process 8796 ################################################################################ Creating OpenStack databases and users. Use your database password when prompted. Run './openstack_keystone.sh' when the script exits. ################################################################################ Enter password: After MySQL is running, you should be able to login with any of the OpenStack users and/or the root admin account by doing the following: mysql -u root -predhat mysql -u nova -predhat nova mysql -u keystone -predhat keystone mysql -u glance -predhat glance
Keystone is OpenStack’s identity manager. Start the install of Keystone by doing:
./openstack_keystone.sh
You’ll be prompted for a token, the password you entered for OpenStack’s services, and your email address. The email address is used to populate the user’s information in the database.
Enter a token for the OpenStack services to auth wth keystone: redhattoken
Enter the password you used for the MySQL users (nova, glance, keystone):redhat
Enter the email address for accounts(nova,glance,keystone):user@company.com
You should be able to query Keystone at this point.
You’ll need to source the“stackrc” file before you talk to Keystone:
. ./stackrc
keystone user-list
Keystone should return a list of users:
+----------------------------------+---------+------------------------+--------+
| id | enabled | email | name |
+----------------------------------+---------+------------------------+--------+
| b32b9017fb954eeeacb10bebf14aceb3 | True | user@company.com | demo |
| bfcbaa1425ae4cd2b8ff1ddcf95c907a | True | user@company.com | glance |
| c1ca1604c38443f2856e3818c4ceb4d4 | True | user@company.com | nova |
| dd183fe2daac436682e0550d3c339dde | True | user@company.com | admin |
+----------------------------------+---------+------------------------+--------+
Glance is OpenStack’s image manager. Start the install of Glance by doing:
./openstack_glance.sh
The script will download an Ubuntu 12.04 LTS cloud image from StackGeek’s S3 bucket.Once it’s done, you should be able to get a list of images:
glance index
Here’s the expected output:
ID :- 71b8b5d5-a972-48b3-b940-98a74b85ed6a Name :- Ubuntu 12.04 LTS Disk Format :- qcow2 Container Format:- ovf Size :- 226426880
We’re almost done installing! The last component is the most important one as well. Nova is OpenStack’s compute and network manager. It’s responsible for starting instances, creating snapshots and volumes, and managing the network. Start the Nova install by doing:
./openstack_nova.sh
You’ll immediately be prompted for a few items, including your existing network interface’s IP address, the fixed network address, and the floating pool addresses:
###################################################### The IP address for eth0 is probably 192.168.1.48. Keep in mind you need an eth1 for this to work. ###################################################### Enter the primary ethernet interface IP: 192.168.1.48 Enter the fixed network (eg. 10.0.2.32/27): 192.168.1.0/24 Enter the fixed starting IP (eg. 10.0.2.33): 192.168.1.1 ############################################################################ The floating range can be a subset of your current network. Configure your DHCP server to block out the range before you choose it here. An example would be 10.0.1.224-255 ############################################################################ Enter the floating network (eg. 10.0.1.224/27): Enter the floating netowrk size (eg. 32):
The fixed network is a set of IP addresses which will be local to the compute nodes. Think of these addresses as being held and routed internally inside any of the compute node instances.
The floating network is a pool of addresses which can be assigned to the instances you are running. For example, you could start a web server and map an external IP to it for serving a site on the Internet.
Nova should finish installing after you enter all the network information. When it’s done, you should be able to get a list of images from Glance via Nova:
nova image-list
And get the expected output we saw earlier from Glance:
root@manager-System-Product-Name:/openstackgeek# nova image-list
+--------------------------------------+------------------+--------+--------+
| ID | Name | Status | Server |
+--------------------------------------+------------------+--------+--------+
| 71b8b5d5-a972-48b3-b940-98a74b85ed6a | Ubuntu 12.04 LTS | ACTIVE | |
+--------------------------------------+------------------+--------+--------+
Horizon is the UI and dashboard controller for OpenStack. Install it by doing:
./openstack_horizon.sh When it’s done installing, you’ll be given a URL to access the dashboard. You’ll be able to login with the user ‘admin’ and whatever you entered earlier for your password. If you’ve forgotten it, simply grep for it in your environment: env |grep OS_PASSWORD The URL will be : http://192.168.1.48
You can login the Openstack dashboard by the following credentials
USER : admin
PASSWORD : redhat
To launch an AWS/EC2 instance, at first setting up a security group to specify what network traffic is allowed to reach the instance. Then select an AMI and launch an instance from it. And create a volume in the same zone of the instance and attach with it. Format the device and mount it to a directory. After that follow the steps to create SSL for Tomcat:
1. For the tomcat we need java, so create a directory to save the Java Binary file.
[shell] mkdir /usr/java
cd /usr/java [/shell]
2. Download jdk binary file (jdk-x-linux-ix.bin) here
Use URL http://www.oracle.com/technetwork/java/archive-139210.html
3. Execute the Binary file
[shell] /usr/java/jdk-x-linux-ix.bin [/shell]
Now we have the Java in our device. Then Download the Tomcat and install it followed by the instructions:-
1. Create a directory to save the tomcat
[shell] mkdir /usr/tomcat
cd /usr/tomcat [/shell]
2. Download tomcat source file (apache-tomcat-x.tar.gz) here
Use URL http://apache.hoxt.com/tomcat/tomcat-6/v6.0.32/bin/
3. Extract that file
[shell] tar -zxvf apache-tomcat-x.tar.gz [/shell]
4. Edit the catalina.sh file
[shell] vim /usr/tomcat/apache-tomcat-x/bin/catalina.sh [/shell]
[shell]
#** Add at the top **
JAVA_HOME=/usr/java/jdk1.x.x_x
[/shell]
save and exit
5. Start the tomcat
[shell] /usr/tomcat/apache-tomcat-x/bin/startup.sh [/shell]
6. We can see the logs by using the given command
[shell]tail -f /usr/tomcat/apache-tomcat-x/logs/catalina.out [/shell]
7. Take the browser and enter the URL http://localhost
Now we can see the tomcat index page
8. To stop the tomcat
[shell]/usr/tomcat/apache-tomcat-x/bin/shutdown.sh [/shell]
Now configure the SSL Certificate for tomcat. When you choose to activate SSL on your web server you will be prompted to complete a number of questions about the identity of your website and your company. Your web server then creates two cryptographic keys – a Private Key and a Public Key. The Public Key does not need to be secret and is placed into a Certificate Signing Request (CSR) – a data file also containing your details.
Create a self signed certificate authority (CA) and keystore.
1. Make a directory to hold the certs and keystore. This might be something like:
[shell] mkdir /usr/tomcat/ssl
cd /usr/tomcat/ssl [/shell]
2. Generate a private key for the server and remember it for the next steps
[shell]openssl genrsa -des3 -out server.key 1024[/shell]
Generating RSA private key, 1024 bit long modulus
…………………..++++++
…++++++
e is 65537 (0x10001)
Enter pass phrase for server.key:
Verifying – Enter pass phrase for server.key:
3. Generate a CSR (Certificate Signing Request). Give the data after executing this command
[shell]openssl req -new -key server.key -out server.csr[/shell]
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [GB]:
State or Province Name (full name) [Berkshire]:
Locality Name (eg, city) [Newbury]:
Organization Name (eg, company) [My Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server’s hostname) []:
Email Address []:
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
4. Remove the passphrasse from the key
[shell]cp server.key server.key.org
openssl rsa -in server.key.org -out server.key[/shell]
Enter pass phrase for server.key.org:
writing RSA key
5. Generate the self signed certificate
[shell]openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt[/shell]
Signature ok
subject=/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd
Getting Private key
You should then submit the CSR. During the SSL Certificate application process, the Certification Authority will validate your details and issue an SSL Certificate containing your details and allowing you to use SSL. Typically an SSL Certificate will contain your domain name, your company name, your address, your city, your state and your country. It will also contain the expiration date of the Certificate and details of the Certification Authority responsible for the issuance of the Certificate.
Create a certificate for tomcat and add both to the keystore
1. Change the path to ssl
[shell]cd /usr/tomcat/ssl[/shell]
2. Create a keypair for ‘tomcat’
[shell]keytool -genkey -alias tom -keyalg RSA -keystore tom.ks[/shell]
Enter keystore password:
Re-enter new password:
What is your first and last name?
[Unknown]:
What is the name of your organizational unit?
[Unknown]:
What is the name of your organization?
[Unknown]:
What is the name of your City or Locality?
[Unknown]:
What is the name of your State or Province?
[Unknown]:
What is the two-letter country code for this unit?
[Unknown]:
Is CN=Unknown, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown correct?
[no]: yes
Enter key password for <tom>
(RETURN if same as keystore password):
Re-enter new password:
3. Generate a CSR (Certificate Signing Request) for tomcat
[shell]keytool -keystore tom.ks -alias tom -certreq -file tom.csr[/shell]
Enter keystore password:
4. create unique serial number
[shell]echo 02 > serial.txt[/shell]
5. Sign the tomcat CSR
[shell]openssl x509 -CA server.crt -CAkey server.key -CAserial serial.txt -req -in tom.csr -out tom.cer -days 365[/shell]
Signature ok
subject=/C=Unknown/ST=Unknown/L=Unknown/O=Unknown/OU=Unknown/CN=Unknown
Getting CA Private Key
6. Import the server CA certificate into the keystore
[shell]keytool -import -alias serverCA -file server.crt -keystore tom.ks[/shell]
Enter keystore password:
Owner: O=My Company Ltd, L=Newbury, ST=Berkshire, C=GB
Issuer: O=My Company Ltd, L=Newbury, ST=Berkshire, C=GB
Serial number: ee13c90cb351968b
Valid from: Thu May 19 02:12:51 EDT 2011 until: Fri May 18 02:12:51 EDT 2012
Certificate fingerprints:
MD5: EE:F0:69:01:4D:D2:DA:A2:4E:88:EF:DC:A8:3F:A9:00
SHA1: 47:97:72:EF:30:02:F7:82:BE:CD:CA:F5:CE:4E:ED:89:73:23:4E:24
Signature algorithm name: SHA1withRSA
Version: 1
Trust this certificate? [no]: yes
Certificate was added to keystore
7. Add the tomcat certificate to the keystore
[shell]keytool -import -alias tom -file tom.cer -keystore tom.ks[/shell]
Enter keystore password:
Certificate reply was installed in keystore
To configure a secure (SSL) HTTP connector for Tomcat, verify that it is activated in the $TOMCAT_HOME/conf/server.xml file. Edit this file and add the following lines.
Tomcat configuration
1. Edit the given portion of tomcat configuretion file and change the port as 80
[shell]vim /usr/tomcat/apache-tomcat-6.0.13/conf/server.xml[/shell]
[shell]“””””” <Connector port=”8080″ protocol=”HTTP/1.1″
connectionTimeout=”20000″
redirectPort=”8443″ /> “”””””
<Connector port=”80″ protocol=”HTTP/1.1″
connectionTimeout=”20000″
redirectPort=”8443″ />
[/shell]
2. Add the given portion to server.xml and give your password in the password portion
[shell]
<Connector port=”443″ protocol=”HTTP/1.1″ SSLEnabled=”true”
maxThreads=”150″ scheme=”https” secure=”true”
keystoreFile=”tom.ks”
keystorePass=”password”
clientAuth=”false” sslProtocol=”TLS” />
[/shell]
When you start the Tomcat Your web server will match your issued SSL Certificate to your Private Key. Your web server will then be able to establish an encrypted link between the website and your customer’s web browser.
Start the tomcat with SSL Certificate
1. Restart tomcat
[shell]/usr/tomcat/apache-tomcat-6.0.13/bin/shutdown.sh
/usr/tomcat/apache-tomcat-6.0.13/bin/startup.sh[/shell]
2. Go to https://Public DNS name:443/
Then your browser shows a security issue. Click the Approve button. Then you can enter to the tomcat with your certificate. When a browser connects to a secure site it will retrieve the site’s SSL Certificate and check that it has not expired, it has been issued by a Certification Authority the browser trusts, and that it is being used by the website for which it has been issued. If it fails on any one of these checks the browser will display a warning to the end user letting them know that the site is not secured by SSL.
You are Done !!!
Although Tomcat is a good option for heavy java applications, it gives a poor performance under high pressure.The best way to solve this problem is to set up an Apache-Tomcat Load Balanced on your Amazon EC2 environment. In this case you will have more than one parallel running tomcat instances and each will be able to share the part of the traffic. Read more…
There are times when you might receive certain warning messages from amazon.
“Hello,
We have noticed that one or more of your instances are running on a host degraded due to hardware failure.
i-111111
The host needs to undergo maintenance and will be taken down. Your instances will be terminated at this point. We recommend that you launch replacement instances and start migrating to them.” Read more…
If you are looking forward to migrating your PostgreSQL database to AWS EC2 cloud servers, you can do so by following the simple steps we have posted below. You can make it more reliable and secure from accidental EC2 instance crashing by allowing the postgresql server to run from an EBS volume. You can also take a snapshot of the EBS volume which will be stored on AWS storage service s3 which will make it highly reliable by making it available on multiple AWS availability zones that spans across datacenters. Read more…
Elastic Load Balancing ( ELB ) is an AWS load balancer service that is readily available for users who have signed up for AWS EC2 and s3 services . ELB is configured to automatically distribute incoming application traffic across multiple Amazon EC2 instances . Recently AWS has announced support for ELB to the AWS Management Console which will give users a simple, point-and-click web interface to create and configure load balancers for the AWS EC2 instances .
Below are the simple steps to configure ELB for webserver from the command line . Read more…
"Our client who has multiple offices across the world was finding it difficult to implement a perfect VOIP solutions. We provided solutions that helped in avoiding call drops and transferring calls from geographical office to another".
"We have migrated an application with 15GB PostgreSQL database to the Amazon EC2 cloud"
"We migrated our shared hosting servers with Cpanel and another with webmin to Amazon EC2"
Cloud enablers help data centers and enterprises in moving to cloud computing. While these IaaS softwares help enterprises adopt cloud, they help service providers enter the lucrative and demanding market without hassle.More
