OpenStack Extended Training Course

1. Introduction to OpenStack - 2h
● Evolution of cloud computing and OpenStack
● Cloud capabilities
● Cloud deployment models
○ private, public, hybrid
○ on-premise, IaaS, PaaS, SaaS
● Public and private cloud deployments utilizing OpenStack
● Open source and commercial OpenStack distributions
● OpenStack deployment architectures
● OpenStack ecosystem
○ Core modules
○ Fundamental tools
○ Integration capabilities
● OpenStack lifecycle

● OpenStack certification paths
● OpenStack lab environment (VM) for this course

2. Hands-on OpenStack administration workshop
● Exploring OpenStack ~0.5h
○ OpenStack components (Keystone, Glance, Nova, Neutron, Cinder, Swift,
Heat)
○ Interacting with the OpenStack cloud
○ OpenStack daemons and API communication flows
● Keystone - Identity management service ~1h
○ Keystone architecture
> ○ Authentication methods and supported backends
○ Token types and token management
○ Authorization in OpenStack - roles and oslo.policy
○ Keystone resources - domains, projects, users
○ Openrc and clouds.yaml - CLI client configuration
○ OpenStack service catalog
○ Integrating new OpenStack services
○ Quota management in OpenStack
● Glance - Image service ~1.5h
○ Cloud-adapted images
○ Image attributes (properties, metadata, format, container)
○ Uploading and downloading images
○ Sharing images
○ Glance image storage backends
○ Protected images
○ Managing image service quotas
○ Verifying Glance services
● Neutron - Networking ~2-3h
○ Architecture and Neutron services
○ The ML2 plugin
○ Compute node networking analysis
○ Networking concepts and tools utilized by Neutron
○ Core Neutron network resource types
○ Managing tenant networks and subnets
○ Managing security groups and rules
○ East-West routing
○ Network namespaces
○ Managing external/provider networks
○ North-South routing
○ Floating IP management
○ Managing network quotas
○ Fundamental network troubleshooting (namespaces, tcpdump, etc.)
○ Network quota configurations
○ Verifying Neutron services
● Nova - Compute service ~2-3h
○ Hypervisor interfaces

○ Key pair management
○ Flavor management
○ Flavors and CPU topology
○ Instance parameters
○ Creating an instance
○ Verifying spawned instances
○ Creating snapshots
○ Instance management
○ Resizing instances
○ Assigning floating IPs
○ Interactive console and console logs
○ Assigning security groups
○ Compute quotas
○ Retrieving statistics from Nova
○ Placement API and Nova Cells v2
○ Placement API and instance scheduling
○ Placement API client commands
○ Verifying Nova services
● Cinder - Block Storage ~2-3h
○ Volume parameters
○ Creating volumes
○ Managing volumes
○ Attaching volumes to Nova instances
○ Managing volume snapshots
○ Managing volume backups
○ Snapshot and backup internals in Cinder
○ Transferring volumes between projects
○ Restoring backups
○ Managing volume quotas
○ Adding new storage backends
○ QoS (limits) in Cinder
○ LVM, storage array, and Ceph storage backends
○ Ceph integration in OpenStack
○ Integrating Ceph and Cinder
○ Best practices for Ceph deployments
○ Verifying Cinder services
● Barbican - Key Management Service - ~2h
○ Barbican architecture
○ Storing passphrases
○ Generating and storing symmetric encryption keys
○ Volume encryption mechanisms
○ Configuring Cinder storage types for volume encryption
○ Limitations of volume encryption
○ Storing X.509 certificate bundles
● Swift - Object Storage (quick screening for the COA exam) <1h
○ Swift components and processes
○ Managing containers and objects
○ Managing access control lists

○ Configuring object expiration
○ The Ring and storage policies
○ Monitoring available storage space
○ Configuring quotas
○ Verifying Swift services
● Octavia - Load Balancing-as-a-service ~2-3h
○ Architecture
○ Objects and request flow
○ Octavia flavors
○ Octavia Availability Zones
○ Creating the HTTP load balancer
○ Creating the TCP load balancer
○ Creating the HTTPS passthrough load balancer
○ Listeners, Pools and Health Monitors
○ Layer 7 load balancing in Octavia
○ Building Amphora images
○ LB Failover
○ Networking and Monitoring details
○ Troubleshooting Octavia
● Heat - Orchestration ~1-2h
○ Heat Orchestration Template and its components
○ Creating Heat stacks
○ Verifying Heat stacks
○ Updating Heat stacks
○ Verifying Heat services
● Basic troubleshooting ~2h
○ Analyzing log files
○ Centralized logging
○ Debugging OpenStack client queries
○ Managing the OpenStack database
○ Backing up OpenStack
○ Analyzing compute node status
○ Analyzing instance status
○ Analyzing the AMQP broker (RabbitMQ)
○ Metadata services
○ General approaches to diagnosing OpenStack issues
○ Troubleshooting network problems
○ Troubleshooting network performance
○ Instance backup and recovery

3. Advanced Topics
● Hardware considerations and capacity planning ~2h
○ Compute hardware
○ Network design
○ Storage design
○ Flavor sizing
○ Resource overcommitment

● Role system - authorization in OpenStack ~2h
○ Creating new roles as member role extensions
○ policy.yaml - API call authorization
● Highly Available control plane ~1h
○ HA in OpenStack services
○ HA database configurations
○ HA message queue setups
● Cloud partitioning and scheduler filters ~1h
○ Rationale and implementation of cloud partitions (host-aggregates)
○ Nova scheduler filters
● Workload migration ~1h
○ Cold and live migration
○ Live migration tuning
● OpenStack monitoring and telemetry <1h
○ Ceilometer service
○ External monitoring solutions
● Advanced cloud/hypervisor features <1h
○ CPU pinning / NUMA architecture
○ SR-IOV
● Cloud-init and image customization <1h
○ Metadata Service
● Block storage backends <1h
○ LVM
○ Ceph RBD
○ Physical appliances
○ Storage network considerations
● Upgrading OpenStack <1h
○ Upgrade strategies and procedures
○ Zero-downtime upgrade methods
● Bare-metal provisioning with OpenStack <1h
○ Ironic module
○ Undercloud and overcloud concepts
● The future of OpenStack
4. Deep-dive into Neutron and OVN backend - ~6-8h
● OVN architecture
● OVN components
● ML2 - OVN vs OvS driver comparison
● Top-down OVN networking
○ OpenStack logic (Neutron database)
○ Northbound database
○ Southbound database
○ Logical datapath pipelines
○ Logical flows
○ OpenFlow flows
● Neutron network and OVN logical switch
○ Logical ports and their types
○ Switching flows

● Neutron router and OVN logical router
○ NAT types
○ Routing flows
● Neutron subnet and native DHCP
○ DHCP flows
● Security groups in OVN
○ ACLs and Port Groups
○ Security group flows
○ Port security in OVN
● Summary of OVN Northbound tables
● Information flow in OVN
○ Neutron DB, OVN NB and SB DB, OpenFlow at OvS
● Logical flow tracing
○ Defining microflows
○ L2 tracing
○ L3 tracing
○ DHCP tracing
● Physical flows - OpenFlow
○ Physical live-cycle of VM-originated packets
● Physical tracing
○ Tracing for hypothetical packets
○ Tracing for real packets
● Displaying Open vSwitch database and resources