Table of Contents
🌏 中文版
OpenStack is an open-source IaaS cloud operating system exposing APIs and dashboards for datacenter compute, networks, images, identity, and storage. It is neither one daemon nor a polished UI over KVM. Independently deployed and upgraded services compose each capability.
A minimal cloud is already distributed
The official minimum includes Keystone identity, Glance images, Placement inventory, Nova compute, and Neutron networking, commonly joined by Horizon and Cinder block storage. Production also needs databases, message queues, load balancing, DNS, keys, telemetry, and object or file storage.
Nova creates instances through hypervisors on compute nodes. Neutron implements virtual networks through agents and plugins. Cinder drivers connect storage backends. APIs appear consistent while performance, HA, and features depend on the hypervisor, SDN, storage, drivers, and hardware.
Multi-tenancy is value and attack surface
Keystone domains, projects, users, groups, roles, and service catalogs form tenant boundaries; quotas constrain consumption. Threat-model network isolation, security groups, image provenance, metadata, secrets and keys, host aggregates, and admin APIs. An overly broad control-plane credential compromises a cloud, not one VM.
Self-service APIs require capacity management. Flavors, Placement traits, availability zones, quotas, and schedulers must reflect CPU overcommit, NUMA, GPUs, bandwidth, and storage IOPS. Schedulable does not mean the workload meets its SLO.
Do not hand-install production
The Installation Guide calls its example a learning PoC, not production. Use Kolla-Ansible, OpenStack-Ansible, or a vendor distribution to automate packages or containers, configuration, certificates, database migrations, and HA topology.
Choose a release and deployment tool, then maintain an upgrade train. Test project release notes, APIs and database migrations, RPC compatibility, live migration, Neutron and Cinder drivers, and rollback in a production-like environment. Tenant VMs surviving does not prove a control-plane upgrade succeeded.
OpenStack, Proxmox, or public cloud
OpenStack can fit extensive self-service tenancy, API-compatible private IaaS, unusual hardware, sovereignty, and datacenter scale. Proxmox is more direct for a few clusters and operators. Without a platform/SRE team or sufficient scale, public or managed private cloud often costs less overall.
Fail controllers, message queues, databases, compute hosts, Neutron paths, and Cinder backends. Upgrade a release and restore the control-plane database. Verify tenant workloads, quotas, audit, showback, and support runbooks under real failures.
References
Loading...