OpenStack Cloud at Yahoo Scale: How to Avoid Disaster
summary
Yahoo runs OpenStack worldwide with 13,000 development VMs and 170 PB mail storage, and secures it by slicing networks into VLANed security domains and separate clusters for corporate vs production. Management nodes are isolated behind jump hosts, Keystone access is limited to admins only, and hypervisors do no direct hypervisor-to-hypervisor communication (no live migrate by default). VMs get metadata via config-drive metadata via cloud-init, consoles use spice proxy + SSO tokens, hosts use internal PKI with SCEP for host certificates, hardened Linux, and L3 iBGP rack networking to avoid spanning-tree failures.
AI-written summary · about
chapters (10)
- 0:00Start
- 3:59OpenStack Reach
- 4:41Slice and Dice
- 7:58Loneliness can be a good thing
- 8:49Who should talk to the Corporate Infrastructure nodes?
- 11:17Who should the Hypervisors talk to?
- 13:11Who should the VMs talk to?
- 19:07What about those responsible for the Infrastructure nodes?
- 21:27Impostors and Spies
- 22:55Someone to watch over me
related talks
36mAdventures in Running a Private Cloud
43mSupporting NASA Science with OpenStack
30mRunning Sovereign Cloud Stack Cluster for International Telecommunication Union: Lessons Learned
23mOpen Matters: HP & OpenStack
11mStanding Up OpenStack at Time Warner Cable
49mIntroduction to OpenStack
35mBehind the Scenes of the Cloud
04mPaul Cleary Interview