Скачать или смотреть 2015 OpenStack Summit Tokyo - Craig Lee – Turn OpenStack into the Global InterCloud — Now!

Currently Keystone is building out the essential support for basic pair-wise federation -- to essentially support hybrid clouds, i.e., cloud-bursting. This is certainly the right place to start, but general federation management will enable an enormous spectrum of cloud deployments and applications whose ultimate culmination will be a global InterCloud. By direct analogy to the Internet, the global InterCloud will consist of many cloud providers that support a wide variety of users and application domains around the world.

To illustrate how OpenStack could support a global InterCloud, we will discuss fundamental federation management requirements and demonstrate a prototype Keystone-based Virtual Organization Management System, a browser-based federated application, and an alternative method to manage federations through the Horizon dashboard.

In the near term, small-scale federation will enable cloud providers to support hybrid clouds. However, the same kind of federation machinery could enable users and organizations to create federations that span multiple providers and essentially create virtual clouds.

Perhaps even more important, though, federation can be applied at the user application level -- to create federations that span providers and organizations. All federations can be managed as Virtual Organizations (VOs) or Virtual Projects (VPs). (For simplicity, we will just use the term VO.) VOs can be thought of as specialized security and collaboration contexts that are not ""owned"" by any one organization. VOs can be created on-demand to enable users and organizations to securely share resources, i.e., data and services, for specific purposes. The ability to securely manage cloud-based (and bare-metal-based) collaborations has enormous applicability and potential impact.

Clearly this won't happen overnight, but OpenStack and Keystone are uniquely positioned to lead in this direction. Keystone's notion of Federate In and Federate Out are the fundamental operations that enable simple, pair-wise federations to be managed by hand. This provides basic federated identity management and federated resource management -- where user credentials from different Identity Providers can be validated, and where cloud resources from different OpenStack installations can be accessed. However, this needs to be augmented with the capability to manage sets of OpenStack installations. Furthermore, the full potential of federation will only be realized when arbitrary, application-level services from different user organizations can also be managed on a per-federation basis.

This can be done using the VO concept. Here, arbitrary sets of resources (including OpenStack services) can be managed as part of a VO, and made discoverable and accessible based on a VO member's authorization attributes. It may even be possible to build a general VO federation agent. Such agents could be used to build arbitrary federation topologies where software-defined networks are used to isolate the network traffic of different federations. When deployed at scale, this would constitute an InterCloud.