Versions Compared

Old Version 17

changes.mady.by.user Will Stevens

Saved on

compared with

New Version 18

changes.mady.by.user Will Stevens

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Bug Reference

JiraserverIssueskeyCLOUDSTACK-6230

Branch

Patch based on off the 4.4 version coming soon...

Introduction

This implementation allows OpenStack Swift to be integrated directly into the CloudStack UI as an Object Storage Service to be used by the CloudStack end users.

Purpose

Everything in this document reflects functionality which has already been developed unless it is marked with 'TODO'.  If you have comments or questions please let me know and I will update this document.

...

  • mauth - An extensible middleware for OpenStack Swift which enables Swift to authenticate CloudStack users.  (Developed by Will Stevens @ CloudOps)
  • HAproxy configuration example.

Document History

  1. The initial writing of the document (2014/03/11)

Glossary

CS - CloudStack
Swift - OpenStack Swift Object Storage 

Feature Specifications

  • 'Object Store' added to the main services menu on the left
  • User can List all containers and objects in their Swift account
  • User can Add/Delete Swift Containers
    • Supports cascade delete, so it will first delete all the objects in the container
  • User can Add/Delete Swift Objects
  • User can Add/Delete Folders in containers to group objects (unique to this implementation)
    • Supports cascade delete of folders, so it will first delete all the objects in the folder
  • User can create containers as Public or Private
    • Public - Each object in the container can be accessed without needing authentication
    • Private - Each object in the container requires the user to authenticate to access it
  • User can modify the Public/Private setting for existing containers
  • A public URL is shown in the details for each object in a public container
  • Supports sharing a Swift account with all users in a specific CS account (global setting)
  • Supports giving each user in a CS account their own Swift account (global setting)

...

  • When a user logs in, a change had to be made to add the 'api key' to the CS user object in the browser
  • The load balancer exposes the URL that is used by both CloudStack and Swift calls
    • One reason for this is to make sure the Swift traffic does not go through the CS server which would create a bottleneck
    • Another reason is to be able to make AJAX calls to Swift without having issues with the Same Origin Policy
  • All Swift calls are done using AJAX and the load balancer handles routing the calls to Swift
  • Swift uses the HTTP PUT verb and browsers do not support the PUT verb, so the client sends the requests as POST and the LB translates to PUT
    • This means that the current implementation does not support any of the Swift API calls that require POST
    • More details on this can be found in the HAproxy config attached at the end of this document
  • This functionality requires the 'mauth' middleware to be installed on Swift
  • The mauth configuration points to CS (the load balancer actually) and requires the 'admin' keys (mauth requires 'listUsers' API call for all accounts)
  • It is VERY recommended to use CS on HTTPS (with SSL)
  • TODO - Important - A global variable needs to be added to CS to enable/disable the Object Store functionality
  • TODO - Medium - Clean up the couple places where text is not translatable
  • TODO - Nice-to-have - Find a cleaner solution when someone tries to download a folder or container (maybe I should just hide download of those)
  • TODO - Nice-to-have - Make the public URL for a public object clickable (just text right now)
  • TODO - Nice-to-have - Reflect the full object path in the breadcrumb when an object is in detail view
  • TODO - Nice-to-have - Remember what containers and folders were open and reopen them after a new container is added (enhancement)
  • TODO - Nice-to-have - When a container or folder is clicked, expand/collapse it rather than forcing the arrow to be clicked (CS treeView enhancement)
  • TODO - Medium - A user guide to explain the setup required to get Swift setup with mauth as well as setting the load balancer in front of CS and Swift
    • What is the best way to make this doc available?

Use cases

For now, refer to the Feature Specifications or the UI Flow sections.

...

  • When a user logs in, a change was made to CS to ALSO pass the 'api key' to the client side, it is then saved in the user object.
    • This was added because mauth (the Swift middleware) authenticates to Swift with the CS 'username' and 'api key' (see curl example above).
    • It is highly recommended that you setup CS with SSL in front of it so the API requests are not in clear text (not safe against sniffers)
  • A load balancer is put in front of CS (and Swift).  I have included details for getting this to work with HAproxy.
  • mauth is required to enable authorization/authentication of CS users in Swift.

Web Services APIs

No changes to the CloudStack APIs

...

swift_ui_with_cloudstack.pptx (additional details)

 

Note: If you have followed this implementation at all (from previous conferences), you may have heard of 'cs_auth' being used as the Swift auth middleware.  'cs_auth' was the first Swift auth middleware I wrote to authenticate CS users in Swift and was the predecessor of 'mauth'.  'mauth' will continue to be supported, but 'cs_auth' will not and should not be used for future projects.