Nova-LXDとLivepatch, GREE Mini Tech Talk 2017-06-21

OpenStack Nova対応ドライバのひとつLXDと、Livepatchを紹介します。

Transcript

1. Nova-LXDとLivepatch GREE Mini Tech Talk 2017-06-21 Nobuto Murata <nobuto.murata@canonical.com>
3. We are the company behind Ubuntu
4. https://insights.ubuntu.com/ 2016/04/07/ubuntu-is-everywhere/
5. We support... + more running anywhere
6. Nova-LXD LXD OpenStack Nova +
7. LXD LXDはNova Compute対応ドライバーのひとつ
8. KVMとは排他ではなく共存 OpenStack control plane KVM compute node Linux kernel Host OS Hypervisor Guest kernel Guest OS Guest kernel Guest OS LXD shared compute node Linux kernel LXD exclusive compute node Linux kernel Host OS Guest OS Host OS Guest OS Guest OS Guest OS Guest OS
9. Nova対応の既存orchestratorやconfiguration management toolでKVMとLXDコンテナを管理できる OpenStack control plane KVM compute node Linux kernel Host OS Hypervisor Guest kernel Guest OS Guest kernel Guest OS LXD shared compute node Linux kernel LXD exclusive compute node Linux kernel Host OS Guest OS Host OS Guest OS Guest OS Guest OS Guest OS Juju Ansible Heat, etc.
10. [ nova-lxd demo ]
11. LXC / LXDの歴史 2008 Developed by IBM engineers Initial release of LXD and nova-lxd 2015 LXC 1.0 release 2014 2016 LXC / LXD 2.0 release 2013 Used by Docker
12. Docker technology is not a replacement for LXC. [...] Docker is optimized for the deployment of applications, as opposed to machines. This is reflected in its API, user interface, design philosophy and documentation. By contrast, the lxc helper scripts focus on containers as lightweight machines ― https://docs.docker.com/engine/faq/
13. [ lxd demo ]
14. Livepatch KVM compute node Linux kernel Host OS Hypervisor Guest kernel Guest OS Guest kernel Guest OS Container worker node Linux kernel Host OS Guest OS Guest OS Guest OS Guest OS カーネル脆弱性対応アップデートは再起動が必要。 ワークロードの退避が必要なため、台数が増えるにつれて 負担になる。 • ワークロードの退避 /他ホス トへのマイグレーション • 更新カーネルのインストー ル • 再起動 • ワークロードの再移動
15. Livepatch KVM compute node Linux kernel Host OS Hypervisor Guest kernel Guest OS Guest kernel Guest OS Container worker node Linux kernel Host OS Guest OS Guest OS Guest OS Guest OS Livepatchを使うと再起動することなくカーネルの脆弱性対応パッ チがあてられる。 Livepatch
16. Canonical Livepatchサービスの使い方 1. ubuntu.com/livepatch にアクセスし、livepatchトークンを取得 2. canonical-livepatch snapをインストール “sudo snap install canonical-livepatch” 3. 取得したトークンを使ってサービスを有効化 “sudo canonical-livepatch enable [TOKEN]” 4. ステータスは次のコマンドでいつでも確認できる “canonical-livepatch status --verbose”
17. [ livepatch demo ]
18. Again, we support... + more running anywhere
19. Questions? https://bit.ly/gree-canonical-201706 Nobuto MURATA <nobuto.murata@canonical.com>