IBM Cloud Manager with OpenStack Disaster Recovery ... · CHAPTER TWO GETTING STARTED 2.1Adding IBM...

IBM Cloud Manager with OpenStackDisaster Recovery Documentation

Release 1.0

IBM HRL

June 08, 2015

CONTENTS

1 What is the purpose of the project and vision for it? 31.1 How it Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

2 Getting Started 52.1 Adding IBM Disaster Recovery to a deployed topology . . . . . . . . . . . . . . . . . . . . . . . . 5

3 Developers Documentation 73.1 Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

4 API Documentation 94.1 Dragon API Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94.2 Dragon client API . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

5 Operations Documentation 175.1 Protect a workload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175.2 Recover a workload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

6 Indices and tables 25

i

IBM Cloud Manager with OpenStack Disaster Recovery Documentation, Release 1.0

IBM Cloud Manager’s Disaster Recovery is a service that enables Disaster Recovery for Openstack workloads.

CONTENTS 1


2 CONTENTS

CHAPTER

ONE

WHAT IS THE PURPOSE OF THEPROJECT AND VISION FOR IT?

• IBM Cloud Manager’s Disaster Recovery provides an API and panels in Horizon to specify workload protectionpolicies and triggering them by executing appropriate OpenStack API calls to protect running cloud applications.

• Currently cloud applications are protected by storing their resources and metadata in a shared object storage at athird party location. Protected applications can be restored on any OpenStack cloud having access to the sharedobject storage.

• The software integrates other core components of OpenStack into unified system. IBM Cloud Manager’s Disas-ter Recovery allows to protect and restore most OpenStack resource types (such as instances, volumes, securitygroups, users, etc).

This documentation offers information on how IBM Cloud Manager’s Disaster Recovery works and how to install anduse it.

1.1 How it Works

• IBM Cloud Manager’s Disaster Recovery is an admin tool that natively supports multi-tenancy.

• It runs as a service registered in the OpenStack system (through keystone) and it can access the list of resources(instances, volumes, security groups, public keys) of each tenant accessible by the admin user

• An admin user can switch to a specific tenant and create one (or more) workload protection policies. A policyis a collection of resources with associated resource actions. A resource action provides the implementation ofthe “protect” and “restore” logic for a specific resource type.

• For instance, in the current implementation of dragon, for a resource of type volume (a volume in cinder) thecurrent default action is called “volume snapshot ”. The “protect” logic of this action first creates a clone ofthe volume, then uses cinder-backup to export the clone data to a remote swift, then saves the cinder-backupmetadata to swift. Conversely the “restore” logic is able to import the cinder-backup metadata from swift into acinder instance and then invoke the restoration of the volume from swift.

• The admin user can manually trigger a workload protection policy and check the status of execution of theprotect tasks for each resource and associated action. Once a protection policy has been correctly executed, themetadata needed to restore the protected resources is saved to a configurable third party object container (swift)

• The recover scenario requires authenticated access to the object container from a dragon instance typically on asecondary (recovery) site. Using the same tenant for which a protection policy was executed, the admin user isable to retrieve a list of successful protection policy executions and restore a point in time

3


• Point in time restore reads the metadata of the protected resources from swift, invokes the restore steps for eachaction associated to a resource, and finally triggers the deployment of the protected workload through heat

4 Chapter 1. What is the purpose of the project and vision for it?

CHAPTER

TWO

GETTING STARTED

2.1 Adding IBM Disaster Recovery to a deployed topology

The IBM Openstack DR project supports backup through Swift and enables protect and recover of workloads. Use thefollowing procedure to add the DR feature to a deployed topology. The DR feature needs to be on the same node withOpenStack controller node.

1. Log in to the deployment system as the root user. This is the system where IBM Cloud Manager with OpenStackwas installed.

2. Append the ibm-os-dr role to this node in your topology file your-topology-name.json

For example, in a minimal topology file, you would append role[ibm-os-dr] to the run list for the node: “runlist”:[

“role[ibm-os-allinone-kvm]”, “role[ibm-os-dr]”

]

3. Update the topology

$ knife os manage update topology your-topology-name.json

4. If not yet configured, configure /etc/cinder/cinder.conf to point to your Openstack Swift for the cinder’sSwift backup driver: set backup_swift_url, backup_swift_key, backup_swift_auth=single_user, backup_swift_user,backup_swift_tenant parameters in cinder.backup.drivers.swift section.

Restart cinder-backup service for the changes to be effective.

After the deployment completes, you can check the status of DR service via Checking status of OpenStack services.You are ready to start using DR feature. You can find the DR panel on Horizon UI.

5


6 Chapter 2. Getting Started

CHAPTER

THREE

DEVELOPERS DOCUMENTATION

3.1 Architecture

High level architecture of the IBM Cloud Manager’s Disaster Recovery service components

Dragon comprises a number of Python components:

3.1.1 dragon client (python-dragonclient)

A Python command line client and library that communicates and controls the DR API.

3.1.2 dragon-api

The dragon-api component provides a REST API that processes API requests by sending them to the dragon-engineover RPC.

7


3.1.3 dragon-engine

The dragon engine does the main work of orchestrating the launch of protection or recovery actions, protection policyediting and providing events back to the API consumer.

3.1.4 dragon user interface

A Horizon dashboard for visualizing the DR process, includes protect and recover panels

8 Chapter 3. Developers Documentation

CHAPTER

FOUR

API DOCUMENTATION

4.1 Dragon API Reference

4.1.1 List resource types

GET /v1/{project_id}/resource_types

Result:

‘‘‘ HTTP/1.1 200 OK [{Resource type 1}, {Resource type 2}]

[{ “resource_type”: {“name”: “instance”, “created_at”: “2015-02-17T18:50:09.629273”, “updated_at”: “2015-02-17T18:50:09.629316”, “default_action_id”: 2, “id”: 1}},{ “resource_type”: {“name”: “volume”, “created_at”: “2015-02-17T18:50:09.629273”, “updated_at”: “2015-02-17T18:50:09.629316”, “default_action_id”: 1, “id”: 2}}]

‘‘‘

4.1.2 List DR actions available for a specific resource type

GET /v1/{project_id}/actions/{resource_type_id}

Parameters: * resource_type_id The unique identifier of the resource type to show actions for

Result:

‘‘‘ HTTP/1.1 200 OK

[{Action 1},{Action 2}] ‘‘‘

4.1.3 List default DR action of a specific resource type

GET /v1/{project_id}/get_default_action_for_resource_type/{resource_type_id}

Parameters: * resource_type_id The unique identifier of the resource type to show action for

Result:

‘‘‘ HTTP/1.1 200 OK

[{Action}] [{“resource_type_id”: 1, “class_name”: “dragon.workload_policy.actions.plugins.instance_snapshot_action.InstanceSnapshotAction”,“created_at”: “2015-02-17T18:50:09.653012”, “updated_at”: “2015-02-17T18:50:09.653019”, “id”: 2, “name”:“Image Snapshot”}] ‘‘‘

9


4.1.4 Mark a resource for DR

‘‘‘ POST /v1/{tenant_id}/resources

{ “resource_id”: “{resource_id}”, “resource_name”:”{resource_name}”, “resource_type”:”{resource_type}”

}

Parameters: * resource_id The unique identifier of the existing resource to enable dr for * resource_name The nameof the resource to enable dr for * resource_type The type of the resource to enable dr for (Instance/Volume/...)

Result:

‘‘‘

4.1.5 List resources marked for DR

GET /v1/{project_id}/resources

Result:

‘‘‘ HTTP/1.1 200 OK

[{Resource 1},{Resource 2}] ‘‘‘

4.1.6 Get resource data

GET /v1/{project_id}/resources/{resource_id}

Parameters: * resource_id The unique identifier of the existing resource to enable dr for

Result:

‘‘‘ HTTP/1.1 200 OK

{Resource} ‘‘‘

4.1.7 Create workload policy

POST /v1/{project_id}/workload_policies

{ “tenant_id”: “{tenant_id}”, “name”:”{name}”,

}

Parameters: * tenant_id The unique identifier of the workload policy’s tenant * name The name of the workload policy

Result:

‘ HTTP/1.1 200 OK {new workload_policy object} ‘

10 Chapter 4. API Documentation


4.1.8 List workload policies

GET /v1/{project_id}/workload_policies

Result:

‘‘‘ HTTP/1.1 200 OK

[{workload policy 1},{workload policy 2}] ‘‘‘

4.1.9 Get wokrload policy data

GET /v1/{project_id}/workload_policies/{workload_policy_id}

Parameters: * workload_policy_id The unique identifier of the existing workload_policy

Result:

‘‘‘ HTTP/1.1 200 OK

{workload_policy} ‘‘‘

4.1.10 Delete workload policy

‘ DELETE /v1/{tenant_id}/workload_policies/{workload_policy_id} ‘

Parameters:

• workload_policy_id The unique identifier of the workload policy

Result:

‘ HTTP/1.1 204 No Content ‘

4.1.11 Assign an action to a resource in a workload policy

POST /v1/{project_id}/resource_action/{resource_id}

{ “action_id”: “{action_id}”, “workload_policy_id”:”{workload_policy_id}”,

}

Parameters: * resource_id The unique identifier of the resource * action_id The unique identifier of the action toperform on the resource * workload_policy_id The id of the workload policy the resource belogns to

Result:

‘ HTTP/1.1 200 OK ‘

4.1.12 Get wokrload policy’s resources

GET /v1/{project_id}/workload_policies/{workload_policy_id}/resource_actions

Parameters: * workload_policy_id The unique identifier of the workload_policy

Result:

‘‘‘ HTTP/1.1 200 OK

4.1. Dragon API Reference 11


[{Resource-action}{Resource-action}] ‘‘‘

4.1.13 Remove a resource from a workload policy

DELETE /v1/{project_id}/resource_action/{tuple_id}

{ “tuple_id”:”{tuple_id}”,

}

Parameters: * tuple_id The unique identifier of the resource-action

Result:

‘ HTTP/1.1 200 OK ‘

4.1.14 List workload policy’s executions

GET /v1/{project_id}/workload_policies/{workload_policy_id}/executions

Parameters: * workload_policy_id The unique identifier of the workload_policy

Result:

‘‘‘ HTTP/1.1 200 OK

[{workload policy execution}{workload policy execution}] ‘‘‘

4.1.15 Get workload policy’s execution data

GET /v1/{project_id}/policy_executions/{policy_execution_id}

Parameters: * policy_execution_id The unique identifier of the workload_policy’s execution

Result:

‘‘‘ HTTP/1.1 200 OK

[{workload policy execution}] ‘‘‘

4.1.16 List workload policy’s execution detailed actions status

GET /v1/{project_id}/policy_executions/{policy_execution_id}/actions

Parameters: * policy_execution_id The unique identifier of the workload_policy’s execution

Result:

‘‘‘ HTTP/1.1 200 OK

[{workload policy execution action 1}{workload policy execution action 2}] ‘‘‘

4.1.17 Protect a workload policy

POST /v1/{project_id}/protect/{workload_policy_id}

{ “consistent”:”{consistent}”,



}

Parameters: * workload_policy_id The unique identifier of the workload policy to protect * consistent gurantee aconsistenct protect action through all resources in the workload policy True/False

Result:

‘ HTTP/1.1 200 OK ‘

4.1.18 List all available workload policy executions’ container names

GET /v1/{project_id}/recovery/policies

Result:

‘‘‘ HTTP/1.1 200 OK

[{container name 1}{container name 2}] ‘‘‘

4.1.19 List workload policy executions’ container names for a given workload pol-icy name

GET /v1/{project_id}/recovery/policies/{policy_name}/executions

Parameters: * policy_name workload policy name

Result:

‘‘‘ HTTP/1.1 200 OK

[{container name 1}{container name 2}] ‘‘‘

4.1.20 Recover from a container

POST /v1/{project_id}/recover

{ “container_name”:”{container_name}”,

}

Parameters: * container_name The container name to recover from

Result:

‘ HTTP/1.1 200 OK ‘

4.2 Dragon client API

create_resource(resource_id, resource_name, resource_type_id)

• create for a given triple : resource_id, resource_name, resource_type_id

param ID of resource

param Name of resource

param ID of type of resource

4.2. Dragon client API 13


rtype none

create_resource_action(resource_id, action_id, workload_policy_id)

• create for a given triple: resource_id, action_id, workload_policy_id


param ID of action

param ID of workload policy

rtype none

create_workload_policy(policy_name, tenant_id, policy_id)

• create workload policy

param Name of policy

param tenant ID

rtype Policy ID

delete_resource_action(resource_action_id)

• remove a resource from a workload_policy

param resource_action_id

rtype none

delete_workload_policy(workload_policy_id)

• per given workload policy id


rtype none

get_policy_executions(policy_execution_id )

• policy executions of policy_execution_id

param ID of policy

get_resource(resource_id )

• get resource info for a given resource_id


rtype resource info: id, type, name

get_resource_actions( workload_policy_id)

• for a given workload_policy_id - get all defined actions


rtype defined actions information per given workload

get_workload_policy( workload_policy_id)

• get policy per given workload policy id


rtype specified workload policy info

list_actions( resource_type_id)



• list_actions for a given resource type

param ID of resource type

rtype list of defined actions details per resource type

list_policy_executions(workload_policy_id )

• for a given workload policy


rtype defined policy workload id information of policy executions

list_resources( )

• list all resources

param none

rtype list of resources (instances, volumes etc.)

list_workload_policies( )

• list all workload policies of current tenant

param none

rtype All workload policies information

protect(workload_policy_id, [is_consistent] )

• protect a given policy


param is consistency required (True/False), will pause relevant VMs before ap-plying the protect actions on the workload_policy

rtype none

recover(container_name )

• recover from a given container

param Name of container to recover from

rtype none

recovery_list_policies()

• List available workload policy executions’ container names

param None

rtype container names

recovery_list_policy_executions(workload_policy_name)

• List workload policy executions’ container names for a given workload policy name

param workload_policy_name

rtype container names

4.2. Dragon client API 15

CHAPTER

FIVE

OPERATIONS DOCUMENTATION

5.1 Protect a workload

To set protection policies and select objects to protect connect to the primary cloud and Login as admin.

Figure 5.1: Login at the primary cloud as Admin

Next, select the tenant whose workloads you wish to protect.

Figure 5.2: Select the tenant from the drop down menu on the right side of the toolbar

On the left side panel, select Disaster Recovery->Protect Workload to see the list of protection policies.

17


Figure 5.3: Accessing the “Protect Workload” page from the “Disaster Recovery” menu on the left panel

Figure 5.4: Providing a name for a new protection policy

In order to add a new Protection policy, click “add policy” button. You will need to provide a mnemonic name for thenew policy.

To add resources to the protection policy, click the “add resource” button

On the Manage Resources page, select the resources to be protected using the current policy

Adding a resource to a policy, the resource will be associated to a default protection depending on the resource type.The default protection action for volumes is “Volume Snapshot”, while for instances it is “Image Snapshot”. You canchange the protection action of each resource through the edit action button on each resource line.

Back to the “Protect Workload” page, in order to execute the actions of a workload policy, click the trigger policybutton.

Each time a workload policy is triggered, a workload policy execution object is created. A workload policy executionlists all the steps of the actions as they are performed, their outcome, and indicates the protection status for eachresource.

If all workload policy actions are executed successfully, the policy execution will update its status to “Protected”.Otherwise, the “Error” status is shown.

Clicking on the “details” button of an execution policy will show the list of resources and the steps taken in theirprotection actions. for instance, in the weekly protection policy, two resources were protected: an instance named“test_backup” and the volume “v1”. The former was protected using an Instance Snapshot action. The instance wascloned, a snapshot was created and next uploaded to Swift. For the v1 Volume, volume cloning and snapshot wherealso executed. A complete point in time for recovery was created.

18 Chapter 5. Operations Documentation


Figure 5.5: Policy view with associated resources and policy executions

Figure 5.6: List of resources not yet associated to the current policy. Use the check boxes to add resources to beprotected to the policy.

Figure 5.7: A policy with its protected resources and associated actions. The “Edit action” button allows to set thedesired protection action for each resource.

5.1. Protect a workload 19


Figure 5.8: The “Trigger Policy” button starts the execution of the protection actions on the policy resources.

Figure 5.9: The policy execution status while the policy is being executed is labeled “Creating”.

Figure 5.10: Once all policy actions have been completed successfully, the policy execution status changes to “Pro-tected”



Figure 5.11: The action steps and their status of a successful policy execution protecting an instance and a volume

5.2 Recover a workload

To recover workloads that were protected using IBM Cloud Manager’s Disaster Recovery feature, login into thesecondary cloud with the admin user.

Note the following assumptions:

1. The secondary cloud has IBM Cloud Manager’s Disaster Recovery components running (i.e. DB schema in-stalled and populated with resource types and actions, Swift connected, etc.)

2. The secondary cloud is clean of resources (i.e. no resources with names that may be colliding with DR restoredresources)

Figure 5.12: Login as admin to the secondary site

Next, select the tenant whose workloads are to be restored.

On the left panel, select Disaster Recovery -> Restore workload

Choose the workload to be restored from the list of workload policies with points in time available for restore.

5.2. Recover a workload 21


Figure 5.13: Choose the tenant from the drop-down menu in the toolbar.

Figure 5.14: The “Restore Workload” option in the disaster recovery menu

Figure 5.15: The list of protection policies available for restore



For each policy, all available points in time available for restore are listed, with their timestamp. Each point in timeincludes a status and a status.log file with indications of the backup state. Points in time are sorted by the time it wastaken, with the most recent one first.

Figure 5.16: The list of available points in time for restore of a protection policy

Click the recover button to start restoring the workload

Figure 5.17: The restore button triggers the actions needed to recreate the protected resources from the policy

Now you can switch to the Orchestration tab on the left, and watch your stack being deployed from the point in time .

Note that all workload policies are restored as well to enable protection on the secondary site.

5.2.1 Fallback

As for now, full fallback only is supported.

To fallback, make sure you protect the workload policies on the secondary cloud, next clean the primaryfrom objects and DR data, and invoke the recover on the primary cloud

5.2. Recover a workload 23

CHAPTER

SIX

INDICES AND TABLES

• genindex

• modindex

• search

25

IBM Cloud Manager with OpenStack Disaster Recovery ... · CHAPTER TWO GETTING STARTED 2.1Adding IBM...

Documents

Transcript of IBM Cloud Manager with OpenStack Disaster Recovery ... · CHAPTER TWO GETTING STARTED 2.1Adding IBM...