Getting Started with Stratus. Evan Bollig 05/01/2017

Transcription

1 Getting Started with Stratus Evan Bollig 05/01/2017

2 Overview What is Stratus? Accessing Stratus Booting Virtual Machines (VMs) Connecting to VMs Working with Volumes Working with Storage Tiers Installing Software

3 What is Stratus?

4 Stratus Stratus is a subscription-based Research Compute Cloud with support for Protected Data Backed by HPE hardware and open-source software, OpenStack (Newton) and Ceph (Kraken) Three types of cloud storage: Block device Volumes S3-compatible Protected Object Cache S3-compatible Persistent Object Storage The Infrastructure-as-a-Service is hosted on-premise at the Minnesota Supercomputing Institute

5 Why Cloud Computing? Cloud computing supports non-traditional HPC workflows: Clinically certified pipelines -- version locked software stacks for reproducibility Software distributed as images and containers -- developer controlled environments Protected data -- ephemeral storage, network isolation, per-user ACLs Long running jobs (> 1 mo.) -- persist through maintenance windows

6 Stratus or Mesabi? Stratus does not compete with HPC Stratus has a self-service, on-demand model. You get what you want, when you want it. The caveat: you are responsible for management and security of your own VMs. Whenever possible, use Mesabi!

7 Managing Expectations Before you get started, let s clarify one more time: Stratus is not a managed HPC environment No software modules. Install your own. No job scheduler. Run jobs as scripts or install your own. No global Tier I Storage (i.e., Panasas) with group directories. Transfer data manually. No automatic backups of VMs, storage, or data. Hardware is oversubscribed to emphasize flexibility and capacity over performance Sane defaults for VM and port security are already applied. If you change settings, you are opting out of our protections at your own risk!

8 Accessing Stratus

9 Login Login with any web browser: Choose UMN OIT - Shibboleth (with Duo)

10 Login Enter your UMN ID and Password when prompted.

11 Duo Two-factor Authentication must be enabled for your account If this is your first time using Duo, follow the setup prompts in the left window. Refer to OIT for configuration help: duo-setup-use-two-factor-authentic ation-0

12 You re In! Congratulations, you are authenticated! If you have one or more Stratus allocations, you will see a list of all of your projects. To become a Stratus subscriber, or to get help with other login issues, contact help@msi.umn.edu

13 The Horizon Interface The OpenStack web interface is called Horizon Horizon provides visibility and control over all Virtual Machines (VMs) and Volumes within each Project The simple Web UI is backed by an advanced Web Service API Click around and kick the tires a bit! Horizon only shows you features that you can control

14 Switching Projects To switch projects, use the omnipresent pull-down

15 Project Quotas Each project has a set of Limits visible from the Project > Compute > Overview tab The base subscription* to Stratus includes: 16 vcpus 50 GB RAM 2 TB of Volume Storage Exhausted quotas prevent creation of new VMs and Volumes (*) à la carte pricing is available for larger allocations

16 Instances The Project > Compute > Instances tab shows active VMs You can Launch or Delete instances, as well as modify settings for individual instances All active and manageable VMs are listed in the table WARNING! A deleted VM is gone for good. Be careful what you delete

17 Volumes The Project > Compute > Volumes tab shows active data volumes Volumes store data, and/or active file systems within VMs You can Create or Delete volumes, as well as modify settings like volume size and attachments All active and manageable VMs are listed in the table WARNING! A deleted volume is gone for good

18 Images The Project > Compute > Images tab shows available images for new VMs MSI provides a number of blessed images. These images come with some pre-configured rules and software for data security Images can be Launched as VMs or converted into Volumes. Volumes created from images can also be launched as VMs

19 Security Groups The Project > Compute > Access & Security tab shows security settings (e.g., security groups and key pairs), plus API access information Security Groups control network traffic to VMs, and work like a firewall By default Security Groups reject all incoming traffic to VMs. Additional Security Groups can be added with rules to open ports (e.g., ssh to TCP port 22)

20 Key Pairs SSH keypairs are essential for accessing VMs Create a new key pair to generate and download a new private key, or Import a key pair to upload an existing public key Every VM will boot with one key pair associated with the default user. To login to the VM you will need the matching private key

21 API Access with OpenStack RC v3 Stratus is backed by many web service APIs that can be controlled directly Click Download OpenStack RC File v3 to get your OpenStack RC file for the current project When sourced in BASH, the OpenStack RC file activates the OpenStack Command Line Interface (CLI)

22 Setup CLI The OpenStack CLI can only connect to Stratus from the bastion host, stratus-bastion.msi.umn.edu To use the CLI: a) b) Transfer your OpenStack RC file to stratus-bastion.msi.umn.edu Source the file on stratus-bastion to authenticate the OpenStack CLI. Use your UMN Password You will be prompted to authenticate with Duo by the bastion host

23 You re Ready! Both Horizon and the OpenStack CLI are ready to roll Let s get started by booting VMs and moving some data!

24 Booting Virtual Machines (VMs)

25 Create a Key Pair (One Time Only) Use the bastion to import a new keypair: 1) 2) 3) Create the new key pair: ssh-keygen -t rsa -b f ~/.ssh/id_rsa Use the OpenStack CLI: openstack keypair create \ --public-key ~/.ssh/id_rsa.pub mykey Check the keypair with: openstack keypair list or go to: oject/access_and_security/ The key pair will be used to boot VMs. Stratus will hold onto the public key, and inject it into VMs, while you hold onto the private key.

26 A New Instance via Horizon The easiest way to boot a VM is through Horizon ( Go to Project > Compute > Instances and click Launch Instance

27 A New Instance via Horizon Horizon provides a Wizard to help you launch VMs. Look for stars (*); those are required fields and can only be set before instance creation! To begin, we name the VM Note that we have the option of booting more than one VM at once by specifying Count

28 A New Instance via Horizon Next we specify the image to boot from. Choose an image, or a volume/snapshot. Enable Create New Volume; this backs the VM with a volume. If you accidentally delete the VM, the volume will persist (unless you agree to Delete Volume on Instance Delete). Specify your Volume Size (GB) based on the capacity needed for the operating system and software on your VM.

29 A New Instance via Horizon Next, choose a Flavor that fits your needs for RAM and vcpus. Total Disk does not matter as the VM storage comes from the backing Volume. Horizon nicely shows you current capacities and the impact on your quota

30 A New Instance via Horizon Next, specify optional settings like additional Security Groups. Don t worry: you can modify optional settings on running VMs, but setting them now will save you time.

31 A New Instance via Horizon Finally, click Launch Instance Stratus will start the boot process and show you details of its current state Inspect the VM by clicking on the Instance Name.

32 A New Instance via Horizon Your instance is ready to go once Status is Active, and Power State is Running

33 Connecting to VMs

34 Opening Port 22 (One Time Only) Before you SSH to a VM, you must open port 22 within the Security Groups Go to Project > Compute > Access & Security and Create Security Group

35 Opening Port 22 (One Time Only) Name the Security Group ssh

36 Opening Port 22 (One Time Only) Next click Manage Rules on the ssh Security Group

37 Opening Port 22 (One Time Only) Click Add Rule

38 Opening Port 22 (One Time Only) Pull down the Rule and choose SSH The default CIDR allows connections from anywhere. Adjust as necessary for your use-case.

39 Opening Port 22 (One Time Only) You re all set! Any VM with the SSH Security Group attached will openly receive ingress (incoming) communication on Port 22

40 Edit a VM s Security Groups To attach the security group, go to Project > Compute > Instances and pull down the instance menu to Edit Security Groups Remember to add the security groups when booting instances, and save time!

41 Edit a VM s Security Groups Apply the new ssh Security Group and click Save The port will be open almost immediately (no reboot required).

42 Choosing the Right Cloud User All cloud images have a default user* for SSH access: On Centos the user is centos On Ubuntu the user is ubuntu See this guide for further details: (*) In the future, some MSI-blessed images will have LDAP enabled for SSH access via your UMNID

43 SSH to VMs Stratus VMs can only be reached via the bastion host, stratus-bastion.msi.umn.edu Remember: a) b) c) VMs are addressed with an IP, not a hostname You must specify the Cloud User when you run ssh Always double check that the server shows the ssh Security Group as attached

44 Working with Volumes

45 Why Volumes? Volumes are created from Block Storage You control the Volume Size Volumes can be formatted as POSIX Filesystems Volumes can migrate between VMs and persist when VMs are stopped Volumes allow for Snapshots

46 Volume Quotas All volumes count against the Volume Storage quota Snapshots are also included

47 Creating a new Volume Go to Project > Compute > Volumes and Create Volume VMs already have volumes attached and in-use for their root filesystem

48 Creating a new Volume Name your volume and specify the desired size (in GB) The size can be grown later The Volume Quota appears on the right

49 Creating a new Volume Success! The volume is created and available. Now you need to attach and format it

50 Attaching a new Volume Pull down the Volume Menu and select Manage Attachments

51 Attaching a new Volume Choose an instance to attach to The Device Name is auto-populated, but you can specify an override

52 Attaching a new Volume The volume is attached! Remember where it is attached to inside the VM (/dev/vdb) Now you need to format and mount the volume

53 Format and Mount a Volume SSH to your VM and check if the volume is present (/dev/vdb) with ls Use mkfs.ext4 (or another mkfs.* command) to format the POSIX filesystem on the volume: sudo mkfs.ext4 /dev/vdb Remember to use sudo for these commands!

54 Format and Mount a Volume The filesystem is ready, but still needs to be mounted. Create a mountpoint with mkdir -p, then mount the filesystem to the mountpoint: sudo mkdir -p /mnt/workspace sudo mount /dev/vdb /mnt/workspace Check the status with df -h Notice that filesystems lose some capacity due to formatting. We ll teach you how to adjust the volume size later

55 Format and Mount a Volume You re almost ready to use the new workspace! Final detail: the mounted filesystem is read-only for regular users. If you want to avoid sudo on every command, open the permissions with chmod: chmod 777 /mnt/workspace

56 Detaching Volumes To safely detach a volume, umount the mount point first: sudo umount /mnt/workspace Confirm it is gone with df -h or ls

57 Detaching Volumes Now you can detach the volume within Horizon Go to Project > Compute > Volumes and pull down the Volume Menu to Manage Attachments

58 Detaching Volumes Click on Detach Volume

59 Detaching Volumes The volume is detached, but not deleted. All data is safe. The volume can be reattached to the previous VM or attached to another VM (e.g., another piece of the workflow)

60 Volume Snapshots Snapshots can be made of any attached or detached volumes Snapshots are static backups of a volume To snapshot a volume, go to Project > Compute > Volumes and choose Create Snapshot from the Volume Menu

61 Volume Snapshots Snapshots can be made of any attached or detached volumes Snapshots are static backups of a volume To snapshot a volume, go to Project > Compute > Volumes and choose Create Snapshot from the Volume Menu

62 Volume Snapshots Label your snapshots intuitively (*) Bug in Horizon: Horizon fails to update the quota for volume snapshots. This will be fixed in the near future.

63 Volume Snapshots If your snapshot exceeds the quota, you will not be able to save it

64 Volume Snapshots You can also snapshot running VMs to lock your software stack Simply create a snapshot of the root volume

65 Volume Snapshots Remember to label and describe the snapshot clearly If the volume is attached and in-use, you can force the snapshot without detaching the volume

66 Volume Snapshots The snapshot might take a while to create

67 Volume Snapshots Viola! The snapshot is ready for use

68 Restoring Snapshots Snapshots are versatile Create Volume will restore the snapshot to a new, attachable volume Launch as Instance restores to a new volume, attached to a new VM instance*. This requires the filesystem inside to be a bootable operating system. (*) Snapshots are your personal VM images

69 Quota Management Storage quotas are always the easiest to fill Remember to delete unused volumes and snapshots to free quota Boot VMs with small volumes (~10GB) and move large workspace volumes between VMs if you would like to purchase a larger quota (1 TB/yr increments)

70 Working with Storage Tiers

71 Storage Tiers Data can migrate between the following Tiers on Stratus: 1. Active Analysis Volume Storage 2. Secure Archive dbgap Cache (s3cache) Persistent Secure Storage (s3secure) 3. Sanitized Data (i.e., non-protected and non-governed) Tier II (tier2) Archive Tape Storage* (*) Availability TBD

72 Where can I use dbgap Data? You can run analysis on dbgap data at MSI, but you must have an active Data Access Plan with the NIH dbgap was previously stored in /panfs/single_copy. It now data goes onto Stratus (s3cache and s3secure)

73 S3 Cache (a.k.a. dbgap Cache) Intended for short-term caching of bulk protected data (e.g., NIH dbgap data). Consider this a scratch space. No source data; copies only! Capacity is limited to 400 TB total, shared by all dbgap users (fairshare). Don t be a jerk! Bucket ACLs are restricted to individual projects; do not open permissions If cache capacity is reached, objects are deleted following a First-In-First-Out rule regardless of 60-day lifecycle

74 S3 Secure Requires purchase (1 TB/yr increments) Dedicated object storage for protected data For data that cannot be made public No public sharing options Stream data directly in/out of VMs with mc and s3cmd

75 Tier II Storage Public sharing options Only for unprotected data! No dbgap clones or other data covered by policy Same archive storage that is available to the rest of MSI Move data between S3 Cache, S3 Secure, and Tier II using the mc or s3cmd commands on a VM Stage data from Tier I (Panasas) into Tier II before pulling into VMs

76 Encryption You are responsible for self-encrypting data at rest (i.e., within S3 Secure and S3 Cache). Use gpg with the S3cmd Use the encryption option with Minio Client* (*) Currently, Minio Client has limited support for encryption. This will improve in the near future.

77 Moving Data Between Tiers Stream data in/out of VMs with Minio Client (mc) or the S3 Command (s3cmd) Stage data from Tier I (Panasas) into Tier II, then pull data into VMs Pull data from NIH using gdc-client (pre-installed on VMs). Move data from VM to s3cache with mc Focus on staging read-write data on volumes, read-only/write-only data in object storage (s3cache and s3secure), and unprotected data in Tier II.

78 Setup Minio MSI blessed images have the Minio Client (mc) pre-installed To use the client: a) b) Upload your Minio config.json from stratus-bastion to the VM: scp \.mc/config.json On the VM: mc ls s3cache mc mb s3cache/dbgap-test mc cp test_file s3cache/dbgap-test/test_file

79 Moving Data Around Put a directory: mc cp -r./dbgap-test \ s3cache/dbgap-test Copy a single file: mc cp s3cache/dbgap-test/test_file \./dbgap-test-file.txt mc cp./dbgap-test-file.txt \ s3secure/dbgap-test/dbgap-test-file.txt Stream data from one storage platform to another: mc mirror s3secure/dbgap-test \ tier2/dbgap-test

80 Installing Software

81 SUDO Privileges Since VMs are self-service, users are in full control of what software gets installed Use sudo to escalate privileges to run commands as root

82 Software from a Package Manager Most operating systems come with a package manager Remember to run with sudo! On Centos use yum: sudo yum install <package> On Ubuntu use apt-get: sudo apt-get install <package>

83 Alternate Installations Refer to your application documentation for preferred installation methods Some packages are in platform agnostic repositories like CRAN ( or PyPi ( Some scientific applications are only available from source Remember: Stratus VMs are self-serve. MSI Staff cannot install software for you.

84 Docker Docker is installed by default on all MSI-blessed images Download and run Docker Container Images from DockerHub ( Try it out: docker run -it centos /bin/bash Or docker run -it biocontainers/samtools \ samtools --version

85 Ports 443 and 8443 To help protect users: a) b) Stratus only allows direct access to VM Ports 443 and 8443*. Any service/application running on these ports must have SSL enabled. All other ports are accessible from stratus-bastion.msi.umn.edu. (*) Security Groups do not open 443 or 8443 by default--follow the guide for Port 22 to open these ports

86 dbgap Software gdc-client is pre-installed on MSI blessed images Use gdc-client to stage data on a VM/volume and then push it into the dbgap Cache with the minio client (mc)

87 Questions? Contact the MSI Help Desk:

88 TODO: Booting from the CLI Creating a volume Attaching an instance to the volume