ManageIQ and OpenStack: Both as a Source of Truth

[mdsue]

Dear ManageIQ Team,

We are writing from TIM, the leading telecommunications company based in Italy. We have a few questions to assist us with our work. We're currently utilizing ManageIQ to build a CMP (Cloud Management Platform).

ManageIQ and OpenStack: Both as a Source of Truth

We want to ensure that all resources created on OpenStack are traceable to a customer who initiated the resource creation within ManageIQ. To achieve this, we are implementing the following steps:

1. We create a Cloud Tenant in ManageIQ, which subsequently creates a Project in OpenStack.
2. We create a Group in ManageIQ with the role EvmRole-administrator and the project/tenant set equal to the Cloud Tenant created in step 1.
3. We assign the customer user to the Group created in step 2.
4. When the user creates an instance, they can only create it within our defined Cloud Tenants.

ManageIQ and OpenStack: Both as a Source of Truth - Questions

1. When we create a Cloud Tenant, is the only way to see it reflected in ManageIQ by refreshing through the Rails console?

Ruby

irb(main):001:0> ems = ExtManagementSystem.find_by(name: "devstack")
irb(main):002:0> ems.refresh

3. Is this strategy, using Cloud Tenants, also suitable for managing networking items like VPNs or Load Balancers?
4. What is the difference between "tenants" and "Cloud Tenants" in ManageIQ?
5. We've noticed that ManageIQ tenants are managed by these APIs: https://www.manageiq.org/docs/reference/latest/api/reference/tenants.html, while Cloud Tenants seem related to the code repository here: https://github.com/ManageIQ/manageiq-providers-openstack.

Thank you for your assistance.

[agrare]

Hey @mdsue,

1. When we create a Cloud Tenant, is the only way to see it reflected in ManageIQ by refreshing through the Rails console?

The openstack provider has what we call event-driven targeted refresh, that means that when an event is raised by the provider we catch the event, parse the contents, and refresh only that object and any related items. This should be done whether you created the project through ManageIQ or via openstack directly. You shouldn't have to refresh the provider manually if eventing is working properly. I'll want to spend more time investigating this at the end but I'll go through your other questions first.

3. Is this strategy, using Cloud Tenants, also suitable for managing networking items like VPNs or Load Balancers?

Do you mean if you create a Load Balancer, do you have to manually refresh the provider for it to show up? Ideally no if you do then something else is broken.

4. What is the difference between "tenants" and "Cloud Tenants" in ManageIQ?

A Cloud Tenant is a provider resource no different from a VM or a Host. We use generic names rather than matching any specific provider directly so that it makes sense as a single-pane-of-glass. Cloud Tenants in OpenStack are Identity service projects as you've mentioned.

A Tenant in ManageIQ is an internal structure for managing users, groups, inventory, etc... and for access control.

So one is synced (refreshed) from the provider and the other is for internal use for MIQ administration and access control.

Normally that would be the end of the story, but specifically in OpenStack only we have what we call tenant-mapping which will automatically create ManageIQ Tenants for OpenStack projects. This is intended to simplify the task for administrators who want to keep these in sync and use that as the basis for RBAC and resource visibility for their users.

Here are some relevant docs on these topics:
ManageIQ Tenants: https://www.manageiq.org/docs/reference/latest/general_configuration/index.html#access-control
OpenStack Cloud Tenants: https://www.manageiq.org/docs/reference/latest/managing_infrastructure_and_inventory/index.html#cloud-tenants
Tenant Mapping: https://www.manageiq.org/docs/reference/latest/managing_infrastructure_and_inventory/index.html#tenant-mapping

5. We've noticed that ManageIQ tenants are managed by these APIs: https://www.manageiq.org/docs/reference/latest/api/reference/tenants.html, while Cloud Tenants seem related to the code repository here: https://github.com/ManageIQ/manageiq-providers-openstack.

Yes, I think this is covered by "what is the difference between tenants and cloud tenants".

Getting back to the issues with having to manually refresh the provider to see new cloud tenants,

1. Do you have the events endpoint configured for this provider?
2. What Event service are you using (AMQP, Ceilometer, STF)
3. Do you see other resources like openstack servers get created in MIQ quickly and it is only projects that you have to manually refresh? Or is it everything.
4. What version / distribution of OpenStack are you using?

Look forward to hearing back from you,
Adam

[lucky-sideburn]

Dear @agrare thank you! I am a colleague of @mdsue

A part the refresh process, is it correct that we create a Cloud Tenant and, using RBAC (Role-Based Access Control), we force a user to create resources only within their tenant? Is this a common best practice with ManageIQ/OpenStack?

Also, other resources like Load Balancers are targeted to a specific cloud tenant.

Do you have the events endpoint configured for this provider?

• We are going to expose AMQP and configure it on the provider within ManageIQ.

What Event service are you using (AMQP, Ceilometer, STF)?

• AMQP

Do you see other resources, such as OpenStack servers, being created quickly in ManageIQ, and is it only projects that you have to manually refresh? Or is it everything?

• Everything

What version/distribution of OpenStack are you using?

• Epoxy