Secure Multi Tenancy Architecture In Openstack Cloud — Complete Documentation & Simulation

Overview & System Context

Secure Multi Tenancy Architecture In Openstack Cloud: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~9567 Words · Real Software Screenshots: 3 1. Executive Overview & Technical Background OpenStack is a free, open standard cloud computing platform. It is mostly deployed as infrastructure-as-a-service (IaaS) in both public and private clouds where virtual servers and other resources are made available to users. The software platform consists of interrelated components that control diverse, multi-vendor hardware pools of processing, storage, and networking resources throughout a data center. Users manage it either through a web-based dashboard, through command-line tools, or through RESTful web services. OpenStack began in 2010 as a joint project of Rackspace Hosting and NASA. As of 2012, it was managed by the OpenStack Foundation, a non-profit corporate entity established in September 2012 to promote OpenStack software and its community. By 2018, more than 500 companies had joined the project. In 2020 the foundation announced it would be renamed the Open Infrastructure Foundation in 2021.

In July 2010, Rackspace Hosting and NASA announced an open-source cloud-software initiative known as OpenStack. The mission statement was "to produce the ubiquitous Open Source Cloud Computing platform that will meet the needs of public and private clouds regardless of size, by being simple to implement and massively scalable". The project intended to help organizations and offer cloud-computing services running on standard hardware. The community's first official release, code-named Austin, appeared three months later on 21 October 2010 (2010-10-21), with plans to release regular updates of the software every few months. The early code came from NASA's Nebula platform as well as from Rackspace's Cloud Files platform. The cloud stack and open stack modules were merged and released as open source by the NASA Nebula team in concert with Rackspace. In 2011, developers of the Ubuntu Linux distribution adopted OpenStack with an unsupported technology preview of the OpenStack "Bexar" release for Ubuntu 11.04 "Natty Narwhal". Ubuntu's sponsor Canonical then introduced full support for OpenStack clouds, starting with OpenStack's Cactus release. OpenStack became available in Debian Sid from the Openstack "Cactus" release in 2011, and the first release of Debian including OpenStack was Debian 7.0 (code name "Wheezy"), including OpenStack 2012.1 (code name: "Essex"). In October 2011, SUSE announced the public preview of the industry's first fully configured OpenStack powered appliance based on the "Diablo" OpenStack release. In August 2012, SUSE announced its commercially supported enterprise OpenStack distribution based on the "Essex" release.

In 2012, Red Hat announced a preview of their OpenStack distribution, beginning with the "Essex" release. After another preview release, Red Hat introduced commercial support for OpenStack with the "Grizzly" release, in July 2013. The OpenStack organization has grown rapidly and is supported by more than 540 companies. In 2012 NASA withdrew from OpenStack as an active contributor, and instead made the strategic decision to use Amazon Web Services for cloud-based services. In July 2013, NASA released an internal audit citing lack of technical progress and other factors as the agency's primary reason for dropping out as an active developer of the project and instead focus on the use of public clouds. This report is contradicted in part by remarks made by Ames Research Center CIO, Ray O'Brien. As of Nov 2021, NASA continues to utilize OpenStack in IAAS and PAAS support of the Discover supercomputer cluster. The OpenStack environment is called "Explore" and operates in the NASA Center for Climate Simulation at Goddard Space Flight Center.

Neutron was formerly known as Quantum. Sahara used to be called Savanna. Designate was previously known as Moniker. Trove was formerly known as RedDwarf. Zaqar was formerly known as Marconi. Figure 1: OpenNebula vs OpenStack: Choosing the Right Open Source IaaS for Your ... Component based architecture: Quickly add new behaviors Highly available: Scale to very serious workloads Fault-Tolerant: Isolated processes avoid cascading failures Recoverable: Failures should be easy to diagnose, debug, and rectify Open Standards: Be a reference implementation for a community-driven api Cinder volumes provide persistent storage to guest virtual machines - known as instances, that are managed by OpenStack Compute software. Cinder can also be used independent of other OpenStack services as stand-alone software-defined storage. The block storage system manages the creation, replication, snapshot management, attaching and detaching of the block devices to servers.

The EC2 API project aims to provide compatibility with Amazon EC2 The GCE API project aims to provide compatibility with Google Compute Engine OpenStack-based Public Cloud A vendor provides a public cloud computing system based on the OpenStack project. On-premises distribution In this model, a customer downloads and installs an OpenStack distribution in their internal network.

See Distributions. Hosted OpenStack Private Cloud A vendor hosts an OpenStack-based private cloud: including the underlying hardware and the OpenStack software. OpenStack-as-a-Service A vendor hosts OpenStack management software (without any hardware) as a service. Customers sign up for the service and pair it with their internal servers, storage and networks to get a fully operational private cloud. Appliance based OpenStack Nebula was a vendor that sold appliances that could be plugged into a network which spawned an OpenStack deployment.

Cloud storage is a model of computer data storage in which data, said to be on "the cloud", is stored remotely in logical pools and is accessible to users over a network, typically the Internet. The physical storage spans multiple servers (sometimes in multiple locations), and the physical environment is typically owned and managed by a cloud computing provider. These cloud storage providers are responsible for keeping the data available and accessible, and the physical environment secured, protected, and running. People and organizations buy or lease storage capacity from the providers to store user, organization, or application data. Cloud storage services may be accessed through a colocated cloud computing service, a web service application programming interface (API) or by applications that use the API, such as cloud desktop storage, a cloud storage gateway or Web-based content management systems.

Figure 2: OpenStack Use Cases and Data Center Infrastructure • Cloudification Cloud storage is based on highly virtualized infrastructure and is like broader cloud computing in terms of interfaces, near-instant elasticity and scalability, multi-tenancy, and metered resources. Cloud storage services can be used from an off-premises service (Amazon S3) or deployed on-premises (ViON Capacity Services). There are three types of cloud storage: a hosted object storage service, file storage, and block storage. Each of these cloud storage types offer their own unique advantages.

Examples of object storage services that can be hosted and deployed with cloud storage characteristics include Amazon S3, Oracle Cloud Storage and Microsoft Azure Storage, object storage software like Openstack Swift, object storage systems like EMC Atmos, EMC ECS and Hitachi Content Platform, and distributed storage research projects like OceanStore and VISION Cloud. Alibaba Cloud is another example of object storage services or OSS that is fully managed, scalable, secure, and cost-effective cloud storage that is made for storing and accessing large amounts of unstructured data, similar to Amazon S3 and Microsoft Azure Storage. OSS supports bucket-based storage, global access and high durability, making it a standard cloud object storage platform. Examples of file storage services include Amazon Elastic File System (EFS) and Qumulo Core, used for applications that need access to shared files and require a file system. This storage is often supported with a Network Attached Storage (NAS) server, used for large content repositories, development environments, media stores, or user home directories. A block storage service like Amazon Elastic Block Store (EBS) is used for other enterprise applications like databases and often requires dedicated, low latency storage for each host. This is comparable in certain respects to direct attached storage (DAS) or a storage area network (SAN). Cloud storage is: Made up of many distributed resources, but still acts as one, either in a federated or a cooperative storage cloud architecture Highly fault tolerant through redundancy and distribution of data Highly durable through the creation of versioned copies Typically eventually consistent with regard to data replicas Security of stored data and data in transit may be a concern when storing sensitive data at a cloud storage provider.

Outsourcing data storage increases the attack surface area. Cloud storage is a rich resource for both hackers and national security agencies. Because the cloud holds data from many different users and organizations, hackers see it as a very valuable target. Figure 3: OpenStack Backup and Recovery | Multi-Tenancy & Self-Service When data has been distributed it is stored at more locations increasing the risk of unauthorized physical access to the data.

For example, in cloud based architecture, data is replicated and moved frequently so the risk of unauthorized data recovery increases dramatically. Such as in the case of disposal of old equipment, reuse of drives, and reallocation of storage space. The manner that data is replicated depends on the service level a customer chooses and on the service provided. When encryption is in place it can ensure confidentiality. Crypto-shredding can be used when disposing of data (on a disk). The number of people with access to the data who could be compromised (e.g., bribed, or coerced) increases dramatically. A single company might have a small team of administrators, network engineers, and technicians, but a cloud storage company will have many customers and thousands of servers, therefore a much larger team of technical staff with physical and electronic access to almost all of the data at the entire facility or perhaps the entire company. Decryption keys that are kept by the service user, as opposed to the service provider, limit access to data by service provider employees. As for sharing multiple data in the cloud with multiple users, a large number of keys has to be distributed to users via secure channels for decryption, also it has to be securely stored and managed by the users in their devices. Storing these keys requires rather expensive secure storage. To overcome that, key-aggregate cryptosystem can be used. It increases the number of networks over which the data travels. Instead of just a local area network (LAN) or storage area network (SAN), data stored on a cloud requires a WAN (wide area network) to connect them both. By sharing storage and networks with many other users/customers it is possible for other customers to access your data. Sometimes because of erroneous actions, faulty equipment, a bug and sometimes because of criminal intent. This risk applies to all types of storage and not only cloud storage. The risk of having data read during transmission can be mitigated through encryption technology. Encryption in transit protects data as it is being transmitted to and from the cloud service. Encryption at rest protects data that is stored at the service provider. Encrypting data in an on-premises cloud service on-ramp system can provide both kinds of encryption protection. There are several options available to avoid security issues. One option is to use a private cloud instead of a public cloud. Another option is to ingest data in an encrypted format where the key is held within the on-premise infrastructure. To this end, access is often by use of on-premise cloud storage gateways that have options to encrypt the data prior to transfer.

Companies are not permanent and the services and products they provide can change. Outsourcing data storage to another company needs careful investigation and nothing is ever certain. Contracts set in stone can be worthless when a company ceases to exist or its circumstances change. Companies can: Go bankrupt. Expand and change their focus. Be purchased by other larger companies. Be purchased by a company headquartered in or move to a country that negates compliance with export restrictions and thus necessitates a move. Suffer an irrecoverable disaster.

Hybrid cloud storage is a term for a storage infrastructure that uses a combination of on-premises storage resources with cloud storage. The on-premises storage is usually managed by the organization, while the public cloud storage provider is responsible for the management and security of the data stored in the cloud. Hybrid cloud storage can be implemented by an on-premises cloud storage gateway that presents a file system or object storage interface that users can access in the same way they would access a local storage system. The cloud storage gateway transparently transfers the data to and from the cloud storage service, providing low latency access to the data through a local cache. Hybrid cloud storage can be used to supplement an organization's internal storage resources, or it can be used as the primary storage infrastructure. In either case, hybrid cloud storage can provide organizations with greater flexibility and scalability than traditional on-premises storage infrastructure. There are several benefits to using hybrid cloud storage, including the ability to cache frequently used data on-site for quick access, while inactive cold data is stored off-site in the cloud. This can save space, reduce storage costs and improve performance. Additionally, hybrid cloud storage can provide organizations with greater redundancy and fault tolerance, as data is stored in both on-premises and cloud storage infrastructure.

Cloud computing enables users to access scalable and on-demand computing resources via the internet, utilizing hardware and software virtualization. It is a rapidly evolving technology capable of delivering extensible services efficiently, supporting a wide range of applications from personal storage solutions to enterprise-level systems. Despite its advantages, cloud computing also faces several challenges. Privacy concerns remain a primary issue, as users often lose direct control over their data once it is stored on servers owned and managed by cloud providers. This loss of control can create uncertainties regarding data privacy, unauthorized access, and compliance with regional regulations such as the General Data Protection Regulation (GDPR), the Health Insurance Portability and Accountability Act (HIPAA), and the California Consumer Privacy Act (CCPA). Service agreements and shared responsibility models define the boundaries of control and accountability between the cloud provider and the customer, but misunderstandings or mismanagement in these areas can still result in security breaches or accidental data loss. Cloud providers offer tools, such as AWS Artifact (compliance documentation and audits), Azure Compliance Manager (compliance assessments and risk analysis), and Google Assured Workloads (region-specific data compliance), to assist customers in managing compliance requirements. Security issues in cloud computing are generally categorized into two broad groups. The first involves risks faced by cloud service providers, including vulnerabilities in their infrastructure, software, or third-party dependencies. The second includes risks faced by cloud customers, such as misconfigurations, inadequate access controls, and accidental data exposure. These risks are often amplified by human error or a lack of understanding of the shared responsibility model. Security responsibilities also vary depending on the service model—whether Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS). In general, cloud providers are responsible for hardware security, physical infrastructure, and software updates, while customers are responsible for data encryption, identity and access management (IAM), and application-level security. Another significant concern is uncertainty regarding guaranteed Quality of Service (QoS), particularly in multi-tenant environments where resources are shared among customers. Major cloud providers address these concerns through Service Level Agreements (SLAs), which define performance and uptime guarantees and often offer compensation in the form of service credits when guarantees are unmet. Automated management and remediation processes, supported by tools such as AWS CloudWatch, Azure Monitor, and Google Cloud Operations Suite, help detect and respond to large-scale failures. Despite these tools, managing QoS in highly distributed and multi-tenant systems remains complex. For latency-sensitive workloads, cloud providers have introduced edge computing solutions, such as AWS Wavelength, Azure Edge Zones, and Google Distributed Cloud Edge, to minimize latency by processing data closer to the end-user. Jurisdictional and regulatory requirements regarding data residency and sovereignty introduce further complexity. Data stored in one region may fall under the legal jurisdiction of that region, creating potential conflicts for organizations operating across multiple geographies. Major cloud providers, such as AWS, Microsoft Azure, and Google Cloud, address these concerns by offering region-specific data centers and compliance management tools designed to align with regional regulations and legal frameworks.

"Understanding application dependencies" "Comparing on-premise and cloud costs" "Assessing technical feasibility." We may share information as discussed below … Law & Order. We may disclose your information to third parties if we determine that such disclosure is reasonably necessary to (a) comply with the law; (b) protect any person from death or serious bodily injury; (c) prevent fraud or abuse of Dropbox or our users; or (d) protect Dropbox's property rights.

As to whether NSW Police needed a warrant to access the information it was likely to have, Byrne said it depended on the process taken. "Gmail does set out in their process in terms of their legal disclosure guidelines [that] it can be done by a search warrant ... but there are exceptions that can apply in different parts of the world and different service providers. For example, Facebook generally provides an exception for emergency life threatening situations that are signed off by law enforcement." Another computer forensic expert at iT4ensics, which works for large corporations dealing with matters like internal fraud, Scott Lasak, said that police "would just contact Google" and "being of a police or FBI background Google would assist them". "Whether or not they need to go through warrants or that sort of thing I'm not sure. But even for just an IP address they might not even need a warrant for something like that being of a police background. ... NSW Police would not comment on whether it had received help from Google. The search giant also declined to comment, instead offering a standard statement on how it cooperated with law enforcement. A spokesman for the online users' lobby group Electronic Frontiers Australia, Stephen Collins, said Google was likely to have handed over the need information on the basis of "probable cause or a warrant", which he said was "perfectly legitimate". He also said “It happens with relative frequency. … Such things are rarely used in Australia for trivial or malevolent purposes.” United States, the Health Insurance Portability and Accountability Act (HIPAA) requires a contingency plan that includes, data backups, data recovery, and data access during emergencies. The privacy laws of Switzerland demand that private data, including emails, be physically stored in Switzerland. In the United Kingdom, the Civil Contingencies Act of 2004 sets forth guidance for a business contingency plan that includes policies for data storage. In a virtualized cloud computing environment, customers may never know exactly where their data is stored. In fact, data may be stored across multiple data centers in an effort to improve reliability, increase performance, and provide redundancies. This geographic dispersion may make it more difficult to ascertain legal jurisdiction if disputes arise.

U.S. Federal Agencies have been directed by the Office of Management and Budget to use a process called FedRAMP (Federal Risk and Authorization Management Program) to assess and authorize cloud products and services. Federal CIO Steven VanRoekel issued a memorandum to federal agency Chief Information Officers on December 8, 2011 defining how federal agencies should use FedRAMP. FedRAMP consists of a subset of NIST Special Publication 800-53 security controls specifically selected to provide protection in cloud environments. A subset has been defined for the FIPS 199 low categorization and the FIPS 199 moderate categorization. The FedRAMP program has also established a Joint Accreditation Board (JAB) consisting of Chief Information Officers from DoD, DHS, and GSA. The JAB is responsible for establishing accreditation standards for 3rd party organizations who perform the assessments of cloud solutions. The JAB also reviews authorization packages, and may grant provisional authorization (to operate). The federal agency consuming the service still has final responsibility for final authority to operate.

Platform lock-in: cloud services tend to be built on one of several possible virtualization platforms, for example VMware or Xen. Migrating from a cloud provider using one platform to a cloud provider using a different platform could be very complicated. Data lock-in: since the cloud is still new, standards of ownership, i.e. who actually owns the data once it lives on a cloud platform, are not yet developed, which could make it complicated if cloud computing users ever decide to move data off of a cloud vendor's platform. Tools lock-in: if tools built to manage a cloud environment are not compatible with different kinds of both virtual and physical infrastructure, those tools will only be able to manage data or apps that live in the vendor's particular cloud environment. Heterogeneous cloud computing is described as a type of cloud environment that prevents vendor lock-in, and aligns with enterprise data centers that are operating hybrid cloud models. The absence of vendor lock-in lets cloud administrators select their choice of hypervisors for specific tasks, or to deploy virtualized infrastructures to other enterprises without the need to consider the flavor of hypervisor in the other enterprise. A heterogeneous cloud is considered one that includes on-premises private clouds, public clouds and software-as-a-service clouds. Heterogeneous clouds can work with environments that are not virtualized, such as traditional data centers. Heterogeneous clouds also allow for the use of piece parts, such as hypervisors, servers, and storage, from multiple vendors. Cloud piece parts, such as cloud storage systems, offer APIs but they are often incompatible with each other. The result is complicated migration between backends, and makes it difficult to integrate data spread across various locations. This has been described as a problem of vendor lock-in. The solution to this is for clouds to adopt common standards. Heterogeneous cloud computing differs from homogeneous clouds, which have been described as those using consistent building blocks supplied by a single vendor. Intel General Manager of high-density computing, Jason Waxman, is quoted as saying that a homogeneous system of 15,000 servers would cost $6 million more in capital expenditure and use 1 megawatt of power.

Open-source software has provided the foundation for many cloud computing implementations, prominent examples being the Hadoop framework and VMware's Cloud Foundry. In November 2007, the Free Software Foundation released the Affero General Public License, a version of GPLv3 intended to close a perceived legal loophole associated with free software designed to run over a network.

unique to their implementation and thus not interoperable. Some vendors have adopted others' APIs and there are a number of open standards under development, with a view to delivering interoperability and portability. As of November 2012, the Open Standard with broadest industry support is probably OpenStack, founded in 2010 by NASA and Rackspace, and now governed by the OpenStack Foundation. OpenStack supporters include AMD, Intel, Canonical, SUSE Linux, Red Hat, Cisco, Dell, HP, IBM, Yahoo, Huawei and now VMware.

Security is generally a desired state of being free from harm (anything that compromises the state of an entity's well-being). As defined in information security, it is a condition in which an information asset is protected against its confidentiality (quality or state of being free from unauthorized or insecure disclosure contrary to the defined access rights as listed in the access control list and or matrix), integrity (a quality or state of being whole/ as complete as original and uncorrupted as functionally proven by the hash integrity values) and availability (a desired state of an information resource being accessible only by authorized parties (as listed in access control list and or matrix) in the desired state and at the right time. Security is an important domain in as far as cloud computing is concerned, there are a number of issues to be addressed if the cloud is to be perfectly secure (a condition i doubt will ever be achieved)(Martin Muduva, 2015). As cloud computing is achieving increased popularity, concerns are being voiced about the security issues introduced through adoption of this new model. The effectiveness and efficiency of traditional protection mechanisms are being reconsidered as the characteristics of this innovative deployment model can differ widely from those of traditional architectures. An alternative perspective on the topic of cloud security is that this is but another, although quite broad, case of "applied security" and that similar security principles that apply in shared multi-user mainframe security models apply with cloud security. The relative security of cloud computing services is a contentious issue that may be delaying its adoption. Physical control of the Private Cloud equipment is more secure than having the equipment off site and under someone else's control. Physical control and the ability to visually inspect data links and access ports is required in order to ensure data links are not compromised. Issues barring the adoption of cloud computing are due in large part to the private and public sectors' unease surrounding the external management of security-based services. It is the very nature of cloud computing-based services, private or public, that promote external management of provided services. This delivers great incentive to cloud computing service providers to prioritize building and maintaining strong management of secure services. Security issues have been categorized into sensitive data access, data segregation, privacy, bug exploitation, recovery, accountability, malicious insiders, management console security, account control, and multi-tenancy issues. Solutions to various cloud security issues vary, from cryptography, particularly public key infrastructure (PKI), to use of multiple cloud providers, standardization of APIs, and improving virtual machine support and legal support. Cloud computing offers many benefits, but is vulnerable to threats. As cloud computing uses increase, it is likely that more criminals find new ways to exploit system vulnerabilities. Many underlying challenges and risks in cloud computing increase the threat of data compromise. To mitigate the threat, cloud computing stakeholders should invest heavily in risk assessment to ensure that the system encrypts to protect data, establishes trusted foundation to secure the platform and infrastructure, and builds higher assurance into auditing to strengthen compliance. Security concerns must be addressed to maintain trust in cloud computing technology. Data breach is one of the big concerns in cloud computing. A compromised server could significantly harm the users as well as cloud providers. A variety of information could be stolen. These include credit card and social security numbers, addresses, and personal messages. The U.S. now requires cloud providers to notify customers of breaches. Once notified, customers now have to worry about identity theft and fraud, while providers have to deal with federal investigations, lawsuits and reputational damage. Customer lawsuits and settlements have resulted in over $1 billion in losses to cloud providers.

The introduction of cloud computing requires an appropriate IT governance model to ensure a secured computing environment and to comply with all relevant organizational information technology policies. As such, organizations need a set of capabilities that are essential when effectively implementing and managing cloud services, including demand management, relationship management, data security management, application lifecycle management, risk and compliance management. A danger lies with the explosion of companies joining the growth in cloud computing by becoming providers. However, many of the infrastructural and logistical concerns regarding the operation of cloud computing businesses are still unknown. This over-saturation may have ramifications for the industry as a whole.

As organizations adopt OpenStack to build flexible, vendor-lock-in-free , open-source cloud environments, managing multiple tenants securely becomes essential. OpenStack multitenancy with Keystone and Neutron RBAC (Role-Based Access Control) provides a robust framework for authentication, authorization, and resource sharing. Whether you’re running a private cloud for internal teams or offering Infrastructure-as-a-Service (IaaS) to customers, you need a solid foundation to help you maintain secure and scalable cloud infrastructures. In this post, you will learn to master these tools to ensure your identity and access management is reliable, efficient, and safe.

OpenStack Keystone is the identity service used by the OpenStack cloud computing platform. It handles authentication and authorization for all the OpenStack services (like Nova for compute, Glance for images, Cinder for block storage, etc.). Keystone is essentially the gatekeeper that controls who can do what in your OpenStack environment. You can check out this article if you want to learn more about OpenStack Architecture.

IIKeystone makes sure that users are who they say they are and controls what they can do in the cloud. Without Keystone, there would be no way to manage who can access which services or perform which actions. It Keystone organizes identity and access into a hierarchical model with three levels of abstraction : Domains are the top-level containers in Keystone. They usually represent a large organizational boundary – think of different business units, customers, or institutions. Each domain can have its own set of: 2. System Architecture & Core Working Principles This makes domains ideal for multi-tenant or service-provider environments. Public clouds based on OpenStack often create a Keystone domain per customer. And one Keystone Domain can hold tens and hundreds of projects.

Projects (previously called “Tenants”) are logical containers for other cloud resources — such as virtual machines, volumes, networks, routers and more. Most day-to-day OpenStack usage happens at the project level. Users are assigned roles within specific projects, controlling what they can do in each one. OpenStack supports nested projects , a way to create hierarchies within a domain. For example: Nested projects allow for granular control and delegated management, especially when paired with OpenStack RBAC.

Speaking about quotas – these are the soft limits that define how many resources (like VMs, Volumes, or Networks) can be provisioned within a Domain, Project, or a Sub-Project. Projects consume their quotas from the parent Domain, and the total quotas of all Projects within a Domain must not exceed the Domain’s overall allocation. This hierarchical enforcement ensures fair and predictable resource distribution.

Similarly, Sub-Projects draw from the quota of their parent Project. The combined quota limits of all Sub-Projects must remain within the boundaries of the Project’s quota. This allows organizations to delegate responsibility and control at different levels while maintaining centralized oversight. In practice, quotas are an essential tool for avoiding resource exhaustion, ensuring multi-tenancy isolation, and enabling capacity planning across teams, departments, or tenants.

Keystone Domains : Top-level containers representing organizational boundaries. Each domain can contain multiple projects, users, groups and roles. Keystone Projects : Containers for resources like instances, volumes, and networks. They provide isolation between different user groups.

Keystone Sub-Projects : Similar to regular projects, but their parent container is a project, not a domain. Users and Groups : Entities that interact with OpenStack services. Users can be organized into groups for easier management. Quotas: Soft limits on the number of resources that can be provisioned inside of a Project or Sub-Project. The quotas limit the number of users, groups, volumes, VMs, networks, and so on.

This structure facilitates organized and secure management of resources across diverse organizational needs. To navigate OpenStack’s Keystone and RBAC model effectively, it’s essential to understand the core terms. Here’s a quick glossary to help you speak the language of identity and access in OpenStack: I Authentication : The first line of defense – authentication is the process of verifying that a user is who they claim to be.

Think of it like showing your ID badge at the entrance. I Authorization : Once a user is authenticated, authorization checks what they’re actually allowed to do. Just because you’re in the building doesn’t mean you have access to every room. I Domain : A domain acts as a top-level container for users, groups, and projects. It helps structure your cloud by segmenting resources and access. Users in one domain can potentially be authorized to access resources in another – depending on role assignments.

I Project : A project is where the real action happens – it’s a namespace or container for OpenStack resources (like VMs, Volumes, or Networks). Projects are isolated from each other, providing tenants with secure boundaries. To interact with a project’s resources, a user (or group) must have the appropriate role assigned. III Role : A role represents a set of permissions. For example, the admin role typically allows full control over resources, while the reader might only allow viewing them. Creation of additional roles and segregating permissions further is also possible in OpenStack.

I Role Assignment : A role assignment links an actor (a user or group) with a target (a project, domain, or even the entire system). This association defines what the actor can do within the context of that target. I Token : Once authenticated, users receive a token – essentially a temporary pass that allows them to interact with OpenStack services. This token can also carry their role-based permissions.

I User : A user is a digital representation of an individual end user who interacts with OpenStack. I Group : A group is a collection of users. Instead of assigning roles individually, you can assign them to a group – making access control scalable and easier to manage. I Scope : The scope of a token defines the context in which the token is valid—typically a specific project or domain. For example, if a user has access to only one project, their token is “scoped to that project.” I Service : An OpenStack service is any component within the cloud – such as Nova (compute), Neutron (networking), Cinder (block storage), Designate (DNSaaS) or other. Tokens authorize access to these services based on roles and scope.

Role-Based Access Control (RBAC) is a method of regulating access to computer or network resources based on the roles of individual users within an enterprise. In OpenStack, RBAC is implemented to ensure that users have appropriate permissions corresponding to their roles. Roles are defined globally (e.g., reader , member , admin ), but assignments are scoped to a particular project or domain meaning that user gets permissions according to the defined boundary, e.g. Project on the image above.

OpenStack’s RBAC is backed by policy.yaml files in each service. These define what each role can actually do (e.g., who can create a server or list volumes). If you create new roles in OpenStack you have to add those to the respective service policy.yaml file and restart the service. Imagine you’re hosting multiple customers in a private cloud. Each gets its own, dedicated Keystone Domain: Only Customer A users can see and interact with resources in Domain A. RBAC ensures proper isolation.

You may have a shared Engineering Keystone Domain with multiple nested projects. For example: Each team gets member access to their own project, while platform engineers might hold admin roles for the full domain access. 3. Software Implementation, Frameworks & Protocols Your compliance team gets reader roles scoped to relevant projects. They can audit logs, see VM specs and network rules – without being able to modify anything.

The Neutron service (OpenStack’s networking component) supports network-specific RBAC policies – a feature that allows granular sharing of resources like Networks, Routers, or Security groups across Projects and even Domains . Efficient use of floating IP pools or external networks (allowing to share IP pools between multiple projects) Now, both projects can attach ports to this network – without making the network globally accessible.

At Cloudification, we sometimes set up a central external network that multiple OpenStack projects need access to. With Neutron RBAC, we can: Application Credentials are Keystone-issued authentication artifacts that allow a script or an external application to act on behalf of a user – without needing to store or expose that user’s password or re-use an expiring token.

These credentials can be scoped to specific roles and projects, providing tight control over what the application can do. Application Credentials are important when it comes to automation because while automation is key to scaling and efficiency, it doesn’t come without challenges. One of those is the challenge of securely authenticating non-human users (like scripts, CI/CD systems, and monitoring tools).

Security : You avoid storing user passwords in automation scripts or exposing them in CI pipelines. Scoped Access : You can restrict the credentials to specific roles and projects, minimizing risk if compromised. Auditing : Actions taken with application credentials are still tied to the owning user, allowing for traceability in logs. Convenience : Tokens generated from application credentials can be used like any other Keystone token, making integration straightforward.

Say you’re building a CI/CD pipeline that deploys resources to OpenStack. Instead of embedding your cloud admin’s password in a GitHub Actions workflow file, you can create an application credential scoped to a specific project with the member role. That credential can then be stored as a secret and used for authentication in automation scripts. From there, your script can perform OpenStack operations as defined by the scope and role.

Keystone and RBAC together form the core of identity and access control in OpenStack. Understanding how to structure domains, projects, and roles allows you to secure your cloud , empower your teams, and enable collaboration without compromising isolation. When paired with features like Neutron RBAC, OpenStack offers a powerful toolkit for multi-tenant networking and secure resource sharing – without vendor lock-in.

At Cloudification , we help enterprises and service providers design secure, scalable and reliable OpenStack environments. Whether you’re building your own private cloud with our c12n solution or migrating from VMware, we’ll help you get the RBAC and identity model right from day one. In the realm of cloud computing, OpenStack has emerged as a powerful open-source platform for building and managing cloud infrastructure. One of its key features is multi-tenancy, which allows multiple users or organizations to share the same physical infrastructure while maintaining isolation and security. This article delves into the concept of OpenStack multi-tenant isolation, exploring its importance, implementation, and best practices.

Multi-tenancy is a crucial aspect of cloud computing, enabling efficient resource utilization and cost-effective solutions. However, it also brings challenges in terms of security and isolation. OpenStack addresses these challenges through its robust multi-tenant isolation mechanisms, ensuring that each tenant’s data and resources remain separate and secure. By implementing strong isolation measures, OpenStack ensures that tenants can coexist on the same infrastructure without compromising security or performance.

OpenStack employs various mechanisms to achieve multi-tenant isolation. Let’s explore the key components: Projects (formerly known as tenants) are the primary organizational units in OpenStack. Each project has its own set of users, resources, and quotas. OpenStack ensures that resources and data within a project are isolated from other projects. OpenStack Neutron provides network isolation through technologies like VLANs, VXLANs, and GRE tunnels. These create separate network segments for each tenant, preventing unauthorized access and network-level attacks.

OpenStack Cinder and Swift offer block and object storage services, respectively. They implement isolation at the storage level, ensuring that tenants can only access their own data volumes and containers. OpenStack Nova manages compute resources and uses hypervisor-level isolation to separate virtual machines (VMs) belonging to different tenants. This prevents unauthorized access to memory, CPU, and other resources between VMs.

To effectively implement OpenStack multi-tenant isolation, consider the following best practices: Utilize OpenStack Keystone for robust identity management. Implement strong authentication methods and role-based access control (RBAC) to ensure that users can only access resources they are authorized for. Leverage OpenStack Neutron’s capabilities to create isolated network segments for each tenant. Use security groups and network policies to control traffic flow between tenants and external networks.

Implement encryption for data at rest and in transit. Use OpenStack Barbican for key management and integrate it with other OpenStack services to ensure comprehensive data protection. Set appropriate resource quotas for each tenant to prevent resource exhaustion and ensure fair usage. This includes limits on CPU, memory, storage, and network resources.

Conduct periodic security audits and vulnerability assessments to identify and address potential isolation breaches or weaknesses in your OpenStack deployment. While OpenStack provides robust isolation mechanisms, challenges can still arise. Here are some common issues and their solutions: Challenge: A tenant’s workload may impact the performance of others sharing the same physical resources.

4. Practical Deployment, Analysis & Case Studies Solution: Implement Quality of Service (QoS) policies in OpenStack to allocate resources fairly and prevent performance degradation. Challenge: Sophisticated attacks may exploit shared hardware to leak information between tenants.

Solution: Keep OpenStack and hypervisor software up-to-date, and consider implementing additional security measures like CPU pinning or NUMA node isolation. Challenge: Incorrect configurations can lead to unintended access or resource sharing between tenants. Solution: Implement configuration management tools and automated compliance checks to ensure consistent and secure configurations across the OpenStack environment.

ONES Project is a comprehensive project management tool that can help organizations efficiently manage their OpenStack deployments, including multi-tenant environments. It offers features for resource allocation , task tracking, and collaboration, which can be invaluable when managing complex cloud infrastructures. (Free trial) The official OpenStack dashboard provides a web-based interface for managing various aspects of the cloud, including tenant isolation settings and resource allocation .

These OpenStack telemetry services offer monitoring and metering capabilities, helping administrators track resource usage across tenants and detect potential isolation issues. Solutions like Prometheus, Grafana, or ELK stack can be integrated with OpenStack to provide advanced monitoring and visualization of multi-tenant environments.

OpenStack multi-tenant isolation is a cornerstone of secure and efficient cloud infrastructure. By implementing robust isolation mechanisms, organizations can leverage the benefits of shared infrastructure while maintaining the security and privacy of each tenant. As cloud technologies continue to evolve, the principles of multi-tenant isolation will remain crucial in building trust and reliability in cloud services.

To ensure effective OpenStack multi-tenant isolation, organizations should focus on continuous improvement, staying updated with the latest security best practices, and leveraging tools like ONES Project for efficient management. By doing so, they can create a secure, scalable, and cost-effective cloud environment that meets the diverse needs of modern businesses. As we move forward, the importance of OpenStack multi-tenant isolation will only grow. Cloud providers and enterprises alike must prioritize this aspect of their infrastructure to stay competitive and secure in an increasingly digital world. By mastering the art of multi-tenant isolation, we pave the way for a more secure and efficient cloud computing future.

This Reference Architecture (RA-1) aims to provide an OpenStack distribution agnostic reference architecture that includes the Network Function Virtualisation Infrastructure (NFVI) and Virtual Infrastructure Manager (VIM). The different OpenStack distributions, without the not up-streamed vendor specific enhancements, are assumed to be Anuket conformant. This Reference Architecture allows operators to provide a common OpenStack-based architecture for any Anuket compliant VNF to be deployed and operated as expected. The purpose of this chapter is to outline all the components required to provide the Cloud Infrastructure (NFVI and the VIM) in a consistent and reliable way.

OpenStack is already very well documented and, hence, this document will describe the specific OpenStack services and features, Cloud Infrastructure features and how we expect them to be implemented. This reference architecture provides optionality in terms of pluggable components such as SDN, hardware acceleration and support tools.

The Cloud Infrastructure layer includes the physical infrastructure which is then offered as virtual resources via a hypervisor. The VIM is the OpenStack Wallaby release. This section will describe the different services that are exposed for the VNF consumption within the execution zone: The multi tenancy service permits hosting of several VNF projects with the assurance of isolated environments for each project. Tenants or confusingly âIIProjectsâII in OpenStack are isolated environments that enable workloads to be logically separated from each other with: The virtual compute resources (vCPU and vRAM) used by the VNFs behave like their physical counterparts. A physical core is an actual processor and can support multiple vCPUs through Simultaneous Multithreading (SMT) and CPU overbooking. With no overbooking and SMT of 2 (2 threads per core), each core can support 2 vCPUs. With the same SMT of 2 and overbooking factor of 4, each core can support 8 vCPUs. The performance of a vCPU can be affected by various configurations such as CPU pinning, NUMA alignment, and SMT.

The configuration of the virtual resources will depend on the software and hardware profiles and the flavour (resource sizing) needed to host VNF components. Profiles are defined in the Reference Model chapter 2.5 . The OpenStack services, Cinder for block storage and Swift for Object Storage, are discussed below in Section 3.3 âIICloud Infrastructure Management Software (VIM)âII.

Ephemeral data is typically stored on the compute hostâIIs local disks, except in environments that support live instance migration between compute hosts. In the latter case, the ephemeral data would need to be stored in a storage system shared between the compute hosts such as on persistent block or object storage. Images are stored using the OpenStack Glance service discussed below in Section 3.3 âIICloud Infrastructure Management Software (VIM)âII.

The OpenStack Storage Table explains the differences between the storage types and typical use cases. The OpenStack compatible storage backend drivers table lists the capabilities that each of these drivers support. Neutron is an OpenStack project that provides âIInetwork connectivity as a serviceâII between interface devices (e.g., vNICs) managed by other OpenStack services (e.g., Nova). Neutron allows users to create networks, subnets, ports, routers etc. Neutron also facilitates traffic isolation between different subnets - within as well as across project(s) by using different type drivers/mechanism drivers that use VLANs, VxLANs, GRE (Generic Routing Encapsulation) tunnels etc. For Neutron API consumer, this is abstracted and provided by Neutron. Multiple network segments are supported by Neutron via ML2 plugins to simultaneously utilise variety of layer 2 networking technologies like VLAN, VxLAN, GRE etc. Neutron also allows to create routers to connect layer 2 networks via âIIneutron-l3-agentâII. In addition, floating IP support is also provided that allows a project VM to be accessed using a public IP.

SDN (Software Defined Networking) controllers separate control and data (user) plane functions where the control plane programmatically configures and controls all network data path elements via open APIs. Open Networking Forum (ONF) defines SDN as âIISoftware-Defined Networking (SDN) is an emerging architecture that is dynamic, manageable, cost-effective, and adaptable, making it ideal for the high-bandwidth, dynamic nature of todayâIIs applications. This architecture decouples the network control and forwarding functions enabling the network control to become directly programmable and the underlying infrastructure to be abstracted for applications and network services.âII OpenStack Neutron supports open APIs and a pluggable backend where different plugins can be incorporated in the neutron-server.

Plugins for various SDN controllers include either the standard ML-2 plugin or specific monolithic plugins. Neutron supports both core plugins that deal with L2 connectivity and IP address management, and service plugins that support services such as L3 routing, Load Balancers, Firewalls, etc. Below we will explore an example of an SDN controller from LFN projects, that can be integrated with a Neutron plugin, to help overcome a number of shortcomings of the vanilla Neutron and provide many needed features that can be consumed by VNF/CNF.

Tungsten Fabric , an open source SDN in Linux Foundation Networking, offers neutron networking through ML2 based plugin, additionally it supports advanced networking features beyond basic neutron networking via monolithic plugin. It also supports the same advanced networking features via CNI plugin in Kubernetes. Hence, it works as a multi-stack SDN to support VMs, containers, and baremetal workloads. It provides separation of control plane functions and data plane functions with its two components: It is based on proven, standards-based networking technologies but repurposed to work with virtualised workloads and cloud automation in data centres that can range from large scale enterprise data centres to much smaller telco DC (aka POPs) . It provides many enhanced features over the native networking implementations of orchestrators, including: Based on the network layering concepts introduced in the Reference Model Section 3.5 , the Tungsten Fabric Controller performs functions of both the SDN underlay (SDNu) and overlay (SDNo) controllers.

The SDN controller exposes a NB API that can be consumed by ETSI MANO for VNF/CNF onboarding, network service onboarding and dynamic service function chaining. 5. Performance Evaluation & Extended Technical Observations Acceleration deals with both hardware and software accelerations. Hardware acceleration is the use of specialised hardware to perform some function faster than is possible by executing the same function on a general-purpose CPU or on a traditional networking (or other I/O) device (e.g., NIC, switch, storage controller, etc.). The hardware accelerator covers the options for ASICs, SmartNIC, FPGAs, GPU etc. to offload the main CPU, and to accelerate workload performance. Cloud Infrastructure should manage the accelerators by plugins and provide the acceleration capabilities to VNFs.

With the acceleration abstraction layer defined, hardware accelerators as well as software accelerators can be abstracted as a set of acceleration functions (or acceleration capabilities) which exposes a common API to either the VNF or the host. The Cloud Infrastructure Management Software (VIM) provides the services for the management of Consumable Resources/Services.

OpenStack is a complex, multi-project framework, and so we will initially focus on the core services required to provide Infrastructure-as-a-Service (IaaS) as this is generally all that is required for Cloud Infrastructure/VIM use cases. Other components are optional and provide functionality above and beyond Cloud Infrastructure/VIM requirements. The architecture consists of the core services shown in the Figure 3-1; Ironic is an optional OpenStack service needed only for bare-metal containers. The rest of this document will address the specific Anuket conformant implementation requirements and recommendations for the core services.

We will refer to the functions above as falling into the following categories to avoid any confusion with other terminology that may be used: Each deployment of OpenStack should be a unique cloud with its own API endpoint. Sharing underlying cloud resources across OpenStack clouds is not recommended.

The architecture based on OpenStack technology relies on different types of nodes associated with specific roles: The data plane consists of the compute nodes. It is typical to consider the other node types to be part of the control plane. Figure 3-2 depicts the 4 types of nodes constitutive of the Infrastructure: control, compute, network and storage nodes. Deployments can be structured using the distribution of services amongst the 4 node types as depicted in Figure 3-2, but depending on workloads requirements, OpenStack services can also be hosted on the same nodes. For instance, services related to Controller, network and storage roles can be hosted on controller nodes.

To build and lifecycle manage an OpenStack cloud, it is typically necessary to deploy a server or virtual machine as a deployment node or foundation node. This function must be able to manage the bare-metal provisioning of the hardware resources but since this does not affect cloud execution it can be detached from the OpenStack cloud and an operator can select their own tooling as they wish.

Functional requirements of this node include: The following OpenStack components are deployed on the Infrastructure. Some of them will be only deployed on control hosts and some of them will be deployed within both control and compute hosts. The table below also maps the OpenStack core services to the Reference Model (RM) Virtual Infrastructure Manager Reference Model Chapter 3.2.2 Virtual Infrastructure Manager .

All components must be deployed within a high available architecture that can withstand at least a single node failure and respects the anti-affinity rules for the location of the services (i.e. instances of a same service must run on different nodes). The services can be containerised or VM hosted as long as they provide the high availability principles described above. This section describes the core set of services and service components needed to run workloads; instances (such as VMs), their networks and storage are referred to as the âIICompute Node ServicesâII (a.k.a. user or data plane services).

Contrast this with the Controller nodes which host OpenStack services used for cloud administration and management. The Compute Node Services include virtualisation, hypervisor instance creation/deletion, networking and storage services; some of these activities include RabbitMQ queues in the control plane including the scheduling, networking and cinder volume creation/attachment.

In Keystone v1 and v2 (both deprecated), the term âIItenantâII was used in OpenStack. With Keystone v3, the term âIIprojectâII got adopted and both the terms became interchangeable. According to OpenStack glossary , Projects represent the base unit of resources (compute, storage and network) in OpenStack, in that all assigned resources in OpenStack are owned by a specific project. OpenStack offers multi-tenancy by means of resource (compute, network and storage)separation via projects. OpenStack offers ways to share virtual resources between projects while maintaining logical separation. As an example, traffic separation is provided by creating different VLAN ids for neutron networks of different projects. As another example, if host separation is needed, nova scheduler offers AggregateMultiTenancyIsolation scheduler filter to separate projects in host aggregates. Thus, if a host in an aggregate is configured for a particular project, only the instances from that project are placed on the host. Overall, tenant isolation ensures that the resources of a project are not affected by resources of another project.

This document uses the term âIIprojectâII when referring to OpenStack services and âIItenantâII ( RM Section 3.2.1 ) to represent an independently manageable logical pool of resources. Cloud administrators can partition the hosts within an OpenStack cloud using Host Aggregates and Availability Zones. A Host Aggregate is a group of hosts (compute nodes) with specific characteristics and with the same specifications, software and/or hardware properties. Example would be a Host Aggregate created for specific hardware or performance characteristics. The administrator assigns key-value pairs to Host Aggregates, these are then used when scheduling VMs. A host can belong to multiple Host Aggregates. Host Aggregates are not explicitly exposed to tenants.

Availability Zones (AZs) rely on Host Aggregates and make the partitioning visible to tenants. They are defined by attaching specific metadata information to an aggregate, making the aggregate visible for tenants. Hosts can only be in a single Availability Zone. By default a host is part of a default Availability Zone, even if it doesnâIIt belong to an aggregate. Availability Zones can be used to provide resiliency and fault tolerance for workloads deployments, for example by means of physical hosting distribution of Compute Nodes in separate racks with separate power supply and eventually in different rooms. They permit rolling upgrades âII an AZ at a time upgrade with enough time between AZ upgrades to allow recovery of tenant workloads on the upgraded AZ. AZs can also be used to seggregate workloads.

An over use of Host Aggregates and Availability Zones can result in a granular partition of the cloud and, hence, operational complexities and inefficiencies. In OpenStack a flavor defines the compute, memory, and storage capacity of nova instances. When instances are spawned, they are mapped to flavors which define the available hardware configuration for them. For simplicity, operators may create named flavors specifying both the sizing and the software and hardware profile configurations .

The number of Compute nodes (for workloads) determines the load on the controller nodes and networking traffic and, hence, the number of controller nodes needed in the OpenStack cloud; the number of controller nodes required is determined on the load placed on these controller nodes and the need for High availability and quorum requires at least 3 instances of many of the services on these controller nodes.

Virtualisation is a technology that enables a guest Operating System (OS) to be abstracted from the underlying hardware and software. This allows to run multiple Virtual Machines(VMs) on the same hardware. Each such VMs have their own OS and are isolated from each other i.e. application running on one VM does not have the access to resources of another VM. Such virtualisation is supported by various hypervisors available as open-source (KVM, Xen, etc.) as well as commercial (Hyper-V, Citrix XenServer, etc.). Selecting a hypervisor depends on the workload needs and the features provided by various hypervisors as illustrated in Hypervisor Feature Support Matrix . OpenStack (Nova) allows the use of various hypervisors within a single installation by means of scheduler filters like ComputeFilter, ImagePropertiesFilter etc.

Virtualisation Services: The OpenStack nova-compute service supports multiple hypervisors natively or through libvirt. The preferred supported hypervisor in this Reference Architecture is KVM. Note : Other hypervisors (such as ESXi) can also be supported as long as they can interoperate with other OpenStack components (e.g., those listed in this Reference Architecture) using standard interfaces and APIs as specified in Chapter 5.

The aim is to specify the requirements on deploying the VIM, from ground up (in a shipping container), and what resources are required of the DC (Data Centre). The physical resources required for the Cloud Infrastructure are mainly based on COTS x86 hardware for control and data plane nodes. HW profiles are defined in Reference Model chapters 5.3 and 5.4 .

Figure 3-3 shows a physical network layout where each physical server is dual homed to TOR (Leaf/Access) switches with redundant (2x) connections. The Leaf switches are dual homed with redundant connections to spines. OpenStack supports many different storage architectures and backends. The choice of a particular backend storage is driven by a number of factors including: scalability, resiliency, availability, data durability, capacity and performance.

Most cloud storage architectures incorporate a number of clustered storage nodes that provide high bandwidth access to physical storage backends connected by high speed networks. The architecture consists of multiple storage controller units, each a generic server (CPU, Cache, storage), managing a number of high-performance hard drives. The distributed block storage software creates an abstract single pool of storage by aggregating all of the controller units. Advanced and high-speed networking (data routing) and global load balancing techniques ensure high-performance, high availability storage system.

A telco cloud will typically be deployed in multiple locations (âIIsitesâII) of varying size and capabilities (HVAC, for example); or looking at this in the context of OpenStack, multiple clouds (i.e. OpenStack end-points) will be deployed that do not rely on each other, by design; each cloud consists of a set of resources isolated from resources of the other clouds. The application layer must span such end-points in order to provide the required service SLA. Irrespective of the nature of the deployment characteristics (e.g., number of racks, number of hosts), the intent of the architecture would be to allow VNFs to be deployed in these sites without major changes.

Harvested Online Documentation & Reference Sources • https://en.wikipedia.org/wiki/OpenStack • https://en.wikipedia.org/wiki/Cloud%20storage • https://en.wikipedia.org/wiki/Cloud%20computing%20issues • https://cloudification.io/cloud-blog/mastering-openstack-multitenancy-with-keystone-and-neutron-rbac-a-guide-to-secure-coll aboration/ • https://ones.com/blog/openstack-multi-tenant-isolation-explained/ • https://cntt.readthedocs.io/en/stable-lakelse/ref_arch/openstack/chapters/chapter03.html