Get in Touch

Course Outline

1. Introduction to OpenStack

  • History of cloud computing and OpenStack
  • Key cloud features
  • Cloud deployment models
    • Private, public, and hybrid clouds
    • On-premise, IaaS, PaaS, and SaaS
  • OpenStack-based public and private cloud deployments
  • Open-source and commercial OpenStack distributions
  • OpenStack deployment strategies
  • The OpenStack ecosystem
    • Core modules
    • Underlying tools
    • Integration capabilities
  • OpenStack lifecycle management
  • OpenStack certification pathways

2. Cloud security and OpenStack

Security domains within private clouds
Threat classification and attack vectors
System and network documentation practices
System management protocols
Vulnerability management strategies
Configuration management and policy enforcement
System backup and recovery procedures
Server hardening techniques
OpenStack management interfaces
Dashboard (Horizon)
API access
SSH connectivity
Out-of-Band (OOB) management
Secure communication channels
TLS and HTTPS implementation
Reference architectures

3. OpenStack architecture and security

Keystone - Identity Service
Keystone architecture overview
Authentication methods and available backends
Token types and token management
Authorization in OpenStack - roles and oslo.policy
Keystone resources: domains, projects, and users
CLI client configuration via Openrc and clouds.yaml
OpenStack service catalog
Quota systems in OpenStack
Glance - Image Service
Glance architecture overview
Cloud-adapted images
Adding new images
Securing Glance deployments
Image metadata
Neutron - Networking Service
Neutron architecture overview
Neutron service distribution
Networks in OpenStack deployments
Network isolation in Neutron
Basic Neutron resources
Compute node networking
Tenant (self-service) networks and subnets
Routing for tenant networks (East-West routing)
Provider networks
Accessing external resources (North-South routing)
Network namespaces
Physical traffic flow in Neutron nodes
Floating IPs
Security Groups
Role-based access control (RBAC)
Nova - Compute Service
Nova architecture overview
Hypervisors in the compute service
QEMU vs. KVM
Keypair management
Flavor management
Instance metadata
Instance features
Creating, verifying, and managing virtual instances
Inspecting VMs at the compute node
Assigning Security Groups and Floating IPs
Tapping into instance ports
Anti-spoofing (port security) in OpenStack
L3 virtual resources (router functions for instance traffic)
Nova-scheduler - compute node selection
Metadata service and configuration drive
Instance migration
Hardening the compute service
Cinder - Block Storage Service
Cinder architecture overview
Volume features
Creating a volume
Attaching and accessing the volume
Storage backends: iSCSI, Ceph
Volume wiping
Barbican - Key Management Service
Barbican architecture overview
Storing passphrases
Generating and storing symmetric encryption keys
Volume encryption mechanisms
  • Configuring Cinder storage type for volume encryption
  • Limitations of volume encryption
  • Storing X.509 certificate bundles

4. Other aspects related to architecture & security

  • Tenant data privacy
  • Instance security
  • Oslo.policy - creating custom roles and API authorization
  • High Availability in OpenStack

Requirements

  • Foundational understanding of networking concepts
  • Basic knowledge of cloud computing paradigms
  • Practical experience in administering Linux operating systems
 14 Hours

Number of participants


Price per participant

Testimonials (3)

Upcoming Courses

Related Categories