samuel-zuk/esi

Elastic Secure Infrastructure project

Elastic Secure Infrastructure (ESI)

We want to create a set of services/systems to permit multiple tenants to flexibly allocate baremetal machines from a pool of available hardware, create networks, attach baremetal nodes and networks, and to optionally provision an operating system on those systems through the use of an associated provisioning service.

Activities

Past

• Ironic node Multi-Tenancy
• Support for the Cisco Nexus switch in networking-ansible
• ESI Leap: a simple leasing service
  • python-esileapclient
• python-esiclient: CLI commands to simplify OpenStack workflows

Current

• Test deployment of single-cloud hardware leasing system in Mass Open Cloud (MOC)
  • External provisioning tests
  • Scale testing
  • Usability tests
  • Test of Cinder Ceph ISCSI driver
• Integration of Keylime attestation in Ironic

Future

• Deployment of multi-cloud hardware leasing system for MOC and Open Cloud Testbed (OCT)
• Multiple ESI architecture: allow creation of a bare metal cluster comprised of hardware leased from multiple ESIs
• Recursive ESI architecture: allow hardware leased from one ESI to be offered up in another

Code Repositories

Our code development features a mix of upstream OpenStack work and custom ESI code.

• OpenStack
  • ironic
  • networking-ansible
• ESI
  • esi-leap: a simple leasing service
    • python-esileapclient
  • python-esiclient: CLI commands to simplify OpenStack workflows

Documentation

Operations

• Deployment: a method of deploying and configuring ESI
• Usage: common commands used by ESI administrators and users
• Provisioning Scenarios: provisioning scenarios for nodes leased through ESI

Planning

• Requirements: initial requirements of the ESI project
• Design: initial implementation plans
• Upstream Features: initial plans for changes we will make in upstream projects

References

Presentations

• ESI: How I Learned to Share My Hardware! [ video | PDF ]

Academic papers [ complete references ]

• "A secure cloud with minimal provider trust"
• "HIL: designing an exokernel for the data center"
• "Supporting Security Sensitive Tenants in a Bare-Metal Cloud"
  • Describes an initial implementation of an isolation service
  • Code for this implementation can be found at https://github.com/cci-moc/hil.
• "M2: Malleable Metal as a Service"
  • Describes an initial implementation of a provisioning service
  • Code for this implementation can be found at https://github.com/cci-moc/m2.

Contact and Contribution

You can contact the ESI development team on the OFTC #moc IRC channel.

You are welcome to open issues or submit pull requests concerning our documentation via the ESI GitHub repository.

We have a mailing list at esi@lists.massopen.cloud. Go here to subscribe.