Hello everybody, welcome to our final talk of the session of the day. There's another deaf room in here this afternoon This is Edward Lewis of ICANN Who is having hardware troubles like all of us all the time and I say problems The the microphone fell off the clip And when I look at something that small disappears with my age of eyesight is Mancing and I left my reading glasses my my Other jacket Edward will be talking about the different ways of minimizing any yes luck. Thank you. Thank you. Thank you very much All right, so This I guess this is kind of stars a pet peeve of mine And I talked to the authors about it of the document and they encourage me to bring this and bring it up I'm gonna try to make this pet peeve interesting to software developers. That's kind of weren't going with this So The title here and the subter I have a name of a document. It's an RFC from the ITF came out a little while ago Talking about how to minimize Responding responding to any I'll talk about why why do we have this document a little bit about that an observation I've made a measurement based on dealing with this Then trying to find out why I see the results I saw and then see is this a good thing or a bad thing for the trend of software development and Of course, I have to mend Brett Bert who bears camel at the end of this because that's everything's about the camel So the document why does it exist the Q type Q type any is a feature of the original DNS It's been around since the start And it's had it has basically three uses one's benign that is You can use it to get a lot of information about a name if you go to the author of server and ask it And you can get everything is there you're kind of like snooping on what the author of servers saying about that name Regardless of type it has everything comes back it has a problematic use because some people realize they could do that and Used it to ask recursive servers the same question not really recursive servers don't get all of the records So they may not have all of the stuff and any and all became kind of confused That was the first row down to this being a problem number then finally it became kind of a malicious use of this because if you wanted to generate a large volume of traffic for it for say a traffic flooding DDoS You could ask for all the records any of the records at some name and get a huge mass of stuff Especially with DNS sec of the larger use of names now and flood victims with lots of traffic Those are the three probably most obvious ways of seeing this query go from being something that was useful To something that we really wanted to kind of get rid of so And for while I was very much in getting I want to get rid of this too at one time when I was working in a job That this was in fact impacting us But when this was written I was not part of the effort it had moved on to other folks and I moved out of that job so But in doing this and saying that the this any we had to get kind of stopped using any queries What do you do instead? How do you say no? I don't do that anymore in the DS? It doesn't really happen But there were there were a few ways to look at this one was to say we don't do that But we don't have that way of doing this In the DNS is kind of funny because the DS you say notice someone's risk query In a sense of an error that may make them try again or even more frequently In fact, we see if we stop answering queries for for reasons we see traffic come up instead of go down It goes backwards because people are trying harder to get the information also Yeah, we also realize we want to help those that were doing things the old way backwards capability those that were using the Problematic version of this we want to make them not be pained by this And so the protocol developers tried to come with some way to say no We're not doing it anymore that would appease all of the interests that were involved here And to go to go before I go further the way that says no is that there are three in the doctor There are three different things that could happen instead of sending back everything you have about the name When you're asked for for any any is not all but any is the query You can send back a subset Just pick something and just send send it back minimize it coming back The second thing is to come back with a synthesized H info which in the previous talk Leo mentioned that that was revived by cloudflare's effort to who happened to be the people Participating in this document They brought that back to life saying we'll use the h info record to say This is a minimized any query out there And the third one was try to guess what the query wanted And if you've ever written DNS code you realize a DNS doesn't give you much information beyond here's what I'm asking I don't tell you why so it's really hard to guess when you're writing code I don't know code that can guess is really kind of hard sometimes it might you might have an idea but not always Now this I'm not picking on this document because a document actually mentions the points I want to make and these are verbatim clips from the document The first one says this mechanism does not signal that an incomplete subset has been coming back It doesn't tell you that it's minimized it number two it receives h info in response But it's not possible tell us h info was synthesized for this purpose So then again, it's not really that reliable and in the last one It's not it's possible to guess what if initiator wants but not always so I could tell here that the authors We're not trying to just cut things off, but they really had there's no place to go with that. That's that's great So to clarify my complaint here is I'm not out to stop limiting the query any I think it's really Kind of not a use not necessary to the protocol The problem is that I don't like the way this comes it's becoming non-deterministic You ask a question you get back an answer which might be a mystery or might be the response You can't tell one or the other and this has happened before This is a small issue probably, but I see it the same way We we we over use serve fail to mean errors of DNS sec versus other service failures and There was the the use of the txt record for everything out there And if you remember the spf record at having to do with mail Mail protection, you know that didn't go well So so my little experiment I run something where I do the any I do the any query all the time I use it to look at the tld operator the tops of the tld zones And so I know I have an idea what's going to come back So when I ran this I'd run 13,475 queries for this experiment Oh, I don't normally do this but I asked every name server for every tld at any query. What did I get back? I got about 250 260 nos UDP tcp. I tried both of them And but the thing that got me was I got like nine or ten different ways They said no in that small sample that really bugged me as a small sample nine or ten different ways And then the absolute numbers here are kind of over counts because operators do do a whole lot of work together If one operator changed their decision they might switch 250 responses right away But to give you a graphical view of this and I don't really have a good I got the small crayon set at work. So I don't have a lot of colors So I did this chart this way the first chart shows I asked this many times. I got that many responses. Of course. It's pretty good. There's tlds out there Of in udp. I get a lot of truncation, which is okay. It's understandable. You truncate large response in udp But of the the ones that got through there that were problematic I got a spread don't worry about what they are over there There's a spread a lot of colors in that circle over there And that covers everything including if you look through there, there's the h info down towards the bottom That's the special case for the h-inch info record all the other ones were that was the one type that was seen there except for the empty one Of course, that means nothing came back And I got 10 different ways in udp for tcp a same thing except that I don't have any truncation in tcp And I get back another little color wheel with lots of different variation out there Again the fact that the ns one is the biggest part that only means that somebody does it a lot that way Doesn't necessarily mean there's a lot more use of ns So I started drilling into the numbers because at first this was that was what I thought was interesting to see But then I said well, let me figure out why I got this Why am I getting these numbers? I found that some of the ip addresses out there I ask For different ip for different tlds respond differently So somehow it's being a as a choice based on either per query or per zone or for something going out there So I decided to figure out no, can I find some more patterns here? Well, it turns out that tlds operators out there sometimes don't really Hide and they don't want to hide their versions. So they actually version dot bind actually works for some of them And I'm looking at version dot bind now That's mostly not a great way to get data But I got something out of it And so I looked at the and I and there was like half a dozen implementations that popped up that I could identify Three of them appear on this chart It means three of them were minimizing. There were no there was no evidence from the other three that They were minimizing the mind you have the big four appear So three of the big four and that's bind nsd on NS say bind nsd not and a parody and s or the big four open open source implementations I call Three of them are minimizing some way and you can see what how it comes out here where there is Empty answers from some of them are not from inflation one and three They all do ns only and then there's other types that are spread out there, which I couldn't really explain So I actually did want to explain this So I looked at the configuration information documentation and from what I could tell And nsd there's a refuse any option and it says what it does here on udp. It would truncate and for tcp Works like normal default to snow By 914 6 says that over udp. It'll pick only one of the rsets To go out there. It doesn't say anything about tcp in there. So I couldn't tell what was going to happen I didn't experiment myself default to snow And I looked up not parody and s and I could not find documentation saying how to do it But I found email in but through doing the searches web searches saying that this was just not done So looking at these four big four and how they let you configure this Didn't answer the question of well, how did I have it answered differently per tld? In fact, this doesn't even match up. I have three out of four Doing this even though two say how and how they Um The choices just don't line up with this. It's still kind of interesting to me to figure how this is going on So i'm a bit baffled by this I couldn't see evidence that the operators were able to make choices that looked like it was intentional in the in doing this I didn't see that some operator always answered a certain way In fact, I was baffled by one particular name server which answered the same way for all but one of the zones It was serving up. I don't know So I don't know it's somewhere in the software somewhere in the operations. It's it's not quite lined up yet Um, why does this bother me? I mean, I I don't care much about the any query I'll get into that but in the principles principles of protocol design. I like determinism I want to know query goes out. I should get back our predictable result or a very definitive signal when it comes back to I have this long-term running Ratio with with operators and realizing that We staff the desks with people have less background over time just because of growth and um, so I want the protocol to be simpler One time I heard this from somebody. I wish I could have a better support for this statement But a protocol design should be like a state machine You have state machines on both ends of the channel And as you trans go for you can transition from state to state based on each message going back and forth Or each signal going back and forth timeouts or whatever should be very deterministic If I'm on this side and I want and I think the other side is thinking this and I'm telling them something I want them to go here in the conversation I don't want them to actually kind of like maybe they're over here now I don't know like it makes it very hard to communicate in a protocol when you have this like random number generator essentially popping up there Now granted DNS is not really good at this but it's it's a dream I'd like to have the protocol be very specific so at both sides know where each other's thinking going back and forth Now The How does this apply to my observations here? I'm talking. I want I guess I didn't bring this slide up earlier. I probably should have I was asking From this end about information over here But I know over here These are apex they should have an so a record you should have an s record If they have dns sec They should have a certain set of records depending on what kind of dns sec they have So I have an expectation on this side of why I should come back And I'm not seeing that come back and I can tell it's an error Think about this in a more generic case where I don't know what this name is. Is it an apex? Is it not an apex? I don't know if I get back one one record set. I might think that is all it has If it if it it's better, so it's a little this is this is some uncertainty in my my In my mind here about the way this this RFC has recommended coming back with the don't don't I don't do the full thing Um now should I be able to take to minimize any response is a good fair question Um because I go back and forth. I don't think that this is critically a critical change to the protocol But it bothers me that we have this non deterministic element going on and I'm going to go past this point right now Another experience thing is staff expertise out there I've seen it where I wanted my operator to have much simpler tools to use I want the software they use to be simpler. They don't need to understand the protocol We can't afford to teach them the protocol anymore. We keep bringing more people in to people turning over They want to know how to make things work There are things working out there This puts pressure on the tool makers to make sure the tooling is there. It's in place and it's simple So with the gaps here protocol engineers describes the way software can be written They like functionality like to make things do more things But I find that sometimes they tend to lose sight of what's in operations and what the tool makers have to do excuse me operators Operators are interesting because they they have a job to do that doesn't matter what they're doing They have to do a job. They have to make sure things don't fall apart I work I met with a group of people who are new operators came into run an organization They know how to do operate they can operate anything a bus line a ticket agency now. They're running a dns thing But they're mystified because the protocol really hasn't it wasn't running the way I thought it would go What this does a lot of operators will lead on packaged software to do this defaults and all that Now the software developers and you know, I'm assuming a lot of people in this room are more interested in the software development process Caught in the middle of this and the Brett Brett Brett. I'm sorry. He wears camel talk If you haven't seen that this is a link to He is saying that what straws and I break the camel's back when I keep getting demands for more and more features on my dns software This is what I'm really concerned that this is doing is making this camel like getting closer to the edge So it's a classic dev ops issue maximize functionality versus to minimize downtime So what do you do about this? This is kind of this is what I'm my message here is I want to encourage folks in this room to Get involved with the with the itf process I was told that where were you when this document was being written? I said, well, I was actually there and I kind of got tired of it But people have to go in and say is this implementable is backwards compatibility always desirable Do we have to get rid of some old features and say, you know It also has got a break because we we don't doesn't matter shouldn't be there Can it be implemented? That's what needs people need to have an eye on that when they go to these organizations That they run the protocol development. That's my basic message here for folks Um You know if you're if you're not doing this what I fear is we're going to have to have more dns flag days At some point we get rid of features or features conflicting with each other We need to have more input to the process to to make sure that We don't say in this document. We're going to let any be minimized The response coming back is going to be this you want to have to be like one record You want to have one thing come back saying if you see this stop asking for any more information Assume you're not going to get any and fall back to whatever you need to get your information And that's my basic message for for the This talk here so I have an email my email isn't in the slides if you if you want to ask me about this you can ask me now I guess too So i'm done Thanks Thank you any questions for adverts Shane Hey, this is Shane. It's not really a question. It's more of a comment. Sure. I mean We all know that you can't really trust any queries for anything So it's already kind of performance art, right? It's like you go to a play and the the writer is trying to say something and the actors are trying to say something The directors are trying to say something and you have to interpret what you get back And it's it can be enjoyable, but don't treat it as as science and you're all right Yeah, this was part of the conversation I had with with the the people who wrote the document For for what I've been doing, I have I have a use for it. It's not about my use for it My use for it actually it that works perfect Because I'm asking a specific question of a specific small population I don't deserve to do that. In fact, my code is for years how I had fallback to Ask for everything you expect to see there anyway. It's just more efficient Um, and yeah, but I mean this is I don't think the any query It's not that I'm I want the any query to survive. Don't get me wrong. I don't want to survive I want it to be clearer that you're not doing it That's what I'm after that was when those documents being discussed Um, I first was The h info option was the first one out there and I thought well, you know We don't like to reuse what create a new record type. Oh, we'll take 20 years for that to roll out, right? Um, this is what I'm after we want to make sure that we do changes to the protocol So that's sustainable so that we you know Maybe we you know because and I I understand the discussion that went on too Well, what about in the case where someone was relying on it and we shouldn't take it away from the monosoceros? So maybe we'll do some Is that worth? I mean is it is it worth is that something we can keep doing because that's part of the straws in the camel You know that so that's good. I think if I think if people here felt strong enough that change Don't don't fight this one if a change is coming along in the itf And it's going to change the code in a way that makes the code blow it up big Go to the itf and let them know this is not implementable. And that's what I'm asking So here here Another question So I presume in your analysis you used you used non recursive queries What about the recursive ones and what is the role of a dns cache server in that respect because I was trying to implement or implement the last version of the djb dns curve I also was had to take the decision what to do with the any ones here. So that's Yeah, it's all of it yet. Yeah, I mean You know Well, that's a good question. I mean in my in my work. I always go to the authority of servers That that's because I'm grafting off a code that does that I didn't do recursive. That's a good question What should a recursive server come back with? You know and I if I told you now I'd be thinking on top of my feet, but obviously You know, there are the problems I like my first reaction was a non-imp not implemented our code But if that happens, some folks go into tizzy about that and keep asking other servers now to see if they do it Not input is for non implemented opcodes. Right. They say, right. Yeah So So we maybe that's part of the problem. We don't have the protocol doesn't have enough definitive like This this is a there's there's zone level errors and there's server level errors, right? The server's not going to respond to you go somewhere else But when the zone is out We need to tell them stop asking I've seen meltdown so many ways. I mean, it's not uncommon to a lot of people out there But for a recursive service out there, I mean, I just haven't thought I've never worked in a recursive service field So I haven't thought of it to be honest. Yeah That that should actually that would actually be Part of what is in here because I think The people who wrote this were thinking as a sort of servers to come to think of it because I don't see recursive in there at all And I do know who they were, you know, the the workroom cloud flare is obviously And they were trying to solve some problems also beyond the ones I was just putting out there as a spec But I'll just leave it at that. So Any other questions? Okay. Thank you. Sure You want this now don't steal that This concludes the dns dev room in about 30 minutes the web performance dev room will start here Um, I will stick around for a bit bet some others will so if you have any questions talk to us Thank you for visiting us


So my name is Ovid, I'm a senior software engineer for Red Hat and today I'm going to talk about scripting and integration with Ovid So the agenda will be as follows I'll start with a small Ovid introduction just in case you don't know the project or you you didn't use the project before and Then I'm going to divide this session into two parts The first one will we'll talk about the rest-based APIs that we have in the Ovid engine I'll start with an introduction to that then I'm going to show Three types of APIs we have the regular API The shell command the over shell, which is the CLI. I'll show some demo of that and the SDK Then I'm going to briefly talk about Delta cloud APIs and how they can be used also with the overtangent Now that part is is basically The basics for the second part in which we'll talk about how we can extend the functionality of the the overtangent and modify its behavior In different fields using UI plugins to change the UI scheduling APIs or scheduling plugins in order to change the way overt schedules VMs in in its environment and VDSM hooks now the first two UI plugins and scheduling API are also You you you would basically use them In addition to using Sorry in addition to using the overt SDK for example in order to do different operations. So that's why I divided it Into these two sections I'll just start and say that there are a few sessions tomorrow regarding over one of them is a session by Omer Frankel That's a talk that talks about another type of integration We have with cloud in it integration with cloud in it. Omer is sitting over here And we have an over developer day at the KVM forum in which we plan to discuss different Different issues. It's it's practically a stage for us to say what we're how we see the product In the future and and the stage for you to say what you want to see in it I guess there will be many open discussions over there in different issues So we will have the opportunity to share your thoughts about About the project and what you want to see in it. So I recommend going there I also have here some USB on a stick so over it you can feel free to take them when the session ends If you will be bad participants, I might throw it at you. So And it's an intimate session. So you can feel free to to move forward or something but And so are you familiar with overt everyone here? Who isn't familiar Okay, so basically over it is is is a large-scale centralized management environment for desktop and server virtualization basically gives you a way to manage your data center Based on leading performance scalability and security technologies. It's based on kvm in its in its Main back end and it basically provides an open source alternative to vSphere or vCenter If you got a chance to to work with this product And a very powerful product a large community behind that many companies also contribute to the project We have a fedora release and then And we take this release and also release reddit enterprise virtualization as a product But today we came here only to discuss the the overt project and So that basically the project is solved. So we'll start with the rest based api I guess some of your Many people here are familiar with rest, but I'll give some some basics about that as well So when looking at overt, what can we do with with with the rest api? So basically we can do infrastructure configuration to configure hosts Configure networks configure storage in the system Create provision new virtual machines Manage users do different daily maintenance that we need to do in our environment We can do Basically anything that can be done with the overtangent through the api some options Some operations are exposed through the api, but they aren't even exposed through the ui because maybe Because the flow doesn't make sense to put them there But if you work with the api, you can do everything and beyond what what can be done in the ui So where you should use it you'll probably use it in scripting and utilities If you have another software you're writing and you want to integrate it with the overtangent If you want to do some task automation in your system provision and new virtual machines manage new virtual machines and you want to do some add-on Performance monitoring of your environment reports The offer project contains reports, but you can also integrate with it and you can Generate reports of your own And and as I said earlier in the second part of the session I'll show you some other use cases where you can use that so for now we We exposed three types of three ways for you to to to use the api one of them is using using the rest api itself The other one is using an sdk and the third one is just to use a shell Now the the sdk is based on the rest api and the shell is based on the sdk The python sdk in in this example. So basically you have three ways you can use the api Now the question is what method you should use and and that's That depends highly on who you are. What do you want to do? What's your role in the organization you work with?  I was a sys admin one So I know I just oh now open the browser and stuff like that So I just want to to have a look at view A few things so you can just use the shell in order to to run some operations to run some to to view some stuff If you're a data center admin managing a larger environment and perhaps you you can get lost in the cli so you would You would probably want to to make some predefined scripts That that fit you best so you perhaps you would use the sdk in order to do that and And if you're a software developer running in a specific environment Where you don't have really an sdk then you can just use the rest api natively using the http Http clients that are available in your environment So it highly depends on on who you are. What's your level of expertise and what you're trying to do? The concepts of the api and when I say api here, I mean all all the types of apis is that they are all integrated through the over retention And they are all based on the rest as a core sda on top of it and the shell on top of that as I said earlier Another thing that's very important for us is backward and forward compatibility So we would be able to use the current api with the current sdk the current shell with older versions Of the over tension and also use older Older sdk with newer versions we try We sometimes break that but we usually try to keep it As compatible as possible to leave all the options available And if we're deprecating them it takes a few versions until they get deprecated We give secure access to the api you need to supply credentials in order to use the api And another thing we added I think about a year ago is session based access and we'll talk about that later on So the api it's a rest api. Are you familiar with rest? Okay, so if not it's practically built of four building blocks in my opinion Four different HTTP methods that you use one of them is get in order to get a resource One of them is post in order to create a new resource in a collection One of them is put in order to modify the resource and delete in order to delete the resource Just as simple as that You usually it supports two different media types xml and json and we support that as well And when we're looking at the structure of A generic rest and specifically in our environment You have the Protocol you're using whether it is HTTP or HTTPS the server and the port that basically the endpoint you're using The api which is the entry point For all the rest api And then afterwards you have a collection in in this example is the vm's collection Then a resource inside this collection A sub collection vm has disks so the disks are a sub collection at the vm Inside the specific vm and there you can access a specific disk and it can go on According to the collections and sub collections you have so that's the structure of the uri It's usually like that in rest applications.  I put it in in xml format So you have the metadata of the resource The details on the resource in here is the vm. So the name of the vm the status of the vm memory cpu's when it was started and etc and the actions That are available on this resource on this vm And links to other resources for example the vm The vm for example has disks so you can access the specific disks of this of this vm So it's a link to another resource or the nicks of the vm The cluster that the vm is part of and etc. So that's the way it's divided I'll just say that the actions in here are not Related in any way to the status of the vm. I saw that specifically delta cloud and other Projects as well. You show you the actions you can actually do on the resource in its current status So it's not affecting here in here. We show you all the actions that can be done on the resource At specific times, but perhaps, you know, you try to stop a vm. That's not running. So we tell you it's not running Just a note about that So in order to list the vm's you you just do a get on the vm's collection If you want to get a specific one you you also use http get with a specific id Create a new vm using post giving the vm details Updating in here in here. We renamed the vm. So we just pass The new name of the vm and in order to delete it We just Do http delete and give the resource ID the resource itself the uri to the resource Are there any questions? I mean it's basic stuff, but perhaps something is not Clear, so I'll be happy to knows So basically A vdsm is a host in the over-retention. So you can use So we have a collection of hosts and you can do different operations on hosts now That depends on what do you want to manage inside the the vdsm node? I mean we we give you the way to add new hosts, which will install vdsm on them And to delete them and to modify different properties of the host But perhaps but but we don't expose in the over-retention every configuration That can be done on the host. We just configure that for you in a way We try to put everything in the engine and free configuration that's relevant for you as a user But perhaps you would you would want to hack that for one reason or another so Yeah, but but when you will access api slash host you will see the host the over-retention is aware of And you will be able to do different operations. I'll show you in a second how you can easily Know what you can do with the specific resource So there are different I won't get Deeply into that but there are different clients you can use in order to to to run this http commands Different rest clients that that are available in the different browsers or command laser utility like curl for example This is just an example using curl To get a specific vm. So In here you pass the the username and the password You say you want to get an xml You say the http method is get and you give the url of the of the specific vm you want to use If you want to create a vm you need to do http post And the three parameters needed to the the minimum parameters needed To that you need to supply and here is the name of the vm the cluster that the vm will Recite on and the template the vm is created from so you would just Also use curl with the minus d option and give the body of the vm you want to use It's very standard use of Of rest api in here to update the vm to rename it. So you just Use the minus d option with curl giving it the The thing you the the properties you would like to change in the vm And in order to delete you issue the delete the delete command Give the minus x delete Now it's a bit hard to understand what you can and can't do with a specific resource in this in the environment It's it's a common problem for rest in general because You don't really know what's exposed. You don't really know What is mandatory to pass when you create a new resource You don't really know what you can modify in the resource So for that reason we created something we call rsdl which is a restful services description language and I I didn't see it used being used in other projects, but I think it's a very It was a very good idea to do that and I'll show you in a second An example for that so So basically it describes the parameter constraints that you have using the rest api And basically it helps you understand how can you create a resource? How what actions are available on the specific collection? What parameters do you need to pass which one is mandatory or which one is optional? Which ones you can't really change the read only and In the best way just to show you an example So in here you see I access the overt api. Do you see well? The screen everyone. Okay, and the question mark rsdl. So let's assume I would like to know what I can do with the VM's collection So let's look for slash api Slash VMs Okay So I got this one Okay, so I see that if I would if I want to add a new VM to the collection I need to use the HTTP method that the post HTTP method In the headers, I need to supply the content type It's a required field there are two additional fields here fields here that are optional And when I get to the body, I know that I need to pass a VM object And different parameters. So I see that the VM name is required The template that the VM is created from is also required either the ID or the name of the template The cluster is required And I have a lot of other options here that that are that are optional Okay, I see the type of the parameter. I want to use I need to use and And that's basically it so I can I can just look at that and understand what I can do I can parse that in order if I want to create some client of mine that that can do different operations If I want to create Fancy why so I'll just show the different options to the user And basically it's a very powerful thing because it describes you The api and each time we do a change in the api. It's also updates this one. So you You For every overt engine you use you can you know exactly what you can and can't do with it and and It's a very powerful thing. Now if we look We saw here the ad operation Let's reel down to There are a lot of options when creating a VM And so let's go to Let's write method Post Okay, so I see that if I need to get To get the VM all I need to do is use the http method get I see here the the header parameters that are In here. Nothing is mandatory. I just have um A parameter here, which is optional And I can do different search queries in order To get more specific details Delete I see that in order to delete. I need to use http delete delete on this resource And I guess I will have put next Somewhere here if I would like to update a VM. I need to use the entity The specific VM entity in the uri And I also have here a list of all the options I can pass when updating nothing is really mandatory. You can update everything you can Do no updates that depends on you so so I think it's a very powerful thing depending again What you would like to accomplish. So, uh That's the rsdl And here you see an example I've uploaded the slides by the way. I changed them a bit but If you access the the website, I guess you can download them and have it available And so so I will skip slides here and there but all the examples are there so An additional functionality we have in the api That was added about I think a year ago One of them is a user level api at first We only have admin api in order to access the api you needed to have admin Permissions in the overt engine. I won't go over what admin permission means and how it's created in the overt engine But basically You needed to be an administrator. And now we also support user level api It's just In order to do that. We just added a new http parameter that says that you would like to work with a filtered view and because users Are only able to see specific objects and not all of them administrators by By definition in our environment Can you can view anything they they can't do anything, but they can view anything And also session support There is some overhead in the rest calls because each time we we need to authenticate the user And to check for held up credentials And verify that so we added the we used cookies in order to create a session basically That you log in At the beginning and then you can do different operations and then log out at the end There are more details about that in the wiki page Just Nice to know that it's available Are there any questions So far Okay, so let's move to the shell We basically the the concept that That that we we did the shell with our to make it Interactive to make it as easy as possible to use with auto completion Using arrow keys in order to do everything you you're familiar with with any other shell to pipe commands in it And stuff like that We also have help which is Smart help basically you can get an apple and a specific command on Command on a sub collection Or command on a on a collection You can just do help and see all the commands you can do And let's keep to to just show some demo of that So let's disconnect i'm gonna I have one to disconnected. Yeah So that that's the over shell i just run over shell and and i see It's a bit cut on the left. I apologize on that. I wasn't I didn't have enough time to to try and fix that Basically, I see that i'm disconnected Then i'm issuing the connect command and i'm if i A double tab i see the different options I need to supply the username the password the url Yeah, sorry And that's basically it and then and now i'm connected to the over shell now. I can do list hosts I can see the different hosts in my environment I see the id and the name. Sorry again that it's a bit cut I see the id of and the name and of each of each host entity and then I can choose to do show host Host one Then I see different details On this specific host um I can use My environment is not very Live at the moment. So I won't do a lot of different operations in here What I can show you is is like Help action for example Okay, so I I see the different I see that when I need to do some action I see that I need to supply the type of the object I want to operate on the name of the object and the action I would like to do um Let's for example help action vm Yeah, let's give a name of the vm and start Okay So for a specific vm I can migrate I can move it I can stop it suspend it export it Shut it down, etc I see all the different operations I can do again It's not related to the status of the the current status of the vm But it shows you all the operations that you could have done with it in in different lifetime options And I can do I can try to do action via workshop start It will probably fail because my my environment is not It is not alive at the moment, but that's the way I can do different operations. I can delete the vm. I can Show the vm details show vm workshop I have the different details So you can basically do through the shell anything you could do with the api anything you could do with the sdk It's all the same thing. It all leads to the same functionality If you found out that's something that you can do in the api you can do with the shell open a bug It will fix that. It's not It's not by design If I remember correctly the shell uses a automatically A rest session so you have a session you don't every log in every time And so it's more performant I know some people are against Using the word session with the word rest because it's a it's a it has some contradiction But we don't really save anything in this session Besides the fact that you can do operations. It has no state and so When you ask for a resource you ask for the resource and you get the current resource. It's not cached everywhere. It's not saved everywhere So in the so the session in here is only in order to be more performant Okay, I have some more examples in the slides You can ask for a specific if you list a specific resource List vm's for example a specific collection. You can choose to show all the properties You can filter them out Using either a query at the client side That means that the sd the cli gets all the information and it does the filtering in the client Or to send a query to the over retention to filter some Some to filter some objects out Depending on what exactly you would like to do You can add update or remove a resource I saw some some help example Again, if I would like to to install a new host for example as you asked so I did action host Atlantic Install and give the root password, which is the only parameter I need to pass that when I will use the the cli it will show me What parameters are available for that operation if I'll use the help. I'll also see further details about each parameter So it's very convenient In here we added a new vm Based on the blank template and we put them in the default cluster We updated the host type of the vm. We added a new nick to the vm. So we said add nick The vm identifier is this the name of the nick is this And the network I want to create the nick in is this It's just as simple as that In here we see an example to create a new disk again passing all the parameters And then Attaching the disk to the vm originally disks were not A main collection. So we had we always had disks inside vm's And now disks are also a collection of its own. So you can create a disk and attach it later on We decided to do the attachment also using a create command Although it doesn't really create a resource it just connects An existing resource to A sub collection of the vm Here we saw we see how to create a template create template What's the vm name you want to create the template from and what's the name of the template and when the template is created We can create a vm from it Again, I there are endless examples Just wanted to give you some basics on what you can do with that Are there any questions? But if there is a problem with one of your roles or your storage domain, then you can use the cli in order to As show me the storage domain, you see the storage domain is in down state Or in active stuff like that. You see if someone I don't know calls you and say that the vm is down Can you check it out so you can Use the cli in order to do it quickly instead of going to need to be management portal and Check it out But not If you have an infrastructure issue with the engine itself, then then most of the times the api won't help You have something to add on that Omar It's So Okay, so let's move to the third section of the first section I promise that the second The second section of The session is is more interested in that we have a lot of technical details here But it's the building blocks for later on so So the sdk is mainly used for integration or automation advanced automation in that case It's object oriented. We currently have two bindings for that a java and the python one As I said earlier the cli is based on the python one. The python one was the first binding we had There are a few other projects that created Different bindings or different wrappers for the rest api one of them is geobjectrapper Leapge overt and the other one is rb overt which created the ruby binding I'm not sure. I know that rb overt is not a complete Binding for the api I'm not sure about leapge overt. You can I have the links in here. You can browse and and have a look if it's Interesting for you in your environment The examples I'll show here is for the python sdk the java sdk is pretty simple Similarly just in java. There are some examples also in our website and So again the concepts up to are to how are To have a complete protocol abstraction just like the cli just like the api Full compliance with the overt api Auto completion is more a feature, you know of your development environment, but you you You can use that. It's very intuitive to use. It's auto generated. So once we have a new change to the api If we do it properly it will propagate From the engine to the api to the sdk The python sdk the java sdk the cli everything will be updated I can't say that for rb overt and leapge overt because there are different libraries But for the java and for the python sdk, it's auto. It's completely auto generated So in python we when we want to to start working with the engine we create a proxy So we pass the we create a new api object Create passing the the url the username and the password And and that's that's pretty much it now we have An object in hand Which we can use For example listing the the all the collections api dot I can see for example, I have the vm's collection I can do api dot vm's dot something I can add the vm get a vm list all the vm's And etc very convenient to use There are two additional options that these are exactly the ones I described earlier one of them is to have A filtered session a user level api If you want for example to create your own user portal You can use the sdk With the filter option. So you you you will only show the user Objects it can it can use And you can use persistent authentication in order to use the rest session I can do api vm's list and pass a query Saying I would like to to to see only this vm Um, I can give another constraint about the the memory I want I want to get only vm's that have this memory again one of them is using Passing the query to the engine and the other one is doing the query on the client side again depending what you would like to do Um, we have both options You can ask to get a specific vm And then you can start it for example using vm.start Again, it's all auto completion depending on your environment If you prefer vi then I can't really promise that but anyway And You can access different properties on the vm for example the name of the vm Access a sub collection For example, I would like to add a new nick to the vm. So I access the nick sub collection Press add passing the the the required parameters. We'll see an example for that Here's an example for creating a new vm So in order to create a vm, I need to say what cluster I want the vm to be in From what template to create that And And that's practically it so I can I can pass more parameter because these are the mandatory ones So first of all I get the clusters The specific cluster I want Then I get the template I want Then I create in this example we created a new Params.vm object giving all these parameters and adding the memory I would like the vm to have And then I'm accessing the vm's collection issuing an add action Passing the parameter that I've created and that would create a new vm resource If I would like to create a new disk I say what storage domain I want to to create a vm on the disk on and And in here, we just say API disks add to create a new disk entity The parameters are this is the name. This is the size Status interface format and etc Once you created a new disk you can attach it to the vm again using vm.disk.add because we add a new disk resource in the vm And passing the disk ID and saying we would like to activate it now We support hot plugging of disks in overt so you can do that Here is an example with nix getting nix with specific interface type And You can find more examples in our website, but Basically to give you knowledge that you could do anything with that anything you could do in the api anything you could do with the cli Any questions so far? Okay, I'll I'll describe delta cloud did a few just a few slides Basically, I saw you three types of apis you can use the delta cloud project adds other apis to that Are you familiar with that project? No, so basically it's an open source apache project that comes to abstract the the differences between different cloud providers It it basically exposes Specific three types of apis On top of all on top of All the cloud provider it supports So it gives you a way to work with different cloud providers using a unified api And they support three types of apis currently one of them is delta cloud api, which is their own api And ec2 api, which is the amazon cloud api And the cmi api, which is the cloud interface cloud infrastructure management interface api The later two are a bit They're not Fully complete, but a lot of options are in there. So basically if you have an environment With a lot of different cloud providers or virtualization providers you use And you would like to work with a Common set of apis on top of that then Then you can use delta cloud it supports over it as well Again, just a way to to use another set of api And so these are the apis that are exposed and inside the delta cloud servers You have different drivers that knows to talk to different cloud providers I won't go Into any further details You if if it interests you If you already work with a specific environment that has support for ec2 api And would like to work with over it as well You can check it out and see if it fits you again That the protocol support is not complete yet I can also say that it looks like the project Is not advancing now as I would have expected to to To proceed, I mean, but who knows what's going to happen And I also have a specific blog post on that so you can go ahead and read it It has some examples of using delta cloud on top of overt So we're going to move to the second part of the session Any questions so far? Okay So in the second part, we're going to talk about UI plugins And I'll show a demo of a plugin. I'll show some examples in the slides And then we're going to talk about the scheduling plugins or scheduling api And then on VDSM hooks They give you different ways in order to customize in order to To extend the functionality of the engine Change it To fit your needs And again, you would probably use You can use the SDK You would usually I guess you would use the SDK In the UI plugins and scheduling api But you're free to do whatever you want. So I'll show some examples. I hope it will be clear So first UI plugins if you're familiar with with our UI then great It's not it basically consists of Two main parts one of them is a tree view of the different objects in my system And the other one in here is a tab view That every main entity in our infrastructure Has a main tab data centers clusters hosts networks and etc so What we allow to extend currently is This section if you want to add a new main tab to your system If you want to add a new sub tab to the system then For a specific in the context of a specific Main entity for example in here is a host you can do that You can add new action buttons You can add new context menu items basically In here we we we can see everything that's possible custom main tab custom action button Custom context menu item they can be a new menu item can be both in here and in here or only In the panel or only in the context menu and the custom sub tab So basically you you can change the way you can add Things into the UI we have And we give you a set of tools in order to do that. I'll go over these tools Basically looking at the the most basic plugin you you could use It's just an html file with a javascript section The first part will contain Accessing the API Telling I would like the plugin API. My name is my plugin And then I'm registering event handler functions In this case, I registered the UI init event The UI init event is event that's triggered when the admin portal is initialized And everything the only thing I did here is adding a new main tab That's the label That's the unique identifier and that's a url That's it. So basically that would create me a new main tab That would be the label and when I will go to this main tab, it will access the url http foo.com At the end I'm telling the API the plugin infrastructure. I'm ready to to use so that triggers basically All the different events. So that's a very basic plugin. Just add a new main tab to the system So we have The basics in the ui plugin contains the html file of the plugin. That's the one we saw a second ago And we have a plugin descriptor, which is a json file containing different configuration items We need the plugin to have And we can override it If we need if we come if we install the plugin with a specific configuration And we would like to override it that we can create a new file In order to do that. So the locations of the plugins are user share over your tangent UI plugins The configuration file is also in that directory using a json file And if you want to override the configuration It's in etc over it engine. I'll show examples. I know it's a bit Confusing for now, but I will show you I will go over the API and then I'll show some examples So basically what we allow you to do is to add a new main tab to add a new sub tab again sub tabs are these ones Are the tabs that are available when you When you select a specific entity in the main tab You can change the url of the sub tab Again, assuming that you you you have a hosts main tab and you go between the hosts and each time You select another host. You want the url of the sub tab to point to another url. For example, let's take For example An external application you integrate with that that is aware of this host So when you press on the host, you want to access the url that this Application has for this host I'll show an example of the form and plugin I created. So form and for example Is aware of of both the hosts and the vms So if you stand on a vm then and you want to see details that aren't available in the overt engine And they are available in form and we're in another Application you use then you can set the url of the sub tab to point to that specific url in the application you need That way you can extend the view of The view the administrator sees when he logs in To the admin portal You can also set whether a tab is accessible or not For example, there may be entities that the tab should be accessible and for example Others that don't according to specific property. So you can you have control on that as well You can add new action buttons. These are the buttons that I showed you These are these ones So when you add a new action button, you say What is the entity? What is the main entity that the action button should be in? And That's the label What's going to happen when you press the button? Um And that would basically give you this functionality We also have a show dialogue option For example, you can have an action button that you press on it and it happens and it opens and you A new dialogue Pointing to some url And these are the main The the main functions that the ui plugin api gives you Some other useful ones are Are ones to the show you the what's the logged in username and what's the user id If you want to do some single sign-on solution between The web admin and the admin portal of overt and The the other application and you need the username for that. So you you have access to this to this information We have different events that the ui plugin infrastructure supports The ui init event is the one I showed you earlier that is triggered when the the main portal Is is generated is initialized For each entity, I have a selection change event. For example If you are in a data center main tab and you selected a different data center You change the selection then the data center selection change event will be triggered if you are in the vm's Main tab and you selected a new vm then the vm's selection change will be triggered. So basically for each main tab We have an event for each selection change and We'll show examples on that as well We have a user login or logout event if you're doing some single sign-on A single sign-on between The admin portal and a different Application then you would probably want to login when you log into the main portal You would like to log into the external application and when you log out you would want to log out from this application Two other events that are useful in in this scope are the rest api session acquired That's basically The way the api the way the ui plugin api gives you to modify To do operations on the engine. Okay, the ui in the ui plugin you can have You can point to a specific url But the fact that you're doing a ui plugin with the engine means that you you want to affect the engine functionality So You you get here The ui plugin infrastructure create a rest api session for you and it gives it to you And then you can use it in order to manipulate Specific operations to to manipulate specific things in the engine for example, uh A nice plugin that net up wrote That allows you to create and you a volume in one of their filers and use a storage domain on that So you would have a main tab for uh I don't remember if it's a main tab or an action button But anyway, you you say I would like to create a new a new volume and a new net of volume And then it will open you at the url of the the net application And you select the different net of properties Again, it's an external application and then at the end it creates the volume And it wants to push it into overt as a new storage domain that you can use So So what we did here is we gave them the opportunity We gave them the rest api session and they and they can use it in order to do to add the storage domain to the system Am I clear is the flow clear or omar Is that clear or So it just gives the the plugin the the the strength To do different operations the other approach we could have taken is is to give a specific operation for everything So we decided to give just access to the api Which is more powerful I'll show an example and then I'll move along The example i'm going to show you here is Less useful i'd say but but more funny Um, and then I'll show other examples as well. So in here I log in into the overt into the overt engine I hope it will work When I stood here before the session it worked one time and it didn't it didn't work one time and it worked two times So, uh, I'm not sure why it happened and You see here I select It's the resolution here I I go to the data center main tab I select the data center and I do right click In here you see I have a new button called protect my data center from alien invasion Okay, and now I have a game Uh, it's not uh second I have an alien invasion game That I can play and protect my data center Now I would like to get out of here and then it tells me no you need to destroy the aliens at least once And I can tell you it's a very hard game. I try to destroy that the first few times and then Eventually I just decided to cheat Okay, I win that's the the cheat in here and then I can close this dialogue So very stupid dialogue if you ask me, but it shows you you In this example you basically created a new action button you showed a new dialogue um Over there. There was a game and And when I cheated it created some event. I'll show that the code for that So that's that's basically it Very easy. I'll show you the code for that. It's it's not most it's not it's not complicated at all What? You said when you Ah, no, I meant A message I'll show you what I meant. Just a second So started from Second, well, I think I'm in another slide for some reason. Yeah, this is great. Okay Um, no, what I what I meant is one of the events is message received It's a way for a new dialogue to switch messages between The dialogue and the engine infrastructure. So so Basically What we did here is that the dialogue sent a message to the y plug in telling him that I won and and That's what happened in here And If I'll show you the code for that again, very simple I created an init function that adds a new main tab action button You saw I have a new action button The scope was a data center. I protected my data center from alien invasion It's enabled only if one data center is selected And when I click on that it opens it caused the open dialogue function now the location I wanted for my uh For my action button was only in the context menu because I don't want my boss to see that I can Play alien invasion during My work hours instead of managing his data center. So I don't want it to see it up there So it's just in the context menu when you right click And there is also I'll show it in a second there in a second There is also a new sub tab that was created Again in the data center scope to have to show the score I have In protecting this data data center from alien invasion And I also asked To align it to the right if you see In here, you see the space shooter score Okay, this my score is five So the open dialogue function Called the api show dialogue function gave a label of data center dot name under attack because we we give The ui plugin infrastructure the the details about the the selected object And we have some two buttons that we created in the dialogue cheat and get me out of here That also gives you a way to open a new dialogue, but also get Buttons that can get you back To the engine these are these two buttons And everything is an event in here. So I have Event registration one of them is the ui in it in order to initialize my plugin And the other one is the selection change of the data center. So again, if I have one One data center that is selected then I have a sub tab for it with the score and etc If I have more than one then the sub tab is not accessible because Because when you select more than one a data center, no sub tab is should be accessible And we talked about the message received The message received event that's the event that is used in order to exchange messages between The the the plugin itself and the infrastructure So I have here several events game in it game win and and get score again when I when I cheated I just posted the game win message To the parent the parent is the Is the ui plugin And I called the api dot ready at the end to tell the overt engine that it can start initializing my plugin Very simple plugin very simple api allows you to to to add Basically buttons and and tabs main tabs and sub tabs in every part of the engine Man Again, I should I told you about the net up example. I show here another example of a plugin I wrote for foreman Basically, uh, what we did there is, um We allowed we added a foreman dashboard tab My environment was pretty dead So we don't see a lot of events here But if you know foreman it has a dashboard and you can just access the URL of the dashboard to see details So in here I created the main tab to just direct you to a URL In this plugin I also had to write something in the foreman side to do some more embeddable view of the dashboard But I want to get into that Now when I'm in the virtual machines main tab and I select the virtual machine that That foreman is aware of I can see here details taken from foreman Different details on the vm different activity graphs and stuff like that Um, again, so I'll show the code for that later on but you understand here that I have a new main tab So you add so I use the add main tab action um I have a new uh sub tab in here for foreman details And I have a vm selection changed event in order to change the url That I that I'm showing in the sub tab according to the vm that I selected And if I select them more than one vm then the sub tab is irrelevant So Is the flow clear? So that's another use case And so again the as I said add the sub tab I added two sub tabs here one for details and one for graphs um I created a helper function to hide or show the The the sub tabs not really important in that matter and I added a new main tab to contact the dashboard now in order to Uh I used also a configuration of the plugin in order to to contain the url of the foreman server i'm working with so I'm just uh A good use of the configuration What we wanted to do here is to to use some single sign-on operation between Foreman and the overt engine so when We use the the rest api session in order to do that so when the uh The session acquired event was triggered. I knew The plugin code knew that there is a new session and then he it It issued a login to foreman Uh, I also needed to add some code in the foreman side in order to support the single sign-on operation Basically, it took the session id and verified it with the overt engine As simple as that I won't get into the foreman side But just to show you a use case Another use case that you can use the rest api session with The other use case is to to use it in order to do stuff In here, I only used that in order to do To verify that the user is indeed logged in and that the session is indeed valid In the system and in the vm sorry And in the virtual machine selection change event What I did here is I checked whether one vm is selected or more and if one vm was selected I I contacted I reached foreman to check whether he is aware of this vm or not because the vm can be Perhaps it was created not through foreman So if it's created through foreman and foreman is aware of that Then I will show the sub tabs if it's not created through foreman then the sub tabs won't be visible And when the user logs out in the user log out event, I also logged out from foreman that's So this is the function that hides and shows the the sub tabs not really important but The only important point here is that we I changed the sub tab content url According to the name of the of the selected vm In here. I see you api.set tab content url So This function is called in case that the vm was was found as a host in foreman So I construct the url and I set the sub tab url. So when you press the sub tab, you will get to the proper url in foreman Is that clear? another thing I wanted to mention is that we added a new feature to allow you to Let's show the ui for a second In our ui we have an events sub tab in order to show different events that happened in the system That relates to the specific entity. We added the ability to to inject external events into the engine so What you would do as a plugin that That creates for example, let's take again the net up example because I think it's a good one You created a new volume. So so when you press the button the Net up can say okay I started to create a new volume in my filer and give the exact details And that would be added as an event to the overt engine Then it can create it then when it finished creating it can send an event It can add an external event saying the volume was created successfully Now I'm going to start creating the storage domain collected to the volume So it it it gave it gives you a way to to do even A more deeply in deep integration. So the administrator knows what's happening right now It's not it didn't just press a button. He knows that the volume is is now is now The creation of the volume is now in progress. He knows that the creation failed or succeeded And it's not just the you know a black box that he doesn't Know what's the status of things that are happening? So it's also powerful because you can as an administrator using this this system You can you can be aware of what's happening in your environment. So That's a new addition in 3.3. I think right I think only 3.3. Yeah Any questions on the plug-in ui plugins? Okay, there are there are a few other examples in our website and one of the nice plugins that that's that A guy I don't remember his name, but he works at a company called ovido Which is funny because I'm oved. Oh over the roof only so and people tend to confuse The two of us. So anyway, he created a plugin that works with Nagios, right? I forgot In order to to to show you different statistics on your your on your vans on your host and etc It's a it's a it's a great plugin You should try install it and use it and also see it as an example if you if you're interested in writing a plugin He did some more complex stuff than I did here in these examples okay, so Moving along to the to the next feature, which is a scheduling api feature So that's an email we got From one of the users he wanted to define the maximum number of running vms on a host Okay, and we didn't give him the way to do that um So the scheduling mechanism we had so far was based on A distribution algorithm that was defined on the cluster one of them Was we had two policies basically on the cluster one of them one of them is evenly Distributed in order to evenly distribute the vms around the hosts And the other one was power saving in order to do the exact opposite to use It's not that in off peak hours to not to use all the hosts and that some hosts can be Even shut down if needs to So basically these were the policies and the scheduling mechanism Which is which basically says I would like to run To run this vm Used one of these One of these policies in order to decide where the vm should run We also have we also had a load balancing mechanism that we In a specific point in time periodically we we ran the load balancer and we asked him, okay Do we have here a vm that needs to be migrated to another host in order to be more compliant with the policy For example, if we are in evenly distributed Policy and we have one host that running a lot of vms then perhaps we will try to migrate vms from this host to other hosts in the system So we only had two distribution algorithms taken into consideration only cpu usage basically And we didn't give you any way to construct your own policy So the new scheduling mechanism again introduced in in over 3.3 gives you a way to do that Through several mechanisms. One of them is a filter module filter module basically as you see in the slide Allows you to filter out hosts That you don't want the vm to run That you don't want the vm to run on for that reason or another For example, I started with four hosts for the first filter Filtered out host number three and the second one filtered Host number one as well. And so I was left with two hosts that are Available to run my vm I can do any logic I want I can say I have a specific network Network infrastructure I need on this on the host running this specific vm and I'm aware of that because I'm I'm in my environment. I have something special about them So I can write a new filter saying If the host is one of these It has this capability Then I can run this vm and for another vm. Maybe this condition is irrelevant So the filter models model allows me to do that The other model is the weight model Which allows you once you have a set of A white list of hosts that can run the vm. You want to choose the best one That the one that fits best in order to According to some weight module That you have So again, you can have more than one weight model and eventually you will get The weight of the host The lower the weight is The more chances this host will be selected as the one running the vm So again the filter model easy to write and maintain it's chained up. We have a filter chain in the in there We can add custom parameters Existing logic that we had in the system when you create a new vm you you can pin it to host For example, we added a new Once we added this infrastructure, we added a new filter to do that externally in the system Um, and we also added the ability to write new external filters in python And that can be loaded into the engine So if i'm going back to the example, I would like to to to Define the maximum number of running vms on the host then I want my filter to filter out hosts that running more than three vms So I create a python class called max vms I have a do filter function over here Uh, uh, that gets the the host IDs These are the IDs of the hosts that are available for now for me to run the vm one and the vm id And I have here some arguments, uh, uh, for example the maximum number of vms Is an is is an argument that I get as an input in here So what I need to do basically If you don't look at the code for a second, what I need to do is to is to go over all the hosts And identify the ones running more than the maximum number of vms or or The maximum itself and filter them out. That's the only thing I need to do So I use the api in order to do that I construct Like we saw earlier in the sdk section I construct a connection to the api giving the username the password and the url And we query for the hosts Again, we do we go to the hosts collection asking to list hosts and To choose only how only hosts that are in the list of host ID with an id that is From the host IDs I got as an input and then I'm going on the Then I'm going over the hosts one by one And I'm checking whether the number of active vms on the host is smaller than the maximum if it is Then I can use these hosts in order to run the vm if it's not then I can't so this function basically filters out Vms the a host that can't that have more than 100 vms In this part in this in this case Am I clear? The python sdk This is python Yeah, yeah, it's using the python sdk to do that the only thing I found a bit Just being honest with you because when I prepared the slides here I saw that something I didn't write this feature schedule api and what bothered me here most Is that you need to pass the username and the password etc In order to to do that Um And you saw a second ago the solution we had for ui plugins that we gave you some registration So perhaps we would do that in here as well to give you some Session the only difference is that for the ui plugins you really logged into the system. This one is a periodic It's both periodic or Our user generated event depending on on whether you're load balancing or running a new vm But perhaps we would it would be nice to give a session ID in here as well, but why are you you're going to ask something because I Uh, that's okay I think it's I think it it it looks for for different classes that have the new filter function When it when it scans for the directory. I'm not sure about that. I mean, uh, um that I think that's the case but Perhaps it's enough Yes, so the events I will get there but But basically what will trigger the filter The the filter will be triggered in in in a few use cases one of them is Just you decide to run the vm. Okay, so you go to the Or to the api or the cli or the sdk or the web of the being or the user portal Whatever you want and you press play on the vm. You say I would like to run this vm So that would call the overhead scheduler and ask him to to to select the host to write It to run the vm on okay So the first thing it would do is is he It would check what available hosts are in the cluster Okay Available hosts are hosted are in an upstate and that would be the the big list of hosts Okay Now all the filters start running one by one And each filter can filter out hosts until we're left with a smaller set of hosts That the weight function Yeah To trigger the So so perhaps so So perhaps a hardware failure may May cause migration to work and the filter will work in migration as well. You can't You can't trigger that that it triggers only when the regular scheduler would have triggered Load balancing is another example that periodically we check if we need to to migrate the vm So it will be triggered as well You would basically trigger In the case you're representing perhaps you will have a script that triggers a vm migration event and the vm migration event will eventually trigger that But you won't trigger that directly you just trigger migration and that will happen Okay, so so that's the filter Now assuming i'm left with with several hosts. I have the weight module and Again the lower the better We we use the current policies we have for evenly distributed the power saving and we created Weight module for them. I won't get into that, but you can create external weight modules in python again. So So in this example, I show the event the evenly distribution So what we do here again is we have a class with the do score function Getting the host IDs and the vm ids. These are the hosts that were left after all the filters ran Okay, these are host host 2 and host 4 in our example And I get the vm id that that's the vm that I want to uh To run or to migrate depending on the use case and and what what we're going to do here is add Is is getting the number of active vm Vms on on on each host and added that to the score To the score set we are returning back So I would add the host id and the and the weight will be the number of active vms. So in that case the the The host with the best score will be the host running The lowest number of vms and if I want to be evenly distributed I should run the vm on that host So that's what that's what this weight function does here Again, you need to access the the api in here in order to get the details Now the reason we don't expose everything in here only the host id is in order Is because you can have a lot of a lot of hosts that can run that that are input in here But maybe you don't want to get the details on all of them. It depends on what you already know. So So that's just an optimization in here that to give you the ideas It also keeps the api in here a bit cleaner even if in the future you will have will have other properties And etc. You will have you get an id and that's it and the third The third part in here is is a load balancing That's periodically runs And determines whether a vm should be migrated now in my environment Again, we had We had two load balancing algorithms evenly distributed and power saving and we created Two predefined Load balancing policies for that And and in here what we what we basically do in the load balancer is we check what if we have in here We run on all the hosts And we check If the number of active VMs on the host is smaller than the maximum if that's the case Then we then the host is is is in the white list And If that's not the case, then perhaps we have here an overloaded host So we save that host for later on so What happened what happens eventually is that if we didn't find an overloaded host then we don't need to do any migration at all because and Because no host is overloaded all all the Everything is okay. We don't need to to do anything But if we found a specific host that that is overloaded, which means it has more than the maximum number of VMs Then we pick a VM and we say Please migrate this VM to one of these white list hosts. The white list host Is the the hosts that have Less than the maximum number of VMs running So if I have for example one host that's running 102 VMs and three hosts that are running 90 VMs Then I will choose Then I will put the host running 90 VMs in my white list And I will choose one VM running on the overloaded host and say, please migrate this host this VM to one of these hosts Okay, is it clear What you Sorry Yeah, so so Later on it will choose one of the hosts. I mean this code runs after Basically after that it will run filters and it will run weights So it's just it's just the the initial phase to just to sell just to choose This the input here will be passed to the filters and then to the weight and then a host will be selected So as I said, you can write external policy units You you place them in user shell of your schedule proxy plugins And we analyze for filter weight or balance functions. We catch the results and we export that Um in the ui. So here is here is the The ui for that We we you can add or edit a cluster policy and in that you can Um enable different filters now some of the filters as you see here like cpu and network Are predefined filters And there is here max vm's the max vm's filter. I showed you earlier that was enabled It's just you just drag and drop filters into this policy Then on the second section you have weight modules and you drag and drop different weights Into that again, you can you see here ext is stands for external Weight functions and you see the predefined ones in here as well And you select one load balancer for each policy In here because we use the the max vm's filter We have here a property called maximum vm count that needs to be configured for this cluster policy So that's the first the first part creating a new cluster policy and then If you go to the cluster it's hard to see in here, but the cluster main tab and you select the cluster You can edit the cluster policy selecting the policy that we created a second ago and you can You can override the this property from the default that was created in the cluster policy That's a way for you to apply the cluster policy In your specific cluster So that will eventually tell what filters will run what weight functions will run and what load balancer logic will It's a very powerful feature depends if you need that Any questions so far? So bear with me a few more minutes and we're over. I know it's a long session. So So The the next part we'll talk about vdsm hooks The vdsm hooks is is a pretty I would say old but It's a feature that's been there for for from the beginning So, uh, ui plugins appear the year and a half ago and the scheduling api is just straight from the oven You have here links to Nation on the vdsm hooks and also a catalog of hooks Basically a hooks is a mechanism to to customize To do different customization and It allows you as an administrator to define scripts that modify Vm operation modify things on the host running the vm Like modifying the vm configuration running system scripts Um In here you see that we have vdsm And when we create a new vm when we would like to run a new vm and we select the host We eventually get to vdsm telling him please create the vm on the host and vdsm Calls libvert in order to do that but In between the call to libvert you can write a hook to modify the vm Just before it gets to to to libvert And you can do also specific operations in the hook that don't change the vm if you want to Write something to a log or if we would like to To add some entry in the ip tables for that specific vm you can do that So hook scripts are called at specific vm lifecycle events As I said they can modify the vm or apply a specific rule or run any command you want So the different lifecycle events you can use is When vdsm starts Before and after the vm starts Before a migration event before you post the vm before you hibernate the vm continue When you stop the vm for example if you created a new IP table entry when the vm when you run the vm maybe when you stop it you want to delete this entry So you would use both before vm start and on vm stop Yeah, you can also hook to a hot plugging Before you hot plug and eek and after you hot plug and eek. I think for for disk as well Mention that So when you stand on vm on a specific vm you see they selected a virtual machine here Main tab and selected a specific virtual machine you go to the custom properties a side tab And in here you see the different hooks that are available for this vm and you can Pass different parameters to them I'll skip this slide for a second. This is an example of a hook What this hook does is add a Watchdog device. It's basically A device that identifies something wrong happened to the vm and if if the vm crashed it can do a Specific operation in here. We decided that we do a reset action So I think that now we have the watchdog support already Inside the over-tension, but before we had this support people people said we want to use that Why can't you allow us to use that? So an easy way to to add this functionality is to tell them or to write a hook by ourselves Just write a hook what the hook does it's it It it takes the The domain xml of the vm. That's the xml that vdsm created in order to pass it to liberate to run the vm We get the devices section And we create a new element in the devices section to add the new watchdog device Telling him I would like to have the the reset action and we added to the devices xml and we write the domain xml So basically what we did here is We took the xml added a device save the xml and then that's the xml that will be best delivered That's it and we have support no need to add a ui for that no need to add the engine code for that only Only add the hook and configure that in the vm custom properties No You need to put the hook manually on the host it's relevant for that For that hook Then then when the vm migrates you don't really you have You have a before after vm migration event So if In case of migration the domain xml doesn't change unless you I'm not sure you can change that or perhaps you know You can change the domain xml on vm migration In this case you won't need to by the way because the domain xml contains the device but just Nobody doesn't need the hook in the in this case. It doesn't really need it. No, yeah Yeah, in this case in other cases If if it needs the hook that you need to put in there and you would probably hook to the Before migration after migration and you see it's before vm migration in or out so in the source or the destination So you would need to In there Yeah, we're not as far as I know we can't really Yeah, I don't think it Is We we do show you that in the ui No, it's here Okay in the whole stop tab you can see the hooks That are on the host so you can easily see if the the hooks are there, but you can't really Add new hooks through the Yeah, the I think the main use case for hooks. I see several ones one of them is that Someone wants a feature and it's not available yet Use a hook for now in the future it will be supported another use case is that perhaps you as a as a third party You use for example I know melanox for example, I don't know if you know this company used hooks in order to To add nicks in philip and nicks into the vm because we didn't have this functionality If I remember correctly, that's why they what they did So basically there were the hook the if you put the hook on all the host and you have this functionality perhaps it It can be added to the engine later on as a native feature if if that's what If that's what's needed and If it's decided in the community that's going to be in a part of a specific version and But until then it can be available as a hook. So So sometimes hook Eventually get to be a feature sometimes not so You can also I'm not sure It would be nice to test whether we Show the hooks through the api. I'm not sure about that They available hooks because if we do then you can write A filter that filters out if you know a specific vm needs the hook And so you can get the host get the different hooks and then see whether it's Whether the hook is in the host That case you can verify that the vm won't run on a on a host that doesn't have the hook But I'm not sure we expose this information That the hook ran No, you you won't see an event that Not as far as I know it's strictly a a vm feature that allows you to Do that the engine just passes the the properties so that if if you see that I don't know that the watchdog property Was added was added when you created a vm then the Then the hook will You see a condition on the hook Um If has key watchdog if you want pass the watchdog key it won't run So all the hooks all the hooks will run, but they will each hook needs to test whether it needs to be activated Yeah No, you can do it Just maybe abusing some of the functionality, but you can use The rest as dk in order to push an external event that the hook was triggered For example, yeah, but it's not But it's not something that's there natively again, I'm not sure that the hooks are Reported at the host. I think not, but I'm not sure about They are what? Yeah, so so in that case you can use a filter for You can use a filter and the filter by the way can can put Um It will filter out hosts. Maybe you can also trigger some warning somewhere An event saying that there is a failure That you would have expected the host to have the hook, but he doesn't have the hook You can do a lot of things with the combination of hooks of scheduling api of using the sdk you can do a lot of things and and This depends how you want to use that So hooks catalog I won't go over that that appears in the link. I I showed you Earlier, we have a lot of hooks some of these hooks. Maybe Attach a line to a vm. We already have that as a feature, but before we had that as a feature You could have done that using a hook And a lot of others These are my details and my email address over the o at reddit.com You can see me on the overtire c I have a blog currently it has Several entries not not allowed unfortunately. I need to do some more but uh about the delta cloud and about ui plugins But it has also other the formal plugin Was more Difficult than than it looks it contained also a part and in the format any a plugin in form and as well And there are a few things you need to consider when running and play a plugin, which is the and the cross origin issue and I want to go into that but the the blog post gets into that and It's worth reading if you're interested in writing a new plugin. You have the users in the engine development list Engine development is mostly for developers users is most is mostly for for users sharing their experience or or asking different questions So you should usually use that one and We'll just go to the overtire c And as I said earlier Going back in time We have wasn't that smart but anyway, yeah We have these sessions Omar session about integration with cloud in it tomorrow and over developer day at the kvm forum Which is your stage to To let us know what you want to have in the product Any questions, okay, so thank you for your patience. Hope you learned something new


I just think, like, grasp on to the things that you're passionate about and keep them there. Maybe accept that sometimes it's okay to be bored and to, like, just have time to reflect and maybe talk things through. This is the first time I've, you know, I don't get interviewed because I basically go into a school with my books and I show them the work and they go, oh yeah, we'll have one of those. So for me to delve deeper, a bit deeper into what's important to me and what I'm passionate about is really important. So I just say, maybe just find time to reflect and ponder and write things down, but also to learn to say, no, I'm not going to do that, which is quite tricky, but just learn to say it and justify why and not take too much on. And basically try in your work, I don't know who, you know, people are young or older or anything to this, but just sort of, like, maybe try something out that, you know, that you didn't think you would enjoy doing. You might actually really love it or just, you know, search through and listen to people who know you well and listen to their advice. Without my friend Jane telling me to stop doing all that high impact stuff and try doing something calmer, I don't know if I'd be in this calm state right now. So, you know, and I might not have even looked at your email and I might have gone on and can't do that. That's just too difficult. So yeah, all those things. And love yourself, which is a bit cliche, but you should.


The UK is recognised throughout the world as for safety at sports grounds and the SGSA is also recognised for improving safety and setting standards. Working with Interpol is an excellent experience. Interpol is probably one of the few organisations that touches every country in the world and can bring together every expert on stadium safety to one suppository. So it's really good to share our experiences and good practice throughout Europe and throughout the rest of the world.


Afizi... The UPND secretary because they are not UPND. Where did they go? DMMA feeding him. Just one day. DMMA is rushing to feed politico Kadath. As if it was an image. Where have you seen DMMA reacting like that? Here in this part of the region, in 2019-2020, Info hojia wanyiko kwa w ladyiko henga kutu Udonizu kua tunikadu mezuwek Wahi kutu kua kutu kya uolbia Oda wakitama wadi karrija? Kwa kabutu HMU? Hfirtu niosi wa. Insi nwa wadi kwa? Ako nga hengha hemi kutu kwa kolikya Hantu humikana wanwiki henda 11kuaturu nia wiana Kupukana hemi kwaze henga This time we will have much change than as but we also have enough twin votes. Not using the change but just using the change for people to have advertisement. Not buying votes. We have capacity this time watching this space. So take your people back wherever you bought them and end this drama. Let's do decent politics. We will even denize asho. Lead by DMMU. How? We have to perform such an important task where from after that launch you don't want the momentum to go down. You want the wavelength to continue. You must put everything in order. Right now logistics everything is being put in place. Who is going to lead which campaign in which province. Motachi is going this side. KBF is going this side. HH is going this side. Narumanwa is going this side. Enest Maasa is going this side. Meroopi is going this side. Muhetwa will be doing huvuzera after receiving information. So these are the issues. Muhetwa and Tamukawana who has been named as the alliance media director. They will anchor the huvuzera engine over their alliance. You can imagine Pete Lee and Tamukawana here. Vesa is Antonio Maasa and I don't know who. Sorry, sorry media. Because as we stand for truth we can never justify a wrong to the right. And when something is wrong say it is wrong. Don't spin around lies and present it to the truth.  So here HH and his team will hit the road running very soon. And I can also indicate that in certain provinces where we have been campaigned don't be deceived that we haven't been campaigning. We left PF brandish in all the trades. They were brandish. We went on aggressively in the campaign using local radio stations, using meetings. Today in Choma, here where we are speaking from, I don't need to campaign here. I'm just going to campaign in four words. We launched our campaign two days ago here in Choma. Our only campaign in four days. Tomorrow we are hitting Livingstone. Tomorrow we are hitting Livingstone for two days. After Livingstone we will let the nation know because we don't want HH to waste time in some of these places that we can handle. There is enough information to discredit PF for their failures. Because here in Choma, why should HH come to do what? He just came here for people to know. He didn't die in Mukoweko. So he is still alive. Okay, this is how now he is looking with KBF and his team. That's all with Narumango. That's all. Not campaigning here, no. Because here PF, I have already assured the part in Choma, PF won't get more votes than they did in 2016. Never. Never. Nothing. It's not there. In case I don't know, 75% of the votes in Choma are raw. And in this rural area, two things that I am saying for free. One, the hunger you exposed our people in 2019-2020 when you made them to be sleeping at sheds for 10 days, refusing to sell maize when they had money to buy after selling their votes, their animals, you punished them, we are reminding them with emotion and they will not give you a vote.


Now, while the backdrop of the current security environment is different, this type of mission is not new or different to the Second Cavalry Regiment. It's exactly who we are and why we exist. As a forward station striker brigade combat team assigned to the United States Army, Europe and Africa, we routinely deploy across the European continent and our major training exercises always include our NATO allies and partners. The Second Cavalry Regiment's standing mission remains to provide a ready and trained force that can do exactly what we're seeing today. Deploy professional combat credible forces to partner with our Alliance teammates. Our readiness demonstrates our resolve and it assures our allies and deters our adversaries.