Systems Management Project

I'm just recording some ideas here for this project.

Note that when I refer to a 'project' here the actual implementation should probably refer to them as a 'client', 'customer', etc. For us, clients are usually projects.

For our primary virtual machine hosting (what we should focus on for now) we are moving to Ganeti

Ganeti offers an HTTP API for management that we should probably use in some way

For documentation see here

1. OSL Sysadmin Creates VM
   1. sysadmin logs in, navigates to VM manager
   2. sysadmin selects create VM (wizard?)
   3. sysadmin enters VM name, operating system, DNS info, project, etc
   4. wizard updates DNS, inventory, etc
   5. *then* wizard creates VM.
   6. One oddity of ganeti is that the VM name must resolve (DNS) *before* ganeti can create the VM.
      1. This might require job scheduling of some sort?
2. Project member reboots VM
   1. Project member logs in, navigates to VM manager
   2. Project member views project VMs
   3. Project member selects VM for reboot
   4. Project member clicks through a scary warning
   5. VM gets rebooted

• A 'domain' can have a lot of stuff in it (ie, osuosl.org). The Linode interface referenced below is fine (preferred?) for a small domain, but for a domain with hundreds of records a better way to browse the domain is needed.
• The app has to interface with the DNS servers somehow
  • Maintain generates and syncs out config files on a schedule
    • Could use django templates for this, even serve it over http?
  • Bind supports remote updates with the 'nsupdate' utility
  • Could push out configs with whatever RPC mechanism is being used for everything else (mcollective?)

1. Project member configures DNS
   1. Project member purchases domain from registrar
   2. Project member configures domain to use OSL nameservers
   3. Project member logs into the OSL management system and navigates to the DNS section
   4. Project member adds domain info to OSL management system
   5. Look here for something similar (I, Russell, have an account there if anyone wants to play with it)
2. Project member adds DNS record
   1. Project member logs into OSL management system and navigates to the DNS section
   2. Project member selects the domain they want to modify
   3. Project member clicks add record (of specific type?)
   4. Project member adds record details and clicks save
3. Project member adds MX Records
   1. Project member logs in, navigates to DNS management and selects domain
   2. Project member selects add MX record
   3. Project member elects to use OSL mail relays
   4. Application automatically fills in smtp1.osuosl.org, smtp2.osuosl.org, etc
4. OSL Sysadmin (or project member?) adds a host
   1. Sysadmin logs in, navigates to DNS and selects domain (default domains would be good)
   2. Sysadmin starts 'add a host wizard'
   3. Sysadmin fills in relevant details (A record, PTR, DHCP info, etc)
   4. The ability to create custom 'wizards' like this for common tasks would be good
   5. Ideally it should add data to inventory, etc

I wanted to get down some thoughts on this because I'm not sure how obvious it is how this works.

• We host projects
• Projects have resources (servers, domains, etc)
• Projects may have sub-projects which may need access to some resources
• Not everyone in a project who needs access to one thing should have access to all things
  • “Roles”? Are Roles the same as sub-projects?
• We generally have access all of a managed projects resources (not all projects are managed)

My guess would be some sort of tree structure:

• Datacenter (The OSL)
  • Project 1
    • DNS Admins
    • VM Admins
  • Project 2
    • Corvallis Branch
      • DNS Admins
    • Europe Branch
      • DNS Admins

Joe is the lead sysadmin for Project 1, and a DNS admin for Project 2, Corvallis branch. He may access any resource for project 1, but only DNS for project 2. He may create child roles/subprojects for Project 1 but not project 2.

Dave is the lead sysadmin for Project 2. He may access any resource belonging to Project 2 and create any role/subproject he wishes.

Russell is a sysadmin for the OSL. He can do whatever he wants (evil laughter?)