Installing openstack python clients on mac yosemite

Up to mavericks I had all my openstack python clients installed and working on my mac. However, after the upgrade to yosemite I started to get some errors about some missing libraries.
After spending more time than I would have liked I managed to get the python openstack clients working again.

Remove older versions of python

  • rm -rf /Library/Frameworks/Python.framework/Versions/2.7
  • rm -rf "/Applications/Python 2.7"
  • rm /usr/bin/python
  • brew rm python

Update python version

The latest available version up to this time of writing was 3.4

After the installation is completed make sure to update the Current symlink

  • ln -s /Library/Frameworks/Python.framework/Versions/3.4 /Library/Frameworks/Python.framework//Versions/Current

and the python symlink:

  • ln -s /Library/Frameworks/Python.framework/Versions/3.4/bin/python3.4 /usr/bin/python

Also needs to update symlinks for pip and easy_install

  • ln -s /Library/Frameworks/Python.framework/Versions/3.4/bin/pip3.4 /usr/bin/pip
  • ln -s /Library/Frameworks/Python.framework/Versions/3.4/bin/pip3.4 /usr/local/bin/pip
  • ln -s /Library/Frameworks/Python.framework/Versions/3.4/bin/easyinstall-3.4 /usr/bin/easyinstall
  • ln -s /Library/Frameworks/Python.framework/Versions/3.4/bin/easyinstall-3.4 /usr/local/bin/easyinstall

Install libffi

Libffi is a dependency for the python-glanceclient. If the lib is not present you might get an error like this:

/usr/bin/clang -fno-strict-aliasing -fno-common -dynamic -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -arch i386 -arch x8664 -g -I/usr/include/ffi -I/usr/include/libffi -I/Library/Frameworks/Python.framework/Versions/3.4/include/python3.4m -c c/cffibackend.c -o build/temp.macosx-10.6-intel-3.4/c/cffi_backend.o

c/cffibackend.c:13:10: fatal error: 'ffi.h' file not found

include <ffi.h>

1 error generated.

Note: will not use '__thread' in the C code

The above error message can be safely ignored

error: command '/usr/bin/clang' failed with exit status 1

To install the libffi I used brew:

  • brew install libffi

Install pbr

PBR is also another dependency for the python-glanceclient, without PBR you might get an erro message like the following:

$ glance --help Traceback (most recent call last):
File "/Library/Frameworks/Python.framework/Versions/3.4/bin/glance", line 6, in <module> from import main File "/Library/Frameworks/Python.framework/Versions/3.4/lib/python3.4/site-packages/glanceclient/", line 24, in import pbr.version ImportError: No module named 'pbr'

To install PBR:

  • pip install pbr

Finally, install the clients

Don't forget to export the PKGCONFIGPATH which will include the dir of the libffi installed with bew:
- export PKGCONFIGPATH when running the install command sudo PKGCONFIGPATH=/usr/local/Cellar/libffi/3.0.13/lib/pkgconfig/ python install

Installing OpenStack, Quantum problems

During the following weeks we plan to expand more on the subject of setting up an OpenStack cloud using Quantum.
For now we have been experimenting with different Quantum functionality and settings.
At first Quantum might look like a black box, not due to its complexity, but because it deals with several different plugins and protocols that if a person is not very familiar with them it becomes hard to understand why Quantum is there in the first place.

In a nutshell Quantum has the role to provide an interface to configure the network of multiple VMs in a cluster.

In the last few years the lines between a system, network and virtualization admin have become really blury.
The classical unix admin is pretty much non existent now a days since most services are offered in the cloud in virtualized environments.
And since everything seems to be migrating over to the cloud some network principles that were applied into physical networks in the past some times don’t translate very well to virtualized networks.

Later we’ll have some posts explaining what technologies and techniques underlie the network configuration of a cloud, in our case focusing specifically on OpenStack and Quantum.

With that being said, below are a few errors that came up during the configuration of Quantum:

1. ERROR [quantum.agent.dhcp_agent] Unable to sync network state.

This is error is most likely caused due a misconfiguration of the rabbitmq server.
A few ways to debug the issue is to:
Check if the file /etc/quantum/quantum.conf in the controller node(where the quantum server is installed) has the proper rabbit credentials

By default rabbitmq runs on port 5672, so run:

netstat -an | grep 5672

and check if the rabbitmq server is up an running

On the network node(where the quantum agents are installed) also check if the /etc/quantum/quantum.conf have the proper rabbit credentials:

If you are running a multihost setup make sure the rabbit_host var points to the ip where the rabbit server is located.

Just to be safe check if you have a connection on the management networking by pinging all the hosts in the cluster and restart both the quantum and rabbitmq server as well the quantum agents.

2. ERROR [quantum.agent.l3agent] Error running l3nat daemon_loop

This error requires a very simple fix, however, it was very difficult to find information about the problem online.
Luckily, I found one thread on the mailing list of the fedora project explaining in more details the problem.

This is error is due to the fact that keystone authentication is not working.
A quick explanation – the l3 agent makes use of the quantum http client to interface with the quantum service.
This requires keystone authentication. If this fails then the l3 agent will not be able to communicate with the service.

To debug this problem check if the quantum server is up and running.
By default the server runs on port 9696

[email protected]:/home/senecacd# netstat -an | grep 9696
tcp 0 0* LISTEN

If nothing shows up is because the quantum server is down, try restarting the service to see if the problems goes away:

quantum-server restart

You can also try to ping the quantum server from the network node(in a multihost scenario):

[email protected]:/home/senecacd# nmap -p 9696

Starting Nmap 5.21 ( ) at 2013-01-28 08:07 PST
Nmap scan report for folsom-controller (
Host is up (0.00038s latency).
9696/tcp open unknown
MAC Address: 00:0C:29:0C:F0:8C (VMware)

Nmap done: 1 IP address (1 host up) scanned in 0.04 seconds

3.ERROR [quantum.agent.l3agent] Error running l3nat daemon_loop – rootwrap error

I didn’t come across this bug, but I found a few people running into this issue.
Kieran already wrote a good blog post explaining the problem and how to fix it

You can check the bug discussion here

4. Bad floating ip request: Cannot create floating IP and bind it to Port , since that port is owned by a different tenant.

This is just a problem of mixed credentials.
Kieran documented the solution for the issue here

There is also a post on the OpenStack wiki talking about the problem.


This should help fixing the problems that might arise with a Quantum installation.
If anybody knows about any other issues with Quantum or has any suggestions about the problems listed above please let us know!

Also check the official guide for other common errors and fixes

OpenStack High Availability Features

Until the moment we have been researching possible solutions to make an OpenStack Cloud deployment have as much high availability features as possible.

Before the Folsom release H.A features were not built in the OpenStack service components.
With a large number of requests from the OpenStack community, starting with the Folsom release H.A is being addressed as part of the project. The features are still being introduced and in test phase, there aren’t a lot of production deployments out there yet, but with the help and feedback of the community the OpenStack developers believe that by the time the next version is release (Grizzly) OpenStack H.A features will be automated and ready to get in production mode from the get go.

Getting into the details of the H.A features available in Folsom:
Instead of reinventing the wheel, OpenStack decided to go with a proven and robust H.A provider available in the market: Pacemaker was their choice. With more than half a decade of production deployments, Pacemaker is a proven solution when it comes to providing H.A features to a vast range of services.

Specifically looking at the technologies involved with OpenStack, the role of H.A would be to prevent:

  • System downtime — the unavailability of a user-facing service beyond a specified maximum amount of time, and
  • Data loss — the accidental deletion or destruction of data.

In the end the focus is to eliminate Single Points of Failures in the cluster architecture.
A few examples:

  • Redundancy of network components, such as switches and routers,
  • Redundancy of applications and automatic service migration,
  • Redundancy of storage components,
  • Redundancy of facility services such as power, air conditioning, fire protection, and others.

Pacemaker relies on the Corosync project for reliable cluster communications. Corosync implements the Totem single-ring ordering and membership protocol and provides UDP and InfiniBand based messaging, quorum, and cluster membership to Pacemaker.

An OpenStack high-availability configuration uses existing native Pacemaker RAs (such as those managing MySQL databases or virtual IP addresses), existing third-party RAs (such as for RabbitMQ), and native OpenStack RAs (such as those managing the OpenStack Identity and Image Services).

Even though high availability features exist for native OpenStack components and external services they are not automated in the project yet so there is a need for manual installation and configuration of whatever H.A features are needed in the cloud deployment

A quick summary of how a Pacemaker setup would look is:

PaceMaker creates a cluster of nodes and uses Corosync to establish a communication between them.

Besides working with RabbitMQ, Pacemaker can also bring H.A features to a MySQL cluster, the steps would be:

  • configuring a DRBD (Distributed Replicated Block Device) device for use by MySQL,
  • configuring MySQL to use a data directory residing on that DRBD device,
  • selecting and assigning a virtual IP address (VIP) that can freely float between cluster nodes,
  • configuring MySQL to listen on that IP address,
  • managing all resources, including the MySQL daemon itself, with the Pacemaker cluster manager.

More information can be found:
Towards a highly available (HA) open cloud: an introduction to production OpenStack

OpenStack Overview

Recently we started moving away from our original setup plan that was to have an OpenNebula cloud running on CentOS boxes, to an OpenStack Cloud running on Ubuntu boxes.

I’ll try to give a quick overview of what is OpenStack and talk a little bit about some of its main components.

Before I get started, I really like this diagram that demonstrates what problem OpenStack is trying to solve.

This is a basic diagram demonstrating the basic usage/need of a cloud platform.
OpenStack works on all levels of the cloud set up, from the low level libraries that interact with the HyperVisors to the Web Dashboard that allows users to interact with the cloud.
In the end OpenStack aggregates different solutions to offer a simple way to build public and private cloud platforms.

Some OpenStack history

Back in 2010 NASA and RacKSpace started the OpenStack Cloud project with the goal of having an open standard for both hardware and software cloud solutions.
Currently there are more than 150 companies involved with the project, such as Intel, IBM, Cisco and HP to name a few.

As far as activity, OpenStack seems to be very active with two major releases per year.
Their release history:

  1. Austin 21 October 2010
  2. Bexar 3 February 2011
  3. Cactus 15 April 2011
  4. Diablo 22 September 2011
  5. Essex 5 April 2012
  6. Folsom 27 September 2012
  7. Grizzly 4 April 2013

OpenStack is divided into three different categories:


  • Nova – OpenStack Compute
  • Glance – OpenStack Image Service


  • Swift – OpenStack Object Storage
  • Cinder – OpenStack Block Storage

Common Projects

  • Keystone – OpenStack Identity
  • Horizon – OpenStack Dashboard


  • Quantum – OpenStack Networking

Now lets took into more details on the components listed above:

Nova – Compute

Nova can be summarized as a cloud controller.
It centralizes the management of a cloud and communicates between all different components, a good diagram that illustrate its role:

The main components of Nova are:

  1. API server: handles requests from the user and relays them to the cloud controller.
  2. Cloud controller: handles the communication between the compute nodes, the networking controllers, the API server and the scheduler.
  3. Scheduler: selects a host to run a command.
  4. Compute worker: manages computing instances: launch/terminate instance, attach/detach volumes
  5. Network controller: manages networking resources: allocate fixed IP addresses, configure VLANs

List of features:

  • Manage virtualized commodity server resources
  • Manage Local Area Networks (LAN)
  • API with rate limiting and authentication
  • Distributed and asynchronous architecture
  • Virtual Machine (VM) image management
  • Live VM management
  • Floating IP addresses
  • Security Groups
  • Role Based Access Control (RBAC)
  • Projects & Quotas
  • VNC Proxy through web browser
  • Store and Manage files programmatically via API
  • Least privileged access design
  • Dashboard with fully integrated support for self-service provisioning
  • VM Image Caching on compute nodes

Glance – Image Service

Glance takes care of managing virtual machine images.
Some of its functionality:

  • List Available Images
  • Retrieve Image Metadata
  • Retrieve Raw Image Data
  • Add a New Image
  • Update an Image
  • List Image Memberships
  • List Shared Images
  • Add a Member to an Image
  • Remove a Member from an Image
  • Replace a Membership List for an Image

Glance is only responsible for creating and managing virtual machine images, the deployment and maintenance of the VMs is taken care by Nova

Swift – Object Storage

The Swift  component is a Container/Object storage system.
Different from SAN and NAS file systems, Swift cannot be mounted, since it is not a file system itself.
You can think of Swift as a distributed storage system for static data, such as images, videos, archive data, etc
All the files are exposed through an HTTP interface, typically with a REST API

A good analogy is to think of Containers as folders as in a regular OS such as Windows
Objects are chunks of data living inside containers.
So when you upload a picture to Swift it will be wrapped in an Object and placed inside a container.
The object can contain some metadata in the form of key value pairs.
No encryption or compression is performed on objects upon storage.
List of features:

  • Leverages commodity hardware
  • HDD/node failure agnostic
  • Unlimited storage
  • Multi-dimensional scalability (scale out architecture)
  • Account/Container/Object structure
  • Built-in replication
  • Easily add capacity unlike RAID resize
  • No central database
  • RAID not required
  • Built-in management utilities
  • Drive auditing
  • Expiring objects
  • Direct object access
  • Realtime visibility into client requests
  • Supports S3 API
  • Restrict containers per account
  • Support for NetApp, Nexenta, SolidFire
  • Snapshot and backup API for block volumes
  • Standalone volume API available
  • Integration with Compute

Keystone – Identity

To summarize what Keystone does in one sentence:

keep track of users and what they are permitted to do

Keystone handles the user management of the cloud system, allowing different permissions to be configured for different users.
One of the keywords they use when talking about Keystone is Tenants.
Their explanation of tenants is something that can be thought of as a project, group, or organization

A diagram demonstrating the basic flow of Keystone:

Horizon – Dashboard

Horizon is the web interface available for OpenStack,  it’s very much like what OpenStone is for OpenNebula.

Quantum – Networking

Quantum is a new addition to OpenStack.
Up to the Essex release Quantum was built in the Nova component. However to provide more functionality in terms of network management Quantum was created with the focus on managing a network of an OpenStack solution


After all that being said, based on the image from the beginning of the blog post, we can have a better idea of where the OpenStack components fit in the overall cloud set up:



From somebody who is just getting started with cloud computing I would say that between OpenNebula and OpenStack the later is a better option. Even though OpenNebula is an older project OpenStack seems more mature.
A few things I noticed:
There is a lot more uptodate information about OpenStack, plus it is very easy to navigate through their website and find information about the different solutions they provide.
The community appears to be a lot more active with OpenStack than with OpenNebula.
Maybe it is just me, but after a few minute reading about OpenStack I was lead to their official repo on github where all the related projects are hosted.
I really like that since it is an easy way to stay in close touch with the project and follow the latest additions, plus it provides a channel of communication between the users and the developer and makes a lot easier for people to contribute back to the project.
I didn’t have the same feeling when it came to OpenNebula, the project didn’t feel as open as OpenStack, I felt there were a lot more hurdles to get started with OpenNebula.

Talking strictly technical it’s hard for me to say which one is better.
Reading about them both I could definitely see a lot of areas where they overlap, for example, they both use noVnc for the visualization of VMs and libvirt to communicate with the hypervisors.
They both have a web interface to manage the cloud and they both have options to configure VM templates.

A big difference is that OpenNebula is written in ruby while OpenStack is in python
And I’m sure they must differ in other architectural decisions as well, but for the most part they are very similar

For more information about OpenStack:
OpenStack wiki
Keystone basic concepts
Underlying technologies
Architecture overview
OpenStack Storage
Very good blog about python & openstack
OpenStack Wikipedia
RackSpace Wikipedia