Published on August 13, 2007
Virtual Appliances for Scientific Applications: Virtual Appliances for Scientific Applications Kate Keahey [email protected] Argonne National Laboratory University of Chicago The Grid Metaphor: The Grid Metaphor How do we store energy? How do we charge for energy? How do we reliably deliver energy? What happens if a power station fails? How do we ensure quality of service? What elements make for a safe and efficient power Grid? How do we make sure that supply meets demand? Computational Grids: Computational Grids What is the 'unit' of resource usage? How can we manage different computing environments? How can we ensure that disk, CPUs, network are all available? How can we negotiate for computation? How can we use Grid resources as easily and intuitively as we use electrical power today? Provisioning Critical Resources: Provisioning Critical Resources Quality of Service: Quality of Service Issues of control Trust management Dynamic relationships Protocols to negotiate SLA-based relationships Enforcement tools What worked Coarse-grained sharing for relatively tight-knit communities with strong incentives to collaborate Non-critical needs Informal relationships What proved difficult: Formal sharing for loosely knit communities Quality of Life: Quality of Life Lots of heterogeneous resources, none of them good for my application Consistent environment Short-term leasing Changing configuration quickly, quick turnaround Some examples: Support for legacy physics applications Unusual platforms needed by ornitologists Climate scientists need very consistent configurations What worked Access to resources with standardized configuration Tightly-knit communities Everything else proved difficult Workspaces for Grid Computing: Workspaces for Grid Computing Virtual Workspace Environment definition Resource allocation The GT4 Virtual Workspace Service (VWS) allows an authorized client to deploy and manage workspaces on-demand. GT4 WSRF-based protocol set, leverages multiple GT services Multiple back-ends possible, currently using Xen http://workspace.globus.org Paper: Virtual Workspaces: Achieving Quality of Service and Quality of Life in the Grid, Scientific Programming Journal Workspace Service: Workspace Service Pool node Trusted Computing Base (TCB) Image Nodeand#x3; Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node The workspace service has a WSRF frontend that allows users to deploy and manage virtual workspaces The VWS manages a set of nodes inside the TCB (typically a cluster). This is called the node pool. Each node must have a VMM (Xen) installed, along with the workspace backend (software that manages individual nodes) VM images are staged to a designated image node inside the TCB VWS Node VWS Service Deploying Workspaces: Image Nodeand#x3; Deploying Workspaces Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Workspace Deployment Request Workspace metadata Describes the workspace Contextualization information (IP, security,partitions,etc.) Resource Allocation Specifies availability, CPU%, disk, memory, nodes, etc. VWS Service Interacting with Workspaces: Image Nodeand#x3; Interacting with Workspaces Pool node Trusted Computing Base (TCB) Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node The workspace service publishes information on each workspace as standard WSRF Resource Properties. Users can query those properties to find out information about their workspace (e.g. what IP the workspace was bound to) as well as manage the resources a workspace was assigned Users can interact directly with their workspaces the same way the would with a physical machine. VWS Service The Case of OSG Edge Services: The Case of OSG Edge Services OSG Edge Services: OSG Edge Services Requirements: Edge Services are VO-specific Resource usage negotiation and enforcement Features: IP addresses Management Host certificates for Edge Services, naming issues Resource allocation (re)negotiation Integration into the local infrastructure Challenges: Image configuration and maintenance Fine-grain resource usage enforcement Running out of public IPs… Paper: Division of Labor: Tools for Growth and Scalability of Grids, ICSOC 2006 The Case of the OSG Virtual Cluster: The Case of the OSG Virtual Cluster Image Nodeand#x3; Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node VWS Service OSG Virtual Cluster: OSG Virtual Cluster Requirements: Leasing/Glide-ins: resource allocation for VO-specific computation Short execution time, workflows Scientific gateways Features: Describing and managing aggregate workspaces Application-specific configuration on the fly Challenges: Integration with local scheduling infrastructure Paper: Virtual Clusters for Grid Communities, CCGrid 2006 (TR2005) The Case of the STAR Application: no STAR The Case of the STAR Application no STAR no STAR STAR STAR STAR VWS GRAM STAR GRAM STAR Application: STAR Application Requirements: Hard-to-install legacy applications Consistent environment requirements Features: Image size (6-10 GB), 8 min deployment time Image Caching Challenges: Integration with local scheduling infrastructure Presentation: Virtual Workspace Appliances, SC06 The Case of the Alice Application: The Case of the Alice Application Requirements: Pull-based computing model Features: Partition management Blank partitions Partition sharing between workspaces Capability maching Workspace descriptions Factory pre-reqisites Ongoing effort Moving Forward: Moving Forward Deployment: a chicken and egg problem The Chicken: overcoming Xenophobia Hypervisor installations are invasive Security: the cure or the disease? Infrastructure: scheduling, etc. Incentives The Egg: users Where do I get an image from? VO administrators How do we describe, identify, query for images? Integrated vision of knitting multiple resources together Overall Approach: Overall Approach Appliance Producer Appliance Deployment Appliance Management Deployment (1): Deployment (1) Matching Appliances to Resources Appliance meta-data VM image? What VMM, architecture, etc. Resource characteristics What kind of appliances am I willing to deploy? Workspace Service Workspace meta-data VWS Factory pre-conditions Deployment (2): Deployment (2) Establishing trust in an appliance Assert appliance properties, sign them to the image Direct or indirect assertion Trust the process, not just the person Probe appliances Presentation: Making your workspace secure: establishing trust with VMs in the Grid, SC05 Deployment (3): Deployment (3) Adapting appliances for deployment IP address delivery Generating certificates Making an appliance work within a specific deployment framework (contextualization) Virtual clusters Application-level configuration Producing Appliances: Producing Appliances Configuration for the masses The profile of an appliance configurer has changed Building appliances incrementally Appliance attestation Functionality testing Trust the process, not just the person Managing Appliances: Managing Appliances Security updates Security RSS Feed Bugtraq, US-CERT Security Advisories Will the system still work? Functionality testing Component dependencies Appliance Layers: Appliance Layers Layered Appliance A set of interdependent layers Appliance layers Less data needs to travel More flexible Faster deployment Trust management Collaborative aspects of configuration System Layer Customization Layer Application Layer VO Layer Virtual Organizations: Virtual Organizations myVO.org grid-proxy-init Sharing resources: images, hardware, networks, storage facilities, security context Conclusions: Conclusions We need languages and protocols to describe, discover and name appliances Growing role of a VO Configuration management Virtual networks and namespaces Beyond a security context Sustainable deployment model How does producing, deploying and managing appliances work together? Credits: Credits Workspace team Tim Freeman, Borja Sotomayor Guest appearances Rick Bradshaw, Predrag Buncic, Narayan Desai, Abhishek Rana, Frank Siebenlist, Doug Olson, Frank Wuerthwein and others.