Grid Information Service (Meta-Directory Service 2) Globus Toolkit™ Developer Tutorial The Globus Project™ Argonne National Laboratory USC Information Sciences Institute Copyright (c) 2002 University of Chicago and The University of Southern California. All Rights Reserved. This presentation is licensed for use under the terms of the Globus Toolkit Public License. See for the full text of this license.

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 Section Overview l MDS review l Information model l Client tools and APIs l Configuring servers and adding service providers

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 Globus MDS Review l Meta Directory Service (MDS) –Globus Toolkit implementation of a Grid Info Service l System information is critical to operation of the grid and construction of applications l A basis for configuration and adaptation in heterogeneous, dynamic environments l Requirements and characteristics –Uniform, flexible access to information –Scalable, efficient access to dynamic data –Access to multiple information sources –Decentralized maintenance

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 “Classic” MDS Architecture (MDS-1) l Resources push information into a central organization server via regular updates (globus-gram-reporter), where it can be retrieved by clients. l Regular updates don’t scale as the number of resources grow rapidly. Commercial LDAP servers are optimized for “read” requests, and can’t handle frequent “write” requests. l If organization server is unavailable, no information is available. LDAP Organization Server Directory contains info from A and B Resource A gram-reporter Resource B gram-reporter gram-reporters periodically update LDAP server’s information. Client 1 Client 2 Client 3 clients query organization server for current information.

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 “Standard” MDS Architecture (MDS-2) l Resources run a standard information service (GRIS) which speaks LDAP and provides information about the resource (no searching). l GIIS provides a “caching” service much like a web search engine. Resources register with GIIS and GIIS pulls information from them when requested by a client and the cache as expired. l GIIS provides the collective-level indexing/searching function. GIIS Cache contains info from A and B Resource A GRIS GIIS requests information from GRIS services as needed. Client 1 Client 2 Client 3 Resource B GRIS Clients 1 and 2 request info directly from resources. Client 3 uses GIIS for searching collective information.

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 MDS-2 Service Architecture l Dynamic Registration via Reg. Protocol (GRRP) l Resource Inquiry via Info. Protocol (GRIP) –Co-located with resource on network l Resource Discovery (via GRIP or other) –Using GRIP allows resource/directory hierarchy discovery (GRIP?) lookup (GRIP) registration (GRRP) VO-specific Aggregate Directories standard Resource Description services RRRR AA?

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 Distributed Services l Service scales with Grid growth l Loose consistency model tolerates failures l Interoperability by GRIP/GRRP protocols D D D D

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 Soft-state Registration l Periodic notification –“Service/resource is available” –Expected-frequency metadata l Automatic directory construction –Add new resources to directory –Invite resources to join new directory l Self-cleaning –Reduce occurrence of “dead” references

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 MDS-2 Implementation l Grid Information Service (GRIS) –Provides resource description –Modular content gateway l Grid Index Information Service (GIIS) –Provides aggregate directory –Hierarchical groups of resources l Lightweight Dir. Access Protocol (LDAP) –Standard with many client implementations –Used for GRIP (and GRRP currently)

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 New MDS-2.1 Features l Security Mechanisms –GSI mutual-authentication –Fine-grained access control by GSI name l Performance Enhancements –Better query speeds –Less stale information l New Information Model (schema) –Better representation of computers –Cleaner namespace management

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 MDS-2.1 External Software Stack l OpenLDAP 2.0.x (.14) –Implements LDAPv3 protocol –Client and server components l Cyrus-SASL –Generic security –We provide loadable SASL/GSS plugin l Globus GSI –Provides GSS-API interface to PKI –Shared library used by our SASL plugin

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 MDS 2.1 Security l PKI authentication l Static authorization –Class, attribute, object name rules l “Self” authorization –Semi-dynamic rule –Requires “owner” attribute on objects l Dynamic authorization –Directory-based group lists (or future CAS) –Per-object access rule attributes –LDAP dynamic authorization (beta?)

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 MDS 2.1 Information Model l Structural information –Resource hierarchy maps to objects –Named positions in LDAP DIT l Merged information –Some parents “join” child data –Simplifies common query patterns l Auxiliary information –Uniform representation of leaf/parent data –Uses LDAP auxiliary objectclasses

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 GRIS Host Objects OS

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 GRIS Object Hierarchy Mds-Host-name=hostname Mds-Software-Deployment=operating system Mds-Device-Group-name=processors Mds-Device-name=cpu 0 Mds-Device-Group-name=memory Mds-Device-name=physical memory Mds-Device-name=virtual memory Mds-Device-Group-name=filesystems Mds-Device-name=/scratch1 Mds-Device-name=/scratch2 Mds-Device-Group-name=networks Mds-Device-name=eth0

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 GRIS Structural Class Hierarchy Mds Attr: Mds-validfrom (like createtime) Attr: Mds-validto (accuracy metadata) Attr: Mds-keepto (discard metadata) MdsHost MdsDevice MdsDeviceGroup MdsSoftwareDeployment l Every MDS object: name, time metadata

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 GRIS Auxiliary Class Examples MdsCpu Attr: Mds-Cpu-vendor Attr: Mds-Cpu-model Attr: Mds-Cpu-speedMHz MdsCpuCache Attr: Mds-Cpu-Cache-L1kB MdsCpuSmp Attr: Mds-Cpu-Smp-size MdsCpuTotal Attr: Mds-Cpu-Total-count l Once per CPU l Once per SMP l Once per MPP

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 GRIS Auxiliary Class Examples MdsCpuFree (once per SMP) Attr: Mds-Cpu-Free-1minX100 Attr: Mds-Cpu-Free-5minX100 Attr: Mds-Cpu-Free-15minX100 MdsCpuTotalFree (once per MPP) Attr: Mds-Cpu-Total-Free-1minX100 Attr: Mds-Cpu -Total-Free-5minX100 Attr: Mds-Cpu -Total-Free-15minX100

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 Client Tools l Globus Toolkit includes 2 command line client tools for querying MDS services –grid-info-search: General purpose client >grid-info-search –h -p -b \ -T [ ] [ ] >-x: Anonymous access –grid-info-host-search: Same as grid-info- search, but defaults to GRIS standard port >E.g. grid-info-host-search –h localhost l Both clients can search for specific system information and filter results.

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 LDAP Client C API l RFC 1823 defines an IETF draft standard C client API for accessing LDAP databases –Connect to server –Pose query which returns data structures contains sets of object classes and attributes –Functions to walk these data structures l Globus Toolkit uses OpenLDAP client library

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 LDAP Client API: Other Languages l Java –JNDI is a standard Java package for accessing LDAP directories –Used by Java CoG l Python –Has libraries that wrap the OpenLDAP client –Used with PyGlobus l Perl –Has modules for LDAP access

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 LDAP exercises l Go to the “ldap” subdirectory l Documentation –RFC 1823: The LDAP Application Programming Interface –Howes and Smith, LDAP: Programming Directory-Enabled Applications with Lightweight Directory Access Protocol, MacMillan 1997 ISBN l Follow instructions in the file README

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 Configuring Servers and Adding Service Provider

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 dc-n1.isi.edu grid-info-site-policy.conf grid-info-resource-register.conf grid-info-resource-ldif.conf dc-n2.isi.edu grid-info-resource-register.conf grid-info-resource-ldif.conf GRIS GIIS GRIS Configuration files for Registration

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 Configuration files for Registration l A resource that is hosting a GIIS –grid-info-site-policy.conf >Determines whether to accept incoming registrations >Accept everything, or only registrations from the resources explicitly defined in this conf file (can use wildcards) l Default policy is to only accept registrations from self, and from port 2135 l In a hierarchical GIIS environment, this file must be modified from the default

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 Default Policy Data: objectclass: MdsRegistrationPolicy policydata: (&(Mds-Service-hn=mako.isi.edu)(Mds-Service-port=2135)) Change ‘policydata’ to this for completely open policy: (Mds-Service-hn=*) Change ‘policydata’ to this to restrict to 2 specific hosts: (&(|(Mds-Service-hn=dc-n2.isi.edu)(Mds-Service-hn=dc- n3.isi.edu))(Mds-Service-port=2135)) grid-info-site-policy.conf

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 Configuration files for Registration l A resource registering GRIS information with a GIIS –grid-info-resource-register.conf >Which GIIS’s this GRIS should register to, and how >GIIS could be on the same machine, but may not be –grid-info-resource-ldif.conf >Determines which GRIS providers are active and available to send data to the GIIS’s that this GRIS is registering with

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 Registering a GRIS with a GIIS l dn: l regtype: mdsreg2 l reghn: l regport: l regperiod: l [service attribute/value]... –where service attribute entries depend on the type of LDAP object being published $GLOBUS_LOCATION/etc/grid-info-resource-register.conf

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 Example GRIS on dc-n2 registers with GIIS on dc-n1 l dn: Mds-Vo-Op-name=register, Mds-Vo-name=site, o=grid l regtype: mdsreg2 l reghn: dc-n1.isi.edu l regport: 2135 l regperiod: 600 l type: ldap l hn: dc-n2.isi.edu l port: 2135 l rootdn: Mds-Vo-name=local, o=grid l ttl: 1200 l timeout: 20 l mode: cachedump l cachettl: 30 $GLOBUS_LOCATION/etc/grid-info-resource-register.conf

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 Registration Control Parameters l regperiod –How often this GRIS will send a message to the GIIS noting its existence l ttl –How long the recieving GIIS should keep the registration information before assuming that the GRIS is no longer available –In general ttl should be: ttl = 2 x (regperiod) l cachettl –Recommendation to the GIIS about how long to maintain in cache, the GRIS information provided by this resource $GLOBUS_LOCATION/etc/grid-info-resource-register.conf

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 MDS-2.1 GRIS Providers grid-info-cpu reports CPU/load info grid-info-fs reports filesystem info grid-info-mem reports RAM/VM info grid-info-net reports NIC/net info grid-info-os reports OS info grid-info-platform reports arch. info grid-info-merged merges all host info* l Extensible for other sources, e.g. GRAM

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 GRIS Dispatch Logic l For each provider: 1.Could search intersect provider? No, then skip. 2.Is provider cache stale? Yes, then refill. 3.Apply search filter to cache data. l Combine all intersecting providers’ results

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 GRIS Response Issues l MDS 2.0 and 2.1 are lazy –Probes are not issued unless queried l Some system probes are slow –“Best” probe may take several seconds l How to avoid stale data? –Clients set time-out per query –GRIS/GIIS define time-out per source –Fresh data found before timeout is returned –Cache fill continues after client time-out

June 1, Globus Toolkit™ Developer Tutorial: MDS GRIS Provider Times OSRH 6.2RH7.1IrixSolaris Platform Os Cpu Mem Fs Net Merge total OLD10.01N/A

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 New Information Providers l Decide what information to publish into MDS l Create a program that implements the IO interface requirements of a GRIS Information Provider l Enable the information provider for an MDS installation

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 New Information Providers l Decide what information to publish into MDS –OID: conflict avoidance >OID Registered with IANA Private Enterprise Numbers l l * Globus OID subspace l * Globus Info Services OID subspace l * MDS OID subspace >ISI will delegate sub-trees of the Globus Info Srvcs OID space l l OR, register your own with IANA –Object Naming: conflict avoidance >ISI will coordinate prefix naming. Request a prefix from: l –Schema >Data Modeling problem >LDAP schema syntax problem >$GLOBUS_LOCATION/etc/grid-info-resource.schema

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 New Information Providers l Create your program –Any language. The only requirements are the I/O interface of your program: >Must be callable by fork and exec from the slapd process l You can pass in arguments to your program >Must return data in LDIF format l Data returned must match the LDAP schema l RFC 2849

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 New Information Providers l Enable your new information provider by adding a configuration block l $GLOBUS_LOCATION/etc/grid-info-resource-ldif.conf –# generate memory info every minute –dn: Mds-Device-Group-name=memory, Mds-Host-hn=mako.isi.edu, Mds-Vo-name=local, o=grid –objectclass: GlobusTop –objectclass: GlobusActiveObject –objectclass: GlobusActiveSearch –type: exec –path: /globus/libexec –base: grid-info-mem-linux –args: -devclassobj -devobjs -dn Mds-Host-hn=mako.isi.edu,Mds-Vo- name=local,o=grid -validto-secs 60 -keepto-secs 60 –cachetime: 60 –timelimit: 10 –sizelimit: 3

June 1, Globus Toolkit™ Developer Tutorial: MDS-2 New Information Providers l dn –Where the object lives in the DIT l These lines must be included: –objectclass: GlobusTop –objectclass: GlobusActiveObject –objectclass: GlobusActiveSearch –type: exec l path –Path to the information provider program l base –Name of the information provider program l args –Arguments to be passed to the information provider program l cachetime –In seconds, how long GRIS will consider the data to not be stale l timelimit –In seconds, how long the GRIS should wait for the information provider to return data before giving up on it l sizelimit –Max number of LDIF objects to be read from the output of the information provider $GLOBUS_LOCATION/etc/grid-info-resource-ldif.conf