1. Virtual Appliances for Scientific Applications Kate Keahey keahey@mcs.anl.gov Argonne National Laboratory University of Chicago

2. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 The Grid Metaphor How do we store energy? How do we charge for energy? How do we reliably deliver energy? What happens if a power station fails? How do we ensure quality of service? What elements make for a safe and efficient power Grid? How do we make sure that supply meets demand?

3. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 Computational Grids How do we store computing? How do we charge for computing? How do we reliably deliver cycles? What happens if a power station fails? How do we ensure quality of service? What elements make for a safe and efficient power Grid? How do we make sure that supply meets demand? What is the unit of resource usage? How can we manage different computing environments? How can we ensure that disk, CPUs, network are all available? How can we negotiate for computation? NCSA ANLCaltech SDSC Tera Grid Grid Middleware How can we use Grid resources as easily and intuitively as we use electrical power today?

4. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 Provisioning Critical Resources

5. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 Quality of Service l Issues of control u Trust management u Dynamic relationships l Protocols to negotiate SLA-based relationships l Enforcement tools l What worked u Coarse-grained sharing for relatively tight-knit communities with strong incentives to collaborate u Non-critical needs u Informal relationships l What proved difficult: u Formal sharing for loosely knit communities

6. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 Quality of Life l Lots of heterogeneous resources, none of them good for my application l Consistent environment l Short-term leasing u Changing configuration quickly, quick turnaround l Some examples: u Support for legacy physics applications u Unusual platforms needed by ornitologists u Climate scientists need very consistent configurations l What worked u Access to resources with standardized configuration u Tightly-knit communities u Everything else proved difficult

7. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 Workspaces for Grid Computing l Virtual Workspace u Environment definition u Resource allocation l The GT4 Virtual Workspace Service (VWS) u allows an authorized client to deploy and manage workspaces on-demand. u GT4 WSRF-based protocol set, leverages multiple GT services u Multiple back-ends possible, currently using Xen u http://workspace.globus.org Paper: Virtual Workspaces: Achieving Quality of Service and Quality of Life in the Grid, Scientific Programming Journal

8. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 Workspace Service Pool node Trusted Computing Base (TCB) Image Node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node The workspace service has a WSRF frontend that allows users to deploy and manage virtual workspaces The VWS manages a set of nodes inside the TCB (typically a cluster). This is called the node pool. Each node must have a VMM (Xen) installed, along with the workspace backend (software that manages individual nodes) VM images are staged to a designated image node inside the TCB VWS Node VWS Service

9. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 Image Node Deploying Workspaces Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Workspace Deployment Request -Workspace metadata -Describes the workspace -Contextualization information (IP, security,partitions,etc.) -Resource Allocation -Specifies availability, CPU%, disk, memory, nodes, etc. VWS Service

10. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 Image Node Interacting with Workspaces Pool node Trusted Computing Base (TCB) Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node The workspace service publishes information on each workspace as standard WSRF Resource Properties. Users can query those properties to find out information about their workspace (e.g. what IP the workspace was bound to) as well as manage the resources a workspace was assigned Users can interact directly with their workspaces the same way the would with a physical machine. VWS Service

11. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 The Case of OSG Edge Services

12. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 OSG Edge Services l Requirements: u Edge Services are VO-specific u Resource usage negotiation and enforcement l Features: u IP addresses Management u Host certificates for Edge Services, naming issues u Resource allocation (re)negotiation u Integration into the local infrastructure l Challenges: u Image configuration and maintenance u Fine-grain resource usage enforcement u Running out of public IPs… Paper: Division of Labor: Tools for Growth and Scalability of Grids, ICSOC 2006

13. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 The Case of the OSG Virtual Cluster Image Node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node Pool node VWS Service

14. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 OSG Virtual Cluster l Requirements: u Leasing/Glide-ins: resource allocation for VO-specific computation l Short execution time, workflows u Scientific gateways l Features: u Describing and managing aggregate workspaces u Application-specific configuration on the fly l Challenges: u Integration with local scheduling infrastructure Paper: Virtual Clusters for Grid Communities, CCGrid 2006 (TR2005)

15. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 no STAR The Case of the STAR Application no STAR STAR VWS GRAM STAR GRAM

16. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 STAR Application l Requirements: u Hard-to-install legacy applications u Consistent environment requirements l Features: u Image size (6-10 GB), 8 min deployment time u Image Caching l Challenges: u Integration with local scheduling infrastructure Presentation: Virtual Workspace Appliances, SC06

17. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 The Case of the Alice Application l Requirements: u Pull-based computing model l Features: u Partition management l Blank partitions l Partition sharing between workspaces u Capability maching l Workspace descriptions l Factory pre-reqisites l Ongoing effort

18. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 Moving Forward l Deployment: a chicken and egg problem u The Chicken: overcoming Xenophobia l Hypervisor installations are invasive l Security: the cure or the disease? l Infrastructure: scheduling, etc. l Incentives u The Egg: users l Where do I get an image from? l VO administrators l How do we describe, identify, query for images? l Integrated vision of knitting multiple resources together

19. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 Overall Approach Appliance Producer Appliance Deployment build an appliance update an appliance manage appliance deployment Appliance Management AA

20. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 Deployment (1) l Matching Appliances to Resources u Appliance meta-data l VM image? l What VMM, architecture, etc. u Resource characteristics l What kind of appliances am I willing to deploy? l Workspace Service u Workspace meta-data u VWS Factory pre-conditions

21. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 Deployment (2) l Establishing trust in an appliance u Assert appliance properties, sign them to the image l Direct or indirect assertion u Trust the process, not just the person u Probe appliances Presentation: Making your workspace secure: establishing trust with VMs in the Grid, SC05

22. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 Deployment (3) l Adapting appliances for deployment u IP address delivery u Generating certificates u Making an appliance work within a specific deployment framework (contextualization) l Virtual clusters l Application-level configuration

23. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 Producing Appliances l Configuration for the masses u The profile of an appliance configurer has changed l Building appliances incrementally l Appliance attestation u Functionality testing u Trust the process, not just the person

24. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 Managing Appliances l Security updates u Security RSS Feed l Bugtraq, US-CERT Security Advisories l Will the system still work? u Functionality testing l Component dependencies

25. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 Appliance Layers l Layered Appliance u A set of interdependent layers l Appliance layers u Less data needs to travel u More flexible u Faster deployment u Trust management l Collaborative aspects of configuration System Layer Customization Layer Application Layer VO Layer

26. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 Virtual Organizations myVO.org grid-proxy-init Sharing resources: images, hardware, networks, storage facilities, security context

27. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 Conclusions l We need languages and protocols to describe, discover and name appliances l Growing role of a VO u Configuration management u Virtual networks and namespaces u Beyond a security context l Sustainable deployment model u How does producing, deploying and managing appliances work together?

28. VAs for Scientific ComputingVirtual Appliances Leadership Summit 2007 Credits l Workspace team u Tim Freeman, Borja Sotomayor l Guest appearances u Rick Bradshaw, Predrag Buncic, Narayan Desai, Abhishek Rana, Frank Siebenlist, Doug Olson, Frank Wuerthwein and others.