Automatic Application Deployment in the Cloud: from Practice to Theory and Back

Transcription

1 Automatic Application Deployment in the Cloud: from Practice to Theory and Back Gianluigi Zavattaro University of Bologna - Italy FoCUS research team INRIA - France Based on joint work with: T.A. Lascu, J. Mauro Univ. of Bologna - Italy R. Di Cosmo, S. Zacchiroli, J. Zwolakowski Univ. Paris Diderot - France A. Eiche Mandriva SA - France

2 Cloud applications u Cloud computing offers the possibility to build sophisticated software systems on virtualized infrastructures at a fraction of the time / cost necessary just few years ago u We can give a look at Juju to have an idea of how cloud applications can be easily deployed nowadays

3 Cloud application management is any way a complex task u Even if tool-supported, the cloud application operator must decide: n which software components to select n the overall application architecture n the order of the configuration actions n

4 The challenge u Understand how much of the operator s activities can be automatised: n selection of the software components (selected from appropriate repositories) n synthesis of the overall architecture n planning of the configuration actions to be executed to realize the expected architecture n

5 Our current practical results u Definition of a language for describing component s repositories { "states": [ { "provide": {}, "require": {}, "initial": true, "name": "Installed", "successors": [ "Template" ] }, { "provide": {}, "require": {}, "successors": [ "Configured" ], "name": "Template" }, { "provide": {}, "require": { "@Haproxy/Active/add_database": 1 }, "successors": [ "Active" ], "name": "Configured" }, { "provide": {}, "require": { "@Haproxy/Active/add_database": 1, "@Httpd/Active/start": 1, "@Httpd/Configured/get_document_root": 1 }, "successors": [ "ActiveWithNfs" ], }, "name": "Active" } { "provide": { "@Wordpress/ActiveWithNfs/get_website": 1000 }, "require": { "@Haproxy/Active/add_database": 1, "@Httpd/Active/start": 1, "@Httpd/Configured/get_document_root": 1, "@Nfs_client/Active/mount": 1 }, "name": "ActiveWithNfs" } ], "name": "Wordpress"

6 Our current practical results u Definition of a language for describing component s @Httpd/Configured/get_document_root Configured Template Installed Legend Component State Initial State Require Port Provide Port

7 Our current practical results u Realization of a tool for component s selection and architecture synthesis debian3@aeiche.innovation.mandriva.com @Wordpress/ActiveWithNfs/get_website mbs1@aeiche.innovation.mandriva.com [mbs] mbs0@aeiche.innovation.mandriva.com [mbs] debian1@aeiche.innovation.mandriva.com [debian] mbs3@aeiche.innovation.mandriva.com @Nfs_server/Active/get_dir mbs2@aeiche.innovation.mandriva.com [mbs] debian2@aeiche.innovation.mandriva.com [debian]

8 Our current practical results u Realization of a tool for component s selection and architecture synthesis

9 Our current practical results u Realization of a tool for planning the configuration actions to be executed GALERA-1 WORDPRESS-2 GALERA-3 GALERA-2 WORDPRESS-1 galera-1 (C,Repositories) wordpress-2 (C,Installed) galera-3 (C,Repositories) galera-2 (C,Repositories) wordpress-1 (C,Installed) HTTPD-1 HTTPD-2 galera-1 (Repositories,Installed) wordpress-2 (Installed,Template) httpd-1 (C,Installed) galera-3 (Repositories,Installed) galera-2 (Repositories,Installed) wordpress-1 (Installed,Template) httpd-2 (C,Installed) NFS_SERVER-1 galera-1 (Installed,Configured) wordpress-2 (Template,Configured) httpd-1 (Installed,Configured) galera-3 (Installed,Configured) galera-2 (Installed,Configured) wordpress-1 (Template,Configured) httpd-2 (Installed,Configured) HAPROXY-2 HAPROXY-1 haproxy-2 (C,Installed) galera-1 (Configured,Active) wordpress-2 httpd-1 (Configured,Active) galera-3 (Configured,Active) galera-2 (Configured,Active) haproxy-1 (C,Installed) wordpress-1 httpd-2 (Configured,Active) VARNISH-1 NFS_CLIENT-2 NFS_CLIENT-1 haproxy-2 (Installed,Configured) galera-1 (Active,D) varnish-1 (C,Installed) wordpress-2 (Active,ActiveWithNfs) httpd-1 (Active,D) galera-3 (Active,D) galera-2 (Active,D) haproxy-1 (Installed,Configured) wordpress-1 (Active,ActiveWithNfs) httpd-2 (Active,D) nfs_client-2 (C,Installed) nfs_server-1 (Configured,Active) varnish-1 (Installed,Configured) haproxy-1 (Configured,Active) wordpress-1 (ActiveWithNfs,D) nfs_client-2 (Installed,Active) nfs_server-1 (Active,D) haproxy-2 (Active,D) varnish-1 (Configured,Active.ActiveSysD) haproxy-1 (Active,D) nfs_client-2 (Active,D) varnish-1 (Active.ActiveSysD,Active) varnish-1 (Active,D)

10 Structure of the talk u Formalizing the deployment problem u Decidability/complexity results u Fully automatic deployment (without capacity constraints and conflicts) u Constraints and conflicts strike back u Conclusion and Open issues u Related work

11 Component types u A component has provide and require ports u A component has an internal state machine u Ports are active or inactive according to the current internal state Provide ports Require ports

12 Example: the Wordpress component @Httpd/Configured/get_document_root Legend Template Component Installed wordpress State Initial State Require Port Provide Port

13 Conflicts u Conflicts are expressed as special ports n The apache web server is in conflict with the lighttpd web server

14 Capacity constraints u Provide (resp. require) ports could have an associated upper (resp. lower) bound to the number of connections wordpress 3 mysql 2 wordpress 2 loadbalancer wordpress mysql varnish mysql

15 Configurations u Component instances, with a current build. In the kerberos case, krb5 is built in the first stage state, missing and out the complementary generation of the krb5-ldapprovide/require package. Then ports openldap connected can be built directly by bindings into its normal build satisfying ing between the tified by id 1 and tified by id 2 ; tate of the commore than one ponents. For inonfiguration dete the resources apache2, a), and three new comy. All these new e initial state for mponents can be ge(a, uninst, inst) int, to be able n Example: build into its Kerberos normal stage. This with process ldap wouldsupport be modeled in Aeolus as depicted in Fig. 2. Debian (example of circular dependency) the mysql inst its dependencies. Once openldap is built, krb5 can also be

16 Configurations u Component instances, with a current state, and complementary provide/require ports connected by bindings 2 mysql loadbalancer varnish 2 wordpress wordpress wordpress wordpress 3 mysql 3 mysql 2 mysql 2 mysql mysql wordpress mysql mysql

17 Formalizing the deployment problem

20 Deployment problem u Input: n A set of component types (called Universe) n One target component type-state pair u Output: n Yes, if there exists a deployment plan n No, otherwise Deployment plan: a sequence of actions leading to a final configuration containing at least one component of the given target type, in the given target state

21 een the id 1 and id 2 ; the comhan one. For intion deesources,a), and ew comese new l state for ts can be inst, inst) be able ysql inst Deployment problem: example build. In the kerberos case, krb5 is built in the first stage u missing Consider out the the generation problem of the krb5-ldap of installing package. Then openldap kerberos can bewith built directly ldap intosupport its normal build in satisfying Debian its dependencies. Once openldap is built, krb5 can also be build into its normal stage. This process would be modeled in Aeolus as depicted in Fig. 2. n Universe: packages krb5 and openldap n Target: krb5 in normal state

22 een the id 1 and id 2 ; the comhan one. For intion deesources,a), and ew comese new l state for ts can be inst, inst) be able ysql inst Deployment problem: example build. In the kerberos case, krb5 is built in the first stage missing out the generation of the krb5-ldap package. Then new(k:krb5),new(o:openldap), openldap can be built directly into its normal build satisfying statechange(k,uninst,stage1), its dependencies. Once openldap is built, krb5 can also be bind(libkrb5-dev,o,k),statechange(o,uninst,normal), build into its normal stage. This process would be modeled bind(libldap2-dev,k,o), Aeolus as depicted Fig. 2. statechange(k,stage1,normal) u Deployment plan: k o

24 Summary of decidability/complexity results Component model Deployment is Full component model Undecidable [SEFM12] No capacity constraints Ackermann-hard [ICALP13,I&C14] No capacity constraints, No conflicts Quadratic [SEFM12]

25 Quadratic algorithm without constraints and conflicts [SEFM12] u Forward reachability algorithm n all reachable states computed by saturation Algorithm 1 Checking achievability in the Aeolus model function Achievability(U, T, q) absconf := { T, T.init T U} provport := T,q absconf {dom(t.p(q ))} repeat new := { T,q T,q absconf, (q,q ) T.trans}\absConf newport := T,q new {dom(t.p(q ))} while T,q new. dom(t.r(q )) provport newport do new := new \{ T,q } newport := T,q new {dom(t.p(q ))} end while absconf := absconf new provport := provport newport until new = if T,q absconf then return true else return false end if end function

26 issing out the generation of the krb5-ldap package. Then penldap Example: can be built directly into its normal build satisfying ts dependencies. Once openldap is built, krb5 can also be uild into its normal stage. This process would be modeled in eolus as depicted in Fig. 2. the kerberos case-study a pyramid of levels of component-states having arrows or arcs between two consecutive levels as the one in Fig. 3. Initial states New states ig. 2: Representation of the krb5 and openldap components. All reachable. Reachability analysis The first step in the proposed technique checks if the the esired states target state can be reached. To do so all reachable tates are computed, for each of the component types in the iven universe. In the following we use the pair T,q to enote a Automatic component Application type Deployment T and one in the ofcloud its state q. An increasing sequence of sets of component-state pairs

27 Lesson learned from the foundational study Deployment can be reasonably fully automatised if we do not consider capacity constraints and conflicts

29 Fully automated deployment (no capacity, no conflicts) [ICTAI13] or. 3. u Use the graph of the reachability algorithm bottom-up from the target state n select the bindings (red arrows) n select the predecessors (black arrows) (a) ple. (b)

30 we at es he m ate in he Fully automated deployment (no capacity, no conflicts) (a) replacing z,x,y with z,x,y where z,x,y is a delete action or it is the the first statechange reaching a state y that does not provide r. After applying these relaxations we obtain the final version of abstract plan that, for the kerberos case, is the one depicted in Fig. 6. (b) Time g. 4: Generation of abstract plan for the kerberos example. te, get component-state pair at the bottom of the pyramid. om to the bottom level we then proceed upward selecting the mponents he that are used to deploy the selected componentte pairs at the lower level. To do so, for every selected on mponent at level i + 1, we select at level i one of its edecessors (i.e. a component-state pair connected via the Fig. Automatic 6: Abstract Application plan Deployment for the kerberos in the Cloud example after relaxation. arrow) or a copy (i.e. a component-state pair connected [ICTAI13] u Generate an abstract plan (one component for each maximal path) Arrows represent a precedence relation: blue: start requirement red: end requirement

31 Fully automated deployment we at es he m ate in he te, to he on en (no capacity, no conflicts) u Plan as a topological visit until target: new(k:krb5),new(o:openldap), statechange(k,uninst,stage1), bind(libkrb5-dev,o,k),statechange(o,uninst,normal), bind(libldap2-dev,k,o), statechange(k,stage1,normal) replacing z,x,y with z,x,y where z,x,y is a delete action or it is the the first statechange reaching a state y that does not provide r. After applying these relaxations we obtain the final version of abstract plan that, for the kerberos case, is the one depicted in Fig. 6. Time [ICTAI13] Arrows represent a precedence relation: blue: start requirement red: end requirement Fig. Automatic 6: Abstract Application plan Deployment for the kerberos in the Cloud example after relaxation.

32 Fully automated deployment (no capacity, no conflicts) [ICTAI13] u Problem: cycles could forbid the topological visit u Example: krb5 in normal requires an openldap in uninst state

33 Fully automated deployment (no capacity, no conflicts) kerberos example in which the component type krb5 in normal state requires not only one openldap in normal state, but also one in uninst state. In thisu case The the target abstract plan state will be as in Fig. 7 (note the addition of the pair of arcs labeled with cannot be visited! uninst). [ICTAI13] Fig. 7: Abstract plan for the modified kerberos example. th d n 9 th im th o n in f F h th n w

34 this is not possible because in the same phase of the plan the instance is required to change its internal state. This problem can be solved by means of instance duplication: an additional component instance is deployed in such a way that the new instance can continue providing the required interface during Fully automated deployment (no capacity, no conflicts) that specific phase of the plan. The application of instance duplication to the abstract plan in Fig. 7 is reported in Fig. 8, where we add a new instance y of type openldap that does not proceed further than state uninst. This new resource is used to satisfy the requirement uninst of z. Notice that the topological visit until the target node z, stage1, normal becomes now possible. [ICTAI13] u Solution: component duplication Fig. 8: Abstract plan in Fig. 7 after duplication of instance w. reachability dependencie nodes at a lo In the con very importa developing l change and, Since 1998, defined for in order to a This languag Our tool to validate o do so we ha problem int into one PD to state cha only when t required inte unbind actio

36 Capacity constraints and conflicts strike back [ASE14,CONCUR15] u We have investigated the problem of synthesising the final configuration n considering capacity constraints and conflicts but... n abstracting away from the internal configuration automata u Idea for computing the final configuration: n first perform component selection n and then establish the bindings

37 Component selection [CONCUR15] u Component selection is NP-complete but we can use Contraint Solving technology

38 Bindings establishment [CONCUR15] u Bindings decided as solution of a max-flow problem

40 Putting everything together: Aeolus Blender [ICSOC15] u Armonic: library of components u Zephyrus: synthesis of the final architecture u Metis: plan the configuration actions

41 Reconfiguration vs. Deployment u Reconfiguration problem: n same as deployment, but with non empty initial configuration n reconfiguration is already PSpace-complete without capacity constraints and conflicts [MFCS15] u Open issue: n Find further restrictions to the model that make reconfiguration tractable (seems very useful in practice)

42 Other open issues u In real systems there is a flow of configuration data among components: n Room for name-passing models? u Hierarchical modeling (administrative domains, cloud providers, geographical areas, ): n Room for ambient-like models? u QoS and resource consumption: n Room for quantitative models?

44 Related work u TOSCA [OASIS standard 2013] n Language for topologies and deployment plans

45 Related work Figure 6: Life-cycle of a node u CloudMF { "id" : "SensApp", "retrieval" : "wget -P ~ war; wget -P ~ sh ; wget -P ~ sh", "deployment" : "deploysensapp.sh", "start" : "startsensapp.sh", "requires" : [ { "id" : "JettyCapability", "isoptional" : false }, { "id" : "MongoDBCapability", "isoptional" : false } ], "inputs" : [ { "id" : "RESTChannel", "portnumber" : "8080", "isremote" : true } ], "provides" : [ { "id" : "RESTServer", "portnumber" : "8080" } ] } Automatic ] Application Deployment in the Cloud Changing the status of an artefact encompasses adapting all its de pendencies accordingly. The resources that can be associated to a artefact type can be annotated with commands describing how t move from one state to another. [J.Ferry et al. - NordiCloud13] n Similar language for component description ()%*( Listing 4: An example of a node instance from a C "nodeinstances"!"#$#%& : '#"%& [ /"#"*$%&& ] { "id" : "smallgnulinux1",!"#"$%&''() "type" : "SmallGNULinux", "provides" : [ { "id" : "ssh1", } ] #"*$%&&%$#+"-.%#& #"*$%&& /"#"*$%&& "type" : "SSH" } *"$%&''() 1+".#,/)( *$%)$#",-())+) 200,0 An artefact instance represents an instance of a co +,"-#./0() application on a specific virtual machine (e.g., an ())+) Jetty container and 1+".#,/)( of the SENSAPP server deploye machine above). *$+0 *$%)$ Listing 5: 1/""#". Examples of artefact instances fro JSON "artefactinstances" : [ { Figure "id" 7: : "jetty1", Life-cycle of an application

46 } var cpus as 1..4; var memory as int; ject, and is Automatic not shared Application between Deployment different in the instances Cloud of Mawe always wanted ws1 to run on m1 we would al ous work, before discussing the implications and directions for future work. var machine as r abstract class Rol to write: } 2 Modelling with ConfSolve Related work var m0 as Machine; class WebServer ex ConfSolve provides the user with Which an is object-oriented an example of an equality var port constraint. as 0..6 In which m0 is a Machine object declarative in thelanguage, global scope, with with a Java-like Constraints: syntax, which Constraints adheres cpus, to several an integer key subrange; principles: } are expressions whi members os, an enumeration; u ConfSolve [J.A.Hewson, P.Anderson, hold in A.D.Gordon any solution to the - LISA12] model. For example and memory, an unbounded integer. 1. Order never matters. Declaration ducing and a database-server usage can oc- role which can be either Member variables may also declare objects, allowing or master, and must be peered References: with another slave Asso the nesting of child objects within a parent object. For elled using referenc example, we could add a network interface to the machine definition: enum DatabaseRole { Master, Consider Slave an } objects elsewhere i instanc n Object-oriented cur in any orderlanguage with no difference for inservices meaning. and ter, as appropriate: machines 2. Everything is an expression, except declarations. 3. All classes are equal: there are no built-in classes n Type system with special for meanings checking such asconfiguration Machine or File. correctness class Machine { class DatabaseServer extends Variables and Classes: A ConfSolve model consists var ws1 Role as { WebServ... var role as DatabaseRole; of a global scope in which strongly-typed variables, n Constraint solver for var en0 as NetworkInterface; classes, and enumerations may be declared. For example, a simple placement machine may of be defined as: machine was declar In the previous decl } // slave or master automatic var peer as ref DatabaseServer; contains a referenc class NetworkInterface services on machines enum { OperatingSystem { Windows, UNIX, OSX } refer to m0, as it is t var subnet as 0..3; // the peer cannot be itself clared. The solver w } peer!= this; class Machine { a reference to any in var os as OperatingSystem; // a master s peer mustwe bealways a slave, wanted w An instance of NetworkInterface var cpus will as be created 1..4; whenever a Machine is instantiated. varthe memory lifetime as int; of the Net- role!= peer.role; // and a slave s peer must to write: be a master workinterface instance is} tied to that of its parent ob- } ws1.machine = m1; var m0 as Machine; ws1.machine = m1;

47 Related work u Engage [J.Fischer, R.Majumdar, S.Esmaeilsabzali - PLDI12] n Architectural specification in terms of inside / peer / environment relationships n Automata with resource lifecycle and transient dependencies n Assumption on acyclic relationships (to always guarantee topological visit) uninstalled Figure 5 shows the dependencies generated when partial instantiation specification [ active] of Figure 2. We h resource install instances that were start restart present in the specificat inside inside Server running inside server, inside and an instance openmrs for inside RS application running inside tomcat. In particular, the t have to explicitly give JDK the other JRE dependencies on Java MySQL env env peers. The partial installation specification may also define ndividual Tomcat configuration portinside properties. In Open our example, MRS me and os user name properties have been assigned ssigned configuration properties will take the default ed infigure the associated 5:HypergraphforpartialinstallationspecificationinFigure 2 Automatic resource Application types. Deployment in the Cloud figuration engine takes this partial installation. specifiinactive active Lemma uninstall 1. Let R be a stop set of well-formed resourc a partial install specification. [ inactive] Then procedure G creates a directed hypergraph G = (V, E), such th resource Figure 3: instance Resource driver r I, forwehaver Tomcat V, and for instance r V, either CONCUR'15 r I- or there is some res r I that is transitively dependent on the key

48 Mentioned publications u u u u u u u [SEFM12] R. Di Cosmo, S. Zacchiroli, G. Zavattaro. Towards a Formal Component Model for the Cloud. Proc. of SEFM 12: LNCS 7504, Springer. [ICALP13] R. Di Cosmo, J. Mauro, S. Zacchiroli, G. Zavattaro. Component Reconfiguration in the Presence of Conflicts. Proc. of ICALP 13: LNCS 7966, Springer. [ICTAI13] T. A. Lascu, J. Mauro, G. Zavattaro. A Planning Tool Supporting the Deployment of Cloud Applications. Proc. of ICTAI 13: IEEE Press. [I&C14] R. Di Cosmo, J. Mauro, S. Zacchiroli, G. Zavattaro. Aeolus: A component model for the cloud. Information and Computation, 239: (2014). [MFCS15] J. Mauro, G. Zavattaro. On the Complexity of Reconfiguration in Systems with Legacy Components. Proc. of MFCS 15: LNCS 9234, Springer. [ASE14] R. Di Cosmo, M. Lienhardt, R. Treinen, S. Zacchiroli, J. Zwolakowski, A. Eiche, A. Agahi. Automated synthesis and deployment of cloud applications. Proc. of ASE 14: ACM Press. [ICSOC15] R. Di Cosmo, A. Eiche, J. Mauro, S. Zacchiroli, G. Zavattaro, J. Zwolakowski. Automatic Deployment of Services in the Cloud with Aeolus Blender. Proc. of ICSOC 15, to appear, Springer.