HP Server Automation Virtual Appliance (aka SA Standard)

Transcription

1 Technical white paper HP Server Automation Virtual Appliance (aka SA Standard) Secure, simplified, and lower-cost edition of HP Server Automation for small to medium size deployments Table of contents A solution for automated server configuration management... 2 HP Server Automation Virtual Appliance (SAVA) feature overview... 2 Server Automation Virtual Appliance design and architecture overview... 3 Server automation client... 4 OS provisioning and configuration... 4 Patch management... 7 Software management... 9 Audit and compliance management... 9 Virtualization management Global Shell (OGFS) HP Live Network Appliance management and maintenance Summary A lightweight solution for server automation... 12

2 A solution for automated server configuration management HP Server Automation software version 10.0 (HP SA) enables automated server configuration and system management. A key IT automation tool for server administrators, it is offered in two editions: 1. HP Server Automation Enterprise with the complete set of features, full set of managed platform support, and extreme scale known for the product 2. HP Server Automation Virtual Appliance (SAVA) aka HP Server Automation Standard is a single HP Server Automation (SA) core packaged as a virtual machine. This offering completely simplifies the setup required for HP Server Automation and reduces the setup time to under an hour. SAVA is targeted specifically for small to medium size deployments and with SAVA customers will be able to manage the entire lifecycle management of servers for up to 3000 servers. HP Server Automation Standard or SAVA supports a limited set of HP Server Automation Enterprise capabilities. For example, SAVA only supports Windows - and Linux-based operating systems platforms. For more information on SAVAsupported platforms, see the SAVA support matrix. This white paper presents a brief overview of the HP Server Automation Virtual Appliance (SAVA) architecture, and provides a very high level insight into specific features it offers as well as the security and maintenance of the overall virtual appliance itself. HP Server Automation Virtual Appliance (SAVA) feature overview System administrators use SAVA to provision and manage servers through their entire lifecycle. SAVA uses resources such as OS build plans and scripts to run deployment jobs. With SAVA, patch administrators can establish patch polices to install and maintain patches for supported operating systems running on managed servers. With SAVA, compliance managers have visibility across the managed servers to see which servers are out of compliance and can then remediate non-compliant servers to bring them back into compliance, based on policies created within SA. SAVA helps you perform the following system management tasks: Scan your networks for unmanaged servers and deploy SA agents for management Install Windows, Linux, VMware ESXi, and Hyper-V on HP and non-hp servers Update drivers, utilities, and firmware on HP ProLiant servers using the HP Service Packs for ProLiant (SPPs) Configure HP ProLiant system hardware, Integrated Lights-Out (ilos), BIOS, and HP Smart Array Deploy to target servers without using PXE (HP ProLiant Gen8 and later, HP servers only) Apply the required operating system patches for Windows and Linux servers Install and configure software applications using templates called software policies Use out-of-the-box application configuration templates to push configurations to all managed servers Define server configuration policies to help ensure SAVA-managed servers meet corporate defined standards as well as the compliance regulations from industry-standard bodies or government organizations Remediate non-compliant servers to bring them into compliance Get complete visibility of all physical and virtual machine environments (VMware ESXi and Hyper-V) from a single tool Create and manage VM templates for multiple virtualization vendor tools within SAVA Search for VMs based on their genealogy (creation record) and by other virtual characteristics Manage servers remotely for routine maintenance or troubleshooting issues from a single tool using SA Global Shell (OGFS) capability 2

3 Server Automation Virtual Appliance design and architecture overview HP Server Automation Virtual Appliance (SAVA) comes completely preinstalled and pre-configured on a virtual machine (VM) in a CentOS 6 platform and communicating with PostgreSQL 9.0 database in the backend. Figure 1 shows a high level view of the SAVA architecture. SA virtual appliance PostgreSQL Provision Patch NIC Appliance IP address Deployment IP address Browser SA client Target server Model repository Software Audit Deployment interface DHCP server optional Media server optional Media server (OS prov) SA agent Figure 1. SAVA architecture As Figure 1 shows, SAVA requires two IP addresses: Appliance IP address: used to manage the appliance lifecycle and operations, such as patching/upgrading the appliance or embedded SA core, getting support logs Deployment IP address: used by SA users to connect the ngui to the embedded SA core to perform deployment or other SA specific tasks The target server represents a server managed by SAVA. Each managed server runs an SA agent, which is software used to make changes to the server. The SA agent is used for software installation and removal, software and hardware configuration, and server status reporting. The external media server is required for OS provisioning tasks and contains vendor-supplied OS media used during OS provisioning. It may also contain media for other purposes, such as firmware and driver updates, and is also where captured images are stored. The external media server is a separate server from the SAVA appliance and is not included as part of the appliance backup and restore actions. The media for other SA features such as software management, patching, and others is kept inside the appliance itself. The model repository is a SA component that stores critical information about SA and its managed server environment including inventory of all servers under management, inventory of the hardware associated with these servers such as memory, CPUs, storage capacity, and so on, managed server configuration, inventory of the operating systems, system software, and applications installed on managed servers, inventory of OS provisioning operating system installation media (the media itself is stored in the external media server), inventory of software available for installation, and the software policies that control how the software is configured and installed as well as the authentication and security information. The Model Repository in SAVA is actually inside the PostgreSQL 9.0 optimized and embedded within the SAVA appliance itself. Server automation client Also known as SA ngui, the SAVA SA client is a Java-based tool that is installed on a SA user desktop and connects to the SA core within SAVA via the deployment IP address. Figure 2 displays a snapshot of the SA client navigation pane showing the operational tabs for SAVA users to manage their servers, scripts, jobs, and so on. 3

4 Server automation client Also known as SA ngui, the SAVA SA client is a Java-based tool that is installed on a SA user desktop and connects to the SA core within SAVA via the deployment IP address. Figure 2 displays a snapshot of the SA client navigation pane showing the operational tabs for SAVA users to manage their servers, scripts, jobs, and so on. Figure 2. Use the tabs to navigate to each major area of the SA client. Devices tab Shows all your servers and lets you manage them Virtualization tab Shows all your virtualization services, virtual machines, VM templates, and other items, and lets you manage them. Library tab Shows everything needed to manage servers such as patches, patch policies, OS build plans, software policies, software packages, audit policies, and more. Jobs and sessions tab Shows a history of jobs that have run and scheduled jobs waiting to run. Administration tab Lets you set up and manage users and passwords, manage your SA cores, set preferences, and more. OS provisioning and configuration SAVA OS provisioning provides the ability to provision operating system baselines onto bare metal and virtual servers quickly, consistently, and with minimal manual intervention. SAVA automates the entire process of provisioning a comprehensive server baseline, which typically consists of the following tasks: Creating OS build plans that define a server build policy, including software policies, patch policies, device groups, and remediation policies Installing a base operating system and default OS configuration using an OS build plan Applying the latest set of OS patches; the exact list depends on the applications running on the server Installing widely shared system software such as Java Virtual Machines Executing pre-installation or post-installation scripts that configure the system with values such as a root password SAVA OS provisioning also integrates with your operating system vendors native installation technologies, specifically: WinPE and Windows setup answer files: unattend.txt, unattend.xml. Red Hat/VMware Kickstart SuSE YaST (Yet another Setup Tool) 4

5 OS build plans An OS build plan is a sequence of steps that execute in a specific order to perform a task on a target server. OS build plan steps are autonomous operations, such as run script, install package(s),, attach patch or software policies, and run remediation. OS build plans are typically used for provisioning operating systems, but can be used for almost any automated task. OS build plans use the software on the media server to provision managed servers. Creating and editing OS build plans SAVA provides a set of baseline OS build plans that you copy and use to base your build plans on. Each build plan is provided with detailed usage instructions. These baseline OS build plans have been tested for their specified platform and are known to work. You simply need to make a copy of a build plan for the appropriate platform and modify it for your specific environment (modifications include: location of the media server, required scripts, required reboots, etc.). New OS build plans/os build plan updates On occasion, HP releases new baseline OS build plans or updates to existing OS build plans. You will be required to download these build plans from the HP Live Network and install them by running an APX from SA client. Installation instructions and detailed descriptions for each baseline OS build plan are included with the download. Types of OS build plans SAVA also provides a master list of OS build plans addressing these tasks: Wait in service OS Reboot the server into the service OS Off-line firmware update Boot the server into the service OS, update the firmware, and reboot the server Hardware for system ROM data configuration Either capture and save the current BIOS configuration, or update it using a previously saved configuration Hardware for Smart Array data configuration Either capture and save the current Smart Array configuration, or update it using a previously saved configuration Hardware for ilo data configuration Either capture and save the current ilo configuration or deploy a setting update OS deployment via scripted install Scripted OS install using OS answer file Windows Server 2008 SP2 x64 Standard edition other Windows editions are supported as well Windows Server 2008 R2 SP1 x64 Standard edition other Windows editions are supported as well Windows Server 2012 x64 Standard edition other Windows editions are supported as well Red Hat 6.3 x64 Red Hat 5.9 x64 SLES 11 SP2 x64 VMware ESXi 5.0 U1 VMware ESXi 5.1 Windows Server OS deployment through image install You can either capture a golden OS image of a Windows install or deploy a previously captured image Windows Server 2008 SP2 x64 Standard edition Windows Server 2008 R2 SP1 x64 Standard edition Windows Server 2012 x64 Standard edition Install Windows SPP on production server Online update of the SPP components on the production OS, including firmware, drivers, and agents Install Linux SPP on production server Online update of the SPP components on the production OS, including firmware, drivers, and agents 5

6 Custom attributes A custom attribute is a simple name/value pair that is used as a form of variable substitution in scripts and other provisioning functions. When referenced, the custom attribute name is replaced by the value of that custom attribute. Custom attributes do not stand alone. They are always associated with an object in the management database, such as servers, facility, or OS build plans. Custom attributes can be inherited from a containing object. For example, a server will inherit the custom attributes inherited from the facility. Custom attributes substitute specific values into scripts, configuration files, and package paths when an OS build plan is run. This is useful for configuring installation processes, including network and server configuration. Custom attributes are typically used for overriding default values. Custom attributes may be defined for a specific build plan using the UI. Facility-level custom attributes may be viewed from the settings screen in the UI. You can find more information about OS build plans and associated software components in SAVA online help. Scripts You use scripts in SAVA to accomplish provisioning tasks. Run a script by inserting it as a step in an OS build plan. You can run multiple scripts as a series of steps within a build plan. SAVA supports a variety of script types: UNIX Bourne shell (sh), C shell (csh), and KornShell (ksh) Opsware Global File System (OGFS). OGFS scripts run on the appliance but can access files on the managed servers as well as run commands there. Windows.BAT Windows batch file Windows VBScript Visual Basic scripting Python Python programming language Configuration files Configuration files are the generic term for Windows and Linux data files used during provisioning tasks. These include the following file types: Hardware configuration files. These files are used during hardware provisioning for such tasks as BIOS configuration and Smart Array configuration. OS answer files. These files provide all the information required to install the OS. Configuration files operate without user intervention. Customers may create new configuration files for their own purposes. These can include: Additional configuration files for Windows 2008 editions besides Standard Additional configuration files for Windows 2008 R2 editions besides Standard Additional configuration files for Windows 2012 editions besides Standard Packages Configured as a.zip file, packages are compressed bundles of files. You can use packages to place files on a target server during deployment. OS build plan steps are used to deploy packages to a target server. When the packages are placed on the target server by Insight Control server provisioning, they are decompressed (unzipped) at the location specified in the build plan step. You can also specify which scripts should run before decompression takes place, and which scripts should run afterward. 6

7 Patch management In SAVA, patch management enables you to identify, install, and remove Microsoft Windows and Linux (see support matrix for full list of platforms supported) patches, and maintain a high level of security across managed servers in your organization. SAVA automates the key aspects of patch management, while offering a fine degree of control over how and under what conditions patches are installed. By automating the patching process, patch management can reduce the amount of downtime required for patching. SAVA also allows you to schedule patch activity, so that patching occurs during off-peak hours. SAVA automates patching by providing the following features and capabilities: A central repository where patches are stored and organized in their native formats A database that stores information about every patch that has been applied Customized scripts that can be run before and after a patch is installed Advanced search abilities that identify servers that require patching Auditing abilities for tracking the deployment of important patches These features and capabilities enable you to browse patches by a certain operating system, schedule patch downloads and installations, set up notifications, preview a patch installation, use policies and remediation to install patches, and export patch information to a reusable file format. 7

8 Importing patches into SAVA You can import the Microsoft patches into SAVA by using the SA client as follows: 1. Navigate to the Administration -> Patch Settings. 2. Select Patch Products from the list of Windows Patch Download settings. 3. Click Edit to open the Edit Patch Products window. Available products are on the left and selected products are on the right. Note: When you use SAVA for the first time, the initial set of selected products in the left panel might be empty and have to be populated from the Microsoft website, which can be done by clicking on Update action button ->Update Products from Vendor (Microsoft s default URL for the patch database will be populated). 4. After the list is updated, modify the selected products list as needed for your environment and click Ok to save selection. Warning: Patch sizes can be large and will take up valuable space on the appliance only choose the products that need to be patched. Figure 3. To import Red Hat Package Managers (RPMs) from the Red Hat website directly, run the SAVA Web Utilities Launcher and select the Import Red Hat option. To verify that your patches were imported, select the Library tag in the SA client. Scan and remediate servers After importing all the patches for all the desired Windows products, attach vendor recommended patch policies (VRPPs) to your Windows servers and scan the required Windows servers for patch compliance against the attached VRPP. Once the scan is complete, remediate the recommended patches on the non-compliant servers to bring them into compliance. 8

9 Software management SAVA enables you to govern the full spectrum of your software management requirements. With SA policy-based software management you can automate software installation and application configuration, and verify that managed servers are compliant with software policies. Figure 4. The software management process within SAVA. Step 1 Set up the SA library: Step 2 Create a software policy: specify software packages, patches, and application configurations in a software policy. Step 3 Attach the policy: attach the software policy to managed servers or device groups. Step 4 Remediate the servers: Step 5 Run compliance scans: import software packages and patches into the SA library and create application configurations. remediate attached servers against the software policy to install the software and apply the application configuration. run compliance scans to ensure that managed servers maintain compliance. Software policies A software policy is an ordered list of packages, script, application configurations, and other items. A software policy is essentially a recipe for installing, uninstalling, and configuring one of more pieces of software on a single server. SAVA software policies enable automation of software installation and application configuration. If a policy is changed after it has been deployed, the managed servers can be scanned and remediated to verify that they maintain compliance with the policy. Additionally in SAVA, software policies also serve as the mechanism to deliver RPMs or Linux patches for supported Linux platforms. Software policy compliance scan and remediation To scan a set of managed server(s) for software policy compliance users should use the SA client and select the server/ set of servers and go to Menu->Actions->Scan->Software compliance. The results of this scan show the servers that are in compliance and the servers that are out of compliance and specify the software policies that need to be synchronized. Users can then remediate non-compliant servers against the specified software policy to bring the servers back into compliance. Audit and compliance management In SAVA, the audit and compliance management feature allows you to identify which objects you want checked, where you want to check for them, and when you want to check them in your IT environment. Using the audit and remediation capabilities, SAVA helps you to ensure that servers in your facilities meet policy standards. When servers are found to be out of compliance not configured the way you want them to be you can remediate them to comply with your organization s standards. 9

10 Audits An audit defines a set of rules or configuration values that determine whether the configuration of a managed server or group of managed servers match your organization s compliance standards. Audit rules can be configured in an ad hoc manner or, more effectively, reference a predefined audit policy that specifically defines the required configuration for a managed server in SAVA. Some audit rules also allow you to run scripts that capture more detailed configuration information. Audit policies An audit policy is a collection of reusable rules that define the desired state of server configuration, based on industry standards and the compliance goals set by your organization. An audit policy can be linked to audits, snapshot specifications, and other audit policies. When changes are made to an audit policy, all references to that audit policy are also updated. An audit policy is typically created by a policy setter who understands the compliance standards that a company requires its servers to meet for a specific configuration domain and operating system. Administrators who manage servers can use predefined audit policies by linking them to their audits or snapshot specifications. This is very critical to organizational security as it helps in separation of roles/duties between policy setters and enforcers. Using the SA client, you can audit server configuration values based on a live server or a server snapshot, based on your own custom values, or based on pre-configured audit policies. You can also take server configuration snapshots to capture the current state of a system, so that you can compare other servers against a known baseline. BSA Essentials compliance subscription service With BSA Essentials Subscription Service, you can be kept up to date on the latest industry compliance standard, based on the needs of your data center. BSA Essentials subscription services give you access to regularly updated security best practices and compliance content, such as the Center for Internet Security (CIS), Payment Card Industry (PCI), and so on. It also enables access to additional free non-subscription content such as Microsoft Patch Supplement for SAVA. BSA Essentials subscription services enable you to access the most current regulatory compliance policies, such as Federal Information Security Management Act (FISMA), Sarbanes-Oxley, and daily vulnerability alerts. SAVA uses HP Live Network connector to download the compliance content available on the BSA Essential Subscription service content stream. For information about subscribing to BSA Essentials Subscription Services, contact your HP Software sales representative. Virtualization management In SAVA, virtualization management feature provides: Visibility into entire data center (P+V) SAVA provides full visibility into your hybrid, heterogeneous, distributed data centers providing you with: Genealogy of VMs SA records how each VM was created and displays it in the virtualization view of the SA client. You can also perform searches on how VMs were created. Search for VMs by Virtual Characteristics Advanced search allows you to locate VMs, VM templates, hypervisors, clusters, resource pools, and data centers by cluster properties, resource pool properties, number of processors, datastore, hypervisor, memory creation method, power state, and many other criteria. See All Virtual Assets SA provides comprehensive details about all your virtual assets data centers, resource pools, clusters, hypervisors, virtual machines, folders, datastores, and network elements. You can see and manage all your hypervisors and VMs. Full end-to-end lifecycle and policy management for VMs and VM templates SAVA provides you with the ability to create and manage VMs and VM templates. By setting up a well-defined process of deploying, managing, and deleting VMs and VM templates you can control VM sprawl and VM compliance drift. SAVA helps significantly in managing this process by bringing SA s policy management capabilities to VM templates from any stage of its lifecycle, for example, if you already have VM templates, SA can attach ongoing patch policies to this template, so that any VMs created from this template automatically derives the SA policies that were set on the templates. For more information on SA s Virtualization Management capabilities, refer to SA Virtualization white paper. 10

11 Global Shell (OGFS) The Global Shell is a command-line interface to the Global File System (OGFS). The command-line interface is a UNIX shell such as bash that runs in a terminal window. The OGFS unifies the SA data model and the contents of managed servers, including files, into a single, virtual file system. SA users can open a Global Shell session from within the SA client. The OGFS represents the SA data model as a hierarchical structure of file directories and text files. For example, in the OGFS, the /opsw/customer directory contains details about SA customers and the /opsw/server directory has information about managed servers. The /opsw/server directory also contains subdirectories that reflect the contents (such as file systems and registries) of the managed servers. If you have the required permissions, in the Global Shell, you can view and even modify the file systems of managed servers. By accessing the global view of the OGFS, system administration scripts can run iteratively on groups of servers. HP Live Network In SAVA, most of the content for OS build plans, Microsoft patch supplements, managed platform updates, and BSA Essentials subscription service (this is for customers who purchase the BSA Essentials subscription service) will be downloaded to the appliance from HP Live Network using the HP Live Network connector. Figure 5 illustrates the content consumption model within SAVA. Figure 5. HP Live Network connector can be configured by users using the SA client by launching the SAVA Web Utilities Launcher and selecting the HP Live Network Connect execute option. SAVA content OSBP, Patch and BSA Essentials subscription service HP live network SA virtual appliance PostgreSQL Model repository Provision Software Patch Audit DHCP server optional Media server optional 11

12 Appliance management and maintenance SAVA provides a set of services to easily maintain and support the appliance. The appliance management interface is actually based on HTML 5 and can be accessed using supported browsers: Windows Internet Explorer version 8 or later Mozilla Firefox latest version Users can point their browsers to the appliance IP address and be able to perform the following actions. Appliance updates and SA core patches Users should go to Settings->Actions->Update Appliance to update the appliance with patches or SAVA core patches. These patches are available on HP Software Support Online (SSO portal) at Appliance support You will need VMware ESXi version 5.0, 5.0 UI, or 5.1 and your host computer must have the ability to run 64 bit guest VMs on the ESXi host. You must install VMware vsphere client with VMware tools. The VM hosting hardware requirements include: At least four cores to accommodate the VM At least 16 GB of memory allocated for the VM Around 500 GB of disk space allocated for the VM One network adapter (after you configure your appliance, the appliance network interface must be able to access the network the target servers are on) A separate media server Two IP addresses allocated to the appliance that must be on the same subnet and be static IP addresses Note: If you host multiple appliances or other VMs on the same host, the requirements must scale appropriately. Appliance security SAVA is delivered as a security-hardened virtual appliance. The number of open ports and protocols supported has been limited to the minimum necessary for operation. Summary A lightweight solution for server automation HP Server Automation Virtual Appliance (SAVA) aka HP Server Automation Standard is a simplified and lighter version of the HP Server Automation product that simplifies the setup and reduces the time associated to manage the physical and virtual servers in your data center throughout their lifecycle. Sign up for updates hp.com/go/getupdated Share with colleagues Rate this document Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. Java is a registered trademark of Oracle Corporation and/or its affiliates. Microsoft, Windows, Internet Explorer, and Hyper-V are U.S. registered trademarks of Microsoft Corporation. UNIX is a registered trademark of The Open Group. 4AA4-6397ENW, May 2013