Intel Cloud Builders Guide to Cloud Design and Deployment on Intel Platforms

Transcription

1 Intel Cloud Builders Guide Intel Xeon Processor-based Servers VCE* Vblock* Infrastructure-as-a-Service Intel Cloud Builders Guide to Cloud Design and Deployment on Intel Platforms VCE* Vblock* Infrastructure-as-a-Service Intel Xeon Processor 5600 Series AUDIENCE AND PURPOSE Many IT organizations have come to appreciate the cost savings and operational efficiencies of a private cloud model for delivery of infrastructure-as-a-service (IaaS). The private cloud infrastructure available from VCE* Vblock* Systems delivers pervasive virtualization in a single, integrated system that combines compute, network, storage, virtualization, and management capabilities. IaaS is a growing category of cloud services. Not all cloud infrastructures are the same. The integration of compute, network, storage, virtualization and management components into a converged infrastructure such as Vblock Systems is unique. Most other private cloud reference architecture platforms require the complex and problematic integration of these components. This white paper includes an overview of the Vblock Systems architecture. The paper also differentiates Vblock Systems from other private cloud infrastructures that require the complex and problematic integration of separate components from different vendors. Included is a description of IaaS setup, discovery, provisioning, operations, maintenance, and de-provisioning through a single, intuitive, easy-to-use user interface using management and orchestration products from EMC, Cisco, and VMware. Many other such tools exist and this paper does not represent an endorsement by VCE of any one approach above others. This paper is written for the reader with a basic knowledge of cloud compute, networking, storage, and management infrastructure components and services. It is geared to prospective customers interested in IaaS who will benefit from understanding the value of a fully integrated and fully virtualized cloud infrastructure system. June 2012

2 Intel Cloud Builders Guide: Intel VCE* Vblock* Infrastructure-as-a-Service Table of Contents Executive Summary...4 Vblock Systems...4 Vblock Series Vblock Series Base Configurations and Scaling...6 Vblock Platform Design Principles...7 Connectivity Overview...7 Compute Layer Overview...7 Network Layer Overview...7 Storage Layer Overview...7 Management Framework...7 Advanced Management Pod (AMP)...7 Expanding Vblock Systems...7 Comparing Vblock Systems to other Cloud Infrastructures...8 Provisioning IaaS with Vblock Systems...9 VMware vcloud Director...9 Cisco Intelligent Automation for Cloud...9 Cisco Process Orchestrator...9 Cisco Cloud Portal...10 Additional Software Components...10 Management and Orchestration with CAIC, CCP, UIM, and vcd...10 Create Service Definition...10 Define Service Request...10 Define Fulfillment Process...11 Publish Service...11 Design Considerations...11 Integration Considerations...11 Validate the Service Environment...11 Service Catalog User Roles and Profiles in the CIAC Suite...11 Best Practices for IaaS Use Cases with the CIAC Suite...11 Use Case: New Tenant Onboarding...13 Use Case: New Tenant User Onboarding...15 Use Case: Order and Deploy a Virtual Application (vapp)...17 Use Case: Decommission vapp...19 Use Case: Remove Tenant...21 Maintaining a Carrier Class Cloud Infrastructure...23 Self Service and Automation...23 Capacity Planning

3 Intel Cloud Builders Guide: VCE* Vblock* Infrastructure-as-a-Service Security and Compliance...23 Availability and Continuity...24 Management and Orchestration...24 Conclusion...25 About VCE

4 Intel Cloud Builders Guide: Intel VCE* Vblock* Infrastructure-as-a-Service Executive Summary The potential of cloud computing to transform the competitive nature of business will make it the largest IT megatrend of this decade. Central to cloud computing include concepts such as ondemand, self-service access to an elastic pool of flexibly provisioned resources with measured service. From a customer perspective, cloud is built differently. The objective is to create dynamic pools of virtualized resources. It is also operated differently, with lowtouch and zero-touch models achieved through automation. Cloud is also consumed differently, through convenient and expedient models, sometimes on a pay-as-you-go basis. Cloud computing as a foundational element within IT can make companies, agencies, and organizations more nimble and competitive by boosting productivity. Cloud computing also promises to simplify IT operations, reduce costs, and increase the speed and effectiveness with which organizations can do business and accomplish mission-critical objectives. One variety of cloud service, Infrastructure as a Service (IaaS), involves the rental of processing, storage, networks, and other computing resources to enable the customer to deploy and run software, including operating systems and applications, as part of testing, disaster recovery, quality assurance, virtual desktop infrastructure, and other projects. The customer does not manage or control the underlying cloud infrastructure but does have control over operating systems, storage, deployed applications, and networking components such as firewalls and load balancers. End users for this service are often IT departments. According to a 2011 research report by Gartner, IaaS offerings generated US $4 billion in global revenues in 2010 and are forecast to grow to $10.5 billion in Other research has forecast even higher and faster growth. Consolidation and virtualization of pooled data center compute, network, and storage resources is the basis of cloud computing. Often the technologies and resources that make cloud offerings like IaaS possible, however, present a reference architecture and a myriad of different vendor products that must be integrated and managed. To deliver the full potential of cloud computing, the infrastructure needs to be built differently from traditional IT methods. This leads to an entirely different approach of productizing IT infrastructure into complete, unified systems that are highly standardized and highly automated with flexible balancing of compute performance, networking bandwidth, storage capacity, and performance. VCE incorporates leading technologies from Cisco, EMC, and VMware into a single, integrated and pre-configured converged infrastructure platform with end-to-end support. A combination of component level automation, advanced features, intentionally aligned and interlocked roadmaps, plus innovative system integration and management technology enables Vblock Systems to be uniquely positioned against competitive alternatives. Once deployed, the pre-integrated nature of Vblock Systems makes them perhaps the easiest platform on which customers can implement a self-service portal to allow their user base to choose exactly what IaaS services and resources they require. What follows is an overview of Vblock Systems, a comparison of Vblock Systems to other cloud-based infrastructures, and a description of a sample set of use cases showing how IaaS services can be provisioned on Vblock Systems through the lifecycle of setup, discovery, provisioning, operating, maintaining, and de-provisioning. Vblock Systems Vblock Systems by VCE are enterpriseand service provider-class IT infrastructures built using industryleading technology by Cisco, EMC, and VMware. The platforms are preengineered, pre-validated, and pre-tested units that streamline IT infrastructure acquisition, deployment, and operations. By standardizing IT building blocks, VCE can dramatically simplify IT operations accelerating IT deployment while reducing costs and improving service levels for all workloads, including the most demanding and mission-critical enterprise applications. Customers who previously spent 70 percent or more of their IT budgets and staff time on maintaining infrastructure can focus on more strategic efforts that add value to the business or mission. Strict design control enables Vblock Systems to meet specific performance and availability levels while maintaining a balanced, optimized, and easily managed converged infrastructure. The Vblock Series 700 is an enterpriseclass, mission-critical system that incorporates the industry s best directorclass, high-density fabric switch; most advanced and uniquely integrated fabric-based blade server; and the industry s most trusted, best-in-class, unified storage platform. The Vblock 700 system is designed for the world s most demanding workloads and service levels. The Vblock Series 300 is an agile and efficient data center-center system that incorporates high-density, compact fabric switching, integrated fabric-based blade servers, and best-in-class unified storage. The Vblock 300 system is engineered for modular and scalable performance. 4

5 Intel Cloud Builders Guide: VCE* Vblock* Infrastructure-as-a-Service What follows in a deeper description of the Vblock Series 300 and Vblock Series 700 platforms. Vblock Series 300 is a system designed to address a wide spectrum of virtual machines (VMs), users, and applications. It is ideally suited to achieve the scale required in both private and public cloud environments. Vblock Series 300 scales from smaller to mid-sized deployments of enterprise resource planning (ERP) applications, , and collaboration. Components in the Vblock Series 300 include: Compute: Two Cisco 6248UP Series Fabric Interconnects or Cisco UCS 61x0XP Series Fabric Interconnects. A minimum of two and maximum of eight Cisco Unified Computing System* (Cisco UCS) 5108 Blade Service Chassis containing Cisco UCS B-series blade server modules and a minimum of two and a maximum of 32 B-series blade packs (four blades minimum, 64 blades maximum). Building on the success of the Cisco UCS B200 M1 and UCS B250 M1 servers, the Cisco UCS B200 M2, UCS B230 M1 and M2, UCS B250 M2, and Cisco UCS B440 M1 and M2 servers extend the capabilities of the Cisco UCS with the next generation of Intel processor technology: Intel Xeon 5600 series processors. These powerful processors deliver more cores, threads, and cache, all within a similar power envelope, with even faster payback, greater productivity, and better energy efficiency. When put into production, the Cisco UCS and Intel Xeon 5600 series processors together offer further reductions in total cost of ownership (TCO), increased business agility, and another big leap forward in data center virtualization. Network: The Cisco Nexus 5548 series switches, in the network layer, provide 10 GbE IP connectivity between the Vblock System and the outside world. In a unified storage configuration, the switches also connect the Fabric Interconnects in the compute layer to the X-blades in the storage layer. The Cisco MDS 9148 series storage switches in the aggregation layer provide Fibre Channel links between the Cisco Fabric Interconnects and the engines. In a unified storage configuration, this connection also supports SAN booting of the blades in the compute layer. Cisco Nexus 5548 data center switches run Cisco NX-OS Software on a dual-core 1.7-GHz Intel Xeon Processor C5500/ C3500 Series with 8 GB of DRAM. The supervisor complex is connected to the data plane in-band through two internal ports running 1-Gbps Ethernet and the system is managed in-band or through the out-of-band 10/100/1000-Mbps management port. Storage: EMC VNX 7500, 570o, 5500 or 5300 unified storage with EMC Unisphere, which is powered by the quad core Intel Xeon 5600 series with a 6-Gbps SAS drive back-end, delivers demonstrable performance improvements over the previous generation mid-tier storage. It can run Microsoft SQL* and Oracle 300 percent faster, with double the system performance in less than two minutes non-disruptively. The EMC VNX is deployed in a single rack with storage scaling from five disk array enclosures (DAEs) with 75 drive slots of storage to seven DAEs with 105 drive slots of storage. Drive types include enterprise Flash drives (EFD), serial attached SCSI (SAS) drives, or Nearline SAS (NL-SAS) drives. Virtualization: VMware vcenter Server, VMware, vsphere ESX 0r ESXi. Management: EMC Ionix Unified Infrastructure Manager (UIM) (optional), VMware vsphere Server Enterprise Plus, and additional management software tools for computing and storage elements. Vblock Series 700 is designed for deployments involving very large numbers of VMs and users. It is ideally suited to meet the higher performance and availability requirements of an enterprise's business critical applications. The Vblock Series 700 scales to accommodate the largest deployments of ERP data center operation environments and service provider cloud computing offerings. Components in the Vblock Series 700 include: Compute: Two Cisco 6248 or 6140 Fabric Interconnects, four to eight Cisco UCS Blade Server Chassis per Cisco UCS domain (with a pair of Fabric Interconnects); up to five Cisco UCS domains are supported (with five pairs of Fabric Interconnects) yielding support for up to 40 Cisco UCS Blade Server chassis 700 LX with six to eight Cisco UCS Blade Server Chassis containing B-series blade server modules and a minimum of two and a maximum of 160 B-series blade packs (four blades minimum, 320 blades maximum). Network: The Cisco Nexus 5548 series switches in the network layer provide 10 GbE IP connectivity between the Vblock System and the outside world. In a unified storage configuration, the switches also connect the Fabric Interconnects in the compute layer to the X-Blades in the storage layer. The Cisco MDS 9148 multilayer fabric switches in the aggregation layer provide Fibre Channel links between the Cisco Fabric Interconnects and the engines. In a unified storage configuration, this connection also supports SAN booting of the blades in the compute layer. 5

6 Intel Cloud Builders Guide: Intel VCE* Vblock* Infrastructure-as-a-Service Storage: Unified storage EMC Symmetrix VMAX 10K/20K. Virtualization: VMware vsphere, VMware vcenter Server, vsphere ESX or ESXi. Management: EMC Ionix Unified Infrastructure Manager (UIM) (optional), VMware vsphere Server Enterprise Plus, and additional management software tools for computing and storage elements. A Vblock Series 300 EX configuration is shown in Figure 1. Base Configurations and Scaling Vblock Systems have been architected with a base and upgrade approach. Base configurations are those configurations that represent an entry point to a Vblock System. Figure 2 shows a high-level topology of Vblock Series 700 MX connectivity. Figure 1: Vblock Series 300 EX Configuration A base Vblock System begins with racks, in-rack PDUs, cabling, patch panels, aggregate SAN and Ethernet switches, enough Cisco UCS hardware to support a full rack of servers, and a storage configuration with a small amount of initial storage in a discrete configuration. Upgrades of blade packs and disk tier groups extend the base to achieve a particular performance or scalability goal. This architecture provides customers with significant scalability and flexibility to meet business requirements. Vblock Systems have different capabilities, features, and scalability to differentiate them individually in the marketplace. This differentiation is based on the ability to deploy various numbers and densities of VMs and storage capabilities, including the ability to provide block or NAS disk usage and many optional features that can be added today and in the future. Figure 2: Vblock Series 700 MX Connectivity Topology 6

7 Intel Cloud Builders Guide: VCE* Vblock* Infrastructure-as-a-Service Vblock System Design Principles Vblock Systems consist of minimum and maximum configurations that offer balanced I/O, bandwidth, and storage capacity relative to the compute and storage arrays offered. They are fully-redundant systems with 1+1 or N+1 redundancy. A Vblock System zone is a collection of pooled Vblock Systems. Vblock Systems contain the following characteristics: A unit of assembly that provides a set of services, at a known level, to target consumers Self-contained, but it can also use external shared services Optimized for the classes of services it is designed to provide Can be clustered to provide availability or aggregated for scalability, but Vblock Systems are each still viable on their own Fault and service isolation - the failure of one or more Vblock System will not impact the operation of other Vblock Systems (service level degradation can occur unless availability or continuity services are present) Connectivity Overview The Vblock System consists of a base and upgrade set of components that offer balanced I/O, bandwidth, and storage capacity relative to the compute and storage arrays offered. Vblock Systems are fully-redundant systems that have 1+1 or N+1 redundancy by default. Compute Layer Overview In Vblock Systems, each Cisco UCS chassis contains Cisco UCS B-series blades. The type of blade and the quantity are custom ordered to each organization s requirements. The amount of RAM per blade within a Vblock System can be adjusted if you have specific requirements within the definition of a Vblock System. This however requires careful consideration of the operational environment and introduces some variance. Each Cisco UCS Fabric Interconnect has either four or eight 10 GE/Unified Fabric uplinks to the Cisco aggregation layer switches and either four or eight 4G Fibre Channel connections to the SAN aggregation provided by a pair of Cisco MDS Aggregation SAN switches (SAN A and B support). Network Layer Overview The Cisco Nexus 5548 series switches in the network layer provide 10 GE IP connectivity between the Vblock System and the outside world. In a unified storage configuration, the switches also connect the Fabric Interconnects in the compute layer to the X-blades in the storage layer. The Cisco MDS 9148 series switches in the aggregation layer provide Fibre Channel links between the Cisco Fabric Interconnects and the engines. In a unified storage configuration, this connection also supports SAN booting of the blades in the compute layer. Storage Layer Overview Storage capacity is tuned to match the I/O performance of the integrated Cisco UCS systems. Additionally, analysis of the likely underlying applications has also characterized user or VM densities that are likely for a given Vblock System. Obviously, these numbers are highly variable based upon your use cases and requirements; the numbers are intended to provide guidance on typical densities. Management Framework Within the Vblock Systems there are several managed elements, some of which are managed by their respective element managers. These elements offer corresponding interfaces that provide an extensible, open management framework. The individual element managers and managed components are: VMware vsphere Server Enterprise Plus Cisco UCS Manager EMC Symmetrix Management Console EMC Unisphere Manager EMC Ionix Unified Infrastructure Manager EMC Secure Remote Support EMC PowerPath/VE Advanced Management Pod (AMP) The Advanced Management POD (AMP) provides a single management point for the Vblock System. VCE uses the AMP to remotely manage the Vblock System. The AMP enables the following benefits: Monitors and manages Vblock System health, performance, and capacity Provides fault isolation for management Eliminates resource overhead on the Vblock System Provides a clear demarcation point for remote operations Expanding Vblock Systems The guiding principle of VCE Vblock Systems is the ability to expand the base capacity. The Vblock System architecture is very flexible and extensible and is architected to be easily expandable from a few hundred VMs to tens of thousands of VMs. In addition, this capacity can be aggregated (clustered) as a single pool of shared capacity or segmented into smaller isolated pools. Each Vblock System can be expanded by adding capacity to compute and storage. Compute capacity is expanded by adding additional blade packs (one blade pack = two blades). As additional compute capacity is required, four additional 7

8 Intel Cloud Builders Guide: Intel VCE* Vblock* Infrastructure-as-a-Service blade packs are ordered to completely populate the base compute rack (eight blade packs = 16 blades). After the rack is fully populated, a fully-populated compute expansion rack (eight blade packs = 16 blades) is added to provide a total of 32 blades between the compute and expansion racks. Storage capacity of Vblock Systems can be increased by adding tiers or levels of storage. The following disk tier groups simplify the configuration: Vblock System and Storage Type Vblock Series 300: EMC VMX Series unified storage with EMC Unisphere EMC RecoverPoint (Optional) Vblock Series 700: EMC Symmetrix VMAX, VMAXe EMC RecoverPoint Disk Tier Groups Vault FC 450GB 15K RAID5 4+1 Tier 1 (T1): EFD One RAID5 4+1 using either 100GB or 200GB Tier 2 (T2): FC Two RAID5 4+1 using either 450GB or 600GB 15k disks Tier 3 (T3): SATA One RAID using either 1TB or 2TB 7.2k disks Or Vault FC 450GB 15K RAID5 4+1, Boot disks FC RAID GB 15k disks Tier 1 (T1): EFD One RAID5 4+1 using either 100GB or 200GB disks Tier 2 (T2): FC Six RAID5 4+1 using either 450GB or 600GB 15k disks Tier 3 (T3): SATA Three RAID using either 1TB or 2TB 7.2k disks Comparing Vblock Systems to other Cloud Infrastructures The potential of cloud computing envisions a flexible, shared pool of preconfigured and integrated computing resources that enable organizations to deliver better IT services faster, more reliably, and at a lower cost than with traditional data center models. The foundation for cloud computing is pervasive virtualization the use of virtualized applications and operating systems throughout the enterprise and at every application tier. Despite the well-understood benefits of virtualization, obstacles remain that slow or prevent implementation. Enterprise IT infrastructure commonly comprises a large variety of devices and software from many vendors, built over time as requirements change. The result is a fragmented, complex network of underutilized and over-utilized resources. The IT components are costly and time consuming to configure, provision, and manage. Significant time and budget are spent getting the pieces to work together, tuning, devising workarounds, and planning upgrades and enhancements instead of improving service delivery to end users. The Vblock System architectures are a pretested, integrated, and validated data center foundation. Enterprises and cloud service providers can deploy Vblock Systems as the basis for cloud service delivery. Vblock Systems are integrated IT offerings combining the best products in their categories for networking, computing, storage, security, and management technologies with end-toend vendor accountability. These technologies are pre-integrated into a new way of delivering IT to business and are validated to support the creation of customized solution packages by the channel, partners, and independent software vendors (ISVs). Rather than buying and assembling individual components, customers can use Vblock Systems, which are validated, secure, and warranted. Vblock Systems arrive as integrated units. All of the Vblock Systems components are pre-tested, assembled, and configured to work together, resulting in a unit of IT infrastructure that is primed for virtualization and is production ready. This integrated approach also helps to simplify data center architecture by reducing the planning and restructuring typically associated with changes in data center design. Vblock Systems remove the architectural hurdles by providing all the necessary technologies in a single integrated system. And Vblock Systems can scale easily as the business grows. Designed to work with almost any application, Vblock Systems have been tested and validated to work with many major applications, including: Microsoft Exchange Microsoft SharePoint Oracle RAC SAP VMware View Because VCE has completed this compatibility and validation work up front, IT can focus on implementing virtualization more broadly throughout the organization. Vblock Systems elevate user confidence and satisfaction by delivering predictable performance and operational characteristics. For example, Vblock Systems predetermined storage, memory, and compute capacity enable uniform distribution of workload as well as workload mobility. And deterministic fault and security isolation help ensure the level of business continuity needed for mission-critical applications. Because the platform components are pretested 8

9 Intel Cloud Builders Guide: VCE* Vblock* Infrastructure-as-a-Service and preconfigured to work together at peak performance, the IT group can focus more on delivering services to end users and less on adjusting the infrastructure components. Vblock Systems present an opportunity for vastly simplified management and orchestration due to the fully integrated nature of the Vblock System, which is manageable as a unit of infrastructure. This allows for a unique approach to intelligent automation, providing dynamic awareness of all system resources within the Vblock System and the ability to correlate events and eliminate the traditional, manually-intensive integration of system resource managers. The pre-defined configurations of Vblock Systems also simplify management of the virtualized infrastructure using traditional management approaches. Management and orchestration products such as VMware s suite of management tools, including vcenter Orchestrator, vcloud Director; the Cisco Intelligent Automation for Cloud (CIAC) suite of products; EMC Ionix Unified Infrastructure Manager (UIM); BMC Cloud Lifecycle Management; and well over a dozen IT management solutions from CA Technologies, simplify deployment and integration of cloud services on Vblock Systems, using features such as IT service catalogs and workflow engines. These tools and others dramatically simplify Vblock Systems as an infrastructure for cloud services by abstracting the overall provisioning while offering granular access to individual components for troubleshooting and fault management. In addition to the above tools, administrators can use component-specific management tools and interfaces to provide an extensible, open management framework that enables granular visibility into each system element. The individual element managers are: VMware vcenter Server Cisco UCS Manager EMC Symmetrix Management Console EMC Unisphere The open management framework also allows IT to use current management tools. The simplified design and the pre-engineered, pre-configured, and pretested model means less work for IT staff. Vblock Systems are production ready, so IT can focus on migrating applications rather than on building and testing a virtualized environment to support them. Provisioning IaaS with Vblock Systems VCE provides a consistent and repeatable solution architecture that is scalable and makes it easy to deploy IaaS. Several different management and workflow automation solutions can be used on Vblock Systems. One recently demonstrated by VCE utilized the CIAC suite of tools in conjunction with the Vblock System. The solution was demonstrated validated on the Vblock Series 300. The following hardware and software components and technologies can be used to provision Vblock Systems for IaaS workloads. Again, they are among many options for management and orchestration of IaaS on the Vblock System. VMware vcloud Director VMware vcloud Director (vcd) is a cloud computing management platform that abstracts virtualized resources to give users access to those resources through a self-service catalog. Tasks previously requiring significant IT staff resources and time to accomplish, such as configuring a network, are automatically executed in minutes with vcloud Director, in the example presented in this paper. In our illustrated IaaS deployment with vcloud Director, IT services are delivered as fully encapsulated and portable units called vapps, which can be manipulated through an open API and extended to deploy on any cloud compatible with VMware vcloud. End-user consumption is controlled through role-based access policies tied to organizational constructs and through virtual networking technologies that enable similar VM environments to be deployed concurrently. By logically pooling infrastructure capacity into virtual datacenters, IT organizations can manage resources more efficiently with complete abstraction between the delivery and consumption of the infrastructure and the underlying resources supporting it. Cisco Intelligent Automation for Cloud Cisco Intelligent Automation for Cloud is a self-service provisioning and orchestration software solution for cloud computing and data center automation. It helps enable secure, on-demand, and highly automated IT operations for both virtual and physical infrastructure across compute, network, storage, and applications. It is comprised of Cisco Process Orchestrator and Cisco Cloud Portal. Cisco Process Orchestrator Cisco Process Orchestrator (CPO) provides the orchestration engine for service delivery and operational processes in this IaaS deployment. Other vendor tools are also available. CPO was used in this illustration to leverage pre-defined and user-defined workflows to orchestrate the provisioning and configuration of infrastructure elements, operating systems, and application software. The automation core includes a process orchestration engine, an interactive automation design studio, and a reporting and analytics module. 9

10 Intel Cloud Builders Guide: Intel VCE* Vblock* Infrastructure-as-a-Service As the foundation used by the CIAC suite for standardizing, unifying, and automating IT processes in complex, heterogeneous environments, CPO integrates event and alert management data with best practices to combine decision-driven event processing with automated intelligent incident response. By automating the end-to-end service delivery process, CPO enables organizations to automate service delivery processes across the entire IT landscape, providing simplicity while increasing both flexibility and choice. In our example IaaS deployment, it was used to create a number of Vblock System-specific workflows to automate provisioning processes. Cisco Cloud Portal The Cisco Cloud Portal (CCP) provides a self-service portal, service catalog, and lifecycle management solution for private cloud or hybrid cloud computing, as well as for other virtual and physical infrastructure services. For this particular example of how to deploy cloud services on the Vblock System, we used CCP to implement the self-service portal and service catalog. It enabled the test team to define an illustrative set of cloud services being offered on the Vblock System and then to present them in a Web-based portal format from which users could select, procure, and provision the services they require. The result: improved IT agility, reduced costs, greater responsiveness to business needs, and faster time to market for application development. Additional Software Components In addition to the above software components, Microsoft SQL Server 2008 and Microsoft Windows Server Active Directory 2008 SP2 were used in creating this example of an IaaS offering implemented on a Vblock System. Management and Orchestration with CIAC, CCP, UIM, and vcd Create Service Definition Creating a clear definition for each service using management and orchestration tools from Cisco, EMC, VMware, and other vendors was the first step in designing and implementing the service catalog, in this example. A typical service definition may include the following elements: Service name Service description Features and options Service levels Service response or service fulfillment timeframes Service prices Figure 3: Service Definition Figure 4: Service Request Form Service billing units of measure In our example, the CCP software provided a flexible, intuitive, and easy to use interface to create service definitions. Figure 3 shows a service definition created using the CCP Service Design module. Define Service Request After creating a service definition, the next step was to define the form used to request the service. The CCP Service Design module includes a form designer for creating the service request that users use to request the service. Figure 4 is an example of the service request form that was used by a new tenant to request cloud resources from the cloud administrator. 10

11 Intel Cloud Builders Guide: VCE* Vblock* Infrastructure-as-a-Service Define Fulfillment Process After creating the service request, the next step was to define the process that fulfills delivery of the service. VCE recommends that the process be modeled on standard business processes with the appropriate approvals and validation steps. After the service fulfillment process was defined, it was implemented using the interactive automation design studio and predefined workflows in CPO. Publish Service The final step was to publish the service catalog to users. Had this been an actual deployment, we would have followed best practices and performed usability and performance testing, taking into consideration the types and levels of users within the corporate structure, the roles that users have in their business units, and organizational policies. After the service was published, it became available to users on a self-service Web-based interface. Design Considerations If you choose to use CIAC, as per this example, here are some things to consider when deploying, designing, and implementing IaaS (when using other tools, these considerations may differ): Understand business requirements and processes before beginning the detailed technical design. Start with a subset and expand from there. Minimize the number of levels that users must navigate to reach specific services when designing a service catalog structure. Introduce standardized configurations and service levels. Use the predefined workflows in CPO as a starting point to design custom workflows. Design synchronization services to synchronize the data among CCP, CPO, and vcd databases. For instance, when new vapp templates are published through the vcd interface, synchronization services can ensure the latest vapp templates are available in the CCP service catalog. Periodically reevaluate standards to ensure alignment with actual needs and requirements. Pay attention to disk space requirements for the CPO database. Disk space requirements depend on the number of records published to the database. Design the data retention policy for the CPO database carefully to satisfy disk space requirements for the CPO database server. Integration Considerations Integration points to consider when implementing this self-service solution, based on CIAC, include the following (may differ if other tools are used): Use Lightweight Directory Access Protocol (LDAP) servers for centralized user authentication and management. Both CCP and CPO have adapters to interact with external third-party systems, such as a configuration management database (CMDB). Validate the Service Environment Based on use of the management and orchestration and workflow automation features of the CIAC suite to determine workload characteristics and performance, the underlying physical resources on the Vblock System can be categorized as Gold, Silver, or Bronze services and corresponding service offerings can be created in UIM. Other ways of categorizing services exist using other tools. Once Gold, Silver, or Bronze level resources (or other labels designated by the administrator), are chosen, the orchestrator specifies the blades, different categories of storage, CPU, etcetera, that will be designated to each slot. Both DNS and DHCP server capabilities are enabled on the Active Directory (AD) installed on a Microsoft 2008 Windows server. A hierarchy of users for a sample organization can be created and configured in this AD. The CCP, CPO, and vcd software is then configured to point to this AD. Figure 5 illustrates the layers of the validation environment and shows how each component layer connects to the components in the next layer in our example using CIAC. Service Catalog User Roles and Profiles in the CIAC Suite User roles and profiles for configuring IaaS in Vblock Systems using the CIAC suite include: Cloud Administrator: Has full administrative access to users, system infrastructure, administrative functions, data, and end user access. The administrator has an authorization tab in Cisco Process Orchestrator that displays requisition requests and service status. Tenant Administrator: Has administrative access to a specific organization, including user management, approvals, and end user access. When the tenant makes a request, the administrator has to approve it. If approved, the request triggers the appropriate workflow. Tenant User: End user of available resources through the service catalog and lifecycle management of the resources allocated to this user. Best Practices for IaaS Use Cases with the CIAC Suite For all IaaS use cases in which the CIAC suite is used to provide the service catalog and workflow automation layers: Use conditional data and dynamic retrieval rules when designing the service request form in CCP so 11

12 Intel Cloud Builders Guide: Intel VCE* Vblock* Infrastructure-as-a-Service that the corresponding data can be pre-populated. Include one or more steps in the workflow to update the CCP service request record so that the user can easily check status and see historical information. Using the Cisco Process Orchestrator, the administrator can look at the provider virtual data center resource area to check the vcloud Director and see if the resources an individual tenant requests are available to meet the tenant s requirements. If they are, they can be provisioned. If not, additional workflow steps can be used to provision additional Vblock System resources (e.g., provisioning an existing blade that is not being used). While vcloud Director creates the workflow for IaaS provisioning, management, and de-provisioning, administrators can also create their own workflow based on their needs and enter it into the cloud orchestrator. The following use cases utilize the CIAC suite as one illustrative method of a management and automation solution for deploying IaaS on the Vblock System. CIAC is one of several solutions available. The Cisco UCS B230 M1 blade servers with Intel Xeon x6550 processors and 2.00GHZ CPUs were used in these sample deployments. Figure 5: Validation Environment Used for Our Demonstration of Vblock Systems Using CIAC 12

13 Intel Cloud Builders Guide: VCE* Vblock* Infrastructure-as-a-Service Use Case: New Tenant Onboarding In this use case, the tenant administrator used the self-service catalog (in this case implemented by CCP) to add a new tenant to the database and to request cloud resources for that tenant. The tenant administrator logged into the self-service catalog portal to request cloud resources for the new tenant. The request was sent to the cloud administrator for approval. When approved, the request was routed to CPO, as the CIAC suite is used in this example, to trigger the automated workflow that fulfills this request. If the cloud provider has adequate resources provisioned to fulfill the request, the requested resources are automatically provisioned for the new tenant. If adequate resources are not available, CPO triggers another automated workflow to provision more resources for the cloud provider to give to tenants. Figure 6 shows the workflow implemented in CPO that adds a new tenant and provisions resources for that tenant. Figure 6: New Tenant Onboarding Workflow 13

14 Intel Cloud Builders Guide: Intel VCE* Vblock* Infrastructure-as-a-Service Regardless of which tools are used, it is important to include a step in the workflow to check whether additional physical resources must be provisioned on the Vblock System to meet the service request. Figure 7 shows sample service request form used by a new tenant administrator to request cloud resources implemented in the portal tool set chosen for this example, in this case the Cisco Cloud Portal. Figure 7: Service Request Form Used by New Tenant Administrator 14

15 Intel Cloud Builders Guide: VCE* Vblock* Infrastructure-as-a-Service Use Case: New Tenant User Onboarding In this use case using CIAC and CCP, a new tenant user requested to be added to an existing tenant organization in order to use the cloud resources of that organization. The new tenant user logged into the self-service catalog portal and requested to be added to an existing tenant organization. The request was sent to the tenant administrator for approval. When approved, the request was routed to CPO to trigger the automated workflow that fulfilled this request. CPO validated that the user does not already exist in the AD for the tenant. The new tenant user was added to the tenant organization and can consume the cloud resources of the tenant organization. One or more ADs may be used in real world scenarios. However, only one AD was used in demonstration of the solution. Figure 8 shows the workflow implemented in CPO that adds a new user to a tenant organization. Figure 8: New Tenant User Onboarding Workflow 15

16 Intel Cloud Builders Guide: Intel VCE* Vblock* Infrastructure-as-a-Service Regardless of which tool is used, it is important to include a step in the workflow to check whether the new user already exists in the AD before trying to add the new user. Figure 9 shows sample service request form used by a new user to request to be added to a tenant organization. Figure 9: New User Service Request Form 16

17 Intel Cloud Builders Guide: VCE* Vblock* Infrastructure-as-a-Service Use Case: Order and Deploy a Virtual Application (vapp) In this use case utilizing CIAC and CCP, a tenant user ordered a vapp from the service catalog. The tenant user logged into the selfservice catalog portal and browsed through a list of published vapp templates in the service catalog for the tenant organization. The tenant user chose a vapp template and requested deployment. The request was sent to the tenant administrator for approval. When approved, the request was routed to CPO to trigger the automated workflow that fulfilled this request. After this request was fulfilled, the tenant user can access the deployed vapp instance as needed. Figure 10 shows the workflow implemented in CPO to instantiate and deploy a vapp. Figure 10: Workflow in CPO to Instantiate a vapp 17

18 Intel Cloud Builders Guide: Intel VCE* Vblock* Infrastructure-as-a-Service For this use case, the vapp instance may contain multiple VMs. Some VMs may take longer to boot up so longer waiting times and timeouts may be needed in the workflow. It is also a good idea to add dynamic resource checks to the form to prevent users from requesting a vapp if they do not have enough resources available to their tenant organizations. Figure 11 is an example of the service request form a tenant user uses to order a vapp from the service catalog. Figure 11: Service Request Form to Order a vapp from the Service Catalog 18

19 Intel Cloud Builders Guide: VCE* Vblock* Infrastructure-as-a-Service Use Case: Decommission vapp Since in our demonstration we have chosen to use CIAC and CCP, we showed the tenant user logging into the service portal and browsing through a list of deployed vapp instances. In this use case, a tenant user no longer requires a particular vapp and requests that it be removed to free up the resources. The tenant user chose the vapp that is no longer needed and requested that it be removed. This request was sent to the tenant administrator for approval. When approved, the request was routed to CPO to trigger the automated workflow that fulfills this request. After the request was fulfilled, the vapp instance was removed from the service portal for the tenant organization and the underlying resources assigned to this vapp instance were released. Figure 12 shows the workflow implemented in CPO to remove a vapp from the service catalog. Figure 12: Workflow to Remove a vapp from the Service Catalog 19

20 Intel Cloud Builders Guide: Intel VCE* Vblock* Infrastructure-as-a-Service In our example configuration, the data displayed in the CCP service portal was maintained in the vcd database. For this use case, we included a step in the workflow to update the CCP database with data from the vcd database to ensure the data is consistent across the databases. We also found that it was a good idea to first shut down the vapp and remove the vapp service item from the service portal, and then use a delayed task to remove the vapp from vcd. This will allow the Cloud Administrator to easily react to emergency accidental delete scenarios. Figure 13 is an example of the service request form a tenant user uses to request removal of a vapp from the service catalog. Figure 13: Service Request Form to Request Removal of a vapp from the Service Catalog 20

21 Intel Cloud Builders Guide: VCE* Vblock* Infrastructure-as-a-Service Use Case: Remove Tenant Since in our demonstration we have chosen to use CIAC and CCP, the tenant administrator requested that an existing tenant be removed from the database. The tenant administrator logged into the self-service catalog portal and requested removal of an existing tenant organization. This request was sent to the Cloud Administrator for approval. When approved, the request was routed to CPO to trigger the automated workflow that fulfills this request. After this request was fulfilled and the tenant was removed, the underlying resources were released to the cloud provider. Key data about the tenant was kept for a period depending on the data retention policy. Figure 14 shows the workflow implemented in CPO to remove a tenant. Figure 14: Workflow to Remove a Tenant from the Database 21

22 Intel Cloud Builders Guide: Intel VCE* Vblock* Infrastructure-as-a-Service For this use case, it is important to understand the dependencies among different components of the vcloud stack so that the workflows are implemented in the correct order. For example, the tenant s networks must be removed before removing the tenant. It is also recommended to have the form dynamically check for active vapps and prompt the tenant to confirm the delete request. Figure 15 is an example of the service request form a tenant administrator uses to request removal of a tenant. Figure 15: Removal of a Tenant 22

23 Intel Cloud Builders Guide: VCE* Vblock* Infrastructure-as-a-Service Maintaining a Carrier Class Cloud Infrastructure Self Service and Automation IT departments need to control costs while simultaneously enabling flexibility and scalability. Self-service and automation solutions enable Vblock Systems customers to deploy predictable, secure, and measurable services. By abstracting the infrastructure from the service, standard processes such as provisioning and approval processes can be automated. Self-service and automation of the standard processes and operations enable alignment with business and create the opportunity for employees typically burdened with these tasks to focus on more strategic initiatives. By lowering the risk of deploying new services, companies can be much more agile. VMware vcloud Director is one particular tool that gives customers the ability to build secure private clouds that dramatically increase datacenter efficiency and business agility. This powerful tool delivers cloud computing for existing data centers by pooling virtual infrastructure resources and delivering them to users as catalog-based services. End users can consume infrastructure without the burden of manual configuration and provisioning. Capacity Planning Managing capacity in the virtualized data center of today presents unique challenges for IT organizations. Exact measurement of available physical resources is difficult because capacity is hidden behind a layer of virtualization. To uncover those physical attributes, IT managers need processes and tool sets that enable the necessary visibility into infrastructure capacity and performance. Understanding, forecasting and finetuning application and infrastructure component usage help improve performance and reduce consumption, therefore lowering costs and enabling more consistent levels of IT service. With an effective capacity management strategy in place, IT operations can provide more efficient and comprehensive service levels while making efficient use of the existing infrastructure. In a virtualized environment, all resources must be shared, which presents some new and unique challenges to the data center when determining actual resource requirements. Ensuring that every virtual server and virtualized business-critical application has the resources it requires when it requires them presents a complex resource allocation challenge. To achieve consistent, acceptable service levels, at a known and controlled cost, define a capacity management strategy that includes: Defining the processes, workflows, approvals, and schedules associated with the workloads in a virtualized environment Identifying and collecting metrics critical to managing the performance and capacity of the resources in the environment Measuring current performance and establishing baselines Collecting and using workload forecasts from consumers to establish current and future resource requirements Following the guidelines for implementing capacity management for Vblock Systems will enable the development of a costeffective capacity management strategy that assures high performance of business-critical applications and prevents performance bottlenecks. Choosing the right monitoring and capacity management toolsets for the specific environment is critical to the success of a capacity management strategy. The considerations for evaluating and choosing toolsets given in this paper can assist in making the right choice. Security and Compliance Vblock Systems enable many different kinds of organizations to meet challenges from implementing generalpurpose, next-generation converged infrastructure for mixed workloads to deploying platforms dedicated to missioncritical enterprise risk management applications. VCE enables secure and compliant virtual desktops in branch offices and within corporate headquarters as well as solutions for re-platforming aging and hard-to-maintain applications from mainframes onto robust x86 platforms. Vblock Systems solutions enable VCE customers to address their many different challenges. The Vblock Systems are fully integrated units of infrastructure designed and factory-integrated for virtualized environments. At every level of the stack, virtualization, security, and ease of management are designed in the Vblock System. The tight integration between server and network environments helps ensure consistent, policy-based network capabilities to all servers in the data center. It allows policies to move with a VM during live migration, which ensures persistent network, security, and storage compliance for improved business continuity and performance management. The Vblock System can deliver uncompromising high availability, security, scalability, and ease of management. Beyond helping businesses meet security needs such as Payment Card Industry (PCI) compliance or other formal or informal requirements, Vblock Systems create a strong overall security foundation. The same infrastructure used to help achieve PCI compliance also helps enforce security 23