Tactical Storage: Simple, Secure, and Semantic Access to Remote Data. Prof. Douglas Thain University of Notre Dame

Transcription

1 Tactical Storage: Simple, Secure, and Semantic Access to Remote Data Prof. Douglas Thain University of Notre Dame

2

3

4 Plentiful Computing Power As of 25 April Condor Worldwide: 56,682 CPUs /??? TB / 1758 sites Teragrid 15,328 CPUs / 220 TB / 6 sites Open Science Grid 21,156 CPUs / 83 TB / 61 sites EGEE Grid Lots???

5 Complex Ecology of Storage Shared Filesystem shared disk private disk private disk private disk HTTP, FTP, RFIO, glite, SRB, SCP, RSYNC, HTTP... private disk Independent Cluster Disks shared disk

6 Problems Accessing Data Large Burden on the User User may not be able/willing to state s in advance. Different services/protocols available at different sites. Programs not modified to take advantage of services. Different access modes for different purposes. File transfer: preparing system for intended use. File system: access to data for running jobs. Resources go unused. Disks on each node of a cluster. Unorganized resources in a department/lab. Would like to combine disks into larger structures. A global system can t t satisfy everyone! (Global means different things to different people.) Both a technical and social problem.

7 What s s the Problem? We often assume that the site administrator is responsible for making the site comfortable for the user. (Not possible on the grid!) Rather, the user should be able to bring along a mechanism to access multiple independent (remote?) data sources. Of course, we have to make it easy!

8 Tactical Storage Systems (TSS) A TSS allows any node to serve as a or as a system client. All components can be deployed without special privileges but with security. Users can build up complex structures. Filesystems,, databases, caches,... Admins need not know/care about larger structures. Two Independent Concepts: Resources The raw storage to be used. Abstractions The organization of storage.

9 App transfer App Parrot??? Simple Filesystem App Parrot Parrot Distributed Filesystem Abstraction Distributed Database Abstraction UNIX UNIX UNIX UNIX UNIX UNIX UNIX system system UNIX UNIX UNIX UNIX UNIX UNIX UNIX system 3PT system system system system Workstations owners control policy on each machine. Cluster administrator controls policy on all storage in cluster

10 Key Properties Tactical Storage is Simple: Appears as an ordinary system. Applies to unmodified applications and data w/out code changes, relinking,, kernel modules, etc... Tactical Storage is Secure: Authentication with standard GSI or Kerberos. Rich distributed access control system. Tactical Storage is Semantic: Name data by meaning, not by location. Supports external name resolution mechanisms.

11

12

13

14

15

16

17 Access Control in File Servers Unix Security is not Sufficient No global user database possible/desirable. Mapping external credentials to Unix gets messy. Instead, Make External Names First-Class Perform access control on remote, not local, names. Types: Globus,, Kerberos, Unix, Hostname, Address Each directory has an ACL: globus:/o= :/O=NotreDame/CN=DThain hostname:*.cs.nd.edu RWLA RWL RL address: * RWLA

18 Distributed Group ACLs App App App App UNIX UNIX UNIX UNIX UNIX UNIX UNIX system system system system system system system Chemistry Group List data Lab 5 Group List data Physics Group List ACL: Lab 5 RW Chemistry R ACL: Physics RW Lab 5 R

19 Semantic Data Access Appl Parrot /usr/local = /chirp/host5.nd.edu/software /tmp = /chirp/host9.nd.edu/scratch /data = /gsiftp/ftp.nd.edu/mydata /db = resolver:find_db Where is /db/dir/523? find_db /usr/local /data /tmp It s at /ftp/ftp.infn.it/db/xz host5 host9 FTP

20

21 Credit: Sander NIKHEF Remote Database Access GSI HEP Simulation Needs Direct DB Access App linked against Objectivity DB. Objectivity accesses system directly. How to distribute application securely? Solution: Remote Root Mount via Parrot: script Parrot Simple FS parrot M M /=/chirp//rootdir rootdir DB code can read/write/lock s directly. WAN GSI Auth system DB data libdb.so sim.exe

22 Credit: Igor Fermi National Lab Remote Application Loading Modular Simulation Needs Many Libraries Devel.. on workstations, then ported to grid. Selection of library depends on analysis tech. Constraint: Must use HTTP for access. Solution: Dynamic Link with TSS+HTTP: /home/cdfsoft -> > /http/dcaf.fnal.gov/cdfsoft appl Parrot HTTP proxy proxy HTTP system liba.so libb.so libc.so select several MB from 60 GB of libraries

23 Technical Problem HTTP is not a system!! (No directories) Advantages: Firewalls, caches, admins. Appl GET /home HTTP/1.0 HTTP Server Parrot opendir(/home) <HTML> <HEAD> <H1> root opendir(/home) home etc bin HTTP Module alice babar cms

24 Technical Problem Solution: Turn the directories into s. Can be cached in ordinary proxies! Hierarchical SHA1 integrity check. Appl Parrot opendir(/home) GET /home/.dir HTTP/1.0 alice babar cms HTTP Server root make httpfs opendir(/home).dir home etc bin HTTP Module alice babar cms.dir

25 Logical Access to Bio Data Many databases of biological data in different formats around the world: Archives: Swiss-Prot, TreMBL,, NCBI, etc... Replicas: Public, Shared, Private,??? Users and applications want to refer to data objects by logical name, not location! Access the nearest copy of the non-redundant protein database, don t t care where it is. Solution: EGEE data management system maps logical names (LFNs( LFNs) ) to physical names (SFNs( SFNs). Credit: Christophe Blanchet, Bioinformatics Center of Lyon, CNRS IBCP, France Christophe.Blanchet@ibcp.fr

26 Logical Access to Bio Data Run BLAST on LFN://ncbi.gov/nr.data BLAST open(lfn://ncbi.gov/nr.data) Parrot Where is LFN://ncbi.gov/nr.data? EGEE File Location Service Find it at: FTP://ibcp.fr/nr.data glite Server nr.data Chirp Server nr.data open(ftp://ibcp.fr/nr.data) RFIO glite HTTP FTP RETR nr.data FTP Server nr.data

27 % ( - / ( 3 2 % - / 3 2 Performance of Bio Apps on EGEE Performance of Bio Apps on EGEE -, )*+ ( + &' % $# -, )*+ +.* -, )*+ + & &10 *+ (2,4 5 &' % $# (2,4 5.* (2,4 5 & &10 *+ "!

28 Credit: John Notre Dame Astrophysics Dept. Expandable Filesystem for Experimental Data Project GRAND Can only analyze the most recent data. 2 GB/day today could be lots more! 30-year archive analysis code buffer disk daily tape daily daily tape daily tape daily tape tape

29 Credit: John Notre Dame Astrophysics Dept. Expandable Filesystem for Experimental Data Can analyze all data over large time scales. Project GRAND analysis code Adapter Distributed Shared Filesystem buffer disk 2 GB/day today could be lots more! daily tape 30-year archive daily daily tape daily tape daily tape tape

30 Current Work Now that we can easily use any storage... Much easier to arrange data/jobs arbitrarily. Idea: combine cluster storage / cluster comp! Goal: keep jobs close to data that they need. PINS: Processing in STorage Example: GEMS Distributed Databank Facility for creating, storing, and analyzing molecular dynamics data in a cluster. Goal: Be able to easily scale both CPU and storage capacity by adding commodity nodes. Credit: Jesus Izaguirre and Aaron Notre Dame

31 meta-data database D1 D1 D3 D4 Fetch D1 Compute F(D1) Query (Mol== CH4 ) && (T>300K) App Adapter Distributed Filesystem Abstraction D2 D3 D4 UNIX UNIX UNIX UNIX UNIX UNIX UNIX D1 D2 D3 D4 system D1 system F(D1) system D2 system D3 system D4 system system J1 F J2 J3 J4

32 More Open Problems Resource Management How to prevent overcommitment -> badput? Security How to easily express complex policies for sharing and controlling combined cpu/disk? Reliability How to deal with disconnection, erasure, rejection, unexpected performance, etc... Garbage Collection What s s to prevent me from filling every disk everywhere with computations that I might need? Debugging How do we dig out of numerous, noisy, distributed logs that state relevant to a complex workflow?

33 Conclusion Tactical storage allows end users to build large structures out of simple building blocks without getting stuck on the ugly details.

34 Acknowledgments Science Collaborators: Christophe Blanchet Patrick Flynn Sander Klous Peter Kunzst Erwin Laure John Poirier Igor Sfiligoi CS Collaborators: Jesus Izaguirre Aaron Striegel CS Students: Paul Brenner James Fitzgerald Jeff Hemmes Paul Madrid Chris Moretti Gerhard Niederwieser Phil Snowberger Justin Wozniak

35 For more information... Cooperative Computing Lab Cooperative Computing Tools Douglas Thain

36

37 Problem: Shared Namespace globus:/o=notredame/* RWLAX test.c a.out test.dat cms.exe

38 Solution: Reservation (V) Right /O=NotreDame/CN=Monk mkdir only! /O=NotreDame/CN=Ted O=NotreDame/CN=* V(RWLA) mkdir mkdir /O=NotreDame/CN=Monk RWLA /O=NotreDame/CN=Ted RWLA test.c a.out test.c a.out