How To Make A Cloud Service More Useful

Transcription

1 A Value- Added Cloud for the Internet2 Community Introduction The Cloud is rapidly changing the face of the Internet, building on two disruptive technologies: multi-tenant virtualized clusters and Software Defined Networks (SDN). Multi-tenant virtualized clusters enable scale-out designs with flexible resource use and good cost/performance. SDN makes it possible to both manage complexity and customize the network. These technologies are being deployed throughout the Internet; they are not limited to the data center. For example, network operators are migrating away from purpose-built hardware appliances and moving towards infrastructure that exploits virtualized commodity servers and SDN at the very edge of the Internet (i.e., their access networks), a practice known as Network Functions Virtualization (NFV). The emergence of the cloud, SDN, and NFV is impacting all IT sectors, including the Research and Education (R&E) community. This puts Internet2 at the center of the discussion of how Universities and community anchors can best take advantage of these technologies. This paper puts forward a vision for a Value-Added Cloud called OpenCloud, which Internet2 proposes to build in collaboration with its member organizations. Value-Add Strategy When developing a cloud strategy, it is natural to focus on deploying the commodity servers needed to offer Infrastructure-as-a-Service (IaaS), but one needs to look no further than Amazon Web Services (AWS) to understand the real challenge. The AWS console shows 46 available cloud services, only one of which (EC2) is about infrastructure. The rest are services that Amazon has built on top of their infrastructure, many of which leverage still other services in their ecosystem. The story at Google is similar. Google App Engine is a front-end to a collection of Google services that originally included BigTable, a NoSQL database built on the Google File System (GFS) and the Chubby Locking Service, but has recently been enhanced with a fault-tolerant data store called Spanner and a new file service called Colossus. The main take away from both examples is that a comprehensive cloud strategy must go beyond infrastructure to include a rich service portfolio that includes both end-user services and building block services that lower the barrier to providing those high-level services. In addition to cloud providers that operate their own data centers, there are a plethora of over-tothe-top service providers that leverage commodity IaaS to build value-added services. Some augment the commodity infrastructure with dedicated resources of their own (e.g., Netflix stores video content in S3, but has built a purpose-built CDN to improve delivery speeds), while others provide all their value in software running on commodity infrastructure (e.g., Dropbox and Box provide value-added storage services on top of S3, Snapchat supports a social network on top of the Google Cloud Platform, and Pertino provides private virtual networks running on top of EC2). These trends suggest a three-part strategy for the Internet2 community. The first is to treat existing clouds as providing useful commodity services (rather than try to replicate those services), and focus instead on adding value to these services by leveraging its strategic advantage a global footprint, including the Internet2 backbone, international co-location centers, and campus edge sites. Doing so gives the Internet2 community an opportunity to provide value along six dimensions:

2 Responsiveness deliver low-latency access to end-users. Bandwidth avoid upstream bottlenecks and transfer costs. Predictability offer compute, memory, and bandwidth guarantees. Privacy keep sensitive data on the customer premises. Trust spread risk over multiple commodity providers. Customization tailor access for targeted user communities. The second is to create an open service framework similar to the ones that empower Amazon and Google that lowers the barrier to deploying new services and supporting the rapid customization of existing services for targeted user communities. Doing so is essential to catalyzing and sustaining its ability to provide value-added services. The third is to cultivate all possible sources of value-added services, including community initiatives that target R&E use cases (e.g., scientific discovery and course delivery), cutting-edge services developed by the research community (e.g., Internet-of-Things and virtual networks on demand), and commercial over-the-top-services that can provide even more value if given access to Internet2 s footprint. Access might be in the form of virtualized infrastructure (i.e., virtual machines and virtual networks), or building block services (e.g., caches, proxies, domain-specific platforms) that the over-the-top providers can leverage to enhance the service they currently deliver to end-users. OpenCloud OpenCloud is a pilot value-added cloud being built jointly by the Open Networking Lab, Internet2, the PlanetLab Consortium, and a collection of participating Universities. As illustrated in Figure 1, OpenCloud does not replace or replicate existing cloud resources, but instead augments public commodity clouds and University-hosted private clouds with a widely distributed cloud that takes advantage of the Internet2 footprint. Figure 1. OpenCloud combines small clusters with Internet2 s global footprint to augment commodity and private clouds in support of value-added services. The current pilot is deployed across Internet2 s backbone, with small clusters of commodity servers deployed at ten Internet2 routing centers in the US and Asia, as well as at a collection of University campuses across the US. An SDN network will interconnect these clusters, spanning the Internet2 backbone, the Innovation Platform that connects the campus networks to the

3 backbone, and top-of-rack switches that connect each cluster into the campus Science DMZ. Said another way, OpenCloud augments Internet2 s Innovation Platform to include virtualized clusters in addition to 100GigE and SDN connectivity. OpenCloud is built from open source software. OpenStack runs on the individual clusters and is used to create and provision virtual machines (VMs). ONOS, an SDN-based network operating system, runs across the Internet2 backbone, as well as each cluster, and is used to create and manage virtual networks (VNs). On top of OpenStack and ONOS, OpenCloud runs an open source service orchestration framework, called XOS, that makes it possible to create, name, operationalize, manage, and compose services as first-class operations. Finally, in addition to virtualized infrastructure, the OpenCloud pilot includes a demonstration building block service a Content Distribution Network (CDN) that the Internet2 community can use to accelerate delivery of existing University and Internet2 content, but it also serves as a building block for other value-added services, such as a multi-tier storage hierarchy and workflow orchestrators. The CDN, along with other example services that benefit from OpenCloud, are briefly described in the next section. Example Value-Added Services The key to building a successful value-added service is to identify functionality that benefits from being deployed across a wide footprint, with close proximity to end-users. This section identifies some examples, and explains how they would benefit from a widely distributed platform like OpenCloud. Scalable Delivery of Academic Content Content distribution networks (CDNs) a set of caches distributed across the network are a well-established mechanism for scaling content delivery (popular content is delivered from multiple end-points rather than a single origin server), improving the end-user experience (content is delivered from a nearby cache near rather than from a distant server), and minimizing transfers across slow or expensive links (cached content avoids upstream links). A pilot CDN running on OpenCloud has the potential to realize the same benefits. For example, content originating at US Universities can be delivered to remote campuses in Asia and the Middle East without traversing high-latency international links. Similarly, Internet2-hosted content with research or educational value can be delivered worldwide by taking advantage of caches deployed near commodity peering points. As another example, content hosted in commodity cloud storage can be cached across OpenCloud s footprint and delivered to widely distributed compute clusters without incurring the cost of reading it out of cloud storage. Finally, by extending the CDN s reach to community anchors (e.g., libraries, museums, hospitals), OpenCloud has the potential to deliver content to users with low-bandwidth connections to the backbone. Multi-Tier Storage Hierarchy Commodity cloud storage services like Dropbox, Box, and S3 are now commonly available, but they are not optimized (in terms of either performance or pricing) to support widespread collaborations or widely distributed computations. At the same time, there are a growing number of purpose-build scientific data repositories, but they often require scientists to become experts at data transfer, replication, staging, security, and consistency. In response to this situation, the pilot deployment of OpenCloud includes a value-added storage service that harnesses available storage components to provide a global, scalable, and secure data delivery platform. These existing components include public and private cloud stores (for data durability), network caches and content distribution networks (for scalable read bandwidth), and

4 local disks (for local reads/write performance). A scalable metadata service running in the commodity cloud implements data consistency, ensuring the caches deliver the most recent version of each file. This combination of commodity storage, network-wide caches, and local disks form a multi-tier storage hierarchy, which makes it possible for applications to access data independent of where it is stored. Doing so allows users to mount shared volumes into cloudhosted virtual machines (VMs), supports a scalable number of users, makes it easy to take advantage of cost/performance tradeoffs among multiple back-end storage providers, allows users to securely share files across organizational boundaries with minimal involvement, and makes it easy to integrate existing user workflows and datasets. This multi-tier storage hierarchy takes advantage of OpenCloud s widespread footprint in two ways. First, the CDN deploy across OpenCloud serves as the intermediate level of the storage hierarchy, putting cached content close to a scalable number of end-users (and the computational resources they use to process the data). Second, the solution deploys acquisition gateways across OpenCloud s footprint, importing (ingesting) data from existing data repositories into the hierarchy. The storage service also leverages OpenCloud s service orchestration framework to compose a combination of commodity and private services. Scientific Workflow Orchestration Managing scientific computations that involve widely distributed data and compute resources is a complex task. Sometimes the data needs to be moved closer to the computation and sometimes the computational tasks need to be moved closer to the data. A scientific workflow orchestration service could help with this task by virtualizing the three major components of a computation: Workflows (the processing steps needed to generate a result), Data Flows (the communication paths needed to move data between the processing tasks), and Data Collections (the context and arrangement associated with the data being processed). Abstracting and virtualizing these three components frees users from having to worry about the low-level details, including identity management, access control, mapping to physical resources, provenance, and so on. For example, a Workflow can be mapped to a collection of cloud resources, shared, re-executed, and published, with the provenance captured by storing the input files and input parameters. A Data Flow can be mapped to a specified virtual network, parallelized using disjoint network paths, or optimized by taking advantage of caches distributed across the network s footprint. A Data Collection can be mapped to a set of storage services, with the data distributed across multiple sites, discovered through descriptive metadata, and archived for long term preservation. Such an orchestration service directly benefits from OpenCloud s widely distributed resources (e.g., distributed caches and close proximity to edge storage and compute resources), as well as its ability to set up virtualized networks and data paths on demand. It also benefits from OpenCloud s support for service composition, with the individual micro-services that make up a scientific computation built by chaining together the individual tasks that make up the workflow. From VPNs to Secure Virtual Networks It is common for Internet2 member organizations to require their off-campus users to access protected resources via a Virtual Private Network (VPN). This typically involves the user first securely connecting to the home campus, and then indirectly accessing both local and remote resources from that anchor point. This indirect path is problematic when the set of communicating parties (and the resources they access) are widely distributed. All traffic has to flow through a central hub at the home campus. OpenCloud s global footprint is an ideal platform for an overlay-based VPN service. Users securely connect to the service at the nearest point-of-presence, and a network graph is constructed among all the sites participating in the VPN. Traffic to off-vpn resources flow

5 through the egress site closest to the destination. Both commercial and open source VPN services are available, and a prototype deployment is in progress on OpenCloud. Connecting users to a VPN usually happens in support of humans accessing web services, in which case a cloud-hosted overlay network is a practical solution. There is a similar situation involving high-performance computation distributed across multiple sites. Putting such computations on an isolated SDN-based virtual network (VN) is a preferred solution. OpenCloud clusters would provide ingress/egress for such a VN, with the underlying switches running across Internet2 s backbone and the per-campus Innovation Platform. OpenCloud would make it possible to acquire such a virtual network on demand. Decentralized Identity Management Different cloud services authenticate users with different sets of credentials. However, it is hard for users to keep track of many credentials, but insecure for them to use the same credential everywhere. While conventional SSO infrastructure can alleviate these concerns, maintaining it across an ever-changing set of users, services, and sites is a tedious, never-ending operational challenge. An emerging response to this situation is to run a decentralized identity management service that maintains a global, public, and consistent namespace of all users and services. It provides functionality similar to using LDAP for PKI by mapping an unchanging human-readable name to an identity record containing public keys. Unlike LDAP, the authenticity, integrity, and edit history of each record is checked against an external blockchain a globally distributed appendonly database that is easy to download and audit but computationally infeasible to alter or forge. Crucially, this identity service is not a trusted third party local users and service VMs validate identity records they receive against a site-local copy of the blockchain. OpenCloud is the ideal deployment platform for such an identity management service. Users only need to track one set of credentials (i.e. for managing their identity), and both users and services leverage it for authentication by using it to discover each other s up-to-date public keys. The solution offers backwards compatibility with existing SSO implementations (e.g. Shibboleth) by presenting itself as another identity provider option to SSO clients, and by hosting copies of the users existing certificates and security assertions as part of the user's identity record. Distributed Monitoring and Analytics OpenCloud s distributed footprint is an ideal platform for deploying performance monitoring and attack detection services. Rather than passively observing traffic and actively probing the network from a single observation point, a multi-site observatory e.g., running performance monitoring tools like perfsonar and attack analysis tools like Snort provides a more complete picture of the Internet s health. Computation-intensive analysis tools and analytics programs would then run on the available public and private clouds, processing the data collected from these edge sites. Data Reduction for IoT Although still an emerging area, there is a consensus that dense deployments of Internetconnected sensors and personal devices will generate substantial volumes of data that needs to be shipped to data centers for analysis. Edge-hosted OpenCloud resources can be leveraged in such scenarios to reduce the value of data through some combination of sampling and data reduction that needs to be transmitted back to centralized public and private clouds. IoT is an area that is ripe for innovation, and OpenCloud could be used to provide sandboxes for promising technologies.