RED HAT ENTERPRISE LINUX 7 AND SATELLITE 6 TECHNICAL OVERVIEW Uzoma Nwosu Solutions Architect, Red Hat September 24, 2014 1
AGENDA 2 1 RED HAT ENTERPRISE LINUX 7 INTRODUCTION 2 LIGHTWEIGHT APPLICATION ISOLATION 3 WINDOWS INTEROPERABILITY 4 FILE SYSTEMS AND STORAGE 5 OPTIMAL PERFORMANCE MANAGEMENT 6 INSTALLATION AND DEPLOYMENT
AGENDA (cont.) 3 7 SYSTEM MANAGEMENT AND FEATURES 8 VIRTUALIZATION 9 DESKTOP AND DEVELOPER FEATURES 10 SUMMARY
RED HAT ENTERPRISE LINUX 7 INTRODUCTION 4
RED HAT ENTERPRISE LINUX 7 REDEFINING THE ENTERPRISE OS FLEXIBILITY to quickly adapt to demands for business agility STABILITY to efficiently meet challenges of datacenter virtualization and cloud CERTAINTY of mission-critical reliability and militarygrade security 90% OF FORTUNE 500 COMPANIES TRUST RED HAT ENTERPRISE LINUX FOR THEIR CRITICAL BUSINESS INFRASTRUCTURE. 5 RED HAT CONFIDENTIAL PLATFORM PRODUCT MARKETING
RED HAT ENTERPRISE LINUX 7 BASICS 6 Based on Fedora 19, the upstream kernel version 3.10 and over 4000 patches (additional features, bugfixes, security errata) Supported hardware architectures: Intel/AMD 64-bit (x86_64) IBM POWER IBM System z Support for 32-bit applications enabled via inclusion of 32-bit libraries (multilib).
STABLE AND EFFICIENT FLEXIBLE RED HAT ENTERPRISE LINUX 7 HIGHLIGHTS LIGHTWEIGHT APPLICATION ISOLATION (LINUX CONTAINERS) WINDOWS INTEROPERABILITY SCALABLE FILE SYSTEMS OPTIMAL PERFORMANCE VIA PROFILES STREAMLINED INSTALLATION AND DEPLOYMENT SYSTEM MANAGEMENT AND FEATURES CERTAINTY OF MISSION-CRITICAL RELIABILITY AND MILITARY-GRADE SECURITY 7
LIGHTWEIGHT APPLICATION ISOLATION via LINUX CONTAINERS 8
LINUX CONTAINERS Software packaging concept that typically includes an application and all of its runtime dependencies. 9 Easy to deploy and portable across host systems Isolates applications on a host operating system. In RHEL, this is done through: CONTAINER APP LIBS Control Groups (cgroups) kernel namespaces HOST OS SELinux, svirt SERVER
CONTAINERS ENABLE CONTINUOUS DELIVERY HOST OS SERVER APP LIBS CONTAINER CONTAINER APP LIBS HOST OS DEVELOPMENT FOCUS SERVER OPERATIONS FOCUS CODE APPLICATIONS LIBRARIES AND OTHER DEPENDENCIES DATA STORE 10 HARDWARE OPERATING SYSTEM NETWORKING MONITORING
CONTAINERS IN RED HAT ENTERPRISE LINUX 7 Identical Containers Non-identical Containers RHEL 7 Runtime Host Containers Image-based Containers Red Hat Enterprise Linux 7 RHEL 6 RHEL 7 RHSCL Fedora Docker format RHEL 7 supports both host containers (RHEL 7 carved into secure containers) and imagebased containers using Docker format Linux containers can be deployed in baremetal or virtual environments RHEL 7 supports both Virtualization with KVM and Application Isolation with Linux Containers 11
IMAGE -BASED CONTIANERS WITH DOCKER TECHNOLOGY App Layer Platform Image Layered Image 2 App A SCL 1 RHEL 7 Runtime App B SCL 2 RHEL 6.5 Runtime App C SCL3 RHEL6.6 Runtime Layered Image 1 Platform Image RHEL 7 Container Host RHEL 7 Container Host provides the capability to run images built with Docker format for content distribution RHEL runtimes and application dependencies built into a Docker image and run inside the container 12
WINDOWS INTEROPERABILITY 13
WINDOWS INTEROPERABILITY VIA DIRECT INTEGRATION MICROSOFT ACTIVE DIRECTORY Easily connect a Red Hat Enterprise Linux client to an existing Windows domain with realmd. SSSD RHEL 14
WINDOWS INTEROPERABILITY VIA INDIRECT INTEGRATION MICROSOFT ACTIVE DIRECTORY IDENTITY MANAGEMENT ALLOWS FOR EASIER CENTRALIZED NATIVE LINUX MANAGEMENT OF MULTIPLE LINUX CLIENTS TRUST SSSD RHEL 1 Source: Research by TechValidate: www.techvalidate.com/product-research/red-hat-enterprise-linux 15
FILE SYSTEMS AND STORAGE 16
CHOICE OF FILE SYSTEMS Scale file systems to 500TB with new default filesystem XFS Scale to 50TB with ext4 Btrfs also available1 Parallel NFS v4 provides improved performance and throughput Type Supported Limit Root Boot Comments Single-node XFS 500TB Yes Yes System default ext4 50TB Yes Yes Driver allow access to older versions (ext2, ext3). btrfs2 50TB Yes Yes Network/Multi-node GFS2 1 2-16 nodes Yes No Shared-storage file system Available as a Technology Preview 17
FILE SYSTEMS CRC32 checksums for XFS and ext4 reduce file system repair times ext4 improvements include: 18 Faster access for small files More efficient use of the underlying block storage with the help of punch hole technology ext2 and ext3 volumes supported using ext4 driver
FILESYSTEMS Network File System (NFS v4.x) features include: 19 Enhanced support for scale-out storage through parallel NFS (pnfs) Integration of fine-grained SELinux context with the help of Labeled NFS Enables FedFS (Federated File System), a set of open protocols that permit construction of a namespace accessible to unmodified NFSv4 clients Improved performance as sessions are better managed between the client and server Firewall friendly with the help of more deterministic port usage
FILE SYSTEMS Global File System (GFS2) improvements include: 20 Better scalability and performance as tools are now aware of device topology and handle RAID stripe alignment, placement of journal and resource groups more efficiently. Improved journaling. Integrated profiling with Performance Co-Pilot with the introduction of a GFS2 module for PCP. Samba v4.1 includes support for SMB 3.0 protocol resulting in better performance and security.
STORAGE 21 Premier support for enterprise storage arrays. Scalable storage stack supporting large scale configuration. Implementation of LVM snapshots based on thin provisioning. Storage allocated only when needed. Faster performance for recursive snapshots.
STORAGE Easy storage configuration with the introduction of System Storage Manager. Support for tiered storage for improved performance. 22 Provides easy to use command line interface for configuration of file and storage. Reduces the learning curve for junior system administrators. New target dm-cache that allows high-speed solid state drives (SSD) to serve as a cache for slower rotational media. New and improved software-based iscsi target mode (RFC-3720). Implemented in the kernel compared to older implementation which was in user-space.
STORAGE Dynamic detection of new LUNs. Reduces the amount of system down-time and manual intervention. LibStorageMgmt * provides the ability to manage external storage devices from the RHEL system. Simplified provisioning of storage volumes on Linux shared storage appliance with the help of a new service called targetd. Unified management of btrfs and LVM snapshots with the introduction of snapper. Allows administrators to create, delete, label and compare snapshots of volumes. * Technology Preview 23
OPTIMAL PERFORMANCE MANAGEMENT AND TOOLING 24
PERFORMANCE ENHANCEMENTS WITH RED HAT ENTERPRISE LINUX 7 BUILT-IN PERFORMANCE PROFILES SIMPLIFY CONFIGURATION 25 MONITORING WITH PERFORMANCE CO-PILOT AND THERMOSTAT FINE-TUNE PERFORMANCE WITH ENHANCED TOOLING VIA TUNA AND TUNED
OPTIMAL PERFORMANCE VIA PROFILES Optimal performance management via enhanced performance tuning at install, simplified instrumentation and tuning features, and performance monitoring tooling PERFORMANCE CO-PILOT (PCP) 26 THERMOSTAT (FOR JVMs)
PROFILING AND MONITORING WITH TUNA Tool for fine grained control Display applications / processes Displays CPU enumeration Socket (useful for NUMA tuning) Dynamic control of tuning 27 Process affinity Parent & threads Scheduling policy Device IRQ priorities, etc
SOLID PERFORMANCE ACROSS WORKLOADS RHEL 7 VS RHEL 6.5 PERFORMANCE GAINS ACROSS WIDE RANGE OF WORKLOADS AND MULTIPLE GENERATIONS OF HARDWARE RHEL 6.5 NETWORK CPU ERP MEMORY NORMALIZED PERFORMANCE (%) OLTP ANALYTICS COMMERCIAL DB 140 120 RHEL 7 OLTP JAVA OPEN SOURCE DB SERVER SIDE PARITY + 1% + 2% + 8% + 10% + 11% + 13% + 25% 2 x Intel Xeon Processor 5600 series 4 x Intel Xeon E7 v2 family 2x Intel Core i5 family 2 x Intel Xeon Processor 5600 series 2 x Intel Xeon Processor 7500 series 2 x Intel Xeon Processor 5600 series 2 x Intel Xeon Processor 5600 series 4 x Intel Xeon Processor 7500 series 100 80 60 40 20 0 28
STREAMLINED INSTALLATION AND DEPLOYMENT 29
STREAMLINED INSTALLATION AND DEPLOYMENT 30 SPEED DEPLOYMENT WITH SERVER PROFILES IN-PLACE UPGRADES FROM 6.X TO 7 PRIORITIZE CRITICAL SERVICES AT START-UP EASILY CREATE CUSTOM INSTALL IMAGES SAFELY ROLL-BACK DURING INSTALL DRAMATICALLY SPEED START-UP TIMES
EASILY CREATE CUSTOM INSTALL IMAGES WITH ANACONDA AND KICKSTART RHEL 7 introduces the ability to create, install and manage custom images for physical, virtual and cloud deployments Live Media Creator Content Sources (Repositories) 31 Custom Image This is alongside existing capabilities to create yum repositories Install and manage images using the same anaconda and Kickstart code used for bare metal installs Automate custom images using Kickstart
Installation and Deployment 32 Software selection provides pre-configured package selections for quicker deployment. Spin custom installable images and Live images with the help of Live Media Creator. Provision of system rollback at install time. Customers doing a Kickstart installation and using LVM can reserve a specific size or percentage of their volume group for rollback or snapshots
Software Selection Example: Infrastructure Server 33 Red Hat Confidential
CENTRALIZED MANAGEMENT AND FASTER BOOT UP CENTRALLY MANAGE PROCESSES, SERVICES, SECURITY PRIORITIZE AND ORDER SERVICES AT START-UP DRAMATICALLY SPEED START-UP TIMES COMPATIBLE WITH EXISTING SCRIPTS (SYSV AND LSB) Next generation system and service manager, systemd, provides on-demand service start-up and better transactional dependency. 34 Compatible with SysV and LSB init scripts.
EASIER INSTALLATION AND DEPLOYMENT IN-PLACE UPGRADES FROM 6.X TO 7 1 PRE-UPGRADE ASSISTANT Audits current OS state vs RHEL 7 profile and creates: preupg UPGRADE TOOL HTML report of potential issues DIRECTORY of config files for modification redhat-upgradetool POST-INSTALL script to be run by user after upgrade RED HAT ENTERPRISE LINUX 6.5 RED HAT ENTERPRISE LINUX 7.0 IF REPORT IS ACCEPTABLE See documentation for valid configurations 35 2 Red Hat Confidential
SYSTEM MANAGEMENT AND FEATURES 36
SYSTEM MANAGEMENT VIA OPENLMI Open standards-based management framework for low-level system configuration Unified management tools and system-wide resource management allow users to streamline administration Supports traditional Linux tools: CLI, scripts & SW tools Example: create 5 drive RAID5 array on remote server example.com: lmi -h example.com storage raid create name=r1 5 sdb sdc sdd sde sdf 37 MANAGEMENT SYSTEM PYTHON SCRIPTS LMI SHELL PYTHON CUSTOM APPS JBOSS SHELL SCRIPTS C/C++ JAVA CLI OpenLMI Client Interface Libraries MANAGED SYSTEMS OpenLMI Object Broker NETWORK STORAGE USERS SERVICES SECURITY SOFTWARE SYSTEM CONFIG OTHER AGENTS MONITOR
NETWORK MANAGEMENT NetworkManager Easy to use yet comprehensive network management suite designed to provide painless network configuration. Flexible interface options with GUI, (new) CLI, and (new) TUI for managing local, remote, or even headless systems. Supports a broad array of many common network interface types, including: 38 Eliminates the need to manually edit network configuration files by hand. Ethernet, IPoIB, VLANs, Bridges, Bonds, Teams, WiFi, WiMAX, WWAN, Bluetooth, VPN, and ATM-based DSL.
NETWORK FEATURES Team Driver Mechanism for bonding multiple network devices (ports) into a single logical interface at the data link layer (L2) Alternative to the existing Linux Bonding driver Provides an increase in maximum bandwidth and link redundancy Provides a number of advantages over traditional bonding while providing equal or even slightly better performance in some cases. Implemented mostly in user space with only the necessary data fast-paths in the kernel. Moves most of the work and logic into a user space daemon making it: more stable easier to debug much simpler to extend eth0 Server Server team0 eth1 39 Network Network Switch Switch
NETWORK FEATURES 40G Ethernet (IEEE 802.3ba) Support for 40G Ethernet link speeds enabling faster network communication for applications and systems. Highly accurate network time synchronization using: Precision Time Protocol (IEEE 1588v2) Enables faster clock synchronization with better accuracy than ntpd especially in cases where network connectivity is not always constant. Numerous TCP optimizations and enhancements aimed at reducing overall latency for connection oriented services such as web servers, including: 40 Capable of achieving clock accuracy in the sub-microsecond range when used in conjunction with PTP hardware support. Chrony Method for precisely synchronizing distributed clocks. Fast Open, Tail Loss Probe (TLP) Algorithm, Early retransmit (ER), Proportional Rate Reduction (PRR), Busy Poll (Low Latency Sockets)
SECURITY FEATURES 41 Filtering of system calls for additional security (seccomp). Also relevant for virtualization (svirt). Fine-grained control for controlling application access to sensitive cryptographic information (key tabs) with the introduction of GSSProxy. Compliance with the trusted computing standards (TNC) that require a health-check prior to joining the network.
SECURITY FEATURES New dynamic and protocol independent firewall service, firewalld, provides greater flexibility over traditional iptables. Eliminates service disruptions during rule updates. Supports different network trust zones for per-connection firewall settings. 42 Unified firewall management service for IPv4 (iptables), IPv6 (ip6tables), and Ethernet Bridges (ebtables). Simple yet powerful XML-based configuration file format with nearly 50 built-in pre-defined settings for many common system services. Easier analysis of log files with the help of structured logging that provides additional context in the logs. Extension of SELinux access controls to NFS with the help of labeled NFS.
HIGH AVAIALBILITY FEATURES Simplified cluster management : 43 Reduced number of software components Ability to clone resources streamlines deployment across nodes. Addition of fine-grained monitoring for components which include core deamons, fence agents, system services. All aspects of the infrastructure are treated as a service. Consistent cluster management experience between two major releases (Red Hat Enterprise Linux 6 and 7).
HIGH AVAIALBILITY FEATURES Better cluster resource management with the introduction of Pacemaker. 44 No longer necessary to edit configuration files directly. Policy engine now allows the cluster to manage both virtual guest(s) and the applications contained within those guests.
VIRTUALIZATION 45
VIRTUALIZATION PERFORMANCE Best SPECvirt_sc2013 Scores by CPU Cores Red Hat claims the top 5 SPECvirt_sc2013 benchmark results All SPECvirt_sc2013 benchmark results published as of June 2, 2014. SPEC is a registerd trademark and SPEC virt is a trademark of the Standard Performance Evaluation Corporation. For more information about the benchmark and the results, see http://www.spec.org/virt_sc2013/. 46
VIRTUALIZATION ENHANCEMENTS Red Hat Enterprise Linux as a virtualization host (KVM) Higher network throughput via multi-queue NIC support in guests Dedicated access of select NVIDIA GPU devices to guests Guest integration for VMware vsphere 47 Stronger cryptography with secure para-virtualized random number generation (virtio-rng) Open-VM-Tools bundled in this release
VIRTUALIZATION ENHANCEMENTS RHEL7 enables Para-Virtual Random Number Generator (RNG) 48 Provide improved randomness in the guest for cryptographic purposes RHEL with KVM feeds entropy to the virtual machines Helps alleviate entropy starvation in guest
VIRTUALIZATION ENHANCEMENTS Virtual Machine Guest OS Application Graphics driver QEMU VFIO Compatible with Nvidia Quadro K5000, Nvidia GRID K1/K2 KVM RHEL Kernel GPU card 49 RHEL7 with KVN enables dedicated GPU passthrough access to a single VM
DESKTOP AND DEVELOPER FEATURES 50
EASE OF USE: CHOICE OF DESKTOPS GNOME CLASSIC (DEFAULT) Familiar and intuitive More traditional look and feel Preserves investments in training 51
EASE OF USE: CHOICE OF DESKTOPS GNOME 3 (GNOME SHELL) 52 ELEGANT AND INTUITIVE USER INTERFACE FOCUS ON END-USER PRODUCTIVITY
EASE OF USE: CHOICE OF DESKTOPS KDE V4.10 53 AN ALTERNATIVE TO GNOME FOR USERS WHO PREFER KDE
DEVELOPER FEATURES Build and concurrently install multiple versions of custom software using scl-utils. Access to updated versions of compilers, debuggers, and related tools (gcc-4.8, gdb-7.6, etc.), providing enhanced support for parallelism and concurrency and extensive new optimizations. Support for the latest version of Java with OpenJDK 7 54 To profile and compare performance across multiple JVMs, users can now install different minor versions of Java 7 (e.g. OpenJDK7 u40 and OpenJDK7 u45) in parallel, with the default version selectable through alternatives.
SATELLITE 6 55
WHAT IS RED HAT SATELLITE 6? New modern design, cutting-edge open source software Designed for software life cycle (SLC) management Bare metal, virtual machine (VM) and cloud deployment Configuration management 56 Provisioning Repository management Content/life cycle management Subscription management
RED HAT SATELLITE 5 & 6 CORE CAPABILITIES Provision systems Configuration management Automated software distribution Life cycle management* Drift reporting * Satellite 5 provided Life cycle Management via channel-cloning. 57 Provision to bare metal, private, and public clouds Declarative configuration management Automated software distribution Life cycle management Drift remediation Simplified content management Federated services and management Localization
WHAT ELSE COMES IN THE BOX? Red Hat Satellite 6 Server Multi-tenant User and group role-based access control (RBAC) with external directories Powerful graphical user interface (GUI), command-line interface (CLI), and application programming interfaces (API) Advanced subscription management 58
WHAT ELSE COMES IN THE BOX? Red Hat Satellite 6 Capsule Server Federated services Automated provisioning Everything but the user interface (UI) Evolution of Red Hat Satellite Proxy 59
RED HAT SATELLITE 6 HI Satellite 6 Capsule: 1 Phoenix Satellite 6 Server Boston 60 Satellite 6 Capsule: 2 San Francisco
LIFE CYCLE MANAGM Library Dev Systems administrator 61 Prod QA Systems administrator Systems administrator
GRANULAR CONTENT MANAGMENT Content view e.g. Red Hat Enterprise Linux 7 e.g. Web server e.g. Red Hat JBoss Middleware 62 Composite content view e.g. SOE for web Environment e.g. Production e.g. Development
CONTENT LIFE CYCLE MANAGMENT Library Dev Systems administrator 63 Prod QA Systems administrator Systems administrator
PROVISIONING How to build a system from start to finish PARTITION TABLE KICKSTART FILE SUBNET/DOMAIN ACTIVATION KEYS PUPPET CLASSES Content OS & packages Puppet modules Host Group 64
PROVISIONING AND CONFIGURATION TOPOLOGY DNS, DHCP, TFTP Customer infrastructure Red Hat Satellite Capsule Mirrored content Puppet master Provisioning orchestration 65 Managed host Puppet agent
DISCOVERY Auto-identification of non-provisioned hosts Metal-as-a-Service Satellite 6 Facts DB 66 Satellite 6 Capsule Server DNS, DHCP, TFTP Customer infrastructure Datacenter
SUBSCRIPTION MANAGEMENT Subscription accounting (even virtualized) End-to-end subscription consumption visibility Built-in reporting engine 67
GUI, API, CLI Modern architecture API-first Enables advanced integration 68
TRANSITION Red Hat Satellite 5 Server 69 Transition application Red Hat Satellite 6 Server
RED HAT SATELLITE 6 ROADMAP Managed Design Program ('MDP') High-touch, early (alpha) stage customer program MDP1: First Satellite 6 Experience - Completed in August 2013 MDP2: Puppet Ecosystem - Completed in February 2014 Beta program: Planned for July, 2014 Public beta for all Satellite customers, closed beta for a high-touch select group General release of Red Hat Satellite 6: Planned for September 2014 70
NEW FEATURES & WHAT'S PLANNED FOR 6.1 Red Hat Satellite 6, September 2014 Content sync from GIT repos Host group deployable on: Bare metal, Red Hat Enterprise Virtualization, VMware, KVM, Amazon EC2, & OpenStack Nested locations Northeast/Datacenter2/Pod2/Rack3 Centralized capsule management IDM & Active Directory integration Plug-in architecture enables on-site modular customization 71 Red Hat Satellite 6.1, early 2015 Splice graphical reporting Consumption reporting Unified dashboards Registration and config state MCollective for remote execution Host group deployable on: Google Compute Engine, Rackspace CloudForms integration Bare-metal use cases
THANK YOU 72