Dr. Thomas Lumpp, IBM Deutschland Research & Development GmbH Cloud Resiliency IBM Corporation

Size: px

Start display at page:

Download "Dr. Thomas Lumpp, IBM Deutschland Research & Development GmbH Cloud Resiliency IBM Corporation"

William Glenn
5 years ago
Views:

1 Dr. Thomas Lumpp, IBM Deutschland Research & Development GmbH Cloud Resiliency 2009 IBM Corporation

2 Disclaimer This document represents the author's views and opinions. It does not necessarily represent IBM's position or strategy. 2

3 Contributor to this presentation Gerd Breiter, Distinguished Engineer, Cloud Architecture Juergen Schneider, Distinguished Engineer, TSAM Architecture Bernd Jostmeyer, Lead Developer System Automation Application Manager Isabell Schwertle, System Automation Development Dominik Brugger, Content Security Engineering 3

4 Agenda Part I: Introduction Introduction Resiliency for the Cloud Resiliency: Availability, High Availability, and Disaster Recovery Recovery Time Objective and Recovery Point Objective Part II: Cloud Resiliency High Availability of the Common Cloud Management Platform Excursus on High Availability Nomenclature and Classification Stateless Applications, Stateful Application types (Warm-Standby, Hot-Standby, Active-Active) High Availability of the Virtualized Infrastructure and Cloud Services 4

5 Motivation (or: Why should I listen to this talk?) IDC Survey: IT executives/cios and their line-of-business (LOB) colleagues about their companies use of, and views about, IT Cloud Services Enterprise Clouds require answers to these issues

6 Availability, High Availability and Disaster Recovery Availability Recover from HW failure and eventually recover from application failure No redundancy High Availability HW and/or SW Redundancy Resiliency scope of a single site (data center) Disaster Recovery Resiliency across data centers Typically implies data replication Stuttgart (Production) Böblingen (Backup)

7 Factors for High Availability Hardware Redundancy Hardware / Hypervisor Monitoring & Recovery Software Redundancy Coordinated Software Monitoring & Recovery Network Availability Data Resiliency HW/Hypervisor SW Large number of possible combinations

Business Relevance of Availability Commerce is handled over the internet and computing centers are growing At the same time businesses need to ensure that their systems are available 24/7 Downtime

8 Business Relevance of Availability Commerce is handled over the internet and computing centers are growing At the same time businesses need to ensure that their systems are available 24/7 Downtime can be directly translated into loss of revenue Average cost of 1 hour downtime: $ Popular examples are Amazon, Google and Ebay Usual customers also include Banks, Insurance Providers and Computing Centers Availability 90% 95% 99% 99.9% 99.99% 99,999% % Downtime per year 36.5 days days 3.65 days 8.76 hours 52.6 minutes 5.26 minutes 31.5 seconds

Recovery Time Objective, Recovery Point Objective, Network Recovery Objective Outage Up and running Point in time of last backup, snapshot, or replication Outage Recovery Time Objective Time delay

9 Recovery Time Objective, Recovery Point Objective, Network Recovery Objective Outage Up and running Point in time of last backup, snapshot, or replication Outage Recovery Time Objective Time delay between outage and recovered application Network Recovery Objective Recovery Point Objective RPO of 5 mins = in case of an outage the data of the last 5 mins could be lost TREND: RPO = 0 Time delay between outage and network availability

10 Part II: Cloud Resiliency 2009 IBM Corporation

Cloud Computing is a user experience and a business model Cloud computing is an emerging style of computing in which applications, data, and IT resources are provided as services to users over the

is a infrastructure management methodology Cloud computing is a way of managing large numbers of highly virtualized resources such that from a management perspective, they can be automatically

11 Cloud Computing is a user experience and a business model Cloud computing is an emerging style of computing in which applications, data, and IT resources are provided as services to users over the network. is a infrastructure management methodology Cloud computing is a way of managing large numbers of highly virtualized resources such that from a management perspective, they can be automatically aggregated to deliver services. Datacenter Infrastructure Monitor & Manage Services & Resources Resilient Cloud Services Access Services Service Consumers Resilient Virtualized Platform IT Cloud Cloud Resilient Cloud Administrator Management Platform Service Catalog, Component Library Component Vendors / Software Publishers Publish & Update Components, Service Templates IBM Corporation

12 Introduction to Cloud Resiliency Cloud Services User Interface API Business-Process-as-a-Service Software-as-a-Service Platform-as-as-Service Infrastructure-as-a-Service Resilient Cloud Services Today, cloud services are mostly offered with no Quality of Services (QoS) for resiliency this will change Virtualized Infrastructure Server, Storage, Network, Facilities Common Cloud Management Platform Service Delivery Portal API BSS Business Support System OSS Operational Support System Offering Mgmt Order Mgmt Accounting & Billing Contract Mgmt Service Templates Service Request Management Provisioning Monitoring & Event Management Customer Mgmt Entitlements Invoicing SLA Reporting Metering, Analytics & Reporting Service Delivery Catalog Service Automation Management Configuration Mgmt Incident, Problem & Change Management IT Asset & License Management Virtualization Mgmt Pricing & Rating Subscriber Mgmt Peering & Settlement Service Offering Catalog Image Lifecycle Management IT Service Level Management Capacity & Performance Management Service Development Portal Resilient Virtualized Infrastructure Very high resiliency requirements to prevent mass outage Failure of a single blade not as critical as the failure of a complete blade landscape Resilient Common Cloud Management Platform High resiliency requirements for the a) cloud management (OSS) b) cloud business application (BSS) Service Provider Portal Service Business Manager Service Transition Manager Service Operations Manager Security & Resiliency Service Security Manager 12

13 High Availability of Common Cloud Management Platform Cloud Services User Interface API Business-Process-as-a-Service Software-as-a-Service Platform-as-as-Service Infrastructure-as-a-Service Virtualized Infrastructure Server, Storage, Network, Facilities Common Cloud Management Platform Service Delivery Portal API BSS Business Support System OSS Operational Support System Offering Mgmt Order Mgmt Accounting & Billing Contract Mgmt Service Templates Service Request Management Provisioning Monitoring & Event Management Customer Mgmt Entitlements Invoicing SLA Reporting Metering, Analytics & Reporting Service Delivery Catalog Service Automation Management Configuration Mgmt Incident, Problem & Change Management IT Asset & License Management Pricing & Rating Subscriber Mgmt Peering & Settlement Service Offering Catalog Image Lifecycle Management IT Service Level Management Capacity & Performance Management Service Development Portal Resilient Common Cloud Management Platform High resiliency requirements for the a) cloud management (OSS) b) cloud business application (BSS) Virtualization Mgmt Service Business Manager Service Provider Portal Service Transition Manager Security & Resiliency Service Operations Manager 13

14 Sample Cloud Management Platform High Availability Considerations WebSphere DMGR TAM WebSphere TAM WebSphere Security (Authentification) Directory Server TDS WebSphere Edge Edge Svr WebSphere Edge Tivoli WebSEAL Tivoli WebSEAL HTTP Server Web Svr HTTP Server Tivoli WebSphere Access Manager Cloud Portal (TAM) WebSphere Cloud Portal Cloud UI WebSphere Cloud Portal WebSphere Cloud Portal Apache Tomcat Apache Tomcat TSAM Admin Server Maximo BSS TSAM Apache Active MQ Apache Active MQ TSAM Directory Server TDS DB2 Cloud Portal Cloud Portal DB DB2 Cloud Portal NFS NFS NFS 14

15 Excursus: Application types High availability for applications is highly dependant on the application type Two general distinctions: Stateless Application means there is no record of previous interactions and each interaction request has to be handled based entirely on information that comes with it. Example: WebServer with static Web Page Serving HA Impact: Can be started without reloading any state Stateful Application means the computer or program keeps track of the state of interaction, usually by setting values in a storage field designated for that purpose. Stateful applications should implement transactional behaviour and need to maintain a state to be recoverable without loosing significant value Example: Databases (ongoing transaction is a state), MQSeries HA Impact: Cannot be restarted without knowledge of the previous state (from an application point of view)

16 Excursus - High Availability for non-was based Applications/Components Stateless Application Application / Component Type Stateless Application Multiple Instances Warm Standby and Hot Standby (Stateful Application Component Single Instance) Active-Active (Stateful Application Component Single Instance) Recommendation No failover required Recommendation: Provides implicit HA by running multiple instances in parallel Warm-Standby (Type I) Recommendation: Use SA MP for Warm-Standby (Example: DB2 ) Hot Standby (Type II) Recommendation (for existing proprietary Hot Standby solutions): Use SA MP for split-brain resolution and automation (Example: DB2 HADR) Stateless Warm standby Hot Standby Active/Active (Type III) No failover required, implementation requires a very complicated, infrastructure to support data integrity and resiliency (e.g. DB2 pure Scale) Active Active Recommendation: Use SA MP for split-brain resolution and automation DB2 System I Web Web Web System I System II System III Warm-Standby System II DB2 HADR System I Active / Active DB2 DB2 DB2 Hot-Standby DB2 HADR System II System I System II System III 16

17 Excursus - High Availability for WAS based Applications/Components Singe WAS Instance Appl Application / Component Type Recommendation WAS Application runs in a single WebSphere Application Server instance Recommendation: Use SA MP to restart a failed component Example: Workload Scheduler Single WAS inst. System I System II J2EE Container-based J2EE containerbased (Application runs across multipe application server instances) Non-pure J2EE Component (Application runs across multipe application server instances) Type IV: J2EE container based Recommendation: If NFS V4 available Use WAS ND s embedded HA Manager Recommendation: Use SA MP to automate and restart failed components Example: CCMDB / Maximo Pure J2EE mutliple Inst. Non Pure J2EE mutliple Inst. Stateful Appl WAS Non-pure J2EE Stateful Appl WAS Appl J2EE container Appl Appl J2EE container WebSphere Cluster J2EE container HA Manager / SA MP Stateful Appl WAS System I System II System III DB2 System IV System V 17

18 Application type groups The application type determines the cluster setup. One active instance* at a time Warm standby Single WAS Instance Non Pure J2EE mutliple Inst. Group 1 (single instance) (No application awareness required) HA Cluster (also known as Failover Cluster) Hot standby Group 2 (Application awareness required) Application awareness required (but typically embedded in the application) Multiple active instances* at a time Stateless Active Active Pure JEE Multi Instance No application awareness required Group 3 (No application awareness required) Note: Active/Active and purejee require most often application awareness but this is typically embedded in application Workload Cluster (also known as Loadbalanced Cluster) * Active instance: Application instance that allows interaction, i.e. processing of user requests

19 Sample Cloud Management Platform High Availability Architecture WebSphere DMGR TAM WebSphere TAM WebSphere Security (Authentification) Directory Server TDS WebSphere Edge Edge Svr WebSphere Edge Tivoli WebSEAL Tivoli WebSEAL HTTP Server Web Svr HTTP Server Tivoli WebSphere Access Manager Cloud Portal (TAM) WebSphere Cloud Portal Cloud UI WebSphere Cloud Portal WebSphere Cloud Portal Apache Tomcat Apache Tomcat TSAM Admin Server Maximo BSS TSAM Apache Active MQ Apache Active MQ TSAM Directory Server TDS DB2 Cloud Portal Cloud Portal DB DB2 Cloud Portal NFS NFS NFS Application Types Group 1 Group 2 Group 3 Stateless Warm standby Hot Standby Active Active Cloud Resiliency Dr. Thomas Lumpp Single WAS inst. Pure J2EE mutliple 2009 IBM Corporation Inst.

20 Introduction to Cloud Resiliency Cloud Services User Interface API Business-Process-as-a-Service Software-as-a-Service Platform-as-as-Service Infrastructure-as-a-Service Resilient Cloud Services Today, cloud services are mostly offered with no Quality of Services (QoS) for resiliency this will change Virtualized Infrastructure Server, Storage, Network, Facilities Common Cloud Management Platform Service Delivery Portal API BSS Business Support System OSS Operational Support System Offering Mgmt Order Mgmt Accounting & Billing Contract Mgmt Service Templates Service Request Management Provisioning Monitoring & Event Management Customer Mgmt Entitlements Invoicing SLA Reporting Metering, Analytics & Reporting Service Delivery Catalog Service Automation Management Configuration Mgmt Incident, Problem & Change Management IT Asset & License Management Virtualization Mgmt Pricing & Rating Subscriber Mgmt Peering & Settlement Service Offering Catalog Image Lifecycle Management IT Service Level Management Capacity & Performance Management Service Development Portal Resilient Virtualized Infrastructure Very high resiliency requirements to prevent mass outage Failure of a single blade not as critical as the failure of a complete blade landscape Service Provider Portal Service Business Manager Service Transition Manager Service Operations Manager 20 Security & Resiliency Cloud Resiliency Dr. Thomas Lumpp Service Security Manager 2009 IBM Corporation

21 Resilient Cloud Services: Relevance for the Cloud Status Quo: Cloud Services are cheap, but not reliable* Trend Customers starting to move from pure development/test cloud usage to production usage As soon as business critical workload will be moved to the cloud, demand for robust, resilient and highly available cloud services will increase * Reliability is influenced by various parts, see later

22 Cloud Services with High Availability QoS Idea: Service provider offers cloud services with simplified High Availability QoSs (e.g. Basic, Premium, Deluxe) Customer does not necessarily need to understand the technical details Criterias of QoS for Cloud Service High Availability Detection and recovery from HW, hypervisor, or OS failure by... restarting OS image or failover OS image to another running hypervisor Detection and recovery from application failure Introduce Redundancy (HW/SW) according to requested High Availability QoS (gold,...) E.g. select appropriate application type (warm standby, hot standby, active-active,...) (note: data is not in scope) 22

23 Cloud Services with High Availability Quality of Service Core Concept: Many Factors for High Availability Cloud Service Developer HA Descriptor creates Instance of Application Image simplify and map HA Middle ware VM DB2 HA Middle ware VM DB2 Cloud Service Consumer request and consume SaaS PaaS Map Levels to Specific Cloud Services Private or Public Cloud IaaS Compute provisions monitors 23 Cloud Service Provider

24 Four Levels of High Availability for an Application in the Compute Cloud (IaaS) 1) Economy: No Recovery 2) Advanced: Automatically Restart Compute Cloud Instance 3) Premium: Automatically Restart Compute Cloud Instance and Monitor/Restart Application 4) Deluxe: Use Cluster Technology: Failover Cluster with Active / Standby Setup or Load Balanced Cluster for Active / Active Type Applications Hardware / Hypervisor Monitoring & Recovery Coordinated Software Monitoring & Recovery Hardware Redundancy Software Redundancy Each level inherits the functionality of the previous levels Economy No Recovery Basic Restart Instance Premium Restart Instance and Monitor/Restart application Deluxe Full Redundancy No Availability Availability Availability High Availability 24 RTO = n/a RPO = 0 RTO = minutes RPO = 0 RTO = minutes RPO = 0 RTO = 0 - minutes RPO = 0

25 Basic High Availability Level Restart Instance Failure: VM dies Cloud Service Provider restarts VM including application from Image Application is restarted by Cloud Service Consumer or OS VM1 A1 Application Image with HA VM failure can be caused by: Guest OS failure HW failure Hypervisor failure user data 25 Economy No Recovery Basic Restart Instance Premium Restart Instance and Monitor/Restart application Deluxe Full Redundancy No Availability Availability Availability High Availability

26 Premium High Availability Level Restart Instance App Monitored Failure: Application dies Application is restarted by HA Component provided by Cloud Service Provider If restart attempt fails, VM including application from Image is restarted and application is restarted by HA Component provided by Cloud Service Provider VM1 A1 Application Image with HA user data 26 Economy No Recovery Basic Restart Instance Premium Restart Instance and Monitor/Restart application Deluxe Full Redundancy No Availability Availability Availability High Availability

27 Deluxe High Availability Level Use Cluster Technology Remember: Application type determines cluster type. Use either HA cluster or workload cluster There must be a description of the required workflows of the cluster setup depending on the application type: 27 Economy No Recovery Basic Restart Instance Premium Restart Instance and Monitor/Restart application Deluxe Full Redundancy No Availability Availability Availability High Availability

28 Deluxe High Availability Level HA Cluster VM1a VM1b A1 A1 Failure: A1 dies in VM1a Recover A1 in VM1b by HA Component provided by Cloud Service Provider Failure of VM1a (HW, Hypervisor and OS) is also covered user data 28 Economy No Recovery Basic Restart Instance Premium Restart Instance and Monitor/Restart application Deluxe Full Redundancy No Availability Availability Availability High Availability

29 Deluxe High Availability Level Workload Cluster The concept of load balancing and scaling can be leveraged to provide High Availability. For High Availability, nodes need to be distributed across independent hardware resources Different levels of High Availability can be achieved by using different thresholds of service utilization that trigger scale out (or scale in respectively). To achieve Deluxe level, a large enough number of spare instances need to be provided at any time (e.g. factor 2). 29 Economy No Recovery Basic Restart Instance Premium Restart Instance and Monitor/Restart application Deluxe Full Redundancy No Availability Availability Availability High Availability

30 Matching Application Types to QoS Levels Application Types (HA Excursus) can be mapped to HA QoS Levels: Economy No Recovery Basic Restart Instance Premium Restart Instance and Monitor/Restart application No Availability Availability Availability High Availability RTO = n/a RPO = 0 RTO = minutes RPO = 0 RTO = minutes RPO = 0 RTO = 0 - minutes RPO = 0 Deluxe Full Redundancy Single Instance HA Cluster Warm standby Single WAS Instance Warm standby Single WAS Instance Hot standby Workload Cluster without spares Workload Cluster with spares Stateless Active Active Pure JEE Multi Instance Stateless Active Active Pure JEE Multi Instance 30

31 From IaaS Compute Cloud Resiliency To PaaS/SaaS Resiliency The concept designed for IaaS can be mapped to PaaS and SaaS Even more IaaS HA components can be used to build composite PaaS and SaaS offerings SaaS SaaS SaaS PaaS PaaS PaaS IaaS Compute IaaS Compute IaaS Compute IaaS Compute IaaS Compute IaaSComputeIaaS

32 Summary HA QoS Levels for all Cloud Services Economy Basic Premium Deluxe - no recovery of HW/OS failure - no application awareness - no redundancy required (single instance) - Restart OS image after HW/OS failure - no application awareness - no redundancy required (single instance) - Restart OS image after HW/OS failure - Recover from application failure - no redundancy required (single instance) - Restart OS image after HW/OS failure - Recover from application failure - HW/SW redundancy No Availability Availability Availability High Availability SaaS n/a Use Basic (or higher) PaaS and/or IaaS Components Use Premium (or higher) PaaS and/or IaaS Components Use Deluxe (or higher) PaaS and/or IaaS Components or use Premium Level PaaS fully redundantly PaaS n/a Use Basic (or higher) IaaS Components Use Premium (or higher) IaaS Components Use Deluxe (or higher) IaaS Components IaaSComputeIaaS Left alone OS IaaS Image Instance RTO = n/a RPO = 0 Restart IaaS Image Instance RTO = minutesor n/a? RPO = 0 Restart IaaS Image Instance and Monitor Application RTO = minutes (improved to Basic) RPO = 0 Redundancy Cluster RTO = 0 - minutes (improved to Premium) RPO = 0

33 Summary Due to the complexity of cloud environments, different strategies need to be applied Resiliency for the virtualized infrastructure Resiliency for the cloud management part Resiliency for the services offered in a cloud Resiliency for cloud services needs to be easily adoptable and complexity needs to be hidden from the customer

34 Thanks 2009 IBM Corporation

Our Own Experience: How IBM is using Cloud

Our Own Experience: How IBM is using Cloud Desmond Koh Putting a Price Tag to Cloud: Chargeback and Metering 7th October, 2010 The Value of Cloud Computing to the User and the Enterprise Improve Business