Ceph Cephalocon Barcelona 2019, 24 May 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Rapid Design and Effective Operating of a General Purpose Object Storage at RWTH - Jonas Jansen

Description

Rapid Design and Effective Operating of a General Purpose Object Storage at RWTH Aachen University - Jonas Jansen, RWTH Aachen University

Collaborative, we started our S3 object storage design using Ceph together with four other partners (DUE, RUB, TU Dortmund, Univ. of Cologne), to build a disaster resilient storage. Since this was our first contact with this technology, our primary intention was to enable stakeholders to outline their needs in reliable metrics.

During the process, we added NAS storage resources. We did several setups, resulting in poor performance. Now are evaluating iSCSI gateway and Windows fileservers.

We developed compliance guidelines to ensure prompt delivery and availability within high-security standards and minimized costs.

These focus on:
Resiliency, by geo distributed setup
Efficiency, by erasure coding
Security, via automated testing and patching
Compliance and reduction of (human) workload, by automation and continuous delivery
High availability, by eliminating any single point of failure

About Jonas Jansen
RWTH Aachen, IT Center
IT Systemadministrator
Aachen, Germany
Jonas Jansen is the technical head of the Backup and Archive team at the IT Center. Since 2018, he is managing the object storage project, performed by the Server and Storage (SuS) group (which Backup and Archive is part of). SuS is a mainly hardware focused operation group running all centralized server and storage systems.

His career as system administrator started in 2014. Since 2015, he is with the RWTH Aachen. Within his current position, he is facing the rapidly growing demand for storage and compute resources every day, and meets those demands by frequent research for, and evaluation of new technologies. His tasks include the transfer of those technologies, like OpenStack Cloud or automation tools like Puppet or Ansible, into the daily routines for the whole team. Of course this needs to be done besides maintaining the stability of legacy technologies like tape libraries and modern infrastructure like virtualization clusters.

A

Hello, everybody, my name is Jana Johnson I'm from the are wth University and I'm gonna. Add you bit about our findings, how to rapidly design and effectively operate safe cluster and yeah we're gonna start with the resiliency you like to reach, and the first important thing is to use multiple data centers. We are using for data centers and important thing. If you have the ability to use multiple data centers, you need a dark, fiber or some kind of high-speed connectivity in between those data.

A

Centers next thing is you need to take account of the probe appropriate trash here hierarchy levels in your trash map. If you, when you design it first, because if you like to scale later, maybe you add rows or something in your data center and it's hard to put it in at the later point of the veil of scaling and art, you also, you should take account of the failure. To means of you know it's a good calculation point is one singer.

A

Note should never be more than nine percent of the of your classic capacity, but also think about the other things that can fail and ones. Next thing is the efficiency of course. The most important thing when, when it comes to efficiency, is use of erasure coding. If you have not that latency critical application, like most s3 storage, but you have to take into account, you cannot use a racial coaching for all proposals like the index pool of your f3 storage.

A

Also important thing blue store is much I owe a fish, more III, efficient, then Phi store and, of course, you have to take an account of cost-efficiency.

A

So you can think about what kind of parts of your notes needs really need to be redundant? Do we really need to have redundant OS disks? Do you really need to have redundant network ports or PS use.

A

Now we are looking at compliance and workload reduction. First of all, you should have a configuration management tool like and zaboo. I think self and zaboo is a great project. You can start off and you should also use your configuration management tool to automate your operating system updates, so you can do them regularly and in a fast manner.

A

Also, everyone should have a good test environment, especially for kind of proposals like updates or changes in your infrastructure as code, and, of course you need to keep your test environment up-to-date, so it behaves the same like your production environment, yeah I'm already mentioned the infrastructure. As code like the answerer play box and configuration I highly recommend to use a version control system like it to keep them version, so you can always see who has changed and when has been changed.

A

What and what may have caused this behavior of our environment, of your environment and last thing for compliance is: do not fix your node installations, just reinstall them most time when you fix an operating system or something it gets non-compliant. So do reinstall have a clean start, and mostly this works.

A

Coming to you secured, we recommend always to do an automatic patching, so this speeds up remediation of security floors and if you have your test environment patch on a regular schedule automatically, you can react really really fast to deploy your security patches to your production environments. Next important thing about security is to split your gateway network from the public network of your cluster, because this way you can do more restrictive firewalling to your gateways and also, if the gateways get compromised, then not that near to your cluster.

A

Next thing is: do security tests we have directory boots like the Mozilla Observatory, so you can test your configuration of your gateways. Most of us I think have a reverse proxy in front of him. Like HF proxy.

A

You can mess up a lot of the country of your confirmation in these tools and also there are situations where something goes wrong with your TLS certificates, so check them on a regular base. They check if they are not expired or maybe and they haven't if they have changed most important thing about security, is collect your locks and combine them collect, especially from the gateways. Combine them with network facilities, so you can have a complete view on all components that are included in the attack vector of the network attacker and last.

A

Why we? Why I think we were fast in our design? It's because Seth is ready for production. If you put it, if you pull it from the repositories, we set up safe as we set up every normal of the chef's storage software, and it worked great also because F is scalable, one can choose a medium size of set up in every means, and then you can have a look at what performance bottlenecks do you have and you can scale up at these points?

A

Maybe you need to add CPU or rum or something areas and least most default configurations of safes are great and you can use them okay, and that's all for me. So thank you for attending and if you can't Reston's can ask them afterwards or send me an email. Thank you.