Presentation is loading. Please wait.

Presentation is loading. Please wait.

Microsoft Azure Cloud Platform an overview CSCI E-90 Cloud Computing Zoran B. Djordjević Harvard University November 14 th, 2014 (5:30 – 7:30) Boston Azure.

Similar presentations


Presentation on theme: "Microsoft Azure Cloud Platform an overview CSCI E-90 Cloud Computing Zoran B. Djordjević Harvard University November 14 th, 2014 (5:30 – 7:30) Boston Azure."— Presentation transcript:

1 Microsoft Azure Cloud Platform an overview CSCI E-90 Cloud Computing Zoran B. Djordjević Harvard University November 14 th, 2014 (5:30 – 7:30) Boston Azure User Group Bill Wilder Bill Wilder

2 My name is Bill Wilder Bill Wilder

3 Who is Bill Wilder?

4 Reality is Resource-Constrained “Security is always a tradeoff; it must be balanced with the cost.” - Bruce Schneier Wilder4

5 Reality is Resource-Constrained “_______ is always a tradeoff; it must be balanced with the cost.” - Bruce Schneier Wilder5

6 Members of Microsoft Azure Security Wilder6

7 Data Defense in Depth Approach Physical Application* Host Network  Strong storage keys for access control  SSL support for data transfers between all parties  Front-end.NET framework code running under partial trust  Windows account with least privileges  Hardened version of Windows Server 2008 OS for both VM Host and VM Guest operating systems  Host boundaries enforced by external hypervisor  Host firewall limiting traffic to VMs  VLANs and packet filters in routers  World-class physical security  ISO and SAS 70 Type II certifications for datacenter processes Layer Wilder7

8 Defenses Inherited by Azure Applications Spoofing Tampering/ Disclosure Elevation of Privilege Configurable scale-out Denial of Service VM switch hardening Certificate Services Shared- Access Signatures HTTPS Sidechannel protections VLANs Top of Rack Switches Custom packet filtering Partial Trust Runtime Hypervisor custom sandboxing Virtual Service Accounts Repudiation Monitoring Diagnostics Wilder8

9 Developer Resources is LOADED with Dev Libraries, Training Kits, How To Guides across: – Mobile (iOS, Android, Win Phone, Win 8 SDKs) –.NET, Node.js, Java, PHP, Python, REST – PowerShell, CLI Example: Create Node.js web site from Mac CLI https://www.windowsazure.com/en-us/develop/nodejs/tutorials/create-a-website-(mac)/ https://www.windowsazure.com/en-us/develop/nodejs/tutorials/create-a-website-(mac)/ Example: Create Linux (CentOS) VM from CLI (Node-based CLI – Windows not required) https://www.windowsazure.com/en-us/develop/php/how-to-guides/command-line-tools/ https://www.windowsazure.com/en-us/develop/nodejs/how-to-guides/command-line-tools/ https://www.windowsazure.com/en-us/develop/php/how-to-guides/command-line-tools/ https://www.windowsazure.com/en-us/develop/nodejs/how-to-guides/command-line-tools/ Example: Install Couchbase + VNet on VM new-windows-azure-features.aspx Wilder9

10 PORTAL DEMO manage.windowsazure.com Wilder10

11 Create Ubuntu VM Scenario that can actually happen in the real world

12 Create Key openssl req -x509 -nodes -days 365 \ -newkey rsa:2048 \ -keyout example1.key \ -out example1.pem chmod 600 example1.key

13 azure vm create --location "West US" --ssh 22 zoran1 b39f27a8b8c64d52b05eac6a62ebad85__Ubuntu- 13_04-amd64-server en-us-30GB azureuser secretPa$$Here123 azure vm list putty zoran1.cloudapp.net call azure vm delete --quiet zoran1

14 download_blob_to_file.py from azure.storage import * blob_service = BlobService( account_name = az_storage_account_name, account_key = az_storage_account_key) stream = blob_service.get_blob( blob_container_name, blob_name) with open(file_path, 'w') as f: f.write(stream)

15 Cloud Computing Packaged Software Storage Servers Networking O/S Middleware Virtualization Data Applications Runtime You manage Infrastructur e (as a Service) Storage Servers Networking O/S Middleware Virtualization Data Applications Runtime Managed by vendor You manage Platform (as a Service) Managed by vendor You manage Storage Servers Networking O/S Middleware Virtualization Applications Runtime Data Software (as a Service) Managed by vendor Storage Servers O/S Middleware Virtualization Applications Runtime Data Networking

16 ___________________ as a Service Apps, $/user, Expertise, SLA App Services as OpEx, $/VM/Svcs, OS, DBMS, etc. with patching & upgrades, Environment Monitoring, Expertise, SLA Virtualized Hardware as OpEx, Networking, Automation, Elasticity, Price Transparency, Global Data Centers, Expertise, SLA Public Cloud Rental Models AppHarbor

17 Microsoft Azure Compute Options HDInsight (Hadoop) – specialized: big data Mobile Services – specialized: devices Virtual Machines – most flexible Web Sites – most convenient Cloud Services – most scalable, most efficient

18 Cloud Services Build highly scalable apps and services Multi-tier, multi-instance architectures Can be combined with other compute services Stateless node, horizontal scaling approach Automated management

19 Cloud Services Web Roles 1+ types Windows Server Running IIS Worker Roles 1+ types Windows Server Could run Tomcat, etc. “Service Model” Deployment Package Config: VM sizes & instance counts, settings, endpoints, certs…

20 Cloud Services Web Role Instances Load Balancer Worker Role Instances

21 Service Bus Queue Durable – won’t lose your data Reliable – backed by SLA and ops team Scalable – Internet scale Approachable – REST + SDKs Feature rich – supports “at least once” and “at most once” delivery guarantees, pinning, suspend, & more… See also: Azure Storage Queue

22 Scalable Architecture Service Bus Queue Web Role Instances Worker Role Instances

23 Queue-Centric Workflow Pattern (QCW for short) pattern 2 of 3

24 Extend example into Service Tier QCW enables applications where the UI and back-end services are Loosely Coupled (Compare to CQRS at end if there is interest)

25 QCW Example: User Uploads Photo Web Server Compute Service Reliable Queue Reliable Storage

26 QCW WE NEED: Compute (VM) resources to run our code Reliable Queue to communicate Durable/Persistent Storage

27 Where does Azure fit?

28 QCW [on Azure] WE NEED: Compute (VM) resources to run our code Web Roles (IIS) and Worker Roles (w/o IIS) Reliable Queue to communicate Azure Storage Queues Durable/Persistent Storage Azure Storage Blobs & Tables; WASD

29 QCW on Azure: User Uploads a Photo Web Role (IIS) Web Role (IIS) Worker Role Worker Role Azure Queue Azure Blob UX implications: user does not wait for thumbnail (architecture!) push pull

30 QCW enables Responsive UX Response to interactive users is as fast as a work request can be persisted Time consuming work done asynchronously Comparable total resource consumption, arguably better subjective UX UX challenge – how to express Async to users? – Communicate Progress – Display Final results – Long Polling/Web Sockets (e.g., SignalR or Node.io)

31 QCW enables Scalable App Decoupled front/back provides insulation – Blocking is Bane of Scalability – Order processing partner doing maintenance – Twitter down – server unreachable – Internet connectivity interruption Loosely coupled, concern-independent scaling – (see next slide) – Get Scale Units right – Key to optimizing operational CO$T$

32 General Case: Many Roles, Many Queues Web Role (IIS) Web Role (IIS) Worker Role Worker Role Web Role (IIS) Web Role (IIS) Web Role (Public) Web Role (Public) Worker Role Worker Role Worker Role Worker Role Worker Role Type 1 Worker Role Type 1 Worker Role Worker Role Worker Role Worker Role Worker Role Worker Role Worker Role Type 2 Worker Role Type 2 Queue Type 1 Queue Type 2 Queue Type 1 Queue Type 2 Queue Type 3 Scaling best when Investment α Benefit Optimize for CO$T EFFICIENCY Logical vs. Physical Architecture depends on current scale Worker Role Type 2 Worker Role Type 2 Worker Role Type 2 Worker Role Type 2 Worker Role Type 2 Worker Role Type 2 Web Role (Admin) Web Role (Admin)

33 Reliable Queue & 2-step Delete (IIS) Web Role (IIS) Web Role Worker Role Worker Role var url = “http://pageofphotos.blob.core.windows.net/up/.png”; queue.AddMessage( new CloudQueueMessage( url ) ); var invisibilityWindow = TimeSpan.FromSeconds( 10 ); CloudQueueMessage msg = queue.GetMessage( invisibilityWindow ); (… do some processing then …) queue.DeleteMessage( msg ); Queue

34 QCW requires Idempotent Perform idempotent operation more than once, end result same as if we did it once Example with Thumbnailing (easy case) App-specific concerns dictate approaches – Compensating action, Last write wins, etc. PARTNERSHIP: division of responsibility between cloud platform & app – Far cry from database transaction

35 QCW expects Poison Messages A Poison Message cannot be processed – Error condition for non-transient reason – Use dequeue count property Be proactive – Falling off the queue may kill your system Determine a Max Retry policy per queue – Delete, put on “bad” queue, alert human, …

36 QCW requires “Plan for Failure” VM restarts will happen – Hardware failure, O/S patching, crash (bug) Bake in handling of restarts into our apps – Restarts are routine: system “just keeps working” – Idempotent support needed important – Event Sourcing (commonly seen with CQRS) may help Not an exception case! Expect it! Consider N+1 Rule

37 Typical SiteAny 1 Role InstOverall System Operating System Upgrade Application Code Update Scale Up, Down, or In Hardware Failure Software Failure (Bug) Security Patch What’s Up? Reliability as EMERGENT PROPERTY

38 What about the DATA? You: Azure Web Roles and Azure Worker Roles – Taking user input, dispatching work, doing work – Follow a decoupled queue-in-the-middle pattern – Stateless compute nodes Cloud: “Hard Part”: persistent, scalable data – Azure Queue & Blob Services – Three copies of each byte – Geo-replicated to sister data center – Busy Signal Pattern

39 Azure Services Compute Virtual Machines Cloud Services Websites Mobile Services Batch Network Services ExpressRoute Virtual Network Traffic Manager App Services Media Services Service Bus Push Notifications Scheduler BizTalk Services Active Directory Multi-Factor Authentication Automation CDN API Management RemoteApp Application Insights Data Services Storage SQL Database HDInsight Cache Backup Site Recovery Machine Learning StorSimple DocumentDB Azure Search Data Factory Stream Analytics Operational Insights

40 Questions? Comments? More information? ?

41 Cloud Architecture Patterns book Primer Chapters 1.Scalability 2.Eventual Consistency 3.Multitenancy and Commodity Hardware 4.Network Latency

42 Cloud Architecture Patterns book Pattern Chapters 1.Horizontally Scaling Compute Pattern 2.Queue-Centric Workflow Pattern 3.Auto-Scaling Pattern 4.MapReduce Pattern 5.Database Sharding Pattern 6.Busy Signal Pattern 7.Node Failure Pattern 8.Colocate Pattern 9.Valet Key Pattern 10.CDN Pattern 11.Multisite Deployment Pattern

43 Business Card

44 BostonAzure.org Boston Azure cloud user group Focused on Microsoft’s Public Cloud Platform Monthly, 6:00-8:30 PM in Boston area – Food; wifi; free; great topics; growing community Follow on More info or to join our Meetup.com group:

45 Looking for … consulting help with Azure Platform? someone to bounce Azure or cloud questions off? a speaker for your user group or company technology event? feel free to reach out … Bill community inquiries: business inquiries: book: Contact Me

46


Download ppt "Microsoft Azure Cloud Platform an overview CSCI E-90 Cloud Computing Zoran B. Djordjević Harvard University November 14 th, 2014 (5:30 – 7:30) Boston Azure."

Similar presentations


Ads by Google