1. Grid Information Service (Meta-Directory Service 2) Globus Toolkit™ Developer Tutorial The Globus Project™ Argonne National Laboratory USC Information Sciences Institute http://www.globus.org/ Copyright (c) 2002 University of Chicago and The University of Southern California. All Rights Reserved. This presentation is licensed for use under the terms of the Globus Toolkit Public License. See http://www.globus.org/toolkit/download/license.html for the full text of this license.

2. June 1, 20152 Globus Toolkit™ Developer Tutorial: MDS-2 Section Overview l MDS review l Information model l Client tools and APIs l Configuring servers and adding service providers

3. June 1, 20153 Globus Toolkit™ Developer Tutorial: MDS-2 Globus MDS Review l Meta Directory Service (MDS) –Globus Toolkit implementation of a Grid Info Service l System information is critical to operation of the grid and construction of applications l A basis for configuration and adaptation in heterogeneous, dynamic environments l Requirements and characteristics –Uniform, flexible access to information –Scalable, efficient access to dynamic data –Access to multiple information sources –Decentralized maintenance

4. June 1, 20154 Globus Toolkit™ Developer Tutorial: MDS-2 “Classic” MDS Architecture (MDS-1) l Resources push information into a central organization server via regular updates (globus-gram-reporter), where it can be retrieved by clients. l Regular updates don’t scale as the number of resources grow rapidly. Commercial LDAP servers are optimized for “read” requests, and can’t handle frequent “write” requests. l If organization server is unavailable, no information is available. LDAP Organization Server Directory contains info from A and B Resource A gram-reporter Resource B gram-reporter gram-reporters periodically update LDAP server’s information. Client 1 Client 2 Client 3 clients query organization server for current information.

5. June 1, 20155 Globus Toolkit™ Developer Tutorial: MDS-2 “Standard” MDS Architecture (MDS-2) l Resources run a standard information service (GRIS) which speaks LDAP and provides information about the resource (no searching). l GIIS provides a “caching” service much like a web search engine. Resources register with GIIS and GIIS pulls information from them when requested by a client and the cache as expired. l GIIS provides the collective-level indexing/searching function. GIIS Cache contains info from A and B Resource A GRIS GIIS requests information from GRIS services as needed. Client 1 Client 2 Client 3 Resource B GRIS Clients 1 and 2 request info directly from resources. Client 3 uses GIIS for searching collective information.

6. June 1, 20156 Globus Toolkit™ Developer Tutorial: MDS-2 MDS-2 Service Architecture l Dynamic Registration via Reg. Protocol (GRRP) l Resource Inquiry via Info. Protocol (GRIP) –Co-located with resource on network l Resource Discovery (via GRIP or other) –Using GRIP allows resource/directory hierarchy discovery (GRIP?) lookup (GRIP) registration (GRRP) VO-specific Aggregate Directories standard Resource Description services RRRR AA?

7. June 1, 20157 Globus Toolkit™ Developer Tutorial: MDS-2 Distributed Services l Service scales with Grid growth l Loose consistency model tolerates failures l Interoperability by GRIP/GRRP protocols D D D D

8. June 1, 20158 Globus Toolkit™ Developer Tutorial: MDS-2 Soft-state Registration l Periodic notification –“Service/resource is available” –Expected-frequency metadata l Automatic directory construction –Add new resources to directory –Invite resources to join new directory l Self-cleaning –Reduce occurrence of “dead” references

9. June 1, 20159 Globus Toolkit™ Developer Tutorial: MDS-2 MDS-2 Implementation l Grid Information Service (GRIS) –Provides resource description –Modular content gateway l Grid Index Information Service (GIIS) –Provides aggregate directory –Hierarchical groups of resources l Lightweight Dir. Access Protocol (LDAP) –Standard with many client implementations –Used for GRIP (and GRRP currently)

10. June 1, 201510 Globus Toolkit™ Developer Tutorial: MDS-2 New MDS-2.1 Features l Security Mechanisms –GSI mutual-authentication –Fine-grained access control by GSI name l Performance Enhancements –Better query speeds –Less stale information l New Information Model (schema) –Better representation of computers –Cleaner namespace management

11. June 1, 201511 Globus Toolkit™ Developer Tutorial: MDS-2 MDS-2.1 External Software Stack l OpenLDAP 2.0.x (.14) –Implements LDAPv3 protocol –Client and server components l Cyrus-SASL –Generic security –We provide loadable SASL/GSS plugin l Globus GSI –Provides GSS-API interface to PKI –Shared library used by our SASL plugin

12. June 1, 201512 Globus Toolkit™ Developer Tutorial: MDS-2 MDS 2.1 Security l PKI authentication l Static authorization –Class, attribute, object name rules l “Self” authorization –Semi-dynamic rule –Requires “owner” attribute on objects l Dynamic authorization –Directory-based group lists (or future CAS) –Per-object access rule attributes –LDAP dynamic authorization (beta?)

13. June 1, 201513 Globus Toolkit™ Developer Tutorial: MDS-2 MDS 2.1 Information Model l Structural information –Resource hierarchy maps to objects –Named positions in LDAP DIT l Merged information –Some parents “join” child data –Simplifies common query patterns l Auxiliary information –Uniform representation of leaf/parent data –Uses LDAP auxiliary objectclasses

14. June 1, 201514 Globus Toolkit™ Developer Tutorial: MDS-2 GRIS Host Objects OS

15. June 1, 201515 Globus Toolkit™ Developer Tutorial: MDS-2 GRIS Object Hierarchy Mds-Host-name=hostname Mds-Software-Deployment=operating system Mds-Device-Group-name=processors Mds-Device-name=cpu 0 Mds-Device-Group-name=memory Mds-Device-name=physical memory Mds-Device-name=virtual memory Mds-Device-Group-name=filesystems Mds-Device-name=/scratch1 Mds-Device-name=/scratch2 Mds-Device-Group-name=networks Mds-Device-name=eth0

16. June 1, 201516 Globus Toolkit™ Developer Tutorial: MDS-2 GRIS Structural Class Hierarchy Mds Attr: Mds-validfrom (like createtime) Attr: Mds-validto (accuracy metadata) Attr: Mds-keepto (discard metadata) MdsHost MdsDevice MdsDeviceGroup MdsSoftwareDeployment l Every MDS object: name, time metadata

17. June 1, 201517 Globus Toolkit™ Developer Tutorial: MDS-2 GRIS Auxiliary Class Examples MdsCpu Attr: Mds-Cpu-vendor Attr: Mds-Cpu-model Attr: Mds-Cpu-speedMHz MdsCpuCache Attr: Mds-Cpu-Cache-L1kB MdsCpuSmp Attr: Mds-Cpu-Smp-size MdsCpuTotal Attr: Mds-Cpu-Total-count l Once per CPU l Once per SMP l Once per MPP

18. June 1, 201518 Globus Toolkit™ Developer Tutorial: MDS-2 GRIS Auxiliary Class Examples MdsCpuFree (once per SMP) Attr: Mds-Cpu-Free-1minX100 Attr: Mds-Cpu-Free-5minX100 Attr: Mds-Cpu-Free-15minX100 MdsCpuTotalFree (once per MPP) Attr: Mds-Cpu-Total-Free-1minX100 Attr: Mds-Cpu -Total-Free-5minX100 Attr: Mds-Cpu -Total-Free-15minX100

19. June 1, 201519 Globus Toolkit™ Developer Tutorial: MDS-2 Client Tools l Globus Toolkit includes 2 command line client tools for querying MDS services –grid-info-search: General purpose client >grid-info-search –h -p -b \ -T [ ] [ ] >-x: Anonymous access –grid-info-host-search: Same as grid-info- search, but defaults to GRIS standard port >E.g. grid-info-host-search –h localhost l Both clients can search for specific system information and filter results.

20. June 1, 201520 Globus Toolkit™ Developer Tutorial: MDS-2 LDAP Client C API l RFC 1823 defines an IETF draft standard C client API for accessing LDAP databases –Connect to server –Pose query which returns data structures contains sets of object classes and attributes –Functions to walk these data structures l Globus Toolkit uses OpenLDAP client library

21. June 1, 201521 Globus Toolkit™ Developer Tutorial: MDS-2 LDAP Client API: Other Languages l Java –JNDI is a standard Java package for accessing LDAP directories –Used by Java CoG l Python –Has libraries that wrap the OpenLDAP client –Used with PyGlobus l Perl –Has modules for LDAP access

22. June 1, 201522 Globus Toolkit™ Developer Tutorial: MDS-2 LDAP exercises l Go to the “ldap” subdirectory l Documentation –RFC 1823: The LDAP Application Programming Interface –Howes and Smith, LDAP: Programming Directory-Enabled Applications with Lightweight Directory Access Protocol, MacMillan 1997 ISBN 1-57870-000-0 l Follow instructions in the file README

23. June 1, 201523 Globus Toolkit™ Developer Tutorial: MDS-2 Configuring Servers and Adding Service Provider

24. June 1, 201524 Globus Toolkit™ Developer Tutorial: MDS-2 dc-n1.isi.edu grid-info-site-policy.conf grid-info-resource-register.conf grid-info-resource-ldif.conf dc-n2.isi.edu grid-info-resource-register.conf grid-info-resource-ldif.conf GRIS GIIS GRIS Configuration files for Registration

25. June 1, 201525 Globus Toolkit™ Developer Tutorial: MDS-2 Configuration files for Registration l A resource that is hosting a GIIS –grid-info-site-policy.conf >Determines whether to accept incoming registrations >Accept everything, or only registrations from the resources explicitly defined in this conf file (can use wildcards) l Default policy is to only accept registrations from self, and from port 2135 l In a hierarchical GIIS environment, this file must be modified from the default

26. June 1, 201526 Globus Toolkit™ Developer Tutorial: MDS-2 Default Policy Data: objectclass: MdsRegistrationPolicy policydata: (&(Mds-Service-hn=mako.isi.edu)(Mds-Service-port=2135)) Change ‘policydata’ to this for completely open policy: (Mds-Service-hn=*) Change ‘policydata’ to this to restrict to 2 specific hosts: (&(|(Mds-Service-hn=dc-n2.isi.edu)(Mds-Service-hn=dc- n3.isi.edu))(Mds-Service-port=2135)) grid-info-site-policy.conf

27. June 1, 201527 Globus Toolkit™ Developer Tutorial: MDS-2 Configuration files for Registration l A resource registering GRIS information with a GIIS –grid-info-resource-register.conf >Which GIIS’s this GRIS should register to, and how >GIIS could be on the same machine, but may not be –grid-info-resource-ldif.conf >Determines which GRIS providers are active and available to send data to the GIIS’s that this GRIS is registering with

28. June 1, 201528 Globus Toolkit™ Developer Tutorial: MDS-2 Registering a GRIS with a GIIS l dn: l regtype: mdsreg2 l reghn: l regport: l regperiod: l [service attribute/value]... –where service attribute entries depend on the type of LDAP object being published $GLOBUS_LOCATION/etc/grid-info-resource-register.conf

29. June 1, 201529 Globus Toolkit™ Developer Tutorial: MDS-2 Example GRIS on dc-n2 registers with GIIS on dc-n1 l dn: Mds-Vo-Op-name=register, Mds-Vo-name=site, o=grid l regtype: mdsreg2 l reghn: dc-n1.isi.edu l regport: 2135 l regperiod: 600 l type: ldap l hn: dc-n2.isi.edu l port: 2135 l rootdn: Mds-Vo-name=local, o=grid l ttl: 1200 l timeout: 20 l mode: cachedump l cachettl: 30 $GLOBUS_LOCATION/etc/grid-info-resource-register.conf

30. June 1, 201530 Globus Toolkit™ Developer Tutorial: MDS-2 Registration Control Parameters l regperiod –How often this GRIS will send a message to the GIIS noting its existence l ttl –How long the recieving GIIS should keep the registration information before assuming that the GRIS is no longer available –In general ttl should be: ttl = 2 x (regperiod) l cachettl –Recommendation to the GIIS about how long to maintain in cache, the GRIS information provided by this resource $GLOBUS_LOCATION/etc/grid-info-resource-register.conf

31. June 1, 201531 Globus Toolkit™ Developer Tutorial: MDS-2 MDS-2.1 GRIS Providers grid-info-cpu reports CPU/load info grid-info-fs reports filesystem info grid-info-mem reports RAM/VM info grid-info-net reports NIC/net info grid-info-os reports OS info grid-info-platform reports arch. info grid-info-merged merges all host info* l Extensible for other sources, e.g. GRAM

32. June 1, 201532 Globus Toolkit™ Developer Tutorial: MDS-2 GRIS Dispatch Logic l For each provider: 1.Could search intersect provider? No, then skip. 2.Is provider cache stale? Yes, then refill. 3.Apply search filter to cache data. l Combine all intersecting providers’ results

33. June 1, 201533 Globus Toolkit™ Developer Tutorial: MDS-2 GRIS Response Issues l MDS 2.0 and 2.1 are lazy –Probes are not issued unless queried l Some system probes are slow –“Best” probe may take several seconds l How to avoid stale data? –Clients set time-out per query –GRIS/GIIS define time-out per source –Fresh data found before timeout is returned –Cache fill continues after client time-out

34. June 1, 201534 Globus Toolkit™ Developer Tutorial: MDS-2 2.1 GRIS Provider Times OSRH 6.2RH7.1IrixSolaris Platform0.040.03 Os0.060.04 Cpu0.280.15 Mem0.120.10 Fs0.140.09 Net0.450.17 Merge0.800.37 total1.890.95 OLD10.01N/A8.2918.27

35. June 1, 201535 Globus Toolkit™ Developer Tutorial: MDS-2 New Information Providers l Decide what information to publish into MDS l Create a program that implements the IO interface requirements of a GRIS Information Provider l Enable the information provider for an MDS installation

36. June 1, 201536 Globus Toolkit™ Developer Tutorial: MDS-2 New Information Providers l Decide what information to publish into MDS –OID: conflict avoidance >OID Registered with IANA Private Enterprise Numbers l http://www.iana.org/cgi-bin/enterprise.pl l 1.3.6.1.4.1.3536.* Globus OID subspace l 1.3.6.1.4.1.3536.2.* Globus Info Services OID subspace l 1.3.6.1.4.1.3536.2.6.* MDS OID subspace >ISI will delegate sub-trees of the Globus Info Srvcs OID space l mailto:mds-oid-registrar@globus.org l OR, register your own with IANA –Object Naming: conflict avoidance >ISI will coordinate prefix naming. Request a prefix from: l mailto:mds-oid-registrar@globus.org –Schema >Data Modeling problem >LDAP schema syntax problem >$GLOBUS_LOCATION/etc/grid-info-resource.schema

37. June 1, 201537 Globus Toolkit™ Developer Tutorial: MDS-2 New Information Providers l Create your program –Any language. The only requirements are the I/O interface of your program: >Must be callable by fork and exec from the slapd process l You can pass in arguments to your program >Must return data in LDIF format l Data returned must match the LDAP schema l RFC 2849

38. June 1, 201538 Globus Toolkit™ Developer Tutorial: MDS-2 New Information Providers l Enable your new information provider by adding a configuration block l $GLOBUS_LOCATION/etc/grid-info-resource-ldif.conf –# generate memory info every minute –dn: Mds-Device-Group-name=memory, Mds-Host-hn=mako.isi.edu, Mds-Vo-name=local, o=grid –objectclass: GlobusTop –objectclass: GlobusActiveObject –objectclass: GlobusActiveSearch –type: exec –path: /globus/libexec –base: grid-info-mem-linux –args: -devclassobj -devobjs -dn Mds-Host-hn=mako.isi.edu,Mds-Vo- name=local,o=grid -validto-secs 60 -keepto-secs 60 –cachetime: 60 –timelimit: 10 –sizelimit: 3

39. June 1, 201539 Globus Toolkit™ Developer Tutorial: MDS-2 New Information Providers l dn –Where the object lives in the DIT l These lines must be included: –objectclass: GlobusTop –objectclass: GlobusActiveObject –objectclass: GlobusActiveSearch –type: exec l path –Path to the information provider program l base –Name of the information provider program l args –Arguments to be passed to the information provider program l cachetime –In seconds, how long GRIS will consider the data to not be stale l timelimit –In seconds, how long the GRIS should wait for the information provider to return data before giving up on it l sizelimit –Max number of LDIF objects to be read from the output of the information provider $GLOBUS_LOCATION/etc/grid-info-resource-ldif.conf