Virtualization overview

Server Virtualization Create multiple isolated environments in which to run software, on the same machine Allows you to run multiple versions side by side Testing Staggered upgrades Different software may have different requirements Share resources between environments Faster provisioning Security through partitioning

O/S level virtualization Run a single kernel, use facilities within the kernel to isolate users Separate root directory (chroot) Separate IP addresses per environment Limit access, e.g. "ps" only shows processes within one environment Examples: Jails (FreeBSD) Virtuozzo / OpenVZ (Linux)

O/S level virtualization Advantages Very efficient Can run hundreds of environments on one box Disadvantages Everything must be running the same O/S (e.g. FreeBSD) although each has its own set of libraries Sharing the same kernel, so a kernel upgrade affects all VMs

Paravirtualization Run multiple instances of a modified operating system The guest OS is aware that it is running in a virtual environment, and makes special calls to the host OS whenever it wants to perform IO Examples: Xen Virtio modules for KVM

Paravirtualization Advantages Very good efficiency Can do things like dynamically change the RAM in a running guest, which wouldn't ever happen in a real server Disadvantages Not "true" virtualization, as it requires customised guest OSes

Full virtualization Emulates the PC hardware Runs most code natively (e.g. i386 code on your i386 processor) Every CPU instruction which accesses the hardware has to be trapped and emulated in software Examples: VMware Server, ESX, ESXi VirtualBox KVM

Full virtualization Advantages Can run guest OSes which are unaware that they are being virtualised (e.g. Windows under Linux) You just boot them - e.g. from a CD-ROM or CD- ROM image - and install as you would on a regular device Disadvantages Overhead of emulating hardware devices in software

Full virtualization with hardware asssistance Newer Intel processors: Intel-VT Newer AMD processors: AMD-V Provides special instructions to make emulation of hardware more efficient Most of the previous examples can also take advantage of hardware assistance Linux KVM requires these features (it cannot run on older CPUs)

Pure software virtualization Simulates an entire other machine, including the CPU, entirely in software Examples: QEMU UML - User Mode Linux Dynamips

Pure software virtualization Advantages Easy to install No special privileges required Can emulate completely different CPU architecture Disadvantages Very slow

Costs of virtualization The hypervisor is commodity now The value is in the management tools Provisioning and importing Automatic migration Reporting Disaster recovery

Storage virtualization Most disk drives are underutilised Most disk drives are not properly backed up Virtualization (SAN) decouples the processor location from the storage location enables "live migration" dynamic resizing Protocols: Fibre Channel, iSCSI, AoE Free software solutions are available (e.g. iSCSI initiator/target, drbd) High performance requires significant spend

Network virtualization We have been virtualizing at layer 2 for years What is it called? How does it work?

Virtualization at layer 3 Newer routers support multiple forwarding tables - e.g. VRF (Cisco) Each interface associated with a VRF Each VRF has its own routes, even its own default route You can even re-use the same IP addresses in different VRFs! Similar features now finding their way into BSD and Linux network stacks

VRFs for security zones Still need to separate these at layer2 if they are going over the same link (e.g. VLANs or MPLS)

Virtualization at other layers Web servers don't need a separate IP address for each website (any more) HTTP GET / HTTP/1.0 Host: noc.mgmt HTTPS Use TLS SNI (Server Name Indication) SMTP virtual domains ...etc