Sponsored by the National Science Foundation

GENI Software

Marshall Brinn, GPO Architect

January 7, 2013

Sponsored by the National Science Foundation 2CC-NIE Workshop January 7, 2013

Outline

• GENI Principles• GENI Software Categories• GENI Software Details• GENI Software Requirements

Sponsored by the National Science Foundation 3CC-NIE Workshop January 7, 2013

GENI Principles

• The GENI Architecture Team has recently worked to define and publish a set of concise statements that define the GENI project and architecture efforts:– Differentiators: What makes GENI different from other

cloud infrastructures or distributed test-beds?– Principles: What are GENI’s essential motivating

values and goals?– Requirements: What are the top level system

requirements that drive the architecture and implementation?

While still a work-in-progress, we hope they convey a good sense of the “what” and “why” of GENI.

Sponsored by the National Science Foundation 4CC-NIE Workshop January 7, 2013

GENI Differentiators

• GENI provides open access to resources to the American academic and research community

• GENI provides custom, segregated and programmable computation, network and storage topologies

• GENI provides low-level metrics on hardware substrate to facilitate repeatable experimentation in virtual environments

• GENI provides access to uncommon or expensive resources to researchers 

• GENI provides resources with broad geographic diversity, spanning the United States and providing access to international federation resources

• GENI provides the ability for users to 'opt-in' their internet traffic to experimental services or networks

Sponsored by the National Science Foundation 5CC-NIE Workshop January 7, 2013

GENI Principles

• GENI is dedicated to supporting science and network experimentation and researchers

• GENI is a federation of autonomous test-beds and resources

• GENI establishes a common trust fabric to allow disparate resources to interoperate reliably

• GENI establishes and enforces policies that provide assurances to resource owners that their resources will not be misused. 

• GENI federation members agree to abide by these policies in exchange for these assurances.

• GENI supports interoperability among disparate resources and control frameworks

Sponsored by the National Science Foundation 6CC-NIE Workshop January 7, 2013

GENI Requirements

• GENI will provide custom, segregated and programmable computation, network and storage topologies

• GENI will provide common authentication and authorization services to support federated aggregates in validating experimenter resource requests

• GENI will provide support for protecting federated aggregates from misuse by, at least, forensics and slice shutdown services

Sponsored by the National Science Foundation 7CC-NIE Workshop January 7, 2013

GENI Software Context Review

Experimenter: A researcher seeking to perform network experiments on customized data plane.

Federation: A collection of people and institutions who agree to share resources and abide by common procedures in order to share resources in a reliable, mutually beneficial manner.

Resources: Physical resources (compute, network, storage) made available to the federation by means of a participating aggregate.

Aggregates: Software entities that represent federated resources in transactions with experimenter tools.

Tools: Software capabilities that interact with federation resources on behalf of experimenters

Clearinghouse: Set of services establishing federation-level authentication, authorization and accountability of experimenter use of federation resources.

Operations Center: Processes and tools monitoring activity on GENI resources for adherence to policies.

Grey boxes are real-world entities, represented in software by Purple boxes.

Sponsored by the National Science Foundation 8CC-NIE Workshop January 7, 2013

GENI Software Suite

• Aggregate Managers: Allows the owner of a set of resources to share these resources with the GENI federation by means of the GENI Aggregate Manager (AM) API

• Experimenter Tools: Allows an experimenter to express and implement their needs for resources and topologies and experiment configurations

• Clearinghouse: Establish federation-level trust, identity, policy

• GMOC: Support forensics and high-level oversight, monitoring and management of GENI operations

Sponsored by the National Science Foundation 9CC-NIE Workshop January 7, 2013

GENI Software Suite: Aggregate Manager

• Control Plane: Creates custom Data Plane topologies– Slicing Services: HyperVisors (OpenStack, KVM, Xen)– Programmability Services: OpenFlow– Stitching Services: Intra-Aggregate and Inter-Aggregate

services for stitching cross-aggregate topologies

• Management Plane: Monitoring Aggregate behavior, taking protective action if necessary– GMOC Monitoring/Reporting/Control Interface

Think of the Aggregate Manager as providing Control Plane and Management Plane operations on customized Data Planes

Sponsored by the National Science Foundation 10CC-NIE Workshop January 7, 2013

GENI Software Suite: Aggregate Manager [2]

• ProtoGENI / InstaGENI: Developed and maintained by University of UTAH, partnered with HP and Princeton, derived from Emulab capability

• ORCA / ExoGENI: Developed and maintained at RENCI in North Carolina

• FOAM/FlowVisor : Maintained by Open Network Labs, presents OpenFlow “flow space” as an virtual resource

Any service that presents resources in accordance with the GENI AM API is an Aggregate Manager. There are several implementations that are deployed and interoperate within the GENI federation

Sponsored by the National Science Foundation 11CC-NIE Workshop January 7, 2013

GENI Software Suite: Experimenter Tools

• Resource Management Tools: Allow experimenters to express and build custom topologies– GENI Portal: Web-based access to Clearinghouse

services and Aggregate resources • Emphasis on making “Simple things simple, Difficult things

possible”

– Omni: Command-line interface to Aggregate resources– FLACK: Graphical interface to building and viewing

custom topologies

Sponsored by the National Science Foundation 12CC-NIE Workshop January 7, 2013

GENI Software Suite: Experimenter Tools [2]

• Experiment Management Tools: Support configuring and running experiments on the GENI-provided data plane, and reviewing/analyzing results– Orchestration: OMF, GUSH– Instrumentation/Monitoring: GEMINI and GIMI projects

esp. GEMINI Portal, LabWIKI– Archiving/Analysis: iRODS, UNIS

Sponsored by the National Science Foundation 13CC-NIE Workshop January 7, 2013

GENI Software Suite: Clearinghouse

• Series of federation-level services to establish broad common trusted sense of identity and policy– Introduces “Project” level of management of activity on

slices/slivers• Establishes privileges of experimenters based on their roles on

“projects”• Establishes accountability (“one neck to wring”) for all activity

on a project to that project’s PI

– Establishes federation-level certificates and trust roots to enable all tools and aggregates to interoperate reliably

– Establishes a common directory of federation-level services for other services to discover one another

Sponsored by the National Science Foundation 14CC-NIE Workshop January 7, 2013

GENI Federation Software Architecture Schematic

GMOC

Experimenter Tool

Aggregate

IdentityProvider

ServiceAuthority AuthZ

Service

Slice Authority

LoggingService

GENI Clearinghouse

ProjectAuthority

Credential Store

MemberAuthority

Sponsored by the National Science Foundation 15CC-NIE Workshop January 7, 2013

GENI Software Suite: GMOC

• Forensics: Detailed logging of operations and metrics on resources for real-time monitoring and post-analysis of experiments, failures, misbehavior– What operations were taken by whom when?– What level of network or compute activity was taking place on

which resources?– What slivers belong to which slices, projects, PI’s?

• Management: Ability to determine a misbehaving experiment (intentionally or not) and shut it down on all participating aggregates without impacting other co-located experiments

The GENI Meta-Operations Center (GMOC) provides top-level oversight and management services to protect resources against misuse (intentional or not)

Sponsored by the National Science Foundation 16CC-NIE Workshop January 7, 2013

Aggregate Manager: Managing Campus Boundaries for Experiments

OUTSIDE CAMPUS FW

INSIDE CAMPUS FW

Aggregate Manager

RESOURCERESOURCEGENI and Campus

Resources

Control/Management Plane (IP)• AM API Requests/Responses• GENI CH Credentialing• GMOC Control Messages• GMOC Monitoring

Data Plane (L2)• Trans-Aggregate Experiment Traffic

• Shibboleth AuthN• InCommon AuthN• PKI-based Credentials• VLAN-based segregation• Signed, Authenticated Requests• Slice/Sliver Expiration• FOAM ‘FlowSpace’ Authorization• ABAC-based AuthZ (Future)

Policy and trust inputs allow the campus to control which requests flow over the control plane, including which resources are connected to the data plane.

Sponsored by the National Science Foundation 17CC-NIE Workshop January 7, 2013

GENI Aggregate Authentication

• GENI participating campuses should be members of the OCI-sponsored InCommon Federation, which provides trusted and validated user credentials– Organizations should provide “Research and

Scholarship” InCommon category IDP’s • https://spaces.internet2.edu/display/InCCollaborate/Research+

and+Scholarship+Category• Provides information such as Affiliation, Email, Name [First, Last], EPPN

• GPO provides a default IDP for campuses that do not yet provide such an IDP

GENI Authentication is based on:• InCommon Identity Provider (IDP) of users signing into GENI tools• Shibboleth provides single sign-on sessions based on this identity

Sponsored by the National Science Foundation 18CC-NIE Workshop January 7, 2013

GENI Policy Management

• GENI Aggregates use policy to control its responses to critical questions such as:– Which experimenters do I trust?– With which other aggregates am I willing to collaborate?– How many resources should I allocate to which experimenters or

experiments?

• Currently, the GENI Clearinghouse presents a bundle of ‘trusted roots’ that federated aggregates accept and thereby trust any credential signed by someone trusted by GENI.

• In the future, GENI expects to use the far more expressive ABAC language to capture and police policy statements

Note that the expressing and policing of policy statements can and is done in software. But the establishment of these policies and trust are human and inter-organizational (out-of-band) actions.

Sponsored by the National Science Foundation 19CC-NIE Workshop January 7, 2013

Deployment Requirements: Software

• Hardware Configuration– Encoding hardware configuration details such as switch

configurations, compute node MAC’s and switch ports, dedicated VLAN’s, capacities/constraints of H/W, QoS budgets

• Integration with Campus Infrastructure– Integration with site health/reporting tools (is rack up?)– Rack power-down/reboot integration with site

management tools

• GENI Federation– Installation of GENI trust roots– Creation/distribution of GENI-signed credentials

This list is not complete and may vary by the type of rack, but provides a sense of the kinds of requirements to deploy a GENI rack

Sponsored by the National Science Foundation 20CC-NIE Workshop January 7, 2013

Software Plans and Milestones

Software Suite Current State Plans/ Milestones

Rack Aggregate

AM API V3 ratified - Rack AM software in test and will be installed on racks as deployed- Aggregates working to be compliant with latest features by Spring ’03

Clearinghouse / Portal

- Current racks implement CH Authentication, Authorization and Audit functions in distributed fashion- Alpha version of CH and Portal available to select experimenters and developers

- Integration of CH with Rack Aggregates as they deploy, expected Beta available Summer ‘13- Additional regular Portal releases (every ~4 months) to capture new AM, tool or CH capabilities

Experimenter Tools

- Several tools (omni, Portal) currently available for topology management - Tools for experiment I&M available as Alpha on certain rack platforms

- Stitching tools expected by Summer ‘13- Tools for experiment I&M expected by Fall ‘13 on all rack platforms

GMOC - Reporting interface under Alpha testing by rack developers, GPO

- Integration of report interface with CH and AM’s expected late Spring ’03- Additional reporting, forensics, control tools and capabilities rolled out in Summer-Fall ‘03

Sponsored by the National Science Foundation 21CC-NIE Workshop January 7, 2013

Summary

• The GENI Federation is a collaborative effort among people: experimenters, resource owners and network managers

• The GENI project provides a broad range of software tools that represent the interests of these people to allow them to share resources in a trusted, efficient manner