xCAT/xcat-core
2
0
Fork 0
mirror of https://github.com/xcat2/xcat-core.git synced 2024-11-21 17:11:52 +00:00
Code Issues Releases Wiki Activity
Page: Multiple_Zone_Support2
Pages
2014_10_01_Bash_vulnerability 2014_11_04_Poodle_Attack AIX_NIM_NFSv4_support Add_Extra_Parameters_for_confignics_Postscript CRHS like_function CRHS like_function_enhancements CSM_CFM like_function_to_sync_config_files_to_the_nodes Capture_Linux_Image_from_running_node_to_create_a_stateless statelite_image Chef_databag_support_for_deploying_openstack_in_xCAT Cluster_config_file Conserver_Replacement Coordinated_Cluster_Shutdown_and_Bringup Copycds_enhancement Coral PDU supports Create_osimage_definition_for_Management_Node Cumulus_OS_Upgrade_Support_Test DFM_Service_Node_Hierarchy_support DHCPv6_management DNS_Enhancments DNS_master_slave_support Def_commands_to_display set_nic_attributes_more_easily Deploying_OpenStack_Baremetal_Nodes_Using_xCAT Disable_ssh_root_passwordless_node to node_access Document_large_cluster_tunables,_etc. Dynamic_node_groups_support Energy_Management_for_Flex Energy_management_support_for_blade Enhance_NTP_setup_support Enhancement_of_lsslp_ flexdiscover Enhancement_on_makeroutes_and_snmove_commands Exporting_more_table_attributes_to_nodes Filling_the_osimage_attributes_with_the_files_that_are_found_in_the_search_path Full_Automation_of_DB2_Setup_on_Service_Nodes Function Verification Test Design of xCAT High Availability GPFS_statelite_nodes Getmacs_and_rnetboot_enhancement Getnodetype_performance_imprvoments_ _phase_I HA_NFS_on_AIX_service_nodes HA_Service_Nodes_for_AIX HA_Service_Nodes_for_AIX_ _using_External_NFS_Server HFI_MAC_address_failover HPC_Integration_Phase_1 Hardware_Inventory_for_Node Health_Check_Script_Framework Hierarchical_Design Home Image_Provisioning Image_import_and_export_enhancement_for_Linux Improve_perl_array_search_efficiency_for_scalability Improvement_of_pre creating_mypostscripts_on_linux Initrd_Enhancement_separate_initrd_hacking_from_noteset_get_drivers_from_os_update_distro Kdump_for_Linux_diskless_nodes Linux_AIX_mixed_Clusters_postscripts_cleanup Local_Disk_support_for_statelite Lstree_for_Servicenode_Hardware_and_VM_hierarchies Management_Node_Pool Management_Node_Setup_Verification Managing_Multiple_Sites_and_Clusters Mellanox_Switch_Support Mini design for openbmc python framework Mini design_of_updating_pre defined_groups_for_nodes Minimize_the_install setup_steps_of_xcat_on_the_MN Mkvlan_enhancements Multiple_Zone_Support2 Multiple_pkgdir_support_with_full_installation NFS_Redundancy_Investigation NFS_redundancy New_Cloud_Tables_in_xCAT Node_Status_and_Application_Status Node_definition_installation_service_node_setup_verification Nodeset_defaults_when_node_provmethod=osimage_is_set OS_Deployment_Monitoring_And_Automatic_Retry OS_Distro_Update_xCAT_command_osdistroupdate OpenStack Chef Cookbook_xCAT_Integration OpenStack_Deployment_using_Chef OpenStack_Deployment_using_Puppet Ospkgs_enhancements_to_install upgrade_OS_packages_from_Updates Overview_of_HA_Services_for_Diskless_AIX_Nodes Power8_BE_support Predict_long_nicname_for_RH7 Proposal_for_docker_Support_in_xCAT RHEL7_Support RHEV_support Rcons_hierachy_support Redfish_support Refine_the_usage_of_installnic_and_primarynic_attributes Release processs automation investigation Resolving_Nodenames_for_System_p_HW_Ctrl Run_parallel_commands_for_Ethernet_switches Run_postbootscripts_after_each_diskful_reboot SLES12_Support SLES_11_SP1_SDK_support Secure root support Sequential_Discovery Sequential_Discovery_phase_2 Service_Node_Scenarios_and_Retry_Logic_in_Postscript_Process Service_node_manual_takeover_on_AIX Service_node_take_over Setup_IP_routes_between_the_MN_and_the_CNs Shared data based xCAT MN HA mini design Shared data based xCAT MN HA user case Shared data based xCAT MN HA Specify_the_disk_partitions_during_diskfull_install Steps to install xcat_openbmc_py3 on RH8 Support uploading openbmc firmware in parallel Support_Management_Node_in_the_servicenode_table Support_for_Redundant_BPAs_and_FSPs Support_multiple_hardware_control_points Support_osimage.pkgdir_with_multiple_paths_in_genimage_and_diskfull_installation Support_postscripts_associated_with_rsync_files_to_be_run_after_rsync_in_xdcp Support_to_inject_drivers_from_Driver_RPM_Package Support_xcatd_running_user_defined_sql_scripts_on_start_and_foreign_keys Supporting_driver_update_disk_for_Linux Supporting_the_scalable_functions_for_HX5_blade Switch_Discovery_And_Switch_Management System_p_Discovery_Enhancements System_z_hierarchical_tree Test Design of HA Test Design of TestCase Label Test Design of `goconserver` Regression Testing Test Design of `goconserver` Support Test Design of configib Test Design of cumulus osimage Test Design of cumulus_osimage Test Design of gonconserver redirect logs Test Design of hardware control commands regression Test Design of makegocons option l Test Design of rbeacon python version Test Design of rcons based goconserver Test Design of revenlog python version Test Design of rflash python version Test Design of rinv python version Test Design of rpower python version Test Design of rsetboot python version Test Design of rspconfig python version Test Design of rvitals python version Test Design of syncfiles Test Design of xcat inventory diff Test Design of xcat inventory export import performance Test Design of xcat inventory option e Test Design of xcat inventory osimage environment variables export part Test Design of xcat inventory osimage environment variables Test Design of xcat inventory osimage phase2 Test Design of xcat inventory osimage support share file directory Test Design of xcat inventory osimage Test Design of xcat inventory phase 1 Test Design of xcat inventory regular expression Test Design of xcat inventory save keys Test Design of xcat inventory user case Test Design of xcat terraform provider phase1 Test Report of `goconserver` Test cases against nodeset error handling Test_Case_Designs_FVT The mini design of osimage version control(initial draft) The mini design of syncfiles for cumulus The mini design of using xcat inventory templates to setup xCAT cluster with ansible The_remote_console_support_of_hmc Trace_Facility_for_xCAT Ubuntu_supports_internet_repository Updatenode_Performance_Enhancements Updatenode_Sync_Service_Nodes_for_install Updatenode_enhancement_for_security_keys_and_certificates Updatenode_support_to_run_mypostscript_sections Updatenode_to_the_Management_Node Updates_to_xcatsetup_and_Cluster_Config_File Windows_Multiple_Disks_Partitions_Configuration Windows_Multiple_Nics_Configuration Windows_Multiple_Winpes Windows_Support_to_Run_Postscripts_Postbootscripts_in_Windows_Deployment Wish_List_for_xCAT_2 Wish_List_for_xCAT_FVT XCAT 2 Mini Designs for New Features XCAT_2.10_Release_Notes XCAT_2.11.1_Release_Notes XCAT_2.11_ESP_Release_Notes XCAT_2.11_Release_Notes XCAT_2.12.1_Release_Notes XCAT_2.12.2_Release_Notes XCAT_2.12.3_Release_Notes XCAT_2.12.4_Release_Notes XCAT_2.12.5_Release_Notes XCAT_2.12_Release_Notes XCAT_2.13.10_Release_Notes XCAT_2.13.11_Release_Notes XCAT_2.13.1_Release_Notes XCAT_2.13.2_Release_Notes XCAT_2.13.3_Release_Notes XCAT_2.13.4_Release_Notes XCAT_2.13.5_Release_Notes XCAT_2.13.6_Release_Notes XCAT_2.13.7_Release_Notes XCAT_2.13.8_Release_Notes XCAT_2.13.9_Release_Notes XCAT_2.13_Release_Notes XCAT_2.14.1_Release_Notes XCAT_2.14.2_Release_Notes XCAT_2.14.3_Release_Notes XCAT_2.14.4_Release_Notes XCAT_2.14.5_Release_Notes XCAT_2.14.6_Release_Notes XCAT_2.14_Release_Notes XCAT_2.15.1_Release_Notes XCAT_2.15_Release_Notes XCAT_2.16.1_Release_Notes XCAT_2.16.2_Release_Notes XCAT_2.16.3_Release_Notes XCAT_2.16.4_Release_Notes XCAT_2.16.5_Release_Notes XCAT_2.16_Release_Notes XCAT_2.17_Release_Notes XCAT_2.9.2_Release_Notes XCAT_2.9.2_aix_Release_Notes XCAT_2.9.3_Release_Notes XCAT_2.9.4_Release_Notes XCAT_Cluster_in_SoftLayer XCAT_HPC_Integration_Files_per_OS,_Architecture,_Product XCAT_Health_Check XCAT_IPv6_support_on_AIX XCAT_IPv6_support_on_Linux XCAT_Mini Design_Template XCAT_Monitoring_Failure_Analysis_Conditions_Batched_Events XCAT_Postscripts_framework_enhancements XCAT_Provisioning_OS_on_consistent_disk XCAT_REST_API_enhancements XCAT_Support_for_Kits_and_Kit_Components XCAT_probe XCAT_support_for_multiple_network_domains Xcatexport_and_xcatimport_commands Xcatmon_and_appstatus_for_HPC_products Xeon_Phi_support cofignetwork_for_RH7 confignetwork integrate confignics_configeth_configib functions usage determine_install_disk diskdiscover_and_configraid docker_instances_lifecycle_management enhancement_for_rinstall_command logging pre script to make debug easy makedhcp_append_statement_automatically_rather_than_get_statement_from_nodeset mini design of ZTP based onie switch discovery and configuration minidesign Switch based switch discovery minidesign_xcatprobe node status enhancement ntp_enhancement openbmc_support post.xcat_restructure rflash_streamline_procedure rscan command for hypervisor rspconfig network rspconfig ntpservers rspconfig password scaleup_basedon_xcat_in_openshift_cluster supporting_partitionfile_for_Ubuntu supporting_persistent_kernel_cmdline_after_diskful_installation test_sidebar the mini design of xcat inventory export and import for osimage use fifo pipe to enhance getadapter xCAT Build Schedule xCAT_2.12_ReleaseInformation xCAT_2.13_ReleaseInformation xCAT_2.14_ReleaseInformation xCAT_2.15_ReleaseInformation xCAT_Docker_Image xcatprobe_framework xcatprobe_requests
16 Multiple_Zone_Support2
ligc edited this page 2015-07-30 04:22:49 -04:00
Table of Contents

Table of Contents

Design_Warning

This document is the current design for Multiple zone support.

Required Reviewers

  • Linda Mellor
  • Bin XA Xu (Platform)

Required Approvers

  • Guang Cheng Li

Overview

A new customer requirement is covered by this design.

The requirement is to be able to take an xCAT Cluster managed by one xCAT Management Node and divide it into multiple zones. The nodes in each zone will share common root ssh keys. This allows the nodes in a zone to be able to ssh to each other without password, but cannot do the same to any node in another zone. You might even call them secure zones.

Note:These zones share a common xCAT Management Node and database including the site table, which defines the attributes of the entire cluster.

There will be no support for AIX.

Multiple zone support

The multiple zone support requires several enhancements to xCAT.

root ssh keys

Currently xCAT changes root ssh keys on the service nodes (SN) and compute nodes (CN) that are generated at install time to the root ssh keys from the Management node. It also changes the ssh hostkeys on the SN and CN to a set of pre-generated hostkeys from the MN. Putting the public key in the authorized-keys file on the service nodes and compute nodes allows passwordless ssh to the Service Nodes (SN) and the compute nodes from the Management Node (MN). This setup also allowed for passwordless ssh between all compute nodes and servicenodes. The pre-generated hostkey makes all nodes look like the same to ssh, so you are never prompted for updates to known_hosts

compute nodes

Having zones that cannot passwordless ssh to nodes in other zones requires xCAT to generate a set of root ssh keys for each zone and install them on the compute nodes in that zone. In addition the MN public key must still be put in the authorized_keys file on all the nodes in the non-hierarchical cluster or the Service Node public key on all the nodes that it services for hierarchical support.

switches, hardware control

We will still use the MN root ssh keys on any devices, switches, hardware control. All ssh access to these is done from the MN or SN, so they will not be part of any zone.

Management Node

The management node cannot be assigned to a zone. xdsh -K and updatenode -k are already not allowed to the Management node.

Service Nodes

Service nodes may be assigned to a zone. We need to document that if they are not in the same zone, then they will not be able to ssh passwordless to each other - service node pools will not work for example.

xCAT changes

To support multiple zones we have the proposed changes:

Table Changes

A new table zone will be created.

key:zone name

sshkeydir - directory containing root ssh RSA keys.

defaultzone - yes/1 or no/0

Note: defaultzone, if not set, default is no. Only one defaultzone=yes is allowed and there must exist one default.

sshbetweennodes - yes/1 or no/0, default is yes and that means we setup to allow passwordless root ssh between nodes

The nodelist table will have a new attribute:

zonename - this will be the name of the zone that the node is currently assigned to.

New Commands

For this implementation we are proposing we can do the following:

  • make a new zone
  • remove an existing zone
  • add nodes to a zone
  • remove nodes from a zone

Note: these command will be packaged in xCAT-client rpm. They must run on the Linux Management Node. There will be no support for AIX in this release. I think checking that the MN is Linux is enough for now when the command runs. We will check if any node in the noderange is AIX ( mixed clusters).

mkzone

mkzone will be used to do the following:

  • define a zone name
  • optionally make it the default zone
  • optionally assign nodes to the zone
    • optionally add group <zonename>to the nodes in the noderange
  • if root ssh private key provided then
    • generated root ssh public key using input private key
  • else
    • generated the root ssh keys (RSA)
mkzone Implementation

mkzone will have the following interface:

mkzone &lt;zonename &gt;  [ --defaultzone] [-k &lt;full path to the ssh RSA private key&gt;] [ -a &lt;noderange&gt;] [-g] [-f] [-s &lt;yes|no&gt;]  [-V]
mkzone &lt;zonename&gt;/.ssh.

  • * if --defaultzone is input, then it will set the zone.defaultzone attribute to yes; otherwise it will set to no. if --defaultzone is input and another zone is currently the default, then the -f flag must be used to force a change to the new defaultzone. If -f flag is not use an error will be returned and no change made.
  • if -a <noderange> is defined
    • For each node in the noderange it will add to the nodelist.zonename attribute for that node the zonename.
    • if -g is defined
      • it will add the group name zonename to each node in the noderange.
  • If a ssh private key is supplied (-k), it will generate the ssh public key and store both in /etc/xcat/sshkeys/<zonename>/.ssh directory.
  • If no (-k) then it will generate a set of root ssh keys for the zone and store them in /etc/xcat/sshkeys/<zonename>/.ssh.
  • if -f is input with --defaultzone, then we will force a change of what is currently defined as the defaultzone to the current zone. Otherwise we will error out, if there is currently a defined default in the zone table.

If there is no currently defined default zone, an error will be reported. There must be one default zone in the zone table.

  • If -s entered, the zone.sshbetweennodes will be set to yes or no. It defaults to yes.
  • If -h, displays usage
  • If -v, displays release and build date
  • if -V, verbose mode.
rmzone
rmzone  zonename [-g] [-f] [-V]
rmzone &lt;zonename&gt;  on MN .

Note: Checks for id_rsa and id_rsa.pub in the directory. If not there will not remove the directory. This is to make sure that the rm -rf on the directory does not remove some arbitrary directory, since the directory will be taken from the zone table sshkeydir attribute. Also if the directory is /root/.ssh, I will not remove the id_rsa or id_rsa.pub file. That will be left to the admin.

  • remove zone.zonename entry from the zone table.
  • For each node with nodelist.zonename=zonename
    • set nodelist.zonename=undefined

Note:This means if there is a default zone still in the zone table that will be used as the nodes new zone. If the zone table is empty then it goes back to using <roothome>.ssh keys

  • * if -g entered, remove the zonename group from each of the nodes
  • Checks you can only remove the defalultzone, if it is the last zone table entry.
  • if rmzone is used to remove the defaultzone then the -f flag must be used.
  • If -h, displays usage
  • If -v, displays release and build date
  • if -V, verbose mode.

Note: If -f is not used then you will get an error and the zone will not be removed. Removing the default zone means that any node that does not have a zonename defined will not have ssh keys assigned. The admin should define a new default zone using chzone or mkzone before removing the default.

chzone
chzone  zonename [-k &lt;fullpath to the ssh private key&gt;] [-K] [-a &lt;noderange&gt; | -r &lt;noderange&gt;] [-g] [-f] {--default] [-s &lt;yes|no&gt;]  [-V]
chzone &lt;noderange&gt; entered,  add nodes to zone 

  • * change nodelist.zonename attribute to the zonename
    • If -g entered add a group=zonename to the nodes
  • If -r <zonename>/.ssh.
  • (-a) will add the nodes in the noderange to the zone by changing the nodelistzonename to the nodes.
    • (-g) will for each node add the group=zonename from the nodelist.groups attribute.
  • (-r) will remove the nodes in the noderange from the zone by changing the nodelist.zonename attribute to the new zone name.
    • (-g) will for each node remove the group=zonename from the nodelist.groups attribute.
  • (--defaultzone) will cause the zone.defaultzone attribute for the input zonename to be set to yes.
    • If another zone in the zone table is the current default, it's zone.defaultzone attribute will be set to no.

Note: When you add and and remove node, it will not take affect until reinstall or xdsh -k / updatenode -K is run to update the ssh keys.

listing zone information

With this implementation, the existing xCAT command can list needed zone information.

  • lsdef -t zone - will list all defined zones
  • lsdef -t zone -l - will list each zone and its attrbutes from the zone table (sshkeydir, defaultzone setting)
  • lsdef -t node -w zonename=myzone will list all the nodes in the myzone.
  • if you have used the -g flag to define the nodes in the group=zonename, then
    • nodels zonename - gives you all the nodes in the zone

Code changes

This support affects several existing xCAT components:

  • xdsh -K
    • pick up zone keys
    • sync zone keys to the service nodes
  • updatenode -k
    • should be covered by xdsh -K work
  • getcredentials
    • pick up zone keys - it will accept a zonename for to find out the path to the keys for ssh_root_key
    • also need to add to return id_rsa.pub (ssh_root_key_pub). Only returns id_rsa (pvt) today.
  • remoteshell - send zonename ( if set) to getcredentials request. Also request both public and private key if zonename.
  • Postage.pm
  • rspconfig - think no impact, hardware ssh is from MN or SN's.
  • makeknownhosts - no change this works from the generated ssh host keys and we are not changing this.

Rules for handling zone

  • A node's nodelist.zonename attribute defines which zone it is currently assigned. Only one zone is supported.
  • If a node's nodelist.zonename attribute is defined, the ssh keys of that zone will be used. If the zone is not in the zone table, it is an error.
  • If a node's nodelist.zonename attribute is undefined:
    • The zone which is the current defaultzone in the zone table will be used. If no defaultzone, report error.

Issues

Some of the issues discussed:

  • Moving nodes from one zone to another. Security concerns? This has to do with when you move a node from one zone to another for a period of time, it still have passwordless access to the nodes in the other zone until updated.
  • Are there problems running commands across zones, that is a noderange that span zones?
  • Should Service Nodes be limited to servicing one zone?
  • Hardware control, any issues/restrictions?

Hierarchy support

  • Hierarchy, the keys are put in /etc/xcat/sshkeys/<zonename>/.ssh by this design. To distribute them from a service node using remoteshell, they are going to need to exist on the service nodes in that same directory. They cannot be in a mounted directory because there is a private key. I would suggest that we use xdcp rsync to sync the /etc/xcat/sshkeys to the service nodes when the zone commands run and sync up this directory /etc/xcat/sshkeys with what is on the MN. Again though, we can have the issue of it being sync'd before the admin is ready and the next reboot of a node would pick up the wrong keys. Probably need another flag on the zone commands to sync service nodes.

Migration

If a node is not defined in a zone, root ssh keys and passwords must work as today. This makes sure that a xCAT upgrade does not disrupt an existing xCAT installation. This should work with this design. This is accomplished by the fact, we come up with an empty zone table. As long as no zones are defined, we use the old code paths and the site table sshbetweennodes attribute. Once they start using zones, we no longer support the site table sshbetweennodes attribute. You will set the zone table sshbetweennodes attribute for each zone. The groups option supported in the site table sshbetweennodes attribute will not be supported in the zone table.

Would like to have all customers using a generated root ssh key. I think with this support documented, the mkzone command gives them the ability to switch from using root/.ssh keys to a new generated key. They can define their zone as all the compute nodes in their cluster. They can use the --defaultzone option. This leaves the change under their control.

Documentation

We would need a new document on setting this type of cluster up and managing it. Hierarchy adds even more complexity.

News

History

  • Oct 22, 2010: xCAT 2.5 released.
  • Apr 30, 2010: xCAT 2.4 is released.
  • Oct 31, 2009: xCAT 2.3 released.
    xCAT's 10 year anniversary!
  • Apr 16, 2009: xCAT 2.2 released.
  • Oct 31, 2008: xCAT 2.1 released.
  • Sep 12, 2008: Support for xCAT 2
    can now be purchased!
  • June 9, 2008: xCAT breaths life into
    (at the time) the fastest
    supercomputer on the planet
  • May 30, 2008: xCAT 2.0 for Linux
    officially released!
  • Oct 31, 2007: IBM open sources
    xCAT 2.0 to allow collaboration
    among all of the xCAT users.
  • Oct 31, 1999: xCAT 1.0 is born!
    xCAT started out as a project in
    IBM developed by Egan Ford. It
    was quickly adopted by customers
    and IBM manufacturing sites to
    rapidly deploy clusters.