OpenStack Congress DelegationforVMPlacement.docx
- 文档编号:6667782
- 上传时间:2023-01-08
- 格式:DOCX
- 页数:14
- 大小:21.84KB
OpenStack Congress DelegationforVMPlacement.docx
《OpenStack Congress DelegationforVMPlacement.docx》由会员分享,可在线阅读,更多相关《OpenStack Congress DelegationforVMPlacement.docx(14页珍藏版)》请在冰豆网上搜索。
OpenStackCongressDelegationforVMPlacement
CongressDelegationforVM-placement
Overview
CongressisapolicysystemdesignedtoacceptANYpolicyaboutadatacenter,whetherthatpolicybeaboutcompute,networking,storage,groupmembership,anti-virus,intrusion-detection,orevenproprietaryservices;inshort,Congressisadomain-agnosticpolicyengine.Incontrast,manyotherpolicyenginesaredomain-specific,meaningtheyonlyacceptcertainkindsofpoliciesandaredesignedtoaggressivelymonitor/enforce/auditthosepolicies.DelegationisaformofcollaborationbetweenCongressanddomain-specificpolicyenginesthataimstoprovideacompletepolicysolutionforend-users.DelegationmeansthatCongressexaminesthepolicyitisgiven,carvesoutasubpolicythatadomain-specificpolicyenginespecializesin,andhandsthatsubpolicyofftothatdomain-specificengine.Forexample,CongresscouldcarveoutapolicyconcernedwithVM-placementanddelegateittoanaugmentedversionofthecompute-managerNova.WeanticipateotherformsofcollaborationbetweenCongressanddomain-specificpolicyengines,butinthisdocumentwearefocusedonlyonDelegation.(It’snoteworthythatevenwithalargecollectionofdomain-specificpolicyenginesandfully-operationalcollaborationbetweenthemthattherewillbepoliciesthatCongressdoesnotfullydelegatetodomain-specificengines--policiesthataretrulycross-domainthatCongressmustitselfmonitor/enforce/audit.)
ThisdoccontainsinformationrelatedtodelegatingpolicyfromCongresstoadomainspecificpolicyenginethatdoesVMplacement.Policydelegationrequires3things:
theexistingdomain-agnosticpolicyenginerunninginsideofCongress,adomain-specificVM-placementengine,andtheinterfacebetweenthetwoengines.Intheend,ourgoalistodefinetheinterfacebetweenthetwoengines,buttobetterevaluatedifferentinterfaceswewilllookattheproblemend-to-end.
Inparticular,wewillbeinvestigatingaVM-placementenginethatisbuiltusingalinearprogramming(LP)solver.WeassumebothenginesarenodesontheDSE,whichisCongress’smessagebusthatallowsnodestopublish/subscribetotablesofdataandinvokeAPIcallsononeanother.(ThisdoesnotprecludetheVM-placementenginebeinganexternalservice--doingsowouldjustmeanthatthe“engine”runningontheDSEisawrapper/adapter/driverfortheactualengine,analogoustothedatasourcedriverswehavetoday.
1.Usergivesthedomain-agnosticengineanypolicyshelikes.
2.Theagnosticenginecarvesoutthe(ideallyunique)DatalogsubpolicyrelevanttoVM-placement.
3.TheagnosticenginesendsthatsubpolicytotheVM-placementengine(wrapper),whichunderstandsDatalog,viaanAPIcall,e.g.byinvokingset_policy(
4.TheVM-placementengineacceptsthepolicyandusestheDSEtosubscribetowhatevertablesofdatathepolicydependsupon.
5.TheVM-placementenginecompilestheDatalogpolicyandthedatathatpolicydependsuponintoanLPprogram.ThisinvolvestheenginechoosingwhichdecisionvariablesarerelevantandaddingitsownLPconstraintstocodifydetailsofthedomain.
6.TheVM-placementenginegivestheLPprogramtoanLPsolverandinvokesthesolvertofindassignmentsforthedecisionvariables.
7.TheVM-placementengineusesthedecision-variableassignmentstomigrateVMsthatviolatepolicy.
8.TheVM-placementenginecontinuallyreceivesupdatesaboutVMperformanceandmigratesVMstoenforcepolicy.
Hereweworkthrougheachofthestepsabove,witharunningexample.
1.Userprovidespolicy
Supposetheuserwantstoensuretheaveragememoryutilizationofallhostsinaspecialzoneislessthan75%ofitsmaximumcapacity.Theuserdecidesthisisasoftconstraint,notahardconstraint,andsodescribesthepolicyasfollows.
warning(id):
-
nova:
host(id,name,service,zone,memory_capacity),
legacy:
special_zone(zone),
ceilometer:
statistics(id,"memory",avg,count,duration,
durstart,durend,max,min,period,perstart,perend,
sum,unit),
TheuserprovidesadditionalpolicystatementsaswellthatmayormaynotberelevantforVM-placement.Hereisapolicystatementthatisnotrelevant:
nopersoncanbeamemberofthemarketinggroupandtheengineeringgroup.
error(user):
-
keystone:
group(user,“marketing”),
keystone:
group(user,“engineering”)
2.Domain-agnosticpolicyenginecarvesoutsubpolicy
Thedomain-agnosticenginemustnowcarveoutthesubpolicyrelevanttotheVM-placementengine.Inourexample,thatwouldmeanrunninganalgorithmthatrealizesthefirstpolicystatementprovidedbytheuserisrelevantforVM-placement,butthesecondisnot,givingusthefollowingVM-placement-relevantsubpolicy.
warning(id):
-
nova:
host(id,name,service,zone,memory_capacity),
legacy:
special_zone(zone),
ceilometer:
statistics(id,"memory",avg,count,duration,
durstart,durend,max,min,period,perstart,perend,
sum,unit),
avg>0.75*memory_capacity
Onewaytocarveoutasubpolicywouldbetoaddspecial-purposecodetothedomain-agnosticenginethatknowsaboutthekindsofpoliciestheVM-placementenginecanhandle.Thedownsidetothisapproachisthateverytimeweaddanewdomain-specificpolicyengine,wemustchangethedomain-agnosticpolicyengine.
Instead,wewouldliketoenablepolicyenginestosnapintoCongressjustlikedatasourcedriverssnapintoCongresstoday.Wewouldliketobeabletoimplementthedomain-agnosticsideofthedelegationinterfacejustonceandthenusethatinterfacetohookupanynewdomain-specificpolicyenginethatwelike.
Tomakesuchaninterfacepossiblerequiresawayforthedomain-agnosticpolicyenginetoaskadomain-specificpolicyenginewhatkindsofpolicystatementsitknowshowtohandle.Oneproposalisforthedomain-agnosticpolicyenginetoinvokeanAPIcallonthedomain-specificpolicyenginethatreturnsalistofthetablenamesthatthedomain-specificpolicyengineunderstandsandalistoftablenamesthatthedomain-specificpolicyenginedoesnotunderstand.
“””Returns(
Forexample,theVM-placementenginemightreturnthefollowingtablenames.(Itwouldjustreturnthetable-names,butbelowthereareadditionalexplanatoryremarks.)
●Permitted
○nova:
host[physicalmachinesandtheirattributes]
○nova:
server[virtualmachinesandtheirattributes]
○ceilometer:
statistics[average,max,min,etc.ofutilizationmetrics]
○<,>,+,-,*,=
●Forbidden
○Non-arithmeticbuiltins:
date_less_than,date_greater_than
Knowingthatnova:
host,ceilometer:
statistics,and>arepermittedtablesisenoughtocarveouttherightsubpolicyforthisexamplebydoingstraightforwarddependencyanalysisontherules.Weknowthispolicyisrelevantbecauseitinvolvesthenova:
hosttable,theceilometer:
statisticstable,the>table,anddoesnotinvolvethedatebuiltins.(Evenifthepolicy-writerhadintroducedhelper-tables,wecanstilldotheproperanalysistofindwarning/errorstatementsthatdependonthePermittedtablesbutnotontheForbiddentables.)
3.Domain-agnosticenginedelegatestoVM-placementengine
Oncethedomain-agnosticenginehasidentifiedthepropersubpolicytodelegate,itmustgivethatpolicytotheVM-placementengine.TheVM-placementenginemaybeanadapterthattalkstotherealVM-placementengineandhandlesthetranslationofDatalogtotheengine’sactualpolicylanguage;thewrapperwouldalsoberesponsibleforupdatingthepolicysenttotherealengineaspolicyandthedatathatpolicydependsuponchange.
OnesimpleproposalistohavetheVM-placementengine(wrapper)implementaset_policy(
defset_policy(
“””Replacethecurrentpolicywith
IdeallywewouldalsohaveawayofcontrollingwhattheVM-placementengineactuallydoeswiththatpolicy,e.g.monitoring,proactiveenforcement,reactiveenforcement.Orperhapstheremightevenbeawaytodescribewhatthepolicyengineshoulddoindifferentcases:
apolicyforcontrollingthepolicyengine.Fornowweassumeitenforcesthatpolicyhoweveritcan:
byacombinationofproactiveandreactiveenforcement.
JustasCongressacceptspolicystatementsasstrings,sotootheVM-placementengineacceptspolicystatementsasstrings.Inourexample,thiswouldmeanthedomain-agnosticpolicyengineexecutesthefollowingAPIcallovertheDSE.
vm_placement_engine.set_policy(‘
warning(id):
-
nova:
host(id,name,service,zone,memory_capacity),
legacy:
special_zone(zone),
ceilometer:
statistics(id,"memory",avg,count,duration,
durstart,durend,max,min,period,
perstart,perend,sum,unit),
avg>0.75*memory_capacity
‘)
4.TheVM-placementengineacceptsthedelegatedpolicy
OncetheVM-placementengineacceptsthepolicy,theremaybedatathatitneedstomakesenseofthepolicy.Inourexample,itneedsnova:
hosttoknowwhichhostsexistandwhichzonestheyarein;itneedslegacy:
special_zonetoknowwhichzonesmatter;anditneedsceilometer:
statisticstoknowabouttheaveragememoryconsumption.TheVM-placementengineknowswhatinformationitisgettingfromnova:
hostandfromceilometer:
statistics---itbuildsthesemanticsofthosetablesintoitsalgorithms.ButtheVM-placementenginedoesnotbuildthesemanticsofthelegacy:
special_zonetableintoitsalgorithms--it’sjustdatathathelpsrefinewhattheconstraintspertainto.ThismeanstheVM-placementenginewillsubscribetoeachofthosetablesontheDSE.Assoonasthesubscriptionoccurs,theDSEsendstheVM-placementenginethecurrentcontentsofthosetables,andwhenthesetableschange,
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- OpenStack Congress DelegationforVMPlacement