Changes between Initial Version and Version 1 of GEMINI_TopicsIssuesTasks

Timestamp:

04/04/12 17:24:18 (12 years ago)

Author:

hmussman@bbn.com

Comment:

--

GEMINI_TopicsIssuesTasks

@@ +1 @@
+GEMINI Topics, Issues and Tasks
+
+Notes and tasks from 3/22/12 GEMINI status call:
+Additions and corrections after call on 3/27/12 with Martin:
+Additions and corrections after team call on 3/29/12, and call on 3/30/12 with Jim:
+Additions and changes after call with Martin and Jim on 4/4/12:
+
+
+1)  Discussion of authentication and authorization:  multiple actor options:
+
+a)  tool (outside slice) to AggMgr srvc;  AM API;  XMl-RPC + ssl   [protoGENI cert + GENI credential]
+
+b)  tool (outside slice) to host (Slice A);  ssh, scp    [private/public keys]
+
+c)  tool (outside slice) to I&M srvc (Slice A);  http(s)   [in LAMP, browser to GUI, https with protoGENI cert]  [can private/public keys be used for access to a GUI?]  [in OMF, signed messages using private/public keys;  more details?]
+
+d)  I&M srvc (Slice A) to I&M srvc (Slice A);  http(s)   [in LAMP, service to service, https with LAMP cert, from LAMP CA]    [in GIMI/OML, not using http;  what is done there?]
+
+e)  I&M srvc (Slice A) to I&M srvc (Slice B);  http(s)   [in European perfSONAR, SOAP interface with security tokens]  [can delegated GENI credentials be used?]  {can credentials based on ABAC be used?]
+
+f)  I&M srvc (Slice A) to UNIS srvc;  http(s)   [in LAMP, service to UNIS, https with protoGENI cert]
+
+g)  tool (outside slice) to iRODS archive srvc;  what is interface to iRODS?  ftp(s)?  can it be http(s)?  how is authentication/authorization handled?   [need info from Shu]
+
+h)  option:  I&M srvc (Slice A) to iRODS archive srvc;  is there any way to move data from MC direct to iRODS?  perhaps mount iRODS on node with MC?  [need info from Shu]
+
+
+
+
+2)  Discussion of authentication and authorization:  multiple methods:
+
+a)  [for ssh, ssl, etc.]  private/public keys    
+
+a')  [in OMF]  signed messages using private/public keys
+
+b)  user certificates
+
+c)  GENI credentials  (user and slice)
+
+c')  [in IMF, GENI credentials included with XML messages, for authorization?  how?  reuse?]
+
+d)  ABAC  [Harry:  GPO believes that ABAC may eventually be used for resource assignment, but not soon]  [What code is available from ISI?  Jim is checking with Teb Faber;  waiting for a response]
+
+        ABAC references:
+        Deter web site: http://abac.deterlab.net/ 
+        Authorization storyboard from Jeff Chase:  http://groups.geni.net/geni/wiki/AuthStoryBoard
+        Slides on credential store from Jeff Chase:  http://groups.geni.net/geni/attachment/wiki/AuthStoryBoard/certstore.ppt
+        Slides on future of authorization in GENI from Tom Mitchell:  http://groups.geni.net/geni/attachment/wiki/GEC13Agenda/Authorization/AuthFuture.pdf  [note options without and with credential store]
+        Summary of GENI authorization discussion at GEC13 (and before):  http://groups.geni.net/geni/wiki/GeniAuthorization  
+
+
+
+3)  Discussion of target protoGENI environments:
+
+a)  servers:  relatively few;  public IP available
+
+b)  VMs:  OpenVZ;  expect move to LXC;  internal to an aggregate, private host name, private IP addresses, need more details
+
+c)  To date, all LAMP/periscope has been on servers
+
+c')  Task:  try to run all LAMP nodes (or just common node) on VMs   (Matt Jaffe)
+
+d)  To date, all INSTOOLS has been with MC on server, and MPs on VMs
+
+e)  Task:  Try to run INSTOOLS MC in a VM;  Nasir on 3/30:  still runs, although might need some small code changes; but would need to open http port, perhaps with extension to rspec;  need to discuss with protoGENI (Jonathan Deurig) about adding to mapping agent;  Jim had discussed with Jonathan and Rob earlier, quite doable, but would have to restart mapping agent;  perhaps could "piggyback" on opening ssh port?  
+
+f)  Task:  can ssh into public host name (or public IP) , with special 5+ digit port number (from manifest) from port map
+
+g)  Task:  (see e) above) how to access http interface?  tunnel through ssh?  port map, like ssh?  perhaps could "piggyback" on opening ssh port?  setup a separate proxy?  
+
+g')  New task:  **Review possible tunnel through ssh (or use fo ssh to forward http port), to reuse available ssh port mapping.  (who?)
+        
+g'')  New task:  ** Review port mapping for http, like ssh, with protoGENI, to see how it might be done (Nasir/Jim)
+        
+g''') New task:  **Review need within GENI/GPO to open ports, and implications for rspec  (Harry)
+
+h)  Task:  what about vnc tunnels?  how were they done in INSTOOLS?   which port on host?  (who?)
+
+i)  Task:  what happens when VMs are on multiple aggregates?   (who?)
+
+j)  Task:  consider separate host for managing communications?  VM?  server?  centralized?  include pub/sub?  is this GENI Event Messaging Service?     (who?)
+
+
+
+
+
+4)  LAMP/Periscope questions:
+Per call with Martin on 3/27/12:
+
+a)  Question:  Is there a local UNIS, or not??   (Martin) Not yet;  needs to be, with push from local UNIS to global UNIS.
+
+b)  How does UNIS authenticate/authorize when receiving data?   (Martin)  [in LAMP, service to UNIS, https with protoGENI cert]
+
+c)  Question:  Use web interface on common node to configure services, tests;  how does this push config to UNIS?  What authentication/authorization steps are included?
+
+d)  How is data transfer from service to service, in a single slice, authorized?  what keys/certificates/credentials are used?  what is held by each service?  (Martin)  [in LAMP, service to service, https with LAMP cert, from LAMP CA]
+
+
+
+5)  Discussion of user workspace service:
+
+Current view:    (Harry)
+
+a)  Persistent Linux environment, with file system, key/certificate/credential store, dedicated to the user;  could also have rspec store, etc.
+
+b)  Place for tools, e.g., Gush and OMNI, and scripts;  can easily call one another;  not in slice;  could deal with multiple slices
+
+c)  Place for "portals";  but what are they? (see below)
+
+d)  Task:  Setup user workspace using server (or VM) in BBN Cambridge lab;  begin to include tools, etc .    (Jeanne)  
+On 3/30/12:  Done on VM in BBN Cambridge lab, ubuntu 10.04, internal to BBN.  
+**Next:  external to BBN
+
+e)  Task: Consider VM to distribute user workspace  (Matt);  e.g, ubuntu on virtual box [similar to what has been done at GEC tutorials]
+
+f)  Task:  What is required to secure keys/certificates/credentials?  passphrase?  other?  [Per Tom Mitchell, OMNI does not require passphrase, but FLACK does currently require passpharase]  [Per Jim protoGENI cert does require passphrase] [Vic to check with Steve Schwab;  need to balance security and ability ot use scripts.]
+
+g)  Start with CNRI:  Directory Archive (DA) service, which can push data to DOA service, using OI service
+Then replace DOA with iRODS
+[Have iRODS at IU for NetKarma;  Jim and Wesley talking with Ilia and Shu]
+
+h)  Include MDOD creator/editor  (CNRI, GPO)
+
+i)  Task:  Need help with final formulation of MDOD   (Ezra?)
+
+j)  Task:  Define view of user workspace service (Jeannie, Matt, Harry, Jim, Martin, Niky)  
+[Jeanne to add security policy into view]
+
+
+6)  Discussion of portals:
+
+a)  Option 1:  "portal to UIs".  [Is this close to Jim's proposal?]
+
+b)  Option 2:  a more complete tool for managing I&M services, as is implied in the SOW, so that it can view, orchestrate, edit MDOD, manage archiving, etc.  [Is this close to Max's proposal]
+
+c)  Task:  understand options for authentication and authorization at a web interface.  (who?)
+
+d)  Task: provide a more complete view of GEMINI portal service   (Harry, jim and Charles)
+
+Task:  Jim and Charles plan to provide in a week or two.
+        
+Task:  Charles needs to find a name for the service  
+
+After discussion on 3/31/12 with Jim, Harry feels that this is very close to Option 1:  "portal to UIs".  
+        
+Jim expects User to have a capable browser, e.g., one that runs HTML-5
+        
+Jim expects portal to manage windowing to various GUIs.
+        
+Jim expect all interactions to be via browser, so there are window(s) to login to shell(s), etc.
+        
+Jim does not specify whether browser is looking at GUI in slice, or a tool;  tools are not in a specified place.
+        
+Harry feels that portal and other tools are in a "user workspace",  in a persistent Linux environment, with file system, key/certificate/credential store, dedicated to the user;  could also have rspec store, etc. ;  then, all tools have ready access to required info, and can readily call one another.
+        
+Harry thinks of "persistent Linux environment" on infrastructure, e.g., a server under your desk or in the lab;  not your laptop;  Jim agrees, and has thought portal would be hosted on infrastructure at Kentucky
+        
+Harry feels that this is just a strucutre, that there is much more work to define tools, interfaces, etc.;  Jim agrees, was concerned it was the final configuration.
+        
+Task:  Harry will modify drawing to reflect discussion with Jim, and then two perspectives can be compared.
+Done on 4/4;  agree thatprotal can be in user workspace, or somewhere else.
+See updated drawing.
+        
+        
+e)  Task:  Understand NICTA's iREEL portal service;  is this a more complete tool for managing I&M services?  
+
+Get login, and survey  (Jeanne)
+        
+Provide more info (NICTA, e.g., Christoph)
+
+
+
+7)  Discussion of configuration to gather host metrics:
+
+a)  Use BLiPP to gather host metrics   (Guilherme)
+
+via libvirt? 
+        
+via Shinken? 
+
+Talking to Dan about use cases for gathering host metrics.  
+
+Could still use SNMP daemon from INSTOOLS  (Jim)
+
+b)  BLiPP pushes to Measurement Store (MS)
+
+Use http?  POST to port?  what about authentication and authorization?
+        
+Use XSP, for streaming?
+        
+c)  Need to realize MS
+
+How many options?
+        
+One per Aggregate?
+
+d)  Need to realize MAP service
+
+Based on Periscope?
+        
+Include druple form INSTOOLS>
+        
+How is this integrated with MS?
+        
+e)  Uses UNIS (new version)
+        
+Uses RESTful interface, replaces older UNIS with SOAP interface
+        
+Allows drawing topology
+        
+Used to configure services?
+        
+Prototype underway (Ahmed)
+        
+**Concern:  incompatible with earlier UNIS, which will still be required (see 9) below.
+
+e)  Later:  Extend to gathering data from an application
+
+f)  Task:  Prototype soon  (Guilherme)
+
+Need baseline configuration ASAP
+
+
+
+
+8)  Steps towards GEMINI tutorial at GEC14
+
+a)  Which aggregates, servers, hosts, etc.?
+
+b)  Start with protoGENI tutorial?  LAMP tutorial?  INSTOOLS tutorial?
+
+c)  Arrange user workspace (GPO, Jeannie)
+
+d)  What is first configuration of tools (see below) ?  LAMP on VMs?  (who provides?)   test scripts?  (Jeannie)
+
+e)  What is second configuration of tools (see below)?  BLiPP to measurement store, with presentation?  (Guilherme?)  when?  test scripts?  (Jeannie)
+
+
+
+9)  First configuration, follows p15 Operator A slice, to collect network measurements, like LAMP project:
+
+a)  Start:  each node on a server, with an available public IP address  (single aggregate or multiple aggregates)
+
+a')  Second:  all nodes on VMs, or all nodes on VMs except common node on server
+
+b)  One common node (e.g., node n+1) to:  configure measurements, collect data, present data
+
+c)  Multiple measurement nodes (e.g., nodes 1, 2, ..., n)
+
+d)  Start:  one slice, classic pS interface, with data pulled from measurement node, authorized with GENI credential or ?
+
+e)  Global UNIS as shown;  include local UNIS on common node
+
+f)  Load software onto common node with image;  as option, use wget
+
+g)  Load software onto measurement node with image;  as option, load after app with wget
+
+h)  Use web interface on common node to configure services, tests, like LAMP;  how does this push config to UNIS??  How do we let only user do this with keys, etc.
+
+i)  Use web interface on common node to present/observe data, like LAMP  How do we let only user do this with keys, etc.
+
+j)  Demo all of the perfSONAR network performance tools, tests, as was done in LAMP project
+
+k)  Extension:  pull data from one slice to another, as shown in p15 from Operator A to Operator B;  authorize using GENI credentials
+
+k)  Provide regression tests of various configurations, features, etc., driven by scripts
+
+l)  Provide tutorial for users at GEC14.
+
+
+
+10)  Second configuration to support basic host monitoring using BLiPP, like p15 Experimenter C slice  What this means:  no SNMP daemon
+
+**Concern:  Per 7) above, still defining intial configuration;  need firm plan to meet GEC14 goals;  or do we start with earlier INSTOOLS code?
+
+a)  Introduces push of data to common node;  what protocol?  http?  XSP?  (is this GENI Event Messaging Service?)
+
+b)  Need to organize presentation of data at a web interface;  like INSTOOLS?  Introduce DRUPLE into periscope? (plan Dec 2012)
+
+c)  Extend:  gather data from user's application (like OML client)
+
+d)  Provide regression tests of various configurations, features, etc., driven by scripts
+
+e)  Provide tutorial for users at GEC14.
+
+
+11)  GEMINI project documentation
+
+a)  Code on IU github
+
+Good:  all relevant code appears to be here, including Kentuck code
+        
+b)  Jira
+
+Good:  being used by IU to track project
+        
+**Concern:  Kentucky effort not reflected here
+
+c)  GENI trac for GEMINI
+
+Include TopicsTasksIssues
+
+Include drawings