WSO2Con 2011: Introduction to Stratos
- 1. Open Source Middleware for the Cloud: WSO2 StratosbyAfkhamAzeezDirector of ArchitectureWSO2 Inc.
- 2. … the completeopen sourcePaaS & CMP
- 3. AgendaWhat is a PaaS?
- 4. What are the differentiations?
- 5. What to look for in a PaaS?
- 6. What is Stratos?What is a middleware Platform?
- 7. What is a middleware Platform?
- 8. What is Platform as a Service?
- 10. What to look for in a PaaS (1/2)Lean
- 11. All the on-premise benefits are magnified in a cloud
- 12. Efficiency that is valuable in fixed deployments is invaluable in large dynamic deployments!
- 13. Available on private, public, on-premise
- 14. Getting locked into a specific public PaaS will have long term repercussions
- 15. Open Source is a huge protection against this
- 16. The correct set of core “services”
- 17. Not just App Server, but Identity, Registry, Data, Cache, ESB, BPMS, Billing, Logging, etcWhat to look for in a PaaS (2/2)Open Standard interfaces to common services
- 18. Self-service, multi-tenancy, elasticity, metering, incremental deployment and testing
- 19. Offers a basis for both single-tenant and multi-tenant models
- 20. Lots of tenants each with their own stuff, and/or
- 21. One application that is offered to all or many tenantsCloud Native Middleware
- 22. Cloud Middleware Platform and PaaSA PaaS requires an underlying software base
- 23. Cloud Middleware Platform (CMP), or
- 24. Cloud Enabled Application Platform (CEAP – Gartner)
- 25. Not all PaaS have redistributable CMPs
- 26. The benefit of having a CMP is choice:
- 27. Run your own PaaS in a private cloud
- 28. More than one PaaS provider
- 29. Open PaaS / Open CMP fights lock-in
- 30. WSO2’s CMP = Stratos
- 31. WSO2’s PaaS = StratosLive11
- 32. Stratos OverviewA full middleware platform available as a service, with self service
- 34. Based on OSGi
- 36. Multi-tenant, Elastic, Metered and Billed
- 38. Available under the Apache License
- 39. Open Source, Open License, Open DevelopmentStratosLivehttp://stratoslive.wso2.com 13
- 40. Complete PaaS Gartner is forecasting that it will be 2015 before vendors have true, integrated, complete CMP & PaaS frameworks
- 41. We believe Stratos & StratosLiveis that today!14
- 42. Services available in Stratoslive
- 43. One Enterprise Platform wherever you need it:A single code continuum
- 44. Completely modular based on OSGi
- 45. Complete Enterprise SOA Architecture:
- 46. AppServer, ESB, Governance, Portal, BPMS, BAM, Identity and more
- 47. Supported 24x7 with phone, web and full SLAsWSO2 Carbon & Stratos
- 48. User Experience of Stratos
- 49. Multi-tenancy
- 52. VM per tenant
- 53. Share machine/VM across tenants
- 54. Challenges
- 55. Data isolation
- 56. Logic isolation
- 57. SecurityAchieving Tenant IsolationEach Tenant is given a Security Domain
- 58. Each domain may have its own User Store and Permissions, thus have a set of users and permissions enabling users to access resources
- 59. Each domain is isolated and do not have access to other domainsAchieving Execution IsolationAxis2 have stateless executions and keep all state in a Context.
- 60. Different contexts are created for each tenant
- 61. Lazy loadedSecurityTenants cannot write code with privilege operations
- 62. Otherwise tenants can write malicious code
- 63. Tenants can't write to file system, can't open port
- 64. Java Security Manager can be used to prevent it
- 65. Sandbox environment, similar to applets
- 66. Only allow privilege operations to codes signed by a particular keyIdentity
- 67. Every tenant has access to an Identity Service
- 68. Identity Server / ServiceEach tenant is identified by the @tenant-domain
- 69. Each tenant admin can choose to manage their tenants user store either within the Stratos-internal LDAP store or using an external LDAP
- 70. Bulk import
- 71. Each tenant user has a OpenId/Infocard as well as SAML2 tokens
- 73. SAML2 is used across the Stratos deployment to ensure a smooth transition (single sign-on) between Stratos services
- 74. SAML2 is also available as sign-on for webapps, gadgets and other user-deployed contentweb.xml – Integrating Identity into WebApps<login-config> <auth-method>BASIC</auth-method> <realm-name>Basic Auth</realm-name></login-config> Automatically ties into Stratos Identity
- 75. Google AuthenticationEnable sign into Stratosusing Google Apps username/password.
- 76. For successful sign in using Google Apps,
- 77. If a tenant does not exist, it will be created with the same name as Google Apps domain. The IdP of this domain is Google AppsLogin with Google Apps Domain
- 78. Direct Access From GmailGoogle Apps administrator can add Stratos to your domain. Direct access to Stratos.Cloud Data Solutions
- 79. WSO2 Cloud Data SolutionsWSO2 Data Server
- 81. Database cluster
- 84. Apache Cassandra as a Service
- 85. Relational Database as a Service
- 86. HDFS as a Service
- 87. We are also planning MapReduce as a Service as Future work. Polyglot Data Architecture
- 88. Database as a Service Users can log in to the Stratos data page and create a Database and receive a JDBC URL.
- 89. A DB will be allocated from an Amazon RDS cluster
- 90. Tenant isolation & and integrated with WSO2 Security model.
- 93. Column Family Storage as a ServiceUsers can log in to the Web Console (both in Stratos and in WSO2 Data Server) and create Cassandra key spaces. Column Family Storage (Contd.) Key spaces
- 94. will be allocated from a Cassandra clusters
- 95. they are isolated from other tenants in Stratos
- 96. it is integrated with WSO2 Security model.
- 97. Users can manage and share his key spaces through Stratos Web Console and use those key spaces through Hector Client (Java Client for Cassandra)
- 98. In essence we provide
- 99. Cassandra as a part of Stratos as a Service
- 101. Security integration with WSO2 security modelHDFS as a ServiceUsers can log in to the Stratos data page and create a HDFS volume (File system volume for user). HDFS as a ServiceThe volume
- 102. will be allocated from a HDFS cluster
- 103. they are isolated from other tenants in Stratos
- 104. it is integrated with WSO2 Security model.
- 105. Users can manage and share his File system through Stratos Web Console and use the file system like any other file system. Cloud Services Gateway
- 106. Elasticity
- 107. ElasticityFault tolerance, High availability and scalability
- 108. Traditional solution: Buying safety-net capacity
- 109. Better Solution: Scale up and down
- 110. Pay for the actual use
- 111. Elastic, Service & tenant aware load balancerMetering & Billing
- 113. Number of service calls
- 115. Registry bandwidth (upload, download)
- 116. Total registry space usage
- 117. Send above to BAM publishers, which sends the data to the BAM Service
- 119. Summarized data will be accessible by Stratos ManagerThrottlingRestrict tenants from using more than the allocated resources, depending on the usage plan
- 120. Number of users per tenant
- 121. Storage space
- 122. Number of requests to webapps, services etcUsage Metering/ThrottlingUsage MeteringRegistry Resource Volume
- 123. Number of users
- 124. Appserver Service Bandwidths/Request Response count
- 125. ESB Mediation Data(Bandwidths Data)ThrottlingNumber of users
- 127. Number of Request and Response counts
- 128. Service incoming and outgoing bandwidthsStratos BillingScheduled invoice generation
- 129. Ability to view past invoices and the current(interim) invoice
- 130. Securely pay the invoice via Paypal
- 131. Notifies the customer via email on received payments
- 132. Notifies the super-admin on customers exceeding the credit limit
- 133. Presents a summary view to the super-admin
- 134. Logging
- 135. Distributed LoggingEvery service and custom applications logs are captured by the log4j/commons loggings settings
- 136. Logs are partitioned & stored by tenant
- 137. Logs are sent to the Manager service via syslog
- 138. Logs are then viewable / downloadable by tenant adminsMT-Logging Deployment Architecture
- 139. Log Viewer – Stratos Manager {Super-Tenant}
- 140. Log Viewer – Stratos Data Services Server {Tenant User}
- 141. MessagingA full AMQP message broker
- 142. Pub/Sub and Queuing
- 143. Queues and Topics are partitioned by tenant
- 144. Authorized against the tenant identity store
- 145. JMS
- 146. Backed by a multi-tenant JNDI implementation based on our Registry
- 147. Amazon SQS API
- 148. WS-EventingTooling
- 149. Questions
- 150. Thank You!