Post on 18-Jan-2018
description
• Except where noted contents © 2014 Development Partners Software Corporation • http://www.devpartners.com •
the
Microsoft AzureCloud Platform
Bill Wilder, Finomial CTO@codingoutloudcodingoutloud@gmail.comblog.codingoutloud.comlinkedin.com/in/billwilder
Zoran’s Class04-December-2015
HELLOmy name isBill Wilder
Azure
Don’t Mess with the Zoran
R
Questions during or after?
@codingoutloud
Image credit: https://www.flickr.com/photos/richardstep/7437999566
Azure is a Toolbox
Image credit: https://www.flickr.com/photos/richardstep/7437999566
Azure is a BIG Toolbox
Azure
Amount we’ll touch onBreadth of
Azure
Compared to What?
Similar to AWS
Similar to Google Compute + AppEngine
… but different
Cloud ComputingPackaged Software
Storage
Servers
Networking
O/S
Middleware
Virtualization
Data
Applications
Runtime
You
man
age
Infrastructure(as a Service)
Storage
Servers
Networking
O/S
Middleware
Virtualization
Data
Applications
Runtime
Managed by vendor
You
man
age
Platform(as a Service)
Managed by vendor
You
man
age
Storage
Servers
Networking
O/S
Middleware
Virtualization
Applications
Runtime
Data
Software(as a Service)
Managed by vendor
Storage
Servers
O/S
Middleware
Virtualization
Applications
Runtime
Data
Networking
Azure ServicesComputeVirtual MachinesCloud ServicesWebsitesMobile ServicesBatch
Network ServicesExpressRouteVirtual NetworkTraffic Manager
App ServicesMedia ServicesService BusPush NotificationsSchedulerBizTalk ServicesActive DirectoryMulti-Factor AuthenticationAutomationCDNAPI ManagementRemoteAppApplication Insights
Data ServicesStorageSQL DatabaseHDInsightCacheBackupSite RecoveryMachine LearningStorSimpleDocumentDBAzure SearchData FactoryStream AnalyticsOperational Insights
https://manage.windowsazure.comhttps://portal.azure.com
IaaS
Acc
ordi
ng to
Gar
tner
http:
//
ww
w.g
artn
er.c
om/t
echn
olog
y/re
prin
ts.d
o?id
=1-1
IMDM
Z8&
ct=1
3081
9&st
=sb
Aug2013
PaaS
Acc
ordi
ng to
Gar
tner
http:
//w
ww
.gar
tner
.com
/tec
hnol
ogy/
repr
ints
.do?
ct=1
4010
8&id
=1-1
P502
BX&
st=s
b
Jan2014
@Bill Wilder 14
Reality is Resource-Constrained
“Security is always a tradeoff; it must be balanced with the cost.”
- Bruce Schneier
http://www.schneier.com/essay-207.html
@Bill Wilder 15
Reality is Resource-Constrained
“_______ is always a tradeoff; it must be balanced with the cost.”
- Common Sense Wisdom
http://www.schneier.com/essay-207.html
@Bill Wilder 16
Members of Microsoft AzureSecurity Team
@Bill Wilder 17
Defenses Inherited by Azure Applications
Spoofing Tampering/ Disclosure
Elevation of Privilege
Configurable scale-out
Denial of Service
VM switch hardening
Certificate Services
Shared-Access Signatures
HTTPS
Sidechannel protections
VLANs
Top of Rack Switches
Custom packet filtering
Partial Trust Runtime
Hypervisor custom sandboxing
Virtual Service Accounts
Repudiation
Monitoring
Diagnostics Service
@Bill Wilder 18
Data
Microsoft Azure Security LayersDefense in Depth Approach
Physical
Application*
Host
Network
Strong storage keys for access control SSL support for data transfers between all parties
Front-end .NET framework code running under partial trust Windows account with least privileges
Hardened version of Windows Server 2008 OS for both VM Host and VM Guest operating systems
Host boundaries enforced by external hypervisor
Host firewall limiting traffic to VMs VLANs and packet filters in routers
World-class physical security ISO 27001 and SAS 70 Type II certifications for datacenter
processes
Layer Defense-in-Depth
SQL Database
• Column-level Encryption• Always Encrypted
Azure Active Directory
Key Management
• Azure Key Vault
Client Encryption
• Azure Storage SDK+ Azure Active Directory+ Azure Key Vault
Azure is a Toolbox
Key Point
to remember!
Azure is a Toolbox
• Code your app• Deploy your app• Host your app source code• Host your app database• Manage and Monitor your app• User management• Integration (hybrid cloud)• Dev/Test• Automate Operations• And much much much much more…
Code Your App
• Visual Studio integration & cross-platform tooling
• Platform support for PaaS and IaaS• Fast-start templates for creating a web site in
many languages / toolkits• Supports many frameworks and languages– REST– ASP.NET, Node.js, Python, Java, PHP, …
Deploy Your App
• Visual Studio Online (VSO)• Continuous Deployment (CD) from VSO,
github, others
Monitor Your App: App Insights
• Monitoring support• Alerting support• Services for gathering logs– “pets vs. cattle”
• Application Insights
Automating Automation: RunBooks
• I have stuff to automate …• … with PowerShell • On a schedule or ad hoc• Might have sensitive credentials• Might require auditing
A Tale of Two Portals
Where’s Azure?
A global map:
http://azuremap.blob.core.windows.net/apps/bingmap-geojson-display.html
Azure “Geo” Coming to Indiahttp://www.business-standard.com/article/news-ians/microsoft-s-private-preview-of-cloud-services-from-india-in-july-115060401040_1.htmlhttp://news.microsoft.com/en-in/microsoft-announces-commercial-cloud-services-from-local-datacenters-by-end-2015/
“Microsoft Announces Commercial Cloud Services from Local Datacenters by End 2015”“Microsoft's private preview of cloud services from India in July”
Concrete Example
Modern App Pattern
Microsoft Azure Compute Options• HDInsight (Hadoop) – specialized: big data• RunBooks service for automation/scripting• Mobile Services – specialized: devices• Virtual Machines – most flexible• Web Sites – most convenient• Cloud Services – most scalable, most efficient
Microsoft Azure Compute Options• HDInsight (Hadoop) – specialized: big data• RunBooks service for automation/scripting• Mobile Services – specialized: devices• Virtual Machines – most flexible• Web Sites – most convenient• Cloud Services – most scalable, most efficient• Azure Service Fabric
New Feature!
Cloud Services• Build highly scalable apps and
services• Multi-tier, multi-instance
architectures• Can be combined with other
compute services• Stateless node, horizontal scaling
approach• Automated management
Cloud Services
Web Roles • 1+ types• Windows
Server • Running IIS
.csdef cscfg
Worker Roles • 1+ types• Windows
Server • Could run
Tomcat, etc.
“Service Model”• Deployment
Package• Config: VM sizes &
instance counts, settings, endpoints, certs…
Service Bus Queue• Durable – won’t lose your data• Reliable – backed by SLA and ops team• Scalable – Internet scale• Approachable – REST + SDKs• Feature rich – supports “at least once” and
“at most once” delivery guarantees, pinning, suspend, & more…
• See also: Azure Storage Queue
Scalable Architecture
Service Bus Queue
Web Role Instances
Worker RoleInstances
QCW Example: User Uploads Photo www.pageofphotos.com
Web Server
Compute ServiceReliable Queue
Reliable Storage
QCW [on Azure]
WE NEED:• Compute (VM) resources to run our code
Web Roles (IIS) and Worker Roles (w/o IIS)• Reliable Queue to communicate
Azure Storage Queues• Durable/Persistent Storage
Azure Storage Blobs & Tables; WASD
QCW on Azure: User Uploads a Photo
WebRole(IIS)
WorkerRoleAzure Queue
Azure Blob
UX implications: user does not wait for thumbnail(architecture!)
ww
w.p
ageo
fpho
tos.
com
push pull
download_blob_to_file.py
from azure.storage import *
blob_service = BlobService( account_name = az_storage_account_name, account_key = az_storage_account_key)
stream = blob_service.get_blob( blob_container_name, blob_name)with open(file_path, 'w') as f: f.write(stream)
QCW enables Responsive UX
• Response to interactive users is as fast as a work request can be persisted
• Time consuming work done asynchronously• Comparable total resource consumption, arguably
better subjective UX• UX challenge – how to express Async to users?– Communicate Progress– Display Final results– Long Polling/Web Sockets (e.g., SignalR or Node.io)
QCW enables Scalable App
• Decoupled front/back provides insulation– Blocking is Bane of Scalability– Order processing partner doing maintenance– Twitter down– Email server unreachable– Internet connectivity interruption
• Loosely coupled, concern-independent scaling– (see next slide)– Get Scale Units right
–Key to optimizing operational CO$T$
General Case: Many Roles, Many Queues
WebRole(IIS)
WorkerRole
WebRole(IIS)
WebRole
(Public)
WorkerRoleWorker
RoleWorker
Role Type 1
WorkerRoleWorker
RoleWorkerRoleWorker
Role Type 2
Queue Type 1
Queue Type 2
Queue Type 1
Queue Type 2
Queue Type 3
• Scaling best when Investment α Benefit• Optimize for CO$T EFFICIENCY• Logical vs. Physical Architecture depends on current scale
WorkerRole
Type 2
WorkerRole
Type 2
WorkerRole
Type 2
WebRole
(Admin)
Reliable Queue & 2-step Delete
(IIS)WebRole
WorkerRole
var url = “http://pageofphotos.blob.core.windows.net/up/<guid>.png”;queue.AddMessage( new CloudQueueMessage( url ) );
var invisibilityWindow = TimeSpan.FromSeconds( 10 );CloudQueueMessage msg = queue.GetMessage( invisibilityWindow );
(… do some processing then …)queue.DeleteMessage( msg );
Queue
QCW requires Idempotent
• Perform idempotent operation more than once, end result same as if we did it once
• Example with Thumbnailing (easy case)• App-specific concerns dictate approaches–Compensating action, Last write wins, etc.
• PARTNERSHIP: division of responsibility between cloud platform & app– Far cry from database transaction
QCW expects Poison Messages
• A Poison Message cannot be processed– Error condition for non-transient reason–Use dequeue count property
• Be proactive– Falling off the queue may kill your system
• Determine a Max Retry policy per queue–Delete, put on “bad” queue, alert human, …
Image credit: https://www.flickr.com/photos/richardstep/7437999566
Azure is a Toolbox
Azure
App Toolbox
• Compute Producer: VM, Cloud Service Web Role, Service Fabric, Web Site
• Compute Consumer: VM, Cloud Service Worker Role, Service Fabric, Web Job
• Storage: SQL DB, Azure Storage Blob, Azure Storage Table, Document DB
• Messaging: Service Bus, Azure Storage Queue• Telemetry: App Insights• Management: portal.azure.com
Azure
More Tools
• Compute Producer: VM, Cloud Service Web Role, Service Fabric, Web Site, Console app on your laptop
• Compute Consumer: VM, Cloud Service Worker Role, Service Fabric, Web Job
• Storage: SQL DB, Azure Storage Blob, Azure Storage Table, Document DB, MySQL, Mongo, …
• Messaging: Service Bus, Azure Storage Queue, RabbitMQ, …• Telemetry: App Insights, New Relic, AppDynamics, …• Management: portal.azure.com, …
Azure
QCW requires “Plan for Failure”
• VM restarts will happen– Hardware failure, O/S patching, crash (bug)
• Bake in handling of restarts into our apps– Restarts are routine: system “just keeps working”– Idempotent support needed important– Event Sourcing (commonly seen with CQRS) may
help• Not an exception case! Expect it!• Consider N+1 Rule
Typical Site Any 1 Role Inst Overall System
Operating System Upgrade
Application Code Update
Scale Up, Down, or In
Hardware Failure
Software Failure (Bug)
Security Patch
What’s Up? Reliability as EMERGENT PROPERTY
What about the DATA?
• You: Azure Web & Worker Roles– Taking user input, dispatching work, doing work– Follow a decoupled queue-in-the-middle pattern– Stateless compute nodes
• Cloud: “Hard Part”: persistent, scalable data– Azure Queue & Blob Services– Three copies of each byte– Geo-replicated to sister data center– Busy Signal Pattern– Scalability targets:
https://msdn.microsoft.com/en-us/library/azure/dn249410.aspx
Questions?Comments?
More information?
?