Tuesday Jul 07, 2015

Introducing Secure Live Migration

Secure Live Migration with Oracle Solaris Kernel Zones

Hopefully you have heard about the Oracle Solaris 11.3 Beta release but if not you can learn more here.

One of the key features of the Oracle Solaris 11.3 Beta release is the introduction of Secure Live Migration for Kernel Zones. This feature brings with it a couple of things of note.

First the obvious part - with live migration system administrators can limit the number and types of outages to applications and end users. This is particularly useful when there is a requirement to do system maintenance to the underlying OS or hardware. The Kernel Zones environments can be migrated off the source system before this maintenance. This is especially useful in today's datacenter where workloads (and owners of those workloads) running on systems can be many and varied. It is not always simple to organise a common outage window and can actually be quite frustrating.

Secondly the secure part. With secure live migration, not only is your data protected but man in the middle attacks are prevented. As with other security features in Oracle Solaris this is the default setting and automatically takes advantage of the available hardware crypto accelerators - meaning you get this protection at no additional performance cost. You may have to set up some security keys but our documentation walks you through this.

So, you are about to try live migrating a Kernel Zones, here are 10 things you might not know:

  1. We recommend that you use a 10GB link between the source and target systems
  2. Live migration with Kernel Zones is available on both SPARC and x86 systems
  3. On SPARC you will need to update your firmware to the appropriate system firmware level (see the docs for actual details)
  4. We recommend you perform live migration with a non-root user
  5. You will need running instances of these 3 services: live migration daemon, Remote Administration Daemon, and NTP server
  6. You can perform a dry run of a live migration with the -n option to zoneadm migrate
  7. Right now you cannot live migrate an LDom guest that has a running Kernel Zone inside it
  8. You might want to consider having a dedicated link for live migration or putting some bandwidth controls on
  9. Live migration tasks are performed by the zone itself so if you have CPU resource limits in place, make sure there is sufficient for the live migration task
  10. You don't have to have a config for a zone setup on the target system, you can configure a privileged to get this done automatically
That's it for now, good luck with the Oracle Solaris 11.3 beta and do let us know in the comments how you get on.

Wednesday Dec 17, 2014

Kernel Zones in 5 minutes

I was lucky enough to get some time to tell Rick Ramsay about Kernel Zones, unfortunately it was only 5 minutes ;-) You can see the result here (go on you know you want to):

You can also get started with Oracle Solaris Kernel Zones with the help of this howto guide.

Wednesday Dec 10, 2014

Which Oracle Solaris Virtualization

Updated: As of Oracle Solaris 11.3 Kernel Zones now support Live Migration on x86 and SPARC platforms 

From time to time as the product manager for Oracle Solaris Virtualization I get asked by customers which virtualization technology they should choose. This is probably because of two main reasons.

  1. Choice: Oracle Solaris provides a choice of virtualization technologies so you can tailor your virtual infrastructure to best fit your application, not to have force (and hence compromise) your application to fit a single option 
  2. No way back: There is the perception, once you make your choice if you get it wrong there is no way back (or a very difficult way back), so it is really important to make the right choice

Understandably there is occasionally a lot of angst around this decision but, as always, with Oracle Solaris there is good news. First the choice isn't as complex as it first seems and below is a diagram that can help you get a feel for that choice. We now have many many customers that are discovering that the combination of Oracle Solaris Zones inside OVM Server for SPARC instances (Logical Domains) gives them the best of both worlds.

Second with Unified Archives in Oracle Solaris 11.2 you always have a way back. With a Unified Archive you can move from a Native Zone to a Kernel Zone to a Logical Domain to Bare Metal and any and all combinations in-between. You can test which is the best type of virtualization for your applications and infrastructure and if you don't like it change to another type in a few minutes. 

Friday Oct 12, 2012

Solaris: Built for the cloud

Not able to get to all the pods at Oracle Open World? Well at least you can now see what we had to say at the Oracle Solaris Cloud pod. This uncut version will be also entered into the "Who ate all the pies?" category at the Oscars.



« July 2016

No bookmarks in folder


No bookmarks in folder