Gravitational Private SaaS Whitepaper · Private SaaS Applications POWERED BY ... the difficulty...

8
Private SaaS Applications POWERED BY GRAVITY Private SaaS: SaaS delivered on private infrastructure Software as a Service (“SaaS”) has brought about a revolution in the way software is delivered to customers. The SaaS model evolved to alleviate the difficulty of adoption, large upfront investment and high cost of maintenance that traditional on-premise software required of customers. It has largely succeeded in these objectives by using subscription pricing and shifting the hardware procurement and software operational burden to the vendor. According to IDC Research, Cloud software, an approximation for SaaS, will grow to $112.8 billion by 2019 at a compound annual growth rate of 18.3%. However, these benefits do come with some trade-offs to the customer, including less data control, resource sharing with other customers and limited integrations across SaaS applications. In addition, there are still many workloads that need to be on private infrastructure due to regulation, latency, existing capital investments or other reasons. Private SaaS is a software delivery model that combines the benefits of SaaS and on-premise models. It does so by the software vendor continuing to provide many of the “services” required to run the software but deploying the software on the customers’ private infrastructure so the customer has more control over their data and the environment in which the application runs. This is not an entirely new concept but with the broad adoption of next- generation container technology, like Docker and Rkt and container orchestration systems, like Kubernetes and Mesos, this model is now easier and cheaper to deliver than it has been in the past. In this paper we will discuss the technical details behind the platform we have developed to deliver Private SaaS, called Gravity. Confidential - Gravitational, Inc. [email protected] | 855-867-2538 Diagram 1: Private SaaS delivers the benefits of both SaaS and on-prem software delivery methods to the end user. Cloud software will grow to $112.8 billion by 2019 at a compound annual growth rate of 18.3%.IDC Research, Inc. "Worldwide SaaS and Cloud Software 2015–2019 Forecast and 2014 Vendor Shares” Aug 2015

Transcript of Gravitational Private SaaS Whitepaper · Private SaaS Applications POWERED BY ... the difficulty...

Page 1: Gravitational Private SaaS Whitepaper · Private SaaS Applications POWERED BY ... the difficulty of adoption, large upfront investment and high cost of maintenance that traditional

Private SaaS ApplicationsPOWERED BY GRAVITY

Private SaaS: SaaS delivered on private infrastructure Software as a Service (“SaaS”) has brought about a revolution in the way software is delivered to customers. The SaaS model evolved to alleviate the difficulty of adoption, large upfront investment and high cost of maintenance that traditional on-premise software required of customers. It has largely succeeded in these objectives by using subscription pricing and shif t ing the hardware procurement and software operational burden to the vendor. According to IDC R e s e a r c h , C l o u d s o f t w a r e , a n approximation for SaaS, will grow to $112.8 billion by 2019 at a compound annual growth rate of 18.3%.

However, these benefits do come with some trade-offs to the customer, including less data control, resource sharing with other customers and limited integrations across SaaS applications. In addition, there are still many workloads that need to be on private infrastructure due to regulation, latency, existing capital investments or other reasons.

Private SaaS is a software delivery model that combines the benefits of SaaS and on-premise models. It does so by the software vendor continuing to provide many of the “services” required to run the software but deploying the s o f t w a r e o n t h e c u s t o m e r s ’ p r i v a t e infrastructure so the customer has more control over their data and the environment in which the application runs. This is not an entirely new concept but with the broad adoption of next-generation container technology, like Docker and Rkt and container orchestration systems, like Kubernetes and Mesos, this model is now easier and cheaper to deliver than it has been in the past.

In this paper we will discuss the technical details behind the platform we have developed to deliver Private SaaS, called Gravity.

Confidential - Gravitational, [email protected] | 855-867-2538

Diagram 1: Private SaaS delivers the benefits of both SaaS and on-prem software delivery methods to the end user.

“Cloud software will grow to $112.8 billion by 2019 at a compound annual growth rate of 18.3%.”

IDC Research, Inc. "Worldwide SaaS and Cloud Software 2015–2019 Forecast and 2014 Vendor Shares” Aug 2015

Page 2: Gravitational Private SaaS Whitepaper · Private SaaS Applications POWERED BY ... the difficulty of adoption, large upfront investment and high cost of maintenance that traditional

Gravity: The Platform Delivering Private SaaSGravity allows software buyers to easily install complex cloud applications onto any linux-based cluster of virtual or bare metal servers, including those at the major Infrastructure as a Service (“IaaS”) providers like Amazon Web Services and Azure. It also maintains a secure connection to those environments in order to provide application maintenance like upgrades and security patches.

Gravity does this by containerizing the application and packaging it with a customized installer, a consistent runtime environment and advanced application management tooling.

Under the hood, Gravity leverages Docker containers and the Kubernetes container orchestration system. This creates a consistent application environment across deployments and automates many of the manual operational tasks that come with the operations of an application environment, like backups and scaling. In addition, Gravity can securely connect to each environment through Teleport, a modern SSH implementation designed for remote teams managing clusters of servers. This allows for remote updates of applications and remote support so that the software vendor can still provide the “services” of SaaS on private infrastructure. Finally, Gravity includes identity and license management and robust application monitoring.

For more information on these features and to view a two minute demo, please visit gravitational.com. For the remainder of this paper we will focus on the technical details of how we deliver on these features.

Confidential - Gravitational, [email protected] | 855-867-2538

Gravity Platform Features

1) Automated installation and updates

2) Runtime enhancements for high availability

3) Identity and license management

4) Persistent Data Store Controllers

5) Advanced management tools

Diagram 2: The main components of Gravity are the software vendor’s Ops

Center, Private Deployments and Teleport which connects them.

Page 3: Gravitational Private SaaS Whitepaper · Private SaaS Applications POWERED BY ... the difficulty of adoption, large upfront investment and high cost of maintenance that traditional

Provisioning, Deployment and Upgrades

Gravity packages each application with a custom installer that allows its users to provision clusters of servers and install complex, multi-host applications across these servers. It may be installed on an IaaS cloud provider or private servers running a modern distribution of Linux. In addition, installed applications can be upgraded with a single click and zero downtime.

These benefits are achieved through Gravity’s built-in package & artifact manager, Orbit. Orbit is based on MPM (Midas Package Manager by Google) and provides key functionality to enable the setup and updating of installed applications.

The application and its dependencies are packaged as a single versioned entity.

Every node in a cluster keeps a full repository of versioned packages. Each package is a single file.

Every host keeps a local copy of everything.

Every node in Orbit keeps a local copy of each component of the application and can perform any service for high availability.

Bootstrapping via systemd.

Orbit provides hooks into systemd to allow packages to install systemd services and other types of units, like mounting volumes. This enables bootstrapping of complex systems to be installed and started easily.

Rolling upgrades and rollbacks

When a new version of the application is published to Gravity, Orbit distributes it onto every node in the cluster and those nodes are then ready to be upgraded quickly when the customer initiates the upgrade.

In order to enable rolling upgrades and rollbacks, we developed and open sourced a Kubernetes monitoring component, called Satellite. Rolling upgrades take place across the nodes through the built-in Kubernetes functionality and Satellite watches Kubernetes to make sure the cluster remains healthy during the upgrade. If anything goes wrong, a rollback is

Confidential - Gravitational, [email protected] | 855-867-2538

Diagram 3: Orbit delivers one-click updates by distributing all

dependencies across all nodes.

Page 4: Gravitational Private SaaS Whitepaper · Private SaaS Applications POWERED BY ... the difficulty of adoption, large upfront investment and high cost of maintenance that traditional

initiated. This provides an added layer of protection against downtime or disruptions during upgrades.

Container Image Management

A significant component of ensuring fast and proper deployments of complex applications is managing the container images. Gravity has built-in container image management that delivers two main features: Layer De-Duplication and Private Docker Registries.

Layer De-Duplication

When preparing a deployment of an application, Gravity automatically removes unneeded copies of layers across multiple container images (see diagram 3). This allows for:

• Speedy distribution of containers across the network for quick deployments

• Downloadable multi-stack applications for offline installation

Private Docker Registries

Every cluster has a built-in local Docker registry which results in the following benefits:

• Pre-caching of all required layers speeds up rolling updates of the new code

• Autonomous and more reliable operation: new nodes can be added even when the centralized Docker registry is down or not accessible

• Every cluster always has everything it needs to stay online

• Increased isolation between clusters: test/dev/stage environments do not need to share anything, even Docker registries

High Availability

In order to ensure that the system orchestrating the containers, Kubernetes, is highly available, we developed an “uber-container”, called Planet. Planet also enables atomic upgrade of every node: all components get updated at the same time. This design enables high availability:

Confidential - Gravitational, [email protected] | 855-867-2538

Diagram 3: Image layer de-duplication improves speed of updates.

Page 5: Gravitational Private SaaS Whitepaper · Private SaaS Applications POWERED BY ... the difficulty of adoption, large upfront investment and high cost of maintenance that traditional

Application services run in a consistent environment.

All services always run in the same containerized environment. This removes variability between nodes, Linux versions, application versions and the underlying infrastructure (AWS, Azure, etc.).

All nodes are identical to each other.

Every node in a cluster contains all application services. They are not running all the time, but this enables every node to assume any role:

• Any node can become a Kubernetes API server• Any node can become a private Docker registry• Any node can become a voting etcd member or a non-voting proxy• Any node can schedule application pods to run on it or not

Because every node keeps a full set of all possible services, every node can be replaced by re-configuring other nodes to run services that have gone down.

Identity Management

Users of Gravity can access it through either a web-based user interface or through a built-in SSH gateway, both of which can be integrated into existing identity management tools (see diagram 5).

Web UI

The web UI has two main views and control planes. Each integrates with existing enterprise identity providers. There is a “god view” which allows administrators see across all applications, versions and deployments and access a cluster with a click of a button (even behind firewalls). There is also a single cluster view which allows users to access and manage a single cluster. Each cluster can be packaged with the standard Kubernetes dashboard and 3rd party monitoring tools.

Confidential - Gravitational, [email protected] | 855-867-2538

Diagram 4: Planet In this example the node is running Kubernetes API server, etcd vo=ng member and a docker registry. Other services are also present and ready to run. Gravity can re-configure it to run a different set of services on the fly.

Page 6: Gravitational Private SaaS Whitepaper · Private SaaS Applications POWERED BY ... the difficulty of adoption, large upfront investment and high cost of maintenance that traditional

SSH Gateway

Gravity comes with a built-in SSH gateway called Teleport. It's an open sourced SSH implementation which integrates employee identities with SSH credentials of Kubernetes clusters.

Every Kubernetes cluster has its own CA (certificate authority) and is able to restrict access only to people with certificates signed by its CA. This is a powerful building block for robust RBAC ops policies.

Teleport also records every SSH session for audit & debugging purposes and comes with built-in session sharing for collaborative debugging and troubleshooting of Kubernetes clusters.

Advanced Management Tools

In addition to the web based control planes, we have developed and open sourced a number of management tools to compliment the built-in Kubernetes tooling.

Log aggregation and search

Any commercial or OSS logging solution can be packaged into Kubernetes clusters, Gravity comes with a simple built-in logging app. It is open sourced and can be found here: https://github.com/gravitational/logging-app

It is implemented as a Kubernetes app and supports searching native Linux (systemd) logs, container logs and can forward logs from all nodes in a cluster into SumoLogic, Splunk and other commercial systems.

Built-in Kubernetes monitoring

Kubernetes itself offers only limited health monitoring. That's why Gravity comes with a more robust monitoring app for Kubernetes applications. It consists of InfluxDB, Grafana and Heapster and is open sourced: https://github.com/gravitational/monitoring-app

Confidential - Gravitational, [email protected] | 855-867-2538

Diagram 6: The monitoring app runs inside Kubernetes alongside applications it's watching.

Satellite is watching Kubernetes itself.

Diagram 5: Existing identity management tools are integrated.

Page 7: Gravitational Private SaaS Whitepaper · Private SaaS Applications POWERED BY ... the difficulty of adoption, large upfront investment and high cost of maintenance that traditional

Monitoring of Kubernetes itself

The monitoring in Kubernetes works as long as Kubernetes itself is up and healthy. But who's watching the watcher? Gravity comes with a built-in Kubernetes watchdog, called Satellite. It works by constantly performing a series of Kubernetes functional tests and alerting if the cluster is not functioning properly. For example, it is used for smoothly upgrading Kubernetes itself. It is open sourced and available here: https://github.com/gravitational/satellite

Gravitational ServicesWe offer two main services in conjunction with a Gravity license: Migrating existing applications to Kubernetes and remote operations of the application.

Implementation Services

Running your application on Gravity requires two main modifications to your applications: containerizing your application and configuring it to fit into the Kubernetes operational model. We can help with both of these.

Moving to Docker Containers

We provide the following services as part of containerizing your application:

• Application image best practices: architecture and implementation services• Image management: configuration of application registries• CI/CD integration for image publishing• Optimization of Docker engines for different Linux distributions

Moving to Kubernetes

Once your application is containerized, we provide the following services with respect to Kubernetes:

• Architecture and best practices consulting• Design and development of Kubernetes definition files• Integration with CI/CD and Docker image registries• Development of custom Kubernetes schedulers and plug-ins• Integration of Kubernetes with existing operational practices and policies

Remote Operations

Gravity was designed with remote support and maintenance as a primary consideration. This allows us to act as your remote ops team. We make sure that your Private SaaS environments

Confidential - Gravitational, [email protected] | 855-867-2538

Page 8: Gravitational Private SaaS Whitepaper · Private SaaS Applications POWERED BY ... the difficulty of adoption, large upfront investment and high cost of maintenance that traditional

are up and running and that your deployments are safely updated to the latest version. Remote operations includes the following services:

Remote Management

• Supervised or automatic migration of applications to new versions• Monitoring of cluster health• Patching of security vulnerabilities• Configuration tuning

Remote Support

• Email, chat and phone support with SLAs• Hands on break/fix support with built-in screen/session sharing • Development environments (including individual laptops) are supported

We hope this paper gives you a better understanding of Gravity’s features and their implementation details. If you have any further questions, please reach out to us at [email protected] or 855-867-2538.

Confidential - Gravitational, [email protected] | 855-867-2538