Cloud Needs Context-Aware Provisioning
June 30 2010 by 
Lori MacVittie (F5)
Devops needs to be able to SELECT COMPUTE_RESOURCES from CLOUD where LOCATION in (APPLICATION SPECIFIC RESTRICTIONS)
The awareness of the importance of context in application delivery and
especially in the “new network” is increasing, and that’s a good thing.
It’s a necessary evolution in networking as both users and applications
become increasingly mobile. But what might not be evident is the need
for more awareness of context during the provisioning, i.e. deployment, process.
A desire to shift the burden of management of infrastructure does not mean a desire for ignorance of that infrastructure, nor does it imply acquiescence to a complete lack of control. But today that’s partially what one can expect from cloud computing . While the fear of applications being deployed on “any old piece of hardware anywhere in the known universe” is not entirely a reality, the possibility of having no control over where an application instance might be launched – and thus where corporate data might reside - is one that may prevent some industries and individual organizations from choosing to leverage public cloud computing.
This is another one of those “risks” that tips the scales of risk versus benefit to the “too risky” side primarily because there are legal implications to doing so that make organizations nervous.
The legal ramifications of deploying applications – and their data – in random geographic locations around the world differ based on what entity has jurisdiction over the application owner. Or does it? That’s one of the questions that remains to be answered to the satisfaction of many and which, in many cases, has led to a decision to stay away from cloud computing.
According to the DPA, clouds located outside the European Union are per se unlawful, even if the EU Commission has issued an adequacy decision in favor of the foreign country in question (for example, Switzerland, Canada or Argentina).
Back in January, Paul Miller published a piece on jurisdiction and cloud computing, exploring some of the similar legal juggernauts that exist with cloud computing:
To
date there are two primary uses for GeoLocation technology. The first
is focused on performance, and uses the client location as the basis
for determining which data center location is closest and thus,
presumably, will provide the best performance. This is most often used
as the basis for content delivery networks like Akamai and Amazon’s CloudFront. The second is to control access to applications 
or data based on the location from which a request comes. This is used, for example, to comply with U.S. export laws by preventing access to applications containing certain types of cryptography from being delivered to those specifically prohibited by law from obtaining such software.
There are additional uses, of course, but these are the primary ones today. A third use should be for purposes of constraining application provisioning based on specified parameters.
While James Urquhart 
touches on location as part of the criteria for automated acquisition
of cloud computing services what isn’t delved into is the enforcement
of location-based restrictions during provisioning. The question is
presented more as “do you support deployment in X location” rather than
“can you restrict deployment to X location”. It is the latter piece of
this equation that needs further exploration and experimentation
specifically in the realm of devops and automated provisioning because
it is this part of the deployment equation that will cause some
industries to eschew the use of cloud computing.
Location should be incorporated into every aspect of the provisioning and deployment process. Not only should a piece of hardware – server or network infrastructure – be capable of describing itself in terms of resource capabilities (CPU, RAM, bandwidth) it should also be able to provide its physical location. Provisioning services should further be capable of not only including location restrictions as part of the policies governing the automated provisioning of applications, but enforcing them as well.
Current standards efforts today such as the OCCI specification 
(intended as a means to query cloud computing implementations and its
components for information) do not make easily available the ability to
query a resource for location at run-time. It does, however, allow the
ability to select all resources residing in a specific location –
assuming you know what that location is, which nearly ends up in a
circular reference loop. The whole problem revolves around the fact
that standards and specifications and APIs have been developed with the
belief that location wasn’t important – you shouldn’t have to know –
without enough consideration for regulatory compliance and the problems
of mixing data, laws, and location. It would be very useful, given the
state of cloud computing and its “Wizard of Cloud”
attitude toward infrastructure transparency, to provide location as an
attribute of every resource – dynamically - and further offer the means
by which location can easily be one of the constraints.
Having available some standardized method of retrieving the physical location of a device or system would allow the provisioning systems to restrict its pool of available resources based on a match between any existing location restrictions required by the customer and the location of available resources. The reason for making location an attribute of every “kind” of resource is that restrictions on application or data location may extend to data traversal paths. Some industries have very specific requirements regarding not only the storage of data and access by applications, but over the transmission of data, as well. These types of requirements may include the location of network devices which have access to, for processing purposes, that data. What seems to many of us to be trivial becomes highly important to courts and lawyers and thus it behooves network devices and components to also be able to provide location from which eventually automated application-specific routing tables could be derived, thus protecting the interests of organizations highly sensitive to location at all times of its data.
This also implies, of course, that the infrastructure itself is capable of enforcing such policies, which means it must be location-aware and able to collaborate with the infrastructure ecosystem to ensure not just at-rest location complies with application restrictions but traversal-location as well, if applicable. That’s going to require a new kind of network, one based on Infrastructure 2.0 principles of collaboration, connectivity, integration and intelligence.
The inclusion of physical location as part of the attributes of a component, made available to automated provisioning and orchestration systems, could enable these types of policies to be constructed and enforced. It may be that a new attribute descriptor is necessary, something that better describes the intent of the meta-data, such as restriction. A broad restriction descriptor could, in addition to location, contain other desired provisioning-based attributes such as minimum RAM and CPU, network speed, or even – given the rising concerns regarding the depletion of IPv4 addresses – the core network protocol supported, i.e. IPv6, IPv4, or “any”.
If not OCCI, then some other standard – de facto or agreed upon – needs to exist because one thing is certain: something needs to make that information available and some other thing needs to be able to enforce those policies. And that governance over deployment location must occur during the provisioning process, before an application is inadvertently deployed in a location not suited to the organization or application.
Posted in Dynamic Infrastructure | Core Network Services | Cloud Computing | Data Center | 
0 comments
