In IBM® PureApplication™ System, applications run in the cloud as workloads that share the system's resources, such as CPU, memory, and networking. Some deployments, however, require that the workloads be isolated from each other. This IBM Redbooks® Solution Guide identifies the features of IBM PureApplication System that make it an ideal solution for implementing runtime environments with application and virtual systems isolation.

Read Martin Keen's blog posts:

• 5 Things To Know About IBM PureApplication System
• Beat the Bandwidth Hogs! How IBM PureApplication System can help

In IBM® PureApplication™ System, applications run in the cloud as workloads that share system resources, such as CPU, memory, and networking. There are some deployments, however, where workloads must be isolated from each other.

Isolation is a key consideration for cloud computing. An application deployed into a cloud environment must be able to run independently from other applications in the cloud. Each application must have sufficient resources to process its workloads, move traffic along the network, and protect its data. Isolation of applications and data, by either physical separation or virtualization within the cloud, can prevent resource contention, satisfy security requirements, and ensure that a failure of one application will not cause the failure of other applications.

An ideal solution to implement such application and virtual systems isolation is to exploit the features of the IBM PureApplication System. This guide explains how isolation can be implemented to separate complete runtime environments, as illustrated in Figure 1.


Figure 1. Isolated application environments in the cloud


Did you know?

IBM PureApplication System provides resource isolation and protection at multiple levels to address security and trust requirements. Built-in security controls provide computing node isolation, disk storage isolation, OS and virtual machine isolation, networking isolation, trust domain isolation, communication integrity and confidentiality protection, and fine-grained resource access control.

Business value

Using the isolation techniques that are incorporated in IBM PureApplication System can minimize business risks. Resource isolation offers increased security, performance, and application reliability.

For example, consider an enterprise that has an IBM PureApplication System in a cloud environment that is shared by different departments and their respective applications, such as marketing, human resources, and finance applications. To achieve the benefits of isolation, the enterprise might want to divide the computing resources into the following three sets or isolated resources:

• One set assigned to the marketing department
• One set assigned to the human resources department.
• One set assigned to the finance department.

To address computing resource isolation requirements, IBM PureApplication System provides the capabilities to create cloud groups and environment profiles. The three cloud groups (development, testing, and production) provide physical isolation of the computing nodes of the three runtime environments. In addition, IP groups with distinct VLANs are used to provide virtual network isolation for each of the environments.

• Resource isolation
  

Prevents problems within applications deployed into the cloud environment from affecting other applications in the cloud with issues of resource contention. This is done by creating virtual barriers between cloud resources, allowing them to operate independently; problems in one application deployed in the cloud do not affect other isolated systems. The primary types of isolation are:


• Computational isolation
  

Groups of CPU and memory capacity are separated from each other. This type of isolation can be physical or virtual. Physical computational isolation provides dedicated hardware resources, whereas virtual computational isolation, or virtualized resources, creates groups of separate resources that might actually share the same hardware.

• Network isolation


Communication flows between computational resources by separate connections. The isolation can be physical or logical. Physical network isolation provides the resources to allow data to travel in parallel sets of network equipment, such as separate switches. Logical network isolation shares the same network equipment and bandwidth, but the data is routed separately by a different virtual local area network (VLAN).

• Resource sharing
  

Common pools of resources, such as IP addresses, CPU, and memory are made available to systems deployed in the cloud. Each workload can acquire a different amount of resources, based on its requirements. Resource sharing is dynamic, meaning workloads acquire shared resources dynamically as needed. This configuration requires care and attention in planning and implementation because sharing resources can trigger workloads to consume excessive resources from any given pool, therefore starving the other workloads in the cloud environment.

• Resource allocation


Resource allocation, or logical isolation, enables resource sharing, but requires setting boundaries on a workload by putting lower and upper limits on resource sharing. Allocation balances isolation and sharing, ensuring that a workload gets at least the minimum resources it needs to run properly. Moreover, it prevents workloads from consuming excessive amounts of a pooled resource. You can set allocation limits on any shared resource: CPU, memory, storage, bandwidth, and even software licenses.

• Compute nodes
  

Compute nodes contain hardware components such as microprocessors, memory, network adapters, and storage adapters.

• IP groups
  

IP Groups are logical groupings of one or more IP Addresses and networking information, such as DNS, subnet, VLAN, and so on. IP Groups, and by association IP addresses, are assigned to cloud groups. At least one IP group is needed to aggregate compute nodes into a cloud group. A cloud group can contain more than one IP Group. A virtual machine (VM), deployed into the IBM PureApplication System infrastructure, will be assigned its IP address. The addresses are assigned from the available pool of addresses defined in the IP group that has been associated with the cloud group used by the VM.
• Cloud groups
  

A cloud group is a logical grouping of computing resources (Compute Nodes) to target your deployments in IBM PureApplication System. A cloud group requires one or more compute nodes and one or more IP groups. A pattern is deployed to a cloud group (using an environment profile). The pattern instance is composed of VMs. To deploy virtual machines into the IBM PureApplication System environment, you must associate these to cloud groups. Virtual machines are deployed on the compute nodes that are part of the chosen cloud group.

• Environment profile
  

Environment profiles are policies for deploying patterns into cloud groups. They group together related deployment configurations, such as virtual machine names, IP address assignment, and cloud groups. Environment profiles also associate users and user groups with cloud groups. These profiles specify the cloud groups that each user or user groups can deploy patterns to. Finally, Environment profiles create the logical isolation of resources by allocating these resources.

• User group
  

A user group is list of users in the same role. Through the use of environment profiles, IBM PureApplication System associates one or more user groups with cloud groups. This relationship enables users in the chosen user groups to deploy patterns into specific cloud groups.

• Development (DEV): An environment used for developing applications.
• Testing (TEST): Used for testing applications.
• Production (PROD): Used for running applications; this is the realm of business or end users.

• A DEV cloud group with one compute node, giving developers 16 physical cores. Setting the cloud group type to average will give a 4 to 1 ratio of virtual CPUs, therefore giving developers 64 virtual CPUs.
• A TEST cloud group with two compute nodes and cloud group type dedicated, to mimic production.
• A PROD cloud group, with three compute nodes, and the cloud group type set to dedicated, because production applications are expected to be used heavily.

• User: There must be one with full permissions on the PureApplication System.
• Compute nodes: For this example, two compute nodes must be assigned for each environment. They need to be otherwise unassigned, that is, not part of another cloud group, so that you can assign them to your cloud groups.
• Networks: You will need three application VLANs, one for each set of isolated applications. VLANs can be defined on a single network, which creates logical isolation; or on separate enterprise networks, so that the network isolation will be not just logical but also physical. We assume that these networks are connected by their respective gateways. Greater network isolation can easily be achieved by reconfiguring the gateways or adding a firewall.

1. Create an IP group.
   
   Define one or more IP groups, with IP addresses and VLAN IDs that are assigned and provided by the network administrator.
   
2. Create a cloud group.
   
   Define a cloud group by assigning one or more compute nodes, the IP group created in the previous step, and a management VLAN ID. The management VLAN is used internally by the system, so it does not require IP addresses to be provided by an administrator; however, the administrator does need to reserve each VLAN ID in the network. Unlike application VLANs, management VLANs do not need to be unique for each of these environments, as shown in Figure 3.
   
3. Create an environment profile.
   
   As noted in the Solution architecture section, the environment profile defines policies for how patterns are deployed to one or more cloud groups and how their instances run in the cloud group. The cloud group created in the previous step is added to the profile and the profile is then configured to use the IP group associated with the cloud group.

• Virtualized system and application workloads, including:

• Integrated middleware like IBM WebSphere® Application Server, web server, DB2®, and hypervisor images.
• Elastic data.
• Application-centric workloads created using pattern types such as web application patterns, database application patterns, and topology patterns.

• Scalable infrastructure, including:

• Optimized hardware tuned for running workloads.
• Isolated networking for secure communications.
• Server resiliency to prevent overload or failures.
• Dynamic storage.

• Integrated delivery, including:

• Factory assembled and wired system.
• Tuned for maximum efficiency of data, storage, workload execution, and retrievability.
• Simple approach to managing all integrated components and monitoring health of the system.
• Single pane of glass management for administrator and application deployment.

• Adopting IBM PureApplication System V1.0, SG24-8113
  http://www.redbooks.ibm.com/abstracts/sg248113.html
• IBM PureApplication System product page
  http://www.ibm.com/ibm/puresystems/us/en/pf_pureapplication.html
• IBM Offering Information page (to search on announcement letters, sales manuals, or both):
  http://www.ibm.com/common/ssi/index.wss?request_locale=en

On this page, enter PureApplication System, select the information type, and then click Search. On the next page, narrow your search results by geography and language.