XenDesktop 5. Under The Covers. Senior Systems Engineer, EMEA

Transcription

1 XenDesktop 5. Under The Covers. Senior Systems Engineer, EMEA

2 This is a Hands On workshop. So Very few marketing and positioning slides Many slides in the deck won t be presented Ask Questions MCS Only

3 Simpler To Deploy

4 Deployment Desktop Studio Designed for IT Admins minutes to install clicks to configure seconds to add a new user

5 Quick Deploy Your Best Friend for PoC s The Quick Deploy concept guides you through the initial Installation Configuration Deployment

6 The Deployment Wizard Takes This Site Site Name Host Hosting Infrastructure Resources Storage Infrastructure Details Master Image Master VM Image VM Information VM Information Users User Settings

7 Does This Configuring Services Host Obtain Identify schema and configure creation specified SQL scripts hypervisor from services connection Create and hosting database unit (via and Hyp apply service) schema creation SQL scripts Point Create services broker catalog newly and created hypervisor database connection Register Configure and Acct join services identity with config pool service Configuring Assignment Machine Creation Create broker machine desktop accounts group in the (including identity access pool policy Create rule, entitlement a provisioning policy scheme rule, power by copying time schemes master VM etc) Create Add machines from using catalog the provisioning to the desktop scheme group Add machines to the broker catalog

8 and creates a fully functional XenDesktop 5 site

9 XenDesktop 5 New Concepts

10 New Concepts in XenDesktop 5 Site XenDesktop deployment in single geographical location Recommended not to spread WAN networks Can contain host connections from various Hypervisors (Desktop Group Size) Previously known as a farm in XenDesktop 4 Defines the XenDesktop 5 Management Realm Hosts (Hosting Unit) Infrastructure comprised of hypervisors, storage and other virtualization components such as networks that is needed to run the Virtual Desktops A site can have multiple host connections (multiple Hypervisors)

11 Site-based deployment Delivery Controller SQL Mirror SQL Cluster HA VM Delivery Controller SQL Mirror SQL Cluster HA VM Delivery Controller Delivery Controller Delivery Controller Delivery Controller

12 New Concepts in XenDesktop 5 Catalogs A collection or pool of similar machine types. Catalogs are used to populate desktop groups. Contains the base image, AD computer accounts for the Desktop. Can include machines from 1 or more hypervisors. Can be split into as many Desktop Groups as needed.

13 Direct copies of the master VM. Changes are not persisted. (Random / Static) Permanently assigned to individual users. Changes are persisted. VM s that were previously created. Desktops hosted on dedicated blade servers vdisk imaged from a master target device with PVS

14 New Concepts in XenDesktop 5 Desktop Groups Contains machines from one or more catalogs. Not limited to a single hypervisor pool. Desktop Groups are assigned to users. Desktop Rules and Power Polices are applied to Desktop Groups. A single user may access multiple desktops in a Desktop Group or a single desktop may be assigned to multiple users.

15 Summary Of The Changes XenDesktop 4 XenDesktop 5 Farm Desktop Group DDC / Broker / Controller IMA datastore XML Blob Terminal Services Site Catalog with Desktop Group XenDesktop Controller SQL database Full Armor Policy Removed Dependency

16 Exercise One, Two & Three - Desktop Deployment - What Just Happened - The Database and Services

17 Architecture

18 XenDesktop 5 Architecture Desktop Studio NOTE: Greatly Simplified Communication Desktop Director PowerShell WCF Machine Creation Service XenDesktop Controller Host Service AD Identity Service Machine Identity Service Broker Service Configuration Service Virtual Desktop Machine Creation Services Broker Services Infrastructure Services SQL Server

19 Administration Machine Database Broker Block Diagram (relation to major components) Infrastructure Services Controller Controller Machine Creation Services Desktop Studio WCF WCF Broker service SDK Active Directory License Server LDAP Hypervisor & Storage Http or PS (via HCL) VDA XML (http) IIS WCF VDA CBP (WCF) WI Sites Desktop Director Site Workstation Agent

20 Controller Services Service instances are stateless as much as possible. i.e. State is not stored in the Service rather held centrally in the database. Controllers are interchangeable Each of the broker service modules can process requests from other components. Thus there is no dependency on a particular controller server in the site. Exception to this rule: Site Services.

21 Site Services Blocks of functionality that run on only one DDC at a time However, it DOES NOT cause a bottleneck. The load is so low as to be negligible. Used for site-wide operations. Configurable via PowerShell Get-BrokerController shows which site service functions are being performed by which Controllers. Site Services allocated to controllers automatically. Brokers maintain a heartbeat and failover takes place in the event of failure.

22 What does Site Services do? Functionality modules that running in the Broker Service Controller Reaper Finds and marks failed controllers Broker Reaper Finds and kills expired launch sessions. Licensing communicates with license server Registration Hardening Completes soft registered machines to hard registrations. Power Policy manages idle pool levels and initiates policy power actions Group Usage monitors how many desktops are in use in each group

23 Hypervisor Connection Site Service One site service for each broker hypervisor connection, Set-BrokerHypervisorConnection sets the preferred Controller to run Hypervisor site service This is the only part of the broker that communicates with the hypervisors This limits the number of connections from servers that the hypervisor has to cope with.

24 Controller Registration Each Service registers with the configuration service (including the configuration service itself). This builds the directory of services available so that services can interact as required. Each service is then informed of the location of the Configuration service so that the services can use the service directory for its operations. In essence, a service directory is built and maintained.

25 XenDesktop Controller Services

26 Broker Service The Broker consists of many parts and is the main part the Controller Service (The XenDesktop Controller) Responsible for most of the day to day activity of a Site

27 The Broker responds to Enumerates and launches the desktops brokered to users. Processes registrations and status updates from VDAs. Controls power state of machines according to policy and user demands. Obtains and release licenses for sessions Passes status of XenDesktop site to admin consoles Workspace control requests, Machine reset requests

28 Broker Service Interaction with other Services MCS services e.g. Reset the disks associated with a VM immediately prior to starting that VM. Infrastructure Services Config Service is used to find the location of infrastructure and MCS services Host Service is used to obtain details about hypervisor connections Hypervisors interaction is performed via the Hypervisor Communications Library

29 Broker Interaction with Hosting Management Module Controls the power state of the configured VDA machines Manages properties such as Power actions and throttling (Power State Changes) Power policy Running / Idle pool management

30 Power Action Queues Idle Pool Count is configured under "Power Management" in the properties of Assignments Stops/starts performed via the hypervisor are queued in the SQL database (Hosting Action Queue Manager)

31 Broker Interaction with the VDA CBP (Connection Brokering Protocol) interaction with VDA Communicates with the workstation agent service on the VDA. Duties Include Registration Launch sequence Status updates session state, user logged in, PortICA stack state etc Session Control such as disconnected or terminated

32 Broker Interaction with XML Services Module. Interaction with WI via XML protocols over http(s) NFuse XML Service (wpnbr) handles user login/validation, desktop / application enumeration, launch and session control ( WorkSpace Control ). Machine Control XML service handles user-driven desktop reset of VM s STA XML Service used by Access Gateway to control/ track user sessions

33 The Broker and it s Database Remember : The Broker Service instances are stateless as much as possible. Broker service database content is split into two schemas The config schema Contains configuration data Does not update frequently The state schema. Contains information about the current state of broker elements Update frequently (and should be volatile) Both schemas contain tables and stored procedures.

34 SQL Database: Broker Service Schema Desktop Groups Desktops Catalogs Workers Worker Index Configuration Schema: chb_config DiagWorker Workers Worker Names Worker Registrations Brokered Sessions Sessions WI Sessions Worker Endpoints Soft Registrations Licenses State Schema: chb_state

35 Other Schemas Machine Creation Service DesktopUpdateManagerSchema AD Identity Service ADIdentitySchema Machine Identity Service MachinePersonalitySchema Configuration service ConfigurationSchema Host service HostingUnitServiceSchema

36 Configuration And Host Services Configuration Service (CCS) Register services that form part of the XenDesktop deployment Provides directory services to all other Rhone services including itself. Host Service (HUS) Creates and Manages connections to the Hypervisor XenServer (standalone host or a single XenServer Pool) VMWare ESX (via VMWare vcenter) Microsoft Hyper-V (via System Center Virtual Machine Manager (SCVMM)) Custom 3rd party hypervisors (requires 3rd party plugin) Analogous to Pool Management in XD4. Get-BrokerHyperVisorConnection

37 Exercise Four & Five - Adding a second controller - The Database

38 XenDesktop Controller Machine Creation Services

39 Is Provisioning Services Dead? NO!!! Citrix Provisioning Services Global Deployment Model FlexCast Unifies Management of Physical and Virtual Desktops Requires a Deployment Investment (PXE, Windows Servers) PVS is ideal for delivery of Server Class Operating Systems to bare metal Machine Creation Services Benefits of Provisioning Services Concept Optimized for Hypervisor environments Low Deployment Investment, Less config & network dependencies Not only small rather SIMPLE, CONSISTENT, STABLE etc VDI scenarios only

40 Machine Creation Services The Real VDI Provisions the virtual machines that are brokered to users. Uses a Provisioning Scheme VM s are based on a Master Image The VMs can be shared or private mode. Shared Mode The OS disk image is reset to its initial state after each restart. Private Mode The OS disk image is retained across boots. Each VM consists of an Difference disk and an Identity disk. The DIFF captures writes for the Operating System. The ID disk provides the AD computer account information

41 Machine Creation Services consists of Machine Creation Service Responsible for the creation of the VMs AD Identity Service Creates / Manages AD computer accounts and passwords of VM. Machine Identity Service Create DIFF and ID disks for VMs Manages storage attached to provisioned VMs Machine Identity Agent (VDA based) Component that resides on the VDA that ensures VDA Identity within the domain Maintains the computer AD password of the Virtual Desktop

42 Machine Creation Services

43 Machine Creation Process Provisioning process consists of 2 mechanisms Creation of a Provisioning Scheme Creation of Machines The Provisioning Scheme defines Name, CPU Count, Memory size, Master Image VM, Identity Pool, Hosting Unit, Boot Behaviour Tasks on the Provisioning Scheme are synchronous i.e. you cannot provision and delete at the same time

44 Machine Creation Process consists of STEP ONE: Image Consolidation Snapshots are consolidated into one image Mitigates performance impact of multiple snapshots This is the Master Image for provisioning scheme. Removes the dependency on the Golden Image i.e. you can change or delete the Golden Image without affecting the Virtual Machines

45 Machine Creation Process consists of STEP TWO: Machine Creation Uses Provisioning Scheme to create virtual machines. Supplies the AD Identity and disk management facilities. Creates Disks for Each Virtual Machine OS Disk image (Diff Disk) Identity disk image (ID Disk)

46 The two Disks OS disk image OS disk image (Diff Disk) The primary disk for the provisioned machine. Created by making a differencing disk to the master image. Destroyed at VM Boot The Identity disk image Contains the identity of the Virtual Machine A file called CTXSOSID.INI, The ListOfDDCs key Attached as a second disk to the VM at creation. Remains untouched for the lifetime of the VM.

47 Machine Creation Services - Operation Hypervisor Admin selects Golden Master Image, this is copied as Full Clone and becomes the Golden Master VM Image (QD Base Disk) Admin Provisions x VM s MCS creates an ID Disk and a Difference Disk and attaches them to each VM ID DIFF ID DIFF ID DIFF ID DIFF MCS Powers up the VM, obtains Identity from the ID Disk Golden Golden Master Master VM Image (BASE) Storage OS Reads come from the Base OS Writes go to the Diff Disk

48 Master VM Snapshot chain is consolidated for performance into new Golden Master VM Image consolidate Desktop Group is updated to reference new Golden Master VM Image New image is propagated to Virtual Machines at reboot

49 Identity disk and diff disks The Disk Sizes reported by a Hypervisor console are what the Hypervisor thinks and not the Actual Consumed Space The Diff Disk is Thrown Away at VM Power On

50 Just to explain what we do and why it s not new. Quote from.. Windows Server 2008 R2 native VHD support Once a differencing disk gets attached to a parent VHD, all the IO writes will be redirected to the differencing disk and parent VHD will not be modified. For example, if you have a Windows Server 2008 R2 VHD as the parent VHD and you connected a new differencing disk to this, the child VHD or the differencing disk becomes the target for all I/O writes. Hence, if you enable any role after connecting the differencing disk, all information pertaining to the new role or feature will be written to the child VHD. Thus, you can keep the parent VHD unmodified and connect multiple child VHDs to it and enable different roles/features in every child VHD.

51 Just to explain why it s not a new idea Golden VM Master Image Master Disk Virtual Machine One Virtual Machine Two Virtual Machines Virtual Machine Three Virtual Machine Four Virtual Machine Five

52 Compatible Storage Almost any shared storage will work, but... Thin Provisioned is better XenServer ESX Hyper-V Recommended NFS NFS CSV Low Scale: Fibre Channel iscsi DAS Low Scale: VMFS CSV uses VHD files under the covers - we create one 'dynamic VHD' for the master image and then differencing VHDs for each VM created. Net result - thin provisioning.

53 PVS Read Cache??? Provisioning Services: Hypervisor(s) Provisioning Services Storage Caches base image in RAM for fast delivery Machine Creation Service: Hypervisor(s) RAM Cache Storage Rack-friendly, 0U hit for RAM cache Caches base image in RAM for fast delivery

54 When to use which.. Machine Creation Services POC Production Less Complex VDI Scalability numbers later VDI Only Provisioning Services POC Production Complex VDI, Flexcast Scalability known FlexCast

55 How simple can it get Machine Creation Services No Streaming, No PXE Uses VHD Chaining Writes go to Diff Disk Reads come from Base Provisioning Services Streams over the network Utilizes PXE booting Use the Pane Of Glass analogy

56 Exercise Six - Machine Creation Services

57 Desktop Launch

58 How is a desktop launched? A lot is used in the background Desktop Viewer Web Interface Broker Services Machine Creation Service VDA Agent Service PortICA Protocol Stack Workstation Agent Service Machine Identity Agent FullArmor Policy Engine Infrastructure Services WCF License Server XML (http) WI Sites Controller IIS Controller Machine Creation Services Broker service WCF WCF Desktop Director Site Database SDK Http or PS (via HCL) CBP (WCF) LDAP Administration Machine Desktop Studio Active Directory Hypervisor & Storage VDA VDA Workstation Agent

59 How is a desktop launched (1)? User logs in to Web Interface. Web Interface validates login and requests the desktop via the broker XML service. Web Interface launches desktop via XML service. Broker selects the VDA machine, requests a reset of that machine s disk (via MCS) and starts the machine (via an HCL call to the hypervisor)

60 How is a desktop launched (1)? OS on the VM boots and the appropriate AD machine identity is applied via the machine identity agent (ID Disk attached to the VM) OS continues to boot, the workstation agent service starts, and the VDA registers with the broker. At this point, machine specific policies are applied by the FullArmor engine.

61 How is a desktop launched (1)? The VDA is now registered and can accept the ICA connection from the broker service to the workstation agent service. PortICA starts listening. The broker passes the desktop address to Web Interface Web Interface passes an ICA file to the user s web browser which launches the desktop viewer on the endpoint device

62 How is a desktop launched (1)? The desktop viewer examines the ICA file, uses its contents to identify the VDA machine, and initiates an ICA connection via PortICA to the VDA. The desktop viewer and PortICA negotiate capabilities via the ICA connection and PortICA calls the workstation agent to validate the connection and obtain user credentials.

63 How is a desktop launched (1)? The workstation agent passes the credentials on to the PortICA stack which uses them to create a new Windows session. The PortICA stack applies user-specific policies via FullArmor policy. Desktop interaction with the user via Desktop Viewer and the ICA connection is now possible.

64 Exercise Seven - Some Useful Database stuff

65 HA Scalability

66 Database Activity Measurements not available yet Still in development / optimization cycle 20,000 Desktops is approx 350MB. The Transaction Log Files are the key!!! Need to be actively managed.

67 Scalability??? No bottleneck due to farm master (XD4) Controllers load balance launch requests Controllers load balance VDA registration Controllers talk to SQL database Don t forget proximity to the database Single server scalability Disk i/o could be the bottleneck and logon rate plays a role here

68 Database High-Availability Broker is critically dependant on Database Existing connections not impacted Creating new connections and reconnecting to desktops impacted Database Failure = Broker Failure Supported Database H/A Options: (expected popularity order) 1. SQL Mirror Virtual Machine H/A 3. SQL Cluster

69 Autonomous VDA High Availability Mode: Brokered VDA is available for connection via ICA Launch file when the broker is unavailable Stand-Alone Mode: VDA connections made via ICA Launch file conditioned by licensing period control Demo Mode: Demonstration mode using VDA and Client control panels providing time limited connections

70 Autonomous VDA High Availability Mode Allows client connect via ICA file when broker is down Enabled by registry setting HKLM\Software\Citrix\VirtualDesktopAgent\HighAvailability REG_DWORD set to non-zero Limited to 30 days.

71 Design No longer necessary to define specialised servers. SQL SOA architecture A single DDC can maitina 10,000 VDA By misktake we tested 20,000 Site Services are distributed automatically between the controllers, using the election process is as follows: Cmdlet Get-BrokerController. Look for property ActiveSiteServices Simply configure all the desktops with the addresses of all brokers. The VDA will randomly select one DDC from the list and try to register with that DDC. If registration fails then that DDC is removed from the list and the cycle repeats until the VDA either registers or exhausts the list. In the latter case with the exhausted list, the VDA will wait and repeat the whole process again with the original full list.

72 Design Desktop Director has been designed for enterprise grade service desks and is therefore very scalable. Nevertheless it is recommended to install Desktop Director on separate servers, to ensure not impacting logon times due to high console usage. There are five operations that require administrative access to the server/database. These are expected to always being performed by an administrator, so there is no specific role-based support for these. The operations are: Database/schema creation and addition of first DDC: The minimal role membership required to run the generated script is dbcreator plus securityadmin (note that I think if run directly via Desktop Studio you require sysadmin privilege).

73 Design Adding a subsequent DDC: The script creates a login, a DB user, and executes various stored procedures in the XD database. Since there is no XD-specific database role associated with this, you would minimally need securityadmin and db_owner privileges. Removing a DDC: The script removes a DB user and executes various stored procedures in the XD database. Since there is no XD-specific database role associated with this, you would need db_owner privileges. Note that the securityadmin role is not required since the login is not removed. Adding DDC logins to a mirror server: The script creates just a login suitable for the DDC (the minimum required configuration on the mirror server in a mirrored configuration). This requires securityadmin privileges. Schema updates: Require db_owner privileges

74 Feedback und Präsentationen Ihre Meinung ist uns wichtig. Bitte nehmen Sie sich einige Minuten Zeit, unseren Online Feedbackbogen auszufüllen. Den Link dazu erhalten Sie einige Tage nach der Veranstaltung. Im Anschluss an den Fragebogen haben Sie Zugriff auf die Downloadseite der Präsentationen.

75

76 Additional Material That Wasn t Presented

77 Resources XenDesktop Design Handbook Provisioning Services Anti Virus Best Practices Virtual Desktop Resource Allocation XD5 POC Quick Start Guide Screen shot based, step by step guide to a PoC Covers Quick Deploy, Desktop Deploy Examples of Desktop Studio, Desktop Director

78 Resources Configure a XenDesktop 5 Site to Use an Existing SQL Database Move an Existing XenDesktop 5 Database to a New SQL Server Configure XenDesktop for SQL Database Mirroring Reconfigure a XenDesktop Site to Use a Mirrored Database XDDBDiag for XenDesktop

79 Resources Redeploy XenDesktop Without Re-Installing XenDesktop 5 FAQ Use a Specific SQL port with XenDesktop 5 XenDesktop 5 Database Transaction Log Growing Excessively Change the XML Port in XenDesktop 5

80 Resources Planning Guide: XenDesktop 5 Migration XenDesktop 4 to XenDesktop 5 Virtual Desktop Agent Conversion Process with Provisioning Server XenDesktop Planning Guide: Desktop Image Delivery XenDesktop 5 Master Classes

81 Resources HDX Demo Mode y+it+out

82 XD5 Quick PoC Kit My Citrix Ask you Citrix contact Tracking of downloads URL alias available: