Windows Terminal Servers Infrastructure

Transcription

1 BASICS Windows Terminal Servers Infrastructure 10 th of March 2017 Sebastian Bukowiec CERN, IT-CDA-AD

2 Windows Terminal Servers Provide the ability to host multiple, simultaneous client sessions on Microsoft Windows Server. Two major functions: provide access to CERN network from outside control the access to critical or key parts of the accelerator complex e.g. Technical Network 3/10/2017 BASICS 2

3 Infrastructure 140 machines 28 load-balanced clusters The usage is very dynamic with an average of 600 connections per day and 200 active, concurrent connections during working hours. 3/10/2017 BASICS 3

4 WTS Infrastructure Architecture RDS License Servers Passive/Active Load Balancers (HAProxy) RDS Connection Brokers 3/10/2017 BASICS 4

5 Beginning $ ai-bs-vm --foreman-hostgroup windows_infrastructure/ts/[cluster_name] --nova-image "Windows Server 2008 R2 - x64 [ ]" --nova-flavor "m2.xlarge --nova-availabilityzone cern-geneva-[a,b,c] cerntsbexxx.cern.ch 3/10/2017 BASICS 5

6 Puppet configuration baseline 3/10/2017 BASICS 6

7 Puppet manifest example class hg_windows_infrastructure::ts { registry::value { 'Disable UAC': key => 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System', value => 'EnableLUA', data => '0', type => 'dword' } windowsfeature { 'RDS-RD-Server': ensure => present, restart => true } wmi { 'Change RDS RDP-TCP Environment Setting': wmi_namespace => 'root/cimv2/terminalservices', wmi_class => 'Win32_TSEnvironmentSetting', wmi_property => 'InitialProgramPolicy', wmi_value => 2, } manipulate registry install features use public modules class { 'windows_disable_ipv6': ipv6_disable => true, ipv6_reboot => true } exec { 'Disable TCP Chimney': command => 'netsh int tcp set global chimney=disabled', unless => '$ChimneyState = netsh int tcp show global Select-String "Chimney Offload State"; if($chimneystate -like "*disabled*") {exit 0} else {exit 1}', provider => powershell } invoke commands } 3/10/2017 BASICS 7

8 LB scenarios The two principal scenarios for the load balancer deployment: the highly-available (active / active) two HAProxy severs provide the load balancer for multiple WTS clusters (27) using ACL rules and redirecting connections to different backends single-node (passive / active) two, small HAProxy VMs load balancing a single cluster 3/10/2017 BASICS 8

9 WTS load balancing The algorithms used to select a server in the cluster: leastconn roundrobin 3/10/2017 BASICS 9

10 HAProxy configuration example frontend RDP-IN bind *:3389 acl cerntslb08 dst acl cerntslb10 dst acl cerntslb11 dst default_backend cernts mode tcp option tcpka persist rdp-cookie tcp-request inspect-delay 5s tcp-request content accept if RDP_COOKIE timeout client 48h use_backend cerntsel if cerntslb08 use_backend cerntscryo if cerntslb10 use_backend cerntscv if cerntslb11 backend cerntscv balance leastconn mode tcp option tcpka option redispatch option abortonclose persist rdp-cookie server CERNTSBE :3389 weight 100 check agent-check agent-port 3333 inter 2000 rise 2 fall 3 minconn 0 maxconn 0 on-marked-down shutdown-sessions server CERNTSBE :3389 weight 100 check agent-check agent-port 3333 inter 2000 rise 2 fall 3 minconn 0 maxconn 0 on-marked-down shutdown-sessions server CERNTSBE :3389 weight 100 check agent-check agent-port 3333 inter 2000 rise 2 fall 3 minconn 0 maxconn 0 on-marked-down shutdown-sessions stick on rdp_cookie upper stick-table type string size expire 12h peers tshap tcp-request inspect-delay 5s tcp-request content accept if RDP_COOKIE timeout server 48h 3/10/2017 BASICS 10

11 HAProxy web interface 3/10/2017 BASICS 11

12 LB feedback agent <xml> <Cpu> <ImportanceFactor value="0" /> <ThresholdValue value="100" /> </Cpu> <Ram> <ImportanceFactor value="1.06" /> <ThresholdValue value="95" /> </Ram> <TCPService> <Name value="http" /> <IPAddress value="*" /> <Port value="80" /> <MaxConnections value="0" /> <ImportanceFactor value="0" /> </TCPService> <ReadAgentStatusFromConfig value="true" /> <ReadAgentStatusFromConfigInterval value="5" /> <AgentStatus value="normal" /> <Interval value="120" /> </xml> 3/10/2017 BASICS 12

13 HA LBs Utilization 3/10/2017 BASICS 13

14 WTS Cluster nodes CERN OpenStack virtual machines m2.xlarge flavors (for all new machines) (8 cores, GB of memory, 80 GB SSD storage) Windows Server 2008 R2 and Windows Server 2012 R2 are the WTS server versions currently in use at CERN Volumes for additional storage (used to store user profiles on some WTS) 3/10/2017 BASICS 14

15 Acknowledgements Uwe Epting (BE-ICS-CIC) Luigi Gallerani (BE-CO-IN) Thank you for your great collaboration! 3/10/2017 BASICS 15