Constantin M. Adam

Managing risk in multi-node automation of endpoint management

Endpoint management, including patching, health checking, configuration etc., is a key function for data center and cloud management. Managing multiple nodes through automation tools or scripts significantly increases efficiency. However, the risks of adverse impact due to excessive privilege or human error may propagate to a large pool of endpoints and lead to massive service disruptions and SLA (Service Level Agreement) violations. In this paper, we present a system that proactively and systematically manages the risk throughout the lifecycle phases of automation. We present a prototype implementation consisting of an authorization mechanism that guarantees the right level of eligibility and privilege of accessing the automation content (during the deployment stage), and an execution validator that controls the risk of human error which may cause massive damage to the infrastructure (during execution of the automation content). Our current implementation has been deployed to more than a dozen customer environments and achieved an efficiency gain of 58% with high execution accuracy.

Optimizing Service Delivery with Minimal Runtimes

In this paper, we argue that deploying applications inside minimal runtime environments, which only contain the files necessary and sufficient for the application to run, can cut down the operating costs, specifically the costs for ensuring the application security and compliance. We identify a way to deliver minimal runtimes as Docker containers built from scratch. We describe a use case where minimal runtimes simplify the service maintenance operations, by reducing the number of updates for fixing security vulnerabilities.

Managing the file system from the kernel

In this paper, we investigate the benefits of adding autonomic capabilities inside the operating system. We have developed and implemented a solution that focuses on three use cases (continuous file permission compliance, dynamic disk cleanup, and accidental removal protection) for the file system, and encapsulates all the respective file system monitoring, troubleshooting and error remedial operations in a Linux kernel module. The main benefits of this approach are the capability to detect issues instantly when they occur, and fix these issues transparently, with the invoking applications being unaware of their occurrence. These capabilities are not present in external agent architectures, including contemporary configuration management systems, like Puppet, Chef, or CFEngine. We have built a prototype and evaluated the performance of the most resource intensive use case, dynamic disk cleanup, using the FileBench file system benchmarking tool.

Design and Evaluation of a Self-Service Delivery Framework

We present a framework for automating change and service request management, a process that has remained almost entirely human-centric, despite the fact that it involves complex workflows, takes a significant amount of time, and is prone to errors. We extend previous work on modeling process complexity to evaluate the impact of automating business constraints (such as policy approvals and entitlements). Our results indicate that automation eliminates a significant amount of operational complexity, reducing it by \(68\%\) compared to the Information Technology Infrastructure Library (ITIL) guidelines, and by \(80\%\) compared to actual client processes. Automation also reduces, between \(55\%\) and \(82\%\) for different client accounts, the average time that elapses from the moment that a change request is received until it starts executing.