Search

Your search keyword '"Pervaiz, Aroosha"' showing total 3 results
Start Over Author "Pervaiz, Aroosha"
3 results on '"Pervaiz, Aroosha"'

1. Implementation of New Security Features in CMSWEB Kubernetes Cluster at CERN

Author

Ali, Aamir, Imran, Muhammad, Kuznetsov, Valentin, Trigazis, Spyridon, Pervaiz, Aroosha, Pfeiffer, Andreas, and Mascheroni, Marco

Subjects
Computer Science - Cryptography and Security, Computer Science - Distributed, Parallel, and Cluster Computing
Abstract

The CMSWEB cluster is pivotal to the activities of the Compact Muon Solenoid (CMS) experiment, as it hosts critical services required for the operational needs of the CMS experiment. The security of these services and the corresponding data is crucial to CMS. Any malicious attack can compromise the availability of our services. Therefore, it is important to construct a robust security infrastructure. In this work, we discuss new security features introduced to the CMSWEB Kubernetes ("k8s") cluster. The new features include the implementation of network policies, deployment of Open Policy Agent (OPA), enforcement of OPA policies, and the integration of Vault. The network policies act as an inside-the-cluster firewall to limit the network communication between the pods to the minimum necessary, and its dynamic nature allows us to work with microservices. The OPA validates the objects against some custom-defined policies during create, update, and delete operations to further enhance security. Without recompiling or changing the configuration of the Kubernetes API server, it can apply customized policies on Kubernetes objects and their audit functionality enabling us to detect pre-existing conflicts and issues. Although Kubernetes incorporates the concepts of secrets, they are only base64 encoded and are not dynamically configured. This is where Vault comes into play: Vault dynamically secures, stores, and tightly controls access to sensitive data. This way, the secret information is encrypted, secured, and centralized, making it more scalable and easier to manage. Thus, the implementation of these three security features corroborate the enhanced security and reliability of the CMSWEB Kubernetes infrastructure., Comment: 26TH INTERNATIONAL CONFERENCE ON COMPUTING IN HIGH ENERGY & NUCLEAR PHYSICS - 2023

Published
2024
Full Text
View/download PDF

2. Implementation of CMSWEB Services Deployment Procedures using HELM

Author

Pervaiz, Aroosha, Imran, Muhammad, Kuznetsov, Valentin, Paparrigopoulos, Panos, Trigazis, Spyridon, and Pfeiffer, Andreas

Subjects
Detectors and Experimental Techniques, Computing and Computers
Abstract

The Compact Muon Solenoid (CMS) experiment heavily relies on the CMSWEB cluster to host critical services for its operational needs. Recently, CMSWEB cluster has been migrated from the VM cluster to the Kubernetes (k8s) cluster. The new cluster of CMSWEB in Kubernetes enhances sustainability and reduces the operational cost. In this work, we added new features to the CMSWEB k8s cluster. The new features include the deployment of services using Helm's chart templates and the incorporation of canary releases using Nginx ingress weighted routing that is used to route traffic to multiple versions of the services simultaneously. The usage of Helm simplifies the deployment procedure and no expertise of Kubernetes are needed anymore for service deployment. Helm packages all dependencies, and services are easily deployed, updated and rolled back. Helm enables us to deploy multiple versions of the services to run simultaneously. This feature is very useful for developers to test the new versions of the services by assigning some weight to the new service version and rolling back immediately in case of issues. Using Helm, we can also deploy different application configurations at runtime.

Published
2022

3. New Features in CMSWEB Kubernetes Cluster at CERN

Author

Pervaiz, Aroosha

Subjects
Particle Physics - Experiment
Abstract

The Compact Muon Solenoid (CMS) experiment heavily relies on the CMSWEB cluster to host critical services for its operational needs. Recently, there has been migration of the CMSWEB cluster from the VM cluster to the Kubernetes (k8s) cluster. The new cluster of CMSWEB in Kubernetes enhances sustainability and reduces the operational cost. In this project, we added new features to the CMSWEB k8s cluster. The new features include the deployment of services using Helm’s chart templates and the incorporation of canary releases using Nginx ingress weighted routing that is used to route traffic to multiple versions of the services simultaneously. The usage of Helm simplifies the deployment procedure and no expertise of Kubernetes are needed anymore for service deployment. Helm packages all dependencies and services are easily deployed, updated and rollbacked. Helm enables us to deploy multiple versions of the services to run simultaneously. This feature is very useful for developers to test the new versions of the services by assigning some weight to the new service version and rolledback immediately in case of issues. Using Helm, we can also deploy different application configurations at runtime.

Published
2021

Catalog

Books, media, physical & digital resources
See catalog results