Head in the Clouds

This week the Linux Foundation announced that Xen was becoming a Linux Collaboration project, Xen Project. In the announcement Amazon Web Services, AMD, Bromium, Calxeda, CA Technologies, Cisco, Citrix, Google, Intel, Oracle, Samsung and Verizon all pledged their support both monetarily and through continued contribution to the development of Xen Project.

Why is this Good For Xen?

Xen Community manager, Lars Kurth, lists a number of reasons why this move is a good for the Xen community on the Xen blog. 

• An increase in Diversity 
• Bringing Users and Developers Together
• More Collaboration

That's interesting with over 10 million users worldwide and over 60% of the code base coming from outside the walls of Citrix (the former sponsor of the Xen.org project) there was already a fair amount of diversity, users, developers and collaboration so things can only get better. 

What the Industry is Saying

The industry is abuzz talking about this move and it's been overwhelmingly positive. First off I think you would be hard-pressed to find a more elite group of users and software developers collectively behind a single virtualization solution. Secondly, the technology has over ten years of software history one of the most mature technologies in it's field. Finally, the software has the support and committment of some of the world's biggest virtualization "power users". 

For example, Verizon also added a very publics statement about their use of Xen and Apache CloudStack on their blog, Chris Drumgoole, Senior Vice President, Global Operations for Verizon Terramark wrote:

A configuration vulnerability has been discovered in CloudStack that could allow a malicious user to execute arbitrary CloudStack API calls, such as deleting all VMs being managed by CloudStack. John Kinsella of the Apache CloudStack PPMC announced the vulnerability on Sunday. The issue does have a workaround that can be applied immediately.

Severity

This is considered a critical vulnerability. You should take action to mitigate the issue immediately. Note that this can be mitigated with no downtime.

Affected Versions

All versions of CloudStack released by Citrix/Cloud.com are believed to be affected. If you’re running a version of CloudStack from the ASF git repository prior to October 7th for testing/development, that is also affected. Note that there have been no official releases from the Apache project as of yet.

Known Exploits

There are no known exploits at this time.

Mitigation

If you’re running an affected version of CloudStack, you can close this vulnerability by doing the following:

On behalf of Lars Kurth, Xen community manager:

Xen.org has just released the XCP 1.6 Beta which is available from the download page and a feature list is available in the release notes. Xen.org is also planning a Test Day for XCP 1.6 as part of the release schedule:

* XCP 1.6 Beta test day: 9 October

* XCP 1.6 Final release: 24 October

Test Days are all day IRC meetings for community members, which focus on new features and 3rd party software integrations (see XCP 1.6 test instructions). Participants (including developers) hang out on the #xentest freenode channel, test the beta or release candidate and help each other with issues or bug reports. Xen.org wants to ensure that XCP 1.6 works seamlessly with Apache Cloudstack and would like to invite cloudstack community members who care about Apache CloudStack- XCP integration to participate.

Today Citrix announced that CloudStack would become the cloud platform project in Apache Software Foundation. I’m excited not just because CloudStack will be an incredibly vibrant and successful project by itself, I also believe there is a tremendous amount of synergy between CloudStack and other cloud-related projects in Apache Software Foundation. I look forward to continuing to work with, for example, Apache Libcloud and Deltacloud projects.

I am the most excited, however, about the prospect of integrating with Apache Hadoop project. Known primarily as the technology for Big Data applications, Hadoop has gained wide-spread adoption in the industry. Similar to CloudStack which is inspired by Amazon’s EC2 service, Hadoop is modeled after Google’s MapReduce and Google File System technologies. And just like CloudStack, Hadoop is implemented in Java.

At the lowest level, Hadoop Distributed File System (HDFS) is a distributed and scalable file system. HDFS is designed to run on a large number of hosts and achieves reliability by automatically replicating data across multiple hosts. Hadoop project also includes a MapReduce engine and HBase distributed database (modeled after Google’s BigTable.) MapReduce and HBase run on top of HDFS. Highly reliable and highly efficient, Hadoop technology is being used by some of the largest cloud companies including eBay, Yahoo! and Facebook.

Today, CloudStack users already run Hadoop on CloudStack. They implement a service very similar to Amazon’s Elastic MapReduce (EMR). For cloud service providers, Hadoop represents a significant amount of workload that can be readily moved to the cloud. Enterprise deployments can achieve tremendous savings by leveraging the same CloudStack infrastructure to host Big Data workload. Users also leverage CloudStack’s bare metal provisioning capabilities to build high performance Hadoop clusters.

Working closely with Hadoop development community, we have started to explore other ways to integrate CloudStack and Hadoop. Because of its scalability, reliability, performance, and maturity, HDFS is a great object store solution for IaaS cloud. We have started the development of an S3 API front-end for HDFS. Once that work is complete, the combination of CloudStack and Hadoop will provide features equivalent to Amazon EC2 and S3 services.

When CloudStack was launched as an open source project back in 2010 our goal was to make CloudStack the leading open source cloud computing platform and to enable our users, partners, and customers to easily use, modify, and contribute to the project. We chose to license the project under the GNU Public License v3 (GPLv3) then.  The reasoning was that this was not only an OSI-approved license but also it allowed us to maintain compatibility with the Apache Software License. At the time it was the right move for the project... but times change.

Today we are announcing our move from the GPLv3 to the Apache License 2.0. We are also planning to apply contribute the CloudStack project to the Apache Software Foundation(ASF) and with their acceptance to turn CloudStack into a truly community run project but with governance provided by the Apache Foundation rather than by Citrix alone.  In addition, Citrix has stepped up its investment in the project and the open source community and decided to become a platinum sponsor of the Apache Foundation. They also will be hiring additional developers, evangelists and providing other resources to help insure the success of the CloudStack project in the long-term.

Why Switch Licenses?

Over the course of the last two years the feedback from our users and partners was that while the GPL was a fine license that it did throw up some roadblocks to their participation and use. Today Citrix has announced their intention to contribute the CloudStack code to the Apache foundation and to license CloudStack 3.0.1 and all future versions under the  Apache Software License.

This decision was not made lightly and frankly when the idea was floated I was a little skeptical as a fan of Linux I was fond of saying, “If the GPL is good enough for Linus, it’s good enough for me.” The problem is that I am only one person and while it was fine for me it was not the license that best served everyone in our community and put up barriers for others to participate.