* The advantages of having pixies in your data center
In the emerging landscape of dynamically allocated data center resources, there are two methods for re-provisioning a server dynamically: hard-drive provisioning and PXE provisioning.
Hard-drive provisioning requires a management system to recreate a disk image on the client system being re-provisioned. PXE (preboot execution environment) provisioning – a.k.a. “pixie booting” – requires the client to grab a boot image off the network, in the same way it might grab a network address via DHCP.
Each approach has its merits. The most obvious merit in the provisioning-to-disk scenario is that the dependency of client on provisioning system ends once a disk image is complete. Network problems or provisioning system failures have no effect on the client system’s basic ability to function through power cycles and restarts.
The most obvious merit of the PXE system is its agility: restarting a server, and moving 20MB or so over the network and into its RAM to get it booted up, is orders of magnitude faster than copying 2GB of data to disk and booting. Combined with server virtualization, PXE offers maximum agility.
That speed of deployment has significant risk-mitigation implications in a couple of other scenarios: system security management and disaster recovery.
In system security, pixie booting provides a way to propagate secured or patched system images as rapidly as possible, but also to keep pre-patch versions available for equally swift rollback in the event of unforeseen problems with the patches. (This has implications outside the data center too, of course. Pixie-booted workstations would offer security advantages similar to those of a Windows or X-terminal, but would offer the benefit of actually continuing to work if the network went down – as long as no reboot was required.)
In disaster recovery, pixie booting allows conservation of a precious shared resource during the emergency: bandwidth. Re-provisioning a room full of servers all at once using disk imaging alone could clog a data center network and choke to a halt a WAN link to some alternate location. Sprinkle some pixie dust, and bandwidth requirements for re-provisioning drop by 99%!
The risk? Let’s leave aside the risk of the network being unavailable when a system needs to reboot. After all, if that is the case, the server with an image and the server without look the same, functionally. No, the real risk is in the PXE provisioning system itself, of course. Such a system must replicate the same kind of reliability and redundancy found in core network services like DHCP and DNS. If it is the foundation of server operations, it simply cannot fail.
Moreover, it must be secure. As a broadcast-based service built on top of DHCP and utilizing UDP and TFTP, PXE alone is open to compromise by anyone with physical network access. The current PXE specification allows implementation of a security service called the Boot Integrity Service (BIS) to verify that boot images come from a trusted source. Unfortunately, not all PXE servers support BIS.
There may well also be compliance-born risks. Is a system that has no auditable image anywhere within it going to pass muster in every environment? When even disk-based dynamic provisioning meets with objections, the answer is almost certainly no, at least for now.
Pixies in the data center then, combined with other server, storage, and security virtualization tools, can provide unprecedented levels of responsiveness in systems deployment and redeployment, but must be carefully tended and protected. If your environment is already friendly to dynamic provisioning, PXE’s bandwidth-conserving nature and its concomitant acceleration of deployment and recovery should put PXE on the menu of options you consider.
