full-stack overview - huawei · 2020-04-07 · full-stack overview full-stack overview issue 01...

Full-Stack Overview

Full-Stack Overview

Issue 01

Date 2019-07-19

HUAWEI TECHNOLOGIES CO., LTD.

Copyright © Huawei Technologies Co., Ltd. 2019. All rights reserved.No part of this document may be reproduced or transmitted in any form or by any means without prior writtenconsent of Huawei Technologies Co., Ltd. Trademarks and Permissions

and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd.All other trademarks and trade names mentioned in this document are the property of their respectiveholders. NoticeThe purchased products, services and features are stipulated by the contract made between Huawei and thecustomer. All or part of the products, services and features described in this document may not be within thepurchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information,and recommendations in this document are provided "AS IS" without warranties, guarantees orrepresentations of any kind, either express or implied.

The information in this document is subject to change without notice. Every effort has been made in thepreparation of this document to ensure accuracy of the contents, but all statements, information, andrecommendations in this document do not constitute a warranty of any kind, express or implied.

Issue 01 (2019-07-19) Copyright © Huawei Technologies Co., Ltd. i

Contents

1 What Is Dedicated Full-Stack Service?......................................................................................1

2 Why Is Dedicated Full-Stack Service?.......................................................................................3

3 Product Architecture..................................................................................................................... 43.1 System Architecture....................................................................................................................................................... 43.2 Network Architecture..................................................................................................................................................... 53.3 Security Architecture......................................................................................................................................................73.4 O&M Management.........................................................................................................................................................8

4 Product Portfolio..........................................................................................................................11

5 Application Scenarios.................................................................................................................125.1 Pan-government............................................................................................................................................................125.2 Financial Industry......................................................................................................................................................... 13

Full-Stack OverviewFull-Stack Overview Contents

Issue 01 (2019-07-19) Copyright © Huawei Technologies Co., Ltd. ii

1 What Is Dedicated Full-Stack Service?

HUAWEI CLOUD Dedicated Full-Stack Service provides finance, government, and largeenterprise customers with dedicated cloud services. The provided compute, storage, network,and cloud service management platform is physically isolated, meeting customers' highrequirements on security compliance. Dedicated Full-Stack Service and HUAWEI CLOUDhave unified architecture, O&M and operations, and APIs. By default, 10 basic cloud servicesare provided in Dedicated Full-Stack Service. You can select other advanced cloud servicesbased on your service requirements.

Figure 1-1 Dedicated Full-Stack Service

Consistent Public Cloud Experiencel Dedicated Full-Stack Service uses the same architecture as that of HUAWEI CLOUD

and inherits the mature large-scale commercial architecture of HUAWEI CLOUD. It isstable, reliable, open, and compatible.

l Dedicated Full-Stack Service provides the same APIs and the same management tools asHUAWEI CLOUD, reducing customers' development and adaptation costs.

l Dedicated Full-Stack Service synchronizes service capabilities with HUAWEI CLOUD.Cloud services in Dedicated Full-Stack Service are decoupled from each other. Thisallows users to deploy cloud services as needed, extend cloud services smoothly, andsynchronize cloud service capabilities from HUAWEI CLOUD quickly.

Full-Stack OverviewFull-Stack Overview 1 What Is Dedicated Full-Stack Service?

Issue 01 (2019-07-19) Copyright © Huawei Technologies Co., Ltd. 1

– Provides complete IaaS services for customers for their exclusive use.– Allows users to deploy services, such as databases, big data, security services,

middleware, and applications as needed.

Exclusive Physical ResourcesDedicated Full-Stack Service is deployed in the HUAWEI CLOUD data center. It supportsexclusive use of resources from underlying hardware to upper-layer software systems,meeting strict requirements of industry regulations on business cloudification.

Unified O&M and OperationsHUAWEI CLOUD O&M team performs unified O&M and operations for Dedicated Full-Stack Service, which helps customers to reduce the O&M and operations costs. It is theoptimal option for migrating core applications of governments, finance, and large enterprisecustomers to the cloud.

Full-Stack OverviewFull-Stack Overview 1 What Is Dedicated Full-Stack Service?


2 Why Is Dedicated Full-Stack Service?

Exclusive Use and Regulatory Compliance

Dedicated Full-Stack Service is deployed in the HUAWEI CLOUD data center. Users canexclusively use resources such as compute, storage, network, and cloud services, and theseresources are physically isolated, which meets the specific performance, service application,and security compliance requirements.

Industry-leading Technology

Dedicated Full-Stack Service synchronizes service capabilities with HUAWEI CLOUD.Cloud services in Dedicated Full-Stack Service are decoupled from each other. This allowsusers to deploy cloud services as needed, extend cloud services smoothly, and synchronizecloud service capabilities from HUAWEI CLOUD quickly to maintain its leadership intechnology.

Collaborative Development

Dedicated Full-Stack Service provides the same APIs and management tools as HUAWEICLOUD, reducing customers' development and adaptation costs.

Shared Ecosystem

Dedicated Full-Stack Service inherits the mature large-scale commercial architecture ofHUAWEI CLOUD and shares the same ecosystem with HUAWEI CLOUD, offeringcustomers the same service experience.

Simplified O&M

Dedicated Full-Stack Service is maintained by the HUAWEI CLOUD O&M team. Thisgreatly simplifies O&M and reduces customers' O&M costs.

Rapid Application to the Cloudl Dedicated Full-Stack Service is automatically deployed and can be quickly put into use.

l HUAWEI CLOUD provides multiple dedicated migration services to seamlessly migratecustomers' applications to the cloud.

Full-Stack OverviewFull-Stack Overview 2 Why Is Dedicated Full-Stack Service?


3 Product Architecture

3.1 System ArchitectureThe architecture of Dedicated Full-Stack Service is as follows:

l Infrastructure: indicates hardware devices and virtualization platforms, includingcompute, storage, network, and firewall devices. The infrastructure virtualization layerconverts physical resources into virtual resource pools so that various resources can beeasily and dynamically scheduled.

l Cloud service system: indicates IaaS, PaaS, and SaaS services. Dedicated Full-StackService provides multiple methods of using cloud services, such as the managementconsole, APIs, and SDKs as well as the online help center. Compute, network, andstorage resources involved in using cloud services are applied from the infrastructurevirtual resource pools.

l O&M platform: This platform is designed for the O&M engineers of cloud services forinstallation and upgrade of cloud services and routine monitoring, alarm, log, ticket,security, and cost management of virtualization systems and physical infrastructures.

Figure 3-1 Dedicated Full-Stack Service architecture

Full-Stack OverviewFull-Stack Overview 3 Product Architecture


3.2 Network ArchitectureThe network of Dedicated Full-Stack Service uses a flat architecture and has a simple internalstructure. For servers and storage devices, the network is divided into the core layer andaccess layer.

Figure 3-2 Dedicated Full-Stack Service network architecture

The networking is divided into five zones based on logical functions:l Internet egress zone: used to connect to the Internet and access network.l Network service zone: provides value-added services, such as traffic statistics, firewall,

load balancing, and VPN.l Management, compute, and storage zones: used to deploy services. Management,

compute, and storage zones have a similar structure. Servers in these three zones aredirectly connected to access switches.

Each zone interconnected with the others through core switches. Core switches are composedof high-performance switches. Subrack switches are used as core switches to form a cluster.Multiple switches are logically virtualized into a switch to implement device redundancy. Inthis case, only one management IP is required for device management.

Internet egress zoneThe Internet egress zone is used to interconnect the data center network with the Internet andthe private line network.



Figure 3-3 Internet egress zone

The Internet egress zone uses routers and Multi-Protocol Label Switching (MPLS) bearernetworks to interconnect with the Internet and Data Communication Network (DCN). TheInternet egress zone uses Border Gateway Protocol (BGP) or static routes to communicatewith external networks. Static routes are used for enterprise access. Dual links are used inactive/standby mode to ensure reliability. Each link connects to a carrier's network to ensurereliability of external connections of the data center.

The firewall in the Internet egress zone of the data center is optional and deployed seriallyThe series firewalls work in routing mode and can be divided in to Untrust, Trust, DMZ, andManagement zones. Security domains use interzone policies to control interzone trafficaccess. Open Shortest Path First (OSPF) is configured between the firewall and the egressrouter to dynamically learn routing entries advertised by the intranet.

Network Service Zone

Network service zone includes VPN devices for remote accesses, business traffic loadbalancers, and security protection device firewalls.

Figure 3-4 Network service zone

Firewalls are used to isolate security domains and control access between security domains.Firewalls support the virtual firewall function to meet high security requirements of tenants.



VPN firewalls allow only legitimate VPN traffic access to the VPN, providing encryptedremote access for users to manage and maintain their own data center resources.

Load balancers balance workloads of users' applications. Load balancing devices can bevirtualized into virtual load balancers. Virtual load balancers are logically isolated. Eachtenant can use at least one virtual load balancer. Data configurations for different tenants areindependent.

Multi-tenant IsolationThe IT administrator deploys dedicated infrastructure resources for each tenant. Deployingpublic infrastructure shared by multiple tenants in the data center can optimize resourceutilization. To use resources at a low cost, different tenant resource isolation policies must bedesigned for the data center to ensure end-to-end path isolation and meet securityrequirements.

3.3 Security ArchitectureDedicated Full-Stack Service uses the architecture designed based on the best practices in theindustry and Huawei's expertise and experience. The security architecture is designed to fullymeet security requirements of customer businesses, such as security, reliability, and dataintegrity, and provide full-stack security defense for customers.

l Reliability: Security devices and key components in security systems in the overallsecurity architecture of Dedicated Full-Stack Service are deployed in dual-node hotstandby mode to meet long-term running requirements of data center services.

l Modularization: The overall architecture of Dedicated Full-Stack Service is designedbased on six modules, including physical security, network security, host security,application security, virtualization security and customer business security. The securityarchitecture can be quickly formed based on customer requirements to provide acustomized security system.

l Easy to expand: The security architecture of Dedicated Full-Stack Service is a guidingframework. Customers can expand the security architecture easily based on the guidingframework and their security requirements for different stages. This improves the returnsof customer investment and meets their specific security requirements.



Figure 3-5 Dedicated Full-Stack Service security architecture

Security evaluation and certification for Dedicated Full-Stack Service include CSA STARGold Certification, CSA C-STAR, ISO/IEC 27001, ISO/IEC 27017, CC EAL3+, PCI DSS,MPS Level 3 Security Information Certification, and Trusted Cloud Service certification.

3.4 O&M Management

Advantages

With the development of cloud computing and virtualization technologies, IT infrastructuremanagement is transforming to self-service management, IT service automation, horizontally-expanded management of servers, storage, and network architecture, and unifiedmanagement. The next-generation data center management requirements are as follows:l Effective control of physical server costsl Lower data center operation costsl Lower management costsl Lower power consumptionl Short service rollout periodl Unified management of physical and virtual resources from different vendorsl Higher utilization of infrastructure devicesl Fault recovery and disaster protection for critical applicationsl Simplified O&M

To meet the management requirements of next-generation data centers, Dedicated Full-StackService has the following advantages in O&M management:l End-to-end self-service managementl Unified operations and maintenance managementl Automatic process orchestration, resource allocation, and application deploymentl Unified management of multiple data centersl Integration service for multiple hardware devices and software



l Maintenance management for servers, network devices, storage devices, databases, andmiddleware

O&M System ArchitectureDedicated Full-Stack Service O&M involves both the hardware and software. Figure 3-6shows the O&M architecture.l Hardware: Dedicated Full-Stack Service is deployed in the HUAWEI CLOUD data

center. Hardware replacement and network maintenance are performed by the HUAWEICLOUD O&M team.

l Software: Software O&M is performed by both the customer and the Huawei O&Mteam.– Customer O&M: Cloud Eye is mandatory for customer O&M capabilities. It is used

for monitoring databases, OSs, and cloud service resources of the customer. CloudEye is a multi-dimensional resource monitoring platform. Customers can use CloudEye to monitor the utilization of service resources, track the running status of cloudservices, configure alarm rules and notifications, and quickly respond to resourcechanges. Cloud Eye is automatically enabled based on the resources created by thecustomer. Customer can view the running status of resources and set alarm rulesthrough Cloud Eye.Application Operations Management (AOM) is optional for customer O&Mcapabilities. AOM is used for cloud-based business apps and middleware. AOM is aone-stop O&M management platform. Customers can use AOM tocomprehensively monitor and uniformly manage servers, storage devices, networks,web containers, and applications hosted in Docker and Kubernetes. This effectivelyprevents problems and helps O&M personnel locate faults in minutes, reducingO&M costs.

– Huawei O&M: Provides remote O&M services for the cloud platform, includingmonitoring alarms, deployment changes, troubleshooting, network management,and O&M data analysis. 24/7 monitoring is available for customers to ensure stablerunning of their businesses. This eliminates the need for customers to performinfrastructure O&M and enables them to focus on core businesses, creating valuesfor customers.



Figure 3-6 Dedicated Full-Stack Service O&M architecture



4 Product Portfolio

Dedicated Full-Stack Service continuously provides customers with a wide range of cloudservices on HUAWEI CLOUD to meet customers' requirements in different scenarios. Inaddition, Dedicated Full-Stack Service synchronizes service capabilities with HUAWEICLOUD for continuous iterations and upgrade.

l Basic services

Dedicated Full-Stack Service provides the following basic computing, storage, network,and management services: Elastic Cloud Server (ECS), Bare Metal Server (BMS), AutoScaling (AS), Elastic Volume Service (EVS), Volume Backup Service (VBS), ObjectStorage Service (OBS), Scalable File Service (SFS), Cloud Server Backup Service(CSBS), Virtual Private Cloud (VPC), Elastic Load Balance (ELB), Virtual PrivateNetwork (VPN), NAT Gateway, Domain Name Service (DNS), Identity and AccessManagement (IAM), Cloud Trace Service (CTS), and Cloud Eye

l Database services

Dedicated Full-Stack Service provides multiple database engines, including thefollowing: RDS for MySQL, RDS for PostgreSQL, Document Database Service (DDS),and Distributed Database Middleware (DDM)

l Big data services

Dedicated Full-Stack Service provides various big data services for different scenarios,including the following: MapReduce Service (MRS), Data Warehouse Service (DWS),Graphics Engine Service (GES), Data Lake Factory (DLF), Cloud Search Service (CSS),and Cloud Data Migration (CDM)

l Middleware and application services

Dedicated Full-Stack Service provides application middleware for customers. This helpscustomers to deploy applications in containers and upgrade and reconstruct microservicearchitecture. Currently, the following services are provided: ServiceStage, SoftwareRepository for Container (SWR), Cloud Container Engine (CCE), ApplicationOperations Management (AOM), Application Performance Management (APM),Distributed Message Service (DMS), Application Orchestration Service (AOS), andDistributed Cache Service (DCS)

l Security services

Dedicated Full-Stack Service provides the following security services to ensure securityof customer applications and data: Security Center, Anti-DDoS, Data EncryptionWorkshop (DEW), and Database Security Service (DBSS)

Full-Stack OverviewFull-Stack Overview 4 Product Portfolio


5 Application Scenarios

Dedicated Full-Stack Service can meet the requirements of data-isolated deployment andsecurity compliance for moving core businesses of finance, pan-government, and largeenterprise customers to the cloud. With customers' data secured, Dedicated Full-Stack Servicecan quickly synchronize innovative services on HUAWEI CLOUD, for example, EI, PaaS,database, and big data services. Specialized and unified O&M are provided by HUAWEICLOUD for Dedicated Full-Stack Service customers.

5.1 Pan-governmentSolution to Promoting Internet+Government Affairs People-Benefiting Information PilotProjects (State Council [2016] 23) requires that the governments' governance capabilitiesneed to be improved based on data. Government cloud projects and government big dataprojects for provinces, cities, and counties are used to break information silos, facilitatecollaborative among departments, thereby changing the passive service model to an activeservice model.

In December 2016, the State Council officially released the National InformatizationPlanning for the13th Five-Year Plan (National Development which determined theconstruction objectives of the new smart cities. Through new technologies such as AI, bigdata, and Internet of Things (IoT), urban development and construction methods aretransformed, and local resources are optimized, and urban governance is effectivelyimplemented, to provide high-quality public services, resolve or alleviate various problems,and promote sustainable urban development. The new smart city construction involves thepan-government departments related to precise governance, welfare services, eco-friendlyhousing, and industrial and economic services. These departments may include economic andinformation commission, bureau of land and resources, administration of taxation,development and reform committee, and recruitment bureau at all levels and transportation,taxation, social security, water resources, environmental protection departments as well asheating and natural gas supply organizations.

Highlightsl Independent intellectual property rights: The cloud platform is deployed in the HUAWEI

CLOUD data center. Huawei has independent intellectual property rights and delivershardware and software in a unified manner, which ensures self-control over theresources.

Full-Stack OverviewFull-Stack Overview 5 Application Scenarios


l Security compliance: With internal network zone isolated from the Internet, DedicatedFull-Stack Service provides full-stack end-to-end security defense covering theinfrastructure layer, external access, O&M management, and tenant cloud services tomeet security compliance requirements.

l Full-stack cloud service capability: Dedicated Full-Stack Service fully inherits the richcloud service capabilities of HUAWEI CLOUD and provides cloud service platformsrequired by various Smart City applications, including IaaS, PaaS, and EI. DedicatedFull-Stack Service iterates and evolves together with HUAWEI CLOUD.

l Scalable cloud services and smooth expansion: Cloud services are decoupled from eachother. Users can deploy cloud service based on their business needs with minimal upfrontinvestment and expand cloud services as needed in the future.

Customer Benefitsl Provides unified planning, construction, and O&M, reducing investment costs.

l Offers full-stack cloud service capability and various intelligent devices to improvegovernment administrative capabilities, facilitate lives of citizens, and boom businessesof smart cities.

l Physically isolates the resources to allow users to exclusively use the resources, meetingthe security compliance requirements

5.2 Financial IndustryThe "Thirteenth Five-Year Plan (2017) for the Development of Information Technology inChina's Financial Sector" points out that China will provide strong support for largeorganizations to build financial industry cloud platforms independently or jointly. Theseplatforms will be used to provide cloud services for financial institutions at all levels in theindustry, especially the small- and mid-sized ones, to improve the utilization efficiency ofindustry resources.

Multiple banking financial technology companies are established and make contributions tothe information building, business processes, and financial application software developmentusing financial industry clouds. Services from the group internal to financial enterprise, suchas small and medium-sized banks, funds, insurance, securities, trust, and to other non-financial enterprises. Financial technologies, such as cloud, big data, block chain, and AI, arebecoming key factors in the core competitiveness of various industry clouds.

Highlightsl Dedicated Full-Stack Service has rich cloud service capabilities of HUAWEI CLOUD

and supports security isolation and exclusive use of resources.

l Dedicated Full-Stack Service can access HUAWEI CLOUD to implement unified O&M,greatly reducing O&M complexity and costs and enabling customers to focus on upper-layer service reliability.

l The O&M plane, management plane, and tenant plane are isolated from one another, andsecurity is ensured dimensionally from chips to the cloud, meeting China's level 3information security protection requirements.

l An independent portal and an independent IAM authentication system are available.



Customer Benefitsl Security compliance: Dedicated Full-Stack Service supports full-stack isolation to meet

security compliance requirements for the finance and insurance industries.l Fast innovation: Dedicated Full-Stack Service offers a wide range of stable IaaS and

PaaS services to facilitate customers' innovations.l Quick delivery: The delivery duration is short, the service version is upgraded quickly,

and the latest capabilities of HUAWEI CLOUD can be synchronized.



full-stack overview - huawei · 2020-04-07 · full-stack overview full-stack overview issue 01...

Documents