SA managed server peer content caching

In previous SA releases, if you had a smaller site without a sufficient number of managed servers to justify installation of a full SA Core, SA provided the Satellite installation. The Satellite installation allowed you to install only the minimum necessary Core Components on a Satellite host, which then accessed the Primary Core’s database and other services through an SA Gateway connection.

SA also provides Managed Server Peer Content Caching, which provides, for facilities with fewer than 50 managed servers, caching of the Software Repository without the need for Satellite components.

Some of the benefits of Managed Server Peer Content Caching are:

• Peer caching uses existing SA managed servers (no additional hardware infrastructure required)
• No SA Satellite installation is required
• No SA Gateway is required
• Peer caching reduces WAN traffic during software staging
• Peer caching allows pre-staging of software packages
• An SA Satellite or Gateway is not required at the remote site
• Software can be manually loaded into the cache

For more information, see the following topics:

• Requirements
• Installing a peer cache
• Configuring the peer cache and SA servers
• Remediating with peer caching enabled
• Viewing the peer cache status page

Requirements

Managed Server Peer Content Caching requires:

• A managed server running any SA supported operating system to act as the Peer Cache server.
• Managed Servers must be configured to use peer caching using custom server attributes.

Installing a peer cache

1. Decide which managed server(s) will act as a peer cache(s).
2. Upgrade the Agents on those managed servers to SA 9.14 (other managed servers Agents do not need to be upgraded).

Perform the Agent upgrade as described in the “Agent Utilities” section of Overview.

Configuring the peer cache and SA servers

1. Create a custom attribute for each managed server in the branch/remote site.
   1. For example, peer_cache_dvc_id = 240001, where 240001 is the device ID of the server acting as a peer cache.
   2. If the branches/remote sites are modeled as device groups, you can apply the custom attributes at the device group level using a script. Managed servers added to the device group later will automatically inherit this custom attribute.
2. Ensure that all managed servers using the peer cache belong to the same customer as the peer cache.
3. (Optional) Create the following custom attributes on the managed server(s) acting as a peer cache(s):
   1. peer_cache_size = <value in megabytes>

      default: 1TB (but limited to file system size)

   2. peer_cache_path = <location of file store>

sa_cache is appended to the value you specify for the path. For example, the default for Windows is:

\Program Files\Common Files\Opsware\sa_cache

4. By default, managed servers attempt to connect to the peer cache using the cache’s primary IP address. However, you can use a custom attribute to specify a different IP address in the format:

   peer_cache_ip_field = < primary_ip | management_ip | ip:<addr>>

   where:

   primary_ip - (default) is the IP address of the management interface. This is the locally configured IP address (not NAT translated).

   management_ip - is the IP address SA uses to communicate with the server. This can be a NAT translated address.

   ip:<addr> - is used to set an IP address manually (for example, ip:192.168.2.1)

   See the SA 10.50 User Guide for more information about configuring the primary IP address and NAT for managed servers.

Remediating with peer caching enabled

You start remediation as described in the "Software management" section in the SA 10.50 User Guide.

When Managed Server Peer Content Caching is enabled, remediation performs these steps:

1. During the staging phase, managed servers are given the cache IP address (derived from the peer_cache_dvc_id custom attribute attached to the server).
2. The managed servers stages packages from the branch/remote site peer cache (see Retrieve Objects from the Peer Cache).

Retrieve Objects from the Peer Cache

When retrieving objects from the peer cache, SA performs these tasks:

1. The staging code on the managed server is passed on the IP address of the configured peer cache.
2. The staging code makes a secure connection to the Agent port of the peer cache server using the Agent’s SA security certificate.
3. The peer cache confirms that the connecting client is configured to use the cache and belongs to the same customer as the peer cache.
4. A request is made to the peer cache to stage a specified unit.
5. The peer cache server responds to the request by sending the unit.
6. During the action phase, the checksum of the object is verified against the checksum of the same object in the Software Repository.

Possible Errors

Step 1: There is no branch cache configured or unable to communicate to the cache agent:

• Staging proceeds across the WAN normally.

Step 3: The client is not authorized to use the peer cache:

1. The cache logs the unauthorized attempt.
2. The cache returns a 403 Forbidden status to the client.
3. Staging proceeds across the WAN normally.

Step 5: The cache does not have the requested object.

1. The cache returns a 503 with a Retry-Later value to the client.
2. The cache requests the object across the WAN from the Software Repository.
3. The client retries the cache after the specified time and retrieves the file.

Step 5: The cache has the requested unit, but the checksum does not match the core checksum:

1. SA treats the file as stale and deletes it when the cache is full.
2. Proceed with Step 5.

Step 5: The software repository does not have the requested object:

1. This situation should be caught during the analysis phase; if not:
2. The cache returns a 404: file not found message.

Viewing the peer cache status page

1. Install browser certificate: browser.p12

   browser.p12 is located in:

   /var/opt/opsware/crypto/spin/

   on any Slice Component bundle host. Copy the file to your local machine, and import browser.p12 into your browser following your browser import certificate instructions.

2. Using your web browser access:

   https://<peer_cache>:1002/oplets/peer_cache.py