Implementing multi-tenancy

Separating networks might take less than 2 hours to complete.

External connection setup

IBM Cloud Pak for Data System supports connection to multiple external networks by using dedicated fabric switch uplink ports. To successfully connect to multiple external networks, you must:

1. Cable the additional ports.

   On each fabric switch, ports 45-48 are dedicated for customer network uplinks.

2. Configure LACP.
3. Contact IBM Support to update the IBM Cloud Pak for Data System network configuration yml file and apply the new configuration.
   To complete this step, you must give the following information to IBM Support:

   1. IBM Cloud Pak for Data System fabric switch ports numbers, which were cabled for the additional connection: the port type that was configured on the BM Cloud Pak for Data System facing customer switch ports (trunk and or access); VLAN number for a trunk port.
   2. The floating IP, gateway IP, and netmask that you want to use on the additional fabric interface.

   An example network configuration yml file with two external networks with access ports on the customer side:

   all:
     children:
       [...]
       switches:
         hosts:
           FabSw1a:
             ansible_host: localhost
             external_connection_enabled: True
             external_connection_config:
               external_link1:
                 switch_ports: ['45']
                 port_config:
                   mtu: 9000
                   link_speed: 10000
                 vlans: ['4080']
                 strict_vlan: false
                 name: h0
                 lacp_link: True
                 lacp_rate: Fast
                 clag_id: 100
                 partner_switch: 'Fabsw1b'
               external_link2:
                 switch_ports: ['46']
                 port_config:
                   mtu: 9000
                   link_speed: 10000
                 vlans: ['4081']
                 strict_vlan: false
                 name: h1
                 lacp_link: True
                 lacp_rate: Fast
                 clag_id: 101
                 partner_switch: 'Fabsw1b'
   
     vars:
       [...]
       application_network_enabled: True
       application_network:
         network1:
           default_gateway: true
           vlan: 4080
           # just number, no slash
           prefix: 24
           gateway: 192.168.10.1
           floating_ip: 192.168.10.10
           mtu: <OPTIONAL>
           custom_routes: <OPTIONAL>
         network2:
           default_gateway: false
           vlan: 4081
           # just number, no slash
           prefix: 24
           gateway: 192.168.20.1
           floating_ip: 192.168.20.10
           mtu: <OPTIONAL>
           custom_routes: <OPTIONAL>
   

Connection-level isolation

After you connected to multiple external networks, you can isolate a corresponding database.

The SET CONNECTION command defines host access records for Netezza clients against a database or databases.

SET CONNECTION HOSTSSL DATABASE dev_db IPADDR ‘192.168.10.0’ IPMASK ‘255.255.255.0’
SET CONNECTION HOSTSSL DATABASE qa_db IPADDR ‘192.168.20.0’ IPMASK ‘255.255.255.0’

Schema changes might be completed in less than 1 hour.

1. Create databases for different tenants:

   MYDB.SCH1 (USER)=> CREATE DATABASE dev_db with COLLECT HISTORY ON;
   MYDB.SCH1 (USER)=> CREATE DATABASE qa_db with COLLECT HISTORY ON;

2. Set disable_crossdb_write to ON in postgressql.conf. For more information, see the instructions.

ACL changes might take less than 1 hour to complete.

To achieve multi-tenancy, you can have two resource groups. For example, development_group and qa_group.

Each resource group can have multiple users inside it. For simplicity, grant all admin and object privileges to the group. You can grant privileges as needed.

For more information, see Netezza Security Model.

A resource group is a special group with nonzero minimum resource percentage. Every resource group must have RESOURCE MINIMUM and RESOURCE MAXIMUM allocated, as specified for the needed allocation. For more information, Resource minimums and maximums.

Procedure

1. Create development_group and qa_group groups with RESOURCE MINIMUM and RESOURCE MAXIMUM

   MYDB.SCH1(USER)=> CREATE GROUP development_group with RESOURCE MINIMUM 60 RESOURCE MAXIMUM 100;

   MYDB.SCH1(USER)=> CREATE GROUP qa_group with RESOURCE MINIMUM 40 RESOURCE MAXIMUM 100;

2. Grant the following privileges to development_group and qa_group:

   MYDB.SCH1(USER)=> GRANT ALL ADMIN IN dev_db.ALL to group development_group;
   MYDB.SCH1(USER)=> GRANT ALL ADMIN IN qa_db.ALL to group qa_group;
   MYDB.SCH1(USER)=> GRANT ALL on dev_db to group development_group;
   MYDB.SCH1(USER)=> GRANT ALL on qa_db to group qa_group;

3. Create users and add them to their respective groups:

   MYDB.SCH1(USER)=> CREATE USER John with password 'abc123' in group development_group in resourcegroup development_group;
   MYDB.SCH1(USER)=> CREATE USER Bob with password '3566' in group qa_group in resourcegroup qa_group;

4. Add users to groups:

   MYDB.SCH1(USER)=> ALTER USER Smith in group qa_group in resourcegroup qa_group;