But du cours
Master the design, deployment, and administration of complete virtualized infrastructures, with an in-depth focus on hypervisor-level, network, and private cloud virtualization mechanisms. Building on prior knowledge in containerization (SR702) and monitoring (SR802), this course trains students to build robust, secure, and automated production virtualized environments, addressing high availability, security, and Infrastructure as Code challenges.
Acquis d'apprentissage visés
- Design and deploy a complete virtualized infrastructure (hypervisor, network, storage) tailored to the performance, availability, and security constraints of an information system
- Administer virtual machines in production: lifecycle, templates, snapshots, live migration, high availability, and automatic failover
- Design and implement virtualized network architectures (SDN, VLANs, VxLAN, virtual firewalls) while ensuring traffic isolation and security
- Deploy and administer a private cloud (Proxmox VE, OpenStack) and design a hybrid cloud architecture interconnecting on-premises resources with public cloud services
- Automate the provisioning and configuration of virtualized infrastructures using Infrastructure as Code tools (Terraform, Ansible)
- Identify and mitigate attack vectors specific to virtualized environments and apply appropriate hardening measures
Prérequis
- SR702 - System Administration: Orchestration, Containers and Automation (S7): Docker, Kubernetes, LDAP, DNS, cloud services — direct complement to infrastructure virtualization.
- SR802 - System Administration: Storage and Monitoring (S8): storage architectures, monitoring, cloud paradigms — direct prerequisite.
- SR062 / SYSRES 602 - System Administration 1 (S6): Linux administration, service management, scripting.
- SR051 - Networking and IoT Principles (S5): TCP/IP, routing, switching — essential for network virtualization.
- Expected cross-disciplinary skills:
- Advanced Linux administration: systemd, LVM, networking, firewalls (iptables/nftables)
- Bash and Python scripting; basic knowledge of Ansible
- Experience with virtualization environments (VirtualBox, VMware Workstation, or KVM)
- Understanding of network architectures: routing, VLANs, firewalls
- Ability to read technical documentation in English
Programme
- Deep dive into virtualization mechanisms:
- Review and positioning relative to containers (SR702) and storage (SR802).
- Hardware-assisted virtualization: Intel VT-x, AMD-V, IOMMU, SR-IOV.
- Type 1 hypervisors: KVM/QEMU, VMware ESXi, Hyper-V, Proxmox VE — internal architecture and comparison.
- Resource optimization: CPU/RAM overcommitment, NUMA, VM affinity and anti-affinity, balloon driver.
- High availability: hypervisor clustering, live migration, automatic failover.
- Templates, cloning, and automated VM deployment at scale.
- Advanced network virtualization:
- Virtual switches: Open vSwitch (OVS), VMware vSwitch, Linux Bridge.
- Segmentation and isolation: VLANs, VxLAN, GENEVE — L2 tunneling and extension over L3.
- SDN (Software Defined Networking): control/data plane separation, OpenFlow, SDN controllers.
- Virtual firewalls and software routers: pfSense, OPNsense, VyOS — deployment and configuration.
- Micro-segmentation and east-west network security policies.
- QoS in virtualized environments: bandwidth limiting, traffic prioritization.
- Private and hybrid cloud:
- Private cloud architecture: compute, network, storage, identity — the four pillars.
- Deployment and administration of a Proxmox VE cluster: HA, integrated Ceph storage, resource management.
- Introduction to OpenStack: Nova, Neutron, Cinder, Glance, Keystone, Horizon components.
- Hybrid cloud: interconnecting private cloud / public cloud via site-to-site VPN or peering.
- Burst strategies to public cloud: cost and data management.
- Infrastructure as Code (IaC):
- IaC principles: idempotency, versioning, reproducibility.
- Terraform: declarative provisioning of VMs and cloud infrastructures (Proxmox, AWS, Azure providers).
- Ansible: configuration and state management of VMs and hypervisors.
- CI/CD pipelines for infrastructure: integrating IaC into a GitOps workflow.
- Managing secrets and credentials in an IaC context (Vault, Ansible Vault).
- Security of virtualized environments:
- Specific attack vectors: VM escape, hyperjacking, side-channel attacks (Spectre, Meltdown, L1TF).
- Hypervisor hardening: minimal attack surface, updates, RBAC access control.
- Enhanced isolation: SELinux/AppArmor for VMs, namespaces, cgroups.
- Encryption of virtual disks (LUKS) and network storage traffic.
- Identity management in a virtualized environment: LDAP/Active Directory integration.
- Auditing and traceability of administrative actions on the hypervisor.
Modalités d'évaluation
Continuous assessments and practical work reports.
Bibliographie
- Evi Nemeth et al. - UNIX and Linux System Administration Handbook - Addison-Wesley, 5th ed., 2017
- James E. Smith & Ravi Nair - Virtual Machines: Versatile Platforms for Systems and Processes - Morgan Kaufmann, 2005
- Sameer Naik et al. - Kubernetes Cookbook: Building Cloud Native Applications - O’Reilly, 2024
- Proxmox VE Documentation: <https://pve.proxmox.com/pve-docs/>
- OpenStack Documentation: <https://docs.openstack.org>
- Open vSwitch Documentation: <https://docs.openvswitch.org>
- Terraform Documentation: <https://developer.hashicorp.com/terraform/docs>
- Ansible Documentation: <https://docs.ansible.com>
- ANSSI - Security recommendations for virtualization-based architectures: <https://www.ssi.gouv.fr/guide/>
Supports
Slides and worksheets for tutorials and practical work.