QA Re-Design? How would you do it with AIX backend DB Servers and VMware?

[jslarouche]

Hello all,

I have been asked to re-design our QA environment here at the company I work for.. It's defiantly going to be a heavy task to accomplish.. But currently we have a whole list of requirements that have to be met. We are planning on using VMware to facilitate the provisioning of VM's on the Wintel side of things and we also have AIX in the backend for Database servers for Oracle Rack and so forth.. The question I have to ask the community is.. How is your QA environment setup as in your company? What is the current tread? Completely isolated? Create a sub domain in your current production environment and mix the two together which to me could be scary? What is the best practise to look for in setting up a proper QA environment before placing code or upgrading software before it hits production as a safe guard? The other challenge aslo lies in the AIX servers and that they connot be refresh as easily and quickly as VM's servers.

Thoughts anyone?

[mcowger]

Totally separate datacenters, networks, etc.

--Matt

VCP, vExpert, Unix Geek

[Texiwill]

Hello,

QA should mimic production as close as possible. Best measurement is still 12" to the Foot. Generally they should be at least separated from Production using a firewall but separate is the way to go.

Best regards,
Edward L. Haletky
VMware Communities User Moderator, VMware vExpert 2009
====
Author of the book 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', Copyright 2008 Pearson Education.
Blue Gears and SearchVMware Pro Blogs -- Top Virtualization Security Links -- Virtualization Security Round Table Podcast

[jslarouche]

What type of mechanism do you use to get into that isolated environment?

[mcowger]

Its not isolated from people in the office, just isolated from production. People in the office can get to QA/Dev via regular SSH, etc.

--Matt

VCP, vExpert, Unix Geek

[jslarouche]

So hows is that exactly controlled? Are you using a firewall so that the servers cant talk to each other, using a nat of some sort? We would like to set something similar to that concept.. More details would be great.

[mcowger · Accepted solution]

Extensive firewalls and ACLs.

--Matt

VCP, vExpert, Unix Geek

[jslarouche]

Once that is in place are you using a differnet subnets and using different hostnames behind the firewall?

[mcowger]

Every site has many different subnets, and hostnames are unique to a site (they are very structured). The firewalls (really just nice switches) between each site control cross site traffic.

--Matt

VCP, vExpert, Unix Geek

[jslarouche]

So how do you keep the AD up to date? Clone the DC and place into that isolated environment?

[mcowger]

We dont use windows. For our central auth we have the KDC/NIS servers in each datacenter, and they pull from a central repo.

--Matt

VCP, vExpert, Unix Geek

[jslarouche]

Okay great thanks for your help on this. Much appreciated.