New Features for Multitenant in Oracle Database 21c

Container only – New Features for
Multitenant in Oracle 21c
MarkusFlechtner

HI!
MARKUS FLECHTNER
PRINCIPAL CONSULTANT
 Trivadis Germany GmbH
 Studied Mathematics a long time ago
 Focus
o Oracle High Availability
o Database Upgrade + Migration
 Teacher: RAC, New Features, Multitenant, PostgreSQL
 Twitter @markusdba
 Blog: markusdba.net
 Co-author of the book The Oracle DBA (2016)

AGENDA
 Introduction
 Upgrade & Migration to Multitenant
 Resource Management & Security
 Multitenant & Oracle GridInfrastructure/RAC
 Multitenant & DataGuard
 Miscellaneous
 Conclusion

REMEMBER …
 The classical Non-CDB Architecture is desupported with Oracle
Database 21c
 Multitenant Architecture („CDB Architecture“) is the only
architecture

REMEMBER …
 Oracle Database 21c is an "Innovation Release"
o Available for Linux x86-64bit, Windows and HP-UX only
o Use it for testing and evaluating new features, but not for
production systems
 Support for Oracle Database 21c
o Premier Support ends June 30, 2023
o No extended support, error correction ends June 30,2023
 Expected next Long Term Support Release: Oracle Database 23c

9
Upgrade & Migration
to Multitenant

AUTOUPGRADE
10
 AutoUpgrade is a well known tool for upgrading and migrating
your database
o Available since 2019
o Download the latest release from MOS (Note 2485457.1)
o Recommended method for database upgrades
 Automatic upgrade of Oracle Databases
o PreUpgrade Checks & FixUps
o Database Upgrade
o PostUpgrade Tasks (e.g. TimeZone Upgrades)
o Migration from Non-CDB to PDB

USING AUTOUPGRADE FOR A NON-CDB TO PDB
MIGRATION & UPGRADE TO 21C
11
 Create the target CDB (21c) beforehand
 Autoupgrade will
o Plug in the Non-CDB as a PDB
o Upgrade the PDB to 21c

AUTOUPGRADE CONFIGURATION FILE
12
 Example configuration file:
global.autoupg_log_dir=/home/oracle/testconv
testconv1.dbname=NCDB
testconv1.start_time=NOW
testconv1.source_home=/u00/app/oracle/product/19c
testconv1.target_home=/u00/app/oracle/product/21c
testconv1.sid=NCDB
testconv1.log_dir=/home/oracle/testupgrade
testconv1.upgrade_node=localhost
testconv1.target_version=21.4
testconv1.target_cdb=TESTCDB
testconv1.target_pdb_copy_option=file_name_convert=
'('/u01/oradata/NCDB','/u01/oradata/TESTCDB/TPDB')
testconv1.target_pdb_name=TPDB
[..]

„REPLAY UPGRADE“ ON PDB OPEN AND
NON-CDB PLUG-IN
 When plugging an older PDB into a 21c-CDB, the PDB will
automatically be upgraded to 21c
 A plugged-in Non-CDB will automatically be converted to a PDB,
too
 Opening the PDB will take (much) longer and you will see the
following messages in the alert.log file (beside others):
13
[…]
TESTPDB(3):Starting Upgrade on PDB Open
[…]
TESTPDB(3):alter pluggable database application APP$CDB$CATALOG end upgrade
TESTPDB(3):Completed: alter pluggable database application APP$CDB$CATALOG
end upgrade
2021-08-16T22:41:21.815101+02:00

„REPLAY UPGRADE“ (2)
 "Replay Upgrade" is controlled by two new database properties
 After opening the PDB you have to compile all invalid objects in
the PDB with the script utl_rp.sql to make all components in
DBA_REGISTRY "valid".
14
alter database property set UPGRADE_PDB_ON_OPEN='true'
Completed: alter database property set UPGRADE_PDB_ON_OPEN='true'
alter database property set CONVERT_NONCDB_ON_OPEN='true'
Completed: alter database property set CONVERT_NONCDB_ON_OPEN='true'

15
Resource Management
&
Security

MANDATORY USER PROFILE FOR PASSWORD
SECURITY
 A „mandatory profile“ can be
created in CDB$ROOT
 This profile will be used for all users
 The profile can contain
o PASSWORD_VERIFY_FUNCTION
o PASSWORD_GRACE_TIME
 Parameter
MANDATORY_USER_PROFILE has to
be set
 Additional profiles for the database
users can exist
SQL> CREATE MANDATORY PROFILE
2 C##ALL_USER_PROFILE
3 LIMIT PASSWORD_VERIFY_FUNCTION
4 ora12c_stig_verify_function
5 CONTAINER=ALL;
Profile created.
SQL> ALTER SYSTEM SET
2 mandatory_user_profile=
3 'C##ALL_USER_PROFILE';
System altered.

DATABASE RESIDENT CONNECTION POOLING
(DRCP) PER PDB
 Using the new parameter ENABLE_PER_PDB_DRCP you can
decide, wether ..
o There is one connection pool for the entire CDB (default)
o There are isolated connection pools for each PDB
SQL> alter system set ENABLE_PER_PDB_DRCP=true|false;

ORACLE DB NEST
 Control and isolation of…
o ... OS resources used by a PDB
o … File system isolation per PDB
o … Secure computing
 Concept analog to container technologies
like Docker
o Use of Linux Namespaces
o Use of CGROUPS
 Available on Linux x86-64bit
only

KERNEL NAMESPACES
 Linux kernel function for isolation and virtualization of system
resources
 When a DB Nest is launched, Oracle creates a
set of namespaces for that DB Nest
 Processes within a DB Nest see only
its namespace
 Namespaces Types
o Process namespace
o User ID namespace
o Mount namespace
o ..

SSCOMP – SECURE COMPUTING MODESCOMP –
SECURE COMPUTING MODE
20
 Linux kernel feature
 Filter out system calls that are…
o … unnecessary
o … malicious
 Restrict the actions available within the container
 seccomp uses Berkeley Packet Filters
 Well known / used in Container environments
e.g. Docker

CONTROL GROUPS (CGROUPS)
21
 cgroups is a Linux kernel feature
 mainlined into the Linux kernel since 2007
 Allows to limit that limits, accounts for, and isolates
the resource usage of a collection of processes
 Possibility of limiting and isolating the
consumption of resources
 Heavily used in Container (runc, Docker etc.)
 CPU, memory, maximum
number of PIDs, (network,
disk I/O)

ARCHITECTURE OF A CDB NEST
22
Source: Oracle® Database Security Guide 21c

GOAL OF DB NEST
23
 DB Nest is the Oracle solution for database instance and PDB
protection
 Enables a database instance to run in a protected, virtualized
environment.
 DB Nest isolate database instance from…
o … another database instance
o … other applications
o … as well as PDBs from each other and from the CDB

DB NEST PROPERTIES
24
 Operating system isolation
o OS resources like process ID, user, and mount
 File system isolation
o Visibility for file system entities
o A pivot root in Linux namespaces
is equivalent to chroot
o A bind mount enables the contents
of one directory to be accessible in a
different directory
 Resource management
o Control and monitor the resources of a nest
 Secure computing mode (seccomp)
o seccomp to filter out system calls

CONFIGURATION OVERVIEW
 Introduction of new init.ora parameter
o DBNEST_ENABLE – Enables or disables DB Nest
o DBNEST_PDB_FS_CONF – Specifies the location of an optional
file system configuration file. Set this parameter in the CDB
root.
 Use of a dedicated broker configured in listener.ora by
DEDICATED_THROUGH_BROKER_LISTENER
 Introduction of new commandline tools dbnest and dbnestinit
o Allows to create, initialize and test DB Nests
 Requires additional OS package
o nscd – A Name Service Caching Daemon (nscd)
o sssd – System Security Services Daemon
25

BASIC DB NEST CONFIGURATION
26
ALTER SYSTEM SET use_dedicated_broker=TRUE;
DEDICATED_THROUGH_BROKER_LISTENER=ON
 Configure a dedicated broker in listener.ora
 Enable the broker
ALTER SYSTEM SET dbnest_enable=cdb_resource_pdb_all SCOPE=SPFILE;
 Enable DB Nest and restart the database
Instance running inside DB Nest (TDB200C_TDB200C)
…
PDBHR(3):DB Nest (PDB00003, 2968463207) open successful
 Check the alert.log for DB Nest
CONFIGURATION

THE DB NEST
27
oracle@training21c:~/ [TVDCDB1] dbnest list
--------------------------------------------------------------------------------
Id : Nest : Parent : : Tag : State
--------------------------------------------------------------------------------
1 : ORA_TVDCDB1_TVDCDB1 : : ORA_TVDCDB1_TVDCDB1 : OPEN
Net State :
Namespace State : (pid=0,cnid=4026531836,pnid=4026531836,no namespace,type=0x0)
Resources : (cpu=0)
Property enabled : resources
Seccomp status : (level=none)
FS Isolation : (disabled)
--------------------------------------------------------------------------------
[…]
--------------------------------------------------------------------------------
3 : PDB00003 : ORA_TVDCDB1_TVDCDB1 : PDB01 (uid=2042280984) : OPEN
Net State :
Namespace State : (pid=5791,cnid=4026532249,pnid=4026531836,type=0x7)
Resources : (cpu=0)
Property enabled : namespaces,resources
Seccomp status : (level=strict1)
FS Isolation : (default-config)
--------------------------------------------------------------------------------
CHECK DB NEST (1)

ENTERING DB NESTS
28
oracle@training21c:~/ [TVDCDB1] lsns
NS TYPE NPROCS PID USER COMMAND
4026531835 cgroup 82 1972 oracle /u00/app/oracle/product/21c/bin/tnslsnr LISTENER
4026531836 pid 80 1972 oracle /u00/app/oracle/product/21c/bin/tnslsnr LISTENER
4026531837 user 80 1972 oracle /u00/app/oracle/product/21c/bin/tnslsnr LISTENER
4026531838 uts 82 1972 oracle /u00/app/oracle/product/21c/bin/tnslsnr LISTENER
4026531839 ipc 82 1972 oracle /u00/app/oracle/product/21c/bin/tnslsnr LISTENER
4026531840 mnt 80 1972 oracle /u00/app/oracle/product/21c/bin/tnslsnr LISTENER
4026531992 net 82 1972 oracle /u00/app/oracle/product/21c/bin/tnslsnr LISTENER
4026532247 user 1 5791 oracle dbnestinit PDB00003
4026532248 mnt 1 5791 oracle dbnestinit PDB00003
4026532249 pid 1 5791 oracle dbnestinit PDB00003
4026532250 user 1 6195 oracle dbnestinit PDB00004
4026532251 mnt 1 6195 oracle dbnestinit PDB00004
4026532252 pid 1 6195 oracle dbnestinit PDB00004
 Existing Namespaces with dbnest
CHECK DBNEST (2)

ENTERING DB NESTS
29
oracle@ol7db21:~/ [TDB210C] dbnest enter PDB00001
Entering nest namespace : PDB00001
oracle@ol7db20:~/ [TDB210C] exit
exit
Exiting nest namespace : PDB00001
 Use dbnest to enter the namespace of a nest e.g. opening a shell
in this namespace
 Sqlplus "/ as sysdba" does not work with Dbnest (use passwordfile)
WORKING WITH DBNEST

FILE SYSTEM ISOLATION
30
ALTER SYSTEM SET DBNEST_PDB_FS_CONF=
'/u00/app/oracle/nest/nest_blacklist.txt' SCOPE=spfile;
vi /u00/app/oracle/nest/nest_blacklist.txt
DBNEST_NO_FS_ROOT_MODE
/bin
/usr/bin
 Directories can be excluded from a DB nest
 Create a blacklist file
 Configure the init parameter DBNEST_PDB_FS_CONF to point to
the blacklist file

NEW TOOLS FOR DBNEST
31
 New commandline tools to configure / administer Oracle DB Nests
 Currently not yet documented
 Highly try and error to use it
oracle@db21:/u00/app/oracle/nest/ [TCPU21C] dbnest -h
Usage : dbnest <command> [options]
List of options and commands.
init [options] Initialize nest environment
--stage <staging area path> Nest staging area path, Used for
storing nest conf files, skeleton
directories for nests etc.
--cgroup <base cgroups> Valid base cgroup path if
required to override the default
path available on the system.
TOOL DBNEST (1)

NEW TOOLS FOR DBNEST
32
oracle@training21c:~/ [rdbms21] dbnest -h
[…]
create <nest> [options] Create a nest
--parent <parent_nest> Parent nest name
--nstype <combination of nstypes> Combination of required namespace
types. Defaults to user, pid and
mount.
--cpu <cpu count> Number of cpus required for nest
--cpuids <list> Comma delimited cpuid range/list
e.g: 0,1-2 1-3,5 2-3 1-3,5-7 2,3
--cpu_excl <1|0> Alloc the CPUs exclusively or not
1 : alloc exclusive
0 : alloc shared (default)
--cpu_from_end <1|0> Start CPU allocation from the end
1 : alloc from end
0 : alloc from cpu0 (default)
--cpushares <cpushares> CPU shares for this nest
--max_mem <maximum memory> Max memory (in MB) for the nest
--max_swap <maximum memory> Max swap (in MB) for the nest
[..]
TOOL DBNEST (2)

33
Multitenant
&
Oracle GridInfrastructure/RAC

PDB AS A CLUSTER RESOURCE (1)
 PDBs are now cluster resources
 Example (Oracle Restart):
grid@fenrir:~/ [grinf21] crsctl stat res -t -w "TYPE = ora.pdb.type"
-------------------------------------------------------------------------------
Name Target State Server State details
-------------------------------------------------------------------------------
Cluster Resources
-------------------------------------------------------------------------------
ora.remcdb.pdb1.pdb
1 ONLINE ONLINE fenrir STABLE
ora.remcdb.pdb2a.pdb
1 ONLINE ONLINE fenrir STABLE
-------------------------------------------------------------------------------

PDB AS A CLUSTER RESOURCE (2)
 There are new commands within the well-known tool srvctl
o srvctl add pdb
o srvctl modify pdb
o srvctl config pdb
o srvctl modify pdb
o srvctl start pdb
o srvctl status pdb
o srvctl stop pdb
o srvctl enable pdb
o srvctl disable pdb
 New PDBs are automatically added as cluster resources

PDB AS A CLUSTER RESOURCE (3) - EXAMPLE
SQL> show pdbs
CON_ID CON_NAME OPEN MODE RESTRICTED
---------- --------------------- ---------- ----------
2 PDB$SEED READ ONLY NO
3 PDB1 READ WRITE NO
4 PDB2A READ WRITE NO
SQL> !srvctl stop pdb -db REMCDB -pdb PDB1
SQL> show pdbs
---------- --------------------- ---------- ----------
3 PDB1 MOUNTED
4 PDB2A READ WRITE NO

PDB SIDE RECOVERY (1)
 Until 19c
o MRP got stuck when there was a hot-cloned, flashbacked or
recovered (PITR) PDB
o Reason: an recovery process was running but there was
already MRP running in the background
o Result: ORA-1153 an incompatible media recovery is active

PDB SIDE RECOVERY (2)
 In 21c (Active DataGuard):
1. PDB on standby is automatically marked as "disabled"
2. PDB is recovered in a separate session
("PDB side recovery", "PDB recovery isolation")
3. PDB is re-enabled again
 In 21c (without ADG):
o PDB files are copied
o PDB ist marked "DISABLED AUTOMATIC RECOVERY" on Standby
o MRP does not stop
o DBA-Action:
o Recover PDB from service (Primary)
o Enable Recovery for PDB

PDB SIDE RECOVERY (3) - EXAMPLE
 On Primary
 On Standby (ADG)
SQL> create pluggable database TESTPDB from DGPDB
2 file_name_convert=('DGPDB','TESTPDB');
Pluggable database created.
SQL> show pdbs
---------- ------------------------------ ---------- ----------
3 DGPDB MOUNTED
4 TESTPDB MOUNTED
SQL> select process,status,sequence# from v$managed_standby where
2 process like 'MRP%';
PROCESS STATUS SEQUENCE#
--------- ------------ ----------
MRP0 APPLYING_LOG 20

PDB SIDE RECOVERY (4) – ALERT.LOG - STANDBY
TESTPDB(4):Datafile #11 has been copied to the standby.
2021-11-10T21:17:31.873127+01:00
TESTPDB(4):PDB Side Media Recovery started for pdbid(4)
TESTPDB(4):.... (PID:7306): Managed Recovery starting Real Time Apply [krsm.c:15901]
TESTPDB(4):max_pdb is 4
TESTPDB(4):.... (PID:7306): Media Recovery Waiting for T-1.S-20 (in transit)
[krsm.c:6191]
2021-11-10T21:17:31.949889+01:00
[…]
TESTPDB(4):.... (PID:7306): Side Recovery Complete [krds.c:1584]
2021-11-10T21:17:53.329342+01:00
all data files of pdbid 4 are brought online.
Started logmerger process
2021-11-10T21:17:53.361688+01:00

PDB SIDE RECOVERY (5) - EXAMPLE
 Without ADG (after creating a PDB as r/w-clone):
SQL> select name,RECOVERY_STATUS from v$pdbs;
NAME RECOVERY_STATUS
---------- --------------------------
PDB$SEED ENABLED
DGPDB ENABLED
TESTPDB ENABLED
TESTPDB2 DISABLED AUTOMATIC RECOVER
SQL> select process,status,sequence# from v$managed_standby where
process like 'MRP%';
PROCESS STATUS SEQUENCE#
--------- ------------ ----------
MRP0 APPLYING_LOG 23

PDB POINT-IN-TIME RECOVERY
 In 21c a PDB can be recovered "to any time in the recent past"
 Flashback & Redolog-data must be available
 No Resetlogs on CDB-level
 Examples:
o "Flashback" to a point in time before a PDB resetlogs
operation
o Point-In-Time-Recovery to a point in time before a PDB
resetlogs operation

TIMEZONE SUPPORT IN DBCA
 A PDB can run in a different timezone than CDB$ROOT (since Oracle
Database 12c)
 21c: you can configure the timezone of a PDB with dbca
o Similar with "-configurePluggableDatabase"
SQL> alter database set timezone='Europe/Berlin';
oracle@tvd21c:~/ dbca -createPluggableDatabase -help
-createPluggableDatabase - Command to Create a pluggable database.
-pdbName <Pluggable database name>
[..]
[-pdbTimezone <Specify PDB specific timezone offset from UTC or
timezone region. +HH:MM | -HH:MM | Region >]
[..]

CONCLUSION
47
 "Replay Upgrade" makes upgrade and migration to Multitenant
"more smooth"
 Oracle DB Nest is …
o a meaningful approach
o definitely still a little shaky
o highly depend on the OS
o poor documentation
 PDB as cluster resource
 PDB side recovery
 and there's more to come ("PDB level DataGuard")

REFERENCES & MORE INFORMATION
48
 Oracle Database 21c Documentation
o "Learning Database 21c New Features"
o Security Guide – Ch. 15: Securing and Isolating Resources Using
DbNest
 MOS-Note "PDB Side Recovery (Doc ID 2649208.1)"
 DB Nest
o https://mahmoudhatem.wordpress.com/2020/10/13/oracle-20c-
dbnest-linux-namespaces-seccomp-capabilites-cgroups/
o https://mahmoudhatem.wordpress.com/2020/10/20/a-first-hands-on-
oracle-20c-dbnest-preview/
o .. And many more blog posts by Hatem Mahmoud
 Information on Linux Namespaces:
http://ifeanyi.co/posts/linux-namespaces-part-1/

QUESTIONS & ANSWERS
MARKUS FLECHTNER
 Markus.flechtner@trivadis.com
 Twitter @markusdba
 Blog: markusdba.net

TOGETHER WE ARE
#1 PARTNER FOR BUSINESSES TO
HARNESS THE POWER OF DATA
FOR A SMARTER LIFE

New Features for Multitenant in Oracle Database 21c

More Related Content

What's hot (20)

Similar to New Features for Multitenant in Oracle Database 21c (20)

More from Markus Flechtner (20)

Recently uploaded (20)

New Features for Multitenant in Oracle Database 21c

Editor's Notes