Storage Supply

Abstract

A method for provisioning storage in a system, performed by a first storage provisioning node of the system, is provided. In response to a first request for an encrypted storage volume for an application node, a second request for an unencrypted storage volume is initiated (20) to a second storage provisioning node. In response to the requested unencrypted storage volume becoming available to the first storage provisioning node, an encrypted storage volume is generated (22) from the unencrypted storage volume, and provisioning of the encrypted storage volume is initiated (24) to make the encrypted storage volume available at a compute node of the system for use by the application node.

Description

Technical Field

[0001] The present disclosure relates to methods for provisioning storage in a system and nodes configured to operate according to these methods. Background Art

[0002] Applications, such as those in fifth-generation (5G) core networks, are increasingly following cloud-native design principles and being deployed in container-based data centers. Container-based data centers can provide persistent storage volumes to container workloads upon request. These persistent storage volumes are provided using components called storage provisioners or storage provisioning nodes.

[0003] Figure 1 and Figure 2 An existing system is shown that includes such a storage provisioning node 510, which provides storage volumes to workloads.

[0004] Typically, a data center has a series of computing nodes (or hosts) 300 on which workloads are executed. Figure 1 and Figure 2 As shown, the computing node 300 generally includes a processing circuit (e.g., a processor) 310, a memory 320, a network interface 330, and an optional storage interface 340. The workload sharing operating system (OS) 350 running on the computing node 300 is a common operating system. Figure 1 In the prior art systems shown in FIG, storage is provided by a storage backend 500 that is attached to the compute nodes 300 via a network using a network interface 330. In these prior art systems, the storage backend 500 includes a storage provisioning node 510. In other prior art systems (e.g., FIG, 5 ), storage is provided by a storage backend 500 that is attached to the compute nodes 300 via a network using a network interface 330. Figure 2 In the prior art systems shown in FIG. 5 , storage is directly attached to the compute node 300 via the storage interface 340. In these prior art systems, the OS 350 of the compute node 300 includes a storage provisioning node 510.

[0005] exist Figure 1 and Figure 2 In the existing system shown, all data center resources are allocated to workloads by a coordinator (e.g., a container cluster coordinator) 400. The coordinator 400 includes a workload coordinator 410 that coordinates computing resources. The coordinator 400 also includes a storage coordinator 420 that coordinates storage resources. The workload coordinator 410 and the storage coordinator 420 can communicate via an interface 430. Figure 1 and Figure 2In the illustrated conventional system, workloads run within application nodes (e.g., application containers or workload containers) 100. Typically, several application nodes (e.g., application containers or workload containers) 100 run on the same compute node 300. Each of these application nodes 100 can request one or more storage volumes 360. The storage needs of storage consumers (e.g., users or applications) 120 requiring data storage are expressed in requests 110, which are processed by an orchestrator 400 during application node deployment.

[0006] The workload coordinator 410 uses the storage coordinator 420 to request storage from the storage provisioning node 510. The storage provisioning node 510 maintains a storage device pool 520, reserves the requested amount of storage, and makes it available to the compute nodes 300. The storage coordinator 420 uses an interface 440 to the OS 350 on the compute nodes 300 to create storage volumes 360 that the storage consumers 120 can access.

[0007] Figure 3 and Figure 4 It shows the existing system (such as Figure 1 and Figure 2 signaling (or call flow) diagram of the signal exchange in FIG. Figure 3 and Figure 4 The illustrated conventional system includes an application node 100 , an OS 350 of a computing node 300 , a storage provisioning node 510 , a coordinator 400 , and an application management node 600 .

[0008] refer to Figure 3 As shown by arrow 700, in the existing system, the application management node 600 sends a deployment request to the coordinator 400. The deployment request is a request to deploy the application node (eg, application container or workload container) 100. In response to the deployment request, Figure 3 As shown by arrow 702, the coordinator 400 sends a request for storage to the storage supply node 510. Figure 3 As shown by arrow 704, in response to the request, the storage provisioning node 510 sends a request to the OS 350 to mount the storage volume 360. Figure 3 As shown in block 706 , the OS 350 mounts the storage volume 360 to the compute node 300 , so that the storage volume 360 becomes available to the application node 100 (or more specifically, the storage consumer 120 ).

[0009] like Figure 3 As shown by arrow 708, the request for storage can be confirmed by the storage provisioning node 510 to the coordinator 400. Figure 3As shown by arrow 710, the coordinator 400 sends a request to the OS 350, which is a request for the OS 350 to create an application node 100. Then, the OS 350 allocates time to the central processing unit (CPU) for the application node 100 to run. Figure 3 As shown by arrow 712, OS 350 sends a request to application node 100, which is a request for application node 100 to start. Figure 3 At box 714 , the application node 100 uses (or consumes) the storage volume 360 .

[0010] refer to Figure 4 As shown by arrow 800, the coordinator 400 receives a stop operation request from the application management node 600. In response to the stop operation request, the coordinator 400 sends a request to the OS 350 to stop (eg, delete) the application node (eg, container) 100. Figure 4 As shown by arrow 802 , the coordinator 400 may send a request to the application node 100 (eg, the operating system 350 of the application node 100 ) to stop operating (eg, delete) the application node 100 .

[0011] like Figure 4 As shown by arrow 804, the application management node 600 may send a request to the coordinator 400 to delete the storage volume. In response to the request, as shown by arrow 806, the coordinator 400 sends a request to the storage provisioning node 510 to delete the storage volume. In response to the request, as shown by arrow 808, the storage provisioning node 510 sends a request to the OS 350 of the computing node 300 to unmount the storage volume. In response to the request, as shown by box 810, the OS 350 of the computing node 300 unmounts the storage volume, making the storage volume unavailable to the application node 100. Figure 4 As shown by arrow 812 , the storage provisioning node 510 may confirm the request to delete the storage volume to the coordinator 400 .

[0012] In existing systems for supply storage (e.g. Figure 1 、 Figure 2 、 Figure 3 and Figure 4In applications such as those described above, data encryption has become mandatory in order for applications to comply with legal requirements related to personal data protection (such as the General Data Protection Regulation (GDPR)) and security. However, most storage provisioning node components currently available do not actually support volume encryption. In addition, for databases without built-in encryption capabilities, the system infrastructure is expected to provide static data encryption. However, applications (such as 5G applications) are often deployed in different data centers, and their system infrastructure is not always fully controlled by a single party. Instead, it is often necessary to use different storage provisioning nodes, but most of these storage provisioning nodes do not actually support the encryption expected by the database.

[0013] One solution to this problem is to implement similar software in many components of the system infrastructure. However, this incurs recurring development costs because similar software needs to be created and implemented for each new component added to the system infrastructure and for each new application version. Application versions depend on the encryption implemented in the application nodes (e.g., application containers or workload containers). In this regard, encryption-related software can be added to the application nodes (e.g., application containers or workload containers). However, this can lead to licensing and support issues, especially when these application nodes are third-party products. In addition, this incurs recurring development costs because similar software needs to be created and implemented in each application that uses encrypted storage. It is also unacceptable to wait until all relevant storage provisioning nodes have been updated to support volume-level encryption. There is no standard for how encryption keys are delivered to storage provisioning nodes. Moreover, even if the storage provisioning nodes integrated in the data center support encryption, the application needs to be adapted for each storage provisioning node that supports encryption, with the keys delivered in a proprietary manner. Summary of the Invention

[0014] It is an object of the present disclosure to avoid or eliminate at least some of the above-mentioned disadvantages associated with existing systems.

[0015] Therefore, according to one aspect of the present disclosure, a method for provisioning storage in a system is provided. The method is performed by a first storage provisioning node of the system. The method includes: in response to a first request for an encrypted storage volume for an application node, initiating a second request for an unencrypted storage volume to a second storage provisioning node. The method also includes: in response to the requested unencrypted storage volume becoming available to the first storage provisioning node, generating an encrypted storage volume from the unencrypted storage volume, and initiating provisioning of the encrypted storage volume to make the encrypted storage volume available at a compute node of the system for use by the application node.

[0016] Therefore, an advantageous method for provisioning storage in a system is provided. Specifically, the method supports volume-level encryption. For example, compared to storage encryption performed at the device level, this volume-level encryption allows for the creation of security domains with finer granularity. This allows each volume to be encrypted using a different key. Furthermore, the method allows security requirements for storage encryption to be met without relying on encryption capabilities provided by the cloud system. Even if the data center does not support such capabilities, encrypted storage volumes can be provisioned to application nodes. This method also avoids the need to create (or modify) and implement software for each new storage provisioning node added to the system infrastructure and / or for each new application version, which makes development and integration easier. Furthermore, since the method does not require encryption-related software to be added to third-party application nodes, licensing and support issues are alleviated. The encrypted storage provided by this method can be used by any application node and can be deployed independently of any application node. Regardless of the number of application nodes using the encrypted storage, minimal additional software footprint is required and no additional storage footprint is required. Replacing the second storage provisioning node with a different storage provisioning node will not affect the application nodes. Furthermore, unlike infrastructure-level data-at-rest encryption, it allows the creation of different security domains on a per-storage-volume basis, for example by encrypting the volumes with separate keys.

[0017] In some embodiments, initiating provisioning of the encrypted storage volume to make the encrypted storage volume available at the computing node for use by the application node may include initiating mounting the encrypted storage volume to the computing node to make the encrypted storage volume available at the computing node for use by the application node. In this manner, the storage volume may be made accessible in the root file system tree, which may serve as a prerequisite for accessing the storage (e.g., reading and / or writing) using functionality provided by the operating system of the computing node.

[0018] In some embodiments, initiating mounting the encrypted storage volume on the compute node may include initiating mounting the encrypted storage volume on a directory tree of the compute node. This may be particularly advantageous when it is desirable to make the encrypted storage volume available to multiple application nodes on the same compute host. Specifically, having separate mount points may simplify adding and removing application node-specific mount points.

[0019] In some embodiments, initiating provisioning of the encrypted storage volume to make the encrypted storage volume available at the compute node for use by the application node may include initiating provisioning of the encrypted storage volume on the first storage provisioning node to make the encrypted storage volume available at the compute node.

[0020] In some embodiments, the method may include initiating a third request to the second storage provisioning node to stop making the unencrypted storage volume available to the compute node. This is particularly advantageous when the storage volume is mounted to only one compute node at a time. For example, unmounting the storage volume may be a prerequisite for subsequently mounting the storage volume to a different compute node. Generally, freeing up unused resources improves resource efficiency.

[0021] In some embodiments, the method may include initiating, in response to a fourth request to stop making the encrypted storage volume available at the computing node, stopping making the encrypted storage volume available at the computing node. This may be advantageous because, depending on the operating system on the computing host, unmounting the encrypted volume may be a prerequisite for unmounting the unencrypted volume. This may also free up unused resources, thereby improving resource efficiency.

[0022] In some embodiments, an encrypted storage volume may be generated by applying an encryption layer to an unencrypted storage volume.

[0023] In some embodiments, the encryption layer may be an encrypted file system layer.

[0024] According to another aspect of the present disclosure, a first storage supply node is provided. The first storage supply node includes processing circuitry configured to operate according to the method described above with respect to the first storage supply node. Thus, the first storage supply node provides the advantages discussed above with respect to the method performed by the first storage supply node. In some embodiments, the first storage supply node includes at least one memory for storing instructions that, when executed by the processing circuitry, cause the first storage supply node to operate according to the method described above with respect to the first storage supply node.

[0025] According to another aspect of the present disclosure, another method for provisioning storage in a system is provided. The method is performed by a second storage provisioning node of the system. The method includes: in response to a second request for an unencrypted storage volume from a first storage provisioning node of the system, initiating provisioning of the unencrypted storage volume to the first storage provisioning node, so that the unencrypted storage volume is available to the first storage provisioning node at a computing node of the system for use by the first storage provisioning node in generating an encrypted storage volume, the encrypted storage volume to be available at the computing node for use by an application node.

[0026] Therefore, an advantageous method for provisioning storage in a system is provided. Specifically, the method supports volume-level encryption. For example, compared to storage encryption performed at the device level, this volume-level encryption allows for the creation of security domains with finer granularity. This allows each volume to be encrypted using a different key. Furthermore, the method allows security requirements for storage encryption to be met without relying on encryption capabilities provided by the cloud system. Even if the data center does not support such capabilities, encrypted storage volumes can be provisioned to application nodes. This method also avoids the need to create (or modify) and implement software for each new storage provisioning node added to the system infrastructure and / or for each new application version, which facilitates development and integration. Furthermore, since the method does not require encryption-related software to be added to third-party application nodes, licensing and support issues are alleviated. The encrypted storage provided by this method can be used by any application node and can be deployed independently of any application node. Regardless of the number of applications using the encrypted storage, minimal additional software footprint is required and no additional storage footprint is required. Replacing the second storage provisioning node with a different storage provisioning node will not impact the application nodes. Furthermore, unlike infrastructure-level data-at-rest encryption, it allows the creation of different security domains on a per-storage-volume basis, for example by encrypting the volumes with separate keys.

[0027] In some embodiments, initiating provisioning of the unencrypted storage volume to the first storage provisioning node to make the unencrypted storage volume available at the compute node to the first storage provisioning node may include initiating mounting the unencrypted storage volume to the compute node to make the unencrypted storage volume available to the first storage provisioning node.

[0028] In some embodiments, initiating provisioning of the unencrypted storage volume to the first storage provisioning node to make the unencrypted storage volume available at the compute node may include initiating generation of a container on which the unencrypted storage volume is made available at the compute node. This may be particularly advantageous when it is not possible to mount the storage volume to an already running container.

[0029] In some embodiments, the compute node can be separated from the secondary storage provisioning node. In this way, performance dependencies between storage and application nodes running on the compute node can be avoided. In some embodiments, the compute node can include the secondary storage provisioning node. This allows for easier scaling of storage solutions and reduces hardware costs by avoiding dedicated storage hardware, and instead allows for the use of only one type of compute node (e.g., server) for both application nodes and storage.

[0030] In some embodiments, the method may include: in response to a third request from the first storage provisioning node to stop making the unencrypted storage volume available at the computing node, initiating stopping making the unencrypted storage volume available at the computing node. In this manner, unused resources may be freed, thereby improving resource usage efficiency on the computing node.

[0031] In some embodiments, initiating the cessation of making the unencrypted storage volume available at the compute node may include initiating the unmounting of the unencrypted storage volume from the compute node. This is particularly advantageous when the storage volume is mounted to only one compute node at a time. For example, unmounting the storage volume may be a prerequisite for subsequently mounting the storage volume to a different compute node. This may also free up unused resources, thereby improving resource efficiency.

[0032] According to another aspect of the present disclosure, a second storage supply node is provided. The second storage supply node includes processing circuitry configured to operate according to the method described above with respect to the second storage supply node. Thus, the second storage supply node provides the advantages discussed above with respect to the method performed by the second storage supply node. In some embodiments, the second storage supply node includes at least one memory for storing instructions that, when executed by the processing circuitry, cause the second storage supply node to operate according to the method described above with respect to the second storage supply node.

[0033] According to another aspect of the present disclosure, another method for provisioning storage in a system is provided. The method is performed by a compute node of the system. The method includes: provisioning an unencrypted storage volume requested by the first storage provisioning node to a first storage provisioning node, making the unencrypted storage volume available to the first storage provisioning node at the compute node for use by the first storage provisioning node in generating encrypted storage. The method also includes: provisioning an encrypted storage volume generated by the first storage provisioning node, making the encrypted storage volume available at the compute node for use by an application node.

[0034] Therefore, an advantageous method for provisioning storage in a system is provided. Specifically, the method supports volume-level encryption. For example, compared to storage encryption performed at the device level, this volume-level encryption allows for the creation of security domains with finer granularity. This allows each volume to be encrypted using a different key. Furthermore, the method allows security requirements for storage encryption to be met without relying on encryption capabilities provided by the cloud system. Even if the data center does not support such capabilities, encrypted storage volumes can be provisioned to application nodes. This method also avoids the need to create (or modify) and implement software for each new storage provisioning node added to the system infrastructure and / or for each new application version, which makes development and integration easier. Furthermore, since the method does not require encryption-related software to be added to third-party application nodes, licensing and support issues are alleviated. The encrypted storage provided by this method can be used by any application node and can be deployed independently of any application node. Regardless of the number of application nodes using the encrypted storage, minimal additional software footprint is required and no additional storage footprint is required. Replacing the second storage provisioning node with a different storage provisioning node will not affect the application nodes. Furthermore, unlike infrastructure-level data-at-rest encryption, it allows the creation of different security domains on a per-storage-volume basis, for example by encrypting the volumes with separate keys.

[0035] In some embodiments, provisioning an unencrypted storage volume to make it available at the compute node may include generating a container on which to make the unencrypted storage volume available at the compute node. This may be particularly advantageous when it is not possible to mount a storage volume to an already running container. In some embodiments, provisioning an unencrypted storage volume to make it available at the compute node may include provisioning an encrypted storage volume to make it available at the compute node, and provisioning an encrypted storage volume to make it available at the compute node may include provisioning an encrypted storage volume on the first storage provisioning node to make it available at the compute node.

[0036] In some embodiments, provisioning an unencrypted storage volume to a first storage provisioning node so that the unencrypted storage volume is available at a computing node for the first storage provisioning node may include mounting the unencrypted storage volume to the computing node so that the unencrypted storage volume is available to the first storage provisioning node, and / or provisioning an encrypted storage volume so that the encrypted storage volume is available at the computing node for use by the application node may include mounting the encrypted storage volume to the computing node so that the encrypted storage volume is available at the computing node for use by the application node.

[0037] In some embodiments, mounting an unencrypted storage volume on a compute node may include mounting the unencrypted storage volume on a directory tree of the compute node, and / or mounting an encrypted storage volume on a compute node may include mounting the encrypted storage volume on a directory tree of the compute node. This may be particularly advantageous when it is desirable to make the encrypted storage volume available to multiple application nodes on the same compute host. Specifically, having separate mount points may simplify the addition and removal of application node-specific mount points.

[0038] In some embodiments, the method may include stopping making the encrypted storage volume available at the computing node and / or stopping making the unencrypted storage volume available at the computing node. In this way, unused resources can be freed up, thereby improving resource usage efficiency on the computing node.

[0039] In some embodiments, ceasing to make the encrypted storage volume available at the compute node may include unmounting the encrypted storage volume from the compute node, and / or ceasing to make the unencrypted storage volume available at the compute node may include unmounting the unencrypted storage volume from the compute node. This may be particularly advantageous when an application node consuming the encrypted volume is terminated on the compute node, for example, due to decommissioning the application node or a coordinator deciding to run the application node on a different compute node.

[0040] In some embodiments, ceasing to make the encrypted storage volume available at the compute node and / or ceasing to make the unencrypted storage volume available at the compute node may be performed in response to a trigger.

[0041] In some embodiments, the compute nodes can be separated from the system's secondary storage provisioning nodes. In this way, performance dependencies between storage and application nodes running on the compute nodes can be avoided. In some embodiments, the compute nodes can comprise the system's secondary storage provisioning nodes. This allows for easier scaling of storage solutions and reduces hardware costs by avoiding dedicated storage hardware, and instead allows for the use of only one type of compute node (e.g., a server) for both application nodes and storage.

[0042] According to another aspect of the present disclosure, a computing node is provided. The computing node includes processing circuitry configured to operate according to the method described above with respect to the computing node. Thus, the computing node provides the advantages discussed above with respect to the method performed by the computing node. In some embodiments, the computing node includes at least one memory for storing instructions that, when executed by the processing circuitry, cause the computing node to operate according to the method described above with respect to the computing node.

[0043] According to another aspect of the present disclosure, a system is provided. The system includes one or more first storage provisioning nodes as described above, one or more second storage provisioning nodes as described above, and / or one or more computing nodes as described above. Thus, the system provides the advantages discussed above with respect to the methods performed by the first storage provisioning nodes, the second storage provisioning nodes, and / or the computing nodes.

[0044] According to another aspect of the present disclosure, a computer program is provided that includes instructions that, when executed by a processing circuit, cause the processing circuit to perform the method described above with respect to the first storage supply node, the second storage supply node, and / or the computing node. Thus, the computer program provides the advantages discussed above with respect to the method performed by the first storage supply node, the second storage supply node, and / or the computing node.

[0045] According to another aspect of the present disclosure, a computer program product embodied on a non-transitory machine-readable medium is provided, the computer program product comprising instructions executable by a processing circuit to cause the processing circuit to perform the method described above with respect to a first storage provision node, a second storage provision node, and / or a computing node. Thus, the computer program product provides the advantages discussed above with respect to the method performed by the first storage provision node, the second storage provision node, and / or the computing node.

[0046] Thus, an advantageous technique for provisioning storage in a system is provided. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] For a better understanding of the present technology, and to show how it may be implemented, reference will now be made, by way of example, to the accompanying drawings, in which:

[0048] Figure 1 is a block diagram showing an existing system;

[0049] Figure 2 is a block diagram showing an existing system;

[0050] Figure 3 is a signaling diagram illustrating the exchange of signals in an existing system;

[0051] Figure 4 is a signaling diagram illustrating the exchange of signals in an existing system;

[0052] Figure 5 is a block diagram illustrating a first storage supply node according to an embodiment;

[0053] Figure 6 is a block diagram illustrating a method performed by a first storage provisioning node according to an embodiment;

[0054] Figure 7is a block diagram illustrating a second storage supply node according to an embodiment;

[0055] Figure 8 is a block diagram illustrating a method performed by a second storage provisioning node according to an embodiment;

[0056] Figure 9 is a block diagram illustrating a computing node according to an embodiment;

[0057] Figure 10 is a block diagram illustrating a method performed by a computing node according to an embodiment;

[0058] Figure 11 is a block diagram illustrating a system according to an embodiment;

[0059] Figure 12 is a block diagram illustrating a system according to an embodiment;

[0060] Figure 13 is a signaling diagram illustrating an exchange of signals in a system according to an embodiment;

[0061] Figure 14 is a signaling diagram illustrating an exchange of signals in a system according to an embodiment;

[0062] Figure 15 is a block diagram illustrating an example environment for a system according to an embodiment;

[0063] Figure 16 is a block diagram illustrating a first storage supply node according to an embodiment;

[0064] Figure 17 is a block diagram illustrating a second storage provisioning node according to an embodiment; and

[0065] Figure 18 is a block diagram illustrating a computing node according to an embodiment. DETAILED DESCRIPTION

[0066] As previously mentioned, this document describes an advantageous technique for provisioning storage in a system. More specifically, the technique described herein provisions storage volumes in a network. As used herein, a storage volume can be any storage unit. The storage volumes referred to herein can be configured to store data, information, objects, and the like. In some embodiments, a storage volume can be a file system. The technique described herein is implemented by a first storage provisioning node, a second storage provisioning node, and a compute node.

[0067] For example, the technology described herein can be applied to data centers, such as those using container technology. These data centers using container technology may also be referred to as cloud data centers. Typically, workloads can be distributed across multiple containers. Multiple containers can be scheduled to execute on multiple compute nodes (or hosts). A storage provider agent can exist on each compute node. The agent can communicate with the compute node's operating system.

[0068] According to some embodiments, the systems described herein for which storage is provisioned may include multiple compute nodes configured as described herein. Multiple compute nodes may also be referred to as a cluster. Provisioning storage or storage provisioning may be defined herein as the process of allocating storage and making it available to application nodes, e.g., for read and / or write operations.

[0069] Figure 5 The first storage provisioning node 200 of the system according to an embodiment is shown. The first storage provisioning node 200 is used to provision storage in the system. For example, the first storage provisioning node 200 can be a physical machine (e.g., a server) or a virtual machine (VM). The first storage provisioning node 200 can be any general-purpose storage provider.

[0070] like Figure 5 As shown, the first storage supply node 200 includes processing circuitry (or logic) 202. The processing circuitry 202 controls the operation of the first storage supply node 200 and can implement the methods described herein with respect to the first storage supply node 200. The processing circuitry 202 can be configured or programmed to control the first storage supply node 200 in the manner described herein. The processing circuitry 202 can include one or more hardware components, such as one or more processors, one or more processing units, one or more multi-core processors, and / or one or more modules. In a specific implementation, each of the one or more hardware components can be configured to perform or be used to perform a single or multiple steps of the methods described herein with respect to the first storage supply node 200. In some embodiments, the processing circuitry 202 can be configured to execute software to perform the methods described herein with respect to the first storage supply node 200. According to some embodiments, the software can be containerized. Thus, in some embodiments, the processing circuitry 202 can be configured to execute a container to perform the methods described herein with respect to the first storage supply node 200. The container can operate in a privileged mode.

[0071] In short, the processing circuitry 202 of the first storage provisioning node 200 is configured to, in response to a first request for an encrypted storage volume for an application node, initiate a second request for an unencrypted storage volume to the second storage provisioning node. The processing circuitry 202 of the first storage provisioning node 200 is further configured to, in response to the requested unencrypted storage volume becoming available to the first storage provisioning node, generate an encrypted storage volume from the unencrypted storage volume, and initiate provisioning of the encrypted storage volume, making it available at the system's compute nodes for use by the application nodes. The first storage provisioning node 200 described herein acts as a shim.

[0072] like Figure 5 As shown, in some embodiments, the first storage supply node 200 may optionally include a memory 204. The memory 204 of the first storage supply node 200 may include a volatile memory or a non-volatile memory. In some embodiments, the memory 204 of the first storage supply node 200 may include a non-transitory medium. Examples of the memory 204 of the first storage supply node 200 include, but are not limited to, a random access memory (RAM), a read-only memory (ROM), a large-capacity storage medium such as a hard disk, a removable storage medium such as a compact disk (CD) or a digital video disk (DVD), and / or any other memory.

[0073] The processing circuitry 202 of the first storage supply node 200 may be connected to a memory 204 of the first storage supply node 200. In some embodiments, the memory 204 of the first storage supply node 200 may be used to store program code or instructions that, when executed by the processing circuitry 202 of the first storage supply node 200, cause the first storage supply node 200 to operate in the manner described herein with respect to the first storage supply node 200. For example, in some embodiments, the memory 204 of the first storage supply node 200 may be configured to store program code or instructions that may be executed by the processing circuitry 202 of the first storage supply node 200 to cause the first storage supply node 200 to operate according to the method described herein with respect to the first storage supply node 200. Alternatively or additionally, the memory 204 of the first storage supply node 200 may be configured to store any information, data, messages, requests, responses, indications, notifications, signals, etc. described herein. The processing circuit 202 of the first storage supply node 200 may be configured to control the memory 204 of the first storage supply node 200 to store information, data, messages, requests, responses, instructions, notifications, signals, etc. described herein.

[0074] In some embodiments, as Figure 5As shown, the first storage supply node 200 may optionally include a communication interface 206. The communication interface 206 of the first storage supply node 200 may be connected to the processing circuit 202 of the first storage supply node 200 and / or the memory 204 of the first storage supply node 200. The communication interface 206 of the first storage supply node 200 is operable to allow the processing circuit 202 of the first storage supply node 200 to communicate with the memory 204 of the first storage supply node 200 and / or vice versa. Similarly, the communication interface 206 of the first storage supply node 200 is operable to allow the processing circuit 202 of the first storage supply node 200 to communicate with the second storage supply node, the computing node and / or any other node. The communication interface 206 of the first storage supply node 200 may be configured to send and / or receive information, data, messages, requests, responses, instructions, notifications, signals, etc. described herein. In some embodiments, the processing circuit 202 of the first storage supply node 200 may be configured to control the communication interface 206 of the first storage supply node 200 to send and / or receive information, data, messages, requests, responses, instructions, notifications, signals, etc.

[0075] Although the first storage supply node 200 Figure 5 204, it should be understood that the first storage supply node 200 may include at least one memory (i.e., a single memory or multiple memories) 204 that operates in the manner described herein. Similarly, although the first storage supply node 200 is shown in FIG. Figure 5 2. Although shown as including a single communication interface 206, it should be understood that the first storage supply node 200 may include at least one communication interface (ie, a single communication interface or multiple communication interfaces) 206 that operate in the manner described herein.

[0076] You will also understand that Figure 5 Only components necessary to illustrate an embodiment of the first storage supply node 200 are shown, and in actual implementations, the first storage supply node 200 may include components in addition to or in place of those shown.

[0077] In some embodiments, the hardware (e.g., processing circuitry 202, memory 204, and / or communication interface 206) that can implement the methods described herein with respect to the first storage supply node 200 can be the same hardware as the hardware that implements the methods performed by the application node. For example, the same hardware (e.g., processing circuitry, memory, and / or communication interface) of an application node that is configured to run at least a portion of one or more applications can also be configured to implement the methods described herein with respect to the first storage supply node 200. In some embodiments, the hardware that can implement the methods described herein with respect to the first storage supply node 200 and / or the hardware that can implement the methods described herein with respect to the application node can be the same hardware as the hardware that implements the methods performed by a computing node (e.g., a computing node described herein) (e.g., in a cluster of computing nodes). The application nodes mentioned herein can be configured to run at least a portion of one or more applications.

[0078] Figure 6 is a flow chart illustrating a method performed by the first storage provisioning node 200 according to an embodiment. The method is used to provision storage in a system. Figure 5 The first storage supply node 200 described is configured according to Figure 6 The method may be performed by the processing circuit 202 of the first storage supply node 200 or under the control of the processing circuit 202 of the first storage supply node 200.

[0079] like Figure 6 As shown, at box 20, in response to a first request for an encrypted storage volume for an application node (e.g., received by the first storage supply node 200), a second request for an unencrypted storage volume is initiated to the second storage supply node. More specifically, the processing circuit 202 of the first storage supply node 200 initiates sending the second request (e.g., via the communication interface 206 of the first storage supply node 200). Thus, the first storage supply node 200 converts the first request for the encrypted storage volume into a second request for an unencrypted storage volume. As used herein, the term "initiate" may mean, for example, to cause or establish. Thus, the processing circuit 202 of the first storage supply node 200 may be configured to send the second request itself, or may be configured to cause another node to send the second request. In some embodiments, the transmission of the second request to the second storage supply node may be via a coordinator of the system.

[0080] In some embodiments, the first request mentioned herein may come from a coordinator of the system. In some embodiments, the first request mentioned herein may originate from an application management node of the system. For example, in some embodiments, the first request mentioned herein may come from an application management node of the system via a coordinator of the system. In some embodiments, the first request mentioned herein may be issued at the time of deployment of the application node. For example, the first request mentioned herein may be issued by the application management node of the system when it deploys the application node. The processing circuit 202 of the first storage supply node 200 may be configured to receive the first request (e.g., via the communication interface 206 of the first storage supply node 200).

[0081] return Figure 6 At block 22, in response to the requested unencrypted storage volume becoming available to the first storage provisioning node 200, an encrypted storage volume is generated from the unencrypted storage volume. Thus, the first storage provisioning node 200 can consume the unencrypted storage volume obtained through the second storage provisioning node and create an encrypted storage volume from the unencrypted storage volume.

[0082] In some embodiments, an encrypted storage volume can be generated by applying an encryption layer to an unencrypted storage volume. More specifically, in some embodiments, the processing circuit 202 of the first storage provisioning node 200 can be configured to apply an encryption layer to the unencrypted storage volume. In some embodiments, when the unencrypted storage volume is provided with an unencrypted file system, the application of the encryption layer can be selected. In some embodiments, the encryption layer can be an encrypted file system layer. For example, the encrypted file system can be deployed as a layer above the unencrypted storage volume. In some embodiments, when the unencrypted storage volume is unencrypted raw block storage (i.e., when only an unencrypted storage device is provided without a file system), an encrypted file system layer can be selected. This can provide performance benefits. The unencrypted storage volume itself can be an unencrypted file system. In some embodiments, the encryption layer can be provided by the first storage provisioning node 200. In other embodiments, another node can provide the encryption layer. In some embodiments where a container is generated on which the unencrypted storage volume is made available at the computing node, the generated container can provide the encryption layer.

[0083] In an example method for generating an encrypted storage volume, the processing circuit 202 of the first storage provisioning node 200 may generate a file and use a device mapper function (e.g., where a file from an unencrypted storage volume is exposed as an encrypted storage device, the encrypted storage device being formatted with another file system) to create an encrypted storage device as the encrypted storage volume mentioned herein. In some embodiments, the processing circuit 202 of the first storage provisioning node 200 may first format the device with a file system and then use the file system as the encrypted storage volume mentioned herein. In another example method for generating an encrypted storage volume, the processing circuit 202 of the first storage provisioning node 200 may format a (raw) block storage device with a file system that supports encryption and use the file system as the encrypted storage volume mentioned herein.

[0084] Back to Figure 6 , at box 24, initiating the provisioning of the encrypted storage volume to make the encrypted storage volume available at the computing node of the system for use by the application node, or more specifically, for use by a storage consumer of the application node (e.g., a user, an application, or any other storage consumer). More specifically, in some embodiments, the processing circuit 202 of the first storage provisioning node 200 initiates the provisioning of the encrypted storage volume. For example, the processing circuit 202 of the first storage provisioning node 200 can be configured to instruct the computing node (e.g., the operating system of the computing node) to make the encrypted storage volume available for use by the application node. In some embodiments, the processing circuit 202 of the first storage provisioning node 200 can be configured to initiate sending an instruction to the computing node (e.g., the operating system of the computing node) (e.g., sending it itself or causing another node to send it). The instruction can be used by the computing node to release the encrypted storage volume for use by the application node.

[0085] In some embodiments, Figure 6 Initiating provisioning of the encrypted storage volume at box 24 to make the encrypted storage volume available at the compute node of the system for use by the application node may include: initiating mounting the encrypted storage volume to the compute node to make the encrypted storage volume available at the compute node for use by the application node. In some of these embodiments, initiating mounting the encrypted storage volume to the compute node may include: initiating mounting the encrypted storage volume to the directory tree of the compute node. Those skilled in the art will understand that mounting the encrypted storage volume to the compute node is only one example of a way in which the encrypted storage volume may be made available at the compute node for use by the application node, and other examples are also possible. For example, in some embodiments, the encrypted storage volume may be made available at the compute node for use by the application node via other interfaces, such as a Hypertext Transfer Protocol (HTTP) interface. This is particularly useful for object storage.

[0086] In some embodiments, Figure 6Initiating provisioning of the encrypted storage volume at block 24 to make the encrypted storage volume available at the computing node for use by the application node may include: initiating provisioning of the encrypted storage volume on the first storage provisioning node to make the encrypted storage volume available at the computing node. In some embodiments, Figure 6 Initiating provisioning of the encrypted storage volume at block 24 to make the encrypted storage volume available at the compute node for use by the application node may include allocating a path within a directory tree of the host file system that is accessible to the application node.

[0087] although Figure 6 Although not shown, in some embodiments, the method may include initiating a third request to the second storage provisioning node to stop making the unencrypted storage volume available at the computing node. More specifically, the processing circuitry 202 of the first storage provisioning node 200 may initiate sending the second request (e.g., via the communication interface 206 of the first storage provisioning node 200). As previously mentioned, the term "initiate" herein may mean, for example, to cause or establish. Thus, the processing circuitry 202 of the first storage provisioning node 200 may be configured to send the third request itself, or may be configured to cause another node to send the third request.

[0088] Despite Figure 6 Also not shown, but in some embodiments, the method may include: in response to a fourth request (e.g., received by the first storage supply node 200) to stop making the encrypted storage volume available at the computing node, initiating a stop making the encrypted storage volume available at the computing node. More specifically, in some embodiments, the processing circuit 202 of the first storage supply node 200 may initiate a stop making the encrypted storage volume available at the computing node. For example, the processing circuit 202 of the first storage supply node 200 may be configured to instruct the computing node (e.g., the operating system of the computing node) to stop making the encrypted storage volume available for use by the application node, or more specifically, for use by a storage consumer of the application node (e.g., a user, an application, or any other storage consumer). In some embodiments, the processing circuit 202 of the first storage supply node 200 may be configured to initiate sending an instruction to the computing node (e.g., the operating system of the computing node) (e.g., sending it itself or causing another node to send it).

[0089] Despite Figure 6Also not shown, but in some embodiments, the method may include: in response to the termination of the application node that uses (e.g., consumes) the encrypted storage volume, removing the configuration related to the encrypted storage volume from the computing node 300. More specifically, in some embodiments, the processing circuit 202 of the first storage provisioning node 200 may be configured to remove the configuration. In some containerized embodiments, a sidecar container may be added to remove any configuration related to the encrypted storage volume from the computing node 300. The sidecar container may run in privileged mode. In this way, the first storage provisioning node 200 can clean up, for example, by ensuring that no configuration remnants or orphaned objects are left behind.

[0090] Figure 7 A second storage provisioning node 510 of a system according to an embodiment is shown. The second storage provisioning node 510 is used to provision storage in the system. For example, the second storage provisioning node 510 may be a physical machine (e.g., a server) or a virtual machine (VM). According to some embodiments, the second storage provisioning node 510 may be a storage provisioning node in a data center. The second storage provisioning node 510 may be responsible for allocating storage in the system.

[0091] like Figure 7 As shown, the second storage supply node 510 includes processing circuitry (or logic) 502. The processing circuitry 502 controls the operation of the second storage supply node 510 and can implement the methods described herein with respect to the second storage supply node 510. The processing circuitry 502 can be configured or programmed to control the second storage supply node 510 in the manner described herein. The processing circuitry 502 can include one or more hardware components, such as one or more processors, one or more processing units, one or more multi-core processors, and / or one or more modules. In a specific implementation, each of the one or more hardware components can be configured to perform or be used to perform a single or multiple steps of the methods described herein with respect to the second storage supply node 510. In some embodiments, the processing circuitry 502 can be configured to execute software to execute the methods described herein with respect to the second storage supply node 510. According to some embodiments, the software can be containerized. Therefore, in some embodiments, the processing circuitry 502 can be configured to execute a container to execute the methods described herein with respect to the second storage supply node 510.

[0092] In short, the processing circuit 502 of the second storage supply node 510 is configured to: in response to a second request for an unencrypted storage volume from the first storage supply node 200 of the system, initiate the provisioning of the unencrypted storage volume so that the unencrypted storage volume is available to the first storage supply node 200 at the computing node of the system, for use by the first storage supply node in generating an encrypted storage volume, which is to be available at the computing node for use by the application node.

[0093] like Figure 7 As shown, in some embodiments, the second storage supply node 510 may optionally include a memory 520. The memory 520 of the second storage supply node 510 may include a volatile memory or a non-volatile memory. In some embodiments, the memory 520 of the second storage supply node 510 may include a non-transitory medium. Examples of the memory 520 of the second storage supply node 510 include, but are not limited to, a random access memory (RAM), a read-only memory (ROM), a large-capacity storage medium such as a hard disk, a removable storage medium such as a compact disk (CD) or a digital video disk (DVD), and / or any other memory. In some embodiments, the memory 520 of the second storage supply node 510 may include one or more storage devices, such as a storage device pool.

[0094] The processing circuitry 502 of the second storage supply node 510 may be connected to a memory 520 of the second storage supply node 510. In some embodiments, the memory 520 of the second storage supply node 510 may be used to store program code or instructions that, when executed by the processing circuitry 502 of the second storage supply node 510, cause the second storage supply node 510 to operate in the manner described herein with respect to the second storage supply node 510. For example, in some embodiments, the memory 520 of the second storage supply node 510 may be configured to store program code or instructions that may be executed by the processing circuitry 502 of the second storage supply node 510 to cause the second storage supply node 510 to operate according to the method described herein with respect to the second storage supply node 510. Alternatively or additionally, the memory 520 of the second storage supply node 510 may be configured to store any information, data, messages, requests, responses, indications, notifications, signals, etc. described herein. The processing circuit 502 of the second storage supply node 510 may be configured to control the memory 520 of the second storage supply node 510 to store information, data, messages, requests, responses, instructions, notifications, signals, etc. described herein.

[0095] In some embodiments, as Figure 7As shown, the second storage supply node 510 may optionally include a communication interface 506. The communication interface 506 of the second storage supply node 510 may be connected to the processing circuit 502 of the second storage supply node 510 and / or the memory 520 of the second storage supply node 510. The communication interface 506 of the second storage supply node 510 is operable to allow the processing circuit 502 of the second storage supply node 510 to communicate with the memory 520 of the second storage supply node 510 and / or vice versa. Similarly, the communication interface 506 of the second storage supply node 510 is operable to allow the processing circuit 502 of the second storage supply node 510 to communicate with the first storage supply node, the computing node and / or any other node. The communication interface 506 of the second storage supply node 510 may be configured to send and / or receive information, data, messages, requests, responses, instructions, notifications, signals, etc. described herein. In some embodiments, the processing circuit 502 of the second storage supply node 510 may be configured to control the communication interface 506 of the second storage supply node 510 to send and / or receive information, data, messages, requests, responses, instructions, notifications, signals, etc.

[0096] Although the second storage supply node 510 Figure 7 520, it should be understood that the second storage supply node 510 may include at least one memory (i.e., a single memory or multiple memories) 520 that operates in the manner described herein. Similarly, although the second storage supply node 510 is shown in FIG. Figure 7 5. As shown in FIG. 5 as including a single communication interface 506, it should be understood that the second storage supply node 510 may include at least one communication interface (ie, a single communication interface or multiple communication interfaces) 506 that operate in the manner described herein.

[0097] You will also understand that Figure 7 Only components necessary to illustrate an embodiment of the second storage supply node 510 are shown, and in actual implementations, the second storage supply node 510 may include components in addition to or in place of those shown.

[0098] In some embodiments, the hardware (e.g., processing circuitry 502, memory 520, and / or communication interface 506) that can implement the methods described herein with respect to the second storage supply node 510 can be the same hardware that implements the methods performed by a computing node (e.g., in a cluster of computing nodes) (e.g., a computing node described herein). For example, in some embodiments, the second storage supply node 510 can be a computing node whose hardware (e.g., processing circuitry) can execute software to implement the methods described herein with respect to the second storage supply node 510. In other embodiments, the hardware (e.g., processing circuitry 502, memory 520, and / or communication interface 506) that can implement the methods described herein with respect to the second storage supply node 510 can be a storage backend node that includes the second storage supply node 510. For example, in some embodiments, the second storage supply node 510 can be a storage backend node whose hardware (e.g., processing circuitry) can execute software to implement the methods described herein with respect to the second storage supply node 510.

[0099] Figure 8 is a flow chart illustrating a method performed by the second storage provisioning node 510 according to an embodiment. The method is used to provision storage in a system. Figure 7 The second storage supply node 510 is configured according to Figure 8 The method may be executed by the processing circuit 502 of the second storage supply node 510 or under the control of the processing circuit 502 of the second storage supply node 510.

[0100] like Figure 8 As shown, at block 50, in response to a second request for an unencrypted storage volume from a first storage provisioning node 200 of the system (e.g., received by a second storage provisioning node 510), provisioning of the unencrypted storage volume is initiated to make the unencrypted storage volume available at a compute node of the system to the first storage provisioning node 200. The unencrypted storage volume is made available to the first storage provisioning node 200 for use in generating an encrypted storage volume by the first storage provisioning node 200. The encrypted storage volume is to be available at the compute node for use by the application node, or more specifically, for use by a storage consumer (e.g., a user, an application, or any other storage consumer) of the application node.

[0101] More specifically, the processing circuit 502 of the second storage provisioning node 510 initiates the provisioning of an unencrypted storage volume. For example, the processing circuit 502 of the second storage provisioning node 510 may be configured to instruct a computing node (e.g., an operating system of the computing node) to make the unencrypted storage volume available to the first storage provisioning node 200. In some embodiments, the processing circuit 502 of the second storage provisioning node 510 may be configured to initiate the sending of an instruction to the computing node (e.g., an operating system of the computing node) (e.g., the processing circuit 502 itself or by having another node send the instruction). This instruction may be used by the computing node to release the unencrypted storage volume system to the first storage provisioning node 200.

[0102] In some embodiments, Figure 8 Initiating provisioning of the unencrypted storage volume to make the unencrypted storage volume available at the compute node to the first storage provisioning node 200 at block 50 of may include: initiating mounting the unencrypted storage volume to the compute node to make the unencrypted storage volume available to the first storage provisioning node 200. In some embodiments, Figure 8 Initiating provisioning of the unencrypted storage volume to make the unencrypted storage volume available at the compute node to the first storage provisioning node 200 at block 50 may include initiating generation of a container on which to make the unencrypted storage volume available at the compute node.

[0103] Those skilled in the art will appreciate that mounting unencrypted storage volumes to compute nodes and generating containers are only some examples of how unencrypted storage volumes can be made available at compute nodes to the first storage provisioning node 200, and that other examples are possible. For example, in some embodiments, unencrypted storage volumes can be made available at compute nodes to the first storage provisioning node 200 via other interfaces, such as a Hypertext Transfer Protocol (HTTP) interface. This is particularly useful for object storage.

[0104] Despite Figure 8Not shown, but in some embodiments, the method may include: in response to a third request from the first storage supply node to stop making the unencrypted storage volume available at the computing node (e.g., received by the second storage supply node 510), initiating stopping making the unencrypted storage volume available at the computing node. More specifically, in some embodiments, the processing circuit 502 of the second storage supply node 510 may be configured to initiate stopping making the unencrypted storage volume available at the computing node. For example, the processing circuit 502 of the second storage supply node 510 may be configured to instruct the computing node (e.g., the operating system of the computing node) to stop making the encrypted storage volume available. In some embodiments, the processing circuit 502 of the second storage supply node 510 may be configured to initiate sending an instruction to the computing node (e.g., the operating system of the computing node) (e.g., send it itself or cause another node to send it). In some of these embodiments, initiating stopping making the unencrypted storage volume available at the computing node may include: initiating unmounting of the unencrypted storage volume from the computing node.

[0105] In some embodiments, the compute node may be separate from the second storage supply node 510. For example, the second storage supply node 510 (or, in some embodiments, the storage backend 500 including the second storage supply node 510) may be an entity separate from the compute node described herein, with its own dedicated software and / or hardware. In other embodiments, the compute node may include the second storage supply node 510. For example, in some embodiments, the methods described herein with respect to the second storage supply node 510 may be run as (e.g., containerized) software on the compute node described herein. In some embodiments, the compute nodes described herein may simultaneously run (e.g., containerized) application software. This may be referred to as "hyper-converged software-defined storage." Alternatively, in some embodiments, the compute nodes described herein may be dedicated to storage. This may be referred to as "software-defined storage." In some embodiments involving a cluster, the methods described herein with respect to the second storage supply node 510 may be run as (e.g., containerized) software on one or more (or each) of a plurality of compute nodes.

[0106] Despite Figure 8Although not shown, in some embodiments, the method may include initiating deprovisioning of the unencrypted storage volume to stop making the unencrypted storage volume available at the computing node. More specifically, the processing circuitry 502 of the second storage provisioning node 510 may be configured to initiate deprovisioning of the unencrypted storage volume. For example, the processing circuitry 502 of the second storage provisioning node 510 may be configured to instruct the computing node (e.g., the computing node's operating system) to stop making the unencrypted storage volume available. In some embodiments, the processing circuitry 502 of the second storage provisioning node 510 may be configured to initiate sending an instruction to the computing node (e.g., the computing node's operating system) (e.g., sending it itself or causing another node to send it).

[0107] Figure 9 A computing node 300 of a system according to an embodiment is shown. The computing node 300 is used to supply storage in the system. The computing node 300 may also be referred to as a computing host in this article. For example, the computing node 300 may be a physical machine (e.g., a server) or a virtual machine (VM). In some embodiments, the computing node 300 may be configured to run the application nodes mentioned herein (e.g., software for the application nodes).

[0108] like Figure 9 As shown, computing node 300 includes processing circuitry (or logic) 310. Processing circuitry 310 controls the operation of computing node 300 and can implement the method described herein with respect to computing node 300. Processing circuitry 310 can be configured or programmed to control computing node 300 in the manner described herein. Processing circuitry 310 may include one or more hardware components, such as one or more processors, one or more processing units, one or more multi-core processors, and / or one or more modules. In a specific implementation, each of the one or more hardware components may be configured to execute or be used to execute a single or multiple steps of the method described herein with respect to computing node 300. In some embodiments, processing circuitry 310 may be configured to run software to execute the method described herein with respect to computing node 300. According to some embodiments, the software may be containerized. Therefore, in some embodiments, processing circuitry 310 may be configured to run a container to execute the method described herein with respect to computing node 300.

[0109] In short, the processing circuit 310 of the computing node 300 is configured to: provision the unencrypted storage volume requested by the first storage provisioning node, so that the unencrypted storage volume is available at the computing node to the first storage provisioning node 200, for use by the first storage provisioning node 200 in generating the encrypted storage volume. The processing circuit 310 of the computing node 300 is also configured to: provision the encrypted storage volume generated by the first storage provisioning node, so that the encrypted storage volume is available at the computing node, for use by the application node.

[0110] like Figure 9 As shown, in some embodiments, computing node 300 may optionally include memory 320. Memory 320 of computing node 300 may include volatile memory or non-volatile memory. In some embodiments, memory 320 of computing node 300 may include non-transitory media. Examples of memory 320 of computing node 300 include, but are not limited to, random access memory (RAM), read-only memory (ROM), mass storage media such as a hard disk, removable storage media such as a compact disk (CD) or a digital video disk (DVD), and / or any other memory.

[0111] The processing circuitry 310 of the computing node 300 can be connected to the memory 320 of the computing node 300. In some embodiments, the memory 320 of the computing node 300 can be used to store program code or instructions that, when executed by the processing circuitry 310 of the computing node 300, cause the computing node 300 to operate in the manner described herein with respect to the computing node 300. For example, in some embodiments, the memory 320 of the computing node 300 can be configured to store program code or instructions that can be executed by the processing circuitry 310 of the computing node 300 to cause the computing node 300 to operate according to the methods described herein with respect to the computing node 300. Alternatively or additionally, the memory 320 of the computing node 300 can be configured to store any information, data, messages, requests, responses, instructions, notifications, signals, etc. described herein. The processing circuitry 310 of the computing node 300 can be configured to control the memory 320 of the computing node 300 to store the information, data, messages, requests, responses, instructions, notifications, signals, etc. described herein.

[0112] In some embodiments, as Figure 9As shown, computing node 300 may optionally include a communication interface 306 (e.g., a network interface and / or a storage interface). The communication interface 306 of computing node 300 may be connected to the processing circuit 310 of computing node 300 and / or the memory 320 of computing node 300. The communication interface 306 of computing node 300 is operable to allow the processing circuit 310 of computing node 300 to communicate with the memory 320 of computing node 300 and / or vice versa. Similarly, the communication interface 306 of computing node 300 is operable to allow the processing circuit 310 of computing node 300 to communicate with the first storage provision node, the second storage provision node, and / or any other node. The communication interface 306 of computing node 300 may be configured to send and / or receive information, data, messages, requests, responses, instructions, notifications, signals, etc. described herein. In some embodiments, processing circuitry 310 of computing node 300 may be configured to control communication interface 306 of computing node 300 to send and / or receive information, data, messages, requests, responses, indications, notifications, signals, and the like.

[0113] Although the computing node 300 Figure 9 320, it should be understood that the computing node 300 may include at least one memory (i.e., a single memory or multiple memories) 320 that operate in the manner described herein. Similarly, although the computing node 300 is shown in FIG. Figure 9 3. Although illustrated as including a single communication interface 306, it should be understood that computing node 300 may include at least one communication interface (ie, a single communication interface or multiple communication interfaces) 306 that operate in the manner described herein.

[0114] You will also understand that Figure 9 Only components necessary to illustrate an embodiment of computing node 300 are shown, and in actual implementations, computing node 300 may include components in addition to or in place of those shown.

[0115] As previously mentioned, in some embodiments, the hardware (e.g., processing circuitry 310, memory 320, and / or communication interface 306) that can implement the methods described herein with respect to computing node 300 can also be used to implement the methods described herein with respect to first storage provisioning node 200 and / or the methods described herein with respect to application nodes. Also as previously mentioned, in some embodiments, the hardware (e.g., processing circuitry 310, memory 320, and / or communication interface 306) that can implement the methods described herein with respect to computing node 300 can also be used to implement the methods performed by second storage provisioning node 510.

[0116] Figure 10 is a flow chart illustrating a method performed by a computing node 300 according to an embodiment. The method is used to provision storage in a system. Figure 9 The computing node 300 described is configured according to Figure 10 The method may be executed by the processing circuit 310 of the computing node 300 or under the control of the processing circuit 310 of the computing node 300.

[0117] like Figure 10 As shown, at block 30, the unencrypted storage volume requested by the first storage provisioning node 200 is provisioned to make the unencrypted storage volume available to the first storage provisioning node 200 at the computing node 300 for use by the first storage provisioning node 200 in generating the encrypted storage volume. More specifically, the processing circuit 310 of the computing node 300 provisions the requested unencrypted storage volume.

[0118] In some embodiments, Figure 10 Provisioning the unencrypted storage volume at block 30 of to make the unencrypted storage volume available at the compute node 300 may include generating a container on which the unencrypted storage volume is made available at the compute node 300. In some embodiments, Figure 10 Provisioning the unencrypted storage volume at block 30 of the first storage provisioning node 200 to make the unencrypted storage volume available at the compute node 300 may include mounting the unencrypted storage volume to the compute node 300 to make the unencrypted storage volume available to the first storage provisioning node 200. In some embodiments, mounting the unencrypted storage volume to the compute node may include mounting the unencrypted storage volume to a directory tree of the compute node. In some embodiments where a container is generated, mounting the unencrypted storage volume to the compute node may include mounting the unencrypted storage volume to the generated container. Thus, in some embodiments, the newly generated (e.g., attached) container may serve as a mount target for the unencrypted storage volume.

[0119] As previously mentioned, those skilled in the art will appreciate that generating a container and mounting an unencrypted storage volume to a compute node are only some examples of how an unencrypted storage volume can be made available at a compute node to the first storage provisioning node 200, and other examples are also possible. For example, in some embodiments, the unencrypted storage volume can be made available at a compute node to the first storage provisioning node 200 via other interfaces (e.g., a Hypertext Transfer Protocol (HTTP) interface). This is particularly useful for object storage.

[0120] return Figure 10 At block 32, the encrypted storage volume generated by the first storage provisioning node 200 is provisioned to make the encrypted storage volume available at the compute node for use by the application node, or more specifically, for use by a storage consumer (e.g., a user, application, or any other storage consumer) of the application node. More specifically, the processing circuitry 310 of the compute node 300 provisions the unencrypted storage volume.

[0121] In some embodiments, Figure 10 Provisioning the encrypted storage volume at block 32 of the present invention to make the encrypted storage volume available at the computing node 300 may include: provisioning the encrypted storage volume on the first storage provisioning node 200 to make the encrypted storage volume available at the computing node 300. In some embodiments, Figure 10 Provisioning the encrypted storage volume at block 32 of the present invention to make the encrypted storage volume available at the computing node 300 for use by the application node may include mounting the encrypted storage volume to the computing node 300 to make the encrypted storage volume available at the computing node 300 for use by the application node. In some embodiments, mounting the encrypted storage volume to the computing node 300 may include mounting the encrypted storage volume to a directory tree of the computing node.

[0122] Those skilled in the art will appreciate that mounting an encrypted storage volume to a compute node is only one example of how an encrypted storage volume can be made available at a compute node for use by application nodes, and that other examples are possible. For example, in some embodiments, an encrypted storage volume can be made available at a compute node for use by application nodes via other interfaces (e.g., a Hypertext Transfer Protocol (HTTP) interface). This is particularly useful for object storage.

[0123] In some embodiments, Figure 10 Provisioning the encrypted storage volume at block 32 to make the encrypted storage volume available at the compute node 300 may include allocating a path within a directory tree of the host file system that is accessible to the application node.

[0124] Despite Figure 10 Not shown, but in some embodiments, the method may include ceasing to make the encrypted storage volume available at the compute node 300 and / or ceasing to make the unencrypted storage volume available at the compute node 300. In some embodiments, ceasing to make the encrypted storage volume available at the compute node 300 may include unmounting the encrypted storage volume from the compute node 300. In some embodiments, ceasing to make the unencrypted storage volume available at the compute node 300 may include unmounting the unencrypted storage volume from the compute node 300. More specifically, in some embodiments, the processing circuitry 310 of the compute node 300 may be configured to unmount the encrypted storage volume and / or the unencrypted storage volume from the compute node 300. In some embodiments, ceasing to make the encrypted storage volume available at the compute node 300 and / or ceasing to make the unencrypted storage volume available at the compute node 300 may be performed in response to a trigger. In some embodiments, the trigger may come from an orchestrator of the system (e.g., Kubernetes or any other orchestrator).

[0125] In some embodiments involving unmounting an encrypted storage volume from a computing node 300, the unmounted encrypted storage volume can be remounted to another computing node. The other computing node can be configured in the same manner as the computing node 300 described herein. The other computing node and the computing node 300 described herein can be part of the same cluster. When a container is retracted from a computing node 300 described herein and rescheduled to another computing node, remounting of the encrypted storage volume can be applied. In these embodiments, the encrypted storage volume (including all data stored thereon) can be retained. The encrypted storage volume can be removed (implicitly or explicitly) from the computing node 300 and recreated on another computing node by the first storage provisioning node 200.

[0126] In some embodiments, as previously described, the computing node 300 can be separate from the second storage supply node 510 of the system described herein. In some embodiments, as previously described, the computing node 300 can include the second storage supply node 510 of the system described herein.

[0127] A system is also provided, comprising one or more first storage supply nodes 200 as described herein, one or more second storage supply nodes 510 as described herein, and / or one or more computing nodes 300 as described herein. In the system, the first storage supply node 200 described herein can be placed (e.g., located or positioned) between the second storage supply node 510 described herein and the application nodes mentioned herein. As previously described, the first storage supply node 200 described herein acts as a shim.

[0128] Figure 11 and Figure 12 Each shows such a system according to an embodiment.

[0129] Figure 11 The system shown is similar to the one previously referenced Figure 1 Same as described except Figure 11 The system shown includes the second storage supply node 510 in addition to the Figure 5 and Figure 6 The first storage supply node 200 is configured in the manner described. Figure 11 In the embodiment shown, the second storage supply node 510 is as previously mentioned. Figure 7 and Figure 8 The configuration is carried out in the manner described, and the computing node 300 is configured as previously described. Figure 9 and Figure 10 Configure as described.

[0130] Figure 12 The system shown is similar to the one previously referenced Figure 2 Same as described except Figure 12The system shown includes the second storage supply node 510 in addition to the Figure 5 and Figure 6 The first storage supply node 200 is configured in the manner described. Figure 12 In the embodiment shown, the second storage supply node 510 is as previously mentioned. Figure 7 and Figure 8 The configuration is carried out in the manner described, and the computing node 300 is configured as previously described. Figure 9 and Figure 10 Configure as described.

[0131] exist Figure 11 In the system shown, the storage backend 500 includes a second storage provisioning node 510. Thus, the storage is accessed via a network connection (e.g., software-defined storage, network-attached storage, etc.). In this embodiment, the second storage provisioning node 510 may include its own hardware as previously described. On the other hand, in Figure 12 In the system shown, the compute node 300 includes a second storage provisioning node 510. Thus, the storage is directly attached to the compute node 300. In this embodiment, the hardware of the second storage provisioning node 510 may be the same hardware as the compute node 300 described above.

[0132] exist Figure 11 and Figure 12 In the system shown, the operating system 350 of the computing node 300 and the first storage provisioning node 200 can communicate via the interface 380. In some embodiments, as shown in FIG. Figure 11 and Figure 12 As shown, the processing circuit 202 of the first storage provisioning node 200 may include an encrypted volume provider module 220 for initiating provisioning of an encrypted storage volume 360 in the manner described herein. Figure 11 and Figure 12 As shown, the processing circuit 202 of the first storage supply node 200 may include a storage coordinator 230. Figure 11 and Figure 12 As shown, the application node 100 may include a storage consuming entity 120. According to some embodiments, the storage consuming entity 120 may be configured to use (or consume) encrypted storage 360.

[0133] exist Figure 11 and Figure 12In the illustrated system, the first storage supply node 200 acts as a storage consumer for the second storage supply node 510. More specifically, the first storage supply node 200 acts as a storage consumer for the unencrypted storage volume 370 provided by the second storage supply node 510. In some embodiments where the processing circuit 202 of the first storage supply node 200 includes an encrypted volume provider module 220, the encrypted volume provider module 220 of the first storage supply node 200 may act as a storage consumer for the unencrypted storage volume 370 provided by the second storage supply node 510. Figure 11 and Figure 12 In the system shown, the first storage provisioning node 200 may act as a storage coordinator 230 for the workload coordinator 410 .

[0134] Figure 13 is a signaling (or call flow) diagram illustrating the exchange of signals in a system according to an embodiment. According to some embodiments, the system may be as follows Figure 11 or Figure 12 As shown. Figure 13 As shown, the system includes an application node 100 , an operating system (OS) 350 of a computing node 300 , a first storage provisioning node 200 , a coordinator 400 , and a second storage provisioning node 510 . Figure 13 The illustrated system further comprises an application management node 600. The application management node 600 may be implemented in hardware and / or software (not shown).

[0135] exist Figure 13 In the embodiment of the present invention, as shown in the figure, steps 700, 702, 704, 706, 710, 712 and 714 can be referred to above. Figure 3 Therefore, refer to Figure 3 The corresponding description of these steps will be understood to also apply to Figure 13 , even though they are not repeated here. However, in Figure 13 At step 706 of the present invention, the unencrypted storage volume 370 is made available at the computing node 100 to the first storage provisioning node 200 (rather than at the Figure 3 Step 706 of the embodiment can be used for the application node 100). In addition, the Figure 13 The illustrated embodiment performs additional steps 902 , 904 , 906 , 908 , 910 , 912 , and 914 .

[0136] In some embodiments, the deployment request (eg, Figure 13The manifest (as indicated by arrow 700) may include a manifest. For example, the manifest may be delivered as part of the application product package. In some embodiments, the manifest may describe the storage requirements of the application node 100. In some embodiments, the manifest may include a description of the storage requirements of the application node 100 and also include a (direct or indirect) pointer to the first storage provisioning node 200.

[0137] refer to Figure 11 、 Figure 12 and Figure 13 ,exist Figure 13 In the embodiment of the present invention, the coordinator 400 transmits the first request 110 for the encrypted storage volume to the first storage provisioning node 200, such as Figure 13 902 . In some embodiments, the first request 110 mentioned herein may be triggered by an application product package deployment operation. In some embodiments, the first request 110 mentioned herein may be used as input to the coordinator 400, for example, during application deployment. This may be performed directly by an administrator interacting with the coordinator 400, for example, through a user interface, or by the application management node 600.

[0138] In response to a first request 110 for an encrypted storage volume (e.g. Figure 13 As shown by arrow 902, the first storage supply node 200 initiates sending a second request 210 to the second storage supply node 510 (eg, via the coordinator 400), as shown in FIG. Figure 13 As shown by arrows 904 and 702. For example, Figure 13 As shown by arrows 904 and 702, the first storage provisioning node 200 itself can send a second request 210 to the second storage provisioning node 510, for example, via the coordinator 400. The second request 210 is a request for an unencrypted storage volume. Therefore, the first storage provisioning node 200 converts the first request for the encrypted storage volume into a second request for an unencrypted storage volume.

[0139] like Figure 13 As shown by arrow 704, in response to the second request 210 (eg, Figure 13 As shown by arrows 904 and 702, the second storage provisioning node 510 initiates provisioning of the unencrypted storage volume 370. Figure 7 and Figure 8 The described manner initiates provisioning of the unencrypted storage volume 370 to make the unencrypted storage volume 370 available to the first storage provisioning node 200 at the computing node 300 (eg, the operating system 350 of the computing node 300 ).

[0140] like Figure 13 As shown in the box 706, the previous reference Figure 9 and Figure 10In the manner described, the computing node 300 (e.g., the operating system 350 of the computing node 300) provisions the unencrypted storage volume 370 so that the unencrypted storage volume 370 is available at the computing node 300 to the first storage provisioning node 200. The unencrypted storage volume 370 is made available at the computing node 300 to the first storage provisioning node 200 for use by the first storage provisioning node 200 in generating the encrypted storage volume 360. In some embodiments, as Figure 13 As shown by arrow 906 , the second request may be confirmed by the second storage supply node 510 to the first storage supply node 200 .

[0141] In response to the requested unencrypted storage volume 370 becoming available to the first storage provisioning node 200, as previously referenced Figure 5 and Figure 6 The method described above generates the encrypted storage volume 360 from the unencrypted storage volume 370 by the first storage provisioning node 200. Figure 13 As shown in block 908 , in some embodiments, an encryption layer may be provided by the first storage provisioning node 200 (or any other node) for generating the encrypted storage volume 360 .

[0142] like Figure 13 As shown by arrow 910, the previous reference Figure 5 and Figure 6 In the manner described, the first storage provisioning node 200 initiates the provisioning of the encrypted storage volume 360 to make the encrypted storage volume 360 available at the computing node 300 for use by the application node 100, or more specifically, for use by the storage consumer 120 of the application node 100 (such as a user, application or any other storage consumer).

[0143] like Figure 13 As shown in the box 912, the previous reference Figure 9 and Figure 10 In the manner described, the encrypted storage volume 360 generated by the first storage supply node 200 is supplied by the computing node 300 (e.g., the operating system 350 of the computing node 300) to make the encrypted storage volume 360 available at the computing node 300 for use by the application node 100, or more specifically, for use by the storage consumer 120 of the application node 100.

[0144] In some embodiments, the coordinator 400 may send a request (eg, an operating system 350 of the computing node 300) to create an application node 100. Figure 13 The computing node 300 (eg, the operating system 350 of the computing node 300) may then send a request to the application node 100 to start (eg, Figure 12Once started, the application node 100 can use (or consume) the encrypted storage volume (e.g., Figure 13 714).

[0145] Figure 14 is a signaling (or call flow) diagram illustrating the exchange of signals in a system according to an embodiment. According to some embodiments, the system may be as follows Figure 11 or Figure 12 As shown. Figure 14 As shown, the system includes an application node 100 , an operating system (OS) 350 of a computing node 300 , a first storage provisioning node 200 , a coordinator 400 , and a second storage provisioning node 510 . Figure 14 The illustrated system further comprises an application management node 600. The application management node 600 may be implemented in hardware and / or software (not shown).

[0146] exist Figure 14 In the embodiment of the present invention, as shown in the figure, steps 800, 802, 804, 806, 808, 810 and 812 can be referred to above. Figure 4 Therefore, refer to Figure 4 The corresponding description of these steps will be understood to also apply to Figure 14 , even though they are not repeated here. However, in Figure 14 At step 810, the unencrypted storage volume 370 is made unavailable to the first storage provisioning node 200 (instead of Figure 4 Step 810 is not available for the application node 100). In addition, it is also possible to Figure 14 The illustrated embodiment performs additional steps 1002, 1004, 1006, 1008, 1010, and 1012. In some embodiments, Figure 14 The method shown can be Figure 13 The method shown in is then executed.

[0147] refer to Figure 14 , in response to a (fourth) request to stop making the encrypted storage volume 360 available at the computing node 300 (e.g. Figure 14 As shown by arrow 1002, Figure 14 As shown by arrow 1004, the previous reference Figure 5 and Figure 6 In the manner described above, the first storage provisioning node 200 may initiate the process of stopping the encrypted storage volume 360 from being available at the computing node 300. Figure 14 As shown by arrow 1002, the (fourth) request to stop making the encrypted storage volume 360 available at the computing node 300 may come from the coordinator 400. Figure 14As shown in block 1006 of FIG. 1 , the computing node 300 (eg, the operating system 350 of the computing node 300) may be configured as described above with reference to FIG. Figure 9 and Figure 10 The described approach stops making the encrypted storage volume 360 available at the compute node 300 .

[0148] like Figure 14 As shown by arrows 1008 and 806, the first storage provisioning node 200 may initiate a (third) request to the second storage provisioning node 510 (eg, via the coordinator 400) to stop making the unencrypted storage volume 370 available at the computing node 300. Figure 14 As shown by arrow 808, in response to the (third) request from the first storage provisioning node 200 to stop making the unencrypted storage volume 370 available at the computing node 300, the second storage provisioning node 510 may stop making the unencrypted storage volume 370 available at the computing node 300 in the manner previously referred to. Figure 7 and Figure 8 The described manner initiates the deactivation of making the unencrypted storage volume 370 available at the computing node 300. Figure 14 As shown in block 810 of FIG. 8 , the computing node 300 (eg, the operating system 350 of the computing node 300 ) may be configured as described above with reference to FIG. Figure 9 and Figure 10 The described approach stops making the unencrypted storage volume 370 available at the compute node 300 .

[0149] like Figure 14 As shown by arrows 812 and 1010, in some embodiments, the (third) request to stop making the unencrypted storage volume 370 available at the computing node 300 may be acknowledged by the second storage provisioning node 510 to the first storage provisioning node 200 (e.g., via the coordinator 400). Figure 14 As shown by arrow 1012 , in some embodiments, the (fourth) request to stop making the encrypted storage volume 360 available at the computing node 300 may be acknowledged by the first storage provisioning node 200 to the coordinator 400 .

[0150] In some embodiments, the methods described herein with respect to the first storage provisioning node 200, the second storage provisioning node 510, and / or the computing node 300 may be executed (e.g., may be run to completion) before the application node 100 is launched (e.g., before the application node 100 is started (or booted)). In this manner, the encrypted storage volume 360 is available at the computing node 300 for use by the application node 100 before the application node 100 is launched (e.g., started (or booted)). In other embodiments, the application node 100 may be launched (e.g., started (or booted)) before the encrypted storage volume 360 is available at the computing node 300. In some of these embodiments, the application node 100 (e.g., the processing circuitry of the application node 100) may be configured to check whether the encrypted storage volume 360 is available at the computing node 300. In some embodiments, the check may be performed by the application node 100 (e.g., the processing circuitry of the application node 100) polling the computing node 300. For example, the check may be performed continuously or at predefined time intervals. In some embodiments, the coordinator 400 may be configured to initiate (eg, start (or initiate)) the application node 100 .

[0151] Figure 15 1 shows an example environment in which systems (such as those described above) may be deployed according to an embodiment. Figure 15 As shown, the example environment includes a Kubernetes (which may also be referred to as k8s) system, which can be used as a coordinator. The example environment also includes a container storage interface (CSI) encryption shim plug-in, a CSI storage plug-in, and a helm chart. The environment also includes an application requesting data storage. The method described herein can be used to provision the data storage. The first storage provisioning node 200 described herein can be used as a CSI encryption shim plug-in. In the example environment, the application node 100 can select the storage type provided by the second storage provisioning node 510, for example, via the helm chart.

[0152] Figure 16is a block diagram illustrating a first storage provisioning node 1100 according to an embodiment. The first storage provisioning node 1100 includes a sending initiation module 1102, which is configured to, in response to a first request for an encrypted storage volume for an application node, initiate sending a second request for an unencrypted storage volume to a second storage provisioning node. The first storage provisioning node 1100 includes a generating module 1104, which is configured to, in response to the requested unencrypted storage volume becoming available to the first storage provisioning node, generate an encrypted storage volume from the unencrypted storage volume. The first storage provisioning node 1100 includes a provisioning initiation module 1106, which is configured to initiate provisioning of the encrypted storage volume to make the encrypted storage volume available at a computing node of the system for use by the application node. The first storage provisioning node 1100 may operate in the manner described herein.

[0153] Figure 17 is a block diagram illustrating a second storage provisioning node 1200 according to an embodiment. The second storage provisioning node 1200 includes a provisioning initiation module 1202, which is configured to, in response to a second request for an unencrypted storage volume from the first storage provisioning node 1100 of the system, initiate provisioning of the unencrypted storage volume so that the unencrypted storage volume is available to the first storage provisioning node 1100 at a computing node of the system, for use by the first storage provisioning node 1100 in generating an encrypted storage volume, which is to be available at the computing node for use by the application node. In some embodiments, the second storage provisioning node 1200 may further include a deprovisioning initiation module, which is configured to initiate deprovisioning of the unencrypted storage volume to stop making the unencrypted storage volume available at the computing node. The second storage provisioning node 1200 may operate in the manner described herein.

[0154] Figure 18 is a block diagram illustrating a computing node 1300 according to an embodiment. Computing node 1300 includes a first provisioning module 1302 configured to provision unencrypted storage volumes requested by first storage provisioning node 1100, making the unencrypted storage volumes available at the computing node to first storage provisioning node 1100 for use by first storage provisioning node 1100 in generating encrypted storage volumes. Computing node 1300 includes a second provisioning module 1304 configured to provision encrypted storage volumes generated by first storage provisioning node 1100, making the encrypted storage volumes available at the computing node for use by application nodes. In some embodiments, computing node 1300 may further include a deprovisioning module configured to deprovision the unencrypted storage volumes to stop making the unencrypted storage volumes available at the computing node. Computing node 1300 may operate in the manner described herein.

[0155] Also provided is a computer program comprising instructions that, when executed by a processing circuit (e.g., the processing circuit 202 of the first storage supply node 200 described above, the processing circuit 502 of the second storage supply node 510 described above, and / or the processing circuit 310 of the computing node 300 described above), cause the processing circuit to perform at least a portion of the method described herein. Also provided is a computer program product embodied on a non-transitory machine-readable medium, comprising instructions that are executable by a processing circuit (e.g., the processing circuit 202 of the first storage supply node 200 described above, the processing circuit 502 of the second storage supply node 510 described above, and / or the processing circuit 310 of the computing node 300 described above) to cause the processing circuit to perform at least a portion of the method described herein. Also provided is a computer program product comprising a carrier containing instructions for causing a processing circuit (e.g., the processing circuit 202 of the first storage supply node 200 described above, the processing circuit 502 of the second storage supply node 510 described above, and / or the processing circuit 310 of the computing node 300 described above) to perform at least a portion of the method described herein. In some embodiments, the carrier can be any one of an electronic signal, an optical signal, an electromagnetic signal, an electrical signal, a radio signal, a microwave signal, or a computer-readable storage medium.

[0156] In some embodiments, the first storage supply node functionality, the second storage supply node functionality, and / or the compute node functionality described herein may be performed by hardware. Thus, in some embodiments, any one or more of the first storage supply node 200, the second storage supply node 510, and the compute node 300 described herein may be hardware nodes. However, it will also be understood that, alternatively, at least some or all of the first storage supply node functionality, the second storage supply node functionality, and / or the compute node functionality described herein may be virtualized. For example, the functionality performed by any one or more of the first storage supply node 200, the second storage supply node 510, and the compute node 300 described herein may be implemented in software, with the software running on general-purpose hardware configured to coordinate node functionality. Thus, in some embodiments, any one or more of the first storage supply node 200, the second storage supply node 510, and the compute node 300 described herein may be virtual nodes. In some embodiments, at least some or all of the first storage supply node functionality, the second storage supply node functionality, and / or the compute node functionality described herein may be performed in a network-enabled cloud. The first storage supply node functionality, the second storage supply node functionality, and / or the compute node functionality described herein may all be co-located, or at least some of the node functionality may be distributed.

[0157] It should be understood that in some embodiments, at least some or all of the method steps described herein can be automated. That is, in some embodiments, at least some or all of the method steps described herein can be performed automatically.

[0158] Therefore, in the manner described herein, a technology for supplying storage in a system is advantageously provided. The first storage supply node 200 described herein can be deployed in any type of system, including but not limited to any cloud system, such as any cloud system that provides an interface that supports a storage provider plug-in. The first storage supply node 200 described herein can fill the gaps in other functions (such as metrics) that are not supported by existing cloud storage providers. The second storage supply node 510 described herein can be any type of storage supply node, including but not limited to any cloud system storage provider. The method described herein can be used for any workload that requires storage. In addition, no software support is required for the storage user end.

[0159] It should be noted that the above embodiments illustrate rather than limit the present concept, and that those skilled in the art will be able to design many alternative embodiments without departing from the scope of the appended claims. The word "comprising" does not exclude the presence of elements or steps other than those listed in a claim, and "a" or "an" does not exclude a plurality, and a single processor or other unit may perform the functions of several units recited in a claim. Any reference signs in the claims should not be construed as limiting the scope.

Claims

1. A method for provisioning storage in a system, performed by a first storage provisioning node (200) of the system, the method comprising: In response to a first request (110, 902) for an encrypted storage volume for an application node (100), initiating (20) sending a second request (210, 904, 702) for an unencrypted storage volume (370) to a second storage provisioning node (510); and In response to the requested unencrypted storage volume (370) becoming available to the first storage provisioning node (200), generating (22) an encrypted storage volume (360) from the unencrypted storage volume (370), and initiating provisioning (24, 910) of the encrypted storage volume (360) to make the encrypted storage volume (360) available at a compute node (300) of the system for use by the application node (100), Wherein, initiating provisioning (24, 910) of the encrypted storage volume to make the encrypted storage volume available at the computing node (300) for use by the application node (100) includes: Initiate mounting of the encrypted storage volume (360) to a directory tree of the computing node (300) to make the encrypted storage volume (360) available at the computing node (300) for use by the application node (100).

2. The method according to claim 1, wherein: Initiating provisioning (24, 910) of the encrypted storage volume (360) to make the encrypted storage volume (360) available at the compute node (300) for use by the application node (100) includes: Provisioning (24, 910) of the encrypted storage volume (360) on the first storage provisioning node (200) is initiated to make the encrypted storage volume (360) available at the computing node (300).

3. The method according to claim 1, comprising: A third request (1008, 806) is initiated to the second storage provisioning node (510) to stop making the unencrypted storage volume (370) available at the compute node (300).

4. The method according to claim 1, comprising: In response to a fourth request (1002) to stop making the encrypted storage volume (360) available at the computing node (300), stopping making the encrypted storage volume (360) available at the computing node (300) is initiated (1004).

5. The method according to claim 1, wherein: The encrypted storage volume (360) is generated (22) by applying (908) an encryption layer to the unencrypted storage volume (370).

6. The method according to claim 5, wherein: The encryption layer is an encrypted file system layer.

7. A first storage supply node (200), comprising: A processing circuit (202) configured to operate according to any one of claims 1 to 6.

8. The first storage supply node (200) according to claim 7, wherein: The first storage supply node (200) comprises: At least one memory (204) for storing instructions which, when executed by the processing circuit (202), cause the first storage supply node (200) to operate according to any one of claims 1 to 6.

9. A method for provisioning storage in a system, performed by a second storage provisioning node (510) of the system, the method comprising: In response to a second request (210, 904, 702) for an unencrypted storage volume from a first storage provisioning node (200) of the system, initiating provisioning (50, 704) of the unencrypted storage volume (370) to make the unencrypted storage volume (370) available to the first storage provisioning node (200) at a compute node (300) of the system for use by the first storage provisioning node (200) in generating an encrypted storage volume (360), the encrypted storage volume (360) to be mounted to a directory tree of the compute node (300) to be available at the compute node (300) for use by the application node (100).

10. The method according to claim 9, wherein: Initiating provisioning (50, 704) of the unencrypted storage volume (370) to make the unencrypted storage volume (370) available to the first storage provisioning node (200) at the compute node (300) includes: Mounting the unencrypted storage volume (370) to the compute node (300) is initiated to make the unencrypted storage volume (370) available to the first storage provisioning node (200).

11. The method according to claim 9, wherein: Initiating provisioning (50, 704) of the unencrypted storage volume (370) to make the unencrypted storage volume (370) available to the first storage provisioning node (200) at the compute node (300) includes: Initiating the creation of a container on which the unencrypted storage volume (370) is made available at the compute node (300).

12. The method according to claim 9, wherein: The computing node (300) is separated from the second storage supply node (510); or The computing node (300) includes the second storage provisioning node (510).

13. The method according to claim 9, comprising: In response to a third request (1008, 806) from the first storage provisioning node (200) to stop making the unencrypted storage volume (370) available at the computing node (300), stopping making the unencrypted storage volume (370) available at the computing node (300) is initiated (808).

14. The method according to claim 13, wherein: Initiating (808) ceasing to make the unencrypted storage volume (370) available at the computing node (300) includes: Initiate unmounting of the unencrypted storage volume (370) from the compute node (300).

15. A second storage supply node (510), comprising: Processing circuit (502) configured to operate according to any one of claims 9 to 14.

16. The second storage supply node (510) according to claim 15, wherein The second storage supply node (510) includes: At least one memory (520) for storing instructions which, when executed by the processing circuit (502), cause the second storage supply node (510) to operate according to any one of claims 9 to 14.

17. A method for provisioning storage in a system, performed by a computing node (300) of the system, the method comprising: Provisioning (30, 706) an unencrypted storage volume (370) requested by a first storage provisioning node (200) to make the unencrypted storage volume (370) available to the first storage provisioning node (200) at the computing node (300) for use by the first storage provisioning node (200) in generating an encrypted storage volume (360); as well as provisioning (32, 912) the encrypted storage volume (360) generated by the first storage provisioning node (200) to make the encrypted storage volume (360) available at the compute node (300) for use by the application node (100), Wherein, provisioning (32, 912) the encrypted storage volume (360) to make the encrypted storage volume (360) available at the computing node (300) for use by the application node (100) includes: The encrypted storage volume (360) is mounted to the directory tree of the computing node (300) to make the encrypted storage volume (360) available at the computing node (300) for use by the application node (100).

18. The method according to claim 17, wherein: Provisioning (30, 706) the unencrypted storage volume (370) to make the unencrypted storage volume (370) available at the computing node (300) includes: generating a container on which the unencrypted storage volume (370) is made available at the computing node (300); and / or Provisioning (32, 912) the encrypted storage volume (360) to make the encrypted storage volume (360) available at the computing node (300) includes: The encrypted storage volume (360) on the first storage provisioning node (200) is provisioned (32, 912) to make the encrypted storage volume (360) available at the computing node (300).

19. The method of claim 17, wherein: Provisioning (30, 706) the unencrypted storage volume (370) to make the unencrypted storage volume (370) available to the first storage provisioning node (200) at the compute node (300) includes: The unencrypted storage volume (370) is mounted to the computing node (300) to make the unencrypted storage volume (370) available to the first storage provisioning node (200).

20. The method of claim 19, wherein: Mounting the unencrypted storage volume (370) to the computing node (300) includes: The unencrypted storage volume (370) is mounted to the directory tree of the computing node (300).

21. The method according to claim 17, comprising: stopping ( 1006 ) making the encrypted storage volume ( 360 ) available at the computing node ( 300 ); and / or Stopping (810) making the unencrypted storage volume (370) available at the compute node (300).

22. The method of claim 21, wherein: Stopping (1006) making the encrypted storage volume (360) available at the computing node (300) includes: Unmounting the encrypted storage volume (360) from the computing node (300); and / or Stopping (810) making the unencrypted storage volume (370) available at the compute node (300) includes: The unencrypted storage volume (370) is unmounted from the computing node (300).

23. The method of claim 21, wherein: Ceasing (1006) making the encrypted storage volume (360) available at the computing node (300) and / or ceasing (810) making the unencrypted storage volume (370) available at the computing node (300) is performed in response to a trigger.

24. The method of claim 17, wherein: The computing node (300) is separated from the second storage provisioning node (510) of the system; or The computing node (300) of the system includes a second storage provisioning node (510) of the system.

25. A computing node (300), comprising: Processing circuitry (310) configured to operate according to any one of claims 17 to 24.

26. The computing node (300) according to claim 25, wherein The computing node (300) includes: At least one memory (320) for storing instructions which, when executed by the processing circuit (310), cause the computing node (300) to operate in accordance with any one of claims 17 to 24.

27. A system for supply storage, comprising: One or more first storage supply nodes (200) according to claim 7 or 8; One or more second storage supply nodes (510) according to claim 15 or 16; and / or One or more computing nodes (300) according to claim 25 or 26.

28. A computer program product embodied on a non-transitory machine-readable medium, comprising instructions executable by a processing circuit to cause the processing circuit to perform the method of any one of claims 1 to 6, 9 to 14, and 17 to 24.

Images