Caching service for providing access to secrets in a containerized cloud computing environment

Abstract

A cache service provides low-latency access to secrets for applications in a containerized, multi-tenant cloud computing system. The cache service can operate as a cluster-level service or a sidecar service. The cache service can store copies of secrets (which are located in one or more absolute stores) in cache storage. The cache service and cache storage can be closer to the applications than the one or more absolute stores. The cache service can aggregate secrets associated with multiple entities in a single cache storage. The cache service can support isolation between secrets such that secrets for a first entity are isolated from secrets for a second entity. The cache service can enforce granular access controls such that it can apply different access controls to secrets for the first entity than to secrets for the second entity.

Description

[0001] Cross-references to related applications

[0002] This application claims priority to Dutch Application No. 2027514, filed on 8 February 2021, the entire contents of which are incorporated herein by reference. Background Technology

[0003] A cloud computing system can be a collection of computing devices or resources that provides customers with access to computing services or physical computing resources via the Internet. A cloud computing system may include multiple data centers located in different geographical locations. Each data center may include multiple clusters, and each cluster may include multiple servers. Servers may include multiple containers. Each container may host an instance of a tenant's application. In this way, a single server can serve multiple customers.

[0004] Applications running in containers may require access to secrets to perform operations. Secrets can be sensitive data, such as keys, credentials, configuration files, tokens, passwords, or certificates. Access to secrets can be restricted based on access controls. Access controls can allow only authorized applications to access secrets. Cloud computing systems can store secrets in one or more master stores within the cloud computing system. One or more master stores can implement access controls to restrict access to secrets. One or more master stores can be located away from the application that made the request. Summary of the Invention

[0005] The caching service provides low-latency, high-throughput access to secrets while maintaining isolation and granular access control between secrets in a multi-tenant environment. The caching service acts as a proxy, receiving requests for secrets, verifying authentication requests, and providing access to the secrets. The caching service stores copies of secrets stored in one or more primary storage locations in cache storage, which is closer to the requesting application than to the one or more primary storage locations. Similarly, the caching service is closer to the requesting application than to the one or more primary storage locations.

[0006] The caching service receives a request for a specific secret from the requesting application. The caching service verifies and authenticates the request based on the application's access controls to determine if the requesting application is authorized to access the specific secret. If the requesting application is authorized, the caching service retrieves a copy of the specific secret from the cache storage and provides it to the requesting application. Because the caching service and cache storage are closer to the requesting application than the absolute store containing the specific secret is, the caching service reduces the latency of requesting the secret.

[0007] In one embodiment, the caching service operates as a cluster-level service. In this embodiment, the caching service operates on a cluster and receives requests for secrets from applications operating on the cluster. The caching service can be horizontally scaled based on traffic. In another embodiment, the caching service operates as a sidecar service. Each application pod or container may include the caching service to receive requests from applications operating within the application pod or container. Operating the caching service as a cluster-level service provides better manageability compared to operating it as a sidecar service. Operating the caching service using a sidecar model provides stronger security and isolation between secrets compared to operating it as a cluster-level service.

[0008] The caching service provides strong authentication and authorization enforcement. It includes access controls that restrict access to secrets. The caching service uses access controls to determine whether an application is authorized to access a specific secret. In one embodiment, the caching service includes different access controls for different individual secrets. For example, the caching service includes a first access control for a first secret and a second access control for a second secret, which is different from the first access control. The first access control authorizes a first entity to access the first secret, while the second access control does not authorize the first entity to access the second secret. As a result, the caching service authorizes the first entity to access the first secret under the first access control, but prohibits the first entity from accessing the second secret under the second access control. In this way, the caching service provides low-latency access to secrets for applications associated with multiple different entities, while protecting one entity's secrets from unauthorized access by other entities.

[0009] In one embodiment, the access control implemented by the caching service for a specific secret is the same as the access control implemented by the main storage containing the specific secret. In this way, the caching service can reduce the latency of the secret without compromising the security and access control restrictions implemented by the main storage.

[0010] In one embodiment, a caching service aggregates secrets from multiple primary storages and provides isolation between the secrets. Consider a cluster-level caching service operating on a cluster of cloud computing systems. Multiple applications associated with different entities run on the cluster. These applications utilize multiple primary storages to access secrets. The caching service provides these applications with access to copies of secrets stored on multiple primary storages. In doing so, the caching service stores copies of secrets such that the secret of a first entity is logically or physically isolated from the secret of a second entity, and allows the caching service to apply different access controls to the secret of the first entity than to the secret of the second entity. In this way, the caching service can provide low-latency, high-throughput secret access for applications on a cluster in a multi-tenant environment, while maintaining isolation and access protection between the secrets of multiple tenants.

[0011] The caching service stores secret copies (which may come from multiple absolute storages and be associated with multiple entities) in a cache storage device. In one embodiment, the cache storage device is an in-memory storage device. In another embodiment, the cache storage device is an in-cluster storage device. In yet another embodiment, the cache storage device is an out-of-cluster storage device.

[0012] The caching service described in this disclosure reduces the latency of providing secrets (at least because the caching service and cache storage are closer to the requesting application than the primary storage containing the secrets), reduces the load on the primary storage (at least because the caching service operates as a cluster-level service or sidecar service rather than serving the absolute storage of multiple clusters), provides faster scaling in response to secret demands (at least because the caching service can scale horizontally as a cluster-level service or as a sidecar service as the application grows), and offers better system reliability (e.g., containers can still scale by retrieving secrets from the caching service when the primary storage fails). The caching service provides these benefits while maintaining isolation between secrets across multiple entities in a multi-tenant environment, and strong, granular authentication and authorization protection for individual secrets across multiple entities.

[0013] According to one aspect of this disclosure, a cloud computing system is disclosed. The cloud computing system includes a first absolute storage containing a first secret associated with a first service. The first absolute storage implements a first set of access controls on the first secret. The first set of access controls authorizes the first service to access the first secret. The cloud computing system also includes a second absolute storage containing a second secret associated with a second service. The second absolute storage implements a second set of access controls on the second secret. The second absolute storage is separate from the first absolute storage. The second set of access controls authorizes the second service to access the second secret but not the first service. The cloud computing system also includes a cache storage device containing copies of the first secret and the second secret. The cloud computing system also includes a first cluster of two or more servers. The first cluster includes a first container, which includes the first service. The first container is an isolated environment within the first cluster for running the first service. The first cluster also includes a second container containing a second service. The second container is an isolated environment within the first cluster for running the second service. The first cluster also includes a cache service. The cache service includes instructions stored in memory, which, when executed by one or more processors, cause the cache service to receive a first call to the first secret from the first service. When executed by one or more processors, the instructions also cause the cache service to receive a second call to the second secret from the second service. When executed by one or more processors, the instructions also cause the cache service to authenticate the first call based on a first set of access controls and to authenticate the second call based on a second set of access controls. When executed by one or more processors, the instructions also cause the cache service to retrieve the first secret from the cache storage device in response to authenticating the first call. The distance from the first container to the cache storage device is closer than the distance to the first absolute storage. When executed by one or more processors, the instructions also cause the cache service to retrieve the second secret from the cache storage device in response to authenticating the second call. The distance from the first container to the cache storage device is closer than the distance to the second absolute storage.

[0014] The first cluster may include cache storage devices.

[0015] The first service can be associated with the first tenant, and the second service can be associated with a second tenant that is different from the first tenant.

[0016] The first service and the second service can be associated with the same tenant.

[0017] The caching service may also include a cache expiration policy. The cache expiration policy determines when entries in the cache storage device expire, and the cache expiration policy is based on a first set of access controls and a second set of access controls.

[0018] The first cluster may also include a third container, which includes a second instance of the first service. Instructions stored in memory, when executed by one or more processors, may further cause the cache service to receive a third invocation of the first secret from the second instance of the first service. Instructions stored in memory, when executed by one or more processors, may further cause the cache service to authenticate the third invocation based on a first set of access controls. Instructions stored in memory, when executed by one or more processors, may further cause the cache service to retrieve the first secret from cache storage in response to authenticating the third invocation.

[0019] The cloud computing system may also include a second instance of the caching service, and the caching service and the second instance of the caching service participate in peer-to-peer communication.

[0020] The system may further include a second cache storage device containing a copy of the first secret and a second cluster. The second cluster may include a fourth container, which includes a third instance of the first service and a second cache service. The second cache service may include instructions stored in memory that, when executed by one or more processors, cause the cache service to receive a fourth call to the first secret from the third instance of the first service. When executed by one or more processors, the instructions may also cause the cache service to authenticate the fourth call based on a first set of access controls and, in response to authenticating the fourth call, retrieve the first secret from the second cache storage device. The fourth container may be closer to the second cache storage device than to the first absolute storage.

[0021] The instructions stored in memory, when executed by one or more processors, can further cause the cache service to receive a fifth call to the first secret from the second service. When executed by one or more processors, the instructions can also cause the cache service to determine, based on the fifth call and the first set of access controls, that the second service is not authorized to access the first secret. When executed by one or more processors, the instructions can also cause the cache service to reject the fifth call to the first secret.

[0022] According to another aspect of this disclosure, a cloud computing system is disclosed. The cloud computing system includes a first absolute storage containing a first secret. The first absolute storage implements a first set of access controls on the first secret, and the first set of access controls authorizes a first service to access the first secret. The cloud computing system includes a first cluster of two or more nodes having a first geographical location. The first cluster includes a first cache storage device containing a copy of the first secret and a first container. The first container includes a first instance of the first service and a first cache service. The first cache service includes a first instruction stored in memory, which, when executed by one or more processors, causes the first cache service to receive a first call to the first secret from the first instance of the first service. When executed by one or more processors, the first instruction also causes the first cache service to authenticate the first call based on the first set of access controls. When executed by one or more processors, the first instruction also causes the first cache service to retrieve the first secret from the first cache storage device in response to authenticating the first call. The first container is closer to the first cache storage device than to the first absolute storage. The cloud computing system also includes a second cluster of two or more nodes having a second geographical location different from the first geographical location. The second cluster includes a second cache storage device containing a copy of the first secret and a second container including a second instance of the first service and a second cache service. The second cache service includes a second instruction stored in memory. When executed by one or more processors, the second instruction causes the second cache service to receive a second call to the first secret from a second instance of the first service. When executed by one or more processors, the second instruction also causes the second cache service to authenticate the second call based on a first set of access controls. When executed by one or more processors, the second instruction also causes the second cache service to retrieve the first secret from a second cache storage device in response to authenticating the second call. The second container is closer to the second cache storage device than to the first absolute storage.

[0023] The system may further include a second absolute storage containing the second secret. The second absolute storage implements a second set of access controls on the second secret. The second absolute storage may be separate from the first absolute storage. The second set of access controls may authorize a second service to access the second secret while not authorizing the first service to access the second secret. The second cache storage device may further include a copy of the second secret. The second cluster may further include a third container. The third container may include a first instance of the second service and a third cache service. The third cache service may include third instructions stored in memory, which, when executed by one or more processors, cause the third cache service to receive a third call to the second secret from the first instance of the second service. When executed by one or more processors, the third instructions may also cause the third cache service to authenticate the third call based on the second set of access controls and, in response to authenticating the third call, retrieve the second secret from the second cache storage device.

[0024] The first secret can include one or more passwords.

[0025] According to another aspect of this disclosure, a computer-readable medium is disclosed, comprising instructions executable by one or more processors to cause a computing system to store a copy of a first secret in a cache storage device. The cache storage device is part of a cloud computing system. The first secret is also stored at a first location different from the cache storage device. A first set of access controls authorizes a first entity to access the first secret but disallows a second entity to access the first secret. These instructions are also executable by one or more processors to cause the computing system to store a copy of a second secret in the cache storage device. The second secret is different from the first secret. The second secret is also stored at a second location different from the cache storage device, and a second set of access controls authorizes a second entity to access the second secret while authorizing the first entity to access the second secret. These instructions are also executable by one or more processors to cause the computing system to receive a first call to the first secret from a first service associated with the first entity within a first cluster of the cloud computing system. The first service runs in a first container in the first cluster, and the first container is closer to the cache storage device than to the first location. These instructions are also executable by one or more processors to cause the computing system to determine, based on the first call and the first set of access controls, that the first service is authorized to access the first secret. These instructions can also be executed by one or more processors to cause the computing system to receive a second call for a second secret from a second service associated with a second entity within the first cluster. The second service runs in a second container within the first cluster, and the second container is closer to a cache storage device than to a second location. These instructions can also be executed by one or more processors to cause the computing system to determine, based on the second call and a second set of access controls, that the second service is authorized to access the second secret. These instructions can also be executed by one or more processors to cause the computing system to retrieve the first secret from the cache storage device based on the determination that the first service is authorized to access the first secret. These instructions can also be executed by one or more processors to cause the computing system to retrieve the second secret from the cache storage device based on the determination that the second service is authorized to access the second secret. These instructions can also be executed by one or more processors to cause the computing system to provide the first secret to the first service. These instructions can also be executed by one or more processors to cause the computing system to provide the second secret to the second service.

[0026] The computer-readable medium may also include instructions executable by one or more processors to cause a computing system to receive a third call to a first secret from a second instance of the first service. The second instance of the first service may run in a third container within a first cluster. The computer-readable medium may also include instructions executable by one or more processors to cause the computing system to determine, based on the third call and a first set of access controls, that the second instance of the first service is authorized to access the first secret. The computer-readable medium may also include instructions executable by one or more processors to cause the computing system to provide the first secret to the second instance of the first service.

[0027] The computer-readable medium may also include instructions executable by one or more processors to cause a computing system to receive a fourth call to the first secret from the second service. The computer-readable medium may also include instructions executable by one or more processors to cause the computing system to determine, based on the fourth call and the first set of access controls, that the second service is not authorized to access the first secret. The computer-readable medium may also include instructions executable by one or more processors to cause the computing system to reject the fourth call.

[0028] This summary is provided to present a simplified description of the selected concepts, which will be further described in the detailed embodiments below. This summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to assist in determining the scope of the claimed subject matter.

[0029] Additional features and advantages will be set forth in the description below. The features and advantages of this disclosure can be realized and obtained by means of the systems and methods particularly pointed out in the appended claims. The features of this disclosure will become more apparent from the following description and the appended claims, or may be learned by practice of the disclosed subject matter as set forth below. Attached Figure Description

[0030] To describe in more detail the manner in which the above and other features of this disclosure are obtained, reference will be made to specific embodiments of this disclosure shown in the accompanying drawings. For better understanding, similar elements are indicated by similar reference numerals in the various drawings. It should be understood that the drawings depict some exemplary embodiments, and the embodiments will be described and explained with additional features and details using the drawings, wherein:

[0031] Figure 1A A cloud computing system is shown, in which a caching service for providing access to secrets operates as a cluster-level service.

[0032] Figure 1B The cluster-level caching service has been expanded to meet demand.

[0033] Figure 2A cloud computing system is shown, in which a caching service for providing access to secrets operates as a sidecar service.

[0034] Figure 3 An example caching service is shown that provides access to a secret in response to a call.

[0035] Figure 4 An example cache memory is shown for storing secrets provided by a caching service.

[0036] Figure 5 A method for providing low-latency access to secrets in a multi-tenant cloud computing system is shown.

[0037] Figure 6 A method for caching secrets from multiple entities is shown.

[0038] Figure 7 Some components that may be included within a computing device are shown. Detailed Implementation

[0039] This disclosure relates to a caching service for providing secure and fast access to secrets in containerized and multi-tenant environments of cloud computing systems, while maintaining granular access control and isolation between secrets of multiple entities.

[0040] A cloud computing system is a collection of remotely accessible computing devices or resources. It provides tenants with the ability to access computing services or physical computing resources via the Internet. A cloud computing system comprises multiple data centers located in different geographical locations. Each data center includes multiple clusters, and each cluster includes multiple servers (which may be called nodes). A server is a physical computer system. A server contains multiple containers. Each container can host an instance of a tenant's application. In this way, a single server and a single cluster can serve multiple tenants.

[0041] Applications running in containers need access to secrets to start, operate, process workloads, and provide services. Secrets are sensitive data. Secrets are non-public data. Examples of secrets include keys, credentials, configuration files, tokens, passwords, or certificates. Therefore, unauthorized access to secrets can allow malicious actors to gain unrestricted access to more information that should be protected. Therefore, it is important that cloud computing systems only allow authorized entities to access secrets. In other words, it is important that cloud computing systems serving many different entities protect one entity's secrets from being accessed by another entity. Therefore, access to secrets is restricted based on access controls. Access controls only allow authorized entities to access secrets. For example, access controls can restrict access to secrets to one or more specific tenants, one or more specific identities within a tenant, one or more specific services of a tenant, or one or more specific services of an identity within a tenant.

[0042] Cloud computing systems store secrets in one or more primary storage units (which may be referred to as absolute storage) within the cloud computing system. These primary storage units implement access controls, ensuring that only authorized entities can access the secrets. Each primary storage unit may be physically or logically separate from other primary storage units. Each primary storage unit can only access those secrets stored within and managed by it.

[0043] Each application can have an associated primary storage that stores and manages the secrets required by the application. An application is a specific software program configured for a specific entity. The same software program can be deployed as a first application configured for a first entity and a second application configured differently for a second entity. Multiple copies (instances) of the same application can be deployed in a cloud computing system. To gain access to secrets, the application (and all instances of the application) sends a request to the primary storage. This request identifies one or more requested secrets and includes an artifact authenticating the request. The primary storage determines whether the application is authorized to access one or more requested secrets based on the artifact and access controls applicable to the requested secrets. If the primary storage determines that the application is authorized to access the requested secrets, it provides the application with one or more requested secrets.

[0044] Providing applications with access to secrets using primary storage presents challenges. First, primary storage may be geographically distant from the application. For example, a cloud computing system may have computing resources (e.g., data centers) located in different locations around the world. Therefore, primary storage may be geographically far from the application. This distance introduces a delay between the time it takes for the application to send a request for the secret and the time it takes for the application to receive a response from primary storage. Second, primary storage can become overwhelmed by requests. When applications run in containerized environments, they can scale up or down rapidly. In other words, cloud computing systems can quickly increase or decrease the number of application instances, which can run across multiple clusters across the cloud computing system. For example, as demand for an application service increases, the cloud computing system replicates the application, creating multiple instances of the application. These multiple instances of the application can be distributed across multiple clusters. Each of these instances of the application can send requests for the secret to the same primary storage. Because the number of application instances can increase rapidly, the number of requests for the secret sent by the application instances may exceed the capacity of the primary storage.

[0045] The caching service provides low-latency, high-throughput access to secrets while maintaining isolation and granular access control between secrets in a multi-tenant environment. The caching service acts as a proxy, receiving requests for secrets, verifying and authenticating the requests, and providing access to the secrets. The caching service stores copies of secrets stored in one or more primary stores in a cache storage device that is closer to the requesting application than the distance from the one or more primary stores to the requesting application. Similarly, the location of the caching service is closer to the requesting application than the distance from the one or more primary stores to the requesting application.

[0046] The caching service receives a request from the container of the requesting application. This request may include an artifact and identify a specific requested secret. The caching service verifies the artifact and authenticates the request against the application's access controls to determine if the requesting application is authorized to access the specific requested secret. If the requesting application is authorized to access the specific requested secret, the caching service retrieves a copy of the specific requested secret from the cache storage and provides it to the requesting application. Because the caching service and cache storage are closer to the requesting application than the absolute storage is, the caching service reduces the latency of requesting secrets.

[0047] Caching services can operate as a cluster-level service or as a sidecar service. In either case, caching services offer higher throughput access to secrets than absolute storage.

[0048] When operating as a cluster-level service, each cluster in a cloud computing system can have a caching service. The caching service operating on the cluster receives requests from applications operating on the cluster. The caching service scales horizontally based on business needs. For example, as the rate of requests to the caching service increases, the caching service can scale to multiple instances. Each instance can operate in a separate container on the cluster. Multiple instances of the caching service can participate in peer-to-peer communication to ensure consistent responses to requests for the secret. Operating the caching service as a cluster-level service provides better manageability compared to operating it as a sidecar service.

[0049] When operating as a sidecar service, each application pod or container can include a caching service to receive requests from applications operating within the application pod or container. As demand for applications increases and cloud computing systems generate additional pods to accommodate additional instances of the application, each additional pod can include an additional instance of the caching service. Operating a caching service in a sidecar model can provide stronger security and isolation between secrets. For example, a caching service operating within an application pod can only access those secrets associated with the application running in the application pod, or only those secrets that the application running in the application pod is authorized to access.

[0050] The caching service described in this disclosure provides strong authentication and authorization implementation. The caching service includes access controls that restrict access to secrets. Access controls can restrict access to secrets to only certain entities. For example, access controls can allow access only to one or more specific tenants, one or more specific identities within a tenant, or one or more specific applications associated with a specific identity or tenant. Access controls can be role-based access controls. The caching service implements access controls.

[0051] The caching service includes different access controls for different individual secrets. For example, the caching service may include a first access control for a first secret and a second access control for a second secret, which is different from the first access control. As a result, a first entity may be allowed to access the first secret under the first access control, but may be denied access to the second secret under the second access control. In this way, the caching service can serve applications associated with multiple different entities and protect the secret of the first entity from access by the second entity. If necessary, the caching service can also protect the secret of the first application from the secret of the second application, even if the first application and the second application are associated with the same tenant or identity.

[0052] The caching service uses access control to determine whether an application is authorized to access a specific secret. The access control implemented by the caching service for a specific secret can be the same as the access control implemented by the main storage containing the specific secret. For example, suppose a first main storage contains a first secret, and based on a first set of access controls, a first application is authorized to access the first secret, but a second application is not authorized to access the first secret. Suppose the caching service receives a first request for the first secret from the first application. The caching service can determine, based on the first request and the first set of access controls, that the first application is authorized to access the first secret. As a result, the caching service can provide the first secret to the first application. Suppose the caching service receives a second request for the first secret from the second application. The caching service can determine, based on the second request and the first set of access controls, that the second application is not authorized to access the first secret. As a result, the caching service can reject the second request.

[0053] Caching services can aggregate secrets from multiple primary storage locations and provide isolation between them. Consider a cluster-level caching service operating on a cluster of cloud computing systems. Multiple applications associated with different entities can run on the cluster. These applications can include multiple instances of a single application, different applications associated with a single tenant, applications associated with multiple different tenants, and applications associated with different identities within a single tenant. Multiple applications on the cluster can utilize multiple primary storage locations to access secrets. The caching service can provide multiple applications on the cluster with access to copies of secrets stored on multiple primary storage locations.

[0054] The caching service stores secrets from multiple primary storages in a manner that is logically or physically isolated from each other. In this way, the caching service can isolate the secret of a first entity from the secret of a second entity and protect the secret of the first entity from being accessed by the second entity. Through isolation, the caching service can also provide access to individual secrets (and even individual versions of individual secrets) and implement access controls that can be applied to individual secrets (and individual versions of individual secrets).

[0055] For example, suppose a first primary storage contains a first secret for a first application of a first tenant, and a second primary storage contains a second secret for a second application of a second tenant, different from the first tenant. Assume the first application, the second application, and a caching service are running on a cluster. The caching service receives requests from both the first and second applications. The caching service may allow the first application to access the first secret but deny it access to the second secret. Similarly, the caching service may grant the second application access to the second secret but deny it access to the first secret.

[0056] As another example, suppose a first primary storage contains a tenant's first identity and a first secret, and a second primary storage contains a tenant's second identity and a second secret (the second identity is different from the first identity). Suppose a first set of access controls grants access to the first identity using the first secret, but not to the second identity using the first secret. Similarly, suppose a second set of access controls grants access to the second identity using the second secret, but not to the first identity using the second secret. Suppose a first application using the first identity, a second application using the second identity, and a caching service are running on the cluster. The caching service can grant the first application access to the first secret, but deny the first application access to the second secret. Similarly, the caching service can grant the second application access to the second secret, but deny the second application access to the first secret.

[0057] As another example, suppose a first primary storage contains a first secret for a tenant's first application, and a second primary storage contains a second secret for a tenant's second application (the second application is different from the first application). Suppose a first set of access controls grants the first application access to the first secret but not the second application. Similarly, suppose a second set of access controls grants the second application access to the second secret but not the first application. Suppose the first application, the second application, and a caching service are running on a cluster. The caching service can grant the first application access to the first secret but deny it access to the second secret. Similarly, the caching service can grant the second application access to the second secret but deny it access to the first secret.

[0058] The caching service stores a copy of the secret (which can come from multiple absolute storages and be associated with multiple entities) in a cache storage device. The cache storage device can be an in-memory storage device, an in-cluster storage device, or an out-of-cluster storage device. For an in-memory storage device, each caching service instance stores a copy of the secret in the volatile memory of the caching service container. During startup, instances of the caching service can "warm up" storage from one or more primary storages or from peer-to-peer cache storage devices. For an in-cluster storage device, the cache storage device is a typical in-cluster storage device. For example, the cache storage device could be an etcd database as a CRD (Custom Resource Definition) or within a cluster of Redis cache instances. In this case, all instances of the caching service share the cache storage device and perform warm-up and secret retrieval on this common, in-cluster cache storage device. For an out-of-cluster storage device, the cache storage device is located outside the cluster and within the cloud computing system. Warming operations can be performed from this location, and caching services running in multiple clusters in a queue can share the cache storage device.

[0059] A caching service can use two or more cache storage devices. For example, a caching service can use in-memory storage devices as the L1 cache layer and in-cluster or out-of-cluster storage devices as the L2 cache layer. The L1 cache layer can provide hot caching for extremely fast access, and the L2 can be used for warm-up or disaster recovery.

[0060] The caching service described in this disclosure reduces the latency of providing secrets, reduces the load on primary storage, provides faster scaling in response to secret demand, and offers better system reliability (e.g., containers can still scale by retrieving secrets from the caching service when primary storage fails). The caching service provides these benefits while maintaining isolation between secrets across multiple entities in a multi-tenant environment, as well as strong and granular authentication and authorization protection for individual secrets across multiple entities.

[0061] As used in this disclosure, a "container" refers to a virtual service or layer on a server node of a cloud computing system that provides access to computing resources (such as storage space) and / or software applications hosted by the cloud computing system. Containers provide an isolated environment for running applications on servers in a cloud computing system. Containers may include configuration files and libraries required for application execution, as well as dependencies. Applications or services, their dependencies, and their configurations can be packaged together as a container image. Containers provide a logical packaging mechanism in which applications can be abstracted from the environment in which they actually run. This decoupling allows container-based applications to be easily and consistently deployed, regardless of the target environment. Containers can serve any number of containerized applications on a cloud computing system.

[0062] A "service" can be a software function or a set of software functions (such as retrieving specified information or performing a set of operations). Services can be configured for different purposes. Services may include policies that should control their use (e.g., based on the identity of the entity requesting the service).

[0063] A "virtual machine" refers to an emulation of a computer system on a server node that provides the functionality of one or more applications on a cloud computing system. A virtual machine can provide the functionality required to execute one or more operating systems. Additionally, a virtual machine can utilize a hypervisor on the processor of a server device that supports hardware virtualization replication. While the one or more specific examples and implementations described herein may specifically relate to virtual machines, the features and functionalities described in conjunction with the utilization of resources on a server node can be similarly applied to other types of computing containers.

[0064] Figure 1 illustrates an example cloud computing system 100, in which a caching service operates as a cluster-level service. The cloud computing system 100 includes clusters 102a and 102b, absolute storage 110a, absolute storage 110b, absolute storage 110c, and memory 116.

[0065] A cloud computing system 100 comprises a large number of physical computing resources, including processing cores, storage space, and memory. These physical computing resources are organized according to specific structures. For example, physical computing resources can be organized into nodes (also called servers or blades). A group of nodes can form a rack. A group of racks can form a cluster. A data center can house multiple clusters. A cloud computing system may include multiple data centers located in different regions of the world.

[0066] These physical computing resources are used to host containers. Containers host applications. Applications perform workloads on behalf of one or more tenants. A tenant can be a customer of the cloud computing system. For example, a tenant can pay for the right to use the resources of cloud computing system 100. A tenant can be a group of users (or identities) sharing public access with specific privileges. However, users within a tenant can have different access privileges for secrets. Cloud computing system 100 hosts applications associated with multiple different tenants. Each tenant among multiple different tenants can have multiple different identities. Each application in a container can be dedicated to a single tenant or a single identity of a tenant.

[0067] Cloud computing system 100 scales up and down applications based on demand. For example, if demand for the first application of the first tenant increases, cloud computing system 100 creates one or more additional containers to host one or more additional instances of the first application. Each of the one or more additional instances of the first application can be associated with the first tenant.

[0068] Applications hosted on Cloud System 100 require access to secrets. Secrets include sensitive data such as API keys, SSH keys, private encryption keys, credentials, configuration files, tokens, passwords, or certificates. Cloud System 100 restricts access to secrets to protect the secrets of a tenant or identity from other tenants and identities. Cloud System 100 implements access controls on secrets to ensure that only tenants, identities, and applications authorized to access certain secrets can access them.

[0069] A secret includes one or more individual secrets and one or more versions of those individual secrets. These secrets can be associated with entities such as applications, services, users, or tenants. A secret can contain information specific to the entity associated with it.

[0070] Cloud computing system 100 includes access controls that restrict access to secrets. Access controls define who can view or use secrets. For example, suppose a first secret is associated with a first application of a first tenant. Access controls can restrict access to the first secret to the first application of the first tenant. Alternatively, access controls can restrict access to the first secret to the first tenant, including other applications of the first tenant. Access controls can include identification, authentication, certification, and authorization protocols. Access controls can enforce different access restrictions on individual secrets or individual versions of individual secrets contained within secrets. Access controls can be role-based access control (RBAC).

[0071] Cloud computing system 100 stores secrets on absolute storage, such as absolute storage 110a, 110b, and 110c. Absolute storage 110a, 110b, and 110c include systems or devices capable of storing and managing electronic information. Absolute storage 110a, 110b, and 110c include or have access to repositories for persistently storing and managing collections of electronic data. Each of absolute storage 110a, 110b, and 110c may include or have access to a defined set of physical computing resources. Each of absolute storage 110a, 110b, and 110c may run within a container. Each of absolute storage 110a, 110b, and 110c has a geographical location. Each of absolute storage 110a, 110b, and 110c may have a different geographical location. For example, absolute storage 110a may be located in North America, while absolute storage 110b may be located in Australia.

[0072] Each of the absolute storage devices 110a, 110b, and 110c is a separate system or device. Each of the absolute storage devices 110a, 110b, and 110c can be a physically separate system or device. For example, each of the absolute storage devices 110a, 110b, and 110c may include or have access to non-overlapping hardware. Each of the absolute storage devices 110a, 110b, and 110c can be a logically separate system or device. For example, each of the absolute storage devices 110a, 110b, and 110c can be managed independently or run within a separate container or virtual machine. Each of the absolute storage devices 110a, 110b, and 110c can only access data stored within it and cannot access data stored in different absolute storage devices. Each of the absolute storage devices 110a, 110b, and 110c can have a separate management system. The management system may include one or more programs that control the organization, storage, management, and retrieval of data stored on the data storage. Each of the absolute storage systems 110a, 110b, and 110c serves a single application (although it can serve multiple instances of a single application).

[0073] Absolute storage 110a includes memory 114a. Memory 114a stores electronic data. Memory 114a may be an addressable semiconductor memory. Memory 114a may include volatile memory or non-volatile memory. Memory 114a stores secret 112a. Absolute storage 110a controls access to memory 114a and secret 112a. Absolute storage 110a controls access to memory 114a and secret 112a based on access controls included in absolute storage 110a. Access controls restrict access to secret 112a. For example, access controls may restrict certain entities' access to secret 112a. Secret 112a is associated with a specific entity. For example, secret 112a may be associated with a specific entity, a specific identity, or a specific tenant.

[0074] Absolute storage 110b includes memory 114b. Memory 114b includes secret 112b. Secret 112b is associated with an entity different from the entity associated with secret 112a. Absolute storage 110b controls access to memory 114b and secret 112b. Absolute storage 110b controls access to memory 114b and secret 112b based on access controls included in absolute storage 110b. Access controls applicable to secret 112b are different from access controls applicable to secret 112a. In other words, restrictions on access to secret 112b are different from restrictions on access to secret 112a. For example, a request that can be granted based on access controls applicable to secret 112b may be denied based on access controls applicable to secret 112a. As another example, an entity authorized to access secret 112b under access controls applicable to secret 112b may not be authorized to access secret 112a under access controls applicable to secret 112a.

[0075] Absolute storage 110c includes memory 114c. Memory 114c includes secret 112c. Secret 112c is associated with an entity different from the entity associated with secret 112a and the entity associated with secret 112b. Secret 112c contains secrets specific to the entity associated with secret 112c. Absolute storage 110c controls access to memory 114c and secret 112c. Absolute storage 110c controls access to memory 114c and secret 112c based on access control. The access control applicable to secret 112c is different from the access control applicable to secret 112a and secret 112b.

[0076] Memory 114a may be physically different from memory 114b and memory 114c. Memory 114b may be physically different from memory 114a and memory 114c. Alternatively, memory 114a may be logically different from memory 114b and memory 114c, and memory 114b may be logically different from memory 114a and memory 114c. Absolute memory 110a may not be able to access memory 114b or memory 114c, absolute memory 110b may not be able to access memory 114a or memory 114c, and absolute memory 110c may not be able to access memory 114a or memory 114b.

[0077] Cluster 102a is a computer network. Cluster 102a may include one or more racks. Each rack in the one or more racks may include one or more servers. Each server in the one or more servers includes computing resources, such as processing cores, memory, storage resources, and network resources. Cluster 102a has a geographical location. The geographical location of cluster 102a may be different from the geographical location of absolute storage 110a, 110b, and 110c. For example, cluster 102a may be located in West Virginia, USA, while absolute storage 110b may be located in Australia.

[0078] Cluster 102a comprises multiple containers. For example, cluster 102a includes containers 104a, 104b, and 104c. Containers 104a, 104b, and 104c are isolated lightweight silos used to run applications and services. Containers 104a, 104b, and 104c are logically distinct from each other. Containers 104a, 104b, and 104c can be built on top of one or more operating system kernels. Containers 104a, 104b, and 104c can operate on one or more nodes in cluster 102a.

[0079] Container 104a includes service 106a. Service 106a is any software service, such as a workload or application. Service 106a may be associated with the first tenant or the first user of the first tenant. Service 106a requires an access secret to start and operate. For example, secret 112a may include a password or other sensitive information required for service 106a to start or operate.

[0080] When service 106a needs a secret, service 106a (or container 104a) can send a call to the absolute storage associated with service 106a. For example, suppose absolute storage 110a manages a specific secret that service 106a needs to access. Suppose the specific secret that service 106a needs to access is included in secret 112a. Service 106a can send a call to absolute storage 110a requesting access to the specific secret. Absolute storage 110a can verify and authenticate the call, and determine whether service 106a is authorized to access the specific secret based on access controls applicable to the specific secret requested by service 106a. In response to authenticating the call, absolute storage 110a can provide the specific secret to service 106a. Absolute storage 110a may be physically located away from service 106a. Due to the physical distance between absolute storage 110a and service 106a, there may be a delay between the time service 106a requests access to the specific secret and the time service 106a receives the specific secret from absolute storage 110a.

[0081] Container 104b includes service 106b. Service 106b may be associated with a second tenant or a second identity of the first tenant. The second tenant may be different from the first tenant. The second identity may be different from the first identity. Service 106b requires an access secret to start or operate. For example, secret 112b may include passwords or other sensitive information required for service 106b to start or operate. When service 106b needs a secret, service 106b (or container 104b) may send a call to the absolute storage associated with service 106b. For example, absolute storage 110b may be associated with service 106b and manage the secret of service 106b.

[0082] Container 104c includes service 106c. Service 106c may be associated with a third tenant or a third identity of the first tenant. The third tenant may be different from the first and second tenants. The third identity may be different from the first and second identities. Service 106c may require an access secret to start or operate. For example, secret 112c may include passwords or other sensitive information required for service 106c to start or operate. When service 106c needs a secret, service 106c (or container 104c) may send a call to the absolute storage associated with service 106c. For example, absolute storage 110c may be associated with service 106c and manage the secret of service 106c.

[0083] Cluster 102b includes containers 104d, 104e, 104f, and 104g. Containers 104d, 104e, 104f, and 104g operate on one or more nodes in cluster 102b.

[0084] Container 104d includes service 106d. Service 106d may be associated with the first tenant or the first identity. Service 106d is a second instance of service 106a. Service 106d may be a copy of service 106a, but in a separate container. Service 106d requires an access secret to start or operate. For example, secret 112a may include the password or other sensitive information required for service 106d to start or operate. To access secret 112a, service 106d may send a call to absolute storage 110a.

[0085] Container 104e includes service 106e. Service 106e may be associated with the first tenant or the first identity. Service 106e is a third instance of service 106a. Service 106e requires an access secret to start or operate. For example, secret 112a may include a password or other sensitive information required for service 106e to start or operate. To access secret 112a, service 106e may send a call to absolute storage 110a.

[0086] Container 104f includes service 106f. Service 106f may be associated with a second tenant or a second identity. Service 106f is a second instance of service 106b. Service 106f requires an access secret to start or operate. For example, secret 112b may include passwords or other sensitive information required for service 106f to start or operate. To access secret 112b, service 106f may send a call to absolute storage 110b.

[0087] Container 104g includes service 106g. Service 106g may be associated with a third tenant or a third identity. Service 106g is a second instance of service 106c. Service 106g requires an access secret to start or operate. For example, secret 112c may include the password or other sensitive information required for service 106g to start or operate. To access secret 112c, service 106g may send a call to absolute storage 110c.

[0088] In addition to services 106a, 106d, and 106e, cloud computing system 100 may also include additional instances of service 106a. For example, cloud computing system 100 may include hundreds of instances of service 106a. Instances of service 106a may be distributed across the globe. Each instance needs to access secret 112a. As a result, each instance of service 106a may send a call to absolute storage 110a each time it needs to access secret 112a. The volume of requests sent to absolute storage 110a may cause a delay in absolute storage 110a providing the requested secret. The volume of requests may also exceed the capacity of absolute storage 110a and cause absolute storage 110a to fail to respond to some requests.

[0089] To reduce the latency associated with the service receiving access to secrets and to increase the throughput of providing access to secrets, cluster 102a includes caching service 108a and cluster 102b includes caching service 108b.

[0090] Cache service 108a provides access to secrets to services 106a, 106b, and 106c. Cache service 108a can reside in a service container separate from containers 104a, 104b, and 104c. Services 106a, 106b, and 106c are closer to cache service 108a than to absolute storage 110a, 110b, and 110c.

[0091] Cache service 108a can access copies of the secrets that services 106a, 106b, and 106c need to access. For example, cache service 108a can access copies of secrets 112a, 112b, and 112c. Services 106a, 106b, and 106c are closer to copies of secrets 112a, 112b, and 112c than to the absolute storage 110a, 110b, and 110c. Cache service 108a stores copies or versions of individual secrets, which are logically or physically isolated. In this way, cache service 108a provides and controls access to individual secrets or individual versions of individual secrets. Cache service 108a can apply different access controls to different individual secrets.

[0092] Copies of secrets 112a, 112b, and 112c can be stored in storage 118a. Storage 118a resides within the service container where cache service 108a resides. Cache service 108a can access storage 118a to retrieve copies of secrets 112a, 112b, and 112c. Copies of secrets 112a, 112b, and 112c can also be stored in storage 120a. Storage 120a is a storage location within cluster 102a, but can reside outside the service container where cache service 108a resides. Cache service 108a can access storage 120a to retrieve copies of secrets 112a, 112b, and 112c. Copies of secrets 112a, 112b, and 112c can also be stored in storage 116. Storage 116 is a storage location within cloud computing system 100 but outside of cluster 102a. Cluster 102a can be closer to near storage 116 than to absolute storage 110a, 110b, and 110c. Cache service 108a can access storage 116 to retrieve copies of secrets 112a, 112b, and 112c.

[0093] Copies of secrets 112a, 112b, and 112c can be stored in two or more locations among memories 118a, 120a, and 116. For example, memory 118a can be used as a first-level cache layer (providing a hot cache for fast access), and memory 120a or memory 116 can be used as a second-level cache layer (for warm-up or disaster recovery).

[0094] Cache service 108a applies access control to copies of secrets 112a, 112b, and 112c. Cache service 108a can apply access control to copies of individual secrets and copies of individual versions of individual secrets. Cache service 108a can apply the same access control to copies of secret 112a as the absolute storage 110a applies to secret 112a. Cache service 108a can apply the same access control to copies of secret 112b as the absolute storage 110b applies to secret 112b. Cache service 108a can apply the same access control to copies of secret 112c as the absolute storage 110c applies to secret 112c.

[0095] Cache service 108a receives requests for access secrets from containers in cluster 102a in which it resides. For example, cache service 108a may receive requests for access secrets 112a, 112b, and 112c from containers 104a, 104b, and 104c. The request may identify one or more specific secrets and include artifacts for authentication. These artifacts may include information about the service making the request. Cache service 108a may determine whether to grant the request based on the one or more specific secrets identified in the request, the artifacts included in the request, and a set of access controls applicable to the one or more specific secrets. If cache service 108a grants the request, it provides one or more specific secrets to the requesting service. Cache service 108a may retrieve one or more specific secrets from memory 118a, memory 120a, or memory 116.

[0096] Access control in caching service 108a protects the secret of the first entity from access by the second entity. For example, suppose access control applicable to secret 112a allows service 106a to access secret 112a, but does not allow service 106b or service 106c to access secret 112a. Further suppose caching service 108a stores copies of secrets 112a, 112b, and 112c on memory 118a. Caching service 108a can, based on access control, allow requests from service 106a to access secret 112a, but deny requests from service 106b to access secret 112a.

[0097] Cache service 108b provides access to secrets to services 106d, 106e, 106f, and 106g. Cache service 108b can reside in a service container separate from containers 104d, 104e, 104f, and 104g. Services 106d, 106e, 106f, and 106g can be closer to cache service 108b than to absolute storage 110a, 110b, and 110c.

[0098] Cache service 108b can access copies of the secrets that services 106d, 106e, 106f, and 106g need to access. For example, cache service 108b can access copies of secrets 112a, 112b, and 112c. The distance from services 106d, 106e, 106f, and 106g to copies of secrets 112a, 112b, and 112c can be closer than the distance to absolute storage 110a, 110b, and 110c. Cache service 108b can store copies or versions of individual secrets with logical or physical isolation. In this way, cache service 108b can provide access to individual secrets or individual versions of individual secrets. Cache service 108b can apply different access controls to different individual secrets.

[0099] Copies of secrets 112a, 112b, and 112c can be stored in storage 118b. Storage 118b resides within the service container where cache service 108b resides. Copies of secrets 112a, 112b, and 112c can also be stored in storage 120b. Storage 120b is a storage location within cluster 102b, but can reside outside the service container where cache service 108b resides. Copies of secrets 112a, 112b, and 112c can also be stored in storage 116. Storage 116 is a storage location within cloud computing system 100 but outside of cluster 102b. Cluster 102b can be closer to storage 116 than to absolute storage 110a, 110b, and 110c.

[0100] Copies of secrets 112a, 112b, and 112c can be stored in two or more locations among memories 118b, 120b, and 116. For example, memory 118b can be used as a first-level cache layer (providing a hot cache for fast access), and memory 120b or memory 116 can be used as a second-level cache layer (for warm-up or disaster recovery).

[0101] Cache service 108b can store copies or versions of individual secrets with logical or physical isolation. Cache service 108b applies access control to copies of secrets 112a, 112b, and 112c. Cache service 108b can apply the same access control to a copy of secret 112a as the absolute storage 110a applies to secret 112a. Cache service 108b can apply the same access control to a copy of secret 112b as the absolute storage 110b applies to secret 112b. Cache service 108b can apply the same access control to a copy of secret 112c as the absolute storage 110c applies to secret 112c.

[0102] Cache service 108b receives a request to access a secret. Cache service 108b receives requests for access to secrets from containers in cluster 102b where it resides. For example, cache service 108b may receive requests for access to secrets 112a, 112b, and 112c from containers 104d, 104e, 104f, and 104g. The request may identify one or more specific secrets and include artifacts for authentication. These artifacts may include information about the requesting service. Cache service 108b may determine whether to grant the request based on the one or more specific secrets identified in the request, the artifacts included in the request, and a set of access controls applicable to the one or more specific secrets. If cache service 108b grants the request, it may provide one or more specific secrets to the requesting service. Cache service 108b may retrieve one or more specific secrets from memory 118b, memory 120b, or memory 116.

[0103] The access control of caching service 108b protects the secret of the first entity from being accessed by the second entity. For example, suppose the access control applicable to secret 112a allows services 106d and 106e to access secret 112a, but does not allow services 106f or 106g to access secret 112a. Further suppose caching service 108b stores copies of secrets 112a, 112b, and 112c on memory 118b. Based on access control, caching service 108b allows requests from services 106d and 106e to access secret 112a, but denies requests from service 106g to access secret 112a.

[0104] Figure 1BCluster 102c is shown, where a caching service operates as a cluster-level service and scales with increasing business volume. Cluster 102c includes container 104h and caching service 108c-1. Container 104h comprises multiple containers. Each container 104h holds an application or an instance of an application. Caching service 108c-1 provides access to secrets to container 104h. Cluster 102c increases or decreases the number of containers 104h based on the service demand of the application running in container 104h. As the service demand of the application grows, cluster 102c increases the number of containers 104h. As the number of containers 104h increases in cluster 102c, the demand for caching service 108c-1 increases. To meet this demand, cluster 102c increases the number of instances of caching service 108c-1. For example, cluster 102c replicates caching service 108c-1 to create caching service 108c-2. Caching service 108c-2 provides access to secrets to container 104h. Cache service 108c-2 runs in a first container, separate from the second container in which cache service 108c-1 runs. Cache service 108c-1 and cache service 108c-2 communicate to maintain consistency in response to requests. Although Figure 1B Two instances of the caching service are shown, but a cluster can include any number of caching service instances based on the demand for the caching service.

[0105] Figure 2 An example cloud computing system 200 is shown, in which the caching service operates in a sidecar model. The cloud computing system 200 includes absolute storage 210a, absolute storage 210b, cluster 202a, and cluster 202b.

[0106] Absolute storage 210a may have any of the properties or characteristics of absolute storage 110a. Absolute storage 210a includes secret 212a. Secret 212a may have any of the properties or characteristics of secret 112a.

[0107] Absolute storage 210b can have any of the properties or characteristics of absolute storage 110b. Absolute storage 210b includes secret 212b. Secret 212b can have any of the properties or characteristics of secret 112b.

[0108] Cluster 202a can have any of the characteristics or features of cluster 102a. Cluster 202a includes pods 222a and pod 222b. A pod is the smallest deployable computing unit that can be created and managed in a containerized computing environment. A pod can be a container. A pod can be a group of one or more containers. The pod can include specifications for how one or more containers run. One or more containers can share resources (such as storage and network resources) and dependencies. One or more containers can communicate with each other and coordinate when and how they terminate. The contents of a pod are co-located and co-scheduled on the same physical machine or virtual machine in the cluster. When a pod contains a single container, the pod can be a wrapper around that single container. When a pod contains two or more containers, those two or more containers can form a single cohesive unit of service. A pod can wrap two or more containers, storage resources, and ephemeral network identities together as a single unit. Each pod can be a single instance designed to run a given application. Horizontally scaling an application can result in additional pods for each additional instance of the application.

[0109] Pod 222a includes application 224a and caching service 226a. Application 224a can run in a container, and caching service 226a can run in a separate sidecar container. Application 224a and caching service 226a can coexist on the same physical machine or virtual machine. Application 224a needs to access secret 212a. Secret 212a is associated with application 224a. In the absence of caching service 226a, application 224a can request the secret from absolute storage 210a. Absolute storage 210a has a different physical location than cluster 202a. The distance between pod 222a and absolute storage 210a causes a delay between application 224a sending a call for the secret and application 224a receiving the secret from absolute storage 210a.

[0110] As demand for application 224a increases, cluster 202a generates additional instances of application 224a. To do this, cluster 202a generates additional pods, and each additional pod includes an additional instance of application 224a. Each additional pod may also include an additional instance of cache service 226a to serve the additional instances of application 224a running in the same additional pod.

[0111] Cache service 226a provides application 224a with reduced latency access to a copy of secret 212a. Cache service 226a stores the copy of secret 212a in storage within pod 222a, storage within cluster 202a, or storage outside cluster 202a that is closer to pod 222a than the distance from absolute storage 210a to pod 222a. Cache service 226a applies access control to the copy of secret 212a. Cache service 226a may apply the same access control to the copy of secret 212a as the access control applied by absolute storage 210a to secret 212a. Cache service 226a may not have permission to access secret 212b. Cache service 226a may choose not to provide access to secret 212b.

[0112] Application 224a sends a call to the secret to caching service 226a. Caching service 226a determines whether application 224a is authorized to access the secret based on the call and access control. If caching service 226a determines that application 224a is authorized to access the secret, it provides a copy of the secret to application 224a. If caching service 226a determines that application 224a is not authorized to access the secret, it rejects the call.

[0113] Pod 222b includes application 224b and caching service 226b. Application 224b can run in a container, and caching service 226b can run in a separate sidecar container. Application 224b and caching service 226b can coexist on the same physical machine or virtual machine. Application 224b needs to access secret 212b. Secret 212b is associated with application 224b. Application 224b is different from application 224a. Application 224b and application 224a can be associated with different tenants. In the absence of caching service 226b, application 224b can request the secret from absolute storage 210b. Absolute storage 210b has a different physical location than cluster 202a. The distance between pod 222b and absolute storage 210b causes a delay between application 224b sending a call to the secret and application 224b receiving the secret from absolute storage 210b.

[0114] Cache service 226b provides application 224b with reduced latency access to a copy of secret 212b. Cache service 226b stores the copy of secret 212b in memory within pod 222b, memory within cluster 202a, or external memory of cluster 202b that is closer to pod 222b than the distance from absolute storage 210b to pod 222b. Cache service 226b applies access control to the copy of secret 212b. Cache service 226b may apply the same access control to the copy of secret 212b as the access control applied by absolute storage 210b to secret 212b. Cache service 226b may not have permission to access secret 212a. Cache service 226b may choose not to provide access to secret 212a.

[0115] Application 224b sends a call to the secret to the caching service 226b. The caching service 226b determines whether application 224b is authorized to access the secret based on the call and access control. If the caching service 226b determines that application 224b is authorized to access the secret, it provides a copy of the secret to application 224b. If the caching service 226b determines that application 224b is not authorized to access the secret, it rejects the call.

[0116] Cluster 202b can have any of the characteristics or features of cluster 102b. Cluster 202b includes pod 222c and pod 222d.

[0117] Pod 222c includes application 224c and caching service 226c. Application 224c can run in a container, and caching service 226c can run in a separate sidecar container. Application 224c and caching service 226c can coexist on the same physical machine or virtual machine. Application 224c needs access to secret 212a. Application 224c is a second instance of application 224a. In the absence of caching service 226c, application 224c can request the secret from absolute storage 210a. Absolute storage 210a has a different physical location than cluster 202b. The distance between pod 222c and absolute storage 210a causes a delay between application 224c sending a call to the secret and application 224c receiving the secret from absolute storage 210a.

[0118] Cache service 226c provides application 224c with reduced latency access to a copy of secret 212a. Cache service 226c stores the copy of secret 212a in memory within pod 222c, memory within cluster 202b, or external memory on cluster 202b that is closer to pod 222c than the distance from absolute storage 210a to pod 222c. Cache service 226c applies access control to the copy of secret 212a. Cache service 226c may apply the same access control to the copy of secret 212a as the access control applied by absolute storage 210a to secret 212a. Cache service 226c may not have permission to access secret 212b. Cache service 226c may choose not to provide access to secret 212b.

[0119] Application 224c sends a call to the secret to caching service 226c. Caching service 226c determines whether application 224c is authorized to access the secret based on the call and access control. If caching service 226c determines that application 224c is authorized to access the secret, caching service 226c provides application 224c with a copy of the secret.

[0120] Pod 222d includes application 224d and caching service 226d. Application 224d can run in a container, and caching service 226d can run in a separate sidecar container. Application 224d and caching service 226d can coexist on the same physical machine or virtual machine. Application 224d needs to access secret 212a. Application 224d is a third instance of application 224a. In the absence of caching service 226d, application 224d can request secrets from absolute storage 210a.

[0121] Cache service 226d provides application 224d with reduced latency access to a copy of secret 212a. Cache service 226d stores the copy of secret 212a in storage within pod 222d, storage within cluster 202b, or external storage within cluster 202b that is closer to pod 222d than the distance from absolute storage 210a to pod 222d. Cache service 226d applies access control to the copy of secret 212a. Cache service 226d may apply the same access control to the copy of secret 212a as the access control applied by absolute storage 210a to secret 212a. Cache service 226d may not have permission to access secret 212b. Cache service 226d may choose not to provide access to secret 212b.

[0122] Application 224d sends a call to the secret to cache service 226d. Cache service 226d determines whether application 224d is authorized to access the secret based on the call and access control. If cache service 226d determines that application 224d is authorized to access the secret, cache service 226d provides application 224d with a copy of the secret.

[0123] Figure 3 Example cache service 340, call 338, and memory 318 are shown.

[0124] Call 338 is a request for one or more secrets from a service, application, or container (the entity making the request). The requesting entity may be associated with a specific tenant or a tenant-specific identity. The requesting entity sends call 338 to cache service 340. The requesting entity may authenticate cache service 340 before sending call 338 to cache service 340.

[0125] Call 338 includes artifact 348 and request 350. Request 350 identifies one or more specific secrets requested by the requesting entity. Artifact 348 includes one or more objects used to authenticate call 338. For example, artifact 348 may include one or more tokens, certificates, signatures, or credentials. The requesting entity may receive artifact 348 or one or more elements of artifact 348 from an identity provider of the cloud computing system. Artifact 348 may include one or more claims. Claims may include information about the requesting entity. For example, claims may identify the requesting entity, the tenant associated with the requesting entity, and / or the identity associated with the requesting entity.

[0126] The caching service 340 includes an authentication module 342, an acquisition module 344, and access control 352. The caching service 340 can access storage 318. Storage 318 can be container storage, cluster storage, or external storage.

[0127] Memory 318 includes one or more secrets. The one or more secrets stored in memory 318 are copies of one or more secrets stored in one or more absolute storage locations. These one or more secrets may be associated with one or more entities (e.g., one or more services or applications of a tenant, one or more identities of a tenant, or one or more tenants). Access to the one or more secrets stored in memory 318 is restricted. Authorization of access to the one or more secrets is based on access control 352.

[0128] Memory 318 stores one or more secrets in such a way that each individual secret (or even each individual version of each individual secret) can be accessed individually. Memory 318 stores one or more secrets in a way that cache service 340 can determine whether a requesting entity is authorized to access any particular individual secret (or even any particular individual version of the secret). Memory 318 stores one or more secrets in a way that cache service 340 can apply different access controls to each individual secret (or even each individual version of the secret).

[0129] Memory 318 includes storage blocks 346a, 346b, and 346c. Each storage block in storage blocks 346a, 346b, and 346c stores a separate secret or a version of a secret. For example, storage block 346a may store a first secret, storage block 346b may store a second secret, and storage block 346c may store a third secret. Cache service 340 may apply a first set of access controls within access control 352 to the first secret stored in storage block 346a, a second set of access controls within access control 352 to the second secret stored in storage block 346b, and a third set of access controls within access control 352 to the third secret stored in storage block 346c. The first set of access controls may be different from the second and third sets of access controls. The second set of access controls may be different from the third set of access controls. For example, one or more entities authorized to access the first secret under the first set of access controls may be different from one or more entities authorized to access the second secret under the second set of access controls.

[0130] The first, second, and third secrets can each be associated with the same entity or two or more different entities. For example, the first, second, and third secrets can all be associated with a single tenant and the same identity within that single tenant. Alternatively, the first, second, and third secrets can all be associated with a single tenant, but with different identities within that single tenant. Alternatively, the first, second, and third secrets can all be associated with a single tenant, but with different services within that single tenant. Alternatively, the first, second, and third secrets can be associated with different tenants.

[0131] Cache service 340 aggregates secrets from two or more absolute storage locations in memory 318. In other words, cache service 340 can store copies of secrets from two or more absolute storage locations in memory 318 and provide access to these copies. Cache service 340 can apply the same access control to the copies of secrets from the two or more absolute storage locations as the access control applied to the secrets by the two or more absolute storage locations.

[0132] The caching service 340 aggregates the secrets of two or more entities in the storage 318. For example, the caching service 340 may aggregate the secrets of two or more tenants, two or more identities of tenants, and / or two or more services of tenants in the storage 318.

[0133] Caching service 340 provides isolation for each entity. Caching service 340 stores secrets in memory 318 in such a way that it can distinguish secrets of different entities and control access to the secrets of different entities individually. Caching service 340 isolates the secret of one entity from the secret of a second entity. Isolating the first secret of the first entity from the second secret of the second entity can mean that caching service 340 can allow the first entity to access the first secret and deny the first entity access to the second secret. For example, caching service 340 can isolate the secret of a first tenant from the secret of a second tenant. In this case, caching service 340 can receive service calls from both the first tenant and the second tenant, allowing the first tenant to access its secret while denying the second tenant access to its secret. As another example, caching service 340 can isolate the secret of the first identity of a first tenant from the secret of the second identity of the first tenant. As yet another example, caching service 340 can isolate the secret of the first service of the first identity of a first tenant from the secret of the second service of the first identity of the first tenant.

[0134] The caching service 340 applies granular access control. The caching service 340 can apply different sets of access controls to different individual secrets. The caching service 340 can receive requests for individual secrets and can determine whether to grant or deny the request based on the access controls applicable to the individual secrets. For example, the caching service 340 can receive a first request from a first entity and a second request from the same first entity. The first request may seek access to a first secret, and the second request may seek access to a second secret. The caching service 340 can apply a first set of access controls to the first request based on the first request seeking access to the first secret, and apply a second set of access controls to the second request based on the second request seeking access to the second secret. The first set of access controls may authorize the first entity to access the first secret. The second set of access controls may deny the first entity to access the second secret. The caching service 340 may grant the first request based on the first set of access controls, but deny the second request based on the second set of access controls.

[0135] Memory 318 includes an expiration policy 336. Expiration policy 336 specifies the lifetime of memory 318. Each individually accessible portion of memory 318 may have a different lifetime. For example, memory block 346a may have a first lifetime, and memory block 346b may have a second lifetime different from the first lifetime. When the contents of memory 318 have expired (e.g., the amount of time since the contents of memory 318 were filled exceeds the lifetime of memory 318), expiration policy 336 may require caching service 340 to refill the contents of memory 318. For example, suppose a first secret stored in memory block 346a has a first lifetime. Suppose the first lifetime has expired. If caching service 340 receives a request for access to the first secret, expiration policy 336 may require caching service 340 to refill memory block 346a before providing access to the contents of memory block 346a. Caching service 340 may refill memory block 346a by retrieving information from absolute storage containing the first secret. Expiration policy 336, including the lifetime of memory 318, may be based on one or more security policies of one or more absolute storage. The memory 318 may include copies of the secret stored on one or more absolute memories.

[0136] The acquisition module 344 retrieves information for storage in memory 318. The acquisition module 344 can retrieve a copy of the secret from one or more absolute storage devices or from one or more L2 cache storage devices. The acquisition module 344 can retrieve information during the startup or warm-up of cache service 340 and memory 318. The acquisition module 344 can retrieve information when it has expired based on expiration policy 336.

[0137] Authentication module 342 authenticates requests for access to secrets. Authentication module 342 may receive call 338. Authentication module 342 determines whether the requesting entity identified in call 338 is authorized to access one or more specific secrets identified in request 350. Authentication module 342 determines whether the requesting entity is authorized to access one or more specific secrets based on artifact 348 and access control 352. Authentication module 342 verifies artifact 348. Authentication module 342 may issue a verification call to the cloud computing system to verify artifact 348. Authentication module 342 authenticates one or more claims in artifact 348 based on access control 352. If authentication module 342 cannot verify artifact 348 or authenticate one or more claims in artifact 348, authentication module 342 rejects the request. If authentication module 342 determines based on access control 352 that the requesting entity is not authorized to access one or more specific secrets, authentication module 342 rejects the request. Access control 352 may include one or more sets of access controls. Different sets of access controls may be applied to each individual secret stored in memory 318.

[0138] Figure 4 An exemplary cache memory 428 is shown.

[0139] Cache memory 428 stores copies of information that are stored in separate storage. For example, cache memory 428 may store a copy of a secret stored in absolute storage, which has a different location from cache memory 428 and is physically and logically different from the absolute storage.

[0140] Cache memory 428 stores copies of secrets, enabling isolation between individual secrets and allowing access control at the granularity applied to individual secrets. Cache memory 428 stores copies of secrets such that a first version of a first secret can be isolated from a second version of the first secret; the first secret can be isolated from the second secret; the first secret associated with a first application can be isolated from the second secret of a second application (even if both the first and second applications are associated with the same tenant or the same identity of the tenant); the first secret associated with a first tenant can be isolated from the second secret of a second tenant; and the first secret of a first user can be isolated from the second secret of a second user (even if both the first and second users are associated with the same tenant). The first secret can be isolated from the second secret when it can be accessed separately from the second secret. The first secret can be isolated from the second secret when access to the first secret can be controlled independently of access to the second secret. The first secret can be isolated from the second secret when the caching service can apply a different set of access controls to the first secret than the set applied to the second secret.

[0141] One way to organize cache memory 428 to provide isolation and granular access control is through namespaces. Namespaces can uniquely identify entities such as applications or services, sets of applications or services, tenants, groups of tenants, users, or groups of users. Namespaces can allow cache memory 428 to isolate information associated with a first entity and information associated with a second entity. For example, namespaces can allow cache memory 428 to isolate information associated with a first tenant and information associated with a second tenant; information associated with a first application of the first tenant and information associated with a second application of the first tenant; information associated with a first application of the first tenant and information associated with a second application of the first tenant; and information associated with a first user of the tenant and information associated with a second user of the tenant.

[0142] As an example, cache memory 428 includes information associated with namespaces 430a and 430b. Namespaces 430a and 430b may be associated with the same tenant. Alternatively, namespaces 430a and 430b may be associated with different tenants.

[0143] Namespace 430a includes secrets 432a and 432b. Both secrets 432a and 432b can be associated with namespace 430a. For example, namespace 430a can be a specific application of the first tenant, and secrets 432a and 432b can both be associated with that specific application. As another example, namespace 430a can be a specific identity of the first tenant, and secrets 432a and 432b can both be associated with that specific identity. Secret 432a can include versions 434a-1 and 434a-2. Versions 434a-1 and 434a-2 can be different versions of secret 432a. Cache memory 428 can allow each of versions 434a-1 and 434a-2 to be accessed individually. Cache memory 428 can allow different access controls for each application in versions 434a-1 and 434a-2. Cache memory 428 may include information identifying which of versions 434a-1 and 434a-2 is the current version of secret 432a. Secret 432b may include version 434b.

[0144] Namespace 430b includes secrets 432c and 432d. Namespace 430b can be different from namespace 430a. For example, namespace 430a can be a first application, while namespace 430b can be a second application different from the first application. As another example, namespace 430a can be a first application associated with a first identity of a first tenant, and namespace 430b can be a first application but associated with a second identity of the first tenant. Secret 432c can include versions 434c-1 and 434c-2. Secrets 432c and 432d can be associated with namespace 430b. Secret 432d can include version 434d.

[0145] Figure 5 A method 500 for providing low-latency access to secrets in a multi-tenant cloud computing system is shown.

[0146] Method 500 includes receiving 502 a first invocation of a first secret from a first application. A first absolute storage contains the first secret and implements a first set of access controls on the first secret. The first application runs on a first cluster of a cloud computing system.

[0147] The first call identifies the first application and contains information about it. The first call includes a first artifact. The first application runs within a first container. The caching service receives the first call to the first secret. The caching service can run within a service container separate from the first container.

[0148] Method 500 includes receiving a second call to the second secret from a second application (504). A second absolute storage, separate from the first absolute storage, contains the second secret and implements a second set of access controls on the second secret. A first set of access controls authorizes the first application to access the first secret but not the second application. A second set of access controls authorizes the second application to access the second secret but not the first application. The second application runs on a first cluster. The first and second absolute storages are located outside the first cluster in the cloud computing system.

[0149] The second call identifies the second application and contains information about it. The second call includes a second artifact. The second application can run within a second container, separate from the first container. The caching service receives the second call.

[0150] The first application can be associated with the first tenant, and the second application can be associated with a second tenant who is different from the first tenant. Alternatively, the first application can be associated with the first tenant's first identity, and the second application can be associated with the first tenant's second identity. Alternatively, both the first and second applications can be associated with the same tenant or the same identity.

[0151] Method 500 includes authenticating the 506 first call within the first cluster based on a first set of access controls. Authentication of the 506 first call can be further based on verifying the first artifact. The caching service authenticates the first call.

[0152] Method 500 includes authenticating the 508 second call within the first cluster based on a second set of access controls. Authentication of the 508 second call can be further based on verifying a second artifact. The caching service authenticates the second call.

[0153] Method 500 includes retrieving 510 a first secret from a cache storage device in response to an authentication first call. The first application is closer to the cache storage device than to a first absolute storage device. The cache storage device contains a copy of the first secret. The cache service retrieves the first secret.

[0154] Method 500 includes retrieving a second secret from a cache storage device in response to a second authentication call. The second application is closer to the cache storage device than to the second absolute storage. The cache storage device contains a copy of the second secret. The cache service retrieves the second secret. The cache storage device may reside in the container's memory. Alternatively, the cache storage device may reside in the memory of a first cluster. Alternatively, the cache storage device may reside outside the first cluster. The cache storage device may include a cache expiration policy for determining when entries in the cache storage device expire. The cache expiration policy may be based on a first set of access controls and a second set of access controls.

[0155] Method 500 includes providing a first secret (514) to a first application. The caching service provides the first secret.

[0156] Method 500 includes providing a second secret (516) to a second application. The caching service provides the second secret.

[0157] Figure 6 A method 600 for caching secrets from multiple entities is shown.

[0158] Method 600 includes storing a copy of the first secret 602 in a cache storage device. The cache storage device is part of a cloud computing system, the first secret is also stored at a first location different from the cache storage device, and a first set of access controls authorizes a first entity to access the first secret but not authorizes a second entity to access the first secret. The caching service stores a copy of the first secret in the cache storage device.

[0159] Method 600 includes storing a copy of the second secret 604 in a cache storage device. The second secret is different from the first secret, and the second secret is also stored in a second location different from the cache storage device, and a second set of access controls authorizes a second entity to access the second secret but not authorizes the first entity to access the second secret.

[0160] Method 600 includes receiving 606 a first call to a first secret. A caching service receives the first call within a first cluster of a cloud computing system. A first service associated with a first entity sends the first call. The first service runs in a first container within the first cluster. The first container is closer to the cache storage device than to a first location. The cache storage device may be located within the first cluster. The caching service may run within a service container within the first cluster. The cache storage device may be located within a service container.

[0161] Method 600 includes determining 608 that the first service is authorized to access the first secret. Determining 608 that the first service is authorized to access the first secret is based on a first call and a first set of access controls. The caching service determines that the first service is authorized to access the first secret.

[0162] Method 600 includes receiving a second call to the second secret 610. The caching service receives the second call within the first cluster. The caching service receives the second call from a second service associated with the second entity. The second service runs in a second container within the first cluster. The first container is closer to the cache storage device than to the second location.

[0163] Method 600 includes determining 612 that the second service is authorized to access the second secret. This determination is based on a second call and a second set of access controls. The caching service determines that the second service is authorized to access the second secret.

[0164] Method 600 includes retrieving 614 of a first secret from a cache storage device. Retrieving 614 of the first secret from the cache storage device is based on determining that a first service is authorized to access the first secret. The cache service retrieves the first secret.

[0165] Method 600 includes retrieving 616 a second secret from a cache storage device. Retrieving 616 the second secret from the cache storage device is based on determining that a second service is authorized to access the second secret. The cache service retrieves the second secret.

[0166] Method 600 includes providing a first secret (618) to the first service. The caching service provides the first secret to the first service.

[0167] Method 600 includes providing a second secret to a second service. The caching service provides the second secret to the second service.

[0168] Method 600 includes receiving a third call to the first secret from a second service (622). The caching service receives the third call.

[0169] Method 600 includes determining that 624, the second service, is not authorized to access the first secret. This determination is based on a third call and a first set of access controls. The caching service also determines that the second service is not authorized to access the first secret.

[0170] Method 600 includes rejecting 626 third-party calls. The caching service rejects third-party calls.

[0171] Now for reference Figure 7 One or more computing devices 700 can be used to implement at least some aspects of the techniques disclosed herein. Figure 7 Some components that may be included within the computing device 700 are shown.

[0172] Computing device 700 includes a processor 701 and a memory 703 in electronic communication with the processor 701. Instructions 705 and data 707 may be stored in the memory 703. Instructions 705 may be executed by the processor 701 to implement some or all of the methods, steps, operations, actions, or other functions disclosed herein. Executing instructions 705 may involve using data 707 stored in the memory 703. Unless otherwise stated, any of the various examples of modules and components described herein may be implemented in whole or in part as instructions 705 stored in the memory 703 and executed by the processor 701. Any of the various examples of data described herein may reside in data 707 stored in the memory 703 and used by the processor 701 during the execution of instructions 705.

[0173] although Figure 7 The computing device 700 shows only a single processor 701, but in alternative configurations, a combination of processors (e.g., an advanced RISC (Reduced Instruction Set Computer) machine (ARM) and a digital signal processor (DSP)) can be used.

[0174] The computing device 700 may also include one or more communication interfaces 709 for communicating with other electronic devices. The communication interface 709 may be based on wired communication technology, wireless communication technology, or both. Some examples of the communication interface 709 include Universal Serial Bus (USB), Ethernet adapters, and wireless adapters operating according to the Institute of Electrical and Electronics Engineers (IEEE) 802.11 wireless communication protocol. Wireless communication adapter and infrared (IR) communication port.

[0175] The computing device 700 may also include one or more input devices 711 and one or more output devices 713. Some examples of input devices 711 include a keyboard, mouse, microphone, remote control device, button, joystick, trackball, touchpad, and light pen. A particular type of output device 713 typically included in the computing device 700 is a display device 715. The display device 715 used with the embodiments disclosed herein can utilize any suitable image projection technology, such as a liquid crystal display (LCD), a light-emitting diode (LED), gas plasma, electroluminescence, wearable display, etc. A display controller 717 may also be provided for converting data 707 stored in memory 703 into text, graphics, and / or moving images (as applicable) displayed on the display device 715. The computing device 700 may also include other types of output devices 713, such as speakers, printers, etc.

[0176] The various components of the computing device 700 can be coupled together via one or more buses, which may include power buses, control signal buses, status signal buses, data buses, etc. For clarity, the various buses are... Figure 7 It is shown as bus system 719.

[0177] The techniques disclosed herein can be implemented in hardware, software, firmware, or any combination thereof, unless specifically described as being implemented in a particular manner. Any features described as modules, components, etc., can also be implemented together in an integrated logic device or separately as discrete but interoperable logic devices. If implemented in software, these techniques can be implemented at least in part through a non-transitory computer-readable medium having computer-executable instructions stored thereon, which, when executed by at least one processor, perform some or all of the steps, operations, actions, or other functions disclosed herein. The instructions can be organized into routines, programs, objects, components, data structures, etc., which can perform specific tasks and / or implement specific data types, and can be combined or distributed as needed in various embodiments.

[0178] The term "processor" can refer to a general-purpose single-chip or multi-chip microprocessor (e.g., an advanced RISC (Reduced Instruction Set Computer) machine (ARM)), a special-purpose microprocessor (e.g., a digital signal processor (DSP)), a microcontroller, a programmable gate array, etc. A processor can be a central processing unit (CPU). In some embodiments, a combination of processors (e.g., ARM and DSP) can be used to implement some or all of the techniques disclosed herein.

[0179] The term "memory" can refer to any electronic component capable of storing electronic information. For example, memory can be implemented as random access memory (RAM), read-only memory (ROM), disk storage media, optical storage media, flash memory devices in RAM, various types of storage-class memory, onboard memory included in a processor, erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, and combinations thereof.

[0180] The steps, operations, and / or actions of the methods described herein may be interchanged without departing from the scope of the claims. In other words, unless the proper operation of the described method requires a specific order of steps, operations, and / or actions, the order and / or use of specific steps, operations, and / or actions may be modified without departing from the scope of the claims.

[0181] The term "determine" (and its grammatical variations) can encompass a wide range of actions. For example, "determine" can include calculation, operation, processing, deduction, investigation, searching (e.g., looking in a table, database, or other data structure), ascertaining, etc. Furthermore, "determine" can include receiving (e.g., receiving information), accessing (e.g., accessing data in memory), etc. Additionally, "determine" can include solving, selecting, choosing, establishing, etc.

[0182] The terms “comprising,” “including,” and “having” are intended to be included and mean that additional elements may exist in addition to those listed. Furthermore, it should be understood that references to “one embodiment” or “embodiment” in this disclosure are not intended to be construed as excluding the existence of additional embodiments that also incorporate the listed features. For example, where compatible, any element or feature described with respect to embodiments herein may be combined with any element or feature of any other embodiment described herein.

[0183] This disclosure may be implemented in other specific forms without departing from its spirit or characteristics. The described embodiments should be considered illustrative rather than restrictive. Therefore, the scope of this disclosure is indicated by the appended claims rather than the foregoing description. Changes falling within the meaning and scope of equivalents of the claims will be included within its scope.

Claims

1. A cloud computing system, the cloud computing system comprising: A first absolute storage contains a first secret associated with a first service, wherein the first absolute storage implements a first set of access controls on the first secret, and wherein the first set of access controls authorizes the first service to access the first secret; A second absolute storage contains a second secret associated with a second service, wherein the second absolute storage implements a second set of access controls on the second secret, wherein the second absolute storage is separate from the first absolute storage, and wherein the second set of access controls authorizes the second service to access the second secret but does not authorize the first service to access the second secret; A cache storage device comprising a copy of the first secret and a copy of the second secret; and A first cluster of two or more servers, the first cluster comprising: A first container includes the first service, wherein the first container is an isolated environment in the first cluster for running the first service; A second container, comprising the second service, wherein the second container is an isolated environment within the first cluster for running the second service; and A caching service, wherein the caching service includes instructions stored in memory, the instructions, when executed by one or more processors, causing the caching service to: Receive a first invocation of the first secret from the first service; Receive a second call to the second secret from the second service; The first call is authenticated based on the first set of access controls; The second call is authenticated based on the second set of access controls; In response to authenticating the first call, the first secret is retrieved from the cache storage device, wherein the distance from the first container to the cache storage device is shorter than the distance to the first absolute storage; and In response to authenticating the second call, the second secret is retrieved from the cache storage device, wherein the second container is closer to the cache storage device than to the second absolute storage.

2. The system according to claim 1, wherein, The first cluster includes the cache storage device.

3. The system according to claim 1 or 2, wherein, The first service is associated with a first tenant, and the second service is associated with a second tenant that is different from the first tenant.

4. The system according to claim 1 or 2, wherein, The first service and the second service are associated with the same tenant.

5. The system according to claim 1 or 2, wherein, The caching service further includes a cache expiration policy, wherein the cache expiration policy determines when an entry in the cache storage device expires, and wherein the cache expiration policy is based on the first set of access controls and the second set of access controls.

6. The system according to claim 1 or 2, wherein, The first cluster further includes a third container, which includes a second instance of the first service, and wherein instructions stored in memory, when executed by the one or more processors, further cause the caching service to: Receive a third call to the first secret from the second instance of the first service; Authenticate the third call based on the first set of access controls; and In response to the authentication of the third call, the first secret is retrieved from the cache storage device.

7. The system according to claim 6, wherein, The cloud computing system also includes a second instance of the caching service, and the caching service and the second instance of the caching service participate in peer-to-peer communication.

8. The system according to claim 1 or 2, further comprising: A second cache storage device, the second cache storage device containing a copy of the first secret; The second cluster includes: A fourth container, comprising a third instance of the first service; and A second cache service, comprising instructions stored in memory, which, when executed by one or more processors, cause the second cache service to: Receive a fourth invocation of the first secret from the third instance of the first service; The fourth call is authenticated based on the first set of access controls; and In response to the authentication of the fourth call, the first secret is retrieved from the second cache storage device, wherein the fourth container is closer to the second cache storage device than to the first absolute storage.

9. The system according to claim 1 or 2, wherein, Instructions stored in the memory further enable the cache service when executed by the one or more processors: Receive a fifth call to the first secret from the second service; Based on the fifth invocation and the first set of access controls, it is determined that the second service is not authorized to access the first secret; as well as The fifth invocation of the first secret is rejected.

10. A cloud computing system, the cloud computing system comprising: A first absolute storage contains a first secret, wherein the first absolute storage implements a first set of access controls on the first secret, and the first set of access controls authorizes a first service to access the first secret; A first cluster consisting of two or more nodes having a first geographical location, the first cluster comprising: A first cache storage device containing a copy of the first secret; and The first container includes: The first instance of the first service; and A first cache service, wherein the first cache service includes a first instruction stored in memory, the first instruction, when executed by one or more processors, causes the first cache service to: Receive a first invocation of the first secret from the first instance of the first service; The first call is authenticated based on the first set of access controls; and In response to the authentication call to the first call, the first secret is retrieved from the first cache storage device, wherein the distance from the first container to the first cache storage device is shorter than the distance to the first absolute storage; and A second cluster having two or more nodes in a second geographical location different from the first geographical location, the second cluster comprising: A second cache storage device containing a copy of the first secret; and The second container includes: A second instance of the first service; and The second cache service includes a second instruction stored in memory, which, when executed by one or more processors, causes the second cache service to: Receive a second invocation of the first secret from the second instance of the first service; The second call is authenticated based on the first set of access controls; and In response to authenticating the second call, the first secret is retrieved from the second cache storage device, wherein the second container is closer to the second cache storage device than to the first absolute storage.

11. The system of claim 10, further comprising: A second absolute storage containing a second secret, wherein the second absolute storage implements a second set of access controls on the second secret, wherein the second absolute storage is separate from the first absolute storage, and wherein the second set of access controls authorizes a second service to access the second secret but does not authorize the first service to access the second secret. The second cache storage device further includes a copy of the second secret, and The second cluster further includes a third container, which includes: The first instance of the second service; A third cache service, wherein the third cache service includes a third instruction stored in memory, the third instruction, when executed by one or more processors, causes the third cache service to: Receive a third call to the second secret from the first instance of the second service; The third call is authenticated based on the second set of access controls; and In response to the authentication of the third call, the second secret is retrieved from the second cache storage device.

12. The system according to any one of claims 10 or 11, wherein, The first secret includes one or more passwords.

13. A computer-readable medium comprising instructions executable by one or more processors to cause a computing system to perform the following operations: A copy of the first secret is stored in a cache storage device, wherein, The cache storage device is part of the cloud computing system, the first secret is also stored in a first location different from the cache storage device, and a first set of access controls authorizes a first entity to access the first secret but does not authorize a second entity to access the first secret; A copy of the second secret is stored in the cache storage device, wherein the second secret is different from the first secret, the second secret is also stored in a second location different from the cache storage device, and a second set of access controls authorizes the second entity to access the second secret, but does not authorize the first entity to access the second secret; Within the first cluster of the cloud computing system, a first call to the first secret is received from a first service associated with the first entity, wherein the first service runs in a first container in the first cluster, and the first container is closer to the cache storage device than to the first location; Based on the first call and the first set of access controls, it is determined that the first service is authorized to access the first secret; Within the first cluster, a second call to the second secret is received from a second service associated with the second entity, wherein the second service runs in a second container in the first cluster, and the second container is closer to the cache storage device than to the second location; Based on the second call and the second set of access controls, it is determined that the second service is authorized to access the second secret; Based on the determination that the first service is authorized to access the first secret, the first secret is retrieved from the cache storage device; Based on the determination that the second service is authorized to access the second secret, the second secret is retrieved from the cache storage device; Provide the first secret to the first service; and Provide the second secret to the second service.

14. The computer-readable medium of claim 13, further comprising instructions executable by the one or more processors to cause the computing system to perform the following operations: A third call to the first secret is received from a second instance of the first service, wherein, The second instance of the first service runs in a third container within the first cluster; Based on the third call and the first set of access controls, it is determined that the second instance of the first service is authorized to access the first secret; as well as The first secret is provided to the second instance of the first service.

15. The computer-readable medium according to any one of claims 13 and 14, further comprising instructions executable by the one or more processors to cause the computing system to perform the following operations: Receive a fourth call to the first secret from the second service; Based on the fourth call and the first set of access controls, it is determined that the second service is not authorized to access the first secret; as well as The fourth call is rejected.

Images