Method and system for automatic deployment of computing infrastructure

Abstract

The present technology relates to a computer-implemented method for automatically deploying at least one computing infrastructure, the computing infrastructure comprising at least one unprovisioned server and at least one switch. The method includes accessing a computer readable medium, the computer readable medium including instructions that, when operated by a processor, cause execution of: a server management module and a key management module; wherein, during each startup of the at least one server, the server management module compares a set of the at least one signature with the signatures stored in the signature file, and on the basis of the comparison result, if all the signatures in the set are listed in the signature file, the server management module verifies the loading of the operating system, such that only the fully signed operating system is loaded during startup of the at least one server.

Description

[0001] Cross-references to related applications

[0002] This application claims priority to European patent application EP 24305690.0, filed on April 30, 2024, and European patent application EP 24306413.6, filed on August 29, 2024, the entire contents of which are incorporated herein by reference. Technical Field

[0003] This technology relates to the technical field of data center management and automation, and in particular to a method for deploying and managing resources of computing infrastructure in large data centers. Background Technology

[0004] Data centers have become critical for businesses and organizations to store, process, and manage massive amounts of digital information. The volume of digital information requiring processing and management has grown to such an extent that, in some cases, data centers may lease their computing equipment / infrastructure to other organizations and facilities that require additional storage and processing resources. However, these leasing arrangements can present certain challenges in terms of operational management and remote control software. Therefore, traditional methods for configuring, deploying, managing, and protecting computing infrastructure can pose challenges to such off-site implementations.

[0005] For example, traditional methods of deploying and managing data centers involve manually configuring network devices and server settings, which can lead to errors, inconsistencies, and extended downtime. Cisco offers a proprietary solution called the Cisco Application Policy Infrastructure Controller (APIC), designed to manage network infrastructure without manually provisioning new devices. However, this system requires three controllers to be deployed, making it unsuitable for initial deployments with limited resources. Additionally, this solution does not support LLDP discovery for bare metal servers and lacks some functionality compared to other traditional manual solutions. OpenStack Ironic is another open-source software that provides primitives and a complete lifecycle for managing bare metal servers. However, it requires the infrastructure (servers, network) to exist before deployment, making it less suitable for initial deployments.

[0006] Other open-source software also lacks the ability to deploy and integrate network infrastructure during initial setup. Microsoft Azure Stack is a software solution that requires deployment by a third party on manually provisioned infrastructure, including servers, storage devices, and networks. Google's on-premises solution takes the same approach. Broadcom / VMware offers a hypervisor with modules but lacks infrastructure management capabilities. This is especially true for off-site deployed infrastructure.

[0007] Therefore, the purpose of this technology is to overcome these limitations, at least in part. Summary of the Invention

[0008] This technology has been designed to overcome at least some of the shortcomings of existing technical solutions.

[0009] According to one aspect, this technology relates to a computer-implemented method for automating the deployment of computing infrastructure. The infrastructure includes at least one unconfigured server and one switch. The method involves accessing instructions from a computer-readable medium that, when executed by a processor, initiate software components. These components include at least a Configuration Management Database (CMDB) module, a deployment module, a communication module, a configuration module, a Network Operations Gateway (NOG) module, a Domain Name System (DNS) module, a server management module (Ironic), and a key management module (Barbican). The CMDB module manages and stores inventory data for the server and switch. The deployment module is responsible for deploying the computing infrastructure. The communication module facilitates communication between the CMDB module and the deployment module and manages at least one Dynamic Host Configuration Protocol (DHCP) interface module. The configuration module initializes the CMDB module using information about the switch and its configuration. The NOG module boots the switch by receiving configuration from the CMDB module and applying it to the switch. The DNS module manages Domain Name System services within the computing infrastructure. The configuration module calculates data for initializing the CMDB module, including at least one IP address of the switch. This data is used to initialize the CMDB module and configure other components.

[0010] According to one aspect, a computer-implemented method, preferably a computer-implemented method for automatically deploying at least one computing infrastructure, the computing infrastructure including at least one unconfigured server and at least one switch, the method comprising:

[0011] ● Access to a computer-readable medium, the computer-readable medium including instructions that, when operated by a processor, cause a software component to be executed, the software component including:

[0012] ○ Server management module, and

[0013] ○ Key management module;

[0014] ● In each startup of at least one server, the server management module compares at least one set of signatures with the signatures stored in the signature file of the key management module, each signature in the at least one set of signatures being associated with a component to be loaded to start the operating system, and based on the comparison result, the server management module verifies the loading of the operating system only if all signatures in the set are listed in the signature file of the key management module, so that only the fully signed operating system is loaded during the startup of at least one server.

[0015] According to one aspect, the present technology relates to a computer-implemented method for automatically deploying at least one computing infrastructure, the computing infrastructure including at least one unprovisioned server and at least one switch, the method comprising:

[0016] ● Access to a computer-readable medium, the computer-readable medium including instructions that, when operated by a processor, cause a software component to be executed, the software component including:

[0017] ○ Configuration Management Database (CMDB) module, which is configured to manage and store inventory data related to at least one unconfigured server and at least one switch;

[0018] ○ Deployment module, which is configured to deploy computing infrastructure;

[0019] ○ Communication module, which is configured as follows:

[0020] ■ Allows communication between the CMDB module and the deployment module; and

[0021] ■ Manage at least one Dynamic Host Configuration Protocol (DHCP) interface module;

[0022] ○ Configuration module, which is configured to initialize the CMDB module using information related to at least one switch and the configuration of at least one switch;

[0023] ○ Network Operation Gateway (NOG) module, which is configured to boot at least one switch by receiving configuration data from the CMDB module and applying the received configuration to at least one switch;

[0024] ○ Domain Name System (DNS) module, which is configured to manage the Domain Name System service in the computing infrastructure;

[0025] ● Calculate the data used to initialize the CMDB module. The calculated data includes at least one Internet Protocol (IP) address of at least one switch.

[0026] ● Initialize at least a portion of the software components via the configuration module through the following operations:

[0027] ○ Use the calculated data to initialize the CMDB module;

[0028] Use the configuration from the CMDB module to configure the DNS module;

[0029] ● Use the CMDB module to determine the configuration for the following:

[0030] ○ A communication module on at least one Intelligent Platform Management Interface (IPMI) and at least one management network; and

[0031] ○ At least one switch, the at least one switch being configured to allow it to perform pre-provisioning based on data calculated from the CMDB module;

[0032] ● Utilize provisioning data from the CMDB module to provision at least one network stack. This provisioning data includes information related to network devices, interfaces, networks, and configurations determined by the CMDB module. The provisioning includes:

[0033] ○ Pre-configure the DNS module;

[0034] Pre-configure the NOG module;

[0035] ● Declare at least one network in the deployment module;

[0036] ● Synchronize the deployment module with the CMDB module so that the deployment module can use the communication module to initiate the server discovery process; and

[0037] ●Start at least one unconfigured server discovered by the deployment module.

[0038] During each startup of at least one server, the server management module compares at least one set of signatures with signatures stored in the signature file of the key management module, each signature in the at least one set of signatures being associated with a component to be loaded to start the operating system, and based on the comparison result, the server management module verifies the loading of the operating system only if all signatures in the set are listed in the signature file of the key management module, so that only the fully signed operating system is loaded during the startup of at least one server.

[0039] In some respects, the first signature in the set of signatures to be compared is associated with the bootloader. If the first signature has been verified, the second signature to be compared is associated with the operating system kernel. If the second signature has been verified, at least one subsequent signature is associated with any module loaded by the kernel.

[0040] Preferably, the method includes a preliminary step of integrating the server's motherboard API into the server management module.

[0041] In this implementation, the CMDB module is responsible for managing and storing inventory data related to unprovisioned servers and switches. It plays a role in automated deployment by providing the information needed to configure and provision the infrastructure. One of the technical advantages of this technology is its minimal footprint, as it centrally manages configuration data, thereby reducing the need for manual intervention and potential errors.

[0042] In this implementation, the deployment module is responsible for deploying the computing infrastructure. It interacts with the CMDB module to obtain necessary information and pre-provisions the network stack, which includes the DNS module, NOG module, and other components. The technical advantage of this feature is that it automates the deployment process, thereby reducing the time and effort required for manual configuration and provisioning.

[0043] According to the implementation, the communication module is responsible for managing communication between various software components and allows the CMDB module to communicate with the deployment module. It also manages at least one DHCP interface module. The technical advantage of this feature is that it facilitates seamless communication between different software components, thereby ensuring proper coordination during the infrastructure deployment process.

[0044] According to the implementation method, the configuration module is responsible for initializing the CMDB module using information related to the switch and its configuration. It calculates the data required to initialize the CMDB module and other software components. The technical advantage of this feature is that it automates the initialization process, thereby reducing the need for manual intervention and potential errors.

[0045] According to the implementation, the Network Operations Gateway (NOG) module is responsible for bootstrapping the switches by receiving configuration data from the CMDB module and applying the received configuration to the switches. It manages the DNS services within the computing infrastructure. The technical advantage of this feature is that it automates the configuration process for switches, thereby ensuring configuration consistency and accuracy across the entire network.

[0046] According to the implementation method, the Domain Name System (DNS) module is responsible for managing DNS services within the computing infrastructure. This DNS module is pre-configured using data from the CMDB module during deployment. The technical advantage of this feature is that it automates the configuration and management of DNS services, thereby ensuring proper name resolution and network functionality.

[0047] According to another aspect, this technology relates to a computer-readable storage medium that stores instructions that enable a processing system to perform a specific function when these instructions are read and executed. More specifically, this embodiment relates to a non-transitory storage device containing program instructions, such as a hard disk, solid-state drive, or optical disk. When these instructions are executed by a processing system, they cause the processing system to perform the steps defined by this technology. By providing a computer-readable storage medium with the necessary instructions, this technology enables the implementation and execution of these methods on different processing systems.

[0048] According to another aspect, the present technology relates to a computer-readable storage medium that stores instructions that, when executed by a processing system, cause the processing system to perform the steps of the present technology.

[0049] According to another aspect, this technology relates to a processing system for automating the deployment of computing infrastructure. The system includes at least one unprovisioned server and a switch, as well as a processor and a computer-readable medium storing instructions that, when executed by the processor, cause software components to be executed. The software components include: a Configuration Management Database (CMDB) module responsible for managing and storing inventory data related to the unprovisioned server and switch. Furthermore, the software components of the processing system include: a deployment module for deploying the computing infrastructure; a communication module capable of enabling communication between the CMDB and the deployment module, and managing at least one Dynamic Host Configuration Protocol (DHCP) interface; an initialization configuration module for initializing the CMDB using information about the switch and its configuration; a Network Operations Gateway (NOG) module for controlling the switch by receiving configurations from the CMDB and applying these configurations; and a Domain Name System (DNS) management module for managing DNS services within the computing infrastructure.

[0050] According to another aspect, this technology relates to a processing system for automating the deployment of at least one computing infrastructure, the processing system comprising at least:

[0051] ● An unconfigured server, and

[0052] ●At least one switch;

[0053] ● Processor;

[0054] ● A computer-readable medium including instructions that, when operated by a processor, cause a software component to be executed, the software component comprising:

[0055] ○ Configuration Management Database (CMDB) module, which is configured to manage and store inventory data related to at least one unconfigured server and at least one switch;

[0056] ○ Deployment module, which is configured to deploy computing infrastructure;

[0057] ○ Communication module, which is configured as follows:

[0058] ■ Allows communication between the CMDB module and the deployment module; and

[0059] ■ Manage at least one Dynamic Host Configuration Protocol (DHCP) interface module;

[0060] ○ Configuration module, which is configured to initialize the CMDB module using information related to at least one switch and the configuration of at least one switch;

[0061] ○ Network Operation Gateway (NOG) module, which is configured to boot at least one switch by receiving configuration data from the CMDB module and applying the received configuration to at least one switch;

[0062] ○ Domain Name System (DNS) module, which is configured to manage the Domain Name System (DNS) service in the computing infrastructure.

[0063] According to the implementation, the Configuration Management Database (CMDB) module is configured to manage and store inventory data for unprovisioned servers and switches. This functionality offers several technical advantages. First, it enables efficient tracking and organization of hardware resources within the computing infrastructure. Second, it ensures consistency of configuration data across the entire infrastructure by providing a centralized repository. Finally, it simplifies the process of managing and updating configurations, as changes can be made in one place and propagated throughout the infrastructure.

[0064] According to the implementation, the deployment module is configured to automate the deployment of computing infrastructure. This feature provides significant benefits, including reducing the time and effort required for manual deployment, improving deployment consistency, and enhancing scalability, as new resources can be easily added to the infrastructure.

[0065] According to the implementation method, the communication module is configured to manage communication between the CMDB module and the deployment module, and also to manage at least one DHCP interface module. This function ensures seamless communication between different components of the system, thereby enabling efficient data exchange and coordinated task execution.

[0066] According to the implementation, the configuration module is configured to initialize the CMDB module using information related to the switch and its configuration. This feature simplifies the process of adding new switches to the computing infrastructure by automating the configuration process and reducing the need for manual intervention.

[0067] According to the implementation, the Network Operation Gateway (NOG) module is configured to boot at least one switch by receiving configuration data from the CMDB module and applying the received configuration to the switch. This functionality offers several technical advantages, including: centralized management of switch configurations; improved network security through consistent configuration; and simplified troubleshooting because all configuration data is stored in a single location.

[0068] According to another aspect, this technology relates to a method for managing computing infrastructure resources, the method comprising:

[0069] ● Use the server management module to discover at least one unconfigured server;

[0070] ● Present at least one unconfigured server as a computing resource to the deployment module;

[0071] ● Integrating the Self-Encrypting Driver (SED) into the server management module makes encryption transparent to the operating system;

[0072] ● Assign a unique encryption key to each host and / or disk and / or client of the computing infrastructure resources, and manage the assigned unique encryption key through the key management module.

[0073] According to another aspect, this technology relates to a method for securely booting an operating system in a computing infrastructure including at least one server, the method comprising:

[0074] ● Generate a unique signature for the operating system image;

[0075] ● Store the unique signature in the key management module;

[0076] ● By implementing a mechanism integrated into the server management module, the deployment module verifies that during the startup of at least one server, only a signed operating system image can be loaded, preferably a signed operating system image from a trusted provider.

[0077] According to another aspect, this technology relates to a management system for a cluster of distributed computing infrastructure, the management system comprising:

[0078] ● Deployment module, which is configured to deploy to servers that are not pre-configured;

[0079] ● Configuration Management Database (CMDB) module, which is configured to manage distributed computing infrastructure;

[0080] ● An integrated self-encrypting driver server management module for automatic encryption key management and secure boot technology;

[0081] ● Key management module, which is used to securely store encryption keys; and

[0082] ● Configuration module, which is configured as follows:

[0083] ○ Initialize the CMDB module;

[0084] ○ Permanently ensure the compliance of distributed computing infrastructure clusters;

[0085] ● Client interface, which allows users to manage the corresponding computing infrastructure from the distributed computing infrastructure associated with the client, while maintaining data security through encryption and distributed key management.

[0086] According to another aspect, this technology relates to a method for reporting the status of servers in a computing infrastructure including at least one server, the method comprising:

[0087] ● Use the server management module to discover servers.

[0088] ● Retrieve configuration data from the Configuration Management Database (CMDB) module, and

[0089] ● Generate a report that includes the discovered information and retrieved configuration data, and preferably then transmit the report to an administrator or monitoring system for further analysis and action.

[0090] According to another aspect, this technology relates to a method for managing Internet Protocol (IP) addresses in a computing infrastructure, the method comprising:

[0091] ●Pre-calculate all required IP addresses based on a set of rules, and

[0092] ● The calculated IP address is stored and transmitted to the appropriate component in the network via the communication module.

[0093] According to another aspect, this technology relates to a method for managing a cluster of distributed data centers, the method comprising:

[0094] ● Automated processes are used to deploy and configure computing infrastructure in each data center;

[0095] ● Pull the configuration to all data centers;

[0096] ● Monitor performance and resource utilization; and

[0097] ● Implement security measures to prevent unauthorized access or data breaches;

[0098] ● Preferably, features such as logging, monitoring, auditing, and key management are provided for distributed key management and auditing.

[0099] According to another aspect, this technology relates to a multi-controller system for managing and automating the deployment and configuration of computing infrastructure, the multi-controller system comprising:

[0100] ● Multiple controllers, each responsible for managing a subset of the infrastructure, and

[0101] ● Communication module: This module enables seamless communication between controllers. This design enhances scalability, improves fault tolerance, and ensures efficient resource utilization by allowing parallel processing and load balancing among controllers.

[0102] Before detailing the implementation of this technology below, some optional features that can be used in conjunction with or as alternatives will be listed below:

[0103] According to the implementation method, the deployment module is configured to: use the communication module to detect at least one new server; use the communication module to send the port number and switch number of the new server to the configuration management database module; and use the communication module to clear the discovery mode of the new server.

[0104] The first technological advantage lies in the automated detection of new servers through a deployment module configured to utilize a communication module. This feature enables real-time monitoring and rapid response to infrastructure changes, ensuring efficient resource allocation and minimizing potential network vulnerabilities from unidentified devices. The second technological advantage is realized when information about detected new servers is transmitted to the configuration management database module. This step allows for seamless integration of new servers into existing infrastructure, ensuring consistent configuration and management across the entire system. Additionally, it automates the provisioning and deployment process, reducing manual intervention and potential human error.

[0105] According to the implementation method, at least one switch includes switches from different manufacturers.

[0106] Using switches from different manufacturers in this technology offers several technical advantages. First, it enhances interoperability between different network components. Switches from various vendors may employ different protocols or proprietary functions, which can affect communication and data exchange within the network. By incorporating switches from multiple manufacturers, the system ensures compatibility and seamless integration of these different components.

[0107] According to the implementation method, the deployment module includes a network virtualization and orchestration component configured to allow: the creation of virtual networks, subnets, routers, firewalls, load balancers and other related network components within the deployment module; and the management of virtual networks, subnets, routers, firewalls, load balancers and other related network components.

[0108] According to the implementation method, the server discovery process includes the following steps:

[0109] ●Initialization:

[0110] ○ Power off the server;

[0111] ○ The server's deployment module and CMDB module are unknown;

[0112] ○ Network interfaces are configured by network virtualization and orchestration components to discover Virtual LAN (VLAN) modes;

[0113] ●Discovery:

[0114] ○ Power on the server;

[0115] ○ Start the server over the network;

[0116] The server loads at least one agent, which is configured to analyze the server and the at least one switch, generate a report including the analysis results, and send the report to the deployment module.

[0117] ○ Use the communication module to synchronize between the deployment module and the CMDB module;

[0118] ●Discovery concluded:

[0119] ○ Power off the server;

[0120] ○ Use network virtualization and orchestration components to deconfigure network interfaces from the discovery virtual LAN mode (VLAN) and place network interfaces in isolation mode.

[0121] The integrated network virtualization and orchestration components within the deployment module enable dynamic creation and management of network components, providing flexibility in the design and configuration of virtual networks. This capability allows for efficient use of network resources and facilitates seamless communication between servers and other network elements. During network interface configuration, the server discovery process using VLAN patterns ensures secure isolation between the discovery process and the production network. By placing server interfaces in isolated VLANs, potential security risks are minimized by preventing unauthorized access to the production network. Additionally, this approach achieves efficient use of network resources by dedicating a separate VLAN to server discovery. Utilizing an agent on the server during the discovery process offers several advantages. The agent can analyze server and switch hardware, providing comprehensive information about its functionality and configuration. This data can be used for configuration and integration into the infrastructure. Furthermore, the agent enables automated reporting, reducing human intervention and potential errors during the discovery process.

[0122] According to the implementation method, deleting the server from the deployment module causes the corresponding entry in the CMDB module to be deleted and the discovery process to be reset.

[0123] After a server is removed from the deployment module, the corresponding entry in the CMDB module is also automatically deleted. This eliminates the need for manual updates, reduces potential errors, and saves time and resources.

[0124] According to the implementation, this technology includes steps to ensure secure boot and disk encryption for computing infrastructure components.

[0125] Secure Boot ensures that only authorized software and / or the operating system is loaded during the system startup process, thus preventing the execution of unauthorized or malicious code. This feature enhances the security of computing infrastructure components by preventing rootkits and other forms of persistent malware that can bypass traditional antivirus solutions.

[0126] According to an implementation, this technology includes steps for managing infrastructure resources, the management steps including:

[0127] ● Use the server management module to discover at least one bare-metal server;

[0128] ● Use the server management module to present at least one bare metal server as a computing resource to the deployment module;

[0129] ●Integrate the self-encrypting driver (SED) into the server management module;

[0130] ● Assign a unique encryption key to each host and / or disk and / or client of the computing infrastructure resources, and manage the assigned unique encryption key through the key management module.

[0131] The first technological advantage lies in using the Server Management Module to automatically discover bare metal servers. This feature efficiently and accurately identifies available hardware resources within the computing infrastructure, reducing human intervention and potential errors. The second technological advantage is the ability to present discovered bare metal servers as computing resources to the Deployment Module. By seamlessly integrating these servers into the Deployment Module environment, users can leverage existing tools and processes for large-scale application management and deployment. Integrating a Self-Encrypting Drive (SED) into the Server Management Module adds an extra layer of security to the computing infrastructure. By managing the SED within the Server Management Module, data remains encrypted during storage and transmission, ensuring protection against unauthorized access and potential data breaches.

[0132] According to the implementation method, the server management module includes:

[0133] ● Control plane component, which is configured to discover servers and present them as computing resources to the deployment module, and is also configured to integrate encryption;

[0134] ● Management module, which is embedded in the operating system, is configured to communicate with the control plane to perform encryption and decryption tasks, manage the disk, and establish communication with the control plane.

[0135] The encryption integration in the server management module allows for secure communication between different components of the system, ensuring data confidentiality and preventing unauthorized access. This feature is useful in today's data-driven and security-critical environment.

[0136] According to an implementation, this technology includes the step of securely booting an operating system in a computing infrastructure, the step of securely booting the operating system including:

[0137] ● Generate a unique signature for the operating system image;

[0138] ● Store the unique signature in the key management module;

[0139] ● By implementing an integrated mechanism into the server management module, the deployment module verifies that only a signed operating system image can be loaded during the startup of at least one server.

[0140] The technical advantage of this method lies in generating and storing a unique signature for each operating system image. This feature ensures the authenticity and integrity of each image before it is loaded into the computing infrastructure. By securely storing these signatures in a key management module to restrict and control access to them, the risk of unauthorized modification or tampering is reduced.

[0141] According to the implementation method, the integrated mechanism is configured to manage signatures and version control.

[0142] The technical advantage of configuring an integrated mechanism to manage signatures lies in ensuring the integrity and authenticity of data. By implementing digital signatures, unauthorized modifications to data or instructions can be detected, thereby preventing potential security vulnerabilities and maintaining the accuracy of information.

[0143] According to an implementation, the technology includes steps that provide features of at least one of the following operations: recording, monitoring, auditing, and security.

[0144] Logs provide a record of past events, enabling system administrators to diagnose problems and identify trends. Incorporating logs into the methodology allows for the collection of valuable data for troubleshooting and performance analysis. Monitoring allows for real-time observation of system behavior and user activity. This feature is crucial for maintaining security and ensuring optimal performance. Incorporating monitoring into the methodology enables proactive intervention in response to unusual events or situations. Auditing provides a systematic assessment of system activities and is an important tool for complying with regulatory requirements and organizational policies. By including auditing as part of the methodology, users can ensure their systems operate within established guidelines and identify any potential areas of non-compliance.

[0145] According to the implementation method, the computing infrastructure includes a dedicated network for server discovery.

[0146] By incorporating a dedicated network for server discovery into the computing infrastructure, communication between servers occurs in a secure and controlled environment. This reduces the risk of unauthorized access or data interception during the discovery process. A dedicated network enables efficient and reliable server discovery because it allows direct connections between servers without traversing the public internet. This results in faster response times and improved overall system performance. Implementing a dedicated network for server discovery enhances scalability by allowing servers to be easily added to or removed from the network. This flexibility enables enterprises to adapt to changing needs and expand their computing infrastructure as required. Using a dedicated network for server discovery provides an additional layer of security through access control mechanisms. By restricting communication to authorized users and devices, potential threats from external sources can be minimized.

[0147] According to an implementation, this technology includes the step of managing Internet Protocol (IP) addresses in a computing infrastructure. The steps of managing Internet Protocol (IP) addresses include:

[0148] ● Pre-calculate all required IP addresses based on a set of rules (such as templates, subnet masks, and the number of hosts per subnet); and

[0149] ● The calculated IP addresses are stored and transmitted to the appropriate components in the network via the communication module.

[0150] Pre-compute IP addresses based on a set of rules, enabling efficient, dynamic, and accurate address management within the computing infrastructure. By calculating all required IP addresses before implementation, potential errors or inconsistencies can be minimized, ensuring a well-organized and streamlined network.

[0151] According to an implementation, this technology includes the step of managing a cluster of distributed computing infrastructure, which includes at least the following sub-steps:

[0152] ● Use automated processes to deploy and configure computing components in each computing infrastructure within a distributed computing infrastructure;

[0153] ● Pull the configuration of all computing infrastructure across the distributed computing infrastructure;

[0154] ● Monitor performance and resource utilization; and

[0155] ● Implement security measures to prevent unauthorized access or data breaches;

[0156] ● Preferably, features such as logging, monitoring, auditing, and key management are provided for distributed key management and auditing.

[0157] By managing clusters of distributed computing infrastructure, this approach enables efficient resource utilization and reduces the risk of data loss or downtime due to hardware failures or natural disasters at any single location. The distributed architecture allows for load balancing and automatic failover, ensuring high availability and reliability for data processing and storage. This approach facilitates effective monitoring and control of each computing infrastructure element in the cluster, allowing for real-time identification and resolution of problems before they escalate into major issues. This proactive approach minimizes downtime and improves overall system performance. It supports dynamic resource scaling on demand, ensuring optimal utilization of computing power, storage capacity, and network bandwidth. This flexibility enables enterprises to quickly adapt to changing needs and grow without costly infrastructure upgrades. Security is enhanced by managing clusters of distributed computing infrastructure, as it allows for the implementation of advanced security measures across multiple locations. Data can be replicated and encrypted, reducing the risk of unauthorized access or data loss. This approach enables seamless integration with various cloud services and on-premises infrastructure, providing enterprises with the flexibility to choose the best deployment model for their specific needs. It also supports hybrid cloud environments, allowing for efficient management of public and private resources. The distributed nature of data processing reduces latency and shortens response times by bringing data processing closer to the end user. This results in a better user experience and increased productivity for applications that require real-time data processing.

[0158] According to the implementation, this technology includes the step of sharing at least one switch among multiple deployment modules.

[0159] By sharing at least one switch among multiple deployment modules, resource utilization is optimized because each module can share the same switch, reducing the need for multiple switches and saving costs. A shared switch also enhances network flexibility, as it allows for easier reconfiguration and management of interconnections between deployment modules. This can be particularly beneficial in dynamic environments where resources are frequently added or removed. The use of a shared switch improves overall system performance by reducing latency and increasing bandwidth between deployment modules. The network becomes more efficient and responsive because data does not need to traverse multiple switches to reach its destination. A shared switch helps improve fault tolerance because a single point of failure in one switch only affects the connected module, not the entire system. This reduces downtime and ensures business continuity for applications running on deployment modules.

[0160] According to the implementation, the technology includes at least one master NOG and at least a plurality of slave NOGs, wherein the master NOG includes data about a plurality of switches, and each slave NOG includes data about only one of the plurality of switches.

[0161] This processing system achieves network isolation by distributing data related to multiple switches to the master NOG, while each slave NOG processes data associated with only one specific switch. This design reduces interconnectivity between different parts of the network, thereby minimizing potential vulnerabilities and improving overall security. Attached Figure Description

[0162] To better understand this technology and its other aspects and additional features, please refer to the following description in conjunction with the accompanying drawings, in which:

[0163] Figure 1 : Figure 1 A computing infrastructure with servers and switches according to an embodiment of the present technology is shown.

[0164] Figure 2 : Figure 2 The sequential steps of a computer-implemented method for automatically deploying at least one computing infrastructure according to an embodiment of the present technology are shown.

[0165] Figure 3 : Figure 3 An automated computing infrastructure deployment system according to an embodiment of the present technology is shown.

[0166] Figures 4a to 4f : Figures 4a to 4f The steps of a computer-implemented method for automating the deployment of at least one computing infrastructure, according to an embodiment of the present technology, are illustrated schematically.

[0167] Figures 5a to 5k : Figures 5a to 5k The steps implemented by at least one server management module associated with a self-encrypting drive according to an embodiment of the present technology are shown.

[0168] Figure 6 : Figure 6 A workflow switch configuration according to an embodiment of the present technology is illustrated schematically.

[0169] Figures 7a to 7b : Figure 7a and Figure 7b A multi-instance network operation gateway (NOG) module according to an embodiment of the present technology is illustrated schematically.

[0170] Figure 8 The safe start function is illustrated schematically. Figure 1 The computing infrastructure system. Detailed Implementation

[0171] The examples and conditional language listed herein are primarily intended to help the reader understand the principles of this technology, rather than limiting its scope to these specific examples and conditions. It should be understood that those skilled in the art can devise various arrangements that, although not explicitly described or shown herein, embody the principles of this technology and are included within its spirit and scope.

[0172] Furthermore, to aid understanding, the following description may depict a relatively simplified implementation of this technology. Those skilled in the art will understand that various implementations of this technology may involve greater complexity.

[0173] In some cases, examples that are considered useful modifications to the present technology may also be illustrated. This is done merely to aid understanding and, again, is not intended to limit the scope of the present technology or define its boundaries. These modifications are not an exhaustive list, and other modifications can be made by those skilled in the art, while such other modifications remain within the scope of the present technology. Furthermore, the absence of examples illustrating modifications should not be construed as impossibility of modification and / or as the only way to implement that element of the present technology.

[0174] Furthermore, all statements herein that illustrate the principles, aspects, and implementations of the present technology, and specific examples thereof, are intended to cover their structural and functional equivalents, whether they are currently known or will be developed in the future. Therefore, for example, those skilled in the art will understand that any block diagram herein represents a conceptual view of an illustrative circuit embodying the principles of the present technology. Similarly, it should be understood that any flowchart, diagram, state transition diagram, pseudocode, etc., represents various processes that can be substantially represented in a computer-readable medium and executed by a computer or processor, whether or not such a computer or processor is explicitly shown.

[0175] In the context of this specification, "server" means a computer program that runs on suitable hardware and is capable of receiving and executing, or causing to be executed, requests over a network (e.g., from a client device). The hardware may be a physical computer or a physical computer system, but neither must be necessary for the purposes of this art. In this context, the use of the term "server" does not imply that every task (e.g., a received instruction or request) or any particular task will be received, executed, or caused to be executed by the same server (i.e., the same software and / or hardware); it is intended to indicate that any number of software elements or hardware devices may be involved in receiving / sending, executing, or causing to be executed any task or request, or the consequences thereof; and all such software and hardware may be one server or multiple servers, both of which are included in the expression "at least one server."

[0176] In the context of this specification, "client device" means any computer hardware capable of running software appropriate for the currently relevant task. Therefore, some (non-limiting) examples of client devices include personal computers (desktops, laptops, netbooks, etc.), smartphones and tablets, as well as network devices such as routers, switches, and gateways. It should be noted that a device acting as a client device in this context does not exclude the possibility of it acting as a server for other client devices. The use of the term "client device" does not exclude the possibility of multiple client devices being used to receive / send, perform, or cause to perform any task or request, or the consequences of any task or request, or the steps of any method described herein.

[0177] In the context of this specification, "database" means any structured collection of data, regardless of its specific structure, database management software, or computer hardware used to store, implement, or otherwise make the data available thereon. A database may reside on the same hardware as the processes that store or utilize the information stored in the database, or it may reside on separate hardware, such as a dedicated server or multiple servers.

[0178] In the context of this specification, the term "information" includes information of any nature or type that can be stored in a database. This information includes, but is not limited to, audiovisual works (images, videos, recordings, presentations, etc.), data (location data, numerical data, etc.), text (opinions, comments, questions, messages, etc.), documents, spreadsheets, glossaries, etc.

[0179] In the context of this specification, the term "component" is intended to include the software (suitable for the specific hardware environment) necessary and sufficient to achieve the particular function mentioned.

[0180] In the context of this specification, the term "computer-usable information storage medium" is intended to include media of any nature and type, including RAM, ROM, disks (CD-ROM, DVD, floppy disk, hard disk, etc.), USB keys, solid-state drives, tape drives, etc.

[0181] The functions of the various components shown in the figure, including any functional blocks labeled "processor" or "graphics processing unit," can be implemented using dedicated hardware and hardware capable of executing software in association with appropriate software. When provided by a processor, these functions can be provided by a single dedicated processor, a single shared processor, or multiple independent processors (some of which may share resources). In some embodiments of this technology, the processor can be a general-purpose processor, such as a central processing unit (CPU), or it can be a processor dedicated to a specific purpose, such as a graphics processing unit (GPU). Furthermore, the explicit use of the terms "processor" or "controller" should not be construed as exclusively referring to hardware capable of executing software, and may implicitly include, but is not limited to, digital signal processor (DSP) hardware, network processors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), read-only memory (ROM) for storing software, random access memory (RAM), and non-volatile memory. Other conventional and / or custom hardware may also be included.

[0182] A software module, or simply a module implied as software, may be represented herein as any combination of flowchart elements or other elements indicating the performance of process steps and / or textual descriptions. Such a module may be executed by hardware, whether explicitly or implicitly indicated.

[0183] In the context of this specification, the words “first,” “second,” “third,” etc., are used as adjectives solely for the purpose of distinguishing the nouns they modify from one another, and not for the purpose of describing any particular relationship between these nouns. Therefore, for example, it should be understood that the use of the terms “first server” and “third server” is not intended to imply, for example, any particular order, type, chronological order, hierarchy, or ranking of servers / servers, nor is its use (in itself) intended to imply that any “second server” necessarily exists in any given situation. Furthermore, as stated in other contexts herein, references to the elements “first” and “second” do not preclude the two elements from being the same actual real-world element. Thus, for example, in some cases, a “first” server and a “second” server may be the same software and / or hardware, while in other cases they may be different software and / or hardware.

[0184] With this foundational knowledge in mind, we will now consider some non-restrictive examples to illustrate various implementations of different aspects of this technology.

[0185] According to the implementation method, and as Figure 1 and Figure 2As shown, this technology relates to a computer-implemented method 100 for automatically deploying at least one computing infrastructure 10 (also referred to as a data center). The computing infrastructure 10 includes at least one unprovisioned server 11 and at least one switch 12. The method 100 includes several components, preferably interconnected components, configured to work together to autonomously deploy and manage the computing infrastructure 10.

[0186] like Figure 2 , Figure 3 as well as Figures 4a to 4f As shown, according to an implementation method, the computer-implemented method 100 includes at least the following steps:

[0187] ● Access to a computer-readable medium 110, which preferably includes instructions that, when operated by a processor 300, cause a software component to be executed. Advantageously, the software component includes at least:

[0188] ○ Configuration Management Database (CMDB) 210, also known as Netbox;

[0189] ○ Deployment Module 220, also known as OpenStack;

[0190] ○ Communication module 230, also known as Dicious;

[0191] Configuration module 240, also known as Flux;

[0192] ○ Network Operation Gateway Module 250, also known as NOG;

[0193] ○ Domain Name System Module 260, also known as the DNS module or DNSMasq;

[0194] ○Optionally, the server management module 270, also known as Ironic;

[0195] ○Optionally, the key management module 280, also known as Barbicane;

[0196] ○Optionally, the network virtualization and orchestration module 290, also known as Neutron.

[0197] ●Calculate the data used by 120 to initialize CMDB module 210, the calculated data including at least one Internet Protocol (IP) address of at least one switch 12;

[0198] ● Initialize at least a portion of the software components 130 via configuration module 240, as follows:

[0199] ○ Use the calculated data to initialize the CMDB module 210; and

[0200] ○ Configure the DNS module 260 using the configuration from the CMDB module 210;

[0201] ● Use CMDB module 210 to determine the configuration of 140 for the following:

[0202] ○ Communication module 230 on at least one Intelligent Platform Management Interface (IPMI) and at least one management network; and

[0203] ○ Switch 12, which is configured to allow it to perform pre-provisioning based on data calculated from CMDB module 210;

[0204] ● Utilize provisioning data from CMDB module 210 to provision at least one network stack (i.e., at least one unprovisioned server 11), the provisioning data including data related to network devices, interfaces, networks, and configurations determined by CMDB module 210, the provisioning including:

[0205] ○ Pre-configure DNS module 260;

[0206] Pre-configure NOG module 250;

[0207] ● Declare at least one network in deployment module 220;

[0208] ● Synchronize deployment module 220 with CMDB module 210 170, so that deployment module 220 can use communication module 230 to initiate the server discovery process; and

[0209] ● Initiate 180 pending the discovery of at least one unconfigured server 11 by deployment module 220.

[0210] According to one implementation, CMDB module 210 (e.g., Netbox) is configured to manage and store inventory data related to the unconfigured server 11 and switch 12. Netbox 210 uses configuration module 240 (e.g., Flux) to initialize the switch 12 and information about its configuration. This initialization process involves calculating data for initializing Netbox 210, including at least one IP address of switch 12.

[0211] According to the implementation method, the main functions of the CMDB module 210 include:

[0212] ●Manage and store inventory data: CMDB module 210 maintains comprehensive information about various components of data center infrastructure 10, such as servers 11, switches 12, interfaces, VLANs, zones, and configuration templates;

[0213] ●Pre-generated YAML files: The CMDB module 210 calculates the data required to configure network devices and generates pre-populated YAML files. These YAML files contain the information needed for automatic configuration of network devices;

[0214] ● Initialize software components: After receiving the pre-filled response file, the CMDB module 210 initializes specific software components, such as IPMI and DHCP services, switches, and Domain Name System (DNS) services on the management network.

[0215] ●Configuration Synchronization: When the network configuration in CMDB module 210 changes, CMDB module 210 propagates the updated information to all connected controllers through a well-defined API or communication mechanism. This ensures that all controllers have up-to-date information about the network infrastructure.

[0216] According to one implementation, deployment module 220 (e.g., OpenStack) is configured to deploy computing infrastructure 10. OpenStack 220 communicates with Netbox 210 using communication module 230 (e.g., Dicious).

[0217] According to the implementation method, the main functions of the deployment module 220 include:

[0218] ● Deployment of computing infrastructure: Deployment module 220 is configured to deploy computing infrastructure 10, including server 11 and network components, based on configuration data provided by other modules such as CMDB module and configuration module (Flux);

[0219] ● Virtual network creation: Deployment module 220 includes at least one component, namely network virtualization and orchestration component 290, which is configured to create the virtual network required for managing server communication and various network interfaces within computing infrastructure 10;

[0220] ●DHCP Interface Management: Deployment module 220 is configured to manage Dynamic Host Configuration Protocol (DHCP) interface modules (e.g., DNS module 260) to assign IP addresses and other relevant configurations to servers during the discovery process.

[0221] ● Server discovery and registration: Deployment module 220 is configured to discover new servers when a new server (i.e., unconfigured server 11) starts up, register them with the processing system 200, and make them manageable by the user.

[0222] ● Synchronize with Netbox: Deployment module 220 is configured to synchronize its configuration data with CMDB module 210 to ensure consistency between physical and virtualized network configurations.

[0223] ● Power Management: Deployment module 220 is configured to manage the power status of servers to ensure they are ready for deployment or maintenance activities.

[0224] ● Image Deployment: Deployment module 220 is configured to deploy the operating system image and other necessary configurations to the newly added server, i.e., the unconfigured server 11, thereby ensuring consistency and minimizing downtime.

[0225] ● Provisioning: Deployment module 220 is configured to provision appropriate network configurations to new servers, enabling seamless integration into existing computing infrastructure 10. This includes configuring virtual interfaces, IP addresses, and routing tables.

[0226] ● Network reconfiguration: When the network configuration in CMDB module 210 changes, deployment module 220 automatically reconfigures the virtual network and other network components as needed to maintain consistency with the physical network.

[0227] According to one implementation, communication module 230 is configured to manage at least one Dynamic Host Configuration Protocol (DHCP) interface module 260 (such as, for example, DNSmasq). Communication module 230 is configured to allow communication between Netbox 210 and OpenStack 220, thereby enabling the exchange of necessary configuration data.

[0228] According to an implementation, the configuration module 240 is configured to initialize the CMDB module 210 using information related to at least one switch 12 and its configuration.

[0229] According to the implementation, one of the main functions of the configuration module 240 is to initialize the CMDB module 210 using information related to the network infrastructure (including the switch 12 and its configuration). More specifically, the configuration module 240 can perform the following tasks:

[0230] ● Initializing CMDB module 210: Configuration module 240 is configured to initialize CMDB module 210 by providing it with necessary data such as the IP address, interface, VLAN, zone name, and configuration template of switch 12. This data is calculated based on predefined rules and stored in configuration module 240.

[0231] ● Pre-configuration of network devices: Configuration module 240 is configured to pre-configure network devices, such as switch 12, by pushing their configurations to these devices after they are started. Configuration module 240 accomplishes this process using rendered configurations obtained from CMDB module 210 for IPMI and DHCP services on the management network, as well as for switch pre-configuration.

[0232] ● Synchronize with Deployment Module 220: Configuration Module 240 is configured to synchronize with Deployment Module 220 to enable the server discovery process. This synchronization ensures that all network configurations are consistent between the physical infrastructure managed by CMDB Module 210 and the virtual network managed by Deployment Module 220.

[0233] ● IP Address Management: Configuration module 240 is configured to manage the IP addresses in computing infrastructure 10 by pre-calculating all required IP addresses based on a series of rules (such as templates, subnet masks, and the number of hosts per subnet). It then stores these calculated IP addresses and transmits them to the appropriate components in the network via communication module 230.

[0234] According to the implementation, the Network Operation Gateway (NOG) module 250 is configured to boot switch 12 by receiving configuration data from CMDB module 210 and applying the received configuration to switch 12. This process ensures that switch 12 is correctly configured based on the data stored in CMDB module 210.

[0235] According to the implementation method, the main functions of NOG module 250 include:

[0236] ● Receive configuration from CMDB module 210: NOG module 250 is configured to receive configuration data from CMDB module 210, which includes information about switch 12, interfaces, VLANs and other network components.

[0237] ● Apply the received configuration to network devices: Once the NOG module 250 receives the configuration from the CMDB module 210, it is configured to apply the configuration to the corresponding network devices, thereby ensuring that they are correctly configured according to the expected settings.

[0238] ● Booting up the switches: The NOG module 250 is responsible for managing and controlling the switches 12 in the computing infrastructure 10. It can boot up the switches 12 by receiving configurations from the CMDB module 210 and applying these configurations to the switches 12, thereby enabling efficient and automated network management.

[0239] ● Communication with other modules: NOG module 250 is configured to communicate with other components of this technology (such as deployment module 220 and communication module 230) to ensure seamless integration and coordination between different parts of computing infrastructure 10.

[0240] ●Ensure network security: The NOG Module 250 is configured to maintain network security by applying configurations that comply with security policies and best practices, thereby ensuring that data center infrastructure is protected from potential threats.

[0241] According to one implementation, the Domain Name System (DNS) module 260 is configured to manage DNS services within the computing infrastructure. The DNS module 260 uses data from the CMDB module 210 for provisioning, including configurations for the IPMI and communication modules 230 on the management network.

[0242] According to the implementation, the Intelligent Platform Management Interface (IPMI) is a standard interface for directly managing and monitoring computer servers (especially off-grid servers) at the hardware level. IPMI enables remote access to various system management features, such as power control, temperature monitoring, fan speed control, and BIOS settings. IPMI uses its own dedicated network interface and protocols, allowing administrators to manage servers even when the server is not running an active operating system or when there is a network outage.

[0243] According to the implementation method, the server management module 270 includes at least:

[0244] ● Control plane component, which is configured to discover server 11 (preferably an unconfigured server) and present it as a computing resource to deployment module 220, and is also configured to integrate encryption;

[0245] ● The Management Module (IPA), which is embedded in the operating system, is configured to communicate with the control plane to perform encryption and decryption tasks, manage the disk, and establish communication with the control plane.

[0246] According to the implementation, the server management module 270 is configured to manage the unconfigured server 11 and integrate the unconfigured server 11 into the computing environment managed by the deployment module 220.

[0247] Preferably, its main functions include:

[0248] ● Discovering server 11 and presenting it as a computing resource to deployment module 220: Its control plane component is responsible for discovering unconfigured server 11 and presenting it to deployment module 220 so that it can be used as a computing resource.

[0249] ●Integrated Self-Encrypting Drive (SED): Server management module 270 includes mechanisms for managing and integrating the Self-Encrypting Drive (SED) into the server management process. By encrypting the drive before deployment to computing infrastructure 10, data security is ensured. Alternatively or supplementarily, server management module 270 may include any other suitable encryption technology. This encryption technology is configured to generate an encryption certificate for method 800.

[0250] ● Managing encryption keys: Server management module 270 is configured to manage encryption keys assigned to each host, disk, or client in computing infrastructure 10, and server management module 270 uses key management module 280 to manage these keys.

[0251] ● Secure Boot: Server management module 270 supports secure boot for computing infrastructure 10 components by generating a unique signature for the operating system image, storing it in key management module 280, and verifying that only the signed operating system image is loaded during server startup.

[0252] ● Communicating with IPA: The management module IPA, embedded in the operating system, communicates with the control plane to perform encryption and decryption tasks, manage the disk, and establish communication with the control plane.

[0253] According to the implementation method, the key management module 280 is configured to manage encryption keys used for data protection. Its main functions may include:

[0254] ● Encryption Key Management: The key management module 280 is configured to store and manage encryption keys for various components of the computing infrastructure 10, such as the server 11, disks, and clients. It ensures that only authorized users can access these keys.

[0255] ● Securely store keys: The key management module 280 is configured to use a secure storage mechanism to store encryption keys, thereby ensuring that they are protected from unauthorized access or theft.

[0256] ●Key rotation: The key management module 280 is configured to support key rotation, which is the process of periodically replacing old encryption keys with new encryption keys to enhance security.

[0257] ● Integration with other modules: The key management module 280 is configured to integrate with other components of this technology to manage the encryption keys used by these modules and ensure secure communication between them.

[0258] ●Key access control: The key management module 280 is configured to provide fine-grained access control for encryption keys, thereby allowing administrators to grant or deny access based on specific roles or users.

[0259] ●RESTful API: The key management module 280 is configured to provide a RESTful API that can be easily integrated with other components of this technology and external applications.

[0260] ●Supports multiple key types: The key management module 280 is configured to support various types of encryption keys, such as RSA, AES and ECDSA, to meet different use cases and requirements.

[0261] ●Key version control: The key management module 280 is configured to maintain a record of key versions, allowing administrators to roll back to previous versions when necessary. The server management module is configured to handle the updates and renewals of the encryption certificates required for the signature verification method 800.

[0262] According to an implementation, the network virtualization and orchestration module 290 is configured to manage and configure virtual networks within the computing infrastructure 10. Its main functions may include:

[0263] ● Create and manage virtual networks: The network virtualization and orchestration module 290 is configured to create and manage virtual networks, subnets, routers, firewalls, load balancers and other related network components within the deployment module 220.

[0264] ● Virtual Local Area Network (VLAN) Configuration: The network virtualization and orchestration module 290 is configured to configure VLANs for network interfaces during the server discovery process to ensure proper communication between server 11 and network devices.

[0265] ● Dynamic Host Configuration Protocol (DHCP) service: Network virtualization and orchestration module 290 is configured to manage the DHCP service, which assigns IP addresses and other relevant configurations to server 11 during the discovery process.

[0266] ●Network security: The network virtualization and orchestration module 290 is configured to provide network security features, such as firewalls, security groups, and access control lists, to protect the virtual network infrastructure from unauthorized access or attacks.

[0267] ●Load balancing: The network virtualization and orchestration module 290 is configured to provide load balancing capabilities.

[0268] This allows for the distribution of network traffic across multiple servers, thereby improving performance and availability.

[0269] ● Network Automation: The network virtualization and orchestration module 290 is configured to automatically perform various network tasks, such as configuring interfaces, creating subnets, and managing routing tables, to simplify the deployment and management of virtual networks.

[0270] ● Integration with other modules: The network virtualization and orchestration module 190 is configured to integrate with other components of this technology, including the CMDB module 210 and the network operations gateway module (NOG) 250, to ensure seamless communication and coordination between different parts of the computing infrastructure 10.

[0271] According to an embodiment, the technology also includes calculating data for initializing the CMDB module 210 using the calculation 120 and using the configuration module 240 to configure at least a portion of the software components.

[0272] According to the implementation method, the technology also includes:

[0273] ● Use the calculated data to initialize the CMDB module 210.

[0274] ● Configure the DNS module 260 using the configuration from the CMDB module 210.

[0275] ●The configuration for communication module 230 is determined, and

[0276] ● Configure switch 12 to allow it to perform pre-provisioning based on data calculated from CMDB module 210.

[0277] According to the implementation, provisioning data from CMDB module 210 is used to provision at least one network stack.

[0278] Preferably, the pre-mixing process involves:

[0279] ●Pre-configure the DNS module 260 and the Network Operation Gateway (NOG) module 250.

[0280] ● Declare at least one network in deployment module 220, and

[0281] ● Synchronize the deployment module 220 with the CMDB module 210 to initiate the server discovery process using the communication module 230.

[0282] According to the implementation method, the unconfigured server 11 is started up to be discovered by the deployment module 220. Once the server 11 is discovered, it can be managed by at least one user.

[0283] According to the implementation method, the discovery process of the new server 11 (i.e., the new unconfigured server) includes at least three steps: initialization, discovery, and discovery end.

[0284] Preferably, during the initialization step of the discovery process, the new server 11 is powered off, and neither the deployment module 220 nor the configuration management database (CMDB) module 210 is aware of the existence of the new server 11. Then, the network interface on the new server 11 is configured by the network virtualization and orchestration component 290 in a virtual LAN (VLAN) discovery mode. Once the new server 11 is powered on, it will boot up over the network and load an agent that analyzes the hardware and generates a report. This report is sent to the deployment module 220, which uses the communication module 230 to synchronize the information with the CMDB module 210.

[0285] Preferably, in the discovery step, the agent analyzes the hardware of the new server and reports its configuration data back to the deployment module 220. The deployment module 220 uses this information to create virtual networks, ports, and other necessary configurations for the new server. Once all configurations are in place, the new server 11 can be discovered and managed by the user.

[0286] Preferably, during the discovery process, the network interface is deconfigured from the discovery VLAN using network virtualization and orchestration component 290 and placed in isolation mode (i.e., isolated). This is done to ensure security by preventing unauthorized access to the newly discovered server. Advantageously, if server 11 is deleted from the deployment module 220 database, the corresponding entry in CMDB module 210 is also deleted, and the discovery process for server 11 is reset. This step helps maintain an accurate inventory of servers and their configurations within the data center infrastructure.

[0287] Preferably, the discovery process also involves managing IP addresses within computing infrastructure 10. Pre-computed IP addresses based on a set of rules (such as templates, subnet masks, and the number of hosts per subnet) are stored and transmitted via communication module 230 to the appropriate components in the network. Each IP address is associated with a template that is linked to a specific function within computing infrastructure 10. This dynamic process ensures that all new servers 11 and switches 12 are assigned unique IP addresses, enabling seamless integration into the computing infrastructure 10 network.

[0288] This technology also focuses on an innovative approach to deploying and managing data centers through a self-initializing and configuration process. This approach encompasses several aspects, including:

[0289] ● Initialization of the data center network: This aspect involves the automatic initialization of the network configuration in the data center, preferably using pre-generated YAML files that may contain the information required to configure network devices.

[0290] ● Regarding the control mechanism for request instantiation and the comparison between real and logical configurations (Ironic and Netbox): This aspect revolves around the control mechanism, which enables request instantiation in the data center by comparing the real configuration with its logical counterpart using tools such as the server management module (Ironic) and the CMDB module (Netbox).

[0291] ● Parallel Configuration Execution (Ironic): This aspect involves using the Server Management Module (Ironic) to execute configuration tasks in parallel when adding new servers to the data center.

[0292] ● Methods for synchronizing multiple controllers (Netbox, OpenStack): This aspect involves synchronizing multiple controllers in a data center environment, specifically synchronizing the CMDB module Netbox and the deployment module OpenStack to maintain consistency between the physical network configuration and the virtualized network configuration managed by OpenStack.

[0293] ● Parallel provisioning of device configurations (Netbox, OpenStack): The fifth technology involves using Netbox and OpenStack to provision multiple devices in the data center in parallel, so as to quickly integrate new devices into the existing infrastructure without causing unnecessary downtime or configuration conflicts.

[0294] This technology also includes optional aspects, namely, using a self-encrypting driver (SED) and at least one server management module (Ironik, a logical stack for bare metal deployment and management) for data protection encryption to manage encryption keys and ensure that all new servers are encrypted before being deployed to the data center.

[0295] According to the implementation method, the IP address is allocated for the functionality of terminals in Virtual Extensible LAN (VXLAN) and Border Gateway Protocol (BGP). Preferably, the IP address acts as an intermediate address between two networked devices in dynamic mode.

[0296] According to the implementation, the IP addresses between network devices are pre-calculated and assigned to their respective interfaces within the Configuration Management Database (CMDB) module 210. Once accessed, the technology can be configured to allow retrieval of interconnections between network devices, thereby obtaining the information required to establish a BGP routing protocol connection. Advantageously, for establishing a BGP session, the Autonomous System Number (ASN) of the other device is preferably known during BGP peer configuration.

[0297] According to the implementation, the CMDB module 210 pre-calculates IP addresses for network devices and assigns them to their corresponding interfaces, effectively identifying connections between devices and configuring BGP sessions, preferably using the required ASN information. Advantageously, this simplifies the process of managing complex network infrastructures while ensuring accurate and consistent routing configuration.

[0298] According to the implementation method, the Intelligent Platform Management Interface (IPMI) is configured to manage servers within the computing infrastructure. Advantageously, this configuration enables efficient and centralized control over server operations.

[0299] According to the implementation method, this technology enables the deployment of automated infrastructure with a very small footprint by using compact and efficient hardware components and simplified software processes. This allows for rapid and easy implementation in a variety of environments with limited space or resources.

[0300] According to the implementation method, Figures 4a to 4f A illustrative representation of some steps involved in a computer implementation method for automating the deployment of at least one computing infrastructure, according to the present technology, is provided.

[0301] exist Figure 4a In this diagram, configuration module 240 (Flux) is shown sending data to CMDB module 210 (Netbox). This data includes information about unconfigured servers 11 and switches 12 that have not yet been deployed to computing infrastructure 10. Communication module 230 (Dicious), which manages communication between the various software components, facilitates the transfer of data from configuration module 240 to CMDB module 210.

[0302] exist Figure 4b In this process, CMDB module 210 receives data sent by configuration module 240 and uses this data to configure Domain Name System (DNS) module 260 (DNSMasq). During this process, communication module 230 manages the DHCP interface used by DNS module 260. This step ensures that DNS services in computing infrastructure 10 are correctly configured, thereby enabling efficient name resolution and network functions.

[0303] exist Figure 4c In this process, CMDB module 210 sends data to Network Operation Gateway (NOG) module 250. NOG module 250 is responsible for bootstrapping switch 12 by receiving the configuration from CMDB module 210 and applying it to switch 12. This process automates the configuration of switch 12 in network infrastructure 10, thereby ensuring consistent and accurate configuration on all switches 12.

[0304] exist Figure 4d In this process, deployment module 220 (OpenStack) receives instructions from CMDB module 210 regarding inventory data for unprovisioned server 11 and switch 12. Deployment module 220 uses this information to provision the network stack, pushing the configuration to switch 12 after startup. This step automates the deployment process, reducing the time and effort required for manual configuration and provisioning.

[0305] exist Figure 4e In the diagram, server 11 and switch 12 are shown being provisioned using data from CMDB module 210. Deployment module 220 initializes the unprovisioned server 11 by installing an operating system image and other necessary configurations. The network stack has also been configured, including virtual interfaces, IP addresses, and routing tables.

[0306] exist Figure 4f In this process, deployment module 220 discovers server 11 using server management module 270 (Ironic). This discovery process involves initializing server 11 using an operating system image and other configurations, registering it with CMDB module 210, and enriching its inventory data. Communication module 230 manages this process by managing the DHCP interface and allowing communication between CMDB module 210 and deployment module 220. Once server 11 is discovered, it can be managed by users within computing infrastructure 10.

[0307] According to the implementation, the deployment module is configured to perform certain functions. Preferably, the deployment module 220 is capable of using the communication module 230 to detect at least one new server (i.e., an unconfigured server 11).

[0308] Advantageously, when a new server 11 is detected, the deployment module 220 sends the port number of the new server 11 and the switch number 12 to the configuration management database (CMDB) module 210 via the communication module 230.

[0309] Furthermore, according to the implementation, once the new server 11 has been successfully added to the CMDB module 210, the deployment module 220 uses the communication module 230 to clear the discovery mode of the new server 11.

[0310] According to the implementation, this technology is configured to use switches 12 from different manufacturers (such as, for example, Arista or Cisco). Preferably, the network infrastructure 10 employs a variety of components to enhance reliability and interoperability. Advantageously, incorporating switches 12 from different manufacturers enables design flexibility and potential cost savings.

[0311] Using switches 12 from different manufacturers can offer several technical advantages:

[0312] ● Interoperability: Switches 12 from different manufacturers may have unique features or capabilities that can enhance overall network performance when used together.

[0313] ● Redundancy: Having switches from multiple sources12 ensures a more robust and resilient infrastructure because components from different vendors are less likely to fail simultaneously.

[0314] ● Cost savings: By utilizing switches 12 from different manufacturers, organizations can negotiate better prices or find cost-effective alternatives for specific network needs.

[0315] According to the implementation, deployment module 220 includes a network virtualization and orchestration component 290 (Neutron). This component is capable of creating virtual networks, subnets, routers, firewalls, load balancers, and other network components within deployment module 220, and managing these virtual networks, subnets, routers, firewalls, load balancers, and other network components.

[0316] According to an implementation, this technology includes the step of managing the deletion of servers in computing infrastructure 10. Preferably, the step of managing server deletion includes the following sub-steps:

[0317] ●Remove server 11 from deployment module 220;

[0318] ● Delete the corresponding entry for this server in the Configuration Management Database (CMDB) module 210;

[0319] ● Reset the discovery process in CMDB module 210.

[0320] According to one implementation, deleting a server from deployment module 220 causes the corresponding entry in CMDB module 210 to be automatically deleted. Advantageously, this feature ensures that the configuration management database is always able to synchronize the current state of computing infrastructure 10 in real time. According to another implementation, the method may include additional steps, such as verifying the identity of the user requesting the deletion of the server, or confirming that all dependent resources have been cleared before starting the deletion process. Advantageously, these features enhance the security and reliability of the computing infrastructure by ensuring the proper handling of dependencies and preventing unintended consequences during server deletion.

[0321] According to an embodiment, this technology includes steps for protecting components of computing infrastructure 10. Preferably, the method includes ensuring secure boot and / or disk encryption. Advantageously, this technology may include the step of deploying a software image. According to an embodiment, secure boot is implemented during the deployment process to ensure that only authorized software can be loaded onto the server. This prevents unauthorized code from running and helps prevent malware attacks. According to an embodiment, disk encryption may also be applied to secure data stored on server 11.

[0322] According to an implementation, this technology includes using a server management module 270 (such as Ironic) to discover at least one bare metal server, i.e., an unconfigured server 11. This step allows identification of servers 11 that do not have an operating system installed and are directly accessible at the hardware level. Advantageously, the discovered bare metal servers 11 are presented as computing resources to a deployment module 220. This presentation is performed through the server management module 270. This integration enables automated deployment of software on the bare metal servers 11. Preferably, self-encrypting drives (SEDs) are integrated into the server management module 270. These drives provide hardware-level encryption for data stored thereon. This technology is configured to assign a unique encryption key to each host and / or disk and / or client of the computing infrastructure resources. Advantageously, a key management module 280 (such as Barbican) manages the assigned unique encryption keys. This ensures secure storage and access to the encryption keys. Encryption is transparent to the operating system, thereby allowing seamless integration within the computing infrastructure 10.

[0323] According to one embodiment, the server management module 270 includes a control plane component. This component is configured to discover the server 11 and present it as a computing resource to the deployment module 220. Preferably, it is also configured to integrate encryption. Furthermore, according to another embodiment, the server management module 270 includes an inter-process management module (IPA) embedded in the operating system. The IPA communicates with the control plane component to perform encryption and decryption tasks, manage the disk, and establish communication with the control plane.

[0324] According to an implementation, this technology includes the step of securely booting an operating system in computing infrastructure 10. This technology may include the following sub-steps:

[0325] ● Generate a unique signature for the operating system image;

[0326] ● Store the unique signature in the key management module 280 (such as Barbican);

[0327] ● Verify that during the startup of at least one server 11, only the signed operating system image will be loaded;

[0328] ● The integrated mechanism is executed in the server management module 270 (such as Ironic) to perform the verification.

[0329] Advantageously, the operating system image is signed by a trusted platform or trusted provider before storage and verification. This ensures the authenticity and integrity of the operating system image during the boot process.

[0330] According to an implementation, the key management module 280 is configured to securely store unique signatures using cryptographic techniques to maintain their confidentiality and prevent unauthorized access. Preferably, the verification step may include comparing the stored signature with a signature generated by the operating system image during the boot process. If a match is found, the server 11 deploys the operating system image; otherwise, the server 11 stops the boot process to prevent potential security threats.

[0331] According to the implementation method, Figures 5a to 5k The diagram illustrates the steps involved in transitioning from a non-provisioned server 11 to a provisioned server using the server management module 270, within the context of deploying and managing at least one computing infrastructure 10, as well as the recycling process for a decommissioned server 11. These diagrams demonstrate the various stages during the recycling process, including connecting the server 11 to the provisioning network, booting it on IPMI, unlocking the disks, switching back to user mode, deleting the server 11, and encrypting the SED.

[0332] exist Figure 5aThe diagram depicts the initial state of a computing infrastructure with several software components, such as NOVA, IRONIC, Barbican, KMS, and TFTP. A client network is connected to two hosts, some disks are locked, and a provisioning network is present. Preferably, NOVA is associated with an orchestrator module configured to orchestrate computing resources. Preferably, KMS is a key management system that can be connected to or included in a key management module 280 named Barbican. Preferably, TFTP is a file transfer module configured to manage file transfers.

[0333] exist Figure 5b In the middle, Nova sends a request to Ironic to start the bare metal node by connecting it to the provisioning network. Ironic then reconfigures the host interface to switch it to the provisioning network.

[0334] Figure 5c This demonstrates the process of booting a server over a network using PXE or iPXE on the IP Address Management Interface (IPMI). During this boot process, the host downloads an image from a TFTP server.

[0335] exist Figure 5d In this context, the Ironic Python Agent image executes on the host machine. It requests instructions from the control plane and receives commands to load the "unlock disk" feature.

[0336] Figure 5e The diagram shows that IPA uses instructions from Ironic to unlock all disks using a given key obtained from Barbican and stored in KMS.

[0337] exist Figure 5f In this configuration, the IPA is set to unlock all disks using the provided key, preferably the OPAL-API.

[0338] Figure 5g This indicates the "Switch Back to User" step, where the IPA notifies Ironic that the job has completed successfully and begins a soft reboot. Ironic clears the network configuration and reverts the host settings back to the customer network.

[0339] Figures 5h to 5k The process of recycling the server was demonstrated. Figure 5h In the process, the client sends a delete command to Nova, which then sends the delete request to Ironic. Ironic then sends a stop command to the server.

[0340] exist Figure 5iDuring this process, the startup process is restarted on IPMI to perform the recycling process. When the server is shut down, Ironic reconfigures the network to place it on the provisioning network.

[0341] Figure 5j This indicates the "SED factory reset" step, where SED is reset to its factory settings.

[0342] exist Figure 5k The document illustrates the "SED Re-encryption" step, in which the SED is encrypted using a new encryption key.

[0343] exist Figures 5a to 5k In the context of the initial state ( Figure 5a An environment with various modules and networks has been set up. The step of "Connecting the server to the provisioning network" ( Figure 5b and Figure 5c The process begins by requesting Ironic to enable the bare metal node and reconfigure the host interface to switch it to the provisioning network. The host then boots up over the network and downloads the image from the TFTP server.

[0344] Steps to "Execute the Ironic Python Agent Image" Figures 5d to 5f This instructs the IPA on how to unlock all disks using a given key retrieved from Barbican and passed to the IPA. The IPA then uses "sedutil-cli" to unlock the disks. The "Switch Back to User" step ( Figure 5g The system notifies the Ironic job that it has successfully completed and is initiating a soft reboot, clearing network configurations and setting the host back on the customer's network.

[0345] The process of "reclaiming the server" Figures 5h to 5k This involves removing the OpenStack server, booting it on the IPA, restoring the SED to its factory settings, encrypting it with the latest encryption key, and then continuing the cleanup process. This process ensures efficient resource management in large data center environments while maintaining security and flexibility.

[0346] According to embodiments, this technology may include an integrated mechanism for managing signatures and version control. Preferably, this integrated mechanism is designed as a software component. This mechanism is capable of tracking and managing different versions of data or information, thereby ensuring that only authorized and authenticated changes are implemented. Advantageously, this feature enhances data security and integrity by providing a reliable means of maintaining a record of all modifications made to the system or device over time. Furthermore, it allows for efficient version control, enabling users to easily revert to previous versions when necessary.

[0347] According to one embodiment, the technology includes a data recording step. Preferably, this recording step records events for subsequent analysis. According to another embodiment, the technology includes a monitoring step. In this step, the system or process is observed in real time or periodically. Advantageously, the technology may include an auditing step. This step involves reviewing logs and other data to ensure compliance with policies or regulations. As previously described, security is another feature that can be incorporated into the technology. Preferably, this security aspect includes measures for protecting data from unauthorized access or manipulation.

[0348] According to an implementation, this technology includes a step of reporting the status of servers in a computing infrastructure, which includes at least the following sub-steps:

[0349] ● Use the server management module to discover servers.

[0350] ● Retrieve configuration data from the Configuration Management Database (CMDB) module, and

[0351] ● Generate a report that includes the discovered information and retrieved configuration data, and preferably then transmit the report to an administrator or monitoring system for further analysis and action.

[0352] According to one implementation, computing infrastructure 10 may include a dedicated network for server discovery. Preferably, the dedicated network is implemented as a local area network (LAN) and / or wide area network (WAN) owned and operated by a user or organization. Advantageously, using a dedicated network for server discovery provides enhanced security and control during the discovery process compared to using a public network. The dedicated network can be configured as an access control and firewall to restrict unauthorized access and prevent potential attacks. Furthermore, using a dedicated network enables faster and more reliable communication between servers on the network.

[0353] Advantageously, in environments where security and reliability are critical, such as financial services, healthcare, or government applications, using a private network for server discovery can be particularly beneficial. By controlling the discovery process within a private network, organizations can reduce the risk of unauthorized access or data breaches that could occur when using public networks for discovery. Furthermore, depending on the implementation, this technology may include load balancing and failover mechanisms to ensure high availability and fault tolerance of the server infrastructure. Preferably, these mechanisms are integrated with the private network, and in the event of a failure or overload, traffic can be automatically detected and redirected to an available server.

[0354] According to an implementation, this technology includes the step of managing Internet Protocol (IP) addresses in a computing infrastructure. This step may include the following sub-steps:

[0355] ●Pre-calculate all required IP addresses based on a set of rules (such as templates, subnet masks, and the number of hosts per subnet);

[0356] ● Store the calculated IP addresses;

[0357] ● The stored IP address is transmitted to the appropriate component in the network via the communication module;

[0358] Preferably, each IP address is associated with a template that is linked to a specific function within the computing infrastructure. Advantageously, this step of managing IP addresses can be updated dynamically as needed.

[0359] More specifically, according to the implementation, this step begins by determining the necessary IP addresses based on predefined rules (such as subnet masks and the number of hosts per subnet). These calculations are performed offline, and the resulting IP addresses are stored for later use. When needed, the calculated IP addresses are transmitted to the appropriate components in the network via communication module 230. Advantageously, each IP address is associated with a specific template that defines its functionality within the computing infrastructure 10. For example, an IP address for a web server may be associated with a template that includes port numbers and other relevant configuration information. This facilitates the management and configuration of network components.

[0360] Furthermore, IP addresses can be dynamically updated to adapt to changes in the network environment. For example, if a new component is added to the network, this technology can be used to calculate its IP address and transmit it to the appropriate module and / or device. Similarly, if an existing IP address needs to be changed, the calculation can be rerun and the updated IP address transmitted accordingly.

[0361] It is important to note that when configuring the new server 11, an IP address must be pre-configured or reserved. Failure to do so may result in connectivity issues between devices. Traditional methods using automatic IP addressing services such as DHCP are suitable for simple interfaces such as those used for managing networks, but not for interconnecting network devices.

[0362] The proposed solution aims to simplify the configuration process of network devices in data center environments by utilizing templates.

[0363] For example, this technology may include a first template and a second template.

[0364] Preferably, a first template, referred to as "device type," can be configured to define the interfaces and their roles for various device types.

[0365] Preferably, a second template named "Network prefix for each role" can be configured to specify the available range of IP addresses for different roles.

[0366] This approach simplifies the configuration process by automating the allocation of interfaces and IP addresses based on the device's role and type.

[0367] Figure 6 The workflow switch configuration is shown. The workflow begins by providing a list of devices (such as switches and / or servers), along with their respective roles and types.

[0368] According to the implementation, the first step of this process is to extend a given device using a "Device Type" template. This extension causes the device to tag its associated interfaces. Subsequently, two parallel processes begin. These processes resolve the interface list for each device and determine the IP address based on the device's role and tags. By leveraging templates and parallel processing, this solution efficiently generates high-level profiles for network devices.

[0369] Preferably, the first step of the workflow involves providing a list of devices, including switches and their respective roles and types. This information is crucial for determining the required interfaces and IP addresses for each device based on its role within the network infrastructure.

[0370] Next, the configuration process begins by expanding the given device using the "Device Type" template. This expansion results in a more detailed representation of the device, including its associated interfaces labeled according to its role. For example, if we have a switch used as a Top-of-Rack (ToR) switch, its interface labels will be qualified based on the Device Type template for ToR switches.

[0371] Following the expansion step, two parallel processes will begin: one process resolves the list of interfaces for each device, while the other calculates the IP address and refines specific attributes based on the device's role and interface labels. These processes run concurrently to optimize the efficiency of the configuration process.

[0372] The first parallel process for handling interface resolution determines the IP address and other relevant configurations based on the label of each interface and the role of the device associated with that interface. For example, if an interface is marked as a management interface, it will be configured using the "Network Prefix for Each Role" template for management interfaces.

[0373] The second parallel process for handling IP address calculation and attribute refinement uses a "network prefix per role" template to determine the range of IP addresses available for each role. Based on this information, it calculates the specific IP address required for each interface, taking into account the label of each interface and the role of the device associated with that interface. Furthermore, it refines any other necessary attributes for the interface, such as VLAN or subnet mask.

[0374] Once the two parallel processes have completed their respective tasks, a high-level configuration file for the network devices will be generated. This file contains all the necessary information for configuring switches and other network devices within the data center infrastructure. Figure 6 This workflow is presented in a clear and concise manner, highlighting the importance of templates and parallel processing in optimizing the switch configuration process.

[0375] As mentioned earlier, the advantages of this template-based solution include increased efficiency and reduced errors when configuring network devices. Automation of interface allocation and IP address calculation ensures consistency across the entire data center infrastructure. Furthermore, parallel processing of multiple devices makes the management of a large number of devices more scalable. This solution provides organizations with an effective way to manage their network configurations while maintaining the security, reliability, and flexibility of their data center environment.

[0376] According to the implementation, this technology can be configured to manage a cluster of distributed computing infrastructure 10 (i.e., data centers). Preferably, each computing infrastructure 10 in the cluster can be geographically distributed and operate independently. Advantageously, this technology includes real-time monitoring of the performance of each computing infrastructure 10 and correspondingly allocating workloads to optimize resource utilization and improve overall system efficiency. Furthermore, this technology can include implementing automated failover mechanisms to ensure high availability and disaster recovery capabilities. Additionally, this technology can include integrated security measures to protect data and prevent unauthorized access to the data center in the cluster. Furthermore, this technology may involve using advanced analytics and machine learning algorithms to predict and prevent potential problems before they occur, thereby reducing downtime and improving system reliability. Advantageously, this technology can be implemented using a cloud-based platform or a decentralized network architecture to achieve scalability and flexibility.

[0377] According to an implementation, this technology includes the step of managing a cluster of distributed computing infrastructure, which includes at least the following sub-steps:

[0378] ● Use automated processes to deploy and configure computing components in each computing infrastructure;

[0379] ● Pull the configuration of all computing infrastructure;

[0380] ● Monitor performance and resource utilization; and

[0381] ● Implement security measures to prevent unauthorized access or data breaches;

[0382] ● Preferably, features such as logging, monitoring, auditing, and key management are provided for distributed key management and auditing.

[0383] According to the implementation, this technology can be configured to share at least one switch 12 among multiple deployment modules 220. Preferably, each deployment module 220 is an OpenStack environment. Advantageously, this arrangement allows multiple Network Operations Gateway (NOG) modules 250 to use the same switch 12.

[0384] According to another implementation, if there is no shared switch 12 among the NOG 250s, each NOG would require its own dedicated switch 12. This could lead to increased cost and complexity. Advantageously, a switch 12 can be shared by multiple NOG 250s. This reduces the total number of switches 12 required and lowers costs. Furthermore, according to the implementation, each client (i.e., user) is associated with a specific NOG 250. However, due to the arrangement of the shared switch 12, multiple clients from different NOG 250s can transmit data through the same switch 12 at different times. This does not cause any interference or conflict because the association of the NOG 250s ensures the correct routing and management of the transmitted data.

[0385] According to an implementation, this technology may include a mutualization step for managing network infrastructure within a computing infrastructure. Preferably, this step may at least include enabling multiple deployment modules 220 to share at least one switch 12 by synchronizing the configurations of multiple deployment modules 220 and allowing efficient use of resources.

[0386] According to an embodiment, the present technology relates to a computer-readable storage medium that stores instructions for implementing the present technology, and thus the computer-readable storage medium is configured to be deployed and managed through an autonomous initialization and configuration process.

[0387] According to one implementation, the first part of the instructions on the computer-readable storage medium relates to the automatic initialization of network configuration in computing infrastructure 10. This process can begin by pre-generating a YAML file containing the necessary information for configuring network devices. These YAML files can be converted into usable configuration files using processes within Netbox and other tools and / or modules.

[0388] According to the implementation, the second part of the instructions relates to a control mechanism capable of instantiating requests within the computing infrastructure 10. This mechanism involves using modules such as the Ironic 270 and Netbox 210 to compare the actual configuration with its logical counterpart. Upon detecting a new server 11, OpenStack 220 initiates automated configuration actions, including installing the initial operating system image, registering server 11 in Netbox 210, and enriching its inventory. Once the server's configuration is updated in Netbox 210, Dicious 230 generates network configuration files for OpenStack 220 to create the virtual networks, ports, and other configurations required for the server to function correctly.

[0389] According to the implementation, the third part of the instructions focuses on using the Ironic 270 to perform configuration tasks in parallel when the new server 11 is added to the computing infrastructure. The Ironic 270 manages power status, deploys operating system images and configurations, and pre-configures appropriate network settings for the new server.

[0390] According to the implementation, the fourth part of the instructions relates to synchronizing multiple controllers in the computing infrastructure 10 environment, specifically synchronizing the Netbox 210 and OpenStack 220. This synchronization is crucial for maintaining consistency between the physical network configuration and the virtualized network configuration managed by the OpenStack 220.

[0391] According to the implementation, the fifth part of the instructions pertains to the parallel provisioning of multiple devices in compute infrastructure 10 using Netbox 210 and OpenStack 220. This process ensures that new devices are quickly integrated into the existing infrastructure without causing unnecessary downtime or configuration conflicts.

[0392] According to one implementation, an optional feature of this technology involves encrypting data for protection. The goal is to ensure that sensitive information remains confidential even if the physical security of the server is compromised. This encryption feature can be applied transparently at the disk level using a self-encrypting drive (SED) without requiring any modifications to the operating system or application layer.

[0393] According to one embodiment, the present technology relates to a processing system 200 for automating the deployment of computing infrastructure 10. The processing system 200 includes at least one unconfigured server 11 and at least one switch 12. The processing system 200 also includes a processor 300 and a computer-readable medium storing instructions that, when executed by the processor 300, cause various software components to be executed.

[0394] As described above, according to the implementation method, the software component includes at least:

[0395] ● Configuration Management Database (CMDB) module 210, preferably configured to manage and store inventory data related to the unconfigured server 11 and switch 12. Advantageously, this data may include the switch 12's IP address, interface, VLAN, zone name, and configuration template;

[0396] ● Deployment module 220, preferably configured to deploy computing infrastructure 10. Advantageously, deployment module 220 is configured to receive instructions from CMDB module 210 regarding inventory data of unprovisioned servers 11 and switches 12. Deployment module 220 then uses this information to provision the network stack and pushes the configuration to switches 12 after startup;

[0397] ● Communication module 230, preferably, is configured to allow communication between CMDB module 210 and deployment module 220, and to manage at least one Dynamic Host Configuration Protocol (DHCP) interface module. Advantageously, communication module 230 initializes the discovery process by configuring the interface in the discovery VLAN using server management module 270. Once the rack is pre-provisioned, each server 11 is discovered by deployment module 220 upon startup, and the server becomes user-manageable.

[0398] ●Configuration module 240, preferably, is configured to initialize CMDB module 210 using information related to switch 12 and its configuration. This data may include the IP address, interfaces, VLANs, zone names, and configuration templates of switch 12. Based on this information, configuration module 240 is configured to generate DHCP services for IPMI and the management network, as well as rendered configurations for switch 12, thereby allowing for pre-configuration.

[0399] ● Network Operation Gateway (NOG) module 250, preferably, is configured to boot switch 12 by receiving configuration data from CMDB module 210 and applying the received configuration to switch 12. This process ensures proper initialization and configuration of the network infrastructure during the deployment of computing infrastructure 10;

[0400] ● Domain Name System (DNSMasq) module 260, which is configured to manage DNS services in computing infrastructure 10. It uses standard protocols such as DHCP to respond to requests from server 11 and provide it with the necessary configurations.

[0401] ● Optionally, server management module 270, preferably configured to manage and control the provisioning, deployment, and lifecycle of unprovisioned servers 11 within the computing infrastructure 10 environment. It interacts with other components such as deployment module 220 and network virtualization and orchestration components 290, such as Neutron, to ensure seamless integration of new servers 11 into the existing infrastructure while maintaining security and consistency;

[0402] ● Optionally, the key management module 280 is preferably configured to manage and securely store the encryption keys of the various components of the computing infrastructure 10 to ensure that only authorized users can access these keys. It automatically performs the generation, distribution, and rotation of encryption keys during server provisioning and deployment.

[0403] Optionally, the network virtualization and orchestration module 290 (referred to as Neutron) is preferably configured to manage and create virtual networks, subnets, routers, firewalls, load balancers, and other related network components within the computing infrastructure 10. It automates network configuration and management tasks, thereby ensuring efficient and consistent deployment and maintenance of network services within the computing infrastructure 10 environment.

[0404] According to an implementation, the processing system 200 may further include at least one master NOG 251 and at least a plurality of slave NOGs 252. The master NOG 251 stores data about the plurality of switches 12, while each slave NOG 252 contains only data about one of the plurality of switches 12. Preferably, in this multi-NOG configuration, the master NOG 251 is able to configure all shared elements because it knows about all switches 12. Conversely, each slave NOG 252 only has information about its own switch 12 and cannot access the configuration of the other switches 12.

[0405] According to the implementation, a new solution is needed to address the challenges of managing large network infrastructures using a single automated instance of NOG in the data center. Indeed, multiple NOG instances are required to improve availability, resilience, and security, while maintaining the ability to share common information for local configuration management.

[0406] According to the implementation method, and as Figure 7a and Figure 7bAs shown, this technology provides an extension to an existing NOG architecture to support multiple instances. Each MiniPod (i.e., a rack group) can run its local NOG instance using an associated orchestrator (e.g., deployment module 220, also known as OpenStack). Preferably, a MiniPod is a predetermined number of racks managed by the same deployment module 220. This setup eliminates the need for a centralized, single point of failure instance and allows for better management of different responsibility areas within the network architecture.

[0407] A key advantage of this solution is the absence of direct interaction between the shared device and the local instances, significantly reducing the attack surface and enhancing security. However, ensuring that these local instances can still be effectively managed with their local configurations is crucial.

[0408] According to the implementation, to achieve this objective, this technology provides a mechanism for sharing public information among local NOG instances. This can be achieved through a centralized database or distributed data store accessible to all instances. By enabling each instance to access and use the shared information, they will be able to manage their local configuration while maintaining consistency with the overall network architecture configuration.

[0409] According to the implementation, the proposed solution for managing computing infrastructure networks involves splitting the Network Operations Gateway (NOG) into a central instance (i.e., the primary instance) and local instances (i.e., the secondary instances), each managed by a separate orchestrator. This design allows for better availability, resilience, and security because it eliminates the need for single-point-of-failure instances and enables the division of different responsibility zones within the network architecture. The central NOG instance, hosted on the primary controller (NUC0), manages local TOR (top-rack) and EDGE devices, while each client controller hosts a local NOG instance to manage its dedicated TOR devices.

[0410] Figure 7a and Figure 7b These are diagrams illustrating the concept of multiple Network Operational Gateway (NOG) instances in a computing infrastructure 10 according to an embodiment of the present technology. These diagrams demonstrate how a central NOG instance manages local TOR (top-rack) devices and EDGE devices, while each client controller hosts a local NOG instance to manage its dedicated TOR devices.

[0411] According to the implementation method, and as Figure 7aAs shown, in this advanced design, the central NOG instance manages the local TOR and EDGE devices, providing network service connectivity to external networks or devices. On the other hand, local NOG instances manage their respective dedicated TOR devices, enabling customers to manage their own local network resources through their local NOG instances. To facilitate sharing information used to build shared services, NOG instances can declare nodes as "remote," thus eliminating the need for configuration management.

[0412] The benefits of this solution include improved availability and resilience due to the elimination of single points of failure, and the ability to manage different areas of responsibility within the network architecture. Additionally, the design provides enhanced security because each customer has control over their local network resources through their dedicated NOG instance. The ability to share information between instances allows for the construction of shared services while minimizing direct interaction between shared devices and local instances.

[0413] In this implementation, the local NOG (also known as the slave NOG) manages the top-of-rack (ToR) devices within the rack and is aware of remote nodes outside its range, but cannot modify their configurations. This local NOG is addressed by the local orchestrator. On the other hand, the central NOG manages nodes located outside the rack or not managed by the local NOG instance. The central NOG creates and deletes services (evpnedges) on these nodes to allow configuration on the local ToR and is aware of the ToR devices as remote nodes. The central NOG synchronizes tasks, pushes configurations, and manages these remote nodes as needed.

[0414] In this implementation, each local NOG (i.e., a slave NOG) plays a role in managing the network infrastructure within the rack, ensuring that ToR devices are correctly configured and operate optimally. By knowing the remote nodes, the local NOG can use that information for local purposes but does not have the ability to change their configurations. This separation of responsibilities allows for better organization and management of the data center network. The local NOG is a component that allows for the maintenance of the overall network infrastructure while ensuring the efficient and effective operation of each rack.

[0415] In another implementation, the central NOG (i.e., the primary NOG) focuses on managing nodes located outside the rack or not managed by the local NOG instance. The central NOG acts as a central hub for managing extended services between local and remote nodes. This central NOG can be configured on a local ToR device. The central NOG's ability to synchronize tasks and manage remote nodes ensures consistency and cohesion throughout the data center network. This separation of responsibilities between the local NOG instance and the central NOG instance enables efficient management and maintenance of large data center networks.

[0416] According to the implementation method, Figure 7b This diagram illustrates an underlying design for configuring services between two Network Operational Gateway (NOG) instances (referred to as "master" and "slave"). These NOG instances manage different parts of the network infrastructure, with the master instance managing devices in one area and the slave instance handling devices in another. The service can be identified using a VxLAN identifier, which is used on both NOG instances to ensure proper synchronization. Preferably, this technique may include a synchronization process involving the creation of specific objects (EDGE1A / B on the slave instance and TOR2A / B on the master instance) and the configuration of these objects on each side using an evpn_edges object.

[0417] According to the implementation, the synchronization process configures services between NOG instances. For example, this synchronization process can begin by creating EDGE1A / B objects on the slave instance and TOR2A / B objects on the master instance. These objects represent network devices that need to be configured as part of the service. Once these objects are created, evpn_edges objects are added to each side to complete the configuration process. evpn_edges objects enable communication between devices and ensure that services function correctly within the data center infrastructure.

[0418] The underlying design for configuring services across NOG instances offers several advantages. By using VxLAN identifiers, the synchronization process ensures that two NOG instances have consistent information about network devices and their configurations. This reduces the likelihood of errors and inconsistencies in the network infrastructure. Additionally, by allowing each NOG instance to perform configuration tasks on its associated switch, this design enables efficient management of the data center environment while maintaining security and reliability.

[0419] According to the implementation method, the multi-NOG configuration in the processing system provides several technical advantages:

[0420] ● Network isolation: By having multiple NOGs, each responsible for managing a specific switch or a group of switches, the network infrastructure is isolated, thereby reducing the risk of unexpected changes or misconfigurations that could affect the entire data center.

[0421] ● Security: Multi-NOG configuration enhances security by restricting access to the configuration and control of the switch to only authorized personnel who manage specific NOGs. This reduces the attack surface and minimizes the potential impact of security vulnerabilities.

[0422] ● Scalability: As data centers grow, adding more switches can be easily managed by creating new NOGs without impacting existing infrastructure or requiring significant changes to the management system.

[0423] ● Flexibility: Each NOG can be configured independently, allowing for customized and tailored solutions for specific use cases or requirements within the data center.

[0424] According to an implementation, this technology includes a multi-controller subsystem for managing and automating the deployment and configuration of computing infrastructure 10. The multi-controller subsystem includes:

[0425] ● Multiple controllers, each responsible for managing a subset of the infrastructure, and

[0426] ● Communication module, which enables seamless communication between controllers.

[0427] This design enhances scalability, improves fault tolerance, and ensures efficient resource utilization by allowing parallel processing and load balancing among controllers.

[0428] According to the implementation, and as previously described, the processing system 200 is configured to automate the deployment and management of computing infrastructure 10, which includes unconfigured servers 11 and switches 12, preferably unconfigured servers 11 and switches 12 in a data center environment.

[0429] Advantageously, this processing system offers several technical advantages:

[0430] ●Minimum footprint: The automated deployment of computing infrastructure 10 using processing system 200 reduces the need for human intervention, resulting in a smaller operating footprint and faster deployment time.

[0431] ●Automated deployment of infrastructure: The processing system 200 automates the process of deploying computing infrastructure 10 (including servers 11 and switches 12), thereby reducing errors and inconsistencies that may occur with manual methods.

[0432] ● Optional security measures against unwanted physical access: The processing system 200 may include features that ensure secure boot and disk encryption for the components of the computing infrastructure 10, thereby providing an additional layer of security to prevent unauthorized access.

[0433] ● Real-time feedback: The synchronization process between Netbox 210 and OpenStack 220 enables real-time feedback, allowing administrators to more effectively monitor and manage the computing infrastructure network.

[0434] ● Parallel processing: The CMDB module 210 and deployment module 220 are used to pre-provision the configuration of multiple devices in the computing infrastructure 10 in parallel, ensuring that new devices are quickly integrated into the existing infrastructure without causing unnecessary downtime or configuration conflicts.

[0435] ● Encryption for data protection: Optional encryption features for data protection ensure that sensitive information remains confidential even if the physical security of server 11 is compromised.

[0436] According to one implementation, this technology relates to the automatic initialization of network configuration in a data center (i.e., computing infrastructure 100). This process 100 may begin, for example, by pre-generating YAML files containing information required to configure network devices. These YAML files are then converted into usable configuration files using processes under the Configuration Management Database (CMDB) module 210 and other tools.

[0437] Preferably, after receiving the pre-filled response file, system 200 performs several steps:

[0438] ● Create network configurations to establish the virtual network required for managing server communication and various network interfaces.

[0439] ● DNS Mask Configuration: The DNS mask is configured with the necessary information to act as the interface between the physical assets and System 200. It uses standard protocols such as DHCP to respond to requests from the server and provide it with the necessary configuration.

[0440] ● Network Device Discovery: Once the DNS mask is configured, network switch 12 can be discovered, and its configuration can be updated based on the information in the YAML file. Switch 12 will then restart, apply the new configuration, and become available for further management.

[0441] According to the implementation, this technology also revolves around a control mechanism that enables request instantiation in data center 10. This mechanism involves using tools such as the Ironic 270 and Netbox 210 to compare the actual configuration with its logically corresponding configuration.

[0442] ● Server Discovery: When a new server 11 is detected, the deployment module 220 (e.g., using OpenStack) begins to perform automated configuration actions on the new server 11, including installing the initial operating system image, registering the server 11 with the Netbox 210, and enriching its inventory.

[0443] ●Configuration Synchronization: Once the server configuration is updated in Netbox 210, Dicious 230 generates the network configuration files required for OpenStack 220 to use, thereby enabling the creation of the appropriate virtual networks, ports and configurations required for the server 11 to run properly.

[0444] ● Server Startup: Once all configurations are in place, server 11 can be started, and it will begin communicating with OpenStack 220 via Ironic 270. This communication enables OpenStack 220 to perform discovery, registration, and management using standard procedures.

[0445] According to the implementation method, this technology also relates to using the Ironic 270 to execute configuration tasks in parallel:

[0446] ● Power Management: The Ironic 270 manages the power status of the servers 11 to ensure they are ready for deployment or maintenance activities, including turning the servers 11 on or off as needed.

[0447] ● Image Deployment: The Ironic 270 can deploy the operating system image and other necessary configurations to the newly added server 11, thereby ensuring consistency and minimizing downtime.

[0448] ● Provisioning: The Ironic 270 can provision new servers 11 with appropriate network configuration, enabling them to be seamlessly integrated into existing data center infrastructure 10. This includes configuring virtual interfaces, IP addresses, and routing tables.

[0449] According to the implementation method, this technology relates to synchronizing multiple controllers in a data center 10 environment, specifically Netbox 210 and OpenStack 220:

[0450] ● Configuration Updates: When the network configuration in the Netbox 210 changes, it is propagated to all connected OpenStack 220 controllers via a well-defined API or communication mechanism.

[0451] ●Automated network reconfiguration: Once the OpenStack 220 controllers receive the updated configuration, they automatically reconfigure virtual networks and other components as needed to maintain consistency with the physical network.

[0452] ● Real-time feedback: This synchronization process enables real-time feedback between Netbox 210 and OpenStack 220, allowing administrators to monitor and manage the data center network more effectively.

[0453] According to another embodiment, this technology also relates to the parallel provisioning of multiple devices in data center 10 using Netbox 210 and OpenStack 220:

[0454] ●Configuration Import: When a new device is added to Data Center 10, its configuration information is imported into Netbox 210.

[0455] ●Automatic configuration propagation: Once the configuration information is imported into the Netbox 210, it will be automatically propagated to all connected OpenStack 220 controllers through a well-defined API or communication mechanism.

[0456] ● Parallel processing: The OpenStack 220 controller processes configuration information simultaneously, enabling more efficient configuration of multiple devices and integration into the data center network.

[0457] ● Feedback and Verification: This process enables real-time feedback between Netbox 210 and OpenStack 220, allowing administrators to verify configuration changes and ensure all devices are functioning correctly.

[0458] This technology also includes optional aspects, namely, using a self-encrypting driver (SED) to encrypt data protection and using the Ironic 270 to automatically manage encryption keys.

[0459] Additionally, this technology also relates to an improved provisioning process, secure boot technology, and data center-as-a-service with distributed auditing and key management. These features bring significant improvements to data security for large data centers by using self-encrypting drives for disk-level encryption, automating the provisioning process with the Ironic 270, enhancing boot security through secure boot technology, and enabling clients to have complete control over their infrastructure while maintaining data security with distributed key management and auditing features.

[0460] A method 800 for securely booting an operating system will now be described in detail. Method 800 is preferably applied to each boot of server 11.

[0461] Method 800 includes a series of consecutive steps, each dedicated to checking the signature of the component. Each subsequent step is executed only if the signature has been verified in the previous step.

[0462] During step 801, the first signature to be verified is the signature of the boot loader, such as GRUB. Only if the first signature has been verified, during step 802, is the second signature to be verified the signature of the operating system kernel. Only if the kernel signature has been verified, during step 803, is the next signature to be verified associated with each module of the kernel to be loaded. Therefore, only a fully signed operating system can be loaded.

[0463] For each inspection step 801 to 803, the signature to be verified is compared with the signature stored in the signature file of the key management module 280. Authentication of each component to be loaded for booting the operating system ensures the secure boot of the operating system.

[0464] Advantageously, the signature file can be updated during step 804. For example, the host control plane (such as a NUC, owned by Intel – a registered trademark) can initially act as the authority to verify the secure boot of the operating system, and later the NUC can act as the authority to verify the secure boot of the operating system.

[0465] Advantageously, method 800 also includes step 805, which is used to update and / or renew the cryptographic certificate required for signature verification.

[0466] Advantageously, the method includes a preliminary step 806 that integrates the server's motherboard API into the server management module to flash or update the BIOS, thereby facilitating use by customers or administrators.

[0467] It is already clear that steps 801 to 806 of method 800 are performed by Ironic.

[0468] Method 800 ensures that any modules booted on the server are in the control of the rightful owner. In fact, it has been observed that servers such as NUCs are shipped pre-installed and cannot be controlled locally. Thanks to Method 800's secure boot, customers are assured that the operating system booted is a clean, unmodified one. Other operating systems will fail to boot.

[0469] With secure boot via method 800, when the NUC is pre-configured, the Ironic is already configured to be application-signed, and the signature is stored in Barbican.

[0470] For the initial boot, but also for every subsequent boot, the complete signature string is checked. First, GRUB is checked (step 801). Method 800 checks if GRUB is signed. If signed, method 800 checks if the signature matches a stored signature. Next, method 800 checks if the kernel is signed (step 802). If unsigned, the kernel cannot be loaded. If signed, the kernel is signed, and method 800 checks all modules the kernel is waiting to load. Typically, NVIDIA modules for the GPU should be signed.

[0471] According to Method 800, everything that needs to run at the CPU level in kernel space must be checked. It must be signed with the correct key; otherwise, the operating system will fail to boot. In other words, Method 800 ensures that only one version of the operating system, which is allowed to be booted, is secure within the system.

[0472] Method 800 ensures that the deployment of Method 100 is robust and reliable, which is even more important when the deployment is automated.

[0473] Unless otherwise stated herein or the context clearly specifies otherwise, the term “approximately” when used to modify numerical quantities implies a margin of error of plus or minus ten percent. Unless otherwise stated herein or the context clearly specifies otherwise, “between two numerical values” should be understood as “between and including both numerical values”.

[0474] This specification includes specific details to provide an understanding of the various disclosed implementations. However, those skilled in the art will recognize that these implementations can be practiced even without one or more of these specific details, parts of the methods, components, materials, etc. In some cases, to avoid unnecessarily obscuring the description of the disclosed implementations, well-known methods associated with artificial intelligence, machine learning, and / or neural networks are not shown or described in detail.

[0475] In this description and the appended claims, the terms "an," "a," "one aspect," or "another aspect" used to describe "implementation," "example," or "mode of implementation" are used to mean that a specific reference feature, structure, or characteristic described in relation to that implementation, example, or mode of implementation is included in at least one implementation, example, or mode of implementation. Therefore, phrases such as "in one implementation," "in an implementation," or "another implementation" do not necessarily refer to the same implementation. Furthermore, specific features, structures, or characteristics may be combined in any suitable manner in one or more implementations, examples, or modes of implementation.

[0476] As used in this description and the appended claims, the singular forms of articles such as “a,” “an,” and “the” may include plural references unless the context otherwise requires. Unless the context otherwise requires, the word “comprising” and its variations, such as “including” and “comprise”, shall be interpreted in an open, inclusive sense, meaning “including but not limited to.”

[0477] Modifications and improvements to the above-described implementation of this technology may become apparent to those skilled in the art. The foregoing description is intended to be illustrative and not restrictive. Therefore, the scope of this technology is limited only by the scope of the appended claims.

[0478] Figure Labels

[0479] 10 Computing Infrastructure

[0480] 11 servers

[0481] 12 switches

[0482] 100 A computer-implemented method for automatically deploying at least one computing infrastructure

[0483] 110 Access to computer-readable media

[0484] 120 Calculated Data

[0485] 130 Initialize the software components

[0486] 140. Confirm the configuration.

[0487] 150 pairs of at least one network stack are pre-configured

[0488] 160 declares at least one network

[0489] 170 will synchronize the deployment module with the CMDB module.

[0490] 180 Start at least one unconfigured server

[0491] 200 processing system

[0492] 210 Configuration Management Database (CMDB) Module

[0493] 220 Deployment Module

[0494] 230 Communication Module

[0495] 240 Configuration Module

[0496] 250 Network Operation Gateway (NOG) Module

[0497] 251 main NOG

[0498] 252 from NOG

[0499] 260 Domain Name System Module

[0500] 270 Server Management Module

[0501] 280 Key Management Module

[0502] 290 Network Virtualization and Orchestration Components

[0503] 300 processor.

Claims

1. A computer-implemented method (100) for automatically deploying a computing infrastructure (10), the computing infrastructure (10) comprising at least one unprovisioned server (11) and at least one switch (12), the method (100) comprising: Access (110) to a computer-readable medium, the computer-readable medium including instructions that, when operated by a processor (300), cause a software component to be executed, the software component comprising: Server management module (270); A key management module (280) is configured to store signature files; Configuration Management Database (CMDB) module (210) is configured to manage and store inventory data relating to the at least one unconfigured server (11) and the at least one switch (12); A deployment module (220) configured to deploy the computing infrastructure (10); A communication module (230) is configured to allow communication between the CMDB module (210) and the deployment module (220), and to manage at least one Dynamic Host Configuration Protocol (DHCP) interface module; A configuration module (240) is configured to initialize the configuration management database module (210) using information related to the configuration of the at least one switch (12) and the at least one switch (12); A Network Operation Gateway (NOG) module (250) configured to control and manage the at least one switch (12) by receiving configuration data from the CMDB module (210) and applying the received configuration to the at least one switch (12); and Domain Name System (DNS) module (260), which is configured to manage the Domain Name System services in the computing infrastructure (10); The CMDB module (210) is used to determine (140) the configuration for the following: A communication module (230) on at least one Intelligent Platform Management Interface (IPMI) and at least one management network; and Based on at least one switch (12) to be pre-configured from the CMDB module (210); At least one network stack is pre-configured (150) using pre-configuration data from the CMDB module (210), the pre-configuration data including data related to network devices, interfaces, networks, and configurations determined by the CMDB module (210), the pre-configuration (150) including: pre-configuring the DNS module (260); and pre-configuring the network operation gateway module (250); Declare (160) at least one network in the deployment module (220); and The deployment module (220) is synchronized (170) with the CMDB module (210) so that the deployment module (220) can use the communication module (230) to initiate the server discovery process in order to start the at least one server (11); During each startup of the at least one server (11) by the IPMI, the server management module (270) compares a set of at least one signatures stored by the key management module (280), the set of at least one signatures being associated with a component to be loaded to start the operating system, and, based on the comparison result, if all signatures of the set are listed in the signature file of the key management module (280), the server management module (270) verifies the loading of the operating system such that only a fully signed operating system is loaded during the startup of the at least one server; and The deployment module (220) includes a network virtualization and orchestration component configured to allow the creation of virtual networks, subnets, routers, firewalls, load balancers and other related network components within the deployment module (220); and to manage the virtual networks, subnets, routers, firewalls, load balancers and other related network components.

2. The method according to claim 1, wherein, The execution of the software component also includes: The calculation (120) is used to initialize the CMDB module (210) and the calculated data includes at least one Internet Protocol (IP) address of the at least one switch (12); The configuration module (240) initializes at least a portion of the software components (130) by initializing the CMDB module (210) with calculated data and configuring the DNS module (260) with the configuration from the CMDB module (210).

3. The method according to claim 1, wherein, The server discovery process includes: Initialization steps: Power off the server (11) that is unknown to the deployment module (220) and the CMDB module (210); and The network interface is configured by the network virtualization and orchestration component (290) in a manner that discovers Virtual Local Area Network (VLAN) modes; Discovery steps: Power on the server (11); The server (11) is started via the network; The server (11) loads at least one agent, which is configured to analyze the server (11) and the at least one switch (12), generate a report including the analysis results, and send the report to the deployment module (220); The communication module (230) is used to synchronize the deployment module (220) with the CMDB module (210); Conclusion of discovery: Power on the server (11) that has been de-energized; and The network interface is deconfigured from the discovery VLAN mode using the network virtualization and orchestration component (290) and placed in the isolation mode (quarantine).

4. The method according to claim 1, wherein, The first signature in the set of signatures to be compared is associated with the bootloader.

5. The method according to claim 4, wherein, If the first signature has been verified, the second signature to be compared is associated with the kernel of the operating system.

6. The method according to claim 5, wherein, If the second signature is verified, at least one subsequent signature is associated with any module loaded by the kernel.

7. The method of claim 1, wherein the method includes a preliminary step of integrating the API of the server's motherboard into the server management module.

8. The method according to claim 1, wherein, The deployment module (220) is configured to: The communication module (230) is used to detect at least one new server (11); The communication module (230) is used to send the port number of the new server (11) and the switch (12) number to the CMDB module (210); and The discovery mode of the new server (11) is cleared using the communication module (230).

9. The method according to claim 8, wherein, Deleting the server (11) from the deployment module (220) causes the corresponding entry in the CMDB module (210) to be deleted and the discovery process to be reset.

10. The method of claim 1, further comprising managing the Internet Protocol (IP) addresses in the computing infrastructure (10) in the following manner: All required IP addresses are pre-calculated according to a set of rules; and The calculated IP address is stored and transmitted to the appropriate component in the network via the communication module (230).

11. The method of claim 1, further comprising managing the cluster of the distributed computing infrastructure (10) in the following manner: The computing components in each computing infrastructure (10) of the distributed computing infrastructure (10) are deployed and configured using an automated process; The configuration is pulled across all computing infrastructures of the distributed computing infrastructure (10); Monitor performance and resource utilization; as well as Implement security measures to prevent unauthorized access or data breaches.

12. A computing infrastructure (10) comprising at least one unconfigured server (11), at least one switch (12), and a processing system (200) wherein the processing system (200) automatically deploys the computing infrastructure (10) by performing the method according to any one of claims 1 to 11 when executing computer-readable instructions.

13. A computer-readable storage medium storing instructions that, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 11.

Images