Computing target and identity with access management integration for data science workload execution

Abstract

A system receives a configuration request that includes defining a set of resource infrastructure definitions to be selected from a set of tenant-managed resources implemented on a tenant venue for implementing a computing target entity. The system generates a computing target entity associated with the addressable identifier. The computing target entity corresponds to a set of resources selected from the set of resources managed by the tenants. The system receives an execution request for performing a set of operations, wherein the execution request specifies an addressable identifier associated with the compute target entity for performing the set of operations. The system maps an addressable identifier of the computing target entity to the set of resources. The system causes the set of operations to be performed on the set of resources of the tenant venue via the computing target entity.

Description

[0001] By incorporating through citation; abandoning the declaration

[0002] The following applications are hereby incorporated herein by reference: Application 18 / 519,807, filed November 27, 2023; and Application 63 / 583,287, filed September 17, 2023. The applicant hereby withdraws any disclaimers regarding the scope of claims in the parent applications(s) or their examination history, and informs the U.S. Patent and Trademark Office that the claims in this application may be more extensive than any claims in the parent applications(s). Technical Field

[0003] This disclosure relates to executing service provider applications on tenant-controlled infrastructure. Specifically, this disclosure relates to creating a computation target entity with credentials that allow the computation target entity to access a set of tenant-managed resources on behalf of a service provider application. Background Technology

[0004] Cloud service providers can offer data services for applications to perform computationally intensive and / or computationally complex operations using the cloud service itself. Data services may include, for example, machine learning operations, artificial intelligence operations, simulations of complex systems, scientific and engineering operations, etc. Data service systems typically use computing infrastructure owned and controlled by the cloud service. If resources within the infrastructure are in use, the data service may not be able to fulfill the customer's requested work at the requested time.

[0005] Some cloud service tenants own and control their own infrastructure. Such tenants may prefer to use the infrastructure they control for data security reasons and / or because their own infrastructure is usually always available when needed. However, data services operated by cloud service providers do not have access to infrastructure controlled by tenants.

[0006] The solutions described in this section are feasible solutions, but not necessarily solutions that have been previously conceived or adopted. Therefore, unless otherwise stated, any solution described in this section should not be assumed to be prior art simply because it is included in this section. Attached Figure Description

[0007] The accompanying figures illustrate embodiments by way of example and not limitation. It should be noted that the terms "a" or "an" embodiment used in this disclosure do not necessarily refer to the same embodiment, and mean at least one. In the figures:

[0008] Figure 1 This is a block diagram illustrating a pattern for implementing a cloud infrastructure as a service system according to at least one embodiment;

[0009] Figure 2 This is a block diagram illustrating another pattern for implementing a cloud infrastructure as a service system according to at least one embodiment;

[0010] Figure 3 This is a block diagram illustrating another pattern for implementing a cloud infrastructure as a service system according to at least one embodiment;

[0011] Figure 4 This is a block diagram illustrating another pattern for implementing a cloud infrastructure as a service system according to at least one embodiment;

[0012] Figure 5 This is a block diagram illustrating an example computer system according to at least one embodiment;

[0013] Figure 6 The illustration shows a system according to one or more embodiments;

[0014] Figure 7 The illustration depicts a set of example operations for executing service provider applications on tenant-controlled infrastructure, according to one or more embodiments;

[0015] Figure 8 Examples of graphical user interfaces according to one or more embodiments are illustrated; and

[0016] Figure 9 An example of a GUI for requesting the execution of a set of operations, according to one or more embodiments, is illustrated. Detailed Implementation

[0017] In the following description, numerous specific details are set forth for purposes of explanation in order to provide a thorough understanding. One or more embodiments may be practiced without these specific details. Features described in one embodiment may be combined with features described in different embodiments. In some examples, well-known structures and devices are described in the form of block diagrams to avoid unnecessarily obscuring the invention.

[0018] 1. General Overview

[0019] 2. Infrastructure as a Service

[0020] 3. Service Provider Architecture

[0021] 4. Run service provider applications on tenant-controlled infrastructure.

[0022] 5. Example Implementation

[0023] 6. Practical applications, advantages, and improvements

[0024] 7. Other matters; extension

[0025] 1. General Overview

[0026] One or more embodiments implement a graphical user interface (GUI) that enables a tenant to perform operations using one or more applications of a service provider and a set of tenant-managed resources located at the tenant's premises. The service provider system displays the GUI to enable the tenant to select, configure, and utilize the set of tenant-managed resources located at the tenant's premises.

[0027] Initially, a GUI presented by the service provider system receives a creation request to create a compute target entity as an abstraction layer for managing a set of resources selected from the group of tenant-managed resources located in the tenant's premises. The creation request includes an infrastructure definition defining the set of resources within the group of tenant-managed resources. The defined set of resources includes (a) a set of physical infrastructure resources (e.g., GPUs) on the tenant's premises and / or (b) a set of virtual resources executed on that set of physical infrastructure resources on the tenant's premises. Virtual resources may include, for example, compute, storage, and networking resources.

[0028] The service provider system generates a compute target entity as an addressable entity with an addressable identifier corresponding to that set of resources. The compute target entity is generated using its own set of credentials for accessing one or more resources managed by the tenant. The compute target entity may also be assigned a role from a set of roles, and a corresponding set of permissions. The compute target entity may be allowed to access one or more namespaces from a set of namespaces implemented across tenant-managed resources. The set of resources mapped to the compute target entity includes the resources permitted by the role assigned to the compute target entity, the credentials corresponding to the compute target entity, and the namespace(s)(s) accessible to the compute target entity.

[0029] The service provider system receives an execution request from a tenant via a GUI, requesting the execution of a set of operations. The execution request specifies a previously defined and created target compute entity. Upon receiving the execution request, the service provider system executes an application to complete the requested operations. This application generates a set of commands that, when executed, complete the requested operations. Associated with the target compute entity, the service provider system transmits this set of commands to the tenant resource manager associated with the set of resources managed by that tenant. The set of commands is transmitted for execution on the set of resources associated with the target compute entity. The tenant resource manager evaluates the permissions and restrictions associated with the target compute entity to verify that the target compute entity is permitted to execute commands on the set of resources. Upon determining that the target compute entity is permitted to execute commands on the set of resources, the tenant resource manager initiates the execution of the received set of commands using the set of resources.

[0030] One or more embodiments described in this specification and / or claimed in the claims may not be included in this general overview section.

[0031] 2. Infrastructure as a Service

[0032] As indicated above, Infrastructure as a Service (IaaS) is a specific type of cloud computing. IaaS can be configured to provide virtualized computing resources over a public network (e.g., the Internet). In the IaaS model, cloud providers can host infrastructure components (e.g., servers, storage devices, network nodes (e.g., hardware), deployment software, platform virtualization (e.g., hypervisor layer), etc.). In some cases, IaaS providers can also offer various services to accompany these infrastructure components (example services include billing software, monitoring software, logging software, load balancing software, clustering software, etc.). Therefore, because these services can be policy-driven, IaaS users can implement policies to drive load balancing to maintain application availability and performance.

[0033] In some cases, IaaS customers can access resources and services over a wide area network (WAN) such as the Internet and can use the cloud provider's services to install the remaining elements of the application stack. For example, a user can log in to the IaaS platform to create virtual machines (VMs), install an operating system (OS) on each VM, deploy middleware such as databases, create buckets for workloads and backups, and even install enterprise software into the VM. The customer can then use the provider's services to perform various functions, including balancing network traffic, troubleshooting application problems, monitoring performance, and managing disaster recovery.

[0034] In most cases, cloud computing models will require the involvement of cloud providers. Cloud providers can, but do not need to, be third-party providers specializing in (e.g., provisioning, renting, selling) IaaS services. Entities can also choose to deploy private clouds, becoming their own infrastructure service providers.

[0035] In some examples, IaaS deployment is the process of placing a new application or a new version of an application onto a prepared application server, etc. It may also include the processing of the preparation server (e.g., installation libraries, daemons, etc.). This is typically managed by the cloud provider under the hypervisor layer (e.g., servers, storage devices, network hardware, and virtualization). Therefore, the customer can be responsible for processing (OS), middleware, and / or application deployment (e.g., on self-service virtual machines, etc., which can be started on demand).

[0036] In some examples, IaaS provisioning can refer to acquiring a computer or virtual host for use, or even installing necessary libraries or services on it. In most cases, deployment does not include provisioning, and provisioning may need to be performed first.

[0037] In some cases, there are two distinct challenges to IaaS provisioning. First, there is the initial challenge of provisioning the initial set of infrastructure before anything can run. Second, there is the challenge of evolving the existing infrastructure after everything has been provisioned (e.g., adding new services, changing services, removing services, etc.). In some cases, these challenges can be addressed by enabling the configuration of the infrastructure to be declaratively defined. In other words, the infrastructure (e.g., what components are needed and how they interact) can be defined by one or more configuration files. Therefore, the overall topology of the infrastructure can be declaratively described (e.g., which resources depend on which resources and how each of them works together). In some cases, after the topology is defined, workflows for creating and / or managing the different components described in the configuration files can be generated.

[0038] In some examples, the infrastructure can have many interconnected elements. For example, there may be one or more Virtual Private Clouds (VPCs) (e.g., potential on-demand pools of configurable and / or shared computing resources), also known as the core network. In some examples, there may also be one or more inbound / outbound traffic group rules, provisioned to define how inbound and / or outbound traffic will be structured for the network, and one or more virtual machines (VMs). Other infrastructure elements, such as load balancers, databases, etc., may also be provisioned. The infrastructure can evolve incrementally as more and / or additional infrastructure elements are desired.

[0039] In some cases, continuous deployment techniques can be used to enable the deployment of infrastructure code across various virtual computing environments. Additionally, the described techniques can enable infrastructure management within these environments. In some examples, service teams may write code that they expect to deploy to one or more (but often multiple) different production environments (e.g., across various geographical locations, sometimes across the world). However, in some examples, the infrastructure on which the code will be deployed must first be established. In some instances, provisioning can be done manually, provisioning tools can be used to provision resources, and / or deployment tools can be used to deploy the code after the infrastructure has been provisioned.

[0040] Figure 1This is a block diagram 100 illustrating an example pattern of an IaaS architecture according to at least one embodiment. Service operator 102 may be communicatively coupled to secure host lease 104, which may include a virtual cloud network (VCN) 106 and a secure host subnet 108. In some examples, service operator 102 may use one or more client computing devices, which may be portable handheld devices (e.g., iPhone®, cellular phone, iPad®, computing tablet, personal digital assistant (PDA)) or wearable devices (e.g., Google Glass® head-mounted display), running software such as Microsoft Windows Mobile® and / or various mobile operating systems such as iOS, Windows Phone, Android, BlackBerry 8, PalmOS, and enabled for the Internet, email, short message service (SMS), Blackberry®, or other communication protocols. Alternatively, client computing devices may be general-purpose personal computers, including, for example, personal computers and / or laptops running various versions of Microsoft Windows®, Apple Macintosh®, and / or Linux operating systems. The client computing device can be a workstation computer running various commercial UNIX® or UNIX-like operating systems (including, but not limited to, various GNU / Linux operating systems, such as Google Chrome OS). Alternatively, or additionally, the client computing device can be any other electronic device, such as a thin client computer, an internet-enabled gaming system (e.g., a Microsoft Xbox game console with or without Kinect® gesture input), and / or a personal messaging device capable of communicating over a network that can access VCN 106 and / or the internet.

[0041] VCN 106 may include a local peering gateway (LPG) 110, which may be communicatively coupled to a secure shell (SSH) VCN 112 via LPG 110 included in SSH VCN 112. SSH VCN 112 may include an SSH subnet 114, and SSH VCN 112 may be communicatively coupled to a control plane VCN 116 via LPG 110 included in control plane VCN 116. Furthermore, SSH VCN 112 may be communicatively coupled to a data plane VCN 118 via LPG 110. Control plane VCN 116 and data plane VCN 118 may be contained within a service lease 119 that may be owned and / or operated by an IaaS provider.

[0042] The control plane VCN 116 may include a control plane demilitarized zone (DMZ) layer 120 that acts as a peripheral network (e.g., a portion of a corporate network between an intranet and an external network). DMZ-based servers can assume limited liability and help keep violations contained. Additionally, the DMZ layer 120 may include one or more load balancer (LB) subnets 122, a control plane application layer 124 that may include one or more application subnets 126, and a control plane data layer 128 that may include one or more database (DB) subnets 130 (e.g., one or more front-end DB subnets and / or one or more back-end DB subnets). One or more LB subnets 122 contained in the control plane DMZ layer 120 may be communicatively coupled to one or more application subnets 126 contained in the control plane application layer 124 and an Internet gateway 134 that may be contained in the control plane VCN 116. The application subnets 126 may be communicatively coupled to one or more DB subnets 130 contained in the control plane data layer 128, as well as a service gateway 136 and a Network Address Translation (NAT) gateway 138. The control plane VCN 116 may include the service gateway 136 and the NAT gateway 138.

[0043] The control plane VCN 116 may include a data plane mirror application layer 140, which may include one or more application subnets 126. The one or more application subnets 126 included in the data plane mirror application layer 140 may include a virtual network interface controller (VNIC) 142 capable of executing a compute instance 144. The compute instance 144 may communicatively couple the one or more application subnets 126 of the data plane mirror application layer 140 to the one or more application subnets 126 that may be included in the data plane application layer 146.

[0044] Data plane VCN 118 may include data plane application layer 146, data plane DMZ layer 148, and data plane data layer 150. Data plane DMZ layer 148 may include one or more application subnets 126 communicatively coupled to data plane application layer 146 and one or more LB subnets 122 communicatively coupled to Internet gateway 134 of data plane VCN 118. One or more application subnets 126 may be communicatively coupled to service gateway 136 and NAT gateway 138 of data plane VCN 118. Data plane data layer 150 may also include one or more DB subnets 130 communicatively coupled to one or more application subnets 126 of data plane application layer 146.

[0045] Internet gateway 134 of control plane VCN 116 and data plane VCN 118 can be communicatively coupled to metadata management service 152, which can be communicatively coupled to public internet 154. Public internet 154 can be communicatively coupled to NAT gateway 138 of control plane VCN 116 and data plane VCN 118. Service gateway 136 of control plane VCN 116 and data plane VCN 118 can be communicatively coupled to cloud service 156.

[0046] In some examples, the service gateway 136 of the control plane VCN 116 or the data plane VCN 118 can make application programming interface (API) calls to the cloud service 156 without traversing the public internet 154. The API call from the service gateway 136 to the cloud service 156 can be unidirectional: the service gateway 136 can make an API call to the cloud service 156, and the cloud service 156 can send requested data to the service gateway 136. However, the cloud service 156 may not initiate an API call to the service gateway 136.

[0047] In some examples, secure host lease 104 can be directly connected to service lease 119, which would otherwise be isolated. Secure host subnet 108 can communicate with SSH subnet 114 via LPG 110, which enables bidirectional communication over an otherwise isolated system. Connecting secure host subnet 108 to SSH subnet 114 grants secure host subnet 108 access to other entities within service lease 119.

[0048] Control plane VCN 116 may allow users of service lease 119 to configure or otherwise provision desired resources. The desired resources provisioned in control plane VCN 116 may be deployed or otherwise used in data plane VCN 118. In some examples, control plane VCN 116 may be isolated from data plane VCN 118, and the data plane mirror application layer 140 of control plane VCN 116 may communicate with the data plane application layer 146 of data plane VCN 118 via VNIC 142, which may be included in both the data plane mirror application layer 140 and the data plane application layer 146.

[0049] In some examples, a user or client of the system may make a request (e.g., a create, read, update, or delete (CRUD) operation) via the public internet 154, which can then forward the request to the metadata management service 152. The metadata management service 152 can forward the request to the control plane VCN 116 via internet gateway 134. The request may be received by one or more LB subnets 122 contained in the control plane DMZ layer 120. The LB subnets 122 can determine that the request is valid, and in response to this determination, they can forward the request to one or more application subnets 126 contained in the control plane application layer 124. If the request is authenticated and requires a call to the public internet 154, the call to the public internet 154 can be forwarded to a NAT gateway 138 that can make the call to the public internet 154. The request may expect that the metadata to be stored can be stored in one or more DB subnets 130.

[0050] In some examples, the data plane mirroring application layer 140 can facilitate direct communication between the control plane VCN 116 and the data plane VCN 118. For example, it may be desirable to apply configuration changes, updates, or other appropriate modifications to resources contained in the data plane VCN 118. Through VNIC 142, the control plane VCN 116 can communicate directly with the resources contained in the data plane VCN 118, and thus can perform configuration changes, updates, or other appropriate modifications to the resources contained in the data plane VCN 118.

[0051] In some embodiments, the control plane VCN 116 and data plane VCN 118 may be contained within a service lease 119. In this case, the system's users or customers may not own or operate the control plane VCN 116 or data plane VCN 118. Alternatively, the IaaS provider may own or operate both the control plane VCN 116 and data plane VCN 118, both of which may be contained within the service lease 119. This embodiment can enable network isolation that prevents users or customers from interacting with the resources of other users or customers. Moreover, this embodiment can allow the system's users or customers to privately store databases without relying on the public internet 154, which may not have the desired level of threat prevention.

[0052] In other embodiments, one or more LB subnets 122 included in the control plane VCN 116 may be configured to receive signals from the service gateway 136. In this embodiment, the control plane VCN 116 and the data plane VCN 118 may be configured to be invoked by the IaaS provider's customers without invoking the public internet 154. The IaaS provider's customers may desire this embodiment because the database(s) used by the customer can be controlled by the IaaS provider and can be stored on a service lease 119 that can be isolated from the public internet 154.

[0053] Figure 2 This is a block diagram 200 illustrating another example pattern of an IaaS architecture according to at least one embodiment. Service operator 202 (e.g., Figure 1 Service provider 102) can communicatively couple to secure host lease 204 (e.g., Figure 1 Secure hosting lease 104), the secure hosting lease may include a Virtual Cloud Network (VCN) 206 (e.g., Figure 1 VCN106) and Secure Host Subnet 208 (e.g., Figure 1 The secure host subnet 108). VCN 206 may include a local peering gateway (LPG) 210 (e.g., Figure 1 The LPG 110), which can be communicatively coupled to the Secure Shell (SSH) VCN 212 (e.g., via the LPG 110 contained in the SSH VCN 212) Figure 1 SSH VCN 212 can include SSH subnet 214 (e.g., SSH VCN 212). Figure 1 SSH subnet 114), and SSH VCN 212 can be communicatively coupled to control plane VCN 216 via LPG 210 contained in control plane VCN 216 (e.g., Figure 1 Control plane VCN 216). Control plane VCN 216 may be included in service lease 219 (e.g., Figure 1 In the service lease 119), and the data plane VCN 218 (e.g., Figure 1 The data plane VCN 118 can be included in a customer lease 221 that can be owned or operated by the system’s users or customers.

[0054] Control plane VCN 216 may include control plane DMZ layer 220 (e.g., Figure 1 The control plane DMZ layer 120 may include one or more LB subnets 222 (e.g., Figure 1(One or more) LB subnets 122), may include (one or more) application subnets 226 (e.g., Figure 1 The control plane application layer 224 of (one or more) application subnets 126 (e.g., Figure 1 The control plane application layer 124) may include one or more database (DB) subnets 230 (e.g., similar to...). Figure 1 The control plane data layer 228 of (one or more) DB subnets 130) (e.g., Figure 1 The control plane data layer 128). One or more LB subnets 222 contained in the control plane DMZ layer 220 can be communicatively coupled to one or more application subnets 226 contained in the control plane application layer 224 and an Internet gateway 234 that can be contained in the control plane VCN 216 (e.g., Figure 1 Internet gateway 134), and application subnet(s) 226 can communicatively couple to DB subnet(s) 230 contained in control plane data layer 228 and service gateway 236 (e.g., Figure 1 Service gateway 136) and Network Address Translation (NAT) gateway 238 (e.g., Figure 1 (NAT gateway 138). The control plane VCN 216 may include the service gateway 236 and the NAT gateway 238.

[0055] The control plane VCN 216 may include a data plane mirror of the application layer 240 (e.g., Figure 1 The data plane mirror application layer 140 may include one or more application subnets 226. The application subnets 226 included in the data plane mirror application layer 240 may include instances 244 capable of performing computations (e.g., similar to...). Figure 1 The virtual network interface controller (VNIC) 242 (e.g., the VNIC of 142) of the computing instance 144. The computing instance 244 may facilitate the mirroring of the application subnet(s) 226 of the application layer 240 in the data plane and may be included in the application layer 246 in the data plane (e.g., Figure 1 Communication between one or more application subnets 226 in the data plane application layer 146 via VNIC 242 contained in the data plane mirror application layer 240 and VNIC 242 contained in the data plane application layer 246.

[0056] The Internet gateway 234 included in the control plane VCN 216 can be communicatively coupled to the metadata management service 252 (e.g., Figure 1 Metadata management service 152), which can communicatively couple to the public Internet 254 (e.g., Figure 1 The public internet 254 can communicatively couple to a NAT gateway 238 contained in the control plane VCN 216. The service gateway 236 contained in the control plane VCN 216 can communicatively couple to a cloud service 256 (e.g., ...). Figure 1 Cloud services (156).

[0057] In some examples, data plane VCN 218 may be included in customer lease 221. In this case, the IaaS provider may provide control plane VCN 216 for each customer, and the IaaS provider may set up a unique compute instance 244 for each customer, included in service lease 219. Each compute instance 244 may allow communication between control plane VCN 216 included in service lease 219 and data plane VCN 218 included in customer lease 221. Compute instance 244 may allow resources provisioned in control plane VCN 216 included in service lease 219 to be deployed or otherwise used in data plane VCN 218 included in customer lease 221.

[0058] In other examples, an IaaS provider's customer may have a database residing in customer lease 221. In this example, control plane VCN 216 may include a data plane mirror application layer 240, which may include one or more application subnets 226. Data plane mirror application layer 240 may reside in data plane VCN 218, but it may not reside in data plane VCN 218. That is, data plane mirror application layer 240 may have access to customer lease 221, but it may not reside in data plane VCN 218 or be owned or operated by an IaaS provider's customer. Data plane mirror application layer 240 may be configured to make calls to data plane VCN 218, but it may not be configured to make calls to any entity contained in control plane VCN 216. Customers may expect to deploy or otherwise use resources provided in the control plane VCN 216 in the data plane VCN 218, and the data plane mirroring application layer 240 can facilitate the customer's desired deployment or other use of resources.

[0059] In some embodiments, an IaaS provider's customer can apply filters to data plane VCN 218. In this embodiment, the customer can determine what data plane VCN 218 can access, and the customer can restrict access from data plane VCN 218 to the public internet 254. The IaaS provider may not be able to apply filters or otherwise control data plane VCN 218's access to any external networks or databases. Applying filters and controls to data plane VCN 218 contained in customer lease 221 helps isolate data plane VCN 218 from other customers and the public internet 254.

[0060] In some embodiments, cloud service 256 may be invoked by service gateway 236 to access services that may not exist on public internet 254, control plane VCN 216, or data plane VCN 218. The connection between cloud service 256 and control plane VCN 216 or data plane VCN 218 may not be real-time or continuous. Cloud service 256 may reside on different networks owned or operated by an IaaS provider. Cloud service 256 may be configured to receive calls from service gateway 236 and may be configured not to receive calls from public internet 254. Some cloud services 256 may be isolated from other cloud services 256, and control plane VCN 216 may be isolated from cloud services 256, meaning the cloud services may not be in the same region as control plane VCN 216. For example, control plane VCN 216 may be located in "Region 1," and cloud service "Deployment 1" may be located in both Region 1 and "Region 2." If a call is made to deployment 1 by service gateway 236 contained in control plane VCN 216 located in region 1, then the call can be transmitted to deployment 1 in region 1. In this example, control plane VCN 216 or deployment 1 in region 1 may be uncoupled from or otherwise communicate with deployment 1 in region 2.

[0061] Figure 3 This is a block diagram 300 illustrating another example pattern of an IaaS architecture according to at least one embodiment. Service operator 302 (e.g., Figure 1 Service provider 102) can communicatively couple to secure host lease 304 (e.g., Figure 1 Secure hosting lease 104), the secure hosting lease 304 may include a virtual cloud network (VCN) 306 (e.g., Figure 1 VCN106) and Secure Host Subnet 308 (e.g., Figure 1 The secure host subnet 108). VCN 306 may include LPG 310 (e.g., Figure 1The LPG 110 can be communicatively coupled to the SSH VCN 312 via the LPG 310 contained in the SSH VCN 312 (e.g., Figure 1 SSH VCN 112). SSH VCN 312 can include SSH subnet 314 (e.g., Figure 1 SSH subnet 114), and SSH VCN 312 can be communicatively coupled to control plane VCN 316 via LPG 310 included in control plane VCN 316 (e.g., Figure 1 The control plane VCN 116) and coupled to the data plane VCN 318 via the LPG 310 contained in the data plane VCN 318 (e.g., Figure 1 Data plane 118). Control plane VCN 316 and data plane VCN 318 may be included in service lease 319 (e.g., Figure 1 In the service rental (119).

[0062] The control plane VCN 316 may include one or more load balancer (LB) subnets 322 (e.g., Figure 1 The control plane DMZ layer 320 of (one or more) LB subnets 122) (e.g., Figure 1 The control plane DMZ layer 120 may include one or more application subnets 326 (e.g., similar to...). Figure 1 The control plane application layer 324 of (one or more) application subnets 126 (e.g., Figure 1 The control plane application layer 124) may include a control plane data layer 328 (e.g., one or more) of DB subnets 330. Figure 1 The control plane data layer 128). One or more LB subnets 322 contained in the control plane DMZ layer 320 can be communicatively coupled to one or more application subnets 326 contained in the control plane application layer 324 and an Internet gateway 334 that can be contained in the control plane VCN 316 (e.g., Figure 1 Internet gateway 134), and application subnet 326 (one or more) can communicatively couple to DB subnet 330 (one or more) contained in control plane data layer 328 and service gateway 336 (e.g., Figure 1 The service gateway) and Network Address Translation (NAT) gateway 338 (e.g., Figure 1 (NAT gateway 138). The control plane VCN 316 may include the service gateway 336 and the NAT gateway 338.

[0063] Data plane VCN 318 may include data plane application layer 346 (e.g., Figure 1 Data plane application layer 146), data plane DMZ layer 348 (e.g., Figure 1 Data plane DMZ layer 148), and data plane data layer 350 (e.g., Figure 1 The data plane data layer 150. The data plane DMZ layer 348 may include one or more trusted application subnets 360 and one or more untrusted application subnets 362 that can be communicatively coupled to the data plane application layer 346, and one or more LB subnets 322 of the Internet gateway 334 contained in the data plane VCN 318. One or more trusted application subnets 360 may be communicatively coupled to the service gateway 336 contained in the data plane VCN 318, the NAT gateway 338 contained in the data plane VCN 318, and one or more DB subnets 330 contained in the data plane data layer 350. One or more untrusted application subnets 362 may be communicatively coupled to the service gateway 336 contained in the data plane VCN 318 and one or more DB subnets 330 contained in the data plane data layer 350. The data plane data layer 350 may include one or more DB subnets 330 that can be communicatively coupled to the service gateway 336 contained in the data plane VCN 318.

[0064] One or more untrusted application subnets 362 may include one or more primary VNICs 364(1)-(N) that can be communicatively coupled to tenant virtual machines (VMs) 366(1)-(N). Each tenant VM 366(1)-(N) may be communicatively coupled to a corresponding application subnet 367(1)-(N) that may be contained in a corresponding container egress VCN 368(1)-(N), which may be contained in a corresponding customer lease 370(1)-(N). A corresponding secondary VNIC 372(1)-(N) may facilitate communication between one or more untrusted application subnets 362 contained in a data plane VCN 318 and the application subnets contained in the container egress VCN 368(1)-(N). Each container egress VCN 368(1)-(N) may include a NAT gateway 338 that can be communicatively coupled to the public Internet 354 (e.g., Figure 1 The public internet (154).

[0065] An Internet gateway 334, contained in the control plane VCN 316 and the data plane VCN 318, can be communicatively coupled to a metadata management service 352 (e.g., Figure 1The metadata management system 152 can communicatively couple to the public internet 354. The public internet 354 can communicatively couple to a NAT gateway 338 contained in a control plane VCN 316 and a data plane VCN 318. The service gateway 336 contained in the control plane VCN 316 and the data plane VCN 318 can communicatively couple to a cloud service 356.

[0066] In some embodiments, the data plane VCN 318 may be integrated with the customer lease 370. Such integration may be useful or desired by the IaaS provider's customers in certain situations, such as when support may be expected during code execution. Customers may provide code that could be destructive, might communicate with other customer resources, or might otherwise cause undesirable effects. In response, the IaaS provider may determine whether to run the code provided by the customer to the IaaS provider.

[0067] In some examples, an IaaS provider's customer may grant the IaaS provider temporary network access and request functionality attached to the data plane application layer 346. The code running this functionality may execute in VMs 366(1)-(N) and may not be configured to run anywhere else on the data plane VCN 318. Each VM 366(1)-(N) may be connected to a customer lease 370. The corresponding container 371(1)-(N) contained in VMs 366(1)-(N) may be configured to run the code. In this case, dual isolation may exist (e.g., container 371(1)-(N) runs the code, where container 371(1)-(N) may be contained in at least one or more untrusted application subnets 362 containing VMs 366(1)-(N)), which can help prevent incorrect or otherwise unintended code from corrupting the IaaS provider's network or the networks of different customers. Containers 371(1)-(N) may be communicatively coupled to customer lease 370 and may be configured to transmit or receive data from customer lease 370. Containers 371(1)-(N) may not be configured to transmit or receive data from any other entity in data plane VCN 318. After the code execution is complete, the IaaS provider may terminate or otherwise dispose of containers 371(1)-(N).

[0068] In some embodiments, one or more trusted application subnets 360 may run code that may be owned or operated by an IaaS provider. In this embodiment, one or more trusted application subnets 360 may be communicatively coupled to one or more DB subnets 330 and configured to perform CRUD operations in one or more DB subnets 330. One or more untrusted application subnets 362 may be communicatively coupled to one or more DB subnets 330, but in this embodiment, one or more untrusted application subnets may be configured to perform read operations in one or more DB subnets 330. Containers 371(1)-(N) that may be contained in each customer's VM 366(1)-(N) and may run code from the customer may not be communicatively coupled to one or more DB subnets 330.

[0069] In other embodiments, the control plane VCN 316 and the data plane VCN 318 may be coupled without direct communication. In this embodiment, direct communication between the control plane VCN 316 and the data plane VCN 318 may not exist. However, communication can occur indirectly through at least one method. An LPG 310, established by an IaaS provider, can facilitate communication between the control plane VCN 316 and the data plane VCN 318. In another example, either the control plane VCN 316 or the data plane VCN 318 may make a call to the cloud service 356 via the service gateway 336. For example, a call to the cloud service 356 from the control plane VCN 316 may include a request for a service that can communicate with the data plane VCN 318.

[0070] Figure 4 This is a block diagram 400 illustrating another example pattern of an IaaS architecture according to at least one embodiment. Service operator 402 (e.g., Figure 1 Service provider 102) can communicatively couple to secure host lease 404 (e.g., Figure 1 Secure hosting lease 104), the secure hosting lease may include a Virtual Cloud Network (VCN) 406 (e.g., Figure 1 VCN106) and Secure Host Subnet 408 (e.g., Figure 1 The secure host subnet 108). VCN 406 may include LPG 410 (e.g., Figure 1 LPG 110), which can be contained in SSH VCN 412 (e.g., Figure 1 The LPG410 in SSH VCN 412 is communicatively coupled to SSH VCN 412. SSH VCN 412 may include SSH subnet 414 (e.g., Figure 1SSH subnet 114), and SSH VCN 412 can be communicatively coupled to control plane VCN 416 via LPG 410 contained in control plane VCN 416 (e.g., Figure 1 The control plane VCN 116) and coupled to the data plane VCN 418 via the LPG 410 contained in the data plane VCN 418 (e.g., Figure 1 Data plane 418). Control plane VCN 416 and data plane VCN 418 may be included in service lease 419 (e.g., Figure 1 In the service rental (119).

[0071] The control plane VCN 416 may include one or more LB subnets 422 (e.g., Figure 1 The control plane DMZ layer 420 of (one or more) LB subnets 122) (e.g., Figure 1 The control plane DMZ layer 120 may include (one or more) application subnets 426 (e.g., Figure 1 The control plane application layer 424 of (one or more) application subnets 126 (e.g., Figure 1 The control plane application layer 124) may include (one or more) DB subnets 430 (e.g., Figure 3 The control plane data layer 428 of (one or more) DB subnets 330 (e.g., Figure 1 The control plane data layer 128). One or more LB subnets 422 contained in the control plane DMZ layer 420 can be communicatively coupled to one or more application subnets 426 contained in the control plane application layer 424 and an Internet gateway 434 that can be contained in the control plane VCN 416 (e.g., Figure 1 Internet gateway 134), and application subnet 426 (one or more) can communicatively couple to DB subnet 430 (one or more) contained in control plane data layer 428 and service gateway 436 (e.g., Figure 1 The service gateway) and Network Address Translation (NAT) gateway 438 (e.g., Figure 1 (NAT gateway 138). The control plane VCN 416 may include the service gateway 436 and the NAT gateway 438.

[0072] Data plane VCN 418 may include data plane application layer 446 (e.g., Figure 1 Data plane application layer 146), data plane DMZ layer 448 (e.g., Figure 1 Data plane DMZ layer 148), and data plane data layer 450 (e.g., Figure 1The data plane data layer 150). The data plane DMZ layer 448 may include one or more trusted application subnets 460 that can be communicatively coupled to the data plane application layer 446 (e.g., Figure 3 (one or more) trusted application subnets 360 and (one or more) untrusted application subnets 462 (e.g., Figure 3 The data plane VCN 418 may include one or more untrusted application subnets 362 and one or more LB subnets 422 of Internet gateway 434. One or more trusted application subnets 460 may communicatively couple to service gateway 436, NAT gateway 438, and DB subnets 430 in data plane VCN 418. One or more untrusted application subnets 462 may communicatively couple to service gateway 436 and DB subnets 430 in data plane VCN 418. Data plane VCN 450 may include one or more DB subnets 430 that may communicatively couple to service gateway 436 in data plane VCN 418.

[0073] One or more untrusted application subnets 462 may include a primary VNIC 464(1)-(N) communicatively coupled to tenant virtual machines (VMs) 466(1)-(N) residing within one or more untrusted application subnets 462. Each tenant VM 466(1)-(N) may run code in a corresponding container 467(1)-(N) and communicatively coupled to an application subnet 426 that may be contained in a data plane application layer 446 that may be contained in a container egress VCN 468. A corresponding secondary VNIC 472(1)-(N) may facilitate communication between one or more untrusted application subnets 462 contained in a data plane VCN 418 and the application subnets contained in a container egress VCN 468. The container egress VCN may include a public internet 454 (e.g., Figure 1 The public internet (154) uses NAT gateway 438.

[0074] Internet gateway 434, contained in control plane VCN 416 and data plane VCN 418, can be communicatively coupled to metadata management service 452 (e.g., Figure 1A metadata management system 152), the metadata management service being communicatively coupled to the public internet 454. The public internet 454 being communicatively coupled to a NAT gateway 438 contained in a control plane VCN 416 and a data plane VCN 418. A service gateway 436 contained in a control plane VCN 416 and a data plane VCN 418 being communicatively coupled to a cloud service 456.

[0075] In some examples, by Figure 4 The architecture pattern illustrated in the block diagram 400 can be considered as Figure 3 The architecture shown in block diagram 300 is an exception to the pattern, and this may be what the IaaS provider's customers expect if the IaaS provider cannot communicate directly with the customer (e.g., in a disconnected region). The customer can have real-time access to the corresponding container 467(1)-(N) contained in each customer's VM466(1)-(N). Container 467(1)-(N) can be configured to invoke the corresponding auxiliary VNIC 472(1)-(N) contained in one or more application subnets 426 of the data plane application layer 446, which may be contained in the container egress VCN 468. The auxiliary VNIC 472(1)-(N) can transmit the invocation to a NAT gateway 438, which can then transmit the invocation to the public internet 454. In this example, the container 467(1)-(N) that can be accessed by the customer in real-time can be isolated from the control plane VCN 416 and from other entities contained in the data plane VCN 418. Container 467(1)-(N) can also be isolated from resources from other customers.

[0076] In other examples, a client may use containers 467(1)-(N) to invoke cloud service 456. In this example, the client may run code within containers 467(1)-(N) requesting a service from cloud service 456. Container 467(1)-(N) may then transmit the request to a secondary VNIC 472(1)-(N), which may then transmit the request to a NAT gateway, which may then transmit the request to the public internet 454. The public internet 454 may then transmit the request via internet gateway 434 to one or more LB subnets 422 contained in control plane VCN 416. In response to determining that the request is valid, one or more LB subnets may then transmit the request to one or more application subnets 426, which may then transmit the request to cloud service 456 via service gateway 436.

[0077] It should be recognized that the IaaS architectures 100, 200, 300, and 400 depicted in the figures may have other components besides those depicted. Furthermore, the embodiments shown in the figures are merely some examples of cloud infrastructure systems that can be incorporated into embodiments of this disclosure. In some other embodiments, the IaaS system may have more or fewer components than shown in the figures, may combine two or more components, or may have different configurations or arrangements of components.

[0078] In some embodiments, the IaaS system described herein may include application suites, middleware, and database service offerings delivered to customers in a self-service, subscription-based, elastically scalable, reliable, highly available, and secure manner. An example of such an IaaS system is the Oracle Cloud Infrastructure (OCI) provided by this assignee.

[0079] Figure 5 An example computer system 500, in which various embodiments can be implemented, is illustrated. System 500 can be used to implement any of the computer systems described above. As shown, computer system 500 includes a processing unit 504 that communicates with a plurality of peripheral subsystems via a bus subsystem 502. These peripheral subsystems may include a processing acceleration unit 506, an I / O subsystem 508, a storage subsystem 518, and a communication subsystem 524. Storage subsystem 518 includes a tangible computer-readable storage medium 522 and system memory 510.

[0080] Bus subsystem 502 provides a mechanism for enabling the various components and subsystems of computer system 500 to communicate with each other as intended. While bus subsystem 502 is schematically shown as a single bus, alternative embodiments of the bus subsystem may utilize multiple buses. Bus subsystem 502 can be any of several types of bus architectures, including memory buses or memory controllers, peripheral buses, and local buses using any of the various bus architectures. For example, such architectures may include Industry Standard Architecture (ISA) buses, Micro Channel Architecture (MCA) buses, Enhanced ISA (EISA) buses, Video Electronics Standards Association (VESA) local buses, and Peripheral Component Interconnect (PCI) buses, which may be implemented as Mezzanine buses manufactured according to the IEEE P1386.1 standard.

[0081] A processing unit 504, which may be implemented as one or more integrated circuits (e.g., a conventional microprocessor or microcontroller), controls the operation of the computer system 500. One or more processors may be included in the processing unit 504. These processors may include single-core or multi-core processors. In some embodiments, the processing unit 504 may be implemented as one or more independent processing units 532 and / or 534, each including a single-core or multi-core processor. In other embodiments, the processing unit 504 may also be implemented as a quad-core processing unit formed by integrating two dual-core processors into a single chip.

[0082] In various embodiments, processing unit 504 can execute various programs in response to program code and can maintain multiple concurrently executing programs or processes. At any given time, some or all of the program code to be executed can reside in processor(s) 504 and / or storage subsystem 518. With appropriate programming, processor(s) 504 can provide the various functions described above. Additionally, computer system 500 may include processing acceleration unit 506, which may include digital signal processor (DSP), dedicated processor, etc.

[0083] I / O subsystem 508 may include user interface input devices and user interface output devices. User interface input devices may include keyboards, pointing devices such as mice or trackballs, touchpads or touchscreens integrated into the display, scroll wheels, click wheels, dials, buttons, switches, keyboards, audio input devices with voice command recognition systems, microphones, and other types of input devices. User interface input devices may include, for example, motion sensing and / or gesture recognition devices, such as the Microsoft Kinect® motion sensor, which enables users to control and interact with input devices such as the Microsoft Xbox® 360 game controller via a natural user interface using gestures and voice commands. User interface input devices may also include eye gesture recognition devices, such as the Google Glass® blink detector, which detects eye activity from the user (e.g., “blinking” when taking a photo and / or making menu selections) and translates the eye gestures into input in an input device (e.g., Google Glass®). Additionally, user interface input devices may include voice recognition sensing devices that enable users to interact with a voice recognition system (e.g., the Siri® navigator) via voice commands.

[0084] User interface input devices may also include, but are not limited to, 3D mice, joysticks or pointers, game controllers and drawing tablets, as well as audio / video devices such as speakers, digital cameras, digital camcorders, portable media players, webcams, image scanners, fingerprint scanners, barcode readers, 3D scanners, 3D printers, laser rangefinders, and eye-tracking devices. Additionally, user interface input devices may include, for example, medical imaging input devices such as computed tomography (CT), magnetic resonance imaging (MRI), positron emission tomography (PET), and medical ultrasound equipment. User interface input devices may also include, for example, audio input devices such as MIDI keyboards, digital musical instruments, etc.

[0085] User interface output devices may include display subsystems, indicator lights, or non-visual displays such as audio output devices, etc. Display subsystems may be cathode ray tubes (CRTs), flat panel devices such as those using liquid crystal displays (LCDs) or plasma displays, projection devices, touchscreens, etc. Generally, the term "output device" is intended to include all possible types of devices and mechanisms for outputting information from computer system 500 to a user or other computer. For example, user interface output devices may include, but are not limited to, various display devices that visually convey text, graphics, and audio / video information, such as monitors, printers, speakers, headphones, car navigation systems, plotters, voice output devices, and modems.

[0086] Computer system 500 may include a storage subsystem 518 that provides a tangible, non-transitory, computer-readable storage medium for storing software and data constructs that provide the functionality of the embodiments described in this disclosure. The software may include programs, code modules, instructions, scripts, etc., which provide the aforementioned functionality when executed by one or more cores or processors of processing unit 504. Storage subsystem 518 may also provide a repository for storing data used according to this disclosure.

[0087] like Figure 5 As depicted in the example, storage subsystem 518 may include various components, including system memory 510, computer-readable storage medium 522, and computer-readable storage medium reader 520. System memory 510 may store program instructions that can be loaded and executed by processing unit 504. System memory 510 may also store data used during the execution of instructions and / or data generated during the execution of program instructions. Various kinds of programs may be loaded into system memory 510, including but not limited to client applications, web browsers, middleware applications, relational database management systems (RDBMS), virtual machines, containers, etc.

[0088] System memory 510 may also store operating system 516. Examples of operating system 516 may include various versions of Microsoft Windows®, Apple Macintosh® and / or Linux operating systems, various commercial UNIX® or UNIX-like operating systems (including, but not limited to, various GNU / Linux operating systems, Google Chrome® OS, etc.) and / or mobile operating systems (such as iOS, Windows® Phone, Android® OS, BlackBerry® OS, and Palm® OS). In some implementations where computer system 500 executes one or more virtual machines, the virtual machine, along with its guest operating system (GOS), may be loaded into system memory 510 and executed by one or more processors or cores of processing unit 504.

[0089] System memory 510 may be configured differently depending on the type of computer system 500. For example, system memory 510 may be volatile memory (such as random access memory (RAM)) and / or non-volatile memory (such as read-only memory (ROM), flash memory, etc.). Different types of RAM configurations may be provided, including static random access memory (SRAM), dynamic random access memory (DRAM), etc. In some embodiments, system memory 510 may include a basic input / output system (BIOS), which contains basic routines that facilitate the transfer of information between components within computer system 500, such as during startup.

[0090] Computer-readable storage medium 522 may represent remote, local, fixed and / or removable storage devices and storage media for temporarily and / or more permanently containing and storing computer-readable information (including instructions executable by the processing unit 504 of the computer system 500) for use by the computer system 500.

[0091] Computer-readable storage medium 522 may include any suitable medium known or used in the art, including storage media and communication media, such as, but not limited to, volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing and / or transmitting information. This may include tangible computer-readable storage media or other tangible computer-readable media such as RAM, ROM, electronically erasable programmable ROM (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile disk (DVD) or other optical storage devices, magnetic tape cassettes, magnetic tape, disk storage devices or other magnetic storage devices.

[0092] For example, computer-readable storage medium 522 may include hard disk drives that read from or write to non-removable non-volatile magnetic media, disk drives that read from or write to removable non-volatile disks, and optical disc drives that read from or write to removable non-volatile optical discs (such as CD ROMs, DVDs, and Blu-ray® discs or other optical media). Computer-readable storage medium 522 may include, but is not limited to, Zip® drives, flash memory cards, Universal Serial Bus (USB) flash drives, Secure Digital (SD) cards, DVD discs, digital audio tapes, and so on. Computer-readable storage medium 522 may also include solid-state drives (SSDs) based on non-volatile memory (such as flash memory-based SSDs, enterprise flash drives, solid-state ROMs, etc.), volatile memory-based SSDs (such as solid-state RAM, dynamic RAM, static RAM), DRAM-based SSDs, magnetoresistive RAM (MRAM) SSDs, and hybrid SSDs using a combination of DRAM-based and flash memory-based SSDs. Disk drives and their associated computer-readable media can provide non-volatile storage for computer-readable instructions, data structures, program modules and other data for computer system 500.

[0093] Machine-readable instructions executable by one or more processors or cores of processing unit 504 may be stored on a non-transitory computer-readable storage medium. The non-transitory computer-readable storage medium may include physically tangible memory or storage devices, including volatile memory storage devices and / or non-volatile memory devices. Examples of non-transitory computer-readable storage media include magnetic storage media (e.g., disks or tapes), optical storage media (e.g., DVDs, CDs), various types of RAM, ROM, or flash memory, hard disk drives, floppy disk drives, removable memory drives (e.g., USB drives), or other types of storage devices.

[0094] The communication subsystem 524 provides an interface to other computer systems and networks. The communication subsystem 524 serves as an interface for receiving data from other systems and sending data from computer system 500 to other systems. For example, the communication subsystem 524 may enable computer system 500 to connect to one or more devices via the Internet. In some embodiments, the communication subsystem 524 may include radio frequency (RF) transceiver components (e.g., advanced data network technologies using cellular telephone technology, such as 3G, 4G, or EDGE (Enhanced Data Rates for Global Evolution), WiFi (IEEE 802.11 series standards), or other mobile communication technologies, or any combination thereof), GPS receiver components, and / or other components for accessing wireless voice and / or data networks. In some embodiments, as an addition to or alternative to the wireless interface, the communication subsystem 524 may provide wired network connectivity (e.g., Ethernet).

[0095] In some embodiments, the communication subsystem 524 may also represent one or more users who can use the computer system 500 to receive input communications in the form of structured and / or unstructured data feeds 526, event streams 528, event updates 530, etc.

[0096] For example, the communication subsystem 524 can be configured to receive data feeds 526 in real time from users of social networks and / or other communication services, such as Twitter® feeds, Facebook® updates, web feeds such as Rich Site Summary (RSS) feeds, and / or real-time updates from one or more third-party information sources.

[0097] Additionally, the communication subsystem 524 can also be configured to receive data in the form of a continuous data stream, which may include an event stream 528 and / or event updates 530 that are essentially continuous or unbounded real-time events without a clearly defined termination. Examples of applications that generate continuous data may include, for example, sensor data applications, financial quote machines, network performance measurement tools (e.g., network monitoring and traffic management applications), clickstream analysis tools, vehicle traffic monitoring, and so on.

[0098] The communication subsystem 524 can also be configured to output structured and / or unstructured data feeds 526, event streams 528, event updates 530, etc. to one or more databases, which can communicate with one or more streaming data source computers coupled to the computer system 500.

[0099] The computer system 500 can be of a variety of types, including handheld portable devices (e.g., iPhone® cellular phones, iPad® computing tablets, PDAs), wearable devices (e.g., Google® Glass head-mounted displays), PCs, workstations, mainframes, information stations, server racks, or any other data processing system.

[0100] Due to the constantly evolving nature of computers and networks, the description of the computer system 500 depicted in the figures is intended only as a concrete example. Many other configurations with more or fewer components than the system depicted in the figures are possible. For example, custom hardware may also be used and / or specific elements may be implemented using hardware, firmware, software (including applets), or a combination thereof. Additionally, connections to other computing devices, such as network input / output devices, may also be employed. Based on the disclosure and teachings provided herein, those skilled in the art will recognize other ways and / or methods for implementing the various embodiments.

[0101] 3. Service Provider Architecture

[0102] Figure 6 A system 600 according to one or more embodiments is illustrated. The system 600 includes an interface 602, a service provider system 610, a tenant location 620, a service provider location 630, and a data storage 640. The system 600 receives client input 650. In one or more embodiments, the system 600 may include a... Figure 6 The diagram shows more or fewer components. Figure 6 The components illustrated in the diagram can be located locally or remotely, and these components can be implemented using software and / or hardware. Each component can be distributed across multiple applications and / or machines. Multiple components can be combined into a single application and / or machine. An operation described for one component can be performed by another component.

[0103] Service provider system 610 can represent one or more aspects of a service provided by a cloud service provider. A cloud service provider offers on-demand, scalable computing services to its customers. This frees customers from investing in, maintaining, and upgrading potentially expensive computing resources. Computing services can include data storage services, large-scale computing power services, and applications delivered over a network. Cloud service providers may possess a large amount of computing resources, such as processors, data storage devices, network devices, and connections between computing resources, to operate and make those resources available to customers. Examples of cloud service applications include data services that perform computationally intensive and / or computationally complex operations. Data services can include, for example, machine learning operations, artificial intelligence operations, simulations of complex systems, scientific and engineering operations, etc.

[0104] In one or more embodiments, service provider system 610 refers to hardware and / or software configured to perform the operations described herein, causing application 614 to execute in response to receiving workload operation request 654. Examples of operations for causing service provider applications to execute on tenant-controlled infrastructure will be referenced below. Figure 7 Describe it.

[0105] Tenant location 620 refers to one or more locations that house a set of physical computing resources owned by a tenant. Tenant location 620 may be a physical space that houses physical computing resources. Tenant location 620 may be a logical grouping of physical resources housed in multiple physical spaces. Computing resources may include, for example, processors, storage devices, volatile memory, and network components. In one or more embodiments, the tenant is a company, organization, enterprise, or other entity that uses service provider system 610 and controls tenant location 620.

[0106] In one or more embodiments, tenant site 620 includes one or more tenant-managed, service provider-accessible (TMSRA) resources 622. TMSRA 622 may include a set of physical resources accessible to service provider system 610 via computing target entity 612. In one or more embodiments, tenant site 620 includes one or more tenant-managed, service provider-inaccessible (TMSRN) resources 624. TMSRN 624 may include a different set of physical resources inaccessible to service provider system 610. TMSRN 624 may be accessible only to applications and resources within tenant site 620. In one or more embodiments, tenant site 620 includes a tenant resource manager 626. Tenant resource manager 626 can evaluate and enforce permissions and restrictions associated with any entity attempting to access tenant-managed resources. When an entity has valid permissions, tenant resource manager can initiate the execution of instructions received from the entity to use the set of resources. Tenant resource manager 626 can also monitor the status of instruction execution and may transmit that status to the entity.

[0107] Service provider site 630 refers to one or more locations that house a set of service provider-managed resources 632. Service provider-managed resources 632 may include physical and logical computing resources owned and controlled by the cloud service provider. Service provider-managed resources 632 can be directly accessed by the service provider system 610.

[0108] Service provider system 610 may include one or more functional components, such as application 614 and workload execution engine 616. Service provider system 610 may also generate and store computation target entities 612. Application 614 may include hardware and / or software configured to perform operations of data services provided by the service. Application 614 may include, for example, machine learning applications, artificial intelligence applications, simulation applications, data analysis applications, etc.

[0109] The workload execution engine 616 can receive workload operation requests 654 from data service clients (referred to herein as clients). The workload operation request 654 may include data, input parameters, resource specifications, and other information required by the application 614. The workload execution engine 616 can identify the application 614 required to execute the workload request and can identify which resources are needed to execute the workload operation. The workload execution engine 616 can initiate the execution of the workload using workload execution logic 642 on the identified resources and can monitor the completion, errors, and other status indicators of the execution.

[0110] In some cases, workload operation request 654 may indicate that the workload operation should be performed by resource 632 managed by the service provider. In other cases, workload operation request 654 may indicate that the workload should be performed on TMSRA resource 622. In the latter case, workload request 654 may include an identifier of the computation target entity 612.

[0111] Compute target entity 612 represents an addressable entity configured to communicate with TMSRA resources 622 on behalf of workload execution engine 616. Compute target entity 612 can be created upon receiving a compute target request 652. Compute target request 652 may include an infrastructure definition that defines a set of resources within the group of TMSRA resources 622 that the compute target entity will be allowed to access. The infrastructure definition may also include identifiers for resource clusters and / or identifiers for regions of the resource clusters. A resource cluster may be a physical grouping of communicatively coupled resources or a logical grouping of communicatively coupled resources. Compute target entity 612 may be a file, database entry, object, executable file, application programming interface (API), or any other data structure that can store or reference the infrastructure definition and other settings from the creation request and can pass data and instructions to applications or other logical entities.

[0112] After creation, the compute target entity 612 has an addressable identifier corresponding to the set of resources defined in the infrastructure definition of the compute target request 652. The compute target entity 612 is generated using its own set of credentials for accessing one or more resources within the TMSRA resource set. The compute target entity 612 may include one or more permissions to access the TMSRA resource. Permissions may include roles within a set of roles, and a corresponding set of permissions. Permissions may include one or more namespaces across the TMSRA resource implementation within a set of namespaces. The set of resources mapped to the compute target entity may include resources permitted by the roles assigned to the compute target entity, the credentials corresponding to the compute target entity, and / or one or more namespaces accessible to the compute target entity. Access privileges may be assigned to the compute target entity based on the principle of least privilege (i.e., the lowest access level required to allow applications using the compute target entity to perform operations on that set of resources).

[0113] If a compute target request includes TMSRN 624 in its infrastructure definition, then the resources within TMSRN 624 can become service provider-accessible resources 622. The tenant resource manager 626 can determine whether a compute target entity can access TMSRN 624 resources based on the permissions associated with that entity.

[0114] A single tenant entity can use multiple different compute target entities. For example, within a single company entity, different departments may have their own compute target entities, which grant each department access to different tenant resources. In this case, the different compute target entities can be associated with their respective roles and / or different namespaces. In another example, a company entity can serve multiple client entities and can use different compute targets for each different client entity.

[0115] In this embodiment, system 600 is implemented on one or more digital devices. The term "digital device" generally refers to any hardware device that includes a processor. A digital device can refer to a physical device that executes an application or a virtual machine. Examples of digital devices include computers, tablets, laptops, desktops, netbooks, servers, web servers, network policy servers, proxy servers, general-purpose machines, function-specific hardware devices, hardware routers, hardware switches, hardware firewalls, hardware network address translation (NAT), hardware load balancers, mainframes, televisions, content receivers, set-top boxes, printers, mobile handsets, smartphones, personal digital assistants (PDAs), wireless receivers and / or transmitters, base stations, communication management equipment, routers, switches, controllers, access points, and / or client devices.

[0116] In one or more embodiments, data storage 640 is any type of storage unit and / or device for storing data (e.g., file system, database, collection of tables, or any other storage mechanism). Furthermore, data storage 640 may include multiple different storage units and / or devices. These multiple different storage units and / or devices may or may not be of the same type or located at the same physical site. Additionally, data storage 640 may be implemented or executed on the same computing system as service provider system 610. Alternatively or additionally, data storage 640 may be implemented or executed on a separate computing system from service provider system 610. Data storage 640 may be coupled to service provider system 610 via a direct connection or via network communication.

[0117] The information describing the workload execution logic 642 can be implemented across any component within system 100. However, for clarity and illustration purposes, this information is illustrated as residing within data storage 640.

[0118] In one or more embodiments, interface 602 refers to hardware and / or software configured to facilitate communication between user and service provider system 610. Interface 602 renders user interface elements and receives input via these elements. Examples of interfaces include graphical user interfaces (GUIs), command-line interfaces (CLIs), haptic interfaces, and voice command interfaces. Examples of user interface elements include checkboxes, radio buttons, drop-down lists, list boxes, buttons, toggle switches, text fields, date and time pickers, command lines, sliders, pages, and forms.

[0119] In this embodiment, the different components of interface 602 are specified in different languages. The behavior of user interface elements is specified in a dynamic programming language such as JavaScript. The content of user interface elements is specified in a markup language such as Hypertext Markup Language (HTML) or XML User Interface Language (XUL). The layout of user interface elements is specified in a stylesheet language such as Cascading Style Sheets (CSS). Alternatively, interface 602 may be specified in one or more other languages ​​such as Java, C, or C++.

[0120] 4. Run service provider applications on tenant-controlled infrastructure.

[0121] Figure 7 The illustration depicts a set of example operations, according to one or more embodiments, for enabling the execution of service provider applications on tenant-controlled infrastructure. Figure 7 One or more operations shown in the diagram can be modified, rearranged, or omitted entirely. Accordingly, Figure 7 The sequence of operations illustrated in the diagram should not be construed as limiting the scope of one or more embodiments.

[0122] In one or more embodiments, the service provider system receives a request to create a computing target entity (operation 702) via a graphical user interface (GUI). The request to create the computing target entity may include an infrastructure definition that defines a set of resources associated with the computing target entity. This set of resources may include virtual and / or physical resources. This set of resources is used to implement the computing target entity. This set of resources is selected from a set of tenant-managed resources implemented on a tenant's premises. The request may also include one or more permission settings that define the access level to the set of resources. The GUI may provide user interface elements that allow a user to select a set of resources from the tenant-managed resources. The GUI may provide user interface elements that allow a user to select roles, permissions, namespaces, or any other settings configured to enable access to desired components of the tenant-controlled resources while blocking access to other parts of the tenant-managed resources. The GUI may also provide user interface elements that allow a user to name the requested computing target entity and include other information such as a description of the purpose of the computing target entity. The GUI may also provide user interface elements that allow a user to select from service provider-managed resources as alternatives to or supplements to the tenant-managed resources.

[0123] In one or more embodiments, the service provider system checks whether the request is valid (operation 704). For example, the system may determine whether the resource specified in the request is available, and / or whether the resource is in the correct usage state. The system may determine whether the resource specified in the request is active. The system may determine whether physical resources are available and accessible within the tenant's premises. The system may determine whether virtual resources (e.g., virtual machines (VMs)) are started and active on hardware within the tenant's premises. The system may determine whether the entity requesting the generation of the compute target entity is authorized to set up the compute target entity corresponding to the specified set of resources.

[0124] In some cases, if a request is determined to be invalid, the service provider's system can take action on the resource to make the request valid. For example, the system can configure the resource (e.g., by starting a virtual machine resource).

[0125] In one or more embodiments, if the request is invalid, the service provider system may present a notification corresponding to the failure of the computation target entity (operation 712). For example, the system may present a visual notification to indicate the failure via a GUI. The notification may include details explaining the failure, such as the resource not found, the resource being inaccessible, the resource being in an invalid state, or the requesting entity not being authorized to access the resource.

[0126] In one or more embodiments, the service provider system generates a computing target entity (operation 706). The service provider system may instantiate the computing target entity and generate a unique addressable identifier for it. The system may also set up resources for use and generate unique identifiers for that set of resources. The system may generate and store a mapping between the addressable identifiers of the computing target entity and the identifiers of the set of resources. A resource manager executing in the tenant's premises may configure permissions and access rules that restrict access to the set of resources associated with the computing target entity.

[0127] The system can transmit the addressable identifier of the newly generated computational target entity, for example, via the GUI, to the entity that generated the creation request. After creation, the computational target entity can be stored, retrieved via the addressable identifier, and reused to communicate with the set of resources associated with the addressable identifier.

[0128] In one or more embodiments, the system receives a request (operation 708) to perform a set of operations by a computing target entity. The request may specify an addressable identifier associated with the computing target entity for performing the set of operations. The request may include a selection of a service provider-specific application to perform the set of operations. The request may include a user-provided application to perform the set of operations. The request may also include data for input to the set of operations, such as as a file or as a link to a data source. The request may include input parameters for the set of operations, command-line instructions, time limits, and any other settings related to performing the set of operations. The request may be received from the same interface through which the computing target creation request is received, or through a different interface.

[0129] In one or more embodiments, the service provider system causes a set of operations to be performed on a set of resources at a tenant's premises via a computing target entity (operation 710). The service provider system maps the computing target entity to the resources corresponding to the set. The system executes an application to complete the requested operations. The application generates a set of commands that, when executed, complete the requested set of operations. The service provider system transmits the set of commands via the computing target entity to the set of tenant-managed resources associated with the computing target entity for execution on the set of tenant-managed resources. In some embodiments, the service provider system may request the execution of the set of operations via the computing target entity using an application programming interface (API) associated with the set of tenant-managed resources. The set of operations is then executed by the set of resources, and any resulting output may be stored within the tenant-managed resources and / or transmitted back to the service provider system via the computing target entity. The service provider system may, for example, display information associated with the results or job status information to the requesting entity via a GUI.

[0130] In some embodiments, the service provider system transmits commands to a tenant resource manager within the tenant's premises via a computing target entity. The tenant resource manager evaluates credentials (e.g., permissions and restrictions) associated with the computing target entity to verify that the computing target entity is permitted to execute commands on that set of resources. In response to determining that the computing target entity is permitted to execute commands on that set of resources, the tenant resource manager initiates the execution of the received set of commands using that set of resources.

[0131] In one or more embodiments, a request to perform a set of operations may include more than one computation target entity. For example, some operations in the set of operations need to be performed on a set of resources or under a set of computation target credentials, while other operations in the set of operations need to be performed on a different set of resources or under a different set of credentials. A service provider system can enable different sets of operations to be performed via the respective computation target entities requesting them.

[0132] In one or more embodiments, the request to perform the group of operations may specify that some operations in the group are to be performed via a compute target entity and tenant-managed resources, while other operations in the group are to be performed via a service provider-managed resource and another compute target entity, or in the absence of a compute target entity. The service provider system may accordingly enable the execution of different groups of operations on the requested resources.

[0133] 5. Example Implementation

[0134] Figure 8 An example of a GUI 800 for creating a compute target is illustrated. GUI 800 includes selectable elements that allow the user to select the service type of the compute target, such as element 802 for a compute target for customer management and element 804 for a compute target for service management. Element 803 indicates that the user has selected to create a compute target for customer management.

[0135] In response to the user selecting element 802, GUI 800 may present resource selection field 810. GUI 800 may present elements, such as 812, 814, and 816. Elements may correspond to resources in a tenant's premises that are available for inclusion in a computing objective, managed by one tenant or a group of tenant-managed resources. For example, element 812 allows the user to select "Customer Resource 1". In the illustrated example, elements 812 and 816 are selected, while element 814 is not selected.

[0136] GUI 800 may present a naming element 820, which presents a naming field 820 that allows the user to type a name for the computation target. In one or more embodiments, the system may check that the typed name is unique for the tenant's premises. The typed name can then be used as an addressable identifier. Alternatively, the system may generate a unique addressable identifier for the computation and display the addressable identifier in the naming field without allowing modification.

[0137] When a user selects to create control element 806, the system receives the selected tenant-managed resources and the name of the compute target entity as a creation request. The selection of tenant-managed resources becomes the infrastructure definition. The system then generates the compute target entity.

[0138] Figure 9 The illustration shows an example of a GUI 900 used to request the execution of a set of operations (referred to herein as a "job"). The GUI 900 can provide a naming field 902 to allow the user to type a name for the job. The GUI 900 can provide selectable elements 904 and 906, which allow the user to select either a computation target or a standard computeshape, respectively. In the illustrated example, the user has selected computation target element 904.

[0139] In response to the user selecting element 904, GUI 900 can present available compute target entities. For example, for each possible compute target in the tenant-managed infrastructure, GUI 900 can present a selectable element, such as elements 910, 912, and 914. Each element can be labeled with an addressable identifier for the corresponding compute target. Alternatively, GUI 900 can present the compute target selection as a drop-down menu.

[0140] GUI 900 may include field 920 to allow a user to provide a set of operations to be performed, for example, as one or more files. Field 920 may allow a user to drag and drop one or more files into the field. Field 920 may include link 922, which, when selected, allows the user to navigate to the one or more files via the computer's file storage interface.

[0141] When the user selects to create control element 930, the system receives the selected computational target entity and the group of operations in the form of one or more files, which are added as a request to perform the group of operations using the selected computational target entity.

[0142] 6. Practical applications, advantages, and improvements

[0143] One or more embodiments described herein allow cloud service data service customers to use the data service within their own tenant-managed infrastructure, while preventing the data service from accessing any parts of the tenant-managed infrastructure that the tenant does not want exposed. This allows data service customers to securely utilize the data service on the tenant's available infrastructure, thereby avoiding potential delays in data service execution when the infrastructure managed by the data service may be unavailable.

[0144] 7. Other matters; extension

[0145] The embodiments relate to a system having one or more devices, which include a hardware processor and are configured to perform any of the operations described herein and / or any of the following claims.

[0146] In an embodiment, the non-transitory computer-readable storage medium includes instructions that, when executed by one or more hardware processors, cause to perform any operation described herein and / or recited in any of the claims.

[0147] While specific embodiments have been described, various modifications, alterations, alternative constructions, and equivalents are also included within the scope of this disclosure. The embodiments are not limited to operation within certain specific data processing environments, but can be freely operated within multiple data processing environments. Additionally, although the embodiments have been described using a specific series of transactions and steps, those skilled in the art will understand that the scope of this disclosure is not limited to the described series of transactions and steps. Various features and aspects of the above embodiments can be used individually or in combination.

[0148] Furthermore, while embodiments have been described using specific combinations of hardware and software, it should be recognized that other combinations of hardware and software are also within the scope of this disclosure. Embodiments may be implemented using only hardware, or only software, or a combination thereof. The various processes described herein can be implemented in any combination on the same processor or on different processors. Accordingly, where a component or service is described as being configured to perform certain operations, such configuration can be accomplished, for example, by designing electronic circuits to perform operations, by programming programmable electronic circuits (such as microprocessors), or any combination thereof. Processes may communicate using a variety of technologies, including but not limited to conventional technologies for inter-process communication, and different pairs of processes may use different technologies, or the same pair of processes may use different technologies at different times.

[0149] Accordingly, the specification and drawings are to be considered illustrative rather than restrictive. However, it will be clear that additions, omissions, deletions, and other modifications and changes may be made therein without departing from the broader spirit and scope set forth in the claims. Therefore, while specific disclosed embodiments have been described, they are not intended to be limiting. Various modifications and equivalents are within the scope of the following claims.

[0150] In the context of describing the disclosed embodiments (particularly in the context of the following claims), the terms “a,” “an,” and “the,” and similar pronouns, are to be interpreted as encompassing both singular and plural, unless otherwise indicated herein or clearly contradicted by the context. Unless otherwise stated, the terms “comprising,” “having,” “containing,” and “including” are to be interpreted as open-ended terms (i.e., meaning “including but not limited to”). The term “connected” should be interpreted as being partially or wholly contained in, attached to, or linked together, even if something intervenes in between. Unless otherwise indicated herein, the enumeration of value ranges herein is intended only as a shorthand method for individually referencing each individual value falling within that range, and each individual value is incorporated into the specification as if it were individually enumerated herein. Unless otherwise indicated herein or clearly contradicted by the context, all methods described herein can be performed in any suitable order. The use of any and all examples or exemplary language (e.g., “such as”) provided herein is intended only to better illustrate the embodiments and does not constitute a limitation on the scope of this disclosure, unless otherwise claimed. No language in the specification should be construed as indicating that any unclaimed element is essential to the practice of this disclosure.

[0151] Disjunctive languages, such as the phrase “at least one of X, Y, or Z”, are intended to be understood in the context generally used to refer to items, terms, etc., unless otherwise explicitly stated, and may be X, Y, or Z, or any combination thereof (e.g., X, Y, and / or Z). Therefore, such disjunctive languages ​​are generally not intended to, and should not, imply that certain embodiments require the presence of at least one of X, at least one of Y, or at least one of Z.

[0152] This document describes preferred embodiments of the present disclosure, including known best modes for carrying out the present disclosure. Variations of these preferred embodiments will become apparent to those skilled in the art upon reading the foregoing description. Those skilled in the art should be able to appropriately employ such variations and may practice the present disclosure in ways other than those specifically described herein. Accordingly, the present disclosure includes all modifications and equivalents to the subject matter recited in the appended claims, where permitted by applicable law. Moreover, unless otherwise indicated herein, the present disclosure includes any combination of the foregoing elements in all its possible variations.

[0153] All references cited in this article, including publications, patent applications and patents, are incorporated into this article by reference to the same extent as if each reference were individually and specifically indicated to be incorporated by reference and elaborated in full in this article.

[0154] In the foregoing specification, various aspects of this disclosure have been described with reference to specific embodiments thereof; however, those skilled in the art will recognize that this disclosure is not limited thereto. The various features and aspects of the foregoing disclosure may be used individually or in combination. Furthermore, embodiments may be used in any number of settings and applications other than those described herein without departing from the broader spirit and scope of this specification. Accordingly, this specification and the accompanying drawings should be considered illustrative rather than restrictive.

[0155] According to one or more embodiments, any combination of the features and functions described herein may be used. In the foregoing description, embodiments have been described with reference to numerous specific details that may vary depending on the implementation. Accordingly, this specification and the accompanying drawings should be viewed in an illustrative rather than restrictive sense. The unique and exclusive reference to the scope of the invention, and what the applicant intends to define as the scope of the invention, is the literal and equivalent scope of the set of claims issued herein, and should be in the specific form at the time of issuance of those claims, including any subsequent corrections.

Claims

1. One or more computer-readable media, including instructions that, when executed by one or more hardware processors, cause to perform operations including: The first request to create the computational target entity is received via a graphical user interface. The first request includes defining an infrastructure definition of a set of resources, which (a) are used to implement the computing target entity and (b) are to be selected from a set of tenant-managed resources implemented in a tenant's premises; In response to receiving a first request: the service provider system generates a computing target entity, which is associated with an addressable identifier corresponding to the set of resources selected from the resources managed by the set of tenants; The service provider system receives a second request to perform a set of operations. The second request specifies an addressable identifier associated with the computation target entity for performing the set of operations. The set of operations mentioned above includes one or more operations; The service provider system maps the addressable identifier of the target entity to the set of resources. as well as The service provider system performs the set of operations on the set of resources at the tenant's premises by calculating the target entity.

2. The computer-readable medium of claim 1, wherein performing the set of operations on the set of resources includes obtaining access to the set of resources using a set of credentials associated with the computing target entity.

3. The computer-readable medium of claim 1, wherein causing the set of operations to be performed on the set of resources includes requesting the execution of the set of operations using an application programming interface (API) associated with resources managed by the set of tenants.

4. The computer-readable medium of claim 1, wherein the first request further specifies a namespace accessible to the computing target entity, wherein the set of resources managed by the set of tenants is restricted to the namespace specified by the first request for the computing target entity.

5. The computer-readable medium of claim 1, wherein the operation further comprises assigning a specific role from a plurality of roles to a computing target entity, and wherein, The set of resources managed by the set of tenants is restricted based on the roles assigned to the computing target entity.

6. The computer-readable medium of claim 1, wherein the operation further comprises: The service provider system transmits a request for a status update regarding one or more operations of the group of tenants to the resource manager associated with the resources managed by the group of tenants; The service provider system receives status updates from the resource manager regarding the set of one or more operations; as well as The status updates are displayed in association with the target entity in the GUI.

7. The computer-readable medium of claim 1, wherein the set of resources corresponds to a subset of a cluster of computing resources included in the resources managed by the set of tenants.

8. The computer-readable medium of claim 1, wherein the operation further comprises: Receive a second request to create a second computational target entity via a graphical user interface. The second request includes a second infrastructure definition that defines a second set of resources, which (a) are used to implement a second computing target entity and (b) are to be selected from a set of service provider-managed resources implemented within a service provider system.

9. The computer-readable medium of claim 1, wherein the operation further comprises: The set of resources that are configured by the service provider system to be implemented on the tenant's premises and managed by the set of tenants.

10. The computer-readable medium of claim 1, wherein causing the set of operations to be performed comprises: The service provider system executes the application that generates commands to perform the set of operations, and transmits the commands to the resource manager that manages the set of resources for the tenant.

11. The non-transitory computer-readable medium of claim 1, wherein the set of resources includes a set of physical infrastructure resources on a tenant site.

12. A computer-implemented method comprising the operations described in any one of claims 1-11.

13. A system comprising: At least one hardware processor; The system is configured to perform the operation as described in any one of claims 1-11 using the at least one hardware processor.

14. A computer program product storing instructions that, when executed by one or more hardware processors, cause to perform the operation as described in any one of claims 1-11.

15. A system comprising components for performing the operations as described in any one of claims 1-11.

Images