Method for managing access to at least one task executed by a container instantiated in a first compute node of a first cluster of nodes by a compute node belonging to a second cluster of nodes.

Abstract

A method for managing access to at least one task executed by a container instantiated in a first compute node of a first node cluster by a compute node belonging to a second node cluster. The invention relates to an orchestration solution for a plurality of node clusters, enabling a compute node in a first node cluster to access a task executed in a compute node belonging to a second node cluster. Currently, it is difficult for a compute node in a first node cluster to access a task executed in a compute node belonging to a second node cluster, particularly when the two node clusters are not co-located. The present solution enables such access by introducing a supervisor node that allows for seamless and transparent communication between node clusters. Figure for the abstract: Fig. 2

Description

Title of the invention: Method for managing access to at least one task executed by a container instantiated in a first computing node of a first cluster of nodes by a computing node belonging to a second cluster of nodes. Prior art

[0001] The present application belongs to the general field of cloud computing. It relates more particularly to a method for managing access to a task executed in a container instantiated in a first cluster of nodes by a node of another cluster of nodes.

[0002] For several years, telecommunications networks have used virtualized functions hosted in servers, or nodes, grouped into clusters, giving rise to cloud computing.

[0003] A solution for orchestrating these clusters of nodes is known as Kubemetes. [Fig.l] presents in a simplified manner the architecture of a cluster of nodes 1 conforming to the Kubemetes solution. The cluster of nodes 1 comprises a first node 10 called the management node, or “Kubemetes master”, and N computing nodes, or “Kubemetes node”, 1 h, ie { 1, .... N}, N being a natural integer.

[0004] The management node 10 comprises a controller 101, an API (Application Programming Interface) module 102 and a database 103 called ETCD which consists of a dynamic configuration register of the computing nodes 11.

[0005] A computing node 11; comprises M containers or “pods” 110j, j F { 1, ..., M}, M being a natural integer. Each container 110j is provided with resources allowing the execution of one or more tasks. A task when executed contributes to the implementation of a network service or function, such as a DHCP (Dynamic Host Configuration Protocol) function for example.

[0006] In order to reduce costs and improve the flexibility of network infrastructures, cloud computing architectures are most often multi-site architectures in which the constituent nodes of the clusters of nodes can be non-co-located, that is to say deployed in separate sites. For example, a management node 10 and two computing nodes 1 lb 112 of a cluster of nodes 1 are located on a site A while three other computing nodes 113, 114, 115 are located on a remote site B.

[0007] For reasons of flexibility, the services or network functions deployed in a first cluster of nodes may be required to be deployed in parallel in separate clusters of nodes which are sometimes operated by a different provider.

[0008] Such a situation most often arises during an increase in load of this service or this network function in a context where the cluster of nodes in which the latter is deployed cannot ensure such an increase in load alone because its resources are limited or do not meet the needs required to ensure such an increase in load.

[0009] In order to allow continuity in the execution of the network service or function when different tasks relating to this service or this network function are executed in containers instantiated in computing nodes belonging to different clusters of nodes, the master node of a first cluster of nodes is provided with an access module whose function is to maintain an up-to-date database of the network addresses assigned to each container within the first cluster of nodes. This access module, itself provided with a network address intended to be used to communicate with containers instantiated in other clusters of nodes, manages the exchanges of data between the different computing nodes of the first cluster of nodes and the computing nodes of the other clusters of nodes involved in the implementation of the network service or function in question.

[0010] Presented in other words, the access module allows a computing node of another cluster of nodes in which the network service or function is also deployed to access a task relating to this same service or this same network function executed in a container of the first cluster of nodes by making a link between a network address associated with the container executing the task and an identifier of the task received from the computing node belonging to another cluster of nodes requiring access to the task.

[0011] In parallel with the management of communication towards other clusters of nodes, the management node has a module for managing communications internal to the first cluster of nodes. Communications internal to the first cluster of nodes are understood to mean the data exchanges occurring between the different containers instantiated in the computing nodes belonging to the first cluster of nodes. To communicate with another container belonging to the first cluster of nodes, a first container uses a connection identifier, such as a domain name for example, internal to the first cluster of nodes and relating to the container with which it wishes to communicate, called a private connection identifier. Such a private connection identifier is presented for example in the following form: ServiceName.NamespaceName.svc.ClusterName.local.

[0012] The configuration and management of the network addresses used to communicate with other clusters of nodes being carried out locally within a management node of a given cluster of nodes, this makes access by a computing node belonging to another cluster of nodes to the information allowing this computing node to access a task executed by a container instantiated in a computing node of the first cluster of nodes difficult and this is all the more so when the computing node of the first cluster of nodes and the computing node of the other cluster of nodes are not co-located in the same site.

[0013] Such difficulty in accessing a given task can have a negative impact on the continuity of service and ultimately on the quality of the service provided. Statement of the invention

[0014] The present invention aims to remedy all or part of the drawbacks of the prior art, in particular those set out above, by proposing a solution which allows a computing node of a given cluster of nodes to access in a fluid and transparent manner a task executed by a container instantiated in a computing node belonging to another cluster of nodes, particularly, but not only, when the two computing nodes are not co-located.

[0015] To this end, and according to a first aspect, the invention relates to a method for managing access to at least one task executed by a container instantiated in a first computing node of a first cluster of nodes, said method being implemented by a management node of the first cluster of nodes and comprising the following steps:

[0016] - obtaining task access parameters,

[0017] - generation of a connection identifier corresponding to the task, called the task identifier public connection, intended to be used by the second compute node to access the task, based on access parameters authorizing access to the task by a second compute node belonging to a second cluster of nodes,

[0018] - transmission, to a supervision node of the first cluster of nodes and the second cluster of nodes, a message including the public connection identifier corresponding to the task.

[0019] It should be noted that the term "supervisory node" refers to a new entity, which may be a software and / or hardware entity and whose function is to manage the interactions between the management nodes of different clusters of nodes. More specifically, such a supervision node allows, among other things, a computing node of a given cluster of nodes to access in a fluid and transparent manner a task executed by a container instantiated in a computing node belonging to another cluster of nodes, in particular when the two computing nodes are not co- located as will be described in more detail later in this document.

[0020] For operational efficiency purposes, but also for the purpose of reducing deployment and maintenance costs, such a supervision node is generally co-located with the management nodes of the clusters of nodes that it supervises.

[0021] Thus, the method according to the invention advantageously makes it possible to manage access to a task executed by a container instantiated in a computing node of a first cluster of nodes by computing nodes belonging to another cluster of nodes in a transparent manner.

[0022] The access parameters for a task are, for example, manually recorded when configuring the task in the container in which it is executed. They may also be provided with other instructions relating to the execution of the task. Finally, they may also evolve over time.

[0023] In the remainder of this document, it should be noted that the term "public connection identifier" covers both a domain name and a network address such as an IP address or any other type of identifier allowing a connection to be established (to include DNS, proxy or even the IP address of a public plan).

[0024] Finally, the term “container” covers both an operating software application, a virtual machine or a hardware device.

[0025] In particular modes of implementation, these parameters belong to a group comprising: a parameter authorizing or not the sharing of the public connection identifier, a parameter authorizing or not the transmission of data obtained during the execution of the task to computing nodes belonging to another cluster of nodes, and a parameter authorizing or not the reception of data from computing nodes belonging to another cluster of nodes intended to be used during the execution of the task.

[0026] In particular embodiments, the method comprising the generation of a task access rule using the task access parameters, the application of the access rule triggers the generation of the public connection identifier when the access rule authorizes access to the task by the second computing node.

[0027] As will be described in more detail in the remainder of this document with reference to particular embodiments of the present invention, the management node of the first cluster of nodes incorporates a new input / output management module whose function is to generate access rules for a given task based on access parameters relating to this task. Such an input / output management module may be a software and / or hardware module.

[0028] Such access rules are regularly updated in order to quickly and dynamically take into account any changes in the access parameters to a given task. The solution which is the subject of the present invention thus offers great responsiveness unlike state-of-the-art solutions in which any change in the access conditions for a given task is entered manually. Here, simply receiving an update file by the cluster management node allows updating the access rules for a task for a set of clusters.

[0029] In particular embodiments, the public connection identifier is associated with a network address of a proxy server instantiated in the first computing node.

[0030] Such a proxy server makes it possible to resolve the public connection identifier provided by the second computing node of the second cluster of nodes seeking to access the task in order to be able to establish communication between this computing node and the container executing the task.

[0031] In particular embodiments, the method comprises sending to the supervision node an authorization to resolve the public connection identifier.

[0032] According to a second aspect, the invention relates to a method for managing access to at least one task executed by a container instantiated in a first computing node of a first cluster of nodes, said method being implemented by a supervision node of the first cluster of nodes and of at least one second cluster of nodes and comprising the following steps:

[0033] - reception of a connection identifier corresponding to the task, called the task identifier public connection, intended to be used by a second compute node belonging to the second node cluster to access the task when access parameters allow access to the task by the second compute node,

[0034] - when the supervisory node has authorization to resolve the identifier public login corresponding to the task, association of the public login identifier with a network address of a proxy server instantiated in the first compute node.

[0035] In particular embodiments, the method comprises receiving authorization to resolve the public connection identifier from a management node of the first cluster of nodes.

[0036] According to a third aspect, the invention relates to a method for accessing at least one task executed by a container instantiated in a first computing node of a first cluster of nodes, said method being implemented by a computing node of a second cluster of nodes and comprising the following steps: - transmission of a first request for resolution of a connection identifier corresponding to the task, called public connection identifier, to a supervision node of the first cluster of nodes and the second cluster of nodes, - receiving a network address from a proxy server instantiated in the first computing node associated with the public connection identifier, - transmission of a second request to resolve the public connection identifier to the proxy server, - reception of data obtained during the execution of the task.

[0037] According to a fourth aspect, the invention relates to a method for accessing at least one task executed by a container instantiated in a first computing node of a first cluster of nodes, said method being implemented by a supervision node of a first cluster of nodes and of at least one second cluster of nodes and comprising the following steps: - at the supervision level, receipt of a request to resolve a connection identifier corresponding to the task, called a public connection identifier, from a second computing node of a second cluster of nodes wishing to access the task, - verification of an authorization to resolve the public connection identifier, - when the monitoring node has an authorization to resolve the public connection identifier, transmission to the second computing node of a network address of a proxy server instantiated in the first computing node associated with the public connection identifier.

[0038] According to a fifth aspect, the invention relates to a method for accessing at least one task executed by a container instantiated in a first computing node of a first cluster of nodes, said method being implemented by the first computing node and comprising the following steps: - reception, from a second computing node of a second cluster of nodes wishing to access the task, of a request to resolve a connection identifier corresponding to the task, called a public connection identifier, - verification of a task access rule generated using task access parameters, - when the access rule allows access to the task by the second computing node, resolution of the public connection identifier, - transmission, to the second computing node, of data obtained during the execution of the task.

[0039] According to a sixth aspect, the invention relates to a management node of a first cluster of nodes capable of managing access to at least one task executed by a container instantiated in a first computing node of the first cluster of nodes, the management node comprising at least one processor configured to: - obtain access parameters to the task, - generate a connection identifier corresponding to the task, called a public connection identifier, intended to be used by the second computing node to access the task, based on access parameters authorizing access to the task by a second computing node belonging to a second cluster of nodes, - transmit, to a monitoring node of the first cluster of nodes and the second cluster of nodes, a message including the public connection identifier corresponding to the task.

[0040] According to a seventh aspect, the invention relates to a supervision node of a first cluster of nodes and at least one second cluster of nodes capable of managing access to at least one task executed by a container instantiated in a first computing node of the first cluster of nodes, the supervision node comprising at least one processor configured to: - receive a connection identifier corresponding to the task, called a public connection identifier, intended to be used by a second computing node belonging to the second cluster of nodes to access the task when access parameters authorize access to the task by the second computing node, - when the monitoring node has authorization to resolve the public connection identifier corresponding to the task, - associate the public login ID with a network address of a proxy server instantiated in the first compute node.

[0041] According to an eighth aspect, the invention relates to a computing node of a second cluster of nodes capable of accessing at least one task executed by a container instantiated in a first computing node of a first cluster of nodes, the computing node comprising at least one processor configured to: - transmit a first request for resolution of a connection identifier corresponding to the task, called public connection identifier, to a supervision node of the first cluster of nodes and the second cluster of nodes, - receive a network address from a proxy server instantiated in the first compute node associated with the public connection identifier, - transmit a second request to resolve the public connection identifier to the proxy server, - receive data obtained during the execution of the task.

[0042] According to a ninth aspect, the invention relates to a computing node of a first cluster of nodes capable of providing access to at least one task executed by a container instantiated in a first computing node of the first cluster of nodes, the computing node comprising at least one processor configured to: - receive, from a second computing node of a second cluster of nodes wishing to access the task, a request to resolve a connection identifier corresponding to the task, called a public connection identifier, - check a task access rule generated using task access parameters, - when the access rule allows access to the task by the second compute node, resolve the public connection identifier, - transmit, to the second computing node, data obtained during the execution of the task.

[0043] Finally, the invention relates to a computer program comprising instructions for implementing a quality control method according to the invention or a wear control method according to the invention when said computer program is executed by a computer.

[0044] This program may use any programming language, and be in the form of source code, object code, or code intermediate between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0045] According to a fourth aspect, the invention relates to one or more information or recording media readable by a computer on which a computer program according to the invention is recorded.

[0046] The information or recording medium may be any entity or device capable of storing the program. For example, the medium may comprise a storage means, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or a magnetic recording means, for example a hard disk.

[0047] On the other hand, the information or recording medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means. The program according to the invention may in particular be downloaded from a network such as the Internet.

[0048] Alternatively, the information or recording medium may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question. List of figures

[0049] Other aims, characteristics and advantages of the invention will appear more clearly on reading the following description, given as a simple illustrative, and non-limiting, example, in relation to the figures, among which:

[0050] [Fig.l]: this figure represents in a simplified manner the architecture of a cluster of nodes conforming to the prior art,

[0051] [Fig.2]: this figure represents in a simplified manner an architecture conforming to the solution which is the subject of the present invention comprising two clusters of nodes,

[0052] [Fig.3]: this figure represents the steps of the methods for managing access to a task when they are implemented by the different constituents of a cluster of the first cluster of nodes 1 and the supervision node 3,

[0053] [Fig.4]: this figure represents a first orchestration loop,

[0054] [Fig.5]: this figure represents a second orchestration loop,

[0055] [Fig.6]: this figure represents the steps of a method of accessing task T when they are implemented by the different constituents of the first cluster of nodes, the second cluster of nodes and the supervision node,

[0056] [Fig.7]: this figure represents a management node capable of implementing the various methods which are the subject of the present invention,

[0057] [Fig.8]: this figure represents a supervision node capable of implementing the various methods which are the subject of the present invention,

[0058] [Fig.9]: this figure represents a computing node belonging to a cluster of nodes capable of implementing the various methods which are the subject of the present invention.

[0059] Detailed description of embodiments of the invention

[0060] [Fig.2] presents in a simplified manner an architecture conforming to the solution object of the present invention comprising two clusters of nodes 1 and 2 supervised by a supervision node 3. The elements already described with reference to [Fig.l] retain the same reference signs.

[0061] The first cluster of nodes 1 comprises a first node 10 called the management node, or “Kubemetes master”, and N computing nodes, or “Kubemetes node”, 1I,, i G { 1, ..., N}, N being a natural integer.

[0062] The management node 10 comprises a controller 101, an API (Application Programming Interface) module 102, a database 103 called ETCD which consists of a dynamic configuration register of the computing nodes 11, an input / output management module 104 and a domain name resolution server 105 internal to the first cluster of nodes 1.

[0063] Finally, a computing node 11; comprises M containers or “pods” 110j, j G {1, .,., M}, M being a natural integer. Each container 110j is provided with resources allowing the execution of one or more tasks. A task when executed contributes to the implementation of a network service or function, such as a DHCP (Dynamic Host Configuration Protocol), DNS (Domain Name System) or SLP (Service Location Protocol) for example. Such a computing node 11; also comprises a proxy server 1100 called “SVC proxy” whose function will be described later.

[0064] More specifically, the input / output management module 104 makes it possible to manage access authorizations, by a computing node belonging to another cluster of nodes, to a task executed in one of the containers 110j instantiated on one of the computing nodes 11; in input and output.

[0065] The domain name resolution server 105 makes it possible to resolve a connection identifier corresponding to the task, called a private connection identifier, intended to be used by another container 110^j instantiated in the same computing node 11; or in another computing node 11h^ wishing to access the task. Such a private connection identifier is presented for example in the following form: servicel. namespace. svc. kubemetesl. local.

[0066] It should be noted that in this [Fig. 1], the computing nodes 11; belonging to the first cluster of nodes 1 have been represented as being co-located. As already explained earlier in this document, the computing nodes 1 h belonging to the first cluster of nodes 1 may be respectively located on separate sites and distant from each other.

[0067] Similarly, the first cluster of nodes 1, the second cluster of nodes 2 also comprises a first management node 20 and N computing nodes 21;, i G { L .. •, N}, N being a natural integer.

[0068] Just like the management node 10 of the first cluster of nodes 1, the management node 20 comprises a controller 201, an API module 202, a database 203 called ETCD which consists of a dynamic configuration register of the computing nodes 21;, an input / output management module 204 and a domain name resolution server 205 internal to the second cluster of nodes 2.

[0069] The computing node 21; comprises M containers or “pods” 210j, i { 1, ..., M}, M being a natural integer. Each container 210j is provided with resources allowing the execution of one or more tasks. Such a computing node 21; also comprises a proxy server 2100 called “SVC proxy”.

[0070] The input / output management module 204 makes it possible to manage access authorizations, by a computing node belonging to another cluster of nodes, to a task executed in one of the containers 210j instantiated on one of the computing nodes 21; in input and output.

[0071] The domain name resolution server 205 also makes it possible to resolve a connection identifier corresponding to the task, called a private connection identifier, intended to be used by another container 210;^ instantiated in the same computing node 21; or in another computing node 21h^ wishing to access the task. Such a private login ID is for example in the following form: services, namespace. svc. kubemetes2. local

[0072] As previously described with reference to the first cluster of nodes 1, the computing nodes 21; belonging to the second cluster of nodes 21 have been represented, in [Fig.l], as being co-located, nevertheless, in certain particular implementation modes, the computing nodes 21; belonging to the second cluster of nodes 2 may be respectively located on separate sites and distant from each other.

[0073] Finally, the architecture represented in [Fig.2] comprises a supervision node 3. Such a supervision node 3 may be a software and / or hardware entity whose function is to manage the interactions between the management nodes 10 and 20 of different clusters of nodes 1, 2. More specifically, such a supervision node 3 allows, among other things, a computing node 21; of the second cluster of nodes 2 to access in a fluid and transparent manner a task executed by a container 110j instantiated in a computing node 11; belonging to the first cluster of nodes 1 in particular, but not exclusively, when the two computing nodes 11; and 21; are not co-located.

[0074] In particular modes of implementation, such a supervision node 3 is co-located with the management nodes 10 and 20 of the clusters of nodes 1 and 2 that it supervises.

[0075] In order to be able to fulfill its supervision function, the supervision node 3 comprises, among other things, a module for controlling an access authorization to a task 31, a database 32 called ETCD which consists of a dynamic configuration register of the management nodes 10 and 20 as well as the calculation nodes 11; and 21; of all the supervised node clusters, and a domain name resolution server 33 whose function is to resolve a connection identifier corresponding to the task, called public connection identifier, intended to be used by a calculation node 21; belonging to the second cluster of nodes 2 to access a task T executed by a container 110j instantiated in a calculation node 11; belonging to the first cluster of nodes 1.

[0076] [Fig.3] represents the steps of the methods for managing access to a task when they are implemented by the different constituents of a cluster of the first cluster of nodes 1 and the supervision node 3.

[0077] In a step E1, the controller 101 of the management node 10 obtains a set of access parameters PT to a task T intended to be executed by a container 110j instantiated on a computing node 1h belonging to the first cluster of nodes 1. This set of access parameters PT comprises three parameters: an SDNS parameter authorizing or not the sharing of a public connection identifier associated with the task T by the supervision node 3, an AS parameter authorizing or not the transmission of data from the container 110j executing the task T to a computing node 21; of the second cluster of nodes 2 and an AE parameter authorizing or not the reception of data sent by the computing node 21; of the second cluster of nodes 2 by the container 11 Oj executing the task T. The value of each of these parameters is “true” or “false”, the value “true” meaning that the sharing of the connection identifier, the transmission of data and the reception of data are authorized, and as a corollary, the value “false” meaning that these actions are not authorized.

[0078] In particular implementation modes, the set of access parameters PT can be transmitted to the management node 10 by equipment of a telecommunications network managed by the same telecommunications operator managing the first cluster of nodes 1, for example, within a service declaration.Such a service declaration includes all the parameters necessary to create the task T in the container 110j. .

[0079] An example of such a service statement is as follows: apiVersion: vl kind: Service metadata: namespace: nameNamespace name: nameService spec: type: NodePort SDNS: true / false AS: true / false AE: true / false selector: app:nameDeployment ports: protocol: TCP port: portnumber targetPort: targetPort nodePort: nodePort

[0080] Receiving the service declaration triggers the generation of the private connection identifier associated with the task T by the controller 101 during a step E2. As a reminder, such a private connection identifier can be the following: servicel. namespace. svc. kubemetesl. local.

[0081] In a step E3, the controller 101 then transmits, to the domain name resolution server 105, the private connection identifier as well as a network address, identifying the container 110j executing the task T, and where appropriate a port number identifying a port of the container 110j through which data relating to the task T can be exchanged.

[0082] During a step E4 which may be concomitant or subsequent to step E3, the controller 101 transmits the values ​​of the SDNS, AS and AE parameters relating to the task T to the input / output management module 104 which then generates an access rule to the task T by means of these values. Such an access rule to the task T is then stored in the database 103 in a step E5.

[0083] During a step E6, an orchestration loop is implemented by the first cluster of nodes 1. Such an orchestration loop is described with reference to [Fig.4] described below.

[0084] An orchestration loop is a process implemented in a cluster of nodes during which the execution conditions of the tasks executed by the computing nodes 1 h are updated according to: information included in the database 103 and information on the current execution conditions of the tasks by the computing nodes 11;.

[0085] The information on the current execution conditions of the tasks is sent by the calculation nodes 1 h to the controller 101 or to the API module 102. The updating of the contents of the database 103 is independent of the execution of an orchestration loop.

[0086] The generation or updating of an access rule to a task T impacting the execution of the task T by the computing nodes 11; of the first cluster of nodes 1, the implementation of such an orchestration loop makes it possible to update the operation of the first cluster of nodes 1.

[0087] Thus, the execution of an orchestration loop makes it possible to take into account the conditions of access to the task T during the execution of the latter by the computing node 11;. At the end of the execution of the orchestration loop, if this is provided for by the access rule to the task T, the latter becomes accessible to a computing node 21j of the second cluster of nodes 2.

[0088] Thus, in a step G1 the controller 101 transmits a request for information DI relating to the task T to the API module 102.

[0089] In a step G2, the API module 102 transmits the request for information DI, in particular information relating to the rules or conditions of access to the task T to the database 103.

[0090] During a step G3, the database 103 transmits the required information to the API module 102. The API module 102 then transmits this information to the controller 101 during a G4 stage.

[0091] In a step G5, the controller 101 transmits a request RQT in application of an access configuration determined by means of the information received at the input / output management module 104 during step G4.

[0092] Once the management module has applied the required configuration, it transmits an acknowledgment message ACK to the controller 101 in a step G6.

[0093] Returning to [Fig.3], at the end of the implementation of the orchestration loop, the control 101 generates, in a step E7, a connection identifier corresponding to the task, called the public connection identifier, intended to be used by the computing node 21i belonging to the second cluster of nodes 2 to access the task T. Such a public connection identifier may be, for example, the following: servicel. namespace. svc. kubemetesl. cluster

[0094] The public connection identifier associated with the task T as well as the access rule to the task T are then transmitted respectively to the domain name resolution server 33 and the module controlling an authorization of access to a task 31, both embedded in the supervision node 3 in a step E8.

[0095] In a step E9, the domain name resolution server 33 checks with the task access authorization control module 31 what the conditions of access to the task T are: is a computing node 21j of the second cluster of nodes 2 authorized to transmit and / or receive data to / from the container 110j executing the task T?

[0096] When it is determined that a computing node 21j of the second cluster of nodes 2 is authorized to transmit and / or receive data to / from the container 110j executing the task T, the domain name resolution server 33 associates the public connection identifier associated with the task T with a network address of the proxy server 1100 of the computing node 11; executing the task T during a step E10.

[0097] Such a correspondence between the public connection identifier associated with the task T and a network address of the proxy server 1100 of the computing node 11; executing the task T is then stored in the database 32 in a step Eli.

[0098] During a step E12, an orchestration loop is implemented by the supervision node 3. Such an orchestration loop is described with reference to [Fig.5].

[0099] Such an orchestration loop is a process during which the operating conditions of the management nodes 10, 20 of the clusters of nodes 1, 2 supervised by the supervision node 3 are updated as a function of: information included in the database 32 and information on the current operating conditions of the management nodes 10, 20.

[0100] Information on the current execution conditions of tasks is sent back by the management nodes 10, 20 to a controller or to an API module (both not shown in the figures) embedded in the supervision node 3. The updating of the contents of the database 32 is independent of the execution of an orchestration loop.

[0101] The reception of an access rule to a task T and the association of the public connection identifier associated with the task T with a network address of the proxy server 1100 of the computing node 11; executing the task T impacting the interactions between the different clusters of nodes 1, 2, the implementation of such an orchestration loop makes it possible to update the operation of the supervision node 3.

[0102] At the end of the execution of the orchestration loop, the supervision node is capable of allowing access to a task T by a computing node 21j of the second cluster of nodes 2.

[0103] Thus, in a step H1 the controller transmits a request for information DI relating to the task T to the API module.

[0104] In a step H2, the API module transmits the request for information DI, in particular information relating to the rules or conditions of access to the task T, to the module controlling an authorization of access to a task 31.

[0105] During a step H3, the module controlling an authorization of access to a task 31 interrogates the database 32 in order to obtain the conditions of access to the task T.

[0106] After retrieving the access conditions to the task T from the database 32, the module for controlling an access authorization to a task 31 transmits the required information to the API module in a step H4. The API module then transmits this information to the controller during a step H5.

[0107] In a step H6, the controller transmits, to the domain name resolution server 33, an RQT request in application of an access configuration determined by means of the information received during step H5.

[0108] Once the domain name resolution server 33 has applied the required configuration, it transmits an acknowledgment message ACK to the controller in a step H7.

[0109] At the end of the execution of the orchestration loop, the different constituents of the first cluster of nodes 1 and the supervision node 3 have been configured and are able to process a request for access to the task T sent by a computing node 21j of the second cluster of nodes 2.

[0110] [Fig.6] represents the steps of a method of accessing task T when they are implemented by the different constituents of the first cluster of nodes 1, of the second cluster of nodes 2 and of the supervision node 3.

[0111] When a computing node 21j of the second cluster of nodes 2 wishes to exchange data with a task T executed by a container 110j instantiated on a node of calculation 1 li belonging to the first cluster of nodes 1, it implements a step Fl during which it sends to the domain name resolution server 205 internal to the second cluster of nodes 2 a request for resolution of the public connection identifier associated with the task T service 1 .namespace.svc.kubemetesl.cluster. According to an example, this connection identifier is standardized. In this case, it will always be constructed in the same way. It can be entered, for example, by an administrator in a task configuration file.

[0112] Seeing that it cannot resolve the connection identifier received during step F1 since it is not a private connection identifier specific to the second cluster of nodes 2 but a public connection identifier relating to another cluster of nodes, the domain name resolution server 205 then transmits, in a step F2, the request for resolution of the public connection identifier associated with the task T to the domain name resolution server 33 of the supervision node 3 on which the second cluster of nodes 2 depends.

[0113] Upon receipt of this request for resolution of the connection identifier, the domain name resolution server 33 queries, in a step F3, the module for controlling an authorization for access to a task 31 so that the latter informs it of the existence or absence of an authorization to resolve the public connection identifier. In other words, the module for controlling an authorization for access to a task 31 checks whether the value of the SDNS parameter is "true", in which case an authorization for resolution of the public connection identifier exists, or if this value is "false", meaning, then, that there is no authorization for resolution of the public connection identifier or that the latter is no longer valid.

[0114] If the value of the SDSN parameter reported by the module controlling an access authorization to a task 31 is “false”, the access process ends.

[0115] If the SDSN parameter value reported by the module controlling an access authorization to a task 31 is "true", the domain name resolution server 33 resolves the public connection identifier servicel.namespace.svc.kubemetesl.cluster and transmits to the domain name resolution server 205, in a step F4, the network address of the proxy server 1100 of the computing node 11; executing the task T with which it was associated during the step E10 described previously with reference to [Fig.3].

[0116] In turn, the domain name resolution server 205 transmits the network address of the proxy server 1100 of the computing node 1 h executing the task T to the computing node 21j in a step F5.

[0117] Once in possession of the network address of the proxy server 1100 of the computing node 1 h executing the task T, the computing node 21j sends, to the latter a request for access to the task T, for example in the form of an https request including the public connection identifier associated with the task T in a step F6.

[0118] Seeing that the request for access to the task T includes the public connection identifier associated with the latter, the proxy server 1100 queries, in a step F7, the input / output management module 104 in order to determine what the conditions of access to the task T are when this access is requested by a computing node not belonging to the cluster of nodes.

[0119] Upon receipt of this request, the input / output management module 104 checks whether the value of the parameters AE and AS is “true” meaning that a computing node belonging to another cluster of nodes can transmit, respectively receive, data to, respectively from, the container 110j executing the task T, or “false” meaning that the computing node belonging to another cluster of nodes cannot transmit, respectively cannot receive, data to, respectively from, the container 110j executing the task T.

[0120] If the value of the AE parameter and the value of the AS parameter reported by the input / output management module 104 are both “false”, the access process ends.

[0121] If the value of at least one of the parameters AE or AS reported by the input / output management module 104 is “true”, then the method continues.

[0122] Upon receipt of information that the computing node 21j belonging to the cluster of nodes 2 can transmit and / or receive data to / from the container 110j executing the task T, the proxy server 1100 replaces the “cluster” extension of the public connection identifier servicel.namespace.svc.kubemetesl.cluster with the "local" extension in an F8 step. This modified connection identifier corresponds to the private connection identifier servicel.namespace.svc.kubemetesl.local, associated with task T within node cluster 1.

[0123] In a step F9, the proxy server 1100 transmits a request for resolution of a connection identifier comprising the private connection identifier associated with the task T to the domain name resolution server 105.

[0124] In response to this request for resolution of the connection identifier, the domain name resolution server 105 transmits, to the proxy server 1100, the network address of the container 110j executing the task T as well as the port number identifying the port of the container 110j through which data relating to the task T can be exchanged during a step F10.

[0125] The proxy server then transfers the request for access to task T to container 110j in a Fil step.

[0126] In response to receiving this task access request, the container 110j establishes, during a step F12, a communication session with the computing node 21j during which the container 110j sends and / or receives data to / from the computing node 21j.

[0127] [Fig.7] represents a management node 10, 20 capable of implementing the various methods which are the subject of the present invention.

[0128] A management node 10, 20 may comprise at least one hardware processor 701, a storage unit 702, and at least one communication interface 703, which are connected to each other through a bus 704 in addition to the API module 102, 202, the controller 101, 201, the database 103, 203, an input / output management module 104, 204 and a domain name resolution server 105, 205. Of course, the constituent elements of the management node 10, 20 may be connected by means of a connection other than a bus.

[0129] The processor 701 controls the operations of the management node 10, 20. The storage unit 702 stores at least one program for implementing the various methods that are the subject of the invention to be executed by the processor 701, and various data, such as parameters used for calculations performed by the processor 701, intermediate data of calculations performed by the processor 701, etc. The processor 701 may be formed by any known and suitable hardware or software, or by a combination of hardware and software. For example, the processor 701 may be formed by dedicated hardware such as a processing circuit, or by a programmable processing unit such as a central processing unit (Central Processing Unit) which executes a program stored in a memory thereof.

[0130] The storage unit 702 may be formed by any suitable means capable of storing the program(s) and data in a computer-readable manner. Examples of the storage unit 702 include non-transitory computer-readable storage media such as semiconductor memory devices, and magnetic, optical, or magneto-optical recording media loaded into a read-write unit.

[0131] The interface 703 provides an interface between the management node 10, 20 and at least one computing node 11^2^ belonging to the same cluster of nodes as the management node 10, 20 or with a supervision node 3.

[0132] [Fig.8] represents a supervision node 3 capable of implementing the various methods which are the subject of the present invention.

[0133] A supervision node 3 may comprise at least one hardware processor 801, a storage unit 802, and at least one communication interface 803, which are connected to each other through a bus 804 in addition to the API module, the controller, the module controlling an access authorization to a task 31, the database 32, and a domain name resolution server 33. Of course, the constituent elements of the supervisory node 3 can be connected by means of a connection other than a bus.

[0134] The processor 801 controls the operations of the management node 10. The storage unit 802 stores at least one program for implementing the various methods that are the subject of the invention to be executed by the processor 801, and various data, such as parameters used for calculations performed by the processor 801, intermediate data of calculations performed by the processor 801, etc. The processor 801 may be formed by any known and suitable hardware or software, or by a combination of hardware and software. For example, the processor 801 may be formed by dedicated hardware such as a processing circuit, or by a programmable processing unit such as a central processing unit (Central Processing Unit) which executes a program stored in a memory thereof.

[0135] The storage unit 802 may be formed by any suitable means capable of storing the program(s) and data in a computer-readable manner. Examples of the storage unit 802 include non-transitory computer-readable storage media such as semiconductor memory devices, and magnetic, optical, or magneto-optical recording media loaded into a read-write unit.

[0136] The interface 803 provides an interface between the supervision node 3 and at least one management node 10, 20 belonging to one of the clusters of nodes 1, 2 supervised by the supervision node 3.

[0137] [Fig.9] represents a computing node 11;, 21; belonging to a cluster of nodes 1.2 capable of implementing the various methods which are the subject of the present invention.

[0138] A computing node 11;, 21; may comprise at least one hardware processor 901, a storage unit 902, and at least one communication interface 903, which are connected to each other through a bus 904 in addition to the M containers 110j, 210j and the proxy server 1100, 2100. Of course, the constituent elements of the computing node 11;, 21; may be connected by means of a connection other than a bus.

[0139] The processor 901 controls the operations of the management node 10. The storage unit 802 stores at least one program for implementing the various methods that are the subject of the invention to be executed by the processor 901, and various data, such as parameters used for calculations performed by the processor 901, intermediate data of calculations performed by the processor 901, etc. The processor 901 may be formed by any known and suitable hardware or software, or by a combination of hardware and software. For example, the processor 901 may be formed by dedicated hardware such as a processing circuit, or by a programmable processing unit such as a central processing unit (Central Processing Unit) which executes a program stored in a memory thereof.

[0140] The storage unit 902 may be formed by any suitable means capable of storing the program(s) and data in a computer-readable manner. Examples of the storage unit 902 include non-transitory computer-readable storage media such as semiconductor memory devices, and magnetic, optical, or magneto-optical recording media loaded into a read-write unit.

[0141] The interface 903 provides an interface between the computing node 11;, 21; and the management node 10, 20 of the cluster of nodes 1, 2 to which it belongs or with the supervision node 3.

Claims

Claims

1. Method for managing access to at least one task executed by a container instantiated in a first computing node of a first cluster of nodes, said method being implemented by a management node of the first cluster of nodes and comprising the following steps: - obtaining access parameters to the task, - generating a connection identifier corresponding to the task, called a public connection identifier, intended to be used by a second computing node belonging to a second cluster of nodes to access the task, according to access parameters authorizing access to the task by said second computing node, - transmitting, to a supervision node of the first cluster of nodes and of the second cluster of nodes, a message comprising the public connection identifier corresponding to the task.

2. A management method according to claim 1 comprising generating a task access rule using the task access parameters, the application of the access rule triggering the generation of the public connection identifier when the access rule authorizes access to the task by the second computing node.

3. Management method according to claim 1 or claim 2 wherein the public connection identifier is associated with a network address of a proxy server instantiated in the first computing node.

4. Management method according to claim 3 comprising the transmission to the supervision node of an authorization to resolve the public connection identifier.

5. Method for managing access to at least one task executed by a container instantiated in a first computing node of a first cluster of nodes, said method being implemented by a supervision node of the first cluster of nodes and of at least one second cluster of nodes and comprising the following steps: - receiving a connection identifier corresponding to the task, called public connection identifier, intended to be used by a second computing node belonging to the second cluster of nodes to access the task when access parameters authorize access to the task by the second computing node, - when the supervision node has authorization to resolve the public login ID corresponding to the task, association of the public login ID with a network address of a proxy server instantiated in the first compute node.

6. The management method of claim 5 comprising receiving authorization to resolve the public login identifier from a management node of the first cluster of nodes.

7. Method for accessing at least one task executed by a container instantiated in a first computing node of a first cluster of nodes, said method being implemented by a computing node of a second cluster of nodes and comprising the following steps: - transmission of a first request for resolution of a connection identifier corresponding to the task, called public connection identifier, to a supervision node of the first cluster of nodes and of the second cluster of nodes, - reception of a network address of a proxy server instantiated in the first computing node associated with the public connection identifier, - transmission of a second request for resolution of the public connection identifier to the proxy server, - reception of data obtained during the execution of the task.

8. Method for accessing at least one task executed by a container instantiated in a first computing node of a first cluster of nodes, said method being implemented by a supervision node of a first cluster of nodes and at least one second cluster of nodes and comprising the following steps: at the supervision level - reception of a request for resolution of a connection identifier corresponding to the task, called public connection identifier, from a second computing node of a second cluster of nodes wishing to access the task, - verification of an authorization to resolve the public connection identifier, - when the supervision node has an authorization to resolve the public connection identifier, transmission to des- destination of the second compute node, a network address of a proxy server instantiated in the first compute node associated with the public connection identifier.

9. Method for accessing at least one task executed by a container instantiated in a first computing node of a first cluster of nodes, said method being implemented by the first computing node and comprising the following steps: - receiving, from a second computing node of a second cluster of nodes wishing to access the task, a request to resolve a connection identifier corresponding to the task, called a public connection identifier, - verifying a task access rule generated by means of task access parameters, - when the access rule authorizes access to the task by the second computing node, resolving a public connection identifier, - transmitting, to the second computing node, data obtained during the execution of the task.

10. Management node of a first cluster of nodes capable of managing access to at least one task executed by a container instantiated in a first computing node of the first cluster of nodes, the management node comprising at least one processor configured to: - obtain access parameters to the task, - generate a connection identifier corresponding to the task, called a public connection identifier, intended to be used by a second computing node belonging to a second cluster of nodes to access the task, according to access parameters authorizing access to the task by said second computing node, - transmit, to a supervision node of the first cluster of nodes and the second cluster of nodes, a message comprising the public connection identifier corresponding to the task.

11. Supervisory node of a first cluster of nodes and at least one second cluster of nodes capable of managing access to at least one task executed by a container instantiated in a first node of calculating the first cluster of nodes, the supervisory node comprising at least one processor configured to: - receive a connection identifier corresponding to the task, called a public connection identifier, intended to be used by a second computing node belonging to the second cluster of nodes to access the task when access parameters authorize access to the task by the second computing node, - when the monitoring node has permission to resolve the public login ID corresponding to the task, associate the public login ID with a network address of a proxy server instantiated in the first compute node.

12.

13. Compute node of a second cluster of nodes capable of accessing at least one task executed by a container instantiated in a first computing node of a first cluster of nodes, the computing node comprising at least one processor configured to: transmitting a first request to resolve a connection identifier corresponding to the task, called the public connection identifier, to a monitoring node of the first cluster of nodes and the second cluster of nodes, receiving a network address of a proxy server instantiated in the first computing node associated with the public connection identifier, transmitting a second request to resolve the public connection identifier to the proxy server, receiving data obtained during the execution of the task. Computing node of a first cluster of nodes capable of providing access to at least one task executed by a container instantiated in a first computing node of the first cluster of nodes, the computing node comprising at least one processor configured to: receive, from a second computing node of a second cluster of nodes wishing to access the task, a request to resolve a connection identifier corresponding to the task, called a public connection identifier, verify a task access rule generated by means of pa task access meters, when the access rule allows access to the task by the second computing node, resolve the public connection identifier, transmit, to the second computing node, data obtained during the execution of the task.

Images