Cross-Cluster Control Plane Trust for Autonomous Cluster Uptime
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtualization management servers in software-defined datacenters act as a single point of failure, leading to potential unplanned downtime or planned upgrades that disrupt the control and management planes for host clusters, compromising the availability and uptime of infrastructure management.
Innovation Solution
Implementing a cross-cluster control plane (xCCP) and cluster control plane (CCP) in an autonomous cluster, where trust data is provided to a hypervisor, persisted in a database, and accessed by a security token service to authenticate access, establishing a decentralized management system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a centralized virtualization management server is used to manage host clusters, then ease of operation and centralized control are improved, but reliability deteriorates because the server becomes a single point of failure
Solution Approach 1:
The patent segments the centralized management function into distributed control plane components (VIMs and orchestrators) that can operate independently across multiple hosts. Each host runs its own control plane instances, eliminating the single point of failure while maintaining management capabilities through distributed coordination.
Solution Approach 2:
The patent introduces trust data and security token services as intermediaries that enable secure communication and authentication between distributed control plane components. The trust data stored in databases on each host acts as a mediator that verifies identities and establishes secure connections without requiring a centralized authentication server.
2Reliability
If control plane components are distributed across multiple hosts, then reliability and availability are improved, but device complexity increases
Solution Approach 1:
The patent implements universal control plane components that can function in multiple roles. The same VIM and orchestrator software can operate as a management entity for its local host, a peer entity for cross-host operations, and a client to external management systems. This multi-functionality reduces the need for specialized components and simplifies the overall system architecture.
Solution Approach 2:
The patent uses parameter changes in the form of trust data configuration and security token generation to manage complexity. By dynamically generating and validating security tokens based on stored trust data, the system automates authentication and authorization processes, reducing the operational complexity of managing distributed components.
3Reliability
If trust data is persisted in local databases on each host, then authentication reliability is improved, but data security risks increase
Solution Approach 1:
The patent segments the authentication data storage across multiple distributed databases on different hosts rather than centralizing it. Each host stores its own trust data locally, which eliminates the single point of failure for authentication while also distributing the security risk. Compromise of one local database does not affect the authentication capability of other hosts.
Solution Approach 2:
The patent implements security token services that generate time-limited, purpose-specific authentication tokens before actual operations occur. These pre-generated tokens with limited scope and validity periods provide a cushion against security breaches, as even if trust data is compromised, the impact is limited to the specific tokens that were generated and their validity periods.
Data Source
AI summary
An example method of establishing trust between a cross-cluster control plane (xCCP) and a cluster control plane (CCP) of an autonomous cluster of hosts in a virtualized computing system includes: providing, by the xCCP, trust data of the xCCP to a hypervisor of a host in the autonomous cluster that is executing the CCP; providing, by the hypervisor, the trust data to the CCP through a volume attached to a virtual machine (VM) that executes the CCP; persisting, by the CCP, the trust data in a database; and accessing, by a security token service (STS) of the CCP, the trust data in the database to authenticate access to the CCP by the xCCP.