Nested Cluster Storage Provisioning via Metadata Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing environments, it is a security concern for infrastructure clusters to provide direct access to physical storage for hosted clusters, as this may lead to inadvertent or malicious access to unauthorized portions of the storage, especially when multiple customers share the same physical storage.
Innovation Solution
Implementing dynamic storage provisioning through an infrastructure cluster, where the hosted cluster accesses physical storage only via the infrastructure cluster, by generating and managing metadata to create persistent volumes that appear to the hosted cluster as allocated storage, without revealing direct access information to the physical storage, thus preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If direct access to physical storage is provided for hosted clusters, then storage accessibility and performance are improved, but security risks and unauthorized access potential increase
Solution Approach 1:
The patent implements an infrastructure cluster as an intermediary layer between the hosted cluster and physical storage. The infrastructure cluster's control plane generates and manages volume metadata that the hosted cluster can access, while the actual physical storage access is controlled through this intermediate layer. This mediator approach allows the hosted cluster to access storage functionality without having direct access to physical storage resources, thereby maintaining security while enabling operational access.
2Adaptability or versatility
If physical storage information is revealed to hosted clusters, then storage provisioning flexibility is improved, but security isolation and data privacy are compromised
Solution Approach 1:
The patent segments storage information into two distinct layers: volume metadata that is exposed to the hosted cluster for provisioning flexibility, and physical storage information that remains hidden to maintain security isolation. The infrastructure cluster's control plane generates volume metadata objects that represent storage resources without revealing underlying physical storage details. This segmentation allows the hosted cluster to flexibly provision and manage storage while the physical storage remains securely isolated.
3Productivity
If hosted clusters can access physical storage directly, then storage performance is improved, but the complexity of managing access control and security increases
Solution Approach 1:
The infrastructure cluster's control plane implements self-service functionality by automatically generating and managing volume metadata in response to hosted cluster requests. When a hosted cluster needs storage, the control plane autonomously creates the appropriate metadata objects and manages the mapping to physical storage without requiring complex manual access control configurations. This self-service approach simplifies access control management while maintaining storage performance through automated resource allocation.
Data Source
AI summary
Dynamic storage provisioning for nested clusters is disclosed. A hosted cluster (HC) storage provisioner, executing in a hosted cluster that is hosted by an infrastructure cluster (IC), receives a request to dynamically provision a hosted cluster (HC) persistent volume object that is coupled to a physical storage. The HC storage provisioner causes an IC control plane executing on the IC to generate IC volume metadata that is backed by a storage volume on the physical storage. The HC storage provisioner determines that the IC volume metadata has been generated. The HC storage provisioner creates HC volume metadata on the hosted cluster that is linked to the IC volume metadata, the HC volume metadata comprising an HC persistent volume object that represents a persistent volume for use by the hosted cluster that is backed, via the IC volume metadata, by the physical storage.