Substrate Instance Certificates for Cloud Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud environments lack a service to provide the necessary information for issuing digital certificates to substrate instances, which are the foundational physical resources of the cloud infrastructure, leading to challenges in authentication and authorization.
Innovation Solution
A certificate service communicates with both a substrate control plane and an identity service to fetch information, issuing a substrate instance principal certificate and additional certificates, enabling agents within the substrate instance to authenticate and access services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a certificate service issues digital certificates to substrate instances, then authentication and authorization capabilities are improved, but the system complexity increases due to the need to integrate with substrate control plane and identity service
Solution Approach 1:
The certificate service acts as an intermediary component that mediates between the substrate control plane and the identity service. It fetches substrate instance information from the substrate control plane and tenancy information from the identity service, then issues certificates that bridge these two systems, enabling authentication without direct integration complexity between the control plane and identity service
Solution Approach 2:
The authentication system is segmented into distinct functional components: the substrate control plane manages substrate instance provisioning, the identity service manages tenancy and user identities, and the certificate service handles certificate issuance. This segmentation allows each component to focus on its specific function while reducing overall system integration complexity
2Loss of information
If the certificate service fetches information from multiple sources (substrate control plane and identity service), then the completeness of certificate information is improved, but the time required for certificate issuance increases
Solution Approach 1:
The substrate control plane and identity service maintain their respective information databases in advance, so when the certificate service needs to issue a certificate, the required substrate instance information and tenancy information are already prepared and readily available for immediate fetching, reducing the time needed during certificate issuance
Solution Approach 2:
The certificate service efficiently acts as an intermediary that performs single-fetch operations from both the substrate control plane and identity service. By optimizing these fetch operations to retrieve only the necessary information in a coordinated manner, the service minimizes total retrieval time while ensuring information completeness
Data Source
AI summary
A method for issuing one or more certificates to a substrate instance of a cloud environment is disclosed. The method includes performing a first fetch to obtain one or more of: (i) an identifier of a compartment that includes the substrate instance, or (ii) an identifier of the substrate instance. The method further includes performing a second fetch to obtain an identifier of a tenancy that includes the substrate instance, based at least in part on one or more of: (i) the identifier of the compartment identified from the first fetch, or (ii) the identifier of the substrate instance identified from the first fetch. The method further includes issuing a principal certificate to the substrate instance, the principal certificate including the identifier of the tenancy that includes the substrate instance.