Microsoft Technology Licensing, LLC

Alex John Hockey

James Warren Turner

Andrew Munro Caldwell

Thomas Robert Steavenson

Huw Ivor George Thomas

Christopher James Paterson

Jack Philip Rickard

A method of processing traffic to provide a service is described. A first service mesh in a first cluster is used to ensure traffic is communicated within the first cluster using a secure communications protocol with mutual authentication accomplished using a certificate chain having a root certificate. A client in the first cluster originates traffic to a second cluster for processing, the second cluster having access to the root certificate. Using the first service mesh, routing the traffic to the second cluster is done using a secure communications protocol with mutual authentication. Mutual authentication is carried out between the first cluster and the second cluster using certificate chains having the root certificate; and in response to the mutual authentication being successful, application data is routed to the second cluster using the secure communications protocol such that the application data may be processed at the second cluster to provide the service.

Mutual authentication between clusters

A computer-implemented method of establishing a secure connection between a first application running in a first computing environment and a second application running in a second computing environment using a service mesh that: interposes a connection forming request from the first application; and establishes the secure connection in response to the connection forming request by: instructing a kernel to establishing a computing environment connection between the first and second computing environments; establishing cryptographic parameters for encrypting or decrypting application traffic between the first application and the second application; and establishing a socket with the kernel for the application traffic that will be communicated over the secure connection.

Interposing service mesh

A computer-implemented method, data processing system and computer-readable medium for a pod of a container orchestration platform to secure metrics relating to the pod prior to transmission of metrics to a metrics collection service. The method comprising: receiving a secure request at a pod IP address and forwarding the request to a container of the pod; and receiving an insecure request at the pod IP address; examining the content of the received insecure request; from the examining, determining whether the received insecure request is requesting metrics information; if it was determined that the received insecure request does not request metrics information, passing the request to an original destination within the pod, and if it was determined that the received insecure request does request metrics information, rejecting the received insecure request.

Securing metrics for a pod

Information is provided to a service mesh by a Kubernetes (K8s) controller. The information enables the service mesh to determine an IP address of application pods to which a monitoring request is destined. The K8s controller detects which of the application pods are scheduled to be monitored by the monitoring service. The K8s controller creates dummy headless services that match the application pods scheduled to be monitored. The service mesh is programmed information from the dummy headless services to cause the service mesh to intercept the monitoring request and identify that the monitoring request is destined to the dummy headless service based on the addresses. In response the service mesh encrypts the monitoring request.

Securing metrics in a service mesh

Techniques are disclosed for capturing diagnostics data in a distributed computing environment comprising a plurality of computing devices executing a plurality of Kubernetes pods. A worker node is configured with a staging area for storing temporary diagnostics data. An agent is configured to upload the temporary diagnostics data. Each container in the worker node is assigned a directory in the staging area for writing the container's temporary diagnostics data. When a container in the worker node has written a temporary diagnostics data file to the container's directory in the staging area, the temporary diagnostics data file is uploaded to the persistent storage.

Growing community of inventors

London, United Kingdom

Alex John Hockey