Red Hat, Inc.

Thomas Wiest

Michael P McGrath

Daniel McPherson

Matthew J Hicks

Joel Smith

Cesar Augusto Wong

Clayton Palmer Coleman

Joel D Diaz

Andrew Goldstein

Andrew Butcher

Computing clusters can be automatically configured according to some aspects described herein. For example, a system can receive configuration datasets from instantiated objects in a management cluster. The configuration datasets can be for configuring target objects in managed clusters, where the managed clusters are separate from the management cluster. The system can then configure the target objects within each of the managed clusters based on the configuration datasets.

Automatically configuring computing clusters

A method of container and image scanning includes receiving, by a processing device initiating a scan process to scan containers executing functionality of multiple applications. The method further includes, for each container of the containers, identifying portions of an application image instance of the container, the portions corresponding to previously-scanned clean layers of the application image instance, scanning, by the processing device in accordance with the scan process, remaining portions of the application image instance not associated with the previously-scanned clean layers, and responsive to a clean result of the scanning of the remaining portions of the application image instance, terminating, by the processing device, the scan process for the container and allowing the container having the application image instance to execute.

Container and image scanning for a platform-as-a-service system

A method of container and image scanning includes receiving, by a processing device executing a node of a multi-tenant Platform-as-a-Service (PaaS) system, a pluggable scan process to scan containers of the multi-tenant PaaS system to detect patterns indicative of threats to the multi-tenant PaaS system, installing, by the processing device, the pluggable scan process at the node, scanning, by the processing device via the pluggable scan process at the node, a top layer of an application image instance used to launch a container at the node without scanning remaining layers of the application image instance, and in response to the scanning generating a clean result, terminating, by the processing device, the pluggable scan process for the container.

A method of container and image scanning includes storing at a central scan store of a multi-tenant system, an image scan result for a container image, the container image for executing functionality of applications and comprising layers, wherein the image scan result generated by a scan process comprising scanning a top layer of the container image, the remaining layers of the container image are immutable, verifying a clean status of the remaining layers of the container image with the central scan store, and transmitting the image scan result for the container image, the image scan result being clean in response to a clean result returned for the scanning and successful verification of the clean status of the remaining layers. The method further includes responsive to receiving a container image scan result request for the container image, transmitting the image scan result for the container image.

Implementations provide for a secure shell (SSH) proxy for a Platform-as-a-Service (PaaS) system. A method of the disclosure includes receiving, by a processing device executing a Secure Shell (SSH) proxy server, a request to establish an SSH connection with a component of an application of a multi-tenant Platform-as-a-Service (PaaS) system, the component is separate from the SSH proxy server, authenticating credentials provided as part of the request, establishing the SSH connection with a device originating the request, receiving, in view of authenticating the credentials and establishing the SSH connection, routing information for the application, the routing information comprising a location of a node of the multi-tenant PaaS system executing the application, establishing an internal communication session with an executing proxy of the node, and forward information conveyed over the SSH connection to the executing proxy via the internal communication session.

Secure shell (SSH) proxy for a platform-as-a-service system

Implementations of the disclosure provide for controlling capacity in a multi-tenant Platform-as-a-Service (PaaS) environment in a cloud computing system. A method includes obtaining, by a resource control module executed by a processing device, an active capacity metric of each node in a multi-tenant Platform-as-a-Service (PaaS) system, the active capacity metric determined in view of a number of containers that are currently executing in the node and a maximum number of active containers allowed to execute in the node, comparing, by the resource control module, the active capacity metric of the each node to an active capacity threshold associated with the each node, and when the active capacity metric exceeds the active capacity threshold in all of the nodes in a district of the multi-tenant PaaS system and when a maximum actual capacity of containers in the district is not exceeded, adding a new node to the district.

Controlling capacity in a multi-tenant platform-as-a-service environment in a cloud computing system

Implementations provide for container and image scanning for a Platform-as-a-Service (PaaS) system. A method of the disclosure includes initiating, by a processing device executing a node of a multi-tenant Platform-as-a-Service (PaaS) system, a scan process at the node to scan containers executing on the node, the containers executing functionality of multiple applications that are owned by multiple owners. The method further includes, for each container of the containers, scanning, by the processing device in accordance with the scan process, a top layer of application image instance used to launch the container in the node without scanning remaining layers of the application image instance, and terminating, by the processing device, the scan process for the container when the scanning generates a clean result.

A mechanism for application partitioning in a multi-tenant PaaS environment in a cloud computing system is disclosed. A method of embodiments includes receiving, by a virtual machine (VM), a request to initialize a container on the VM, the container comprising a resource-constrained space of the VM to execute functionality of an application of a multi-tenant PaaS system. The method also includes assigning a user identification (UID) and non-volatile resources to the container, wherein the UID and non-volatile resources are part of a subset of UIDs and a subset of non-volatile resources allotted to the VM from a range of UIDs and a range of non-volatile resources associated with a district of the VM, and wherein other VMs in the district are not allotted the same subset of UIDs from the range of UIDs or the same subset of non-volatile resources from the range of non-volatile resources.

Application partitioning in a multi-tenant platform-as-a-service environment in a cloud computing system

A mechanism for controlling capacity in a multi-tenant Platform-as-a-Service (PaaS) environment in a cloud computing system is disclosed. A method includes detecting, by a resource control module, an occurrence of a trigger event for capacity analysis of virtual machines (VMs) in a multi-tenant PaaS system, obtaining an active capacity metric of each of the VMs, the active capacity metric comprising a result of dividing a number of containers that are currently executing in the VM by a maximum number of active containers allowed to execute in the VM, comparing the active capacity metric of each VM to an active capacity threshold of each VM, when the active capacity metric exceeds the active capacity threshold in all of the VMs in a district of the multi-tenant PaaS system and when a maximum actual capacity of containers in the district is not exceeded, adding a new VM to the district.

A mechanism for controlling utilization in a multi-tenant Platform-as-a-Service (PaaS) environment in a cloud computing system is disclosed. A method includes obtaining, by a resource control module executing on a computing device, an active capacity metric of each virtual machine (VM) of a plurality of VMs in a district of a multi-tenant PaaS system, the active capacity metric comprising a result of dividing a number of containers that are currently executing in the VM by a maximum number of active containers allowed to execute in the VM, determining that the active capacity metric of a source VM in the district exceeds an active capacity threshold associated with the source VM, and migrating at least one of the containers of the source VM to a target VM in the district, wherein the target VM is operating with an active capacity metric below the active capacity threshold associated with the target VM.

Growing community of inventors

Lehi, UT, United States of America

Thomas Wiest