Sidecar-backed services for cloud computing platform

Patent metadata

Field	Value
Publication number	US-10623390-B1
Application number	US-201715686042-A
Country	US
Kind code	B1
Filing date	Aug 24, 2017
Priority date	Aug 24, 2017
Publication date	Apr 14, 2020
Grant date	Apr 14, 2020

Abstract

This specification describes methods, systems, and computer-readable media for sidecar-backed services for a cloud computing platform. An application is bound to a service. A transformer component of the cloud computing platform transforms credential information for accessing the service by replacing an access address to the service with a localhost address to a sidecar program associated with the application. When the application uses the service, the application communicates with the sidecar program rather than with the service directly. The sidecar program then forwards the communication to the service.

First claim

What is claimed is:

1. A method, comprising:
receiving, by one or more processors from a cloud controller of a cloud computing platform, binding information specifying that an application may use a service provided on the cloud computing platform;
receiving, by the one or more processors from the cloud controller, credential information about the service, the credential information including an access address to the service;
transforming, by the one or more processors, the received credential information into redacted credential information, including replacing the access address with a localhost address to a sidecar program associated with the application, the sidecar program executing on a computer hosting the application;
providing, by the one or more processors to the application, the redacted credential information, the redacted credential information and the binding information operable to cause the application to access the localhost address when using the service; and
providing, by the one or more processors to the sidecar program, the received credential information and the redacted credential information, the received credential information and the redacted credential information operable to cause the sidecar program to listen at the localhost address and to communicate with the service at the access address in response to receiving a request from the application through the localhost address.

2. The method of claim 1 , wherein the received credential information includes a user name and a password for accessing the service, the access address includes a hostname of the service and a port number of the service, the localhost address includes a port number and localhost hostname indicating the computer hosting the application and the associated sidecar program.

3. The method of claim 1 , wherein the sidecar program is an application-side program that is located, with the application, in an application container, the sidecar program configured to perform at least one of discovering the service, establishing a secure connection to the service, load-balancing subsequent requests across a plurality of instances of the service, retrying connection in response to network interruption, or forwarding metrics of the request to a metric collector.

4. The method of claim 3 , wherein the service is associated with a service sidecar program, and the application communicates with the service through both the application sidecar program and the service sidecar program.

5. The method of claim 4 , wherein communication between the application sidecar program and the service sidecar program is through a sidecar-to-sidecar mutual transport layer security (MTLS) tunnel.

6. The method of claim 1 , comprising:
receiving, from the cloud controller, update information indicating that the application is bound to a new service; and
while the application is executing, updating at least one of the received credential information or the redacted credential information, the updating causing the application to use the new service through the sidecar program without interruption.

7. The method of claim 1 , wherein:
the service is a service that is hosted outside of the cloud computing platform and allows access only from designated addresses, and
the sidecar program is configured to access the service through the designated addresses.

8. A system comprising:
one or more computers; and
one or more storage devices which store instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
receiving, by one or more processors from a cloud controller of a cloud computing platform, binding information specifying that an application may use a service provided on the cloud computing platform;
receiving, by the one or more processors from the cloud controller, credential information about the service, the credential information including an access address to the service;
transforming, by the one or more processors, the received credential information into redacted credential information, including replacing the access address with a localhost address to a sidecar program associated with the application, the sidecar program executing on a computer hosting the application;
providing, by the one or more processors to the application, the redacted credential information, the redacted credential information and the binding information operable to cause the application to access the localhost address when using the service; and
providing, by the one or more processors to the sidecar program, the received credential information and the redacted credential information, the received credential information and the redacted credential information operable to cause the sidecar program to listen at the localhost address and to communicate with the service at the access address in response to receiving a request from the application through the localhost address.

9. The system of claim 8 , wherein the received credential information includes a user name and a password for accessing the service, the access address includes a hostname of the service and a port number of the service, the localhost address includes a port number and localhost hostname indicating the computer hosting the application and the associated sidecar program.

10. The system of claim 8 , wherein the sidecar program is an application-side program that is located, with the application, in an application container, the sidecar program configured to perform at least one of discovering the service, establishing a secure connection to the service, load-balancing subsequent requests across a plurality of instances of the service, retrying connection in response to network interruption, or forwarding metrics of the request to a metric collector.

11. The system of claim 10 , wherein the service is associated with a service sidecar program, and the application communicates with the service through both the application sidecar program and the service sidecar program.

12. The system of claim 11 , wherein communication between the application sidecar program and the service sidecar program is through a sidecar-to-sidecar mutual transport layer security (MTLS) tunnel.

13. The system of claim 8 , the operations comprising:
receiving, from the cloud controller, update information indicating that the application is bound to a new service; and
while the application is executing, updating at least one of the received credential information or the redacted credential information, the updating causing the application to use the new service through the sidecar program without interruption.

14. The system of claim 8 , wherein:
the service is a service that is hosted outside of the cloud computing platform and allows access only from designated addresses, and
the sidecar program is configured to access the service through the designated addresses.

15. One or more non-transitory storage devices storing instructions that are operable, when executed by one or more computers, to cause the one or more computers to perform operations comprising:
receiving, by one or more processors from a cloud controller of a cloud computing platform, binding information specifying that an application may use a service provided on the cloud computing platform;
receiving, by the one or more processors from the cloud controller, credential information about the service, the credential information including an access address to the service;
transforming, by the one or more processors, the received credential information into redacted creden

Assignees

• Pivotal Software Inc

Inventors

• Rosenhouse Gabriel

Classifications

• H04L67/10 Primary

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L63/166

  at the transport layer · CPC title

• H04L63/0263

  Rule management · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L67/1002

  Electricity · mapped topic