Methods and systems for securely and efficiently clustering distributed processes using a consistent database

Patent metadata

Field	Value
Publication number	US-10901771-B2
Application number	US-201916255768-A
Country	US
Kind code	B2
Filing date	Jan 23, 2019
Priority date	Jan 23, 2019
Publication date	Jan 26, 2021
Grant date	Jan 26, 2021

Abstract

Certain embodiments described relate to methods and systems for adding one or more nodes to a first cluster including a first node in a computer system. A method performed by the first node comprises retrieving a first cluster configuration associated with the first cluster from a distributed database through a first database server (DBS) and creating a second cluster configuration using the first cluster configuration and information received from a second node as part of a request to join the first cluster. The method further comprises populating a first one or more local trust stores of a first one or more processes executing on the first node with a second one or more security certificates of a second one or more processes executing on the second node. The method further comprises writing the second cluster configuration to the distributed database and returning the second cluster configuration to the second node.

First claim

We claim:

1. A method of adding one or more nodes to a first cluster including a first node in a computer system, wherein the method is performed by the first node, the method comprising:
receiving a first request from a second node to join the first cluster, wherein:
the first node is configured to execute a first one or more processes associated with corresponding one or more distributed applications, the first one or more processes including a first database server (DBS) associated with a distributed database;
the first one or more processes comprising a corresponding first one or more security certificates;
the second node is configured to execute a second one or more processes associated with the one or more distributed applications, the second one or more processes comprising a corresponding second one or more security certificates;
the first request comprises a first information comprising the second one or more security certificates;

retrieving a first cluster configuration associated with the first cluster from the distributed database through the first DBS;
creating a second cluster configuration using the first cluster configuration and the first information;
populating a first one or more local trust stores of the first one or more processes with the second one or more security certificates;
writing the second cluster configuration to the distributed database through the first DBS; and
returning the second cluster configuration to the second node.

2. The method of claim 1 , further comprising:
populating the first one or more local trust stores of the first one or more processes with each other's security certificates prior to receiving the first request, wherein by accessing each other's security certificates the first one or more processes are able to authenticate each other.

3. The method of claim 1 , further comprising:
creating a DBS cluster configuration for a DBS cluster including the first DBS; and
storing the DBS cluster configuration in the distributed database prior to receiving the first request, wherein:
the second node retrieves the DBS cluster configuration,
the second node adds a second DBS executing on the second node to the DBS cluster by updating the DB S cluster configuration after receiving the second cluster configuration from the first node, and
after the second DBS is added to the DBS cluster, the first DBS and the second DBS are configured to be able to maintain consistent instances of the distributed database.

4. The method of claim 1 , further comprising:
writing a DB connection information to a DB connection information file stored in storage resources of the first node, wherein:
the DB connection information comprises information relating to the first DBS, and
the DB connection information is used by each of the first one of more processes to connect to the first DBS.

5. The method of claim 1 , further comprising:
creating a group membership table for each process type associated with the first one or more processes, except for the first DBS; and
adding each of the first one or more processes, except for the first DBS, as a member to a corresponding group membership table based on a type of the process, wherein a group membership table is used by each member to check a status of each other member of the group membership table.

6. The method of claim 1 , further comprising:
creating a cluster configuration version table;
storing the cluster configuration version table in the distributed database through the first DBS;
prior to receiving the first request, setting a cluster configuration version of the first node in the cluster configuration version table to a first version associated with the first cluster;
after populating the first one or more local trust stores of the first one or more processes with the second one or more security certificates, changing the cluster configuration version of the first node in the cluster configuration version table from the first version associated with the first cluster to a second version associated with the second cluster; and
periodically examining the cluster configuration version table to determine whether the first node is synchronized with a latest cluster configuration.

7. The method of claim 1 , wherein the first information comprises information relating to the second node and the second one or more processes.

8. The method of claim 1 , wherein the first request comprises a username and a password associated with the first node, the method further comprising:
authenticating the second node based on the username and password;
transmitting an application programming interface (API) certificate to the second node, wherein the second node authenticates the first node by comparing the API certificate with a thumbprint of the API certificate that is stored in storage resources of the second node.

9. The method of claim 1 , wherein after returning the second cluster configuration to the second node the second node:
receives the second cluster configuration from the first node, the second cluster configuration comprising the first one or more certificates;
populates a second one or more local trust stores of the second one or more processes with the first one or more certificates;
sets a cluster configuration version of the second node to a cluster configuration of the second cluster in a cluster configuration version table stored in the distributed database;
retrieves a latest cluster configuration from the distributed database;
adds each of the second one or more processes, except for the second DBS, as a member to a corresponding group membership table, wherein a group membership table is used by each member to check a status of each other member of the group membership table;
generates an updated cluster configuration by setting a status of the second node in the latest cluster configuration to joined;
stores the updated cluster configuration in the distributed database; and
periodically examines the cluster configuration version table to determine whether the second node is synchronized with another latest cluster configuration.

10. The method of claim 9 , wherein upon determining that the second one or more processes comprise a second DBS associated with the distributed database, the second node adds the second DBS to a DBS cluster including the first DBS.

11. The method of claim 9 , upon determining that the cluster configuration version of the second node does not match a cluster configuration version of the latest cluster configuration, the second node:
adds any security certificate in the latest cluster that the second one or more local trust stores do not already store;
updates the cluster configuration version of the second node to the cluster configuration version of the latest cluster configuration.

12. The method of claim 1 , further comprising:
receiving a second request from a third node to join the second cluster, wherein:
the second request comprises a second information comprising a third one or more security certificates associated with the third one or more processes;

retrieving the second cluster configuration associated with the second cluster from the distributed database;
creating a third cluster configuration using the second cluster configuration and the second information;
populating the first one or more local trust stores with the third one or more security certificates;
writing the third cluster configuration to the distributed database;
upon the first node and the second node being in synchronization with the third cluster configuration, returning the third cluster configuration to the third node.

Assignees

• Vmware Inc

Inventors

• Neginhal Srinivas
• Dhawan Medhavi
• Brajkovic Vjekoslav
• Zhang Cheng
• Chen Jiaqi
• Tsai David
• Munshed Maithem
• Lokhandwala Zeeshan
• Wen Ming
• Edholm Ragnar
• Bajpai Rajneesh

Classifications

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/0869

  for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273) · CPC title

• G06F3/067

  Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS] · CPC title

• G06F3/0658

  Controller construction arrangements · CPC title

• G06F2009/45575

  Starting, stopping, suspending or resuming virtual machine instances · CPC title