Methods and systems for securely and efficiently clustering distributed processes using a consistent database

Patent metadata

Field	Value
Publication number	US-11907745-B2
Application number	US-202117157075-A
Country	US
Kind code	B2
Filing date	Jan 25, 2021
Priority date	Jan 23, 2019
Publication date	Feb 20, 2024
Grant date	Feb 20, 2024

Abstract

Certain embodiments described herein are directed to methods and systems for adding one or more nodes to a first cluster including a first node in a computer system. A method performed by the first node comprises receiving a first request from a second node to join the first cluster. The method also comprises retrieving a first cluster configuration associated with the first cluster from a distributed database through a first database server (DBS) and creating a second cluster configuration using the first cluster configuration and information received from the second node as part of the request. The method further comprises populating a first one or more local trust stores of a first one or more processes executing on the first node with a second one or more security certificates of a second one or more processes executing on the second node. The method further comprises writing the second cluster configuration to the distributed database and returning the second cluster configuration to the second node.

First claim

We claim:

1. A method of adding one or more nodes to a first cluster including a first node in a computer system, the method comprising:
receiving, by the first node, a first request from a second node, the first request indicating an intention of the second node to join the cluster, wherein:
the first node is configured to execute a first one or more processes associated with one or more distributed applications;
the first request includes authentication information associated with the second node; and
the authentication information comprises one or more security certificates for a second one or more processes running on the second node;

retrieving, by the first node, a cluster configuration associated with the cluster from a database;
creating, by the first node, an updated cluster configuration using the cluster configuration and the authentication information;
populating, by the first node, a trust store associated with each of the first one or more processes with the authentication information to allow the first one or more processes to authenticate the second one or more processes running on the second node;
writing, by the first node, the updated cluster configuration to the database;
providing, by the first node, the updated cluster configuration to the second node;
determining, by a first process of the first one or more processes, that the first process can trust a second process of the second one or more processes based on retrieving, from the trust store associated with the first process, a corresponding security certificate of the one or more security certificates; and
communicating, by the first process, with the second process based on the determining that the first process can trust the second process.

2. The method of claim 1 , further comprising:
prior to receiving the first request, exchanging second authentication information between the first one or more processes to allow the first one or more processes to authenticate each other.

3. The method of claim 1 , wherein the database is a distributed database.

4. The method of claim 3 , wherein:
the first one or more processes include a first database server (DBS) associated with the distributed database,
retrieving the cluster configuration from the database is through the first DBS, and
writing the updated cluster configuration to the database is through the first DBS.

5. The method of claim 4 , further comprising:
creating a DBS cluster configuration for a DBS cluster including the first DBS; and
storing the DBS cluster configuration in the distributed database prior to receiving the first request, wherein:
the second node retrieves the DBS cluster configuration,
the second node adds a second DBS executing on the second node to the DBS cluster by updating the DBS cluster configuration after receiving the updated cluster configuration from the first node, and
after the second DBS is added to the DBS cluster, the first DBS and the second DBS are configured to be able to maintain consistent instances of the distributed database.

6. The method of claim 4 , further comprising:
writing a DB connection information to a DB connection information file stored in storage resources of the first node, wherein:
the DB connection information comprises information relating to the first DBS, and

the DB connection information is used by each of the first one of more processes to connect to the first DBS.

7. The method of claim 1 , further comprising:
creating a group membership table for each process type associated with the first one or more processes; and
adding each of the first one or more processes as a member to a corresponding group membership table based on a type of the process, wherein a group membership table is used by each member to check a status of each other member of the group membership table.

8. The method of claim 1 , further comprising:
creating a cluster configuration version table;
storing the cluster configuration version table in the database;
prior to receiving the first request, setting a cluster configuration version of the first node in the cluster configuration version table to a first version associated with the first cluster changing the cluster configuration version of the first node in the cluster configuration version table from the first version associated with the first cluster to a second version associated with the second cluster; and
periodically examining the cluster configuration version table to determine whether the first node is synchronized with a latest cluster configuration.

9. The method of claim 1 , wherein the first request comprises a username and a password associated with the first node, the method further comprising:
authenticating the second node based on the username and password;
transmitting an application programming interface (API) certificate to the second node, wherein the second node authenticates the first node by comparing the API certificate with a thumbprint of the API certificate that is stored in storage resources of the second node.

10. The method of claim 1 , wherein after returning the updated cluster configuration to the second node, the second node:
receives the updated cluster configuration from the first node, the updated cluster configuration comprising second authentication information associated with the first node;
associates the second one or more processes with the second authentication information to allow the second one or more processes to authenticate the first one or more processes;
sets a cluster configuration version of the second node to a cluster configuration of the second cluster in a cluster configuration version table stored in the database;
retrieves a latest cluster configuration from the database;
adds each of the second one or more processes, except for a second DBS of the second one or more processes, as a member to a corresponding group membership table, wherein a group membership table is used by each member to check a status of each other member of the group membership table;
generates an updated cluster configuration by setting a status of the second node in the latest cluster configuration to joined;
stores the updated cluster configuration in the database; and
periodically examines the cluster configuration version table to determine whether the second node is synchronized with another latest cluster configuration.

11. The method of claim 1 , further comprising:
receiving a second request for a third node to join the second cluster, wherein the second request comprises second authentication information associated with the third node;
retrieving the updated cluster configuration associated with the second cluster from the database;
creating a third cluster configuration using the updated cluster configuration and the second authentication information;
associating the first one or more processes with the second authentication information to allow the first one or more processes to authenticate a third one or more processes running on the third node;
writing the third cluster configuration to the database; and
upon the first node and the second node being in synchronization with the third cluster configuration, returning the third cluster configuration to the third node.

12. The method of claim 11 , further comprising determining the second node is in synchronization with the third cluster configuration by periodically examining a cluster configuration version table to determine whether a cluster configuration version of the second node matches the cluster configuration version of the third cluster.

13. The method of claim 1 , wherei

Assignees

• VMware LLC
• Vmware Inc

Inventors

• Neginhal Srinivas
• Dhawan Medhavi
• Brajkovic Vjekoslav
• Zhang Cheng
• Chen Jiaqi
• Tsai David
• Munshed Maithem
• Lokhandwala Zeeshan
• Wen Ming
• Edholm Ragnar
• Bajpai Rajneesh

Classifications

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title

• G06F3/062

  Securing storage systems · CPC title

• G06F3/067

  Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS] · CPC title

• G06F3/0662

  Virtualisation aspects · CPC title

• G06F16/1827

  Management specifically adapted to NAS (management of storage area networks [SAN] G06F3/067) · CPC title