Tag-based enforcement of object storage policies across tenants of an object storage system

1 . A method for enforcing object storage policies using corresponding tags, the method comprising:

identifying Information Lifecycle Management (ILM) policies for an object storage system having multiple tenants, wherein different tenants of the multiple tenants are authorized to use different portions of the ILM policies;

associating respective tags with the ILM policies;

identifying a subset of the tags that correspond to a portion of the ILM policies a tenant of the multiple tenants is authorized to use;

enabling the tenant to assign the subset of the tags to data objects of the tenant in the object storage system, wherein remaining tags of the tags outside of the subset are disabled for assignment by the tenant to the data objects, wherein assignment of a tag of the subset of tags to a data object of the data objects indicates a policy of the ILM policies corresponding to the tag should be used for the data object; and

enforcing the portion of the ILM policies on the data objects in accordance with which of the subset of the tags the tenant has assigned to which of the data objects.

2 . The method of claim 1 , comprising:

identifying a second subset of the tags that correspond to a second portion of the ILM policies a second tenant of the multiple tenants is authorized to use;

enabling the second tenant to assign the second subset of the tags to second data objects of the second tenant in the object storage system, wherein the second subset is different from the subset and corresponds; and

enforcing the second portion of the ILM policies on the second data objects in accordance with which of the second subset the second tenant has assigned to which of the second data objects.

3 . The method of claim 2 , wherein the tenant cannot apply tags of the subset to the second data objects and the second tenant cannot apply tags of the second subset to the data objects.

4 . The method of claim 1 , wherein enforcing the portion of the ILM policies comprises:

determining a first ILM policy of the ILM policies corresponding to a first tag of the tags assigned to a subject data object of the data objects conflicts with a second ILM policy of the ILM policies corresponding to a second tag of the tags assigned to the subject data object; and

determining to apply the first ILM policy to the subject data object when the first ILM policy provides greater data protection than the second ILM policy.

5 . The method of claim 1 , comprising:

displaying a user interface to an administrator of the object storage system, wherein the user interface displays the tags; and

receiving user input from the administrator indicating which tags are available to which of the multiple tenants.

6 . The method of claim 1 , comprising:

displaying a user interface to an administrator of the object storage system, wherein the user interface displays the tags; and

receiving user input from the administrator assigning the tags of the subset to the data objects.

7 . The method of claim 1 , comprising:

displaying a user interface to a user for the tenant, wherein the user interface displays the subset; and

receiving user input from the user assigning the tags of the subset to the data objects.

8 . The method of claim 1 , comprising:

displaying a user interface to an administrator of the object storage system, wherein the user interface enables creation of tags and associating the tags with ILM policies; and

receiving user input from the administrator defining a tag and an associated ILM policy for inclusion in the tags.

9 . The method of claim 1 , comprising:

during enforcement of the portion of the ILM policies, receiving an updated policy associated with a tag of the subset; and

enforcing the updated policy on ones of the data objects having the tag of the subset assigned thereto.

10 . The method of claim 1 , wherein the tags of the subset assigned to the data objects comprise tags of the subset assigned to one or more buckets including the data objects, wherein the tags of the subset assigned to the one or more buckets take precedence over tags of the subset assigned to a lower level of the object storage system.

11 . A system for enforcing object storage policies using corresponding tags, the system comprising:

a set of distributed storage nodes implementing an object storage system having Information Lifecycle Management (ILM) policies available for data objects stored therein,

wherein the object storage system distributes the data objects across the distributed storage nodes,

wherein the object storage system associates the ILM policies with respective tags,

wherein the object storage system determines subsets of the tags corresponding to different portions of the ILM policies available to different tenants of the object storage system, and

wherein the object storage system enables a first tenant of the tenants to assign a first subset of the subsets to a first portion of the data objects belonging to the first tenant in the object storage system while those of the tags not in the first subset remain disabled for the first tenant; and

a user client system of the first tenant connected to the distributed storage nodes over a communication network,

wherein the user client system assigns one or more tags from the first subset to the first portion of the data objects, and

wherein the distributed storage nodes enforce the ILM policies on the first portion of the data objects corresponding to the one or more tags assigned to the first portion of the data objects.

12 . The system of claim 11 , comprising:

a second user client system of a second tenant of the tenants connected to the distributed storage nodes over the communication network,

wherein the second tenant is enabled by the data storage system to assign a second subset of the subsets to a second portion of the data objects belonging to the second tenant in the object storage system while those of the tags not in the second subset remain disabled for the second tenant,

wherein the second user client system assigns one or more additional tags from the second subset to the second portion of the data objects,

wherein at least one of the one or more additional tags is different from the one or more tags and corresponds to a different ILM policy, and

wherein the distributed storage nodes enforce the different ILM policies on the second portion of the data objects.

13 . The system of claim 12 , wherein the one or more tags cannot be applied to the second portion of the data objects and the at least one of the one or more additional tags cannot be applied to the portion of the data objects.

14 . The system of claim 11 , wherein:

during enforcement of the ILM policies, the distributed storage nodes receive an updated policy associated with a tag of the one or more tags; and

the distributed storage nodes enforce the updated policy on ones of the data objects having the tag assigned thereto.

15 . An object storage system that enforces object storage policies using corresponding tags, the object storage system comprising:

a plurality of storage nodes configured to:

identify Information Lifecycle Management (ILM) policies for the object storage system having multiple tenants;

associate respective tags with the ILM policies;

identify a subset of the tags that correspond to a portion of the ILM policies a tenant of the multiple tenants is authorized to use;

enable the subset of the tags to be assigned to data objects of the tenant while ones of the tags not included in the subset remain disabled for the tenant, wherein the subset is different from at least one other subset of the tags enabled for at least one other tenant of the multiple tenants; and

enforce a portion of the ILM policies on the data objects, wherein the portion of the ILM policies corresponds to tags of the subset assigned to the data objects.

16 . The object storage system of claim 15 , comprising the plurality of storage nodes configured to:

identify a second subset of the tags that correspond to a second portion of the ILM policies a second tenant of the multiple tenants is authorized to use;

enable the second subset of the tags to be assigned to second data objects of the second tenant while ones of the tags not included in the second subset remain disabled for the second tenant, wherein the second subset is in the at least one other subset; and

enforce a second portion of the ILM policies on the second data objects, wherein the second portion of the ILM policies corresponds to tags of the second subset assigned to the second data objects.

17 . The object storage system of claim 16 , wherein the tenant cannot apply tags of the subset to the second data objects and the second tenant cannot apply tags of the second subset to the data objects.

18 . The object storage system of claim 15 , wherein to enforce the portion of the ILM policies, the plurality of storage nodes are configured to:

determine a first ILM policy of the ILM policies corresponding to a first tag of the tags assigned to a subject data object of the data objects conflicts with a second ILM policy of the ILM policies corresponding to a second tag of the tags assigned to the subject data object; and

determine to apply the first ILM policy to the subject data object when the first ILM policy retains data greater length of time than the second ILM policy.

19 . The object storage system of claim 15 , wherein an administrator of the object storage system provides user input indicating which of the tags are available to which of the multiple tenants.

20 . The object storage system of claim 15 , comprising the plurality of storage nodes configured to:

during enforcement of the portion of the ILM policies, receive an updated policy associated with a tag of the subset; and

enforce the updated policy on ones of the data objects having the tag of the subset assigned thereto.

21 . The object storage system of claim 15 , wherein the tags of the subset assigned to the data objects comprise tags of the subset assigned to one or more buckets including the data objects, and wherein the tags of the subset assigned to the one or more buckets take precedence over tags of the subset assigned to a lower level of the object storage system.