Verifiable virtualized storage port assignments for virtual machines
View Patent ↗Techniques for verifiable virtualized storage port assignments in virtual machines are provided. Configuration data for a virtual machine is defined to include a mechanism to verify an identity for the virtual machine in a target physical environment and a mechanism to verify a storage port assignment for use in the target physical processing environment. Before the target physical processing environment initiates the virtual machine an identity for the virtual machine is acquired, the configuration data is verified and the storage port assignment is verified.
1. A method, comprising:
establishing control data for a virtual distribution that is to be subsequently initiated as a virtual machine within a target physical processing environment and a target physical machine, wherein the control data identifies processor and memory resources and a virtual distribution identity acquired to initially verify the virtual machine;
defining storage data for the virtual distribution to identity a port to communicate with physical storage on the target physical processing environment that the processing and memory resources use within the virtual machine, and wherein the storage data is also to identify a storage designator to assist in verifying the port before the virtual machine is operational in the target physical processing environment, defining the storage data to include one or more of the following: an encryption key or token for encrypting storage and persistence specifications that define when storage is to persist beyond the processing of the virtual machine; and
having an identity service sign the storage data to bind it with the control data of the virtual distribution.
2. The method of claim 1 further comprising, storing the control data and the signed storage data in a data repository as the virtual distribution and which is retrievable via the virtual distribution identity.
3. The method of claim 1 , further comprising adding image data to the virtual distribution that provides imaged versions of an operating system, services, and the storage designator for use with the virtual machine in the physical processing environment.
4. The method of claim 3 , further comprising signing the control data, the signed storage data, and the image data as a configuration definition for the virtual distribution.
5. The method of claim 1 , wherein defining further includes enlisting a storage resource manager to identify the port in response to one or more specifications.
6. The method of claim 5 , further comprising receiving the port from the storage resource manager, wherein the port is associated with multiple storage volumes within the physical processing environment and multiple storage managers.
7. A method, comprising:
receiving a request to initiate a virtual distribution as a virtual machine within a physical processing environment and a physical machine;
verifying a signature of configuration data associated with the virtual distribution;
acquiring a virtual machine identity using a temporary identity housed in configuration data via interactions with one or more identity services;
contacting a storage resource manager to verify a storage port included for storage in the virtual machine, wherein the storage port is identified in the configuration data; and
starting services identified in the configuration data for the virtual machine within the physical processing environment when the signature and the storage port are verified.
8. The method of claim 7 further comprising, communicating the storage port to a driver of the physical processing environment to establish a storage communication path from the virtual machine to physical storage of the physical processing environment.
9. The method of claim 7 further comprising:
receiving a move request to move the virtual distribution to a different physical processing environment and a different physical machine;
notifying the storage resource manager to stop permitting access from the virtual machine to the storage port; and
modifying the configuration data for subsequent distribution to the different physical processing environment and the different physical machine and including at least a new storage port associated with the different physical processing environment.
10. The method of claim 7 further comprising:
receiving a copy request to copy the virtual distribution to a second virtual machine on the physical processing environment and the physical machine;
notifying the storage resource manager to permit the second virtual machine to access the storage port when policy permits;
copying the configuration data and acquiring another identity for the second virtual machine; and
starting the second virtual machine.
11. The method of claim 7 further comprising:
receiving a termination request to terminate the virtual machine;
notifying the storage resource manager to stop permitting access from the virtual machine to the storage port; and
stopping the services of the virtual machine.
12. The method of claim 11 further comprising, maintaining storage accessed by the virtual machine when persistence specifications existed in the configuration data after the services are stopped.
13. The method of claim 11 further comprising, clearing storage accessed by the virtual machine when persistence specifications did not exist in the configuration data after the services are stopped.
14. A system, comprising:
a storage resource manager implemented in a machine-accessible medium and to process on a machine; and
a virtual machine definer implemented in the machine-accessible medium and to process on the machine, wherein the virtual machine definer is to define configuration data for a virtual machine to include processor and memory resources and to include a virtual machine identifier, and wherein the virtual machine definer is to interact with the storage resource manager to include a storage port for a target physical processing environment in the configuration data and to include a designator name associated with a particular resource imaged in the configuration data that assist in verifying the storage port when the virtual machine is initiated in the target physical processing environment, the virtual machine definer also includes one or more of the following in the configuration data: a key or token for storage encryption use with the virtual machine, persistence specifications for storage that is to persist beyond a life-cycle of the virtual machine, and a signature for the configuration data to verify the configuration data is unchanged when received in the target physical processing environment.
15. The system of claim 14 further comprising an orchestrator implemented in the machine-accessible medium and to process on the machine, wherein the orchestrator is to manage the configuration data as a virtual distribution.
16. The system of claim 14 further comprising, an identity service implemented in the machine-accessible medium and to process on the machine, wherein the identity service is to interact with the virtual machine definer to digitally sign one or more of the following: storage data associated with the storage port and the designator name; and the configuration data as a whole.
17. The system of claim 16 , wherein the identity service is to further provide or assist in acquiring the virtual machine identifier.
18. The system of claim 14 further comprising one or more storage managers implemented in the machine-accessible medium and to process on the machine to interact with the storage resource manager and to supply the storage port.
19. A system, comprising:
a virtual machine initiation service implemented in a machine-accessible medium and to process on a physical machine associated with a physical processing environment in which a virtual machine is to be initiated; and
a storage resource manager implemented in the machine-accessible medium and to process on a machine, wherein the virtual machine initiation service is to acquire an identity for the virtual machine and verify configuration data for the virtual machine, and wherein the virtual machine initiation service is to interact with the storage resource manager to verify a storage port defined in the configuration data for use within the physical processing environment by the virtual machine, the storage resource manager and the virtual machine initiation service cooperate to perform one or more of the following operations: terminate the virtual machine, move the virtual machine to another different physical processing environment and different physical machine, and copy the virtual machine as a different virtual machine within the physical processing environment and the physical machine.
20. The system of claim 19 , wherein the virtual machine initiation service is to initiate one or more additional services within the physical processing environment in response to imaged versions of those services included in the configuration data.
21. The system of claim 19 further comprising, an identity service implemented in the machine-accessible medium and to process on the machine and to assist in acquiring the identity for the virtual machine.
22. The system of claim 21 further comprising, a local physical distribution identity service implemented in the machine-accessible medium and to process on the physical machine, and wherein the local physical distribution identity service is to interact with the identity service to supply the identity for the virtual machine within the physical processing environment.
23. The system of claim 19 further comprising, one or more storage managers implemented in the machine-accessible medium and to process on the machine, wherein the one or more storage managers interact with the storage resource manager to provide paths to physical storage or to storage drivers when the virtual machine supplies storage instructions with reference to the storage port.