Cloud services management system and method
A cloud services management system and method that is capable of ensuring that communication between one or more cluster master(s) and cluster nodes is disclosed. The cloud services management system ensures secure communication that are not susceptible to security breaches even when the cluster master(s) and the cluster nodes reside in different networks (and/or have different security profiles, particularly in a public network). The cloud service management system utilizes three main communication paths: (1) a first route to manage communication between cluster master and a cluster; (2) a second route to manage communication between a cluster and one or more services/APIs; and (3) a third route to manage communication between a cluster and external domains. One purpose of these routes is to prevent direct communication between a cluster and the Internet (since such communication can be unsecured and prone to security risks and threats).
1. A method performed by a computing device within clusters of computing device nodes, the method comprising:
configuring a first data route for a first type of traffic between at least one computing device node in a cluster of computing device nodes and a cluster master node;
configuring a second data route for a second type of outgoing traffic from the at least one computing device node in the cluster to at least one cloud services node,
wherein the at least one cloud services node is external to the cluster, and
wherein the second type of outgoing traffic is routed from the at least one computing device node in the cluster to the at least one cloud services node via an egress gateway subnet, the egress gateway subnet comprising two or more zones that each include at least one network address translation gateway and at least one proxy server; and
configuring a third data route for a third type of outgoing traffic from the at least one computing device node in the cluster to at least one domain,
wherein the at least one domain is external to the cluster,
wherein the third type of outgoing traffic is routed from the at least one computing device node in the cluster to the at least one domain via the egress gateway subnet; and
wherein the first data route is assigned a first priority level, the second data route is assigned a second priority level, and the third data route is assigned a third priority level.
2. The method of claim 1 wherein the egress gateway subnet and the cluster are on a common network.
3. The method of claim 1 wherein the first data route routes secure communications from the cluster master on a first secure port, and
wherein the first data route routes outgoing communications from the cluster to the cluster master through a default Internet gateway on a second secure port.
4. The method of claim 3 wherein the first data route routes the outgoing communications from the cluster to the cluster master through the default Internet gateway on the second secure port using an instance tag.
5. The method of claim 1 wherein the first priority level is greater than the second priority level and the second priority level is greater than the third priority level.
6. The method of claim 1 wherein the second type of outgoing traffic comprises system calls, maintenance calls, native calls, or any combination thereof.
7. The method of claim 1 wherein the egress gateway subnet comprises at least one network address translation gateway and at least one proxy server.
8. The method of claim 1 wherein the second type of outgoing traffic is routed from the at least one computing device node in the cluster to the egress gateway subnet via a first load balancer.
9. The method of claim 1 wherein the third type of outgoing traffic is routed from the at least one computing device node in the cluster to the egress gateway subnet via a second load balancer.
10. The method of claim 1 wherein the third data route is managed using domain whitelists, domain blacklists, firewalls, or any combination thereof.
11. The method of claim 1 wherein the third data route is managed using domain whitelists in a host file associated with each cluster.
12. The method of claim 1 wherein the third data route is managed using domain whitelists in a host file associated with a host node that administers the clusters.
13. A non-transitory computer readable medium storing instructions, which when executed by at least one computing device within clusters of computing device nodes to perform a method of routing traffic, the method comprising:
configuring a first data route for a first type of traffic between at least one computing device node in a cluster of computing device nodes and a cluster master node;
configuring a second data route for a second type of outgoing traffic from the at least one computing device node in the cluster to at least one cloud services node,
wherein the at least one cloud services node is external to the cluster, and
wherein the second type of outgoing traffic is routed from the at least one computing device node in the cluster to an egress gateway subnet via a load balancer and routed to the at least one cloud services node via the egress gateway subnet, the egress gateway subnet comprising two or more zones that each include at least one network address translation gateway and at least one proxy server; and
configuring a third data route for a third type of outgoing traffic from the at least one computing device node in the cluster to at least one domain,
wherein the at least one domain is external to the cluster, and
wherein the third type of outgoing traffic is routed from the at least one computing device node in the cluster to the at least one domain via the egress gateway subnet.
14. The non-transitory computer readable medium of claim 13 wherein the first data route is assigned a first priority level, the second data route is assigned a second priority level, and the third data route is assigned a third priority level, and
wherein the first priority level is greater than the second priority level and the second priority level is greater than the third priority level.
15. The non-transitory computer readable medium of claim 13 wherein the second type of outgoing traffic comprises system calls, maintenance calls, native calls, or any combination thereof.
16. The non-transitory computer readable medium of claim 13 wherein the egress gateway subnet comprises two or more zones,
wherein each of the two or more zones comprises at least one network address translation gateway and at least one proxy server.
17. The non-transitory computer readable medium of claim 13 wherein the third data route is managed using domain whitelists in a host file associated with each cluster.
18. An apparatus for routing traffic from clusters of computing devices, the apparatus comprising:
at least one hardware processor;
at least one memory having contents configured to, when executed by the at least one hardware processor, perform a method comprising:
configuring a first data route for a first type of traffic between at least one computing device node in a cluster of computing device nodes and a cluster master node,
wherein the first data route routes secure communications from the cluster master on a first secure port, and
wherein the first data route routes outgoing communications from the cluster to the cluster master through a default Internet gateway on a second secure port using an instance tag;
configuring a second data route for a second type of outgoing traffic from the at least one computing device node in the cluster to at least one cloud services node,
wherein the at least one cloud services node is external to the cluster, and
wherein the second type of outgoing traffic is routed from the at least one computing device node in the cluster to the at least one cloud services node via an egress gateway subnet; and
configuring a third data route for a third type of outgoing traffic from the at least one computing device node in the cluster to at least one domain,
wherein the at least one domain is external to the cluster, and
wherein the third type of outgoing traffic is routed from the at least one computing device node in the cluster to the at least one domain via the egress gateway subnet.