Secure storage access through rate limitation

1. A method comprising:

initiating an instance of an isolated application on a node computing device;

determining, by a processing device, that the isolated application requests exclusive access to a block storage resource;

creating, by the processing device, a control group associated with the block storage resource and the isolated application;

providing access of the block storage resource to members of the control group and preventing access to the block storage resource for non-members of the control group by setting an access rate limit to zero for non-members of the control group; and

assigning the isolated application to the control group.

2. The method of claim 1 , further comprising:

detaching the isolated application from the node computing device; and

resetting a control group access rate for the block storage resource.

3. The method of claim 2 , further comprising preventing attachment of a new isolated application to a block storage device comprising the block storage resource until the control group access rate is reset.

4. The method of claim 1 , further comprising assigning additional processes in a hierarchy of the isolated application to the control group.

5. The method of claim 1 , further comprising:

receiving a request to access the block storage resource by a second isolated application;

determining that the second isolated application does not belong to the control group; and

denying access based on the access rate limit set to zero for non-members of the control group.

6. The method of claim 1 , further comprising:

restarting the node computing device;

reinitiating the isolated application on the node computing device; and

recreating the control group and resetting the access rate limit to zero for non-members of the control group.

7. The method of claim 1 , wherein the isolated application comprises a plurality of processes performing operations in respective isolated processing spaces that share one or more of memory or network access.

8. The method of claim 1 , wherein determining that the isolated application requests exclusive access to a block storage resource comprises receiving, by an orchestrator, a request from the isolated application for exclusive access to a storage block.

9. The method of claim 1 , wherein creating the control group is performed by a node agent executing on the node computing device in response to an instruction from an orchestrator.

10. A system comprising:

a memory device; and

a processing device operatively coupled to the memory device, the processing device to:

initiate an instance of an isolated application on a node computing device;

determine, by a node agent executed by the processing device, that the isolated application requests exclusive access to a block storage resource;

create a control group associated with the block storage resource and the isolated application;

provide access to members of the control group and prevent access to the block storage resource for non-members of the control group by setting an access rate limit to zero for non-members of the control group; and

assign the isolated application to the control group.

11. The system of claim 10 , wherein the processing device is further to:

detach the isolated application from the node computing device; and

reset a control group access rate for the block storage resource.

12. The system of claim 11 , wherein the processing device is further to prevent attachment of a new isolated application to a block storage device comprising the block storage resource until the control group access rate is reset.

13. The system of claim 10 , wherein the processing device is further to assign additional processes in a hierarchy of the isolated application to the control group.

14. The system of claim 10 , wherein the processing device is further to:

receive a request to access the block storage resource by a second isolated application;

determine that the second isolated application does not belong to the control group; and

deny access based on the access rate limit set to zero for non-members of the control group.

15. The system of claim 10 , wherein the processing device is further to:

restart the node computing device;

reinitiate the isolated application on the node computing device; and

recreate the control group and resetting the access rate limit to zero for non-members of the control group.

16. The system of claim 10 , wherein the isolated application comprises a plurality of processes performing operations in respective isolated processing spaces that share one or more of memory or network access.

17. The system of claim 10 , wherein the processing device is further to execute a node agent to create the control group in response to an instruction from an orchestrator.

18. A non-transitory computer-readable storage medium including instructions that, when executed by a processing device, cause the processing device to:

initiate an instance of an isolated application on a node computing device;

determine, by the processing device, that the isolated application requests exclusive access to a block storage resource;

create, by the processing device, a control group associated with the block storage resource and the isolated application;

provide access to members of the control group and prevent access to the block storage resource for non-members of the control group by setting an access rate limit to zero for non-members of the control group; and

assign the isolated application to the control group.

19. The non-transitory computer-readable medium of claim 18 , wherein the instructions further cause the processing device to:

detach the isolated application from the node computing device; and

reset a control group access rate for the block storage resource.

20. The non-transitory computer-readable medium of claim 18 , wherein the instructions further cause the processing device to:

receive a request to access the block storage resource by a second isolated application;

determine that the second isolated application does not belong to the control group; and

deny access based on the access rate limit set to zero for non-members of the control group.