DISTRIBUTED COMPUTING SYSTEM WITH MULTI TENANCY BASED ON APPLICATION SLICES

1 . A distributed computing system having a plurality of clusters interconnected by a network, each cluster including a plurality of compute nodes connected by a cluster network and collectively executing a set of microservices in respective containers organized into multi-container pods, the pods being individually addressable in the cluster network, the distributed computing system including application slice components distributed among the clusters to define and operate a plurality of application slices each providing application slice services for respective sets of pods distributed among the clusters, the clusters further configured in a multi-tenancy in which a plurality of distinct tenants each includes a respective distinct set of the application slices and is configured according to respective per-tenant configuration data.

2 . The distributed computing system of claim 1 , wherein each tenant is an administrative grouping of resources and functions that enable inter-service operation within each tenant while providing for desired separation and protection between services of different tenants.

3 . The distributed computing system of claim 2 , wherein the tenants are distinct customers of a compute cloud provider or other compute service provider.

4 . The distributed computing system of claim 1 , wherein the tenants share cluster resources with isolation of per-tenant compute resources, network resources, security mechanisms, and policy among the tenants.

5 . The distributed computing system of claim 1 , wherein the per-tenant configuration data for a given tenant includes tenant-wide settings that are applied to all the slices of the tenant across all the clusters.

6 . The distributed computing system of claim 1 , wherein the per-tenant configuration data is stored and applied by a controller residing in a controller cluster separate from the clusters, and access control is used to provide controlled access to the per-tenant configuration data.

7 . The distributed computing system of claim 1 , wherein each cluster includes a slice operator configured and operative to implement orchestration of the slices in its cluster, the slice operator (1) implementing and enforcing application slice multi-tenancy requirements, and (2) monitoring slice metrics and configuration to enforce the multi-tenancy requirements.

8 . The distributed computing system of claim 1 , wherein the per-tenant configuration data includes resource quotas for the tenants and slices, the resource quotas being passed to respective slice operators of the clusters during slice orchestration, the slice operator in each cluster implementing the resource quotas across associated namespaces and other slice services, and monitoring resource usage and taking actions including generating alerts and events that can trigger corrective actions by a system controller.

9 . The distributed computing system of claim 1 , wherein the per-tenant configuration data includes respective quality of service (QOS) profiles for the tenants and slices, whereby distinct traffic control/priorities are provided for each of the tenants.

10 . The distributed computing system of claim 1 , wherein a system controller and respective slice operators of the clusters ingest telemetry from multi-tenancy related resources including namespaces, network policy, and other slice services, and upon detection of configuration drift or other violations, corresponding alerts and events are generated, and corresponding corrective actions are taken.

11 . The distributed computing system of claim 1 , wherein per-slice functionality includes configuration and implementation of different slice optimization policies selected from 1) load-balancer optimization for efficient traffic control and distribution, 2) workload placement for cost and resource optimization and 3) slice-wide auto-scalar policy to optimize cost and resources used for auto-scaling application/services deployment.

12 . The distributed computing system of claim 1 , wherein each slice has its own slice specific service discovery, and services discovered across the slice are isolated from other tenants and slices.

13 . A method performed in a multi-cluster distributed computing system, each cluster including a plurality of compute nodes connected by a cluster network and collectively executing a set of microservices in respective containers organized into multi-container pods, the pods being individually addressable in the cluster network, the method comprising the steps, performed for each slice of respective sets of slices for respective tenants of the system, of:

by a slice controller, receiving and validating slice configuration data, generating dynamic slice configuration data, and sending the dynamic slice configuration data to slice operators of respective clusters as specified in the slice configuration data; and

by each of the slice operators of the selected clusters, (1) implementing the slices of the tenants in the respective cluster according to the dynamic slice configuration data from the slice controller, (2) onboarding the microservices of namespaces associated with the application slices onto the respective slices, and (3) during subsequent operation, monitoring the application slices for enforcement of multi-tenancy policies and for detection and reporting of resource usage violations and configuration drifts.

14 . The method of claim 13 , wherein generating dynamic slice configuration data includes:

generating overlay network configuration;

generating network policy configuration;

generating namespace associations and associated resource quotas; and

generating service discovery, authentication, and related configuration data.

15 . The method of claim 13 , wherein implementing the slices includes:

orchestrating slice components;

creating helm charts, deployment files, and specifications applying them to create custom and native resources;

creating overlay network services;

creating associated namespaces if needed, the namespaces including global namespace and associated sub-namespaces;

creating and applying appropriate network policies to associate namespaces and block traffic from other tenants and slices;

creating deployment specifications for ingress/egress gateways and configuring traffic management rules;

creating and applying appropriate slice optimization policies.