Plugin based host definitions for a multi-cloud infrastructure
A system for accessing computing elements of a cloud computing infrastructure includes a dynamic host interface associated with an identity-based access management system. The dynamic host interface is configured to receive host catalogs from components of the cloud computing infrastructure, each host catalog including one or more host sets, each of the one or more host sets including references to one or more hosts, where each of the one or more hosts represents an addressable computing element. The system further includes a plugin-based hosts model in a memory, and being configured to receive, from the dynamic host interface, the host catalogs for identity-based access to the one or more host sets by a user of a client computer to address the addressable computing element represented by the host.
1 . A system for accessing, by a client computer via an identity-based access management system of a cloud computing infrastructure, one or more addressable computing elements of the cloud computing infrastructure, the system comprising:
a server computer providing a dynamic host interface associated with the identity-based access management system, the dynamic host interface being configured to
receive one or more host catalogs from one or more components of the cloud computing infrastructure, each of the one or more host catalogs comprising one or more host sets, each of the one or more host sets comprising references to one or more hosts, and each of the one or more hosts representing one of the one or more addressable computing elements; and
a model generator executed by the server computer and configured to form a plugin-based hosts model in a memory associated with the identity-based access management system, the plugin-based hosts model being configured to receive, from the dynamic host interface, the one or more host catalogs for identity-based access to the one or more host sets by a user of the client computer to address the one or more addressable computing elements of the cloud computing infrastructure represented by the one or more hosts
wherein the identity-based access management system includes a common programming interface that can be used by plugins to receive requests for resources from a cloud provider and map resources to a host/host-set/host-catalog model;
wherein the plugin-based hosts model comprises a secrets field for storing credential data associated with the one or more hosts, the secrets field being configured such that credential data is encrypted before being written to persistent storage and is not returned by any read operation through the common programming interface, thereby making the secrets field write-only through the common programming interface;
wherein the model generator is further configured to, in response to a request for hosts, generate virtual host entries on-demand in memory, assign each virtual host entry a deterministic stable identifier, and discard the virtual host entries after completion of the request, such that the hosts obtained from a cloud provider are not persisted in storage; and
wherein, for each Create, Read, Update, Delete, or List (CRUDL) operation performed on a host catalog or host set, the identity-based access management system is configured to invoke plugin-specific validation hooks that (i) verify the correctness of attributes, (ii) mutate or reject credential data, and (iii) determine host-set availability.
2 . The system in accordance with claim 1 , wherein the plugin-based hosts model configures the one or more host sets according to a filter.
3 . The system in accordance with claim 2 , wherein the filter is used to categorize the host sets in the plugin-based hosts model according to one or more filter attributes.
4 . The system in accordance with claim 1 , further comprising an application programming interface (API) associated with the identity-based access management system, for receiving requests for access to the one or more addressable computing elements by the user of the client computer.
5 . The system in accordance with claim 1 , wherein the plugin-based hosts model is configured to inform the identity-based access management system of which of the one or more host sets are available to the user of the client computer.
6 . A system for accessing, by a client computer via an identity-based access management system of a cloud computing infrastructure, one or more computing elements of the cloud computing infrastructure, the system comprising:
a server computer providing a dynamic host interface associated with the identity-based access management system, the dynamic host interface being configured to
receive a host catalog from a component of the cloud computing infrastructure, the host catalog comprising one or more host sets, each of the one or more host sets comprising references to one or more hosts, and each of the one or more hosts representing one of the one or more computing elements of the cloud computing infrastructure; and
a model generator executed by the server computer and configured to form a plugin-based hosts model in a memory associated with the identity-based access management system, the plugin-based hosts model being configured to receive, from the dynamic host interface, the host catalog to execute identity-based access to the one or more host sets by a user of the client computer to address the one or more computing elements of the cloud computing infrastructure represented by the one or more hosts wherein the identity-based access management system includes a common programming interface that can be used by plugins to receive requests for resources from a cloud provider and map resources to a host/host-set/host-catalog model;
wherein the plugin-based hosts model comprises a secrets field for storing credential data associated with the one or more hosts, the secrets field being configured such that credential data is encrypted before being written to persistent storage and is not returned by any read operation through the common programming interface, thereby making the secrets field write-only through the common programming interface;
wherein the model generator is further configured to, in response to a request for hosts, generate virtual host entries on-demand in memory, assign each virtual host entry a deterministic stable identifier, and discard the virtual host entries after completion of the request, such that the hosts obtained from a cloud provider are not persisted in storage; and
wherein, for each Create, Read, Update, Delete, or List (CRUDL) operation performed on a host catalog or host set, the identity-based access management system is configured to invoke plugin-specific validation hooks that (i) verify the correctness of attributes, (ii) mutate or reject credential data, and (iii) determine host-set availability.
7 . The system in accordance with claim 6 , wherein the plugin-based hosts model configures the one or more host sets according to a filter.
8 . The system in accordance with claim 7 , wherein the filter is used to categorize the host sets in the plugin-based hosts model according to one or more filter attributes.
9 . The system in accordance with claim 6 , further comprising an application programming interface (API) associated with the identity-based access management system, for receiving requests for access to the one or more computing elements by the user of the client computer.
10 . The system in accordance with claim 6 , wherein the plugin-based hosts model is configured to inform the identity-based access management system of which of the one or more host sets are available to the user of the client computer.