Service mesh-based control of access to a storage application
An illustrative method may include detecting a request for an application deployed within a first compute environment to have access to a storage application deployed within a second compute environment; deploying, based on the request, an endpoint proxy within the first compute environment, the endpoint proxy configured to participate in a service mesh running within the second compute environment and authorize the application to securely access the storage application by way of a network that interconnects the first and second compute environments; and routing communications between the application and the storage application through the endpoint proxy and a sidecar proxy running within the second compute environment, the sidecar proxy also participating in the service mesh and configured to allow access to the storage application.
1 . A method comprising:
detecting, by a storage management system, a request for an application deployed within a first compute environment to have access to a storage application deployed within a second compute environment;
deploying, by the storage management system based on the request, an endpoint proxy within the first compute environment, the endpoint proxy configured to participate in a service mesh running within the second compute environment and authorize the application to securely access the storage application by way of a network that interconnects the first and second compute environments;
routing, by the storage management system, communications between the application and the storage application through the endpoint proxy and a sidecar proxy running within the second compute environment, the sidecar proxy also participating in the service mesh and configured to allow access to the storage application; and
transmitting, by the storage management system by way of a control plane associated with the service mesh, one or more configuration parameters to the endpoint proxy, the one or more configuration parameters configured to configure the endpoint proxy to authorize the application to securely access the storage application, wherein:
the first compute environment is implemented by a first cluster of nodes managed by a container orchestrator,
the second compute environment is implemented by a second cluster of nodes managed by the container orchestrator,
the first compute environment is associated with a client of a storage management provider entity and is manageable by the client, and
the second compute environment is associated with the storage management provider entity and is not manageable by the client.
2 . The method of claim 1 , wherein the detecting the request comprises detecting user input provided by way of a user interface to deploy a particular storage application for use with the application.
3 . The method of claim 1 , wherein:
the first compute environment is further implemented by a first virtual machine-based environment; and
the second compute environment is further implemented by a second virtual machine-based environment.
4 . The method of claim 1 , wherein the deploying the endpoint proxy within the first compute environment comprises directing an agent application running within the first compute environment and associated with the storage management system to install the endpoint proxy within the first compute environment.
5 . The method of claim 1 , wherein the endpoint proxy does not allow any other application deployed within the first compute environment to have access to the storage application.
6 . The method of claim 1 , wherein the second compute environment comprises a plurality of nodes across which the storage application is distributed.
7 . The method of claim 1 , wherein the storage application comprises a database.
8 . The method of claim 1 , further comprising:
detecting, by the storage management system, a request to provision a volume for use by one or more applications deployed within the first compute environment;
provisioning, by the storage management system based on the request to provision the volume, the volume on compute resources within the first compute environment.
9 . A system comprising:
a memory storing instructions; and
one or more processors communicatively coupled to the memory and configured to execute the instructions to perform a process comprising:
detecting a request for an application deployed within a first compute environment to have access to a storage application deployed within a second compute environment;
deploying, based on the request, an endpoint proxy within the first compute environment, the endpoint proxy configured to participate in a service mesh running within the second compute environment and authorize the application to securely access the storage application by way of a network that interconnects the first and second compute environments;
routing communications between the application and the storage application through the endpoint proxy and a sidecar proxy running within the second compute environment, the sidecar proxy also participating in the service mesh and configured to allow access to the storage application; and
transmitting, by way of a control plane associated with the service mesh, one or more configuration parameters to the endpoint proxy, the one or more configuration parameters configured to configure the endpoint proxy to authorize the application to securely access the storage application, wherein:
the first compute environment is implemented by a first cluster of nodes managed by a container orchestrator,
the second compute environment is implemented by a second cluster of nodes managed by the container orchestrator,
the first compute environment is associated with a client of a storage management provider entity and is manageable by the client, and
the second compute environment is associated with the storage management provider entity and is not manageable by the client.
10 . The system of claim 9 , wherein the detecting the request comprises detecting user input provided by way of a user interface to deploy a particular storage application for use with the application.
11 . The system of claim 9 , wherein:
the first compute environment is further implemented by a first virtual machine-based environment; and
the second compute environment is further implemented by a second virtual machine-based environment.
12 . The system of claim 9 , wherein the deploying the endpoint proxy within the first compute environment comprises directing an agent application running within the first compute environment to install the endpoint proxy within the first compute environment.
13 . A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
detecting a request for an application deployed within a first compute environment to have access to a storage application deployed within a second compute environment;
deploying, based on the request, an endpoint proxy within the first compute environment, the endpoint proxy configured to participate in a service mesh running within the second compute environment and authorize the application to securely access the storage application by way of a network that interconnects the first and second compute environments;
routing communications between the application and the storage application through the endpoint proxy and a sidecar proxy running within the second compute environment, the sidecar proxy also participating in the service mesh and configured to allow access to the storage application; and
transmitting, by way of a control plane associated with the service mesh, one or more configuration parameters to the endpoint proxy, the one or more configuration parameters configured to configure the endpoint proxy to authorize the application to securely access the storage application, wherein:
the first compute environment is implemented by a first cluster of nodes managed by a container orchestrator,
the second compute environment is implemented by a second cluster of nodes managed by the container orchestrator,
the first compute environment is associated with a client of a storage management provider entity and is manageable by the client, and
the second compute environment is associated with the storage management provider entity and is not manageable by the client.
14 . The computer program product of claim 13 , wherein the computer instructions are further for deploying the endpoint proxy within the first compute environment comprises directing an agent application running within the first compute environment to install the endpoint proxy within the first compute environment.
15 . The computer program product of claim 13 , wherein the endpoint proxy does not allow any other application deployed within the first compute environment to have access to the storage application.
16 . The computer program product of claim 13 , wherein the second compute environment comprises a plurality of nodes across which the storage application is distributed.
17 . The computer program product of claim 13 , wherein the storage application comprises a database.
18 . The computer program product of claim 13 , wherein the computer instructions are further for:
detecting a request to provision a volume for use by one or more applications deployed within the first compute environment;
provisioning, based on the request to provision the volume, the volume on compute resources within the first compute environment.