Processing platform with distributed policy definition, enforcement and monitoring across multi-layer infrastructure
An apparatus in one embodiment comprises a processing platform configured to implement multi-layer infrastructure comprising compute, storage and network resources at a relatively low level of the multi-layer infrastructure, an application layer at a relatively high level of the multi-layer infrastructure, and one or more additional layers arranged between the relatively high level and the relatively low level. The processing platform is further configured to determine policies for respective different ones of the layers of the multi-layer infrastructure, the policy for a given one of the layers of the multi-layer infrastructure defining rules and requirements relating to that layer, to enforce the policies at the respective layers of the multi-layer infrastructure, and to monitor performance of an application executing in the multi-layer infrastructure. One or more configuration parameters of the multi-layer infrastructure are adjusted based at least in part on a result of the monitoring.
1. An apparatus comprising:
a processing platform comprising a plurality of processing devices each comprising a processor coupled to a memory;
the processing platform being configured to implement multi-layer infrastructure comprising compute, storage and network resources at a relatively low level of the multi-layer infrastructure, an application layer at a relatively high level of the multi-layer infrastructure, and one or more additional layers arranged between the relatively low level and the relatively high level;
the processing platform being further configured:
to determine policies for respective different ones of the layers of the multi-layer infrastructure, the policy for a given one of the layers defining rules and requirements relating to that layer;
to enforce the policies at the respective layers of the multi-layer infrastructure; and
to monitor performance of an application executing in the multi-layer infrastructure;
wherein determining policies for respective ones of the layers of the multi-layer infrastructure comprises:
determining operational policies for each of a plurality of layers other than the application layer;
determining an application policy for the application layer;
propagating the application policy from the application layer through the other layers of the multi-layer infrastructure; and
generating the policy for the given one of the layers as a combination of the application policy and an operational policy for that layer;
wherein one or more configuration parameters of the multi-layer infrastructure are adjusted based at least in part on a result of the monitoring; and
wherein each of one or more of the layers of the multi-layer infrastructure is associated with at least one controller configured to receive the policy for the corresponding layer and to translate the policy into management and orchestration actions for that layer.
2. The apparatus of claim 1 wherein the relatively low level of the multi-layer infrastructure comprising the compute, storage and network resources comprises a lowest level of the multi-layer infrastructure.
3. The apparatus of claim 1 wherein the additional layers of the multi-layer infrastructure comprise at least a subset of:
an execution venue layer;
a software-defined infrastructure layer;
a node partition layer; and
a node composer layer.
4. The apparatus of claim 1 wherein each of one or more of the layers of the multi-layer infrastructure is associated with at least one orchestrator configured to receive an application policy from an overlying layer and to provide the application policy to an underlying layer.
5. The apparatus of claim 4 wherein a given one of the orchestrators is configured to generate the policy for its corresponding layer as a function of an operational policy for that layer and the application policy.
6. The apparatus of claim 1 wherein a given one of the controllers is configured to register infrastructure inventory of the corresponding layer to one or more orchestrators associated with that layer.
7. The apparatus of claim 1 wherein a given one of the controllers is configured to enforce the policy for the corresponding layer at least in part by identifying a deviation of a current state of designated infrastructure assets of that layer from a desired state of the designated infrastructure assets of that layer and generating one or more additional management and orchestration actions for that layer responsive to the identified deviation.
8. The apparatus of claim 1 wherein the processing platform is further configured to implement role-based access control for controlling access to operational policy definition functionality for respective ones of the layers of the multi-layer infrastructure so as to permit only entities having particular roles to define operational policies for at least portions of different ones of the layers.
9. The apparatus of claim 1 wherein different operational policies are ingested at respective different ones of the layers of the multi-layer infrastructure other than the application layer and wherein an application policy is ingested at the application layer of the multi-layer infrastructure.
10. The apparatus of claim 9 wherein mutual enforcement of the operational and application policies is achieved in the multi-layer infrastructure by combining operational and application policies at respective policy control points of respective ones of the layers other than the application layer.
11. The apparatus of claim 10 wherein combining operational and application policies at one of the policy control points of a given one of the layers comprises combining an operational policy ingested by the given layer with an application policy received by the given layer from an overlying layer to produce a combined policy for the given layer.
12. The apparatus of claim 1 wherein enforcing the policy for a given one of the layers of the multi-layer infrastructure comprises converting the policy in a controller of the given layer into one or more infrastructure-specific management and orchestration actions to be carried out in the given layer.
13. A method comprising:
implementing multi-layer infrastructure comprising compute, storage and network resources at a relatively low level of the multi-layer infrastructure, an application layer at a relatively high level of the multi-layer infrastructure, and one or more additional layers arranged between the relatively low level and the relatively high level;
determining policies for respective different ones of the layers of the multi-layer infrastructure, the policy for a given one of the layers defining rules and requirements relating to that layer;
enforcing the policies at the respective layers of the multi-layer infrastructure; and
monitoring performance of an application executing in the multi-layer infrastructure;
wherein determining policies for respective ones of the layers of the multi-layer infrastructure comprises:
determining operational policies for each of a plurality of layers other than the application layer;
determining an application policy for the application layer;
propagating the application policy from the application layer through the other layers of the multi-layer infrastructure; and
generating the policy for the given one of the layers as a combination of the application policy and an operational policy for that layer;
wherein one or more configuration parameters of the multi-layer infrastructure are adjusted based at least in part on a result of the monitoring;
wherein each of one or more of the layers of the multi-layer infrastructure is associated with at least one controller configured to receive the policy for the corresponding layer and to translate the policy into management and orchestration actions for that layer; and
wherein the method is performed in at least one processing platform comprising a plurality of processing devices each comprising a processor coupled to a memory.
14. The method of claim 13 wherein each of one or more of the layers of the multi-layer infrastructure is associated with at least one orchestrator configured to receive an application policy from an overlying layer and to provide the application policy to an underlying layer, and wherein a given one of the orchestrators is configured to generate the policy for its corresponding layer as a function of an operational policy for that layer and the application policy.
15. The method of claim 13 wherein a given one of the controllers is configured to register infrastructure inventory of the corresponding layer to one or more orchestrators associated with that layer.
16. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing platform comprising a plurality of processing devices causes the processing platform:
to implement multi-layer infrastructure comprising compute, storage and network resources at a relatively low level of the multi-layer infrastructure, an application layer at a relatively high level of the multi-layer infrastructure, and one or more additional layers arranged between the relatively low level and the relatively high level;
to determine policies for respective different ones of the layers of the multi-layer infrastructure, the policy for a given one of the layers defining rules and requirements relating to that layer;
to enforce the policies at the respective layers of the multi-layer infrastructure; and
to monitor performance of an application executing in the multi-layer infrastructure;
wherein determining policies for respective ones of the layers of the multi-layer infrastructure comprises:
determining operational policies for each of a plurality of layers other than the application layer;
determining an application policy for the application layer;
propagating the application policy from the application layer through the other layers of the multi-layer infrastructure; and
generating the policy for the given one of the layers as a combination of the application policy and an operational policy for that layer;
wherein one or more configuration parameters of the multi-layer infrastructure are adjusted based at least in part on a result of the monitoring; and
wherein each of one or more of the layers of the multi-layer infrastructure is associated with at least one controller configured to receive the policy for the corresponding layer and to translate the policy into management and orchestration actions for that layer.
17. The computer program product of claim 16 wherein each of one or more of the layers of the multi-layer infrastructure is associated with at least one orchestrator configured to receive an application policy from an overlying layer and to provide the application policy to an underlying layer, and wherein a given one of the orchestrators is configured to generate the policy for its corresponding layer as a function of an operational policy for that layer and the application policy.
18. The computer program product of claim 16 wherein a given one of the controllers is configured to register infrastructure inventory of the corresponding layer to one or more orchestrators associated with that layer.
19. The computer program product of claim 16 wherein the additional layers of the multi-layer infrastructure comprise at least a subset of:
an execution venue layer;
a software-defined infrastructure layer;
a node partition layer; and a node composer layer.
20. The computer program product of claim 16 wherein a given one of the controllers is configured to enforce the policy for the corresponding layer at least in part by identifying a deviation of a current state of designated infrastructure assets of that layer from a desired state of the designated infrastructure assets of that layer and generating one or more additional management and orchestration actions for that layer responsive to the identified deviation.