US 2023/0145488 A1 · Cross-Cloud Workload Identity Virtualization

Abstract

A system for cross cloud workload identity virtualization including a program having instructions to route a first network call from a workload in a first cloud computing environment addressed to a first cloud computing environment instance metadata service (IMS) having destination data with an IP address of 169.254.169.254 to a universal IMS (UIMS) different from the first cloud computing environment IMS, route a second network call from the workload addressed to a destination other than the first cloud computing environment IMS to the destination indicated by the second network call, respond to the first network call with credentials valid for accessing a cloud service provided in a second cloud computing environment. The workload can access the cloud service from the first cloud computing environment, and access the cloud service from a third cloud computing environment different from the first cloud computing environment.

Claims20

Dependent claims

A method, comprising:

providing, on a first cloud platform, a masquerading instance metadata service configured to process instance metadata service requests that originate from a workload deployed on the first cloud platform;
providing a request routing element;
and
configuring the request routing element to detect a communication from the workload and selectively route the communication to the masquerading instance metadata service according to whether the communication is an instance metadata service request;
wherein the masquerading instance metadata service returns, to the workload , valid credentials that are credentials to a cloud service operating in a second cloud platform;
and
wherein the workload successfully consumes the cloud service operating in the second cloud platform using the valid credentials.

4 more elements

A system, comprising:

one or more processors;
a non-transitory computer readable medium storing one or more programs for execution by the one or more processors, wherein a first program of the one or more programs includes first instructions for providing a request routing element, wherein a second program of the one or more programs includes second instructions for providing a masquerading instance metadata service, and wherein the first instructions include instructions to:
detect a communication from a workload on a first cloud platform;
and
selectively route, according to whether the communication is an instance metadata service request, the communication to the masquerading instance metadata service;
and
wherein the second instructions include instructions to:
return, to the workload, valid credentials that are credentials to a cloud service operating in a second cloud platform, wherein the valid credentials result in the workload successfully accessing the cloud service operating in the second cloud platform using the valid credentials.

5 more elements

A system, comprising:

one or more processors;
a non-transitory computer readable medium storing one or more programs for execution by the one or more processors, wherein the one or more programs includes instructions for providing a masquerading instance metadata service, and wherein the instructions include instructions to:
receive, from a request routing element, a communication that is generated by a workload and this is selectively routed to the masquerading instance metadata service according to whether the communication is an instance metadata service request;
and
return, to the workload, valid credentials that are credentials to a cloud service operating in a second cloud platform, wherein the workload successfully uses the cloud service operating in the second cloud platform using the credentials.

2 more elements

Dependencies are inferred from the claim text.

Cross-Cloud Workload Identity Virtualization

Life of this patent

Cross-Cloud Workload Identity Virtualization

Life of this patent

Abstract

Claims20