Abstract: A storage system proxy associated with a storage system may receive a service mesh policy used by a service mesh. The storage system may include a storage system proxy. The service mesh may include a control plane and a data plane. The data plane may include proxies associated with respective services. The control plane may configure the proxies according to the service mesh policy. The data plane may include the proxies communicating with each other, as configured by the control plane, to relay exchanges between the services. The storage system proxy may communicate with the storage system to configure a volume based on the service mesh policy received from the service mesh. The volume may be exposed to the data plane.

Abstract: A node of a container system is made immutable to containers (e.g., to applications operating in the containers) running on the node. For example, the node may be made immutable by performing a method comprising: mounting, by a container runtime operating on a node within a container system, a volume comprising a container image, wherein the node comprises storage resources; creating, on the node and based on access to the volume, an instance of a container associated with the container image; and mapping, with respect to the container, accesses to the storage resources to one or more volumes stored remotely from the node, where the storage resources on the node are immutable to the container based on the mapping the accesses to the storage resources to the one or more volumes.

Abstract: An illustrative method of container recovery using layer prioritization includes identifying a set of immutable layers of container images included in a dataset used by a container system to run containerized applications on a first cluster; copying the set of immutable layers of container images to a second cluster in preparation for a recovery event; receiving, after the set of immutable layers of container images are copied to the second cluster, a recovery request to recover the containerized applications; and copying, in response to the recovery request, a set of mutable layers included in the dataset to the second cluster, the second cluster configured to use the copied set of immutable layers and the copied set of mutable layers to recover the containerized applications on the second cluster.

Abstract: A storage system, associated with a container system, may be configured to perform a method that includes: providing, by a storage system, storage services to a container system; determining, by the storage system and based on the providing the storage services to the container system, a potential security threat; and performing, by the storage system, a remedial action based on the potential security threat.

Abstract: A container-aware storage system may be configured to store, manage, and provide immutable container images and optionally persistent storage to a container system for use by the container system to run container instances of the container images. The storage system may use volumes to store, manage, and provide immutable container images and optionally persistent storage to the container system for use by the container system to run container instances of the container images. In some embodiments, the storage system receives an immutable container image and stores the immutable container image as a volume. The storage system subsequently detects a request from a container system, such as a request to run a container instance of the immutable container image in the container system and, in response to the request, provides the volume to the container system.

Abstract: An illustrative method includes a controller associated with a plurality of clusters receiving, from a user, a disaster recovery policy of a containerized application deployed on a first cluster in the plurality of clusters, determining a cluster profile of each second cluster among one or more second clusters that are distinct from the first cluster in the plurality of clusters, identifying, from the one or more second clusters, a particular cluster based on the disaster recovery policy of the containerized application and the cluster profile of each second cluster, and assigning the particular cluster to be a disaster recovery cluster for the containerized application.

Abstract: In some embodiments, a method for software application deployment across dusters may include receiving a request to deploy a software application with a first deployable component and a second deployable component. The method may further include determining, based on the request, an availability, within a first duster of the plurality of dusters, of first computing resources capable of executing the first deployable component, and an availability, within a second duster of the plurality of dusters different from the first duster, of second computing resources capable of executing the second deployable component. The method may further include deploying, based on the availabilities of the first and second computing resources, the software application across the plurality of dusters. For example, this deploying across dusters may include deploying the first deployable component to the first cluster and deploying the second deployable component to the second duster.

Abstract: A method for containerized application deployment that includes: determining, by a controller and based on a plurality of clusters, a first subset of clusters based on the first subset of clusters having node resources that satisfy a resource specification of a containerized application; determining, by the controller and based on the plurality of clusters, a second subset of clusters based on the second subset of clusters having cluster attributes that satisfy a deployment policy; selecting, by the controller and based on the deployment policy, a first cluster included in the first subset of clusters and in the second subset of clusters; and deploying, by the controller, the containerized application to the first cluster.

Abstract: An illustrative method includes providing, by an orchestrator implemented on top of a plurality of clusters, a client-facing interface; receiving, by the orchestrator by way of the client-facing interface, a request to deploy a containerized application; selecting, by the orchestrator and based on the request, a cluster from the plurality of clusters; and deploying, by the orchestrator, the containerized application to the selected cluster.

Abstract: In some embodiments, a method for containerized application deployment to use multi-cluster computing resources may include receiving a request to deploy a containerized application, The request may be associated with a resource specification that indicates that, when deployed, the containerized application uses a first computing resource and a second computing resource. Accordingly, after determining an availability of the first computing resource on a first duster and of the second computing resource on a different second duster, the method may further include deploying the containerized application based on the determined availabilities of the computing resources. For example, the method may include deploying the containerized application such that it uses the first computing resource on the first duster and the second computing resource on the second duster. Corresponding methods and systems are also disclosed.

Abstract: An illustrative method includes a controller associated with a plurality of clusters generating a disaster recovery profile of a containerized application deployed on a first cluster in the plurality of clusters, determining a cluster profile of each second cluster among one or more second clusters that are distinct from the first cluster in the plurality of clusters, identifying, from the one or more second clusters, a particular cluster based on the disaster recovery profile of the containerized application and the cluster profile of each second cluster, and assigning the particular cluster to be a disaster recovery cluster for the containerized application.

Abstract: An illustrative method includes a storage-aware serverless function management system monitoring one or more serverless function instances of one or more serverless functions implemented in a serverless system, the one or more serverless function instances associated with one or more components of a storage system, determining a portion of a component among the one or more components of the storage system based on the monitoring, and requesting the storage system to adjust storage of data associated with the portion of the component.

Abstract: In some embodiments, storage path routing in a container system includes: determining, within the container system, a storage operation directed to a storage resource; determining one or more conditions associated with a plurality of network paths to the storage resource, where the plurality of network paths includes a first network path through a storage area network and a second network path through a container system communication network; and routing, based on the one or more conditions, the storage operation to the storage resource using the first network path.

Abstract: States of storage nodes in a storage cluster may be transitioned from a secured state to an unsecured state. When all the storage nodes are in the secured state, a first reboot of the storage nodes is initiated. The first reboot may involve the storage nodes rebooting from the secured state into an intermediate state. During the first reboot: storage nodes that have rebooted into the intermediate state are allowed to rejoin the distributed storage cluster, and storage nodes in the unsecured state are not allowed to join the distributed storage cluster. When all the storage nodes are in the intermediate state, a second reboot of the storage nodes may be initiated. The second reboot may involve rebooting the storage nodes from the intermediate state into the unsecured state. During the second reboot, storage nodes that have rebooted into the unsecured state are allowed to rejoin the storage cluster.

Abstract: An illustrative method includes a storage-aware serverless function management system monitoring one or more serverless function instances of one or more serverless functions implemented in a serverless system, the one or more serverless function instances associated with one or more components of a storage system, determining a portion of a component among the one or more components of the storage system based on the monitoring, and requesting the storage system to adjust storage of data associated with the portion of the component.

Abstract: An example computer-implemented method of controlling access to a storage system includes using, in response to a request to access a resource of the storage system during a transitional state associated with a transition of the storage system to use a security protocol to control access to the storage system, a guest role to control access to the resource of the storage system when the request does not include a token identifier

Abstract: An illustrative method includes a storage-aware serverless function management system receiving a request to execute a serverless function instance of a serverless function implemented in a serverless system, the serverless function instance associated with a component of a storage system, determining a portion of the component accessible to the serverless function instance based on a storage system policy associated with the storage system, and executing the serverless function instance using the portion of the component of the storage system.

Abstract: An illustrative method includes a monitoring system obtaining event data describing an event within a distributed compute and storage system, generating an event block for the event based on the event data, and attaching the event block to an event blockchain associated with the distributed compute and storage system, the event blockchain being immutable and indicating one or more events within the distributed compute and storage system in a chronological order of the one or more events. The event blockchain is used to provide one or more features of a storage system.

Abstract: An illustrative method may include creating a volume object based on a request that includes a user token that indicates an identifier of a user associated with the request, the volume object corresponding to a physical or virtual volume of storage; creating an ownership object corresponding to the volume object, the creating comprising obtaining the identifier of the user from the user token and including the identifier in the ownership object; and including in the ownership object an access control list that is associated with an operation type, the access control list comprising identifiers of users and/or user groups who have permission to perform operations on the volume object.

Abstract: An example method includes detecting a request to store a software build instance within a storage system prior to the software build instance being uploaded to a software registry and initiating, based on the request and while the software build instance is stored within storage system, a scanning operation with respect to the software build instance, the scanning operation configured to check for one or more anomalies associated with the software build instance.