Automated Deployment of Applications with Tenant-Isolation Requirements

• US 20120180039A1
• Filed: 01/11/2011
• Published: 07/12/2012
• Est. Priority Date: 01/11/2011
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Bravery, Andrew James Frederick, Rouvellou, Isabelle M., Iyengar, Arun Kwangil, Kasman, Aaron Edward, Mikalsen, Thomas Arthur
• Granted Patent: US 9,104,514 B2
• Time in Patent Office: Days
• US Class Current: 717/178
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: G06F 9/45504 Abstract machines for programme code execution, e.g. Java virtual machine [JVM], interpreters, emulators
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45537 Provision of facilities of other operating environments, e.g. WINE I/O emulation G06F13/105
• CPC Class Codes: G06F 9/5077 Logical partitioning of resources; Management or configuration of virtualized resources specific details on emulation or internal functioning of virtual machines G06F9/455

Abstract

An embodiment of the invention provides a method for multi-tenant enabling a service, where the service includes a plurality of service components. Rules are received from a provider of the service, wherein the rules include rules for isolating the service components and rules for sharing the service components. The service components are matched with virtualization environments and/or physical environments based on the rules. The virtualization environments include at least one isolation container and/or at least one shared container. The service components are stored in the virtualization environments and/or the physical environments based on the matching. The service components are mapped to the at least one isolation container of the virtualization environments, the at least one shared container of the virtualization environments, and/or the physical environments based on the storing of the service components.

Claims

1. A method for multi-tenant enabling a service, said method comprising:

receiving rules from a provider of the service, the rules including rules for isolating components of the service and rules for sharing the components of the service;

associating the rules with the components of the service;

automatically matching the components of the service with at least one of virtualization environments and physical environments;

automatically provisioning the components of the service in at least one of the matched virtualization environments and the matched physical environments based on the rules; and

automatically reconfiguring the components of the service based on said provisioning of the components of the service.

2. The method of claim 1, further including:

receiving a request for the service from a tenant; and

routing the request to the components of the service based on said matching of the virtualization environments and based on said reconfiguring of the components of the service.

3. The method of claim 1, wherein the service enables at least one of developing of applications and hosting of the applications, wherein the applications are at least one of created by a tenant and deployed by the tenant as a function of the service.

4. The method of claim 1, further including:

sharing platform-specific resources between tenants of a platform via an integrated repository of the platform; and

permitting access to the platform via platform-defined browser-based tooling.

5. The method of claim 1, wherein the service includes browser-based, self-service administrative tools for

allowing tenants to configure at least one of tenant containers and tenant components and

restricting access via a command prompt shell.

6. A method for multi-tenant enabling a service, the service including a plurality of service components, said method comprising:

receiving rules from a provider of the service, the rules including rules for isolating the service components and rules for sharing the service components;

matching the service components with virtualization environments based on the rules, the virtualization environments including at least one of;

at least one isolation container, and

at least one shared container;

storing the service components in the virtualization environments based on said matching; and

mapping the service components to at least one of the at least one isolation container and the at least one shared container of the virtualization environments based on said storing of the service components.

7. The method of claim 6, further comprising:

matching physical environments with the service components;

storing the service components in the physical environments based on said matching of the physical environments; and

mapping the service components to the physical environments based on said storing of the service components in the physical environments.

8. The method of claim 7, wherein at least one of the physical environments, the virtualization environments, and an isolation container of the physical environments uses an operating system including a Linux kernel.

9. The method of claim 6, further comprising:

receiving a request for the service from an end-user; and

routing the request to the service components based on said mapping.

10. The method of claim 6, further including at least one of developing applications with the service and hosting the applications with the service, wherein the applications are at least one of created by a first user and deployed by the first user as a function of the service.

11. The method of claim 6, wherein said isolation container includes a higher level of isolation relative to said shared container, and wherein said shared container includes a higher level of sharing relative to said isolation container.

12. The method of claim 6, wherein said virtualization environments include at least one nested virtualization environment in a nesting virtualization environment.

13. The method of claim 6, further including receiving a request to provision the service components from at least one of a first user and the provider of the service, wherein said storing of the service components is performed based on the request.

14. The method of claim 6, further including extending an initial configuration of a container by a first user, said extending of the initial configuration including at least one of acquiring additional component libraries and upgrading existing component libraries.

15. The method of claim 6, wherein the service includes a natively standalone service extended with platform-specific extensions.

16. A method for multi-tenant enabling a service, the service including a plurality of service components, said method comprising:

receiving rules from a provider of the service with an interface, the rules including rules for isolating the service components and rules for sharing the service components;

matching the service components with at least one of virtualization environments and physical environments with a configuration module based on the rules, the virtualization environments including at least one of;

at least one isolation container, and

at least one shared container;

storing the service components in at least one of the virtualization environments and the physical environments with a storage module, said storing of the service components being based on said matching;

mapping the service components with a mapping module to at least one of the at least one isolation container of the virtualization environments, the at least one shared container of the virtualization environments, and the physical environments based on said storing of the service components;

receiving a request for the service from an end-user with a second interface; and

routing the request to the service components with a router based on said mapping.

17. A system for multi-tenant enabling a service, said system comprising:

an interface for receiving rules from a provider of the service, the rules including rules for isolating the service components and rules for sharing the service components;

a configuration module connected to said interface, said configuration module matches the service components with virtualization environments based on the rules, the virtualization environments including at least one of;

at least one isolation container, and

at least one shared container;

a storage module connected to said configuration module, said storage module stores the service components in the virtualization environments based on the matching performed by said configuration module; and

a mapping module connected to said storage module, said mapping module maps the service components to at least one of the at least one isolation container and the at least one shared container of the virtualization environments based on the storing performed by said storage module.

18. The system of claim 17, further comprising:

a second interface for receiving a request for the service from an end-user; and

a router connected to said second interface for routing the request to the service components based on the mapping performed by said mapping module.

19. The system of claim 17, further including a statistics module for generating at least one statistics report, the statistics report including statistics of use of the service.

20. A computer program product for multi-tenant enabling a service, the service including a plurality of service components, said computer program product including:

a computer readable storage medium;

first program instructions to receive rules from a provider of the service, the rules including rules for isolating the service components and rules for sharing the service components;

second program instructions to match the service components with virtualization environments based on the rules, the virtualization environments including at least one of

at least one isolation container and

at least one shared container;

third program instructions to store the service components in the virtualization environments based on said matching; and

fourth program instructions to map the service components to at least one of the at least one isolation container and the at least one shared container of the virtualization environments based on said storing of the service components,

said first program instructions, said second program instructions, said third program instructions, and said fourth program instructions are stored on said computer readable storage medium.