Patent Description:
Applications (e.g. in the fifth generation (<NUM>) core network) are increasingly following cloud native design principles and are being deployed in container-based data centers. Upon request, container-based data centers can provide persistent storage volumes to container workloads. These persistent storage volumes are provided using a component that is referred to as a storage provisioner or storage provisioning node.

<FIG> and <FIG> illustrate existing systems comprising such a storage provisioning node <NUM>, which provides storage volumes to workloads.

Generally, data centers have a range of compute nodes (or hosts) <NUM> on which workloads are executed. As illustrated in <FIG> and <FIG>, a compute node <NUM> often comprises processing circuitry (e.g. a processor) <NUM>, a memory <NUM>, a network interface <NUM> and optionally a storage interface <NUM>. The workloads running on the compute node <NUM> share an operating system (OS) <NUM>. In some existing systems, such as the existing system illustrated in <FIG>, storage is provided by a storage backend <NUM>, which is attached to the compute node <NUM> through a network using the network interface <NUM>. In these existing systems, the storage backend <NUM> comprises the storage provisioning node <NUM>. In other existing systems, such as the existing system illustrated in <FIG>, storage is directly attached by means of the storage interface <NUM> to the compute node <NUM>. In these existing systems, the OS <NUM> of the compute node <NUM> comprises the storage provisioning node <NUM>. The document <CIT> (<NUM>-<NUM>-<NUM>), discloses a management server which searches the storage system and compiles information about security in the system, including authentication requirements for communications among ports and encryption states of various storage devices.

In the existing systems illustrated in <FIG> and <FIG>, all data center resources are allocated to workloads by an orchestrator (e.g. a container cluster orchestrator) <NUM>. The orchestrator <NUM> comprises a workload orchestrator <NUM> that orchestrates compute resources. The orchestrator <NUM> also comprises a storage orchestrator <NUM> that orchestrates storage resources. The workload orchestrator <NUM> and the storage orchestrator <NUM> can communicate via an interface <NUM>. In the existing systems illustrated in <FIG> and <FIG>, workloads run within an application node (e.g. an application container or workload container) <NUM>. Typically, several application nodes (e.g. application containers or workload containers) <NUM> run on the same compute node <NUM>. Each of these application nodes <NUM> can request one or more storage volumes <NUM>. The storage needs of a storage consumer (e.g. a user or an application) <NUM> that requires data storage are expressed within a request <NUM> that is processed by the orchestrator <NUM> at the time of application node deployment.

The workload orchestrator <NUM> uses the storage orchestrator <NUM> to request storage from the storage provisioning node <NUM>. The storage provisioning node <NUM> maintains a pool of storage devices <NUM>, reserves the requested amount of storage and makes it available to the compute node <NUM>. The storage orchestrator <NUM> uses an interface <NUM> to the OS <NUM> on the compute node <NUM> to create a storage volume <NUM> that is accessible to the storage consumer <NUM>.

<FIG> and <FIG> are signalling (or call flow) diagrams illustrating an exchange of signals in an existing system, such as those illustrated in <FIG> and <FIG>. The existing system illustrated in <FIG> and <FIG> comprises the application node <NUM>, the OS <NUM> of the compute node <NUM>, the storage provisioning node <NUM>, the orchestrator <NUM>, and an application management node <NUM>.

With reference to <FIG>, as illustrated by arrow <NUM>, in existing systems, the application management node <NUM> transmits a deployment request towards the orchestrator <NUM>. The deployment request is a request to deploy an application node (e.g. an application container or workload container) <NUM>. In response to the deployment request, as illustrated by arrow <NUM> of <FIG>, the orchestrator <NUM> transmits a request for storage towards the storage provisioning node <NUM>. As illustrated by arrow <NUM> of <FIG>, in response to this request, the storage provisioning node <NUM> transmits a request towards the OS <NUM> for the OS <NUM> to mount the storage volume <NUM>. As illustrated at block <NUM> of <FIG>, the OS <NUM> mounts the storage volume <NUM> to the compute node <NUM> and thus the storage volume <NUM> becomes available to the application node <NUM> (or, more specifically, the storage consumer <NUM>).

As illustrated by arrow <NUM> of <FIG>, the request for storage may be acknowledged by the storage provisioning node <NUM> to the orchestrator <NUM>. As illustrated by arrow <NUM> of <FIG>, the orchestrator <NUM> transmits a request towards the OS <NUM>, which is a request for the OS <NUM> to create the application node <NUM>. Then, the OS <NUM> allocates central processing unit (CPU) time for the application node <NUM> to run. Thus, as illustrated by arrow <NUM> of <FIG>, the OS <NUM> transmits a request towards the application node <NUM>, which is a request for the application node <NUM> to start. At block <NUM> of <FIG>, the application node <NUM> uses (or consumes) the storage volume <NUM>.

With reference to <FIG>, as illustrated by arrow <NUM>, a decommissioning request is received by the orchestrator <NUM> from the application management node <NUM>. In response to the decommissioning request, the orchestrator <NUM> transmits a request towards the OS <NUM> to decommission (e.g. delete) the application node (e.g. container) <NUM>. As illustrated by arrow <NUM> of <FIG>, the orchestrator <NUM> may transmit a request towards the (e.g. operating system <NUM> of the) application node <NUM> for the application node <NUM> to be decommissioned (e.g. deleted).

As illustrated by arrow <NUM> of <FIG>, the application management node <NUM> may transmit a request towards the orchestrator <NUM> for the storage volume to be deleted. In response to this request, as illustrated by arrow <NUM>, the orchestrator <NUM> transmits a request towards the storage provisioning node <NUM> for the storage provisioning node <NUM> to delete the storage volume. In response to this request, as illustrated by arrow <NUM>, the storage provisioning node <NUM> transmits a request to the OS <NUM> of the compute node <NUM> for the compute node <NUM> to unmount the storage volume. In response to this request, as illustrated at block <NUM>, the OS <NUM> of the compute node <NUM> unmounts the storage volume, such that it becomes unavailable to the application node <NUM>. As illustrated by arrow <NUM> of <FIG>, the request to delete the storage volume may be acknowledged by the storage provisioning node <NUM> to the orchestrator <NUM>.

In existing systems for provisioning storage, such as those described with reference to <FIG>, <FIG>, <FIG> and <FIG>, data encryption has become mandatory in order for applications to comply with legal requirements related to personal data protection (e.g. the General Data Protection Regulation (GDPR)) and security. However, most of the storage provisioning node components that are currently available do not actually support volume encryption. Also, for databases that do not have built-in encryption functionality, it is desirable for the system infrastructure to provide encryption of data at rest. However, applications (e.g. <NUM> applications) are often deployed in different data centers for which the system infrastructure is not always fully controlled by a single party. Instead, it is usually necessary to work with different storage provisioning nodes, but most of these storage provisioning nodes do not actually support the encryption that is expected by the databases.

One solution to this is to implement similar software in a multitude of components in the system infrastructure. However, this creates recurring development costs, since similar software then needs to be created and implemented for every new component that is added to the system infrastructure and for every new application release. The application release dependency applies to encryption implemented in application nodes (e.g. application containers or workload containers). In this respect, encryption related software may be added to the application nodes (e.g. application containers or workload containers). However, this can lead to licensing and support problems, particularly if these application nodes are third party products. Furthermore this creates recurring development costs, since similar software then needs to be created and implemented in every application that uses encrypted storage. It is also not acceptable to wait until all relevant storage provisioning nodes have been updated to support volume level encryption. There is no standard on how an encryption key may be passed to the storage provisioning node. Moreover, even if a storage provisioning node integrated in a data center supports encryption, the application needs to be adapted for each storage provisioning node that supports encryption to convey the key in the respective proprietary way.

It is an object of the disclosure to obviate or eliminate at least some of the above-described disadvantages associated with existing systems.

Therefore, according to an aspect of the disclosure, there is provided a method for provisioning storage in a system. This method is performed by a first storage provisioning node of the system. The method comprises, in response to a first request for an encrypted storage volume for an application node, initiating transmission of a second request towards a second storage provisioning node for an unencrypted storage volume. The method also comprises, in response to the requested unencrypted storage volume becoming available to the first storage provisioning node, generating an encrypted storage volume from the unencrypted storage volume and initiating provisioning of the encrypted storage volume to make the encrypted storage volume available at a compute node of the system for use by the application node.

There is thus provided an advantageous method for provisioning storage in a system. In particular, the method supports volume level encryption. This encryption on a volume level allows finer granularity for the creation of security domains, for example, compared with storage encryption performed on device level. It allows every volume to be encrypted with a different key. Moreover, the method allows security requirements on storage encryption to be satisfied without being dependent on encryption functionality provided by cloud systems. It is possible to provide encrypted storage volumes to application nodes even if a data center does not support such functionality. The method also avoids the need for software to be created (or modified) and implemented for every new storage provisioning node that is added to the system infrastructure and/or for every new application release, which provides easier development and integration. Moreover, licensing and support issues are mitigated since the method does not require encryption related software to be added to third party application nodes. The encrypted storage that is provide by way of the method can be used by any application node and can be deployed independently of any application node. It requires only a minimal additional software footprint irrespective of the number of application nodes that use it and no extra storage footprint. There is also no impact on application nodes if the second storage provisioning node is replaced with a different one. Moreover, different to encryption of data at rest on an infrastructure level, it allows the creation of different security domains on a per storage volume basis, e.g. by encrypting volumes with individual keys.

In some embodiments, initiating provisioning of the encrypted storage volume to make the encrypted storage volume available at the compute node for use by the application node may comprise initiating mounting of the encrypted storage volume to the compute node to make the encrypted storage volume available at the compute node for use by the application node. In this way, it is possible to make storage volumes accessible in a root file system tree, which can be a precondition for using functionality provided by the operating system of the compute node to access storage, such as reading and/or writing.

In some embodiments, initiating mounting of the encrypted storage volume to the compute node may comprise initiating mounting of the encrypted storage volume to a directory tree of the compute node. This can be particularly advantageous when the encrypted storage volume needs to be made available to multiple application nodes on the same compute host. In particular, having a separate mount point simplifies adding and removing of application node specific mount points.

In some embodiments, initiating provisioning of the encrypted storage volume to make the encrypted storage volume available at the compute node for use by the application node may comprise initiating provisioning of the encrypted storage volume on the first storage provisioning node to make the encrypted storage volume available at the compute node.

In some embodiments, the method may comprise initiating transmission of a third request towards the second storage provisioning node to cease making the unencrypted storage volume available at the compute node. This can be particularly advantageous where storage volumes can only be mounted to one compute node at a time. For example, unmounting of storage volumes may then be a precondition for mounting them to a different compute node. In general, the freeing up of unused resources improves efficiency of resource usage.

In some embodiments, the method may comprise, in response to a fourth request to cease making the encrypted storage volume available at the compute node, initiating the ceasing of making the encrypted storage volume available at the compute node. This may be advantageous since, depending on the operating system on the compute host, unmounting of the encrypted volume may be a precondition for unmounting of the unencrypted volume. It can also free up unused resources to thereby improve the efficiency of resource usage.

In some embodiments, the encrypted storage volume may be generated by applying an encrypted layer to the unencrypted storage volume.

In some embodiments, the encrypted layer may be an encrypted file system layer.

According to another aspect of the disclosure, there is provided a first storage provisioning node. The first storage provisioning node comprises processing circuitry configured to operate in accordance with the method described earlier in respect of the first storage provisioning node. The first storage provisioning node thus provides the advantages discussed earlier in respect of the method performed by the first storage provisioning node. In some embodiments, the first storage provisioning node comprises at least one memory for storing instructions which, when executed by the processing circuitry, cause the first storage provisioning node to operate in accordance with the method described earlier in respect of the first storage provisioning node.

According to another aspect of the disclosure, there is provided another method for provisioning storage in a system. This method is performed by a second storage provisioning node of the system. The method comprises, in response to a second request from a first storage provisioning node of the system for an unencrypted storage volume, initiating provisioning of the unencrypted storage volume to make the unencrypted storage volume available to the first storage provisioning node at a compute node of the system to the first storage provisioning node for the first storage provisioning node to use in the generation of an encrypted storage volume to be made available at the compute node for use by an application node.

There is thus provided an advantageous method for provisioning storage in a system. In particular, the method supports volume level encryption. This encryption on a volume level allows finer granularity for the creation of security domains, for example, compared with storage encryption performed on device level. It allows every volume to be encrypted with a different key. Moreover, the method allows security requirements on storage encryption to be satisfied without being dependent on encryption functionality provided by cloud systems. It is possible to provide encrypted storage volumes to application nodes even if a data center does not support such functionality. The method also avoids the need for software to be created (or modified) and implemented for every new storage provisioning node that is added to the system infrastructure and/or for every new application release, which provides easier development and integration. Moreover, licensing and support issues are mitigated since the method does not require encryption related software to be added to third party application nodes. The encrypted storage that is provided by way of the method can be used by any application node and can be deployed independently of any application node. It requires only a minimal additional software footprint irrespective of the number of applications that use it and no extra storage footprint. There is also no impact on application nodes if the second storage provisioning node is replaced with a different one. Moreover, different to encryption of data at rest on an infrastructure level, it allows the creation of different security domains on a per storage volume basis, e.g. by encrypting volumes with individual keys.

In some embodiments, initiating provisioning of the unencrypted storage volume to make the unencrypted storage volume available to the first storage provisioning node at the compute node to the first storage provisioning node may comprise initiating mounting of the unencrypted storage volume to the compute node to make the unencrypted storage volume available to the first storage provisioning node.

In some embodiments, initiating provisioning of the unencrypted storage volume to make the unencrypted storage volume available to the first storage provisioning node at the compute node to the first storage provisioning node may comprise initiating generating of a container on which to make the unencrypted storage volume available at the compute node. This can be particularly advantageous where it is not possible to mount storage volumes to already running containers.

In some embodiments, the compute node may be separate to the second storage provisioning node. In this way, performance dependencies between storage and application nodes running on the compute nodes can be avoided. In some embodiments, the compute node may comprise the second storage provisioning node. This allows easier scaling of the storage solution and reduces hardware cost by avoiding dedicated storage hardware and instead allows to make use of only one type of compute node (e.g. server) for the application nodes and storage.

In some embodiments, the method may comprise, in response to a third request from the first storage provisioning node to cease making the unencrypted storage volume available at the compute node, initiating the ceasing of making the unencrypted storage volume available at the compute node. In this way, unused resources can be freed up to thereby improve efficiency of resource usage on the compute node.

In some embodiments, initiating the ceasing of making the unencrypted storage volume available at the compute node may comprise initiating unmounting of the unencrypted storage volume from the compute node. This can be particularly advantageous where storage volumes can only be mounted to one compute node at a time. For example, unmounting storage volumes may then be a precondition for mounting them to a different compute node. It can also free up unused resources to thereby improve efficiency of resource usage.

According to another aspect of the disclosure, there is provided a second storage provisioning node. The second storage provisioning node comprises processing circuitry configured to operate in accordance with the method described earlier in respect of the second storage provisioning node. The second storage provisioning node thus provides the advantages discussed earlier in respect of the method performed by the second storage provisioning node. In some embodiments, the second storage provisioning node comprises at least one memory for storing instructions which, when executed by the processing circuitry, cause the second storage provisioning node to operate in accordance with the method described earlier in respect of the second storage provisioning node.

According to another aspect of the disclosure, there is provided another method for provisioning storage in a system. This method is performed by a compute node of the system. The method comprises provisioning an unencrypted storage volume requested by a first storage provisioning node to make the unencrypted storage volume available to the first storage provisioning node at the compute node to the first storage provisioning node for the first storage provisioning node to use in the generation of an encrypted storage volume. The method also comprises provisioning the encrypted storage volume generated by the first storage provisioning node to make the encrypted storage volume available at the compute node for use by an application node.

There is thus provided an advantageous method for provisioning storage in a system. In particular, the method supports volume level encryption. This encryption on a volume level allows finer granularity for the creation of security domains, for example, compared with storage encryption performed on device level. It allows every volume to be encrypted with a different key. Moreover, the method allows security requirements on storage encryption to be satisfied without being dependent on encryption functionality provided by cloud systems. It is possible to provide encrypted storage volumes to application nodes even if a data center does not support such functionality. The method also avoids the need for software to be created (or modified) and implemented for every new storage provisioning node that is added to the system infrastructure and/or for every new application release, which provides easier development and integration. Moreover, licensing and support issues are mitigated since the method does not require encryption related software to be added to third party application nodes. The encrypted storage that is provided by way of the method can be used by any application node and can be deployed independently of any application node. It requires only a minimal additional software footprint irrespective of the number of application nodes that use it and no extra storage footprint. There is also no impact on application nodes if the second storage provisioning node is replaced with a different one. Moreover, different to encryption of data at rest on an infrastructure level, it allows the creation of different security domains on a per storage volume basis, e.g. by encrypting volumes with individual keys.

In some embodiments, provisioning the unencrypted storage volume to make the unencrypted storage volume available at the compute node may comprise generating a container on which to make the unencrypted storage volume available at the compute node. This can be particularly advantageous where it is not possible to mount storage volumes to already running containers. In some embodiments, provisioning the unencrypted storage volume to make the unencrypted storage volume available at the compute node may comprise provisioning the encrypted storage volume to make the encrypted storage volume available at the compute node may comprise provisioning the encrypted storage volume on the first storage provisioning node to make the encrypted storage volume available at the compute node.

In some embodiments, provisioning the unencrypted storage volume to make the unencrypted storage volume available to the first storage provisioning node at the compute node to the first storage provisioning node may comprise mounting the unencrypted storage volume to the compute node to make the unencrypted storage volume available to the first storage provisioning node and/or provisioning the encrypted storage volume to make the encrypted storage volume available at the compute node for use by the application node may comprise mounting the encrypted storage volume to the compute node to make the encrypted storage volume available at the compute node for use by the application node.

In some embodiments, mounting the unencrypted storage volume to the compute node may comprise mounting the unencrypted storage volume to a directory tree of the compute node and/or mounting the encrypted storage volume to the compute node may comprise mounting the encrypted storage volume to the directory tree of the compute node. This can be particularly advantageous when the encrypted storage volume needs to be made available to multiple application nodes on the same compute host. In particular, having a separate mount point simplifies adding and removing of application node specific mount points.

In some embodiments, the method may comprise ceasing to make the encrypted storage volume available at a compute node and/or ceasing to make the unencrypted storage volume available at the compute node. In this way, unused resources can be freed up to thereby improve efficiency of resource usage on the compute node.

In some embodiments, ceasing to make the encrypted storage volume available at the compute node may comprise unmounting the encrypted storage volume from the compute node and/or ceasing to make the unencrypted storage volume available at the compute node may comprise unmounting the unencrypted storage volume from the compute node. This can be particularly advantageous when the application node that consumes the encrypted volume is terminated on the compute node, for example, due to decommissioning of the application node or an orchestrator deciding to run the application node on a different compute node.

In some embodiments, ceasing to make the encrypted storage volume available at the compute node and/or ceasing to make the unencrypted storage volume available at the compute node may be in response to a trigger.

In some embodiments, the compute node may be separate to a second storage provisioning node of the system. In this way, performance dependencies between storage and application nodes running on the compute nodes can be avoided. In some embodiments, the compute node may comprise a second storage provisioning node of the system. This allows easier scaling of the storage solution and reduces hardware cost by avoiding dedicated storage hardware and instead allows to make use of only one type of compute node (e.g. server) for the application nodes and storage.

According to another aspect of the disclosure, there is provided a compute node. The compute node comprises processing circuitry configured to operate in accordance with the method described earlier in respect of the compute node. The compute node thus provides the advantages discussed earlier in respect of the method performed by the compute node. In some embodiments, the compute node comprises at least one memory for storing instructions which, when executed by the processing circuitry, cause the compute node to operate in accordance with the method described earlier in respect of the compute node.

According to another aspect of the disclosure, there is provided a system. The system comprises one or more first storage provisioning nodes as described earlier, one or more second storage provisioning nodes as described earlier and/or one or more compute nodes as described earlier. The system thus provides the advantages discussed earlier in respect of the method performed by the first storage provisioning node, second storage provisioning node and/or compute node.

According to another aspect of the disclosure, there is provided a computer program comprising instructions which, when executed by processing circuitry, cause the processing circuitry to perform the method described earlier in respect of the first storage provisioning node, second storage provisioning node and/or compute node. The computer program thus provides the advantages discussed earlier in respect of the method performed by the first storage provisioning node, second storage provisioning node and/or compute node.

According to another aspect of the disclosure, there is provided a computer program product, embodied on a non-transitory machine-readable medium, comprising instructions which are executable by processing circuitry to cause the processing circuitry to perform the method described earlier in respect of the first storage provisioning node, second storage provisioning node and/or compute node. The computer program product thus provides the advantages discussed earlier in respect of the method performed by the first storage provisioning node, second storage provisioning node and/or compute node.

Therefore, an advantageous technique for provisioning storage in a system is provided.

For a better understanding of the technique, and to show how it may be put into effect, reference will now be made, by way of example, to the accompanying drawings, in which:.

As mentioned earlier, an advantageous technique for provisioning storage in a system is described herein. More specifically, the technique described herein provisions storage volumes in a network. Herein, a storage volume can be any unit of storage. The storage volumes referred to herein can be configured to store data, information, objects, etc. In some embodiments, a storage volume may be a file system. The technique described herein is implemented by a first storage provisioning node, a second storage provisioning node and a compute node.

The technique described herein may, for example, be applied to data centers, such as data centers that use container technology. These data centers that use container technology may also be referred to as cloud data centers. Generally, workloads may be distributed over multiple containers. The multiple containers can be scheduled to execute on a plurality of compute nodes (or hosts). An agent of a storage provisioner may be present on each compute node. The agent may communicate with an operating system of the compute node.

According to some embodiments, the system described herein for which storage is provisioned may comprise a plurality of compute nodes that are configured in the manner described herein. A plurality of compute nodes may also be referred to as a cluster. Herein, provisioning storage or storage provisioning can be defined as the process of assigning storage and making that storage available to an application node, e.g. for read and/or write operations.

<FIG> illustrates a first storage provisioning node <NUM> of a system in accordance with an embodiment. The first storage provisioning node <NUM> is for provisioning storage in the system. The first storage provisioning node <NUM> may, for example, be a physical machine (e.g. a server) or a virtual machine (VM). The first storage provisioning node <NUM> may be any generic storage provisioner.

As illustrated in <FIG>, the first storage provisioning node <NUM> comprises processing circuitry (or logic) <NUM>. The processing circuitry <NUM> controls the operation of the first storage provisioning node <NUM> and can implement the method described herein in respect of the first storage provisioning node <NUM>. The processing circuitry <NUM> can be configured or programmed to control the first storage provisioning node <NUM> in the manner described herein. The processing circuitry <NUM> can comprise one or more hardware components, such as one or more processors, one or more processing units, one or more multi-core processors, and/or one or more modules. In particular implementations, each of the one or more hardware components can be configured to perform, or is for performing, individual or multiple steps of the method described herein in respect of the first storage provisioning node <NUM>. In some embodiments, the processing circuitry <NUM> can be configured to run software to perform the method described herein in respect of the first storage provisioning node <NUM>. The software may be containerised according to some embodiments. Thus, in some embodiments, the processing circuitry <NUM> may be configured to run a container to perform the method described herein in respect of the first storage provisioning node <NUM>. This container may run in privileged mode.

Briefly, the processing circuitry <NUM> of the first storage provisioning node <NUM> is configured to, in response to a first request for an encrypted storage volume for an application node, initiate transmission of a second request towards a second storage provisioning node for an unencrypted storage volume. The processing circuitry <NUM> of the first storage provisioning node <NUM> is also configured to, in response to the requested unencrypted storage volume becoming available to the first storage provisioning node, generate an encrypted storage volume from the unencrypted storage volume and initiate provisioning of the encrypted storage volume to make the encrypted storage volume available at a compute node of the system for use by the application node. The first storage provisioning node <NUM> described herein acts as a shim.

As illustrated in <FIG>, in some embodiments, the first storage provisioning node <NUM> may optionally comprise a memory <NUM>. The memory <NUM> of the first storage provisioning node <NUM> can comprise a volatile memory or a non-volatile memory. In some embodiments, the memory <NUM> of the first storage provisioning node <NUM> may comprise a non-transitory media. Examples of the memory <NUM> of the first storage provisioning node <NUM> include, but are not limited to, a random access memory (RAM), a read only memory (ROM), a mass storage media such as a hard disk, a removable storage media such as a compact disk (CD) or a digital video disk (DVD), and/or any other memory.

The processing circuitry <NUM> of the first storage provisioning node <NUM> can be connected to the memory <NUM> of the first storage provisioning node <NUM>. In some embodiments, the memory <NUM> of the first storage provisioning node <NUM> may be for storing program code or instructions which, when executed by the processing circuitry <NUM> of the first storage provisioning node <NUM>, cause the first storage provisioning node <NUM> to operate in the manner described herein in respect of the first storage provisioning node <NUM>. For example, in some embodiments, the memory <NUM> of the first storage provisioning node <NUM> may be configured to store program code or instructions that can be executed by the processing circuitry <NUM> of the first storage provisioning node <NUM> to cause the first storage provisioning node <NUM> to operate in accordance with the method described herein in respect of the first storage provisioning node <NUM>. Alternatively or in addition, the memory <NUM> of the first storage provisioning node <NUM> can be configured to store any information, data, messages, requests, responses, indications, notifications, signals, or similar, that are described herein. The processing circuitry <NUM> of the first storage provisioning node <NUM> may be configured to control the memory <NUM> of the first storage provisioning node <NUM> to store information, data, messages, requests, responses, indications, notifications, signals, or similar, that are described herein.

In some embodiments, as illustrated in <FIG>, the first storage provisioning node <NUM> may optionally comprise a communications interface <NUM>. The communications interface <NUM> of the first storage provisioning node <NUM> can be connected to the processing circuitry <NUM> of the first storage provisioning node <NUM> and/or the memory <NUM> of first storage provisioning node <NUM>. The communications interface <NUM> of the first storage provisioning node <NUM> may be operable to allow the processing circuitry <NUM> of the first storage provisioning node <NUM> to communicate with the memory <NUM> of the first storage provisioning node <NUM> and/or vice versa. Similarly, the communications interface <NUM> of the first storage provisioning node <NUM> may be operable to allow the processing circuitry <NUM> of the first storage provisioning node <NUM> to communicate with the second storage provisioning node, compute node and/or any other node. The communications interface <NUM> of the first storage provisioning node <NUM> can be configured to transmit and/or receive information, data, messages, requests, responses, indications, notifications, signals, or similar, that are described herein. In some embodiments, the processing circuitry <NUM> of the first storage provisioning node <NUM> may be configured to control the communications interface <NUM> of the first storage provisioning node <NUM> to transmit and/or receive information, data, messages, requests, responses, indications, notifications, signals, or similar, that are described herein.

Although the first storage provisioning node <NUM> is illustrated in <FIG> as comprising a single memory <NUM>, it will be appreciated that the first storage provisioning node <NUM> may comprise at least one memory (i.e. a single memory or a plurality of memories) <NUM> that operate in the manner described herein. Similarly, although the first storage provisioning node <NUM> is illustrated in <FIG> as comprising a single communications interface <NUM>, it will be appreciated that the first storage provisioning node <NUM> may comprise at least one communications interface (i.e. a single communications interface or a plurality of communications interface) <NUM> that operate in the manner described herein.

It will also be appreciated that <FIG> only shows the components required to illustrate an embodiment of the first storage provisioning node <NUM> and, in practical implementations, the first storage provisioning node <NUM> may comprise additional or alternative components to those shown.

In some embodiments, the hardware (e.g. processing circuitry <NUM>, memory <NUM>, and/or communications interface <NUM>) that can implement the method described herein in respect of the first storage provisioning node <NUM> may be the same hardware as that which implements the method performed by an application node. For example, the same hardware (e.g. processing circuitry, memory, and/or communications interface) of the application node that is configured to run at least part of one or more applications may also be configured to implement the method described herein in respect of the first storage provisioning node <NUM>. In some embodiments, the hardware that can implement the method described herein in respect of the first storage provisioning node <NUM> and/or the hardware that can implement the method described herein in respect of the application node may be the same hardware as that which implements the method performed by a compute node (e.g. of a cluster of compute nodes), such as the compute node described herein. The application node referred to herein may be configured to run at least part of one or more applications.

<FIG> is a flowchart illustrating a method performed by a first storage provisioning node <NUM> in accordance with an embodiment. The method is for provisioning storage in a system. The first storage provisioning node <NUM> described earlier with reference to <FIG> is configured to operate in accordance with the method of <FIG>. The method can be performed by or under the control of the processing circuitry <NUM> of the first storage provisioning node <NUM>.

As illustrated in <FIG>, at block <NUM>, in response to (e.g. the first storage provisioning node <NUM> receiving) a first request for an encrypted storage volume for an application node, transmission of a second request towards is initiated towards a second storage provisioning node for an unencrypted storage volume. More specifically, the processing circuitry <NUM> of the first storage provisioning node <NUM> initiates transmission of the second request (e.g. via a communications interface <NUM> of the first storage provisioning node <NUM>). Thus, the first storage provisioning node <NUM> translates a first request for an encrypted storage volume into a second request for an unencrypted storage volume. Herein, the term "initiate" can mean, for example, cause or establish. Thus, the processing circuitry <NUM> of the first storage provisioning node <NUM> can be configured to itself transmit the second request or can be configured to cause another node to transmit the second request. In some embodiments, the transmission of the second request towards the second storage provisioning node may be via an orchestrator of the system.

In some embodiments, the first request referred to herein may be from the orchestrator of the system. In some embodiments, the first request referred to herein may originate from an application management node of the system. For example, in some embodiments, the first request referred to herein may be from an application management node of the system via an orchestrator of the system. In some embodiments, the first request referred to herein may be issued at deployment of the application node. For example, the first request referred to herein may be issued by the application management node of the system when it deploys the application node. The processing circuitry <NUM> of the first storage provisioning node <NUM> may be configured to receive the first request, e.g. via a communications interface <NUM> of the first storage provisioning node <NUM>.

Returning back to <FIG>, at block <NUM>, in response to the requested unencrypted storage volume becoming available to the first storage provisioning node <NUM>, an encrypted storage volume is generated from the unencrypted storage volume. Thus, the first storage provisioning node <NUM> can consume the unencrypted storage volume obtained by the second storage provisioning node and create an encrypted storage volume from it.

In some embodiments, the encrypted storage volume may be generated by applying an encrypted layer to the unencrypted storage volume. More specifically, in some embodiments, the processing circuitry <NUM> of the first storage provisioning node <NUM> can be configured to apply the encrypted layer to the unencrypted storage volume. In some embodiments, the application of the encrypted layer may be chosen when the unencrypted storage volume is provided with an unencrypted file system. In some embodiments, the encrypted layer may be an encrypted file system layer. For example, an encrypted file system may be deployed as a layer on top of the unencrypted storage volume. In some embodiments, an encrypted file system layer may be chosen when the unencrypted storage volume is an unencrypted raw block storage (i.e. when only an unencrypted storage device is provided, without a file system). This can provide performance benefits. The unencrypted storage volume may itself be an unencrypted file system. In some embodiments, the encrypted layer may be provided by the first storage provisioning node <NUM>. In other embodiments, another node may provide the encrypted layer. In some embodiments where a container on which to make the unencrypted storage volume available at the compute node is generated, the generated container may provide the encrypted layer.

In an example approach for generating the encrypted storage volume, the processing circuitry <NUM> of the first storage provisioning node <NUM> may generate a file and use a device mapper functionality (e.g. where a file from the unencrypted storage volume is exposed as an encrypted storage device, which is formatted with another file system) to create an encrypted storage device as the encrypted storage volume referred to herein. In some embodiments, the processing circuitry <NUM> of the first storage provisioning node <NUM> may first format the device with a filesystem and then use this filesystem as the encrypted storage volume referred to herein. In another example approach for generating the encrypted storage volume, the processing circuitry <NUM> of the first storage provisioning node <NUM> may format a (raw) block storage device with a filesystem that supports encryption and use this filesystem as the encrypted storage volume referred to herein.

Returning back to <FIG>, at block <NUM>, provisioning of the encrypted storage volume is initiated to make the encrypted storage volume available at a compute node of the system for use by the application node or, more specifically, a storage consumer (e.g. a user, an application, or any other storage consumer) of the application node. More specifically, in some embodiments, the processing circuitry <NUM> of the first storage provisioning node <NUM> initiates the provisioning of the encrypted storage volume. For example, the processing circuitry <NUM> of the first storage provisioning node <NUM> may be configured to instruct (e.g. an operating system of) the compute node to make the encrypted storage volume available for use by the application node. In some embodiments, the processing circuitry <NUM> of the first storage provisioning node <NUM> may be configured to initiate transmission of (e.g. itself transmit or cause another node to transmit) the instruction towards (e.g. an operating system of) the compute node. The instruction may be for the compute node to publish the encrypted storage volume for use by the application node.

In some embodiments, initiating provisioning of the encrypted storage volume at block <NUM> of <FIG> to make the encrypted storage volume available at a compute node of the system for use by the application node may comprise initiating mounting of the encrypted storage volume to the compute node to make the encrypted storage volume available at the compute node for use by the application node. In some of these embodiments, initiating mounting of the encrypted storage volume to the compute node may comprise initiating mounting of the encrypted storage volume to a directory tree of the compute node. A person skilled in the art will appreciate that mounting of the encrypted storage volume to the compute node is only one example of the manner in which the encrypted storage volume can be made available at the compute node for use by the application node and that other examples are also possible. For example, in some embodiments, the encrypted storage volume can be made available at the compute node for use by the application node through other interfaces, such as a hypertext transfer protocol (HTTP) interface. This can be particularly useful for object storage.

In some embodiments, initiating provisioning of the encrypted storage volume at block <NUM> of <FIG> to make the encrypted storage volume available at the compute node for use by the application node may comprise initiating provisioning of the encrypted storage volume on the first storage provisioning node to make the encrypted storage volume available at the compute node. In some embodiments, initiating provisioning of the encrypted storage volume at block <NUM> of <FIG> to make the encrypted storage volume available at the compute node for use by the application node may comprise allocating a path within a directory tree of a host file system that is accessible to the application node.

Although not illustrated in <FIG>, in some embodiments, the method may comprise initiating transmission of a third request towards the second storage provisioning node to cease making the unencrypted storage volume available at the compute node. More specifically, the processing circuitry <NUM> of the first storage provisioning node <NUM> may initiate transmission of the second request (e.g. via a communications interface <NUM> of the first storage provisioning node <NUM>). As mentioned earlier, herein, the term "initiate" can mean, for example, cause or establish. Thus, the processing circuitry <NUM> of the first storage provisioning node <NUM> can be configured to itself transmit the third request or can be configured to cause another node to transmit the third request.

Although also not illustrated in <FIG>, in some embodiments, the method may comprise, in response to (e.g. the first storage provisioning node <NUM> receiving) a fourth request to cease making the encrypted storage volume available at the compute node, initiating the ceasing of making the encrypted storage volume available at the compute node. More specifically, in some embodiments, the processing circuitry <NUM> of the first storage provisioning node <NUM> may initiate the ceasing of making the encrypted storage volume available at the compute node. For example, the processing circuitry <NUM> of the first storage provisioning node <NUM> may be configured to instruct (e.g. an operating system of) the compute node to cease make the encrypted storage volume available for use by the application node or, more specifically, the storage consumer (e.g. a user, an application, or any other storage consumer) of the application node. In some embodiments, the processing circuitry <NUM> of the first storage provisioning node <NUM> may be configured to initiate transmission of (e.g. itself transmit or cause another node to transmit) the instruction towards (e.g. an operating system of) the compute node.

Although also not illustrated in <FIG>, in some embodiments, the method may comprise removing a configuration related to the encrypted storage volume from the compute node <NUM> in response to termination of the application node that uses (e.g. consumes) the encrypted storage volume. More specifically, in some embodiments, the processing circuitry <NUM> of the first storage provisioning node <NUM> can be configured to remove this configuration. In some containerised embodiments, a sidecar container may be added to remove any configuration related to the encrypted storage volume from the compute node <NUM>. The sidecar container may run in privileged mode. In this way, the first storage provisioning node <NUM> can clean up, e.g. by making sure that there is no configuration residue or orphaned objects left behind.

<FIG> illustrates a second storage provisioning node <NUM> of a system in accordance with an embodiment. The second storage provisioning node <NUM> is for provisioning storage in the system. The second storage provisioning node <NUM> may, for example, be a physical machine (e.g. a server) or a virtual machine (VM). The second storage provisioning node <NUM> can be a storage provisioning node of a data center according to some embodiments. The second storage provisioning node <NUM> can be responsible for allocating storage in the system.

As illustrated in <FIG>, the second storage provisioning node <NUM> comprises processing circuitry (or logic) <NUM>. The processing circuitry <NUM> controls the operation of the second storage provisioning node <NUM> and can implement the method described herein in respect of the second storage provisioning node <NUM>. The processing circuitry <NUM> can be configured or programmed to control the second storage provisioning node <NUM> in the manner described herein. The processing circuitry <NUM> can comprise one or more hardware components, such as one or more processors, one or more processing units, one or more multi-core processors, and/or one or more modules. In particular implementations, each of the one or more hardware components can be configured to perform, or is for performing, individual or multiple steps of the method described herein in respect of the second storage provisioning node <NUM>. In some embodiments, the processing circuitry <NUM> can be configured to run software to perform the method described herein in respect of the second storage provisioning node <NUM>. The software may be containerised according to some embodiments. Thus, in some embodiments, the processing circuitry <NUM> may be configured to run a container to perform the method described herein in respect of the second storage provisioning node <NUM>.

Briefly, the processing circuitry <NUM> of the second storage provisioning node <NUM> is configured to, in response to a second request from a first storage provisioning node <NUM> of the system for an unencrypted storage volume, initiate provisioning of the unencrypted storage volume to make the unencrypted storage volume available at a compute node of the system to the first storage provisioning node <NUM> for the first storage provisioning node to use in the generation of an encrypted storage volume to be made available at the compute node for use by an application node.

As illustrated in <FIG>, in some embodiments, the second storage provisioning node <NUM> may optionally comprise a memory <NUM>. The memory <NUM> of the second storage provisioning node <NUM> can comprise a volatile memory or a non-volatile memory. In some embodiments, the memory <NUM> of the second storage provisioning node <NUM> may comprise a non-transitory media. Examples of the memory <NUM> of the second storage provisioning node <NUM> include, but are not limited to, a random access memory (RAM), a read only memory (ROM), a mass storage media such as a hard disk, a removable storage media such as a compact disk (CD) or a digital video disk (DVD), and/or any other memory. In some embodiments, the memory <NUM> of the second storage provisioning node <NUM> may comprise one or more storage devices, e.g. a pool of storage devices.

The processing circuitry <NUM> of the second storage provisioning node <NUM> can be connected to the memory <NUM> of the second storage provisioning node <NUM>. In some embodiments, the memory <NUM> of the second storage provisioning node <NUM> may be for storing program code or instructions which, when executed by the processing circuitry <NUM> of the second storage provisioning node <NUM>, cause the second storage provisioning node <NUM> to operate in the manner described herein in respect of the second storage provisioning node <NUM>. For example, in some embodiments, the memory <NUM> of the second storage provisioning node <NUM> may be configured to store program code or instructions that can be executed by the processing circuitry <NUM> of the second storage provisioning node <NUM> to cause the second storage provisioning node <NUM> to operate in accordance with the method described herein in respect of the second storage provisioning node <NUM>. Alternatively or in addition, the memory <NUM> of the second storage provisioning node <NUM> can be configured to store any information, data, messages, requests, responses, indications, notifications, signals, or similar, that are described herein. The processing circuitry <NUM> of the second storage provisioning node <NUM> may be configured to control the memory <NUM> of the second storage provisioning node <NUM> to store information, data, messages, requests, responses, indications, notifications, signals, or similar, that are described herein.

In some embodiments, as illustrated in <FIG>, the second storage provisioning node <NUM> may optionally comprise a communications interface <NUM>. The communications interface <NUM> of the second storage provisioning node <NUM> can be connected to the processing circuitry <NUM> of the second storage provisioning node <NUM> and/or the memory <NUM> of second storage provisioning node <NUM>. The communications interface <NUM> of the second storage provisioning node <NUM> may be operable to allow the processing circuitry <NUM> of the second storage provisioning node <NUM> to communicate with the memory <NUM> of the second storage provisioning node <NUM> and/or vice versa. Similarly, the communications interface <NUM> of the second storage provisioning node <NUM> may be operable to allow the processing circuitry <NUM> of the second storage provisioning node <NUM> to communicate with the first storage provisioning node, compute node and/or any other node. The communications interface <NUM> of the second storage provisioning node <NUM> can be configured to transmit and/or receive information, data, messages, requests, responses, indications, notifications, signals, or similar, that are described herein. In some embodiments, the processing circuitry <NUM> of the second storage provisioning node <NUM> may be configured to control the communications interface <NUM> of the second storage provisioning node <NUM> to transmit and/or receive information, data, messages, requests, responses, indications, notifications, signals, or similar, that are described herein.

Although the second storage provisioning node <NUM> is illustrated in <FIG> as comprising a single memory <NUM>, it will be appreciated that the second storage provisioning node <NUM> may comprise at least one memory (i.e. a single memory or a plurality of memories) <NUM> that operate in the manner described herein. Similarly, although the second storage provisioning node <NUM> is illustrated in <FIG> as comprising a single communications interface <NUM>, it will be appreciated that the second storage provisioning node <NUM> may comprise at least one communications interface (i.e. a single communications interface or a plurality of communications interface) <NUM> that operate in the manner described herein.

It will also be appreciated that <FIG> only shows the components required to illustrate an embodiment of the second storage provisioning node <NUM> and, in practical implementations, the second storage provisioning node <NUM> may comprise additional or alternative components to those shown.

In some embodiments, the hardware (e.g. processing circuitry <NUM>, memory <NUM>, and/or communications interface <NUM>) that can implement the method described herein in respect of the second storage provisioning node <NUM> may be the same hardware as that which implements the method performed by a compute node (e.g. of a cluster of compute nodes), such as the compute node described herein. For example, in some embodiments, the second storage provisioning node <NUM> may be software that the hardware (e.g. processing circuitry) of the compute node can run to implement the method described herein in respect of the second storage provisioning node <NUM>. In other embodiments, the hardware (e.g. processing circuitry <NUM>, memory <NUM>, and/or communications interface <NUM>) that can implement the method described herein in respect of the second storage provisioning node <NUM> may be the hardware of a storage backend node that comprises the second storage provisioning node <NUM>. For example, in some embodiments, the second storage provisioning node <NUM> may be software that the hardware (e.g. processing circuitry) of the storage backend node can run to implement the method described herein in respect of the second storage provisioning node <NUM>.

<FIG> is a flowchart illustrating a method performed by a second storage provisioning node <NUM> in accordance with an embodiment. The method is for provisioning storage in a system. The second storage provisioning node <NUM> described earlier with reference to <FIG> is configured to operate in accordance with the method of <FIG>. The method can be performed by or under the control of the processing circuitry <NUM> of the second storage provisioning node <NUM>.

As illustrated in <FIG>, at block <NUM>, in response to (e.g. the second storage provisioning node <NUM> receiving) a second request from a first storage provisioning node <NUM> of the system for an unencrypted storage volume, provisioning of the unencrypted storage volume is initiated to make the unencrypted storage volume available at a compute node of the system to the first storage provisioning node <NUM>. The unencrypted storage volume is made available to the first storage provisioning node <NUM> for the first storage provisioning node <NUM> to use in the generation of an encrypted storage volume. This encrypted storage volume is to be made available at the compute node for use by an application node or, more specifically, a storage consumer (e.g. a user, an application, or any other storage consumer) of the application node.

More specifically, the processing circuitry <NUM> of the second storage provisioning node <NUM> initiates the provisioning of the unencrypted storage volume. For example, the processing circuitry <NUM> of the second storage provisioning node <NUM> may be configured to instruct (e.g. an operating system of) the compute node to make the unencrypted storage volume available to the first storage provisioning node <NUM>. In some embodiments, the processing circuitry <NUM> of the second storage provisioning node <NUM> may be configured to initiate transmission of (e.g. itself transmit or cause another node to transmit) the instruction towards (e.g. an operating system of) the compute node. The instruction may be for the compute node to publish the unencrypted storage volume system to the first storage provisioning node <NUM>.

In some embodiments, initiating provisioning of the unencrypted storage volume at block <NUM> of <FIG> to make the unencrypted storage volume available at the compute node to the first storage provisioning node <NUM> may comprise initiating mounting of the unencrypted storage volume to the compute node to make the unencrypted storage volume available to the first storage provisioning node <NUM>. In some embodiments, initiating provisioning of the unencrypted storage volume at block <NUM> of <FIG> to make the unencrypted storage volume available at the compute node to the first storage provisioning node <NUM> may comprise initiating generating of a container on which to make the unencrypted storage volume available at the compute node.

A person skilled in the art will appreciate that mounting of the unencrypted storage volume to the compute node and generating of a container are only some examples of the manner in which the unencrypted storage volume can be made available at the compute node to the first storage provisioning node <NUM> and that other examples are also possible. For example, in some embodiments, the unencrypted storage volume can be made available at the compute node to the first storage provisioning node <NUM> through other interfaces, such as a hypertext transfer protocol (HTTP) interface. This can be particularly useful for object storage.

Although not illustrated in <FIG>, in some embodiments, the method may comprise, in response to (e.g. the second storage provisioning node <NUM> receiving) a third request from the first storage provisioning node to cease making the unencrypted storage volume available at the compute node, initiate the ceasing of making the unencrypted storage volume available at the compute node. More specifically, in some embodiments, the processing circuitry <NUM> of the second storage provisioning node <NUM> can be configured to initiate the ceasing of making the unencrypted storage volume available at the compute node. For example, the processing circuitry <NUM> of the second storage provisioning node <NUM> may be configured to instruct (e.g. an operating system of) the compute node to cease making the encrypted storage volume available. In some embodiments, the processing circuitry <NUM> of the second storage provisioning node <NUM> may be configured to initiate transmission of (e.g. itself transmit or cause another node to transmit) the instruction towards (e.g. an operating system of) the compute node. In some of these embodiments, initiating the ceasing of making the unencrypted storage volume available at the compute node may comprise initiating unmounting of the unencrypted storage volume from the compute node.

In some embodiments, the compute node may be separate to the second storage provisioning node <NUM>. For example, the second storage provisioning node <NUM> (or, in some embodiments, the storage backend <NUM> that comprises the second storage provisioning node <NUM>) may be an entity that is separate to the compute node described herein, with its own dedicated software and/or hardware. In other embodiments, the compute node may comprise the second storage provisioning node <NUM>. For example,.

in some embodiments, the method described herein in respect of the second storage provisioning node <NUM> may be running as (e.g. containerised) software on the compute node described herein. In some embodiments, the compute node described herein may at the same time be running (e.g. containerised) application software. This may be referred to as "hyperconverged software defined storage". Alternatively, in some embodiments, the compute node described herein may be exclusively used for storage. This may be referred to as "software defined storage". In some embodiments involving a cluster, the method described herein in respect of the second storage provisioning node <NUM> may be running as (e.g. containerised) software on one or more (or each) of the plurality of compute nodes.

Although not illustrated in <FIG>, in some embodiments, the method may comprise initiating unprovisioning of the unencrypted storage volume to cease making the unencrypted storage volume available at the compute node. More specifically, the processing circuitry <NUM> of the second storage provisioning node <NUM> may be configured to initiate the unprovisioning of the unencrypted storage volume. For example, the processing circuitry <NUM> of the second storage provisioning node <NUM> may be configured to instruct (e.g. an operating system of) the compute node to cease making the unencrypted storage volume available. In some embodiments, the processing circuitry <NUM> of the second storage provisioning node <NUM> may be configured to initiate transmission of (e.g. itself transmit or cause another node to transmit) the instruction towards (e.g. an operating system of) the compute node.

<FIG> illustrates a compute node <NUM> of a system in accordance with an embodiment. The compute node <NUM> is for provisioning storage in the system. The compute node <NUM> may also be referred to herein as a compute host. The compute node <NUM> may, for example, be a physical machine (e.g. a server) or a virtual machine (VM). In some embodiments, the compute node <NUM> can be configured to run (e.g. the software for) the application node referred to herein.

As illustrated in <FIG>, the compute node <NUM> comprises processing circuitry (or logic) <NUM>. The processing circuitry <NUM> controls the operation of the compute node <NUM> and can implement the method described herein in respect of the compute node <NUM>. The processing circuitry <NUM> can be configured or programmed to control the compute node <NUM> in the manner described herein. The processing circuitry <NUM> can comprise one or more hardware components, such as one or more processors, one or more processing units, one or more multi-core processors, and/or one or more modules. In particular implementations, each of the one or more hardware components can be configured to perform, or is for performing, individual or multiple steps of the method described herein in respect of the compute node <NUM>. In some embodiments, the processing circuitry <NUM> can be configured to run software to perform the method described herein in respect of the compute node <NUM>. The software may be containerised according to some embodiments. Thus, in some embodiments, the processing circuitry <NUM> may be configured to run a container to perform the method described herein in respect of the compute node <NUM>.

Briefly, the processing circuitry <NUM> of the compute node <NUM> is configured to provision an unencrypted storage volume requested by a first storage provisioning node to make the unencrypted storage volume available at the compute node to the first storage provisioning node <NUM> for the first storage provisioning node <NUM> to use in the generation of an encrypted storage volume. The processing circuitry <NUM> of the compute node <NUM> is also configured to provision the encrypted storage volume generated by the first storage provisioning node to make the encrypted storage volume available at the compute node for use by an application node.

As illustrated in <FIG>, in some embodiments, the compute node <NUM> may optionally comprise a memory <NUM>. The memory <NUM> of the compute node <NUM> can comprise a volatile memory or a non-volatile memory. In some embodiments, the memory <NUM> of the compute node <NUM> may comprise a non-transitory media. Examples of the memory <NUM> of the compute node <NUM> include, but are not limited to, a random access memory (RAM), a read only memory (ROM), a mass storage media such as a hard disk, a removable storage media such as a compact disk (CD) or a digital video disk (DVD), and/or any other memory.

The processing circuitry <NUM> of the compute node <NUM> can be connected to the memory <NUM> of the compute node <NUM>. In some embodiments, the memory <NUM> of the compute node <NUM> may be for storing program code or instructions which, when executed by the processing circuitry <NUM> of the compute node <NUM>, cause the compute node <NUM> to operate in the manner described herein in respect of the compute node <NUM>. For example, in some embodiments, the memory <NUM> of the compute node <NUM> may be configured to store program code or instructions that can be executed by the processing circuitry <NUM> of the compute node <NUM> to cause the compute node <NUM> to operate in accordance with the method described herein in respect of the compute node <NUM>. Alternatively or in addition, the memory <NUM> of the compute node <NUM> can be configured to store any information, data, messages, requests, responses, indications, notifications, signals, or similar, that are described herein. The processing circuitry <NUM> of the compute node <NUM> may be configured to control the memory <NUM> of the compute node <NUM> to store information, data, messages, requests, responses, indications, notifications, signals, or similar, that are described herein.

In some embodiments, as illustrated in <FIG>, the compute node <NUM> may optionally comprise a communications interface <NUM>, e.g. a network interface and/or a storage interface. The communications interface <NUM> of the compute node <NUM> can be connected to the processing circuitry <NUM> of the compute node <NUM> and/or the memory <NUM> of compute node <NUM>. The communications interface <NUM> of the compute node <NUM> may be operable to allow the processing circuitry <NUM> of the compute node <NUM> to communicate with the memory <NUM> of the compute node <NUM> and/or vice versa. Similarly, the communications interface <NUM> of the compute node <NUM> may be operable to allow the processing circuitry <NUM> of the compute node <NUM> to communicate with the first storage provisioning node, second storage provisioning node and/or any other node. The communications interface <NUM> of the compute node <NUM> can be configured to transmit and/or receive information, data, messages, requests, responses, indications, notifications, signals, or similar, that are described herein. In some embodiments, the processing circuitry <NUM> of the compute node <NUM> may be configured to control the communications interface <NUM> of the compute node <NUM> to transmit and/or receive information, data, messages, requests, responses, indications, notifications, signals, or similar, that are described herein.

Although the compute node <NUM> is illustrated in <FIG> as comprising a single memory <NUM>, it will be appreciated that the compute node <NUM> may comprise at least one memory (i.e. a single memory or a plurality of memories) <NUM> that operate in the manner described herein. Similarly, although the compute node <NUM> is illustrated in <FIG> as comprising a single communications interface <NUM>, it will be appreciated that the compute node <NUM> may comprise at least one communications interface (i.e. a single communications interface or a plurality of communications interface) <NUM> that operate in the manner described herein.

It will also be appreciated that <FIG> only shows the components required to illustrate an embodiment of the compute node <NUM> and, in practical implementations, the compute node <NUM> may comprise additional or alternative components to those shown.

As mentioned earlier, in some embodiments, the hardware (e.g. processing circuitry <NUM>, memory <NUM>, and/or communications interface <NUM>) that can implement the method described herein in respect of the compute node <NUM> may also be used to implement the method described herein in respect of the first storage provisioning node <NUM> and/or the method described herein in respect of the application node. As also mentioned earlier, in some embodiments, the hardware (e.g. processing circuitry <NUM>, memory <NUM>, and/or communications interface <NUM>) that can implement the method described herein in respect of the compute node <NUM> may also be used to implement the method performed by the second storage provisioning node <NUM>.

<FIG> is a flowchart illustrating a method performed by a compute node <NUM> in accordance with an embodiment. The method is for provisioning storage in a system. The compute node <NUM> described earlier with reference to <FIG> is configured to operate in accordance with the method of <FIG>. The method can be performed by or under the control of the processing circuitry <NUM> of the compute node <NUM>.

As illustrated in <FIG>, at block <NUM>, an unencrypted storage volume requested by a first storage provisioning node <NUM> is provisioned to make the unencrypted storage volume available at the compute node <NUM> to the first storage provisioning node <NUM> for the first storage provisioning node <NUM> to use in the generation of an encrypted storage volume. More specifically, the processing circuitry <NUM> of the compute node <NUM> provisions the requested unencrypted storage volume.

In some embodiments, provisioning the unencrypted storage volume at block <NUM> of <FIG> to make the unencrypted storage volume available at the compute node <NUM> may comprise generating a container on which to make the unencrypted storage volume available at the compute node <NUM>. In some embodiments, provisioning the unencrypted storage volume at block <NUM> of <FIG> to make the unencrypted storage volume available at the compute node <NUM> to the first storage provisioning node <NUM> may comprise mounting the unencrypted storage volume to the compute node <NUM> to make the unencrypted storage volume available to the first storage provisioning node <NUM>. In some embodiments, mounting the unencrypted storage volume to the compute node may comprise mounting the unencrypted storage volume to a directory tree of the compute node. In some embodiments where a container is generated, mounting the unencrypted storage volume to the compute node may comprise mounting the unencrypted storage volume to the generated container. Thus, in some embodiments, a newly generated (e.g. an additional) container may serve as a mount target for the unencrypted storage volume.

As mentioned earlier, a person skilled in the art will appreciate that generating a container and mounting of the unencrypted storage volume to the compute node are only some examples of the manner in which the unencrypted storage volume can be made available at the compute node to the first storage provisioning node <NUM> and that other examples are also possible. For example, in some embodiments, the unencrypted storage volume can be made available at the compute node to the first storage provisioning node <NUM> through other interfaces, such as a hypertext transfer protocol (HTTP) interface. This can be particularly useful for object storage.

Returning back to <FIG>, at block <NUM>, the encrypted storage volume generated by the first storage provisioning node <NUM> is provisioned to make the encrypted storage volume available at the compute node for use by an application node or, more specifically, a storage consumer (e.g. a user, an application, or any other storage consumer) of the application node. More specifically, the processing circuitry <NUM> of the compute node <NUM> provisions the encrypted storage volume.

In some embodiments, provisioning the encrypted storage volume at block <NUM> of <FIG> to make the encrypted storage volume available at the compute node <NUM> may comprise provisioning the encrypted storage volume on the first storage provisioning node <NUM> to make the encrypted storage volume available at the compute node <NUM>. In some embodiments, provisioning the encrypted storage volume at block <NUM> of <FIG> to make the encrypted storage volume available at the compute node <NUM> for use by the application node may comprise mounting the encrypted storage volume to the compute node <NUM> to make the encrypted storage volume available at the compute node <NUM> for use by the application node. In some embodiments, mounting the encrypted storage volume to the compute node <NUM> may comprise mounting the encrypted storage volume to the directory tree of the compute node.

A person skilled in the art will appreciate that mounting of the encrypted storage volume to the compute node is only one example of the manner in which the encrypted storage volume can be made available at the compute node for use by the application node and that other examples are also possible. For example, in some embodiments, the encrypted storage volume can be made available at the compute node for use by the application node through other interfaces, such as a hypertext transfer protocol (HTTP) interface. This can be particularly useful for object storage.

In some embodiments, provisioning the encrypted storage volume at block <NUM> of <FIG> to make the encrypted storage volume available at the compute node <NUM> may comprise allocating a path within a directory tree of a host file system that is accessible to the application node.

Although not illustrated in <FIG>, in some embodiments, the method may comprise ceasing to make the encrypted storage volume available at the compute node <NUM> and/or ceasing to make the unencrypted storage volume available at the compute node <NUM>. In some embodiments, ceasing to make the encrypted storage volume available at the compute node <NUM> may comprise unmounting the encrypted storage volume from the compute node <NUM>. In some embodiments, ceasing to make the unencrypted storage volume available at the compute node <NUM> may comprise unmounting the unencrypted storage volume from the compute node <NUM>. More specifically, in some embodiments, the processing circuitry <NUM> of the compute node <NUM> can be configured to unmount the encrypted storage volume and/or the unencrypted storage volume from the compute node <NUM>. In some embodiments, ceasing to make the encrypted storage volume available at the compute node <NUM> and/or ceasing to make the unencrypted storage volume available at the compute node <NUM> may be in response to a trigger. In some embodiments, the trigger may be from an orchestrator (e.g. a Kubernetes or any other orchestrator) of the system.

In some embodiments involving unmounting the encrypted storage volume from the compute node <NUM>, the unmounted encrypted storage volume may be remounted to another compute node. This other compute node may be configured in the same way as the compute node <NUM> described herein. The other compute node and the compute node <NUM> described herein may be part of the same cluster. The remounting of the encrypted storage volume may apply when a container is evicted from the compute node <NUM> described herein and re-scheduled to the other compute node. In these embodiments, the encrypted storage volume (including all data stored on it) can be kept. The encrypted storage volume may be (implicitly or explicitly) removed from the compute node <NUM> and recreated on the other compute node by the first storage provisioning node <NUM>.

In some embodiments, as described earlier, the compute node <NUM> may be separate to the second storage provisioning node <NUM> of the system described herein. In some embodiments, as described earlier, the compute node <NUM> may comprise the second storage provisioning node <NUM> of the system described herein.

There is also provided a system comprising one or more first storage provisioning nodes <NUM> as described herein, one or more second storage provisioning nodes <NUM> as described herein, and/or one or more compute nodes <NUM> as described herein. In the system, the first storage provisioning node <NUM> described herein can be placed (e.g. positioned or located) between the second storage provisioning node <NUM> described herein and the application node referred to herein. As mentioned earlier, the first storage provisioning node <NUM> described herein acts as a shim.

<FIG> and <FIG> each illustrate such a system in accordance with an embodiment.

The system illustrated in <FIG> is as described earlier with reference to <FIG> with the exception that the system illustrated in <FIG> also comprises a first storage provisioning node <NUM> configured in the manner described earlier with reference to <FIG> and <FIG> in addition to the second storage provisioning node <NUM>. Also, in the embodiment illustrated in <FIG>, the second storage provisioning node <NUM> is configured in the manner described earlier with reference to <FIG> and <FIG>, and the compute node <NUM> is configured in the manner described earlier with reference to <FIG> and <FIG>.

In the system illustrated in <FIG>, the storage backend <NUM> comprises the second storage provisioning node <NUM>. Thus, storage is accessed over a network connection (e.g. software defined storage, network attached storage, etc.). In this embodiment, the second storage provisioning node <NUM> can comprise its own hardware as described earlier. On the other hand, in the system illustrated in <FIG>, the compute node <NUM> comprises the second storage provisioning node <NUM>. Thus, storage is directly attached to the compute node <NUM>. In this embodiment, the hardware of the second storage provisioning node <NUM> may be the same hardware as the compute node <NUM> as described earlier.

In the systems illustrated in <FIG> and <FIG>, the first storage provisioning node <NUM> and the operating system <NUM> of the compute node <NUM> may communicate via an interface <NUM>. In some embodiments, as illustrated in <FIG> and <FIG>, the processing circuitry of <NUM> of the first storage provisioning node <NUM> may comprise an encrypted volume provider module <NUM> for initiating provisioning of the encrypted storage volume <NUM> in the manner described herein. In some embodiments, as illustrated in <FIG> and <FIG>, the processing circuitry of <NUM> of the first storage provisioning node <NUM> may comprise a storage orchestrator <NUM>. As illustrated in <FIG> and <FIG>, the application node <NUM> can comprise a storage consuming entity <NUM>. The storage consuming entity <NUM> may be configured to use (or consume) the encrypted storage <NUM> according to some embodiments.

In the systems illustrated in <FIG> and <FIG>, the first storage provisioning node <NUM> acts as a storage consumer towards the second storage provisioning node <NUM>. More specifically, the first storage provisioning node <NUM> acts as a storage consumer of the unencrypted storage volume <NUM> that is provided by the second storage provisioning node <NUM>. In some embodiments where the processing circuitry of <NUM> of the first storage provisioning node <NUM> comprises an encrypted volume provider module <NUM>, the encrypted volume provider module <NUM> of the first storage provisioning node <NUM> may act as the storage consumer of the unencrypted storage volume <NUM> that is provided by the second storage provisioning node <NUM>. In the systems illustrated in <FIG> and <FIG>, the first storage provisioning node <NUM> can act as a storage orchestrator <NUM> towards the workload orchestrator <NUM>.

<FIG> is a signalling (or call flow) diagram illustrating an exchange of signals in a system according to an embodiment. The system may be as illustrated in <FIG> or <FIG> according to some embodiments. As illustrated in <FIG>, the system comprises the application node <NUM>, the operating system (OS) <NUM> of the compute node <NUM>, the first storage provisioning node <NUM>, the orchestrator <NUM>, and the second storage provisioning node <NUM>. The system illustrated in <FIG> also comprises an application management node <NUM>. The application management node <NUM> may be implemented in hardware and/or software, which is not shown.

In the embodiment of <FIG>, as illustrated, the steps <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM> and <NUM> may be performed in the manner described earlier with reference to <FIG>. The corresponding description of these steps with reference to <FIG> will thus be understood to also apply to <FIG>, even if they are not repeated here. However, at step <NUM> of <FIG>, the unencrypted storage volume <NUM> is made available at the compute node <NUM> to the first storage provisioning node <NUM> (rather than to the application node <NUM> as it is at step <NUM> of <FIG>). Also, additional steps <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM> and <NUM> may also be performed according to the embodiment illustrated in <FIG>.

In some embodiments, the deployment request (as illustrated by arrow <NUM> of <FIG>) transmitted by the application management node <NUM> to the orchestrator <NUM> may comprise a manifest. The manifest may, for example, be delivered as part of an application product package. In some embodiments, the manifest may describe the storage needs of the application node <NUM>. In some embodiments, the manifest may comprise the description of the storage needs of the application node <NUM> and also a (direct or indirect) pointer to the first storage provisioning node <NUM>.

With reference to <FIG>, <FIG> and <FIG>, in the embodiment of <FIG>, the orchestrator <NUM> passes a first request <NUM> towards the first storage provisioning node <NUM> for an encrypted storage volume as illustrated by arrow <NUM> of <FIG>. In some embodiments, the first request <NUM> referred to herein may be triggered by an application product package deployment operation. In some embodiments, the first request <NUM> referred to herein may be served as an input to the orchestrator <NUM>, e.g. at time of application deployment. This can be performed either directly by an administrator interacting with the orchestrator <NUM>, e.g. through a user interface, or by the application management node <NUM>.

In response to the first request <NUM> for an encrypted storage volume (as illustrated by arrow <NUM> of <FIG>), transmission of a second request <NUM> is initiated by the first storage provisioning node <NUM> towards the second storage provisioning node <NUM>, e.g. via the orchestrator <NUM>, as illustrated by arrows <NUM> and <NUM> of <FIG>. For example, as illustrated by arrows <NUM> and <NUM> of <FIG>, the first storage provisioning node <NUM> may itself transmit the second request <NUM> towards the second storage provisioning node <NUM>, e.g. via the orchestrator <NUM>. The second request <NUM> is a request for an unencrypted storage volume. Thus, the first storage provisioning node <NUM> translates the first request for an encrypted storage volume into a second request for an unencrypted storage volume.

As illustrated by arrow <NUM> of <FIG>, in response to the second request <NUM> from the first storage provisioning node <NUM> (as illustrated by arrows <NUM> and <NUM> of <FIG>), provisioning of the unencrypted storage volume <NUM> is initiated by the second storage provisioning node <NUM>. The provisioning of the unencrypted storage volume <NUM> is initiated to make the unencrypted storage volume <NUM> available at (e.g. the operating system <NUM> of) the compute node <NUM> to the first storage provisioning node <NUM> in the manner described earlier with reference to <FIG> and <FIG>.

As illustrated by block <NUM> of <FIG>, the unencrypted storage volume <NUM> is provisioned by (e.g. the operating system <NUM> of) the compute node <NUM> to make the unencrypted storage volume <NUM> available at the compute node <NUM> to the first storage provisioning node <NUM> in the manner described earlier with reference to <FIG> and <FIG>. The unencrypted storage volume <NUM> is made available at the compute node <NUM> to the first storage provisioning node <NUM> for the first storage provisioning node <NUM> to use in the generation of an encrypted storage volume <NUM>. In some embodiments, as illustrated by arrow <NUM> of <FIG>, the second request may be acknowledged by the second storage provisioning node <NUM> to the first storage provisioning node <NUM>.

In response to the requested unencrypted storage volume <NUM> becoming available to the first storage provisioning node <NUM>, an encrypted storage volume <NUM> is generated by the first storage provisioning node <NUM> from the unencrypted storage volume <NUM> in the manner described earlier with reference to <FIG> and <FIG>. As described earlier and as illustrated at block <NUM> of <FIG>, in some embodiments, an encryption layer may be provided by the first storage provisioning node <NUM> (or any other node) for use in generating the encrypted storage volume <NUM>.

As illustrated by arrow <NUM> of <FIG>, in the manner described earlier with reference to <FIG> and <FIG>, provisioning of the encrypted storage volume <NUM> is initiated by the first storage provisioning node <NUM> to make the encrypted storage volume <NUM> available at the compute node <NUM> for use by the application node <NUM> or, more specifically, a storage consumer <NUM> (e.g. a user, an application, or any other storage consumer) of the application node <NUM>.

As illustrated by block <NUM> of <FIG>, in the manner described earlier with reference to <FIG> and <FIG>, the encrypted storage volume <NUM> generated by the first storage provisioning node <NUM> is provisioned by (e.g. the operating system <NUM> of) the compute node <NUM> to make the encrypted storage volume <NUM> available at the compute node <NUM> for use by the application node <NUM> or, more specifically, the storage consumer <NUM> of the application node <NUM>.

In some embodiments, the orchestrator <NUM> may transmit a request towards the (e.g. operating system <NUM> of the) compute node <NUM> for the creation of the application node <NUM> (as illustrated by arrow <NUM> of <FIG>). The (e.g. operating system <NUM> of the) compute node <NUM> may then transmit the request for the application node <NUM> to start (as illustrated by arrow <NUM> of <FIG>). Once started, the application node <NUM> may use (or consume) the encrypted storage volume (as illustrated by block <NUM> of <FIG>).

In the embodiment of <FIG>, as illustrated, the steps <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM> and <NUM> may be performed in the manner described earlier with reference to <FIG>. The corresponding description of these steps with reference to <FIG> will thus be understood to also apply to <FIG>, even if they are not repeated here. However, at step <NUM> of <FIG>, the unencrypted storage volume <NUM> is made unavailable to the first storage provisioning node <NUM> (rather than to the application node <NUM> as it is at step <NUM> of <FIG>). Also, additional steps <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, and <NUM> may also be performed according to the embodiment illustrated in <FIG>. In some embodiments, the method illustrated in <FIG> may be performed subsequent to the method illustrated in <FIG>.

With reference to <FIG>, in response to a (fourth) request to cease making the encrypted storage volume <NUM> available at the compute node <NUM> (as illustrated by arrow <NUM> of <FIG>), the ceasing of making the encrypted storage volume <NUM> available at the compute node <NUM> may be initiated by the first storage provisioning node <NUM> as illustrated by arrow <NUM> of <FIG> in the manner described earlier with reference to <FIG> and <FIG>. The (fourth) request to cease making the encrypted storage volume <NUM> available at the compute node <NUM>, as illustrated by arrow <NUM> of <FIG>, may be from the orchestrator <NUM>. As illustrated at block <NUM> of <FIG>, the compute node <NUM> (e.g. the operating system <NUM> of the compute node <NUM>) may cease to make the encrypted storage volume <NUM> available at the compute node <NUM> in the manner described earlier with reference to <FIG> and <FIG>.

As illustrated by arrows <NUM> and <NUM> of <FIG>, transmission of a (third) request may be initiated by the first storage provisioning node <NUM> towards the second storage provisioning node <NUM> (e.g. via the orchestrator <NUM>) to cease making the unencrypted storage volume <NUM> available at the compute node <NUM>. As illustrated by arrow <NUM> of <FIG>, in response to the (third) request from the first storage provisioning node <NUM> to cease making the unencrypted storage volume <NUM> available at the compute node <NUM>, the ceasing of making the unencrypted storage volume <NUM> available at the compute node <NUM> may be initiated by the second storage provisioning node <NUM> in the manner described earlier with reference to <FIG> and <FIG>. As illustrated at block <NUM> of <FIG>, the compute node <NUM> (e.g. the operating system <NUM> of the compute node <NUM>) may cease to make the unencrypted storage volume <NUM> available at the compute node <NUM> in the manner described earlier with reference to <FIG> and <FIG>.

As illustrated by arrows <NUM> and <NUM> of <FIG>, in some embodiments, the (third) request to cease making the unencrypted storage volume <NUM> available at the compute node <NUM> may be acknowledged by the second storage provisioning node <NUM> to the first storage provisioning node <NUM>, e.g. via the orchestrator <NUM>. As illustrated by arrow <NUM> of <FIG>, in some embodiments, the (fourth) request to cease making the encrypted storage volume <NUM> available at the compute node <NUM> may be acknowledged by the first storage provisioning node <NUM> to the orchestrator <NUM>.

In some embodiments, the method described herein in respect of the first storage provisioning node <NUM>, the second storage provisioning node <NUM> and/or the compute node <NUM> may be performed (e.g. may run to completion) prior to initiation of the application node <NUM>, e.g. prior to the application node <NUM> starting (or booting up). In this way, the encrypted storage volume <NUM> is available at the compute node <NUM> for use by the application node <NUM> before the application node <NUM> is initiated, e.g. started (or booted up). In other embodiments, the application node <NUM> may be initiated, e.g. started (or booted up), before encrypted storage volume <NUM> is available at the compute node <NUM>. In some of these embodiments, the application node <NUM> (e.g. processing circuitry of the application node <NUM>) may be configured to check whether the encrypted storage volume <NUM> is available at the compute node <NUM>. In some embodiments, the check may be performed by the application node <NUM> (e.g. processing circuitry of the application node <NUM>) polling the compute node <NUM>. The check may be performed, for example, continuously or at predefined time intervals. In some embodiments, the orchestrator <NUM> may be configured to initiate, e.g. start (or boot up) the application node <NUM>.

<FIG> illustrates an example environment in which a system (such as those described earlier) can be deployed in accordance with an embodiment. As illustrated in <FIG>, the example environment comprises a Kubernetes (which may also be referred to as a k8s) system, which can function as an orchestrator. The example environment also comprises a container storage interface (CSI) encryption shim plugin, a CSI storage plugin, and a helm chart. The environment also comprises an application that requires data storage. The method described herein can be used to provision this data storage. The first storage provisioning node <NUM> described herein can be used as the CSI encryption shim plugin. In the example environment, the application node <NUM> may select, e.g. via the helm chart, the type of storage that is provided by the second storage provisioning node <NUM>.

<FIG> is a block diagram illustrating a first storage provisioning node <NUM> in accordance with an embodiment. The first storage provisioning node <NUM> comprises a transmission initiating module <NUM> configured to, in response to a first request for an encrypted storage volume for an application node, initiate transmission of a second request towards a second storage provisioning node for an unencrypted storage volume. The first storage provisioning node <NUM> comprises a generating module <NUM> configured to, in response to the requested unencrypted storage volume becoming available to the first storage provisioning node, generate an encrypted storage volume from the unencrypted storage volume. The first storage provisioning node <NUM> comprises a provisioning initiating module <NUM> configured to initiate provisioning of the encrypted storage volume to make the encrypted storage volume available at a compute node of the system for use by the application node. The first storage provisioning node <NUM> may operate in the manner described herein.

<FIG> is a block diagram illustrating a second storage provisioning node <NUM> in accordance with an embodiment. The second storage provisioning node <NUM> comprises a provisioning initiating module <NUM> configured to, in response to a second request from a first storage provisioning node <NUM> of the system for an unencrypted storage volume, initiate provisioning of the unencrypted storage volume to make the unencrypted storage volume available at a compute node of the system to the first storage provisioning node <NUM> for the first storage provisioning node <NUM> to use in the generation of an encrypted storage volume to be made available at the compute node for use by an application node. In some embodiments, the second storage provisioning node <NUM> may also comprise an unprovisioning initiating module configured to initiate unprovisioning of the unencrypted storage volume to cease making the unencrypted storage volume available at the compute node. The second storage provisioning node <NUM> may operate in the manner described herein.

<FIG> is a block diagram illustrating a compute node <NUM> in accordance with an embodiment. The compute node <NUM> comprises a first provisioning module <NUM> configured to provision an unencrypted storage volume requested by a first storage provisioning node <NUM> to make the unencrypted storage volume available at the compute node to the first storage provisioning node <NUM> for the first storage provisioning node <NUM> to use in the generation of an encrypted storage volume. The compute node <NUM> comprises a second provisioning module <NUM> configured to provision the encrypted storage volume generated by the first storage provisioning node <NUM> to make the encrypted storage volume available at the compute node for use by an application node. In some embodiments, the compute node <NUM> may also comprise an unprovisioning module configured to unprovision the unencrypted storage volume to cease making the unencrypted storage volume available at the compute node. The compute node <NUM> may operate in the manner described herein.

There is also provided a computer program comprising instructions which, when executed by processing circuitry (such as the processing circuitry <NUM> of the first storage provisioning node <NUM> described earlier, the processing circuitry <NUM> of the second storage provisioning node <NUM> described earlier, and/or the processing circuitry <NUM> of the compute node <NUM> described earlier), cause the processing circuitry to perform at least part of the method described herein. There is provided a computer program product, embodied on a non-transitory machine-readable medium, comprising instructions which are executable by processing circuitry (such as the processing circuitry <NUM> of the first storage provisioning node <NUM> described earlier, the processing circuitry <NUM> of the second storage provisioning node <NUM> described earlier, and/or the processing circuitry <NUM> of the compute node <NUM> described earlier) to cause the processing circuitry to perform at least part of the method described herein. There is provided a computer program product comprising a carrier containing instructions for causing processing circuitry (such as the processing circuitry <NUM> of the first storage provisioning node <NUM> described earlier, the processing circuitry <NUM> of the second storage provisioning node <NUM> described earlier, and/or the processing circuitry <NUM> of the compute node <NUM> described earlier) to perform at least part of the method described herein. In some embodiments, the carrier can be any one of an electronic signal, an optical signal, an electromagnetic signal, an electrical signal, a radio signal, a microwave signal, or a computer-readable storage medium.

In some embodiments, the first storage provisioning node functionality, the second storage provisioning node functionality, and/or the compute node functionality described herein can be performed by hardware. Thus, in some embodiments, any one or more of the first storage provisioning node <NUM>, the second storage provisioning node <NUM>, and the compute node <NUM> described herein can be a hardware node. However, it will also be understood that optionally at least part or all of the first storage provisioning node functionality, the second storage provisioning node functionality, and/or the compute node functionality described herein can be virtualized. For example, the functions performed by any one or more of the first storage provisioning node <NUM>, the second storage provisioning node <NUM>, and the compute node <NUM> described herein can be implemented in software running on generic hardware that is configured to orchestrate the node functionality. Thus, in some embodiments, the any one or more of the first storage provisioning node <NUM>, the second storage provisioning node <NUM>, and the compute node <NUM> described herein can be a virtual node. In some embodiments, at least part or all of the first storage provisioning node functionality, the second storage provisioning node functionality, and/or the compute node functionality described herein may be performed in a network enabled cloud. The first storage provisioning node functionality, the second storage provisioning node functionality, and/or the compute node functionality described herein may all be at the same location or at least some of the node functionality may be distributed.

It will be understood that at least some or all of the method steps described herein can be automated in some embodiments. That is, in some embodiments, at least some or all of the method steps described herein can be performed automatically.

Thus, in the manner described herein, there is advantageously provided a technique for provisioning storage in a system. The first storage provisioning node <NUM> described herein can be deployed in any type of system including, but not limited to, any cloud system, such as any cloud system that provides a supported interface for storage provisioner plugins. The first storage provisioning node <NUM> described herein can fill the gap of other functionality, such as metrics, that existing cloud storage providers do not support. The second storage provisioning node <NUM> described herein can be any type of storage provisioning node including, but not limited to, any cloud system storage provisioner. The method described herein can be used with any workload that requires storage. Moreover, software support on the storage user side is not required.

Claim 1:
A method performed by a first storage provisioning node (<NUM>) of a system for provisioning storage in the system, the method comprising:
in response to a first request (<NUM>, <NUM>) for an encrypted storage volume for an application node (<NUM>), initiating (<NUM>) transmission of a second request (<NUM>, <NUM>, <NUM>) towards a second storage provisioning node (<NUM>) for an unencrypted storage volume (<NUM>); and
in response to the requested unencrypted storage volume (<NUM>) becoming available to the first storage provisioning node (<NUM>), generating (<NUM>) an encrypted storage volume (<NUM>) from the unencrypted storage volume (<NUM>) and initiating provisioning (<NUM>, <NUM>) of the encrypted storage volume (<NUM>) to make the encrypted storage volume (<NUM>) available at a compute node (<NUM>) of the system for use by the application node (<NUM>).