SOFAStack introduces the concept of workspace on the basis of the basic resources of Alibaba Cloud. A workspace is essentially a group of resources with network interconnectivity, consistent security policies, and extremely low access latency. You can group resources into a workspace to facilitate management. For example, you can group your resources into the development workspace, test workspace, and production workspace based on different R&D and delivery requirements. Resources in different workspaces are mutually isolated. Independent operator permissions can be assigned for each workspace to facilitate management.
Workspaces can traverse availability zones (AZs) but not regions, to support high availability (HA). Resources must be allocated to applications in each workspace. Different application versions can be published in different workspaces. The following figure shows the topology of applications, workspaces, regions, and AZs.
After creating a workspace, you can manage and maintain the basic resources in the workspace in a centralized manner. More SOFAStack products, such as Classic Application Service (CAS), LDC Hybrid Cloud (LHC), and Real-time Monitoring Service (RMS), can be used in your workspaces.
Workspace isolation mechanism
Resources in different workspaces are mutually isolated. Resources in virtual private cloud (VPC) workspaces are isolated through VPCs. Each workspace maps a single VPC. That is, every workspace is an independent private network and is logically isolated.
Workspace resource binding
You can import purchased and created IaaS resources into the target workspace and group the resources by workspace. This whole process is called workspace resource binding.
To import resources when a VPC is used, bind the VPC to the current workspace. Then the Elastic Compute Service (ECS) instances, disks, security groups, and internal Server Load Balancer (SLB) instances under the VPC are automatically imported into the current workspace.
If a workspace is created in a region supporting only VPCs, the workspace can be used only after being bound to a VPC.
You can also remove imported resources from the target workspace. After the resources are removed, their binding relationship with the workspace is revoked. However, the moved resources are not deleted. You can still manage them on the basic resource console of Alibaba Cloud, or import them into another workspace.
Resource metadata synchronization
After basic resources are imported into the target workspace, the metadata of the basic resources on the Alibaba Cloud console will be regularly synchronized to the SOFAStack console. For example, if an ECS instance has been imported into a workspace and you have modified the specifications of the instance on the Alibaba Cloud console after the import, this ECS instance on the resource management page of the workspace will be updated upon next synchronization. Currently, the synchronization interval is around 5 minutes.
We recommend that you prepare resources, including purchasing resources and modifying their specifications, on the Alibaba Cloud console in advance, and import the resources to the target workspace on its resource management page where you can then perform O&M operations. Do not perform operations on the Alibaba Cloud console and the resource management page of the workspace at the same time, so as to avoid unexpected consequences caused by inconsistencies due to data synchronization latency.