Patent ID: 12197559

DETAILED DESCRIPTION

As noted in the background section, a configuration can be deployed on a computing resource. A configuration may be deployed on a computing resource using deployer program code for the computing resource, which can also be referred to as a deployer. Examples of deployers include Terraform®, which is an opensource infrastructure tool that provides a consistent command line interface (CLI) by which diverse cloud services can be commonly deployed via configurations; and Chef®, which also is an infrastructure tool by which infrastructure and applications can be deployed via configurations, and which is available from Progress Software Corp., of Bedford, Mass.

Other examples of deployers include Puppet®, which is an opensource deployment tool by which multiple application servers can be deployed via configurations; and Ansible®, which is an automation tool by which enterprise infrastructure can be deployed via configurations, and which is available from Red Hat, Inc., of Raleigh, N.C. Another example of a deployer includes CloudSlang®, which is an opensource tool by which computing resources can be deployed via configurations. Other examples of deployers include scripting engines for deploying computing resources via configurations (i.e., for deploying configurations on computing resources).

In general, a user who is interested in deploying a configuration on a computing resource—and who is referred to as a deployment user herein—interacts directly with the deployer for the computing resource. The deployment user via a computing device provides a configuration to the deployer, and may also provide credentials to the deployer that permit the deployment user to deploy the configuration on the computing resource using the deployer. The deployer in turn authenticates the credentials, and if successful, attempts to deploy the configuration on the computing resource. The deployer then returns a response back to the computing device of the deployment user as to whether deployment was successful.

The deployment user may be part of an enterprise or other organization that maintains subscriptions for the computing resources by which suitable deployers can deploy configurations on the resources. Another user of the enterprise, who is referred to as a policy user herein, may be responsible for promulgating policies governing what types of configurations can be deployed on which types of computing resources. The deployment user may thus be expected to ensure that his or her configuration is in compliance with a policy before deploying the configuration on a computing resource using a deployer.

However, there is no way for the policy user to enforce such compliance checking before the deployment user deploys a configuration on a computing resource using a deployer. The deployer may be provided by a third party separate from the enterprise or other organization of which the deployment and policy users are a part. Therefore, the deployer may not be able to be modified to perform a compliance check on a configuration received from the policy user before deploying the configuration on a computing resource.

The deployer may perform limited checking on a configuration before deployment. However, such checking is just to ensure that it is possible to deploy the configuration on a computing resource, not whether it is permissible to deploy the configuration. That is, even if a configuration is able to be deployed on a computing resource by a deployer, the policies created by the policy user govern whether such configuration deployment is to be permitted.

Furthermore, even if a compliance check tool were developed by the enterprise or other organization to perform a compliance check on a configuration before a deployer is used to deploy the configuration on a computing resource, there is no way to force the deployment user to use the tool prior to deploying the configuration via the deployer. The deployment user may not be aware of such a tool, for instance, or the deployment user may forget to use the tool. Because the deployment user him or herself interacts directly with the deployer, he or she has the credentials necessary to use the deployer, and thus may do so without performing any compliance check on the configuration, either manually or via a compliance check tool.

Techniques described herein ameliorate these and other issues. The techniques described herein provide for controller program code, which is also referred to as a controller, by which a deployment user interacts with a deployer. The controller receives a request from the deployment user (i.e., via a computing device of the deployer user) to deploy a configuration on a computing resource. The controller first performs a compliance check on the configuration according to a policy to determine whether deployment of the configuration on the computing resource is permitted.

Just if the configuration has passed the compliance check does the controller than control a deployer for the computing resource to deploy the configuration on the computing resource. The controller in this respect may have a credential for the deployer that is passed to the deployer along with the configuration, and which authorizes usage of the deployer for the deploying the configuration on the computing resource. The credential may be unavailable to the deployment user, such that the deployment user is unable to deploy the configuration on the computing resource using the deployer except through the controller.

FIG.1shows an example system100in which a compliance check can be performed on a configuration before deployment. The system100includes computing devices102and104, which may be server computers or other types of computing devices. The computing devices102and104are communicatively connected to one another, such as over the Internet and/or another network.

The computing device102may also be referred to as a deployer device or a deployer computing device, whereas the computing device104may be referred to as a controller device or a controller computing device. The computing devices102and104may be maintained by or on behalf of different entities. For example, the computing device102may be maintained by or for a third party providing a deployer, whereas the computing device104may be maintained by or for an enterprise or other organization that uses the deployer.

The deployer computing device102includes a processor106and a memory108. The computing device102may also include other components in addition to the processor and the memory108. The memory108stores deployer program code110A,110B, . . . ,110N, which are collectively referred to as the deployer program code110, for computing resources112A,112B, . . . ,112N, respectively, which are collectively referred to as the computing resources112. Each deployer program code110can also be referred to as a deployer, and can be executed by the processor106to deploy configurations on its corresponding computing resource112.

In the example ofFIG.1, each deployer program code110is responsible for a corresponding computing resource112. However, in another implementation, a deployer program code110may be responsible for more than one computing resource112. Furthermore, in the example, the same deployer computing device102stores and executes more than one deployer program code110. However, in another implementation there may be multiple deployer devices that each stores and executes one or more than one deployer program code110.

The controller computing device104includes a processor114, a memory116, and a storage device118. The computing device104may also include other components in addition to the processor114, the memory116, and the storage device118. The storage device118may be a hard disk drive, a solid state drive (SSD), or another type of storage device. The memory116stores controller program code120, which can also be referred to as a controller. The controller program code120can be executed by the processor114to perform a compliance check on a configuration for a computing resource112before controlling the deployer program code110for the computing resource112to deploy the configuration on the computing resource112.

In this respect, the storage device118stores one or multiple policy general specifications122. Each policy general specification122is a general specification of a policy that may not be particular or specific to any computing resource112and/or any deployer program code110. Each general specification122may delineate a policy in a markup language or other format, for instance. The controller program code120performs a compliance check on a configuration for a computing resource112according to any such policy that is applicable to the computing resource112and/or the deployer program code110for the computing resource112.

The storage device118further stores translation information124A,124B, . . . ,124N, collectively referred to as the translation information124, for the deployer program code110A,110B, . . . ,110N, respectively. Each translation information124can be considered configuration information that specifies how to map a policy general specification122to a particular policy specification for a corresponding deployer program code110. The controller program code120thus performs a compliance check on a configuration for a computing resource112by mapping the general specification122for a policy to a particular specification for the policy, and then applying the particular policy specification to the configuration.

It is noted that the deployer program code110governs the formatting of a configuration for a corresponding computing resource112. Because different deployer program code110may provide for different formatting of configurations for their corresponding computing resources112, the general policy specifications122may not be able to be directly applied to such diverse configurations. The translation information124for a deployer program code110thus defines how to map the general policy specifications122to particular policy specifications that can be directly applied to configurations for the computing resource112to which the deployer program code110corresponds.

The storage device118also stores credentials126A,126B, . . . ,126N, collectively referred to as the credentials126, for the deployer program code110A,110B, . . . ,110N, respectively. The credential126for each deployer program code110permits usage of the deployer program code110to deploy a configuration on the computing resource112to which the deployer program code110corresponds. After performing a compliance check on a configuration for a computing resource112, the controller program code120thus passes the credential126for the deployer program code110corresponding to the computing resource112, along with the configuration, to this deployer program code110.

The deployer program code110in turn authenticates the passed credential126to verify that deployment of the configuration on the computing resource112is authorized. If authentication is successful, the deployer program code110deploys the configuration on the computing resource112. If authentication is unsuccessful (i.e., if the wrong or no credential126is provided), the deployer program code110does not deploy the configuration on the computing resource112. This means that if a deployment user does not have access to the credential126apart from usage of the controller computing device104, the deployment user is forced to use the computing device104in order to deploy a configuration on the computing resource112.

FIG.2shows an example process200for performing a compliance check on a policy before deploying the configuration on a computing resource112in the system100ofFIG.1. The process is performed by the controller computing device104. For instance, the process can be performed by execution of the controller program code120by the processor114from the memory116of the computing device104. The process is described in relation to the deployment of a configuration on the computing resource112A in particular for which the deployer program code110A is used for such deployment. The process involves three users: a deployment user202, a developer user204, and a policy user206. The users202,204, and206may be part of the same enterprise or other organization, and can be the same user or different users.

The deployment user202provides to the controller a configuration208that the user202wishes to deploy on the computing resource112A. The deployment user202may provide the controller this information by interacting with the controller via a computing device of the deployment user202that is communicatively connected to the controller computing device104. The developer user204provides to the controller translation information124A governing mapping of a policy general specification122to a deployer-specific policy specification212, which is a particular policy specification that can be applied to the configuration208for the computing resource112A as governed by the deployer program code110A. The developer user204may similarly provide the controller this information by interacting with the controller via a computing device of the developer user204that is communicatively connected to the controller computing device104.

The policy user206provides to the controller the policy general specification122, which is a general specification of a policy governing whether deployment of the configuration208(and other configurations) on the computing resource112A (and other computing resources112) is permitted. The policy user206(or another user) may also provide to the controller the credential126A authorizing usage of the deployer program code110A to deploy the configuration208on the computing resource112A. The policy user206may provide the controller this information by interacting with the controller via a computing device of the policy user206that is communicatively connected to the controller computing device104.

The controller therefore maps (210) the policy general specification122to the deployer-specific policy specification212using the translation information124A for the deployer program code110A. The controller then applies (214) the deployer-specific policy specification212to the configuration208for the computing resource112A. In this way, the controller determines whether deployment of the configuration208on the computing resource112A is permitted according to the policy of the general specification122.

If deployment of the configuration208on the computing resource112A is permitted (216), the controller passes (218) the credential126A and the configuration208to the deployer program code110A for the computing resource112A. It is noted that the controller may not modify or adjust the configuration208in any way. That is, the configuration208received from the deployment user202is the same as if the deployment user202were interacting directly with the deployer program code110A. In this respect, the controller (i.e., the controller program code120) may provide a user interface, such as a graphical user interface (GUI) or a CLI that mimics that of the deployer program code110A.

Upon being passed the credential126A and the configuration208, the deployer program code110A deploys (220) the configuration208on the computing resource112A, assuming that the credential126A passes authentication and thus authorizes such deployment. The configuration208is therefore deployed on the computing resource112A (222). By comparison, if deployment of the configuration208on the computing resource112A is not permitted (216), the controller does not pass the credential126A or the configuration208to the deployer program code110A, and the configuration208is not deployed on the computing resource112A (224).

FIG.3shows an example method300showing in detail the specifics of the process200ofFIG.2as it pertains to the developer user204and the policy user206. The parts of the method300in the left, middle, and right columns are respectively performed by the developer user204, the controller program code120(i.e., the controller) and the policy user206. That is, a computing device of the developer user204, the controller computing device104, and a computing device of the policy user206may respectively perform the parts of the method300in the left, middle, and rights columns.

The developer user204provides translation information124for one or more deployers (i.e., for one or more deploy program code110) to the controller program code120(302), which receives (304) and stores the translation information124within the storage device118(306). At some point thereafter (307) per the example, or concurrently or before in another example, the policy user206provides one or more policy general specifications122to the controller program code120(308). The controller program code120receives (310) and stores the one or more policy general specifications312within the storage device118(312).

Also at some point thereafter (313) per the example, or concurrently or before in another example, the policy user206provides a credential126for each of one or more deployers (i.e., of one or more deployer program code110) to the controller program code120(314). In another implementation, a user other than the policy user206may provide the credentials126, such as the developer user204or another user. The controller program code120receives (316) and stores the credential126or credentials126within the storage device118(318).

FIGS.4A and4Bshow an example method400showing in detail the specifics of the process ofFIG.2as it pertains to the deployment user202. Referring first toFIG.4A, the parts of the method400in the left and right columns are respectively performed by the deployment user202and the controller program code120(i.e., the controller). That is, a computing device of the deployment user202and the controller computing device104may respectively perform the parts of the method400in the left and right columns. The method400may be performed after the method300ofFIG.3has been performed. The method400is described in relation to the configuration208for the computing resource112A having the corresponding deployer program code110A.

The deployment user202provides the configuration208to be deployed on the computing resource112A to the controller program code120(402), which receives the configuration208(404). The controller program code120in turn selects the deployer program code110A that corresponds to the computing resource112A (406), which is the deployer program code110A that is used to deploy configurations, such as the configuration208, on the computing resource112A.

The controller program code120also selects a policy for the configuration208and/or the computing resource112A (408). That is, of the policies for which the storage device118stores general specifications122, the controller program code120selects the policy that is applicable to the configuration208and/or the computing resource112A. There may be more than one such policy as well in this respect. Furthermore, as an example, just some policies may be applicable to the configuration208, and just some policies may be applicable to the computing resource112A. Therefore, the policy or polices that concern or pertain to both the configuration208and the computing resource112A are selected.

The controller program code120retrieves the translation information124A for the selected deployer program code110A from the storage device118(410). The controller program code120similarly retrieves the general specification or specifications122for the selected policy or policies (412). Using the retrieved translation information124A, the controller program code120then maps each retrieved general specification122to a particular policy specification (414).

Referring next toFIG.4B, the parts of the method400in the left, middle, and right columns are respectively performed by the deployment user202, the controller program code120(i.e., the controller), and the deployer program code110A (i.e., the deployer). That is, a computing device of the deployment user202may perform the parts of the method400in the left column. Similarly, the controller computing device104may perform the parts of the method400in the middle column, and the deployer computing device102may perform the parts of the method400in the right column.

The controller program code120applies each particular policy specification to the configuration208to determine whether deployment of the configuration208on the computing resource112A is permitted (416). The configuration208may have to pass compliance with the particular specification of every selected policy in order for deployment of the configuration208to be permitted on the computing resource112A. If the configuration208fails compliance with the particular specification of any selected policy, deployment of the configuration208is not permitted on the computing resource112A.

If deployment is permitted (418), then the controller program code120may send a response to the deployment user202indicating that that deployment of the configuration208on the computing resource112A is permitted (420). The deployment user202(i.e., a computing device thereof) thus receives this response (422). The controller program code retrieves the credential126A for the deployer program code110A from the storage device118(424), and passes both the configuration208and the credential126A to the deployer program code110A (426).

The deployer program code110A receives the configuration208for the computing resource112A and the credential126A for the deployer program code110A (428). The deployer program code110A then deploys the configuration208on the computing resource112A (430). As part of such deployment, the deployer program code110A may first authenticate the credential126A to determine whether usage of the deployer program code110for configuration deployment on the computing resource112A is authorized.

The deployer program code110A sends an indication back to the controller program code120as to whether deployment was successful (432). The controller program code120receives this indication (434), and in turns sends a response as to whether deployment was successful back to the deployment user202(436), which receives this response (438). Deployment of the configuration208on the computing resource112may be unsuccessful if the credential126A does not pass authentication, for instance, if the configuration208is one that is not possible to be realized on the computing resource112A, or if an error occurred during deployment.

If the configuration208fails the compliance check and thus its deployment is not permitted on the computing resource112A (418), then the controller program code120instead sends to the deployment user202a response indicating that deployment of the configuration208is not permitted on the computing resource112A (440). The deployment user202receives this response (442). Therefore, the deployment user202may receive a response indicating that deployment is permitted in part422, followed by a response indicating whether or not deployment was actually successful in part438, or may receive a response indicating that deployment is not permitted in part442.

FIG.5shows an example non-transitory computer-readable data storage medium500that stores program code502executable by a processor. For instance, the program code502may be the controller program code120that is executable by the processor114of the controller computing device104. As such, the program code502is executable by a controller device to perform processing. The processing is described in relation to the configuration208for the computing resource112A having the corresponding deployer program code110A. The processing includes receiving, from the deployment user202, a request to deploy the configuration208on the computing resource112A (504).

The processing includes performing a compliance check on the configuration208according to a policy to determine whether deployment of the configuration208on the computing resource112A is permitted (506). The processing includes, in response to determining that the deployment of the configuration208on the computing resource112A is permitted, controlling a deployer (i.e., the deployer program code110A) for the computing resource112A to deploy the configuration208on the computing resource112A (508). The processing includes, in response to determining that the deployment is not permitted, not controlling the deployer for the computing resource112A such that the configuration208is not deployed on the computing resource112A (510).

Techniques have been described for performing a compliance check on a configuration208prior to deployment of the configuration208on a computing resource112A. A controller both performs the compliance check and, if the compliance check is successful, controls the deployer that actually deploys the configuration208on the computing resource112A. A deployment user202may not have access to the credential126A for the deployer, and therefore be forced to use the controller in order to deploy the configuration208on the computing resource112A, ensuring that the compliance check is performed prior to deployment.