Managing virtual machine policy compliance

1. A method for restoring compliance of a virtual machine found to be non-compliant to a compliance rule, the method comprising

detecting non-compliance of the virtual machine with the compliance rule using a compliance agent deployed on the virtual machine;

detaching the virtual machine from a network;

creating a copy of a compliance repository volume on a requested disk resource for the virtual machine, wherein the compliance repository volume has stored thereon a version of the virtual machine which adheres to the compliance rule;

responsive to detecting the non-compliance of the virtual machine, mounting the requested disk resource, having stored thereon the copy of the compliance repository volume, to the virtual machine;

responsive to mounting the requested disk resource, applying a remediation action to the virtual machine using content of the copy of the compliance repository volume to restore compliance of the virtual machine;

responsive to applying the remediation action to the virtual machine, triggering, by the compliance agent, a compliance scan to ensure that the virtual machine complies with the compliance rule; and

responsive to ensuring that the virtual machine complies with the compliance rule, attaching the virtual machine back to the network.

2. The method according to claim 1 , further comprising:

responsive to triggering the compliance scan, detaching the requested disk resource having stored the copy of the compliance repository volume from the virtual machine.

3. The method according to claim 2 , wherein the detaching of the requested disk resource is performed after applying the remediation action.

4. The method according to claim 1 , further comprising:

removing the copy of the compliance repository volume on the requested disk resource.

5. The method according to claim 4 , wherein the removing the copy of the compliance repository volume comprises releasing the requested disk resource.

6. The method according to claim 1 , wherein the creation of the copy of the compliance repository volume is performed by a storage system controlled by a hypervisor.

7. The method according to claim 6 , wherein the creation of the copy of the compliance repository volume is triggered by the compliance agent via the hypervisor.

8. The method according to claim 1 , wherein the remediation action is performed by the compliance agent using at least one script and/or at least one software component stored on the copy of the compliance repository volume.

9. A data processing program for execution in a data processing system, the data processing program comprising software code portions stored in a memory device for performing the method according to claim 1 when said data processing program is run on the data processing system.

10. The method according to claim 1 , wherein the compliance repository volume comprises a storage volume having stored thereon a version of a compliant virtual machine that is compliant with the compliance rule, and the step of applying the remediation action to the virtual machine reverts the virtual machine back to a compliant state.

11. The method according to claim 10 , wherein the compliance repository volume is copied on-the-fly during operation of the virtual machine to a disk resource requested by the compliance agent via the hypervisor in order to create the copy of the compliance repository volume.

12. The method according to claim 11 , wherein the copy of the compliance repository volume is copied by a storage system such that the copy is performed independent from the virtual machine.

13. A compliance system adapted to restore compliance of a virtual machine found to be non-compliant to a compliance rule, the compliance system comprising a data processor coupled to a memory having instructions stored therein that are operable, when executed by the data processor, to perform steps of:

detecting non-compliance of a virtual machine with the compliance rule using a compliance agent deployed on the virtual machine;

detaching the virtual machine from a network;

creating a copy of a compliance repository volume on a requested disk resource for the virtual machine, wherein the compliance repository volume has stored thereon a version of the virtual machine which adheres to the compliance rule;

responsive to detecting the non-compliance of the virtual machine, mounting the requested disk resource, having stored thereon the copy of the compliance repository volume, to the virtual machine;

responsive to mounting the requested disk resource, applying a remediation action to the virtual machine using content of the copy of the compliance repository volume to revert the virtual machine back to a compliant state;

responsive to applying the remediation action to the virtual machine, triggering, by the compliance agent, a compliance scan to ensure that the virtual machine complies to the compliance rule; and

responsive to ensuring that the virtual machine complies with the compliance rule, attaching the virtual machine back to the network.

14. The compliance system according to claim 13 , wherein the compliance repository volume comprises a storage volume having stored thereon a version of a compliant virtual machine that is compliant with the compliance rule, and the step of applying the remediation action to the virtual machine reverts the virtual machine back to a compliant state.

15. The compliance system according to claim 14 , wherein the compliance repository volume is copied on-the-fly during operation of the virtual machine to a disk resource requested by the compliance agent via the hypervisor in order to create the copy of the compliance repository volume.

16. The compliance according to claim 15 , wherein the copy of the compliance repository volume is copied by a storage system such that the copy is performed independent from the virtual machine.

17. A computer program product stored on a non-transitory computer usable medium, comprising computer readable program code for causing a computer to perform steps of:

detecting non-compliance of the virtual machine with the compliance rule using a compliance agent deployed on the virtual machine;

detaching the virtual machine from a network;

creating a copy of a compliance repository volume on a requested disk resource for the virtual machine, wherein the compliance repository volume has stored thereon a version of the virtual machine which adheres to the compliance rule;

responsive to detecting the non-compliance of the virtual machine, mounting the requested disk resource, having stored thereon the copy of the compliance repository volume, to the virtual machine;

responsive to mounting the requested disk resource, applying a remediation action to the virtual machine using content of the copy of the compliance repository volume to restore compliance of the virtual machine;

responsive to applying the remediation action to the virtual machine, triggering, by the compliance agent, a compliance scan to ensure that the virtual machine complies with the compliance rule; and

responsive to ensuring that the virtual machine complies with the compliance rule, attaching the virtual machine back to the network.

18. The computer program product according to claim 17 , wherein the compliance repository volume comprises a storage volume having stored thereon a version of a compliant virtual machine that is compliant with the compliance rule, and the step of applying the remediation action to the virtual machine reverts the virtual machine back to a compliant state.

19. The computer program product according to claim 18 , wherein the compliance repository volume is copied on-the-fly during operation of the virtual machine to a disk resource requested by the compliance agent via the hypervisor in order to create the copy of the compliance repository volume.

20. The computer program product according to claim 19 , wherein the copy of the compliance repository volume is copied by a storage system such that the copy is performed independent from the virtual machine.