Validation of payload for deployment to a target environment

1. A method performed by a computing system, the method comprising:

receiving a payload including;

a first payload portion having application code configured to be deployed to a target resource cluster,

a second payload portion having payload identifying metadata uniquely identifying the application code in the first payload portion, and

a deployment target identifier that identifies the target resource cluster;

generating a token corresponding to the payload based on the payload identifying metadata, the token including:

a payload identifying claim having a unique identifier that uniquely identifies the application code, and

a deployment target identifier claim based on the deployment target identifier;

controlling a signing system to obtain a signed token by using a signature to electronically sign the token including the payload identifying claim and the deployment target identifier claim; and

outputting a deployment request, including the signed token and the payload, requesting deployment of the payload to the target resource cluster.

2. The method of claim 1 , and further comprising:

identifying an approver system for approving deployment of the payload to the target resource cluster based on the deployment target identifier; and

generating an approval request to the approver system.

3. The method of claim 1 , comprising:

receiving, at a deployment system, the deployment request including the signed token and the payload;

determining whether the payload identifying claim identifies the application code included in the payload;

generating a token/payload correspondence output indicating whether the payload identifying claim identifies the application code included in the payload;

generating a payload validation output indicating whether the payload is validated based at least in part on the token/payload correspondence output; and

controlling the deployment system to deploy the payload to the target resource cluster based on the payload validation output.

4. The method of claim 3 wherein the payload identifying claim comprises a hash value and wherein determining whether the payload identifying claim identifies the application code included in the payload comprises:

hashing the application code in the payload to obtain a code hash value; and

comparing the code hash value to the hash value.

5. The method of claim 3 wherein receiving the deployment request comprises:

receiving the deployment request requesting deployment of the payload to a requested target resource cluster identified by a requested target resource identifier.

6. The method of claim 5 wherein the token includes a deployment target identifier claim identifying a resource cluster and further comprising:

comparing the requested target resource identifier to the deployment target identifier claim.

7. The method of claim 6 wherein generating the payload validation output comprises:

generating the payload validation output based at least in part on whether the requested target resource identifier matches the deployment target identifier claim.

8. The method of claim 7 wherein the token is signed with a signature and further comprising:

validating the signature on the token; and

generating a signature validation output based on validation of the signature.

9. The method of claim 8 wherein controlling the deployment system comprises:

controlling the deployment system to deploy the payload to the target resource cluster based on the payload validation output and the signature validation output.

10. A computing system, comprising:

a processor; and

a data store that has computer executable instructions which cause the processor to implement computing system components, comprising:

a token generator configured to:

receive a payload that includes:

a first payload portion having application code to be deployed to a target resource cluster,

a second payload portion having payload identifying metadata uniquely identifying the application code and

a deployment target identifier that identifies the target resource cluster; and

generate a token corresponding to the payload based on the payload identifying metadata, the token including:

a payload identifying claim having a unique identifier that uniquely identities the application code, and

a deployment target identifier claim based on the deployment target identifier;

a signing system configured to obtain a signed token by using a signature to electronically sign the token including the payload identifying claim and the deployment target identifier claim; and

an output generator configured to generate a deployment request including the signed token and the payload, requesting deployment of the payload to the target resource cluster.

11. The computing system of claim 10 and further comprising:

an approval request generator identifying an approver system for approving deployment of the payload to the target resource cluster based on the deployment target identifier and generating an approval request to the approver system.

12. The computing system of claim 10 and further comprising:

a claim, processing system configured to determine whether the payload identifying claim identifies the application code included in the payload and to generate a token/payload correspondence output indicating whether the payload identifying claim identifies the application code included in the payload and to further generate a payload validation output indicating whether the payload is validated based at least in part on the token/payload correspondence output.

13. The computing system of claim 12 and further comprising:

a target environment validation component configured compare a requested target resource identifier to the deployment target identifier claim and to generate the payload validation output based at least in part on whether the requested target resource identifier matches the deployment target identifier claim.