Multi-element selection of subtrees in fixed-depth trees

1. A method for dynamic selection of resource objects in a non-static environment, the method comprising:

defining a scope group from a scope tree, via a dynamic query, wherein the dynamic query comprises:

executing a query on the scope tree, the query including a name-type rule, a label-type rule, or a combination thereof; and

selecting a subtree of the scope tree, to include in the scope group, based on the query, wherein the subtree includes a resource object that belongs exclusively to the subtree of the scope tree, and wherein the resource object is configurable to be a node, deployment, secret, or route.

2. The method of claim 1 , wherein the selecting the subtree is based on the name-type rule, the selecting comprising:

identifying the subtree based on its unique identifier that is specified by the name-type rule, wherein the unique identifier is associated exclusively to the subtree; and

selecting the identified subtree to include in the scope group.

3. The method of claim 1 , wherein the selecting the subtree is based on the label-type rule, the selecting comprising:

identifying a subtree with an assigned label that is specified by the label-type rule; and

selecting the identified subtree to include in the scope group.

4. The method of claim 1 , wherein the selecting the subtree is based on the label-type rule, the selecting comprising:

recognizing that a label specified by the label-type rule is not within the scope tree, or is not yet created;

identifying a subtree with a newly created assigned label specified by the label-type rule; and

selecting the identified subtree to include in the scope group.

5. The method of claim 1 , wherein a subtree includes at least one resource object.

6. The method of claim 1 , further comprising:

controlling a user's world view in a cloud system based on the defined scope group and resource objects within the scope group.

7. The method of claim 5 , wherein controlling the user's world view includes at least one of the following:

displaying to the user via a user interface only resource objects within the defined scope group,

preventing the user read access to the resource objects outside the defined scope group, and

preventing the user write access to the resource objects outside the defined scope group.

8. The method of claim 1 , wherein the selecting a subtree based on the label-type rule comprises:

executing a kubernetes label selector mechanism.

9. The method of claim 1 , wherein the dynamic query further comprises:

converting a name of a resource object to a virtual label;

converting a name of each subtree in each level of depth in the scope tree to a virtual label; and

combining the virtual labels from resource objects and subtrees to produce a virtual label identifier for each resource object and each subtree in the scope tree.

10. The method of claim 9 , wherein the dynamic query further comprises:

excluding a subtree or resource object from inclusion into the scope group based on the label-type rule that specifies at least one virtual label identifier to exclude.

11. The method of claim 1 , wherein the dynamic query further comprises:

executing an intermediary application that is run constantly or intermittently;

dynamically identifying via the intermediary application, newly created labels that meet criteria set by the label-type rule; and

selecting a subtree of the scope tree, to include in the scope group, based on the label-type rule.

12. A cloud-based security system comprising:

a database;

a server, the server and the database managed via a cloud-based operating system, the server comprising a processor and a memory storing instructions that, when executed by the processor, are effective to program the at least one processor to:

define a scope group from a scope tree, via a dynamic query, wherein the scope group includes nodes or clusters, and wherein the dynamic query comprises instructions to:

execute a query on the scope tree, the query including a name-type rule, a label-type rule, or a combination thereof; and

select a subtree of the scope tree, to include in the scope group, based on the query, wherein the subtree includes a resource object that belongs exclusively to the subtree of the scope tree, and wherein the resource object is configurable to be a node, deployment, secret, or route.

13. The system of claim 12 , wherein the instructions to select a subtree are based on the name-type rule, the instructions comprise:

identify the subtree based on its unique identifier that is specified by the name-type rule, wherein the unique identifier is associated exclusively to the subtree; and

select the identified subtree to include in the scope group.

14. The system of claim 12 , wherein the instructions to select a subtree are based on the label-type rule, the instructions comprise:

identify a subtree with an assigned label that is specified by the label-type rule; and

select the identified subtree to include in the scope group.

15. The system of claim 12 , wherein the instructions to select a subtree are based on the label-type rule, the instructions comprise:

recognize that a label specified by the label-type rule is not within the scope tree, or is not yet created;

identify a subtree with a newly created assigned label specified by the label-type rule; and

select the identified subtree to include in the scope group.

16. The system of claim 12 , the instructions further comprising: control a user's world view in a cloud system based on the defined scope group and resource objects within the scope group, by considering at least one of the following:

display to the user via a user interface only resource objects within the defined scope group,

prevent the user read access to the resource objects outside the defined scope group, and

prevent the user write access to the resource objects outside the defined scope group.

17. The system of claim 12 , wherein the dynamic query further comprises:

converting a name of a resource object to a virtual label;

converting a name of each subtree in each level of depth in the scope tree to a virtual label;

combining the virtual labels converted from resource objects and subtrees to produce a virtual label identifier for each resource object and each subtree in the scope tree; and

excluding a subtree or resource object from inclusion into the scope group based on the label-type rule that specifies at least one virtual label identifier to exclude.

18. A non-transitory computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for dynamic selection of resource objects comprising:

defining a scope group from a scope tree, via a dynamic query, wherein the dynamic query comprises:

executing an instructional query on the scope tree; and

selecting a subtree of the scope tree, to include in the scope group, based on a name-type rule, a label-type rule, or a combination thereof, wherein the subtree includes a resource object that belongs exclusively to the subtree of the scope tree, and wherein the resource object is configurable to be a node, deployment, secret, or route; and

controlling a user's world view in a cloud system based on the defined scope group, wherein the controlling comprises at least one of the following:

displaying to the user via a user interface only resource objects within the defined scope group,

preventing the user read access to the resource objects outside the defined scope group, and

preventing the user write access to the resource objects outside the defined scope group.