Cloud compliance monitoring for a cloud compute environment managed by a container orchestrator
Cloud compliance monitoring for a cloud compute environment managed by a container orchestrator may be performed by a data platform. For example, the data platform may obtain cluster configuration data from a control plane of a cluster that is managed by a container orchestrator within a cloud compute environment, obtain node configuration data from one or more compute nodes associated with a data plane of the cluster that is managed by the container orchestrator, and generate a compliance statement based on the cluster configuration data and node configuration data. The compliance statement may indicate a configuration posture of the cloud compute environment according to a compliance benchmark. Corresponding methods, systems, and products are also disclosed.
1 . A method comprising:
obtaining, by a data platform, first cluster configuration data from a control plane of a first cluster that is managed by a first container orchestrator within a first cloud compute environment;
obtaining, by the data platform, second cluster configuration data from a control plane of a second cluster that is managed by a second container orchestrator within a second cloud compute environment;
obtaining, by the data platform, first node configuration data from one or more compute nodes associated with a data plane of the first cluster that is managed by the first container orchestrator;
obtaining, by the data platform, second node configuration data from one or more compute nodes associated with a data plane of the second cluster that is managed by the second container orchestrator; and
generating, by the data platform based on the cluster configuration data and node configuration data, a multi-cloud compliance statement indicating a configuration posture of a plurality of cloud compute environments according to a compliance benchmark, wherein the multi-cloud compliance statement comprises an aggregated compliance posture generated by analyzing configuration metadata obtained from multiple clusters across different cloud compute environments, further wherein the compliance posture is generated based on a compliance benchmark selected in accordance with attributes of the configuration metadata.
2 . The method of claim 1 , wherein the first container orchestrator and the second container orchestrator are different orchestration platforms selected from the group consisting of: Kubernetes, ECS, EKS, AKS and OpenShift.
3 . The method of claim 1 , wherein the compliance benchmark is selected based on a type of cloud provider associated with each cluster.
4 . The method of claim 1 , wherein the compliance benchmark is selected based on a type of cloud provider associated with a respective cluster.
5 . The method of claim 1 , wherein the compliance benchmark is a client-customized compliance benchmark configured to measure compliance with respect to a set of client-defined practices for a containerized application deployed to the cloud compute environment.
6 . The method of claim 1 , wherein the cluster configuration data includes data generated by at least one component operating in the control plane of the cluster and selected from a group including:
a cluster controller manager component;
a cloud controller manager component;
a persistence storage manager component: or
a scheduler component.
7 . The method of claim 1 , wherein the node configuration data includes data generated by at least one type of component operating in the data plane of the cluster and selected from a group including:
orchestration agent components running on the one or more compute nodes;
network proxy components running on the one or more compute nodes; or
container runtimes running on the one or more compute nodes.
8 . The method of claim 1 , further comprising obtaining, by the data platform, additional data associated with activity occurring within the cloud compute environment, the additional data distinct from the cluster configuration data and the node configuration data;
wherein the generating of the compliance statement is further based on the additional data associated with the activity occurring within the cloud compute environment.
9 . The method of claim 1 , wherein:
the container orchestrator within the cloud compute environment is a first container orchestrator within a first cloud compute environment associated with a first cloud service provider;
the method further comprises obtaining, by the data platform, additional cluster configuration data and additional node configuration data from an additional cluster managed by a second container orchestrator within a second cloud compute environment associated with a second cloud service provider, the second container orchestrator functionally related to the first container orchestrator and the second cloud compute environment and second cloud service provider distinct from the first cloud compute environment and first cloud service provider; and
the generating of the compliance statement is further based on the additional duster configuration data and the additional node configuration data.
10 . The method of claim 9 , wherein the first and second cloud service providers are different commercial cloud service providers.
11 . The method of claim 9 , wherein the first cloud service provider is a commercial cloud service provider and the second cloud service provider is a private cloud service provider.
12 . The method of claim 1 , wherein the compliance statement is a compliance report generated during a configuration phase prior to deployment of a containerized application to the cloud compute environment.
13 . The method of claim 1 , wherein the compliance statement is a compliance alert generated during a runtime phase subsequent to deployment of a containerized application to the cloud compute environment.
14 . The method of claim 1 , further comprising constructing, by the data platform and based on at least one of the duster configuration data or the node configuration data, a graph comprising a plurality of node points connected by a plurality of edges, each node point of the plurality of node points representing a logical entity and each edge of the plurality of edges representing a behavioral relationship between node points connected by the edge; wherein the generating of the compliance statement is further based on the graph.
15 . A system comprising:
a memory storing instructions; and
one or more processors communicatively coupled to the memory and configured to execute the instructions to perform a process comprising:
obtaining, by a data platform, first cluster configuration data from a control plane of a first cluster that is managed by a first container orchestrator within a first cloud compute environment;
obtaining, by the data platform, second cluster configuration data from a control plane of a second cluster that is managed by a second container orchestrator within a second cloud compute environment;
obtaining, by the data platform, first node configuration data from one or more compute nodes associated with a data plane of the first cluster that is managed by the first container orchestrator;
obtaining, by the data platform, second node configuration data from one or more compute nodes associated with a data plane of the second cluster that is managed by the second container orchestrator; and
generating, by the data platform based on the cluster configuration data and node configuration data, a multi-cloud compliance statement indicating a configuration posture of a plurality of cloud compute environments according to a compliance benchmark, wherein the multi-cloud compliance statement comprises an aggregated compliance posture generated by analyzing configuration metadata obtained from multiple clusters across different cloud compute environments, further wherein the compliance posture is generated based on a compliance benchmark selected in accordance with attributes of the configuration metadata.
16 . The system of claim 15 , wherein the first container orchestrator and the second container orchestrator are different orchestration platforms selected from the group consisting of: Kubernetes, ECS, EKS, AKS and OpenShift.
17 . The system of claim 15 , wherein the duster configuration data includes data generated by at least one component operating in the control plane of the duster and selected from a group including:
a duster controller manager component;
a cloud controller manager component;
a persistence storage manager component; or
a scheduler component.
18 . The system of claim 15 , wherein the node configuration data includes data generated by at least one type of component operating in the data plane of the cluster and selected from a group including:
orchestration agent components running on the one or more compute nodes;
network proxy components running on the one or more compute nodes; or
container runtimes running on the one or more compute nodes.
19 . The system of claim 15 , wherein:
the container orchestrator within the cloud compute environment is a first container orchestrator within a first cloud compute environment associated with a first cloud service provider;
the process further comprises obtaining additional duster configuration data and additional node configuration data from an additional cluster managed by a second container orchestrator within a second cloud compute environment associated with a second cloud service provider, the second container orchestrator functionally related to the first container orchestrator and the second cloud compute environment and second cloud service provider distinct from the first cloud compute environment and first cloud service provider; and
the generating of the compliance statement is further based on the additional cluster configuration data and the additional node configuration data.
20 . A computer program product embodied in a non-transitory computer-readable storage medium and comprising computer instructions for performing a process comprising:
obtaining, by a data platform, first cluster configuration data from a control plane of a first cluster that is managed by a first container orchestrator within a first cloud compute environment;
obtaining, by the data platform, second cluster configuration data from a control plane of a second cluster that is managed by a second container orchestrator within a second cloud compute environment;
obtaining, by the data platform, first node configuration data from one or more compute nodes associated with a data plane of the first cluster that is managed by the first container orchestrator;
obtaining, by the data platform, second node configuration data from one or more compute nodes associated with a data plane of the second cluster that is managed by the second container orchestrator; and
generating, by the data platform based on the cluster configuration data and node configuration data, a multi-cloud compliance statement indicating a configuration posture of a plurality of cloud compute environments according to a compliance benchmark, wherein the multi-cloud compliance statement comprises an aggregated compliance posture generated by analyzing configuration metadata obtained from multiple clusters across different cloud compute environments, further wherein the compliance posture is generated based on a compliance benchmark selected in accordance with attributes of the configuration metadata.