Containerized agent for monitoring container activity in a compute environment
A containerized agent that is deployed to a compute node of a compute environment and that executes in both user space and kernel space of the compute node is disclosed. The containerized agent collects data associated with a first container entity that is deployed to the compute node and that executes only in the user space of the compute node such that the first container entity is isolated from other entities executing in the user space of the compute node. The containerized agent also provides the collected data associated with the first container entity to a data platform that is monitoring the cloud compute environment using the containerized agent. Corresponding methods, systems, and products are also disclosed.
1 . A method comprising:
collecting, by a containerized agent that is deployed to a compute node of a cloud compute environment and that executes in both user space and kernel space of the compute node, data associated with a first container entity that is deployed to the compute node and that executes only in the user space of the compute node such that the first container entity is isolated from other entities executing in the user space of the compute node, wherein the containerized agent is implemented using a Host Process container; and
providing, by the containerized agent, the collected data associated with the first container entity to a data platform that is monitoring the cloud compute environment using the containerized agent, wherein the containerized agent is deployed to the compute node during a session that begins with a setup routine and ends with a cleanup routine, including:
installing, by the containerized agent as part of the setup routine, a kernel driver for the containerized agent that executes in the kernel space, and
uninstalling, by the containerized agent as part of the cleanup routine, the kernel driver for the containerized agent.
2 . The method of claim 1 , wherein:
the containerized agent includes a containerized service component executing in the user space of the compute node and a kernel driver executing in the kernel space of the compute node.
3 . The method of claim 1 , wherein the compute node is a worker node managed by a master node.
4 . The method of claim 1 , further comprising:
collecting, by the containerized agent, additional data associated with a second container entity that is deployed to the compute node and that executes only in the user space of the compute node such that the second container entity is isolated from the first container entity and the other entities executing in the user space of the compute node by way of at least one of namespace isolation, filesystem isolation, and registry isolation; and
providing to the data platform, by the containerized agent and together with the providing of the collected data associated with the first container entity, the collected additional data associated with the second container entity.
5 . The method of claim 1 , wherein the containerized agent and the first container entity are managed by a container runtime executing on the compute node.
6 . The method of claim 1 , wherein the collected data provided to the data platform is configured to be used by the data platform for generation of a data model that facilitates the data platform in assessing a security posture of the cloud compute environment.
7 . The method of claim 6 , wherein:
the data model is a graph comprising a plurality of graph nodes connected by a plurality of edges;
each graph node of the plurality of graph nodes represents a logical entity and each edge of the plurality of edges represents a behavioral relationship between graph nodes connected by the edge; and
the plurality of graph nodes includes a graph node associated with the first container entity to allow the assessing of the security posture to account for the first container entity.
8 . The method of claim 6 , wherein the assessing of the security posture of the cloud compute environment includes identifying, based on the data model, at least one of an anomaly, a security threat, or a compliance issue with respect to the first container entity that is deployed to the compute node of the cloud compute environment.
9 . A computer program product embodied in a non-transitory computer-readable storage medium and comprising computer instructions implementing a containerized agent that is deployed to a compute node of a compute environment and that executes in both user space and kernel space of the compute node to perform a process comprising:
collecting data associated with a first container entity that is deployed to the compute node and that executes only in the user space of the compute node such that the first container entity is isolated from other entities executing in the user space of the compute node;
providing the collected data associated with the first container entity to a data platform that is monitoring the compute environment using the containerized agent, wherein the containerized agent is deployed to the compute node during a session that begins with a setup routine and ends with a cleanup routine, including:
installing, as part of the setup routine, a kernel driver for the containerized agent that executes in the kernel space; and
uninstalling, as part of the cleanup routine, the kernel driver for the containerized agent.
10 . The computer program product of claim 9 , wherein:
the containerized agent includes a containerized service component executing in the user space of the compute node and the kernel driver.
11 . The computer program product of claim 9 , wherein:
the containerized agent is implemented using a Host Process container.
12 . The computer program product of claim 11 , wherein:
the first container entity is implemented as a containerized application deployed to a first dedicated pod not shared by other containerized applications; and
the Host Process container implementing the containerized agent is deployed to a second dedicated pod not shared by other containerized applications.
13 . The computer program product of claim 9 , wherein the compute node is a worker node managed by a master node.
14 . The computer program product of claim 9 , wherein the process further comprises:
collecting additional data associated with a second container entity that is deployed to the compute node and that executes only in the user space of the compute node such that the second container entity is isolated from the first container entity and the other entities executing in the user space of the compute node by way of at least one of namespace isolation, filesystem isolation, and registry isolation; and
providing to the data platform, together with the providing of the collected data associated with the first container entity, the collected additional data associated with the second container entity.
15 . The computer program product of claim 9 , wherein the collected data provided to the data platform is configured to be used by the data platform for generation of a data model that facilitates the data platform in assessing a security posture of the compute environment.
16 . A computing system within a compute environment monitored by a data platform using a containerized agent that executes in both user space and kernel space of the computing system, the computing system comprising:
a memory storing instructions; and
one or more processors communicatively coupled to the memory and configured to execute the instructions to implement the containerized agent and cause the containerized agent to perform a process comprising:
collecting data associated with a first container entity that is deployed to the computing system and that executes only in the user space of the computing system such that the first container entity is isolated from other entities executing in the user space of the computing system; and
providing the collected data associated with the first container entity to the data platform that is monitoring the compute environment using the containerized agent, wherein:
the collected data provided to the data platform is configured to be used by the data platform for generation of a data model that facilitates the data platform in assessing a security posture of the compute environment;
the data model is a graph comprising a plurality of graph nodes connected by a plurality of edges;
each graph node of the plurality of graph nodes represents a logical entity and each edge of the plurality of edges represents a behavioral relationship between graph nodes connected by the edge; and
the plurality of graph nodes includes a graph node associated with the first container entity to allow the assessing of the security posture to account for the first container entity.
17 . The computing system of claim 16 , wherein:
the containerized agent is implemented using a Host Process container.
18 . The computing system of claim 17 , wherein:
the first container entity is implemented as a containerized application deployed to a first dedicated pod not shared by other containerized applications; and
the Host Process container implementing the containerized agent is deployed to a second dedicated pod not shared by other containerized applications.
19 . The computing system of claim 16 , wherein:
the containerized agent is deployed to the computing system during a session that begins with a setup routine and ends with a cleanup routine; and
the process further comprises:
installing, by the containerized agent as part of the setup routine, a kernel driver for the containerized agent that executes in the kernel space; and
uninstalling, by the containerized agent as part of the cleanup routine, the kernel driver for the containerized agent.
20 . A method comprising:
collecting, by a containerized agent that is deployed to a compute node of a cloud compute environment and that executes in both user space and kernel space of the compute node, data associated with a first container entity that is deployed to the compute node and that executes only in the user space of the compute node such that the first container entity is isolated from other entities executing in the user space of the compute node, wherein the containerized agent is implemented using a Host Process container; and
providing, by the containerized agent, the collected data associated with the first container entity to a data platform that is monitoring the cloud compute environment using the containerized agent, wherein:
the collected data provided to the data platform is configured to be used by the data platform for generation of a data model that facilitates the data platform in assessing a security posture of the cloud compute environment;
the data model is a graph comprising a plurality of graph nodes connected by a plurality of edges;
each graph node of the plurality of graph nodes represents a logical entity and each edge of the plurality of edges represents a behavioral relationship between graph nodes connected by the edge; and
the plurality of graph nodes includes a graph node associated with the first container entity to allow the assessing of the security posture to account for the first container entity.