Secure workload configuration
View Patent ↗Described are techniques for secure workload configuration including a method comprising receiving a workload definition file at a worker node and from a master node, where the workload definition file comprises an encrypted immutable definition, a partially immutable definition with a predefined range of values and a first value modified by the master node, and a variable definition with a second value modified by the master node. The method further comprises decrypting, by the worker node, the encrypted immutable definition to generate a decrypted immutable definition. The method further comprises verifying, by the worker node, that the first value satisfies the predefined range of values. The method further comprises, in response to decrypting the encrypted immutable definition and verifying that the first value satisfies the predefined range of values, executing a workload based on the workload definition file in a virtual computing environment.
1. A processor-implemented method comprising:
receiving a workload definition file at a worker node and from a master node, wherein the workload definition file comprises:
an encrypted immutable definition;
a partially immutable definition with a predefined range of values and a first value modified by the master node; and
a variable definition with a second value modified by the master node;
decrypting, by the worker node, the encrypted immutable definition to generate a decrypted immutable definition;
verifying, by the worker node, that the first value satisfies the predefined range of values; and
in response to decrypting the encrypted immutable definition and verifying that the first value satisfies the predefined range of values, executing a workload based on the workload definition file in a virtual computing environment.
2. The method of claim 1 , wherein the worker node resides in a Virtual Private Cloud (VPC), and wherein the master node resides in control plane managing multiple Virtual Private Clouds.
3. The method of claim 1 , wherein the encrypted immutable definition is unalterable by the master node.
4. The method of claim 1 , wherein the encrypted immutable definition comprises a container image name.
5. The method of claim 1 , wherein the encrypted immutable definition is encrypted using a public key of a customer leasing the worker node.
6. The method of claim 1 , wherein the partially immutable definition comprises a memory allocation.
7. The method of claim 1 , wherein the variable definition comprises a container instance identifier.
8. A system comprising:
a processor; and
a computer-readable storage medium storing program instructions which, when executed by the processor, are configured to cause the processor to perform a method comprising:
receiving a workload definition file at a worker node and from a master node, wherein the workload definition file comprises:
an encrypted immutable definition;
a partially immutable definition with a predefined range of values and a first value modified by the master node; and
a variable definition with a second value modified by the master node;
decrypting, by the worker node, the encrypted immutable definition to generate a decrypted immutable definition;
verifying, by the worker node, that the first value satisfies the predefined range of values; and
in response to decrypting the encrypted immutable definition and verifying that the first value satisfies the predefined range of values, executing a workload based on the workload definition file in a virtual computing environment.
9. The system of claim 8 , wherein the worker node resides in a Virtual Private Cloud (VPC), and wherein the master node resides in control plane managing multiple Virtual Private Clouds.
10. The system of claim 8 , wherein the encrypted immutable definition is unalterable by the master node.
11. The system of claim 8 , wherein the encrypted immutable definition comprises a container image name.
12. The system of claim 8 , wherein the encrypted immutable definition is encrypted using a public key of a customer leasing the worker node.
13. The system of claim 8 , wherein the partially immutable definition comprises a memory allocation.
14. The system of claim 8 , wherein the variable definition comprises a container instance identifier.
15. A computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform a method comprising:
receiving a workload definition file at a worker node and from a master node, wherein the workload definition file comprises:
an encrypted immutable definition;
a partially immutable definition with a predefined range of values and a first value modified by the master node; and
a variable definition with a second value modified by the master node;
decrypting, by the worker node, the encrypted immutable definition to generate a decrypted immutable definition;
verifying, by the worker node, that the first value satisfies the predefined range of values; and
in response to decrypting the encrypted immutable definition and verifying that the first value satisfies the predefined range of values, executing a workload based on the workload definition file in a virtual computing environment.
16. The computer program product of claim 15 , wherein the worker node resides in a Virtual Private Cloud (VPC), and wherein the master node resides in control plane managing multiple Virtual Private Clouds.
17. The computer program product of claim 15 , wherein the encrypted immutable definition is unalterable by the master node.
18. The computer program product of claim 15 , wherein the encrypted immutable definition comprises a container image name.
19. The computer program product of claim 15 , wherein the encrypted immutable definition is encrypted using a public key of a customer leasing the worker node.
20. The computer program product of claim 15 , wherein the partially immutable definition comprises a memory allocation, and wherein the variable definition comprises a container instance identifier.