Method and apparatus for providing secure debug information
A method and apparatus provides debug information and employs a central debug service in a management environment that issues, to a client debug agent in a client environment, a cryptographically secure signed request for access to debug information that is generated by code executing in the client environment. The request is signed using a private key of a public/private key pair associated with the central debug service. The central debug service receives from the client debug agent, a request that requests the public key of public/private key pair associated with the central debug service and provides the public key of the central debug service to the client debug agent, in response to the request, for verification of approval to access debug information in the client environment. The central debug service receives the requested debug information from the client debug agent, in response to a successful signature verification by the client debug agent.
1. A method for providing debug information comprising:
issuing, by a debug service in a computing environment, to a debug agent in an operation environment, a cryptographically secure signed request for access to debug information in the operation environment, the cryptographically secure signed request having a digital signature associated with the debug service;
issuing a reply to a request from the debug agent that requests a public key associated with the debug service, by providing signature verification information associated with the debug service to the debug agent, in response to the request from the debug agent, for verification of the digital signature; and
receiving the requested debug information from the debug agent, in response to a successful verification by the debug agent,
wherein at least a part of the method is performed by one or more processors.
2. The method of claim 1 further comprising generating the digital signature by using a public key and a private key pair.
3. The method of claim 1 further comprising:
providing a debug agent registration by mapping a plurality of debug agent identifiers to a plurality of environment identifiers; and
receiving a request for the debug information that comprises data representing a destination debug agent,
wherein the issuing a cryptographically secure signed request for access to the debug information comprises checking the mapping of the plurality of debug agent identifiers for the data representing the destination debug agent.
4. The method of claim 1 further comprising:
providing one or more predetermined conditions to the debug agent that causes the debug agent to send the debug information back to the debug service when the one or more predetermined conditions are satisfied.
5. The method of claim 1 further comprising:
receiving a request to obtain the debug information from a requesting agent, wherein the request includes a debug agent identifier; and
providing the debug information received from the debug agent in response to the request to obtain the debug information.
6. The method of claim 1 , wherein the receiving the requested debug information from the debug agent comprises:
storing a diagnostic log comprising the debug information; and
providing the debug information to a requesting agent by periodically retrieving the debug information from the diagnostic log.
7. The method of claim 1 further comprising generating a user interface that communicates with the debug service, the user interface configured to provide selectable data that represents selectable debug tasks from the operation environment.
8. A method for providing debug information comprising:
receiving a cryptographically secure signed request for access to debug information, from a debug service, the cryptographically secure signed request having a digital signature associated with the debug service;
issuing a request in response to the cryptographically secure signed request for access to the debug information, that requests a public key associated with the debug service;
in response to obtaining the public key of the debug service from the debug service, verifying the digital signature; and
providing the debug information to the debug service in response to a successful verification.
9. The method of claim 8 further comprising:
receiving event criteria information from the debug service; and
sending the debug information back to the debug service based at least in part on the event criteria information.
10. The method of claim 9 further comprising:
polling for debug information tasks issued by the debug service; and
returning the debug information to the debug service in response to an issued debug information task.
11. A system comprising:
one or more memories having instructions stored thereon; and
one or more processors configured to execute the instructions and perform operations comprising:
issuing to a debug agent in an operation environment, a cryptographically secure signed request for access to debug information in the operation environment, the cryptographically secure signed request having a digital signature associated with a debug service;
issuing a reply to a request from the debug agent that requests a public key associated with the debug service, by providing verification information associated with the debug service to the debug agent, in response to the request from the debug agent, for verification of the digital signature; and
receiving the requested debug information from the debug agent, in response to a successful verification by the debug agent.
12. The system of claim 11 , wherein the operations further comprise:
providing debug agent registration by mapping a plurality of debug agent identifiers to a plurality of environment identifiers;
receiving a request for the debug information, from a requesting agent, that comprises data representing a destination debug agent; and
wherein the issuing a cryptographically secure signed request for access to debug information comprises checking the mapping of the plurality of debug agent identifiers for the data representing the destination debug agent.
13. The system of claim 11 , wherein the operations further comprise:
in response to obtaining the public key of the debug service from the debug service, verifying that the cryptographically secure signed request is from the debug service; and
providing the debug information to the debug service in response to a successful verification.
14. The system of claim 11 , wherein the operations further comprise:
provide one or more predetermined conditions to the debug agent that causes the debug agent to send the debug information back to the debug service if the one or more predetermined conditions are satisfied.
15. The system of claim 11 , wherein the operations further comprise:
receive a request to fetch the debug information from a requesting agent in a computing environment, wherein the request includes a debug agent identifier; and
provide the fetched debug information received from the debug agent in response to the request to fetch the debug information.
16. The system of claim 11 , wherein the operations further comprise:
store a diagnostic log comprising the debug information by the debug agent; and
provide the debug information to a requesting agent by periodically retrieving the debug information from the diagnostic log.
17. The system of claim 11 , wherein the operations further comprise generating a user interface that communicates with the debug service, the user interface configured to provide selectable data that represents selectable debug tasks from the operation environment.
18. The system of claim 11 , wherein the cryptographically secure signed request is signed using a private key of the public key and a private key pair associated with the debug service; and
wherein the operations further comprise:
issuing a request in response to the cryptographically secure signed request for access to the debug information, that requests the public key associated with the debug service;
in response to obtaining the public key of the debug service from the debug service, verifying that the cryptographically secure signed request is from the debug service; and
providing the debug information to the debug service in response to a successful verification.
19. The system of claim 18 , wherein the operations further comprise:
receiving event criteria information from the debug service; and
sending the debug information back to the debug service based at least in part on the event criteria information.
20. The method of claim 1 , wherein the request from the debug agent for the public key associated with the debug service is received in response to issuing the cryptographically secure signed request for access to the debug information.