Change management service

Patent metadata

Field	Value
Publication number	US-12131189-B2
Application number	US-202318104806-A
Country	US
Kind code	B2
Filing date	Feb 2, 2023
Priority date	Nov 30, 2022
Publication date	Oct 29, 2024
Grant date	Oct 29, 2024

Abstract

A computer-implemented method, computer-readable medium, and computer system that involve operations including receiving, from a computing cluster, a first request for changing a first object type specified by an approval policy resource, where the approval policy resource is a first one of a plurality of custom resources; identifying, in response to receiving the first request and using a second custom resource of the plurality, an approval process associated with the first object type; performing the approval process associated with the first object type; and sending, to the computing cluster, a first notification indicating that the request has been approved.

First claim

What is claimed is:

1. A computer-implemented method performed by an operator in a containerized environment, the method comprising:
receiving, from a computing cluster in the containerized environment, a first request for changing a first object type specified by an approval policy resource, wherein the approval policy resource is a first one of a plurality of custom resources, the computing cluster comprising a plurality of nodes running containerized applications;
identifying, in response to receiving the first request and using a second custom resource of the plurality, an approval process associated with the first object type;
performing the approval process associated with the first object type, wherein performing the approval process associated with the first object type comprises adding an annotation to the first object type that indicates that the first object type is approved; and
sending, to the computing cluster, a first notification indicating that the request has been approved.

2. The computer-implemented method of claim 1 , wherein the operator comprises a mutating admission webhook, and wherein receiving, from a computing cluster, a first request for changing a first object type specified by the approval policy resource comprises:
monitoring, using the mutating admission webhook, a plurality of requests received via a Kubernetes application programming interface (API), each of the plurality of requests comprising an API kind;
comparing each of the API kinds to a plurality of object types specified by the approval policy resource; and
determining that a first API kind in the first request corresponds to the first object type.

3. The computer-implemented method of claim 1 , wherein performing the approval process associated with the first object type further comprises:
identifying, using a third custom resource of the plurality, one or more approvers responsible for approving the first object type;
assigning the first request to the one or more approvers; and
receiving an indication, from the one or more approvers, that the first request has been approved.

4. The computer-implemented method of claim 1 , further comprising:
sending, to the computing cluster, a second notification indicating that the first request is undergoing an approval process.

5. The computer-implemented method of claim 4 , wherein the second notification comprises at least one of: an approval identifier (ID) associated with the first request or a link to a user interface for tracking a status of the first request.

6. The computer-implemented method of claim 1 , wherein the approval policy resource specifies a plurality of object types that require approval, the plurality of object types comprising one or more of: (i) Node Group requests, (ii) Compliance and security exceptions, (iii) New infrastructure requests, (iv) Network changes, (v) protected application configuration changes, and Cluster-level resource access.

7. The computer-implemented method of claim 1 , further comprising:
receiving a second request for changing the first object type; and
automatically approving, based at least in part on the annotation, the second request without performing the approval process associated with the first object type.

8. The computer-implemented method of claim 1 , wherein the operator is a Kubernetes operator and the computing cluster is a Kubernetes cluster.

9. A non-transitory computer-readable medium storing instructions which, when executed by a hardware-based processor, performs operations comprising:
receiving, by an operator in a containerized environment and from a computing cluster, a first request for changing a first object type specified by an approval policy resource, wherein the approval policy resource is a first one of a plurality of custom resources;
identifying, in response to receiving the first request and using a second custom resource of the plurality, an approval process associated with the first object type;
performing the approval process associated with the first object type, wherein performing the approval process comprises adding an annotation to the first object type that indicates that the first object type is approved; and
sending, to the computing cluster, a first notification indicating that the request has been approved.

10. The non-transitory computer-readable medium of claim 9 , wherein the operator comprises a mutating admission webhook, and wherein receiving, from the computing cluster, a first request for changing a first object type specified by the approval policy resource comprises:
monitoring, using the mutating admission webhook, a plurality of requests received via an application programming interface (API), each of the plurality of requests comprising an API kind;
comparing each of the API kinds to a plurality of object types specified by the approval policy resource; and
determining that a first API kind in the first request corresponds to the first object type.

11. The non-transitory computer-readable medium of claim 9 , wherein performing the approval process associated with the first object type further comprises:
identifying, using a third custom resource of the plurality, one or more approvers responsible for approving the first object type;
assigning the first request to the one or more approvers; and
receiving an indication, from the one or more approvers, that the first request has been approved.

12. The non-transitory computer-readable medium of claim 9 , the operations further comprising:
sending, to the computing cluster, a second notification indicating that the first request is undergoing an approval process.

13. The non-transitory computer-readable medium of claim 12 , wherein the second notification comprises at least one of: an approval identifier (ID) associated with the first request or a link to a user interface for tracking a status of the first request.

14. The non-transitory computer-readable medium of claim 9 , wherein the approval policy resource specifies a plurality of object types that require approval, the plurality of object types comprising one or more of: (i) Node Group requests, (ii) Compliance and security exceptions, (iii) New infrastructure requests, (iv) Network changes, (v) protected application configuration changes, and Cluster-level resource access.

15. The non-transitory computer-readable medium of claim 9 , further comprising:
receiving a second request for changing the first object type; and
automatically approving, based at least in part on the annotation, the second request without performing the approval process associated with the first object type.

16. The non-transitory computer-readable medium of claim 9 , wherein the operator is a Kubernetes operator and the computing cluster is a Kubernetes cluster.

17. A system comprising:
one or more processors including a hardware-based processor; and
a memory storage including a non-transitory computer-readable medium storing instructions which, when executed by the one or more processors including the hardware-based processor, performs operations comprising:
receiving, by an operator in a containerized environment and from a computing cluster, a first request for changing a first object type specified by an approval policy resource, wherein the approval policy resource is a first one of a plurality of custom resources;
identifying, in response to receiving the first request and using a second custom resource of the plurality, an approval process associated with the first object type;
performing the approval process associated

Assignees

• Vmware Inc
• VMware LLC

Inventors

• O'Rourke Thomas James
• Davis Brian
• Baheti Abhinandan
• Carpenter Matthew
• Singh Vivek Kumar

Classifications

• G06F9/54

  Interprogram communication · CPC title

• H04L41/12 Primary

  Discovery or management of network topologies · CPC title

• G06F9/5005 Primary

  to service a request · CPC title

• G06F9/5072

  Grid computing · CPC title