Securely rehydrating containerized agents

Patent metadata

Field	Value
Publication number	US-12177209-B2
Application number	US-202217943637-A
Country	US
Kind code	B2
Filing date	Sep 13, 2022
Priority date	Sep 13, 2022
Publication date	Dec 24, 2024
Grant date	Dec 24, 2024

Abstract

A method, apparatus, and computer-readable medium are described that enable agent instances to be instantiated in secure, containerized environments. When a new container is detected, a list of agent instances expected to be running in a compute instance or in a container may be obtained and compared with status information regarding which agent instances are active. For a non-active agent instance, an agent object and configuration information for the agent instance may be obtained from a storage. Based on the available name, the agent object, and the configuration information, the agent instance may be instantiated and connected to an agent status server. An application related to the new agent instance may be deployed in the secure containerized environment.

First claim

What is claimed is:

1. A computer-implemented method for instantiating agents in containers, wherein tasks are performed by the instantiated agents, the method comprising:
receiving, for a container, container configuration information comprising:
a container name; and
one or more agent identifications associated with one or more agent instances;

receiving one or more agent identifications of one or more active agent instances having been instantiated in the container;
identifying, based on a comparison between the container configuration information and the one or more agent identifications of the one or more active agent instances, an agent identification of a non-instantiated agent;
sending, to an authentication process and based on an identification of the agent identification of the non-instantiated agent, a client identification and a password;
receiving, based on the client identification and the password, an access token;
sending, with the access token and based on the identification of the agent identifications of the non-instantiated agent, a request for a preconfigured agent object, wherein the request comprises the agent identification of the non-instantiated agent;
receiving, based on the request, the preconfigured agent object associated with the agent identification of the non-instantiated agent;
instantiating, based on the preconfigured agent object, a new agent instance, wherein the new agent instance is associated with the container; and
scheduling performance, based on the instantiation of the new agent instance, of a task by the new agent instance.

2. The computer-implemented method of claim 1 , wherein names of all instantiated agent instances are predetermined.

3. The computer-implemented method of claim 1 , wherein receiving the container configuration information further comprises:
receiving exactly one agent identification.

4. The computer-implemented method of claim 1 , wherein identifying the agent identification of the non-instantiated agent comprises:
selecting a first predetermined non-instantiated agent from a plurality of non-instantiated agents.

5. The computer-implemented method of claim 1 , further comprising:
sending, via an agent status application programming interface (API), the one or more agent identifications of one or more inactive agent instances.

6. The computer-implemented method of claim 1 , further comprising:
sending, via an agent status API and based on the instantiation of the new agent instance, a status of the new agent instance.

7. The computer-implemented method of claim 1 , further comprising:
determining, based on a determination that the container has been deployed, whether at least one agent instance associated with the container is inactive; and
obtaining, based on a determination that the at least one agent instance is inactive, agent instance information for the inactive at least one agent instance,
wherein the sending the request for the preconfigured agent object is further based on the obtained agent instance information.

8. The computer-implemented method of claim 1 , wherein the sending the client identification and the password further comprises:
sending, via a management agent associated with the container, the client identification and the password.

9. The computer-implemented method of claim 1 , wherein the sending the client identification and the password further comprises:
sending, via a management agent associated with a compute instance, the client identification and the password,
wherein the compute instance comprises the container and at least one additional container.

10. An apparatus for instantiating agents in containers, wherein tasks are performed by the instantiated agents having predetermined names, the apparatus comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the apparatus to:
receive, for a container, container configuration information comprising:
a container name; and
one or more agent identifications associated with one or more agent instances, wherein each agent identification comprises one of the predetermined names;

receive one or more agent identifications of one or more active agent instances having been instantiated in the container;
identify, based on a comparison between the container configuration information and the one or more agent identifications of the one or more active agent instances, an agent identification of a non-instantiated agent;
send, to an authentication process and based on an identification of the agent identification of the non-instantiated agent, a client identification and a password;
receive, based on the client identification and the password, an access token;
send, with the access token and based on the identification of the agent identifications of the non-instantiated agent, a request for a preconfigured agent object, wherein the request comprises the agent identification of the non-instantiated agent;
receive, based on the request, the preconfigured agent object associated with the agent identification of the non-instantiated agent;
instantiate, based on the preconfigured agent object, a new agent instance, wherein the new agent instance is associated with the container; and
schedule performance, based on the instantiation of the new agent instance, of a task by the new agent instance.

11. The apparatus of claim 10 , wherein the instructions to receive the first predetermined agent instance name further cause the apparatus to:
receive exactly one agent identification name.

12. The apparatus of claim 10 , wherein the instructions to identify the agent identification of the non-instantiated agent further cause the apparatus to:
select a first predetermined non-instantiated agent from a plurality of non-instantiated agents.

13. The apparatus of claim 10 , wherein the instructions further cause the apparatus to:
send, via an agent status application programming interface (API), the one or more predetermined agent instance names of one or more inactive agent instances.

14. The apparatus of claim 10 , wherein the instructions further cause the apparatus to:
send, via an agent status API and based on the instantiation of the new agent instance, a status of the new agent instance.

15. The apparatus of claim 10 , wherein the instructions further cause the apparatus to:
determine, based on a determination that the container has been deployed, whether at least one agent instance associated with the container is inactive; and
obtain, based on a determination that the at least one agent instance is inactive, agent instance information for the inactive at least one agent instance,
wherein the request for the preconfigured agent object is further based on the obtained agent instance information.

16. The apparatus of claim 10 , wherein the instructions to send the client identification and the password further cause the apparatus to:
send, via a management agent associated with the container, the client identification and the password.

17. The apparatus of claim 10 ,
wherein a compute instance is instantiated in the memory of the apparatus,
wherein the compute instance comprises a management agent and a task,
wherein the task comprises the container, and
wherein the instructions to determine whether the container has been deployed cause the management agent to determine whether the container has been deployed.

18. The apparatus of claim 10 ,
wherein a compute instance is instantiated in the

Assignees

• Capital One Services Llc

Inventors

• Konduru Anil
• Deshpande Amit Ramesh
• Forsberg Dillon
• Rabadia Dirgh
• Sadananda Anvitha Banakal
• Mony Jameskutty

Classifications

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title