Method of automatically updating cloud infrastructure configuration with near zero downtime

Abstract

A method is provided including: determining a vulnerability associated with a first node group included in a cloud-based computing environment; deploying a second node group in the cloud-based computing environment in response to determining the vulnerability associated with the first node group; and transferring work from the first node group to the second node group.

Description

71CCS-511084-WO-2_BHI0587PCTMETHOD OF AUTOMATICALLY UPDATING CLOUD INFRASTRUCTURE CONFIGURATION WITH NEAR ZERO DOWNTIMECROSS REFERENCE TO RELATED APPLICATIONS

[0001] This application claims the benefit of an earlier filing date from Italian Application No. 102025000001800, filed January 31, 2025, the entire disclosure of which is incorporated herein by reference.BACKGROUND

[0002] Some cloud-based computing environments may be susceptible to operating system-level vulnerabilities (e.g., server level vulnerabilities) received at regular intervals. Such vulnerabilities may pose security concerns, and techniques for addressing and fixing the vulnerabilities under the shortest amount of time are desired.SUMMARY

[0003] Example embodiments of the present disclosure are directed to a computer-implemented method including: determining a vulnerability associated with a first node group included in a cloud-based computing environment; deploying a second node group in the cloudbased computing environment in response to determining the vulnerability associated with the first node group; and transferring work from the first node group to the second node group.

[0004] Example embodiments of the present disclosure are also directed to a system including: a hardware processor; and a non- transitory computer-readable medium storing instructions that, when executed by the hardware processor, cause the hardware processor to perform operations including: determining a vulnerability associated with a first node group included in a cloud-based computing environment; deploying a second node group in the cloudbased computing environment in response to determining the vulnerability associated with the first node group; and transferring work from the first node group to the second node group.

[0005] Example embodiments of the present disclosure are also directed to a computer program product including a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform operations including: determining a vulnerability associated with a first node group included in a cloud-based computing environment; deploying a second node group in the cloudbased computing environment in response to determining the vulnerability associated with the first node group; and transferring work from the first node group to the second node group.71CCS-511084-WO-2_BHI0587PCT

[0006] Further aspects supported by the present disclosure and features of example embodiments are illustrated in the accompanying drawings and / or described in the following description.BRIEF DESCRIPTION OF THE DRAWINGS

[0007] The following descriptions should not be considered limiting in any way. With reference to the accompanying drawings, like elements are numbered alike:

[0008] FIG. 1 illustrates a system supportive of automatically updating a cloud infrastructure configuration with near zero downtime in accordance with aspects of the present disclosure.

[0009] FIG. 2 illustrates an example flowchart of a method in accordance with one or more embodiments of the present disclosure.

[0010] FIG. 3 illustrates an example flowchart of a method in accordance with one or more embodiments of the present disclosure.

[0011] FIG. 4 depicts a block diagram of a processing system, which can be used for implementing the techniques described herein.

[0012] FIG. 5 illustrates an example flowchart of a method in accordance with one or more embodiments of the present disclosure.DETAILED DESCRIPTION

[0013] Some cloud-based computing environments may be susceptible to operating system-level vulnerabilities (e.g., server level vulnerabilities) received at regular intervals. Such vulnerabilities may pose security concerns, techniques for addressing and fixing the vulnerabilities at the earliest and under the shortest amount of time are desired.

[0014] For example, some current approaches include a manual intervention for remediating raised issues (e.g., vulnerabilities) prior to the issues becoming a security threat. Such manual intervention may be time consuming and prone to human error.

[0015] A detailed description of one or more embodiments of the disclosed apparatus and method are presented herein by way of exemplification and not limitation with reference to the Figures.

[0016] FIG. 1 illustrates a system 100 supportive of automatically updating a cloud infrastructure configuration 111 with near zero downtime in accordance with aspects of the present disclosure. The system 100 provides a platform supportive of automatically updating the cloud infrastructure configuration 111 with near zero downtime.71CCS-511084-WO-2_BHI0587PCT

[0017] The platform may support traffic handling of data (e.g., data traffic 156 later described herein) associated with, for example, an end-to-end carbon capture, utilization, and storage (CCUS) value chain. It is to be understood herein that the example aspects described herein reference to the functions provided by systems (e.g., system 100, system 400 later described herein, and the like) may be implemented with respect to handling data traffic for an entire CCUS value chain, which includes data indicative of capture, storage, transportation, and utilization, but embodiments of the present disclosure are not limited thereto.

[0018] The system 100 may include a cloud-based computing environment 105. The cloud-based computing environment 105 may include an application load balancer 107, a cluster 110 (e.g., Kubernetes (K8s) cluster), node groups 115, and virtual machines 117 (e.g., elastic compute cloud (EC2) instances, also referred to herein as instances). In some aspects, the virtual machines 117 may be referred to as virtual servers or virtual machine servers, and the virtual machines may be software-based servers created by partitioning a physical server into multiple virtual machines.

[0019] Each node group 115 includes a collection of virtual machines 117 grouped together, which supports effective management and application of consistent policies across all virtual machines 117 within the node group 115. For example, node group 115-a includes virtual machine 117-al through virtual machine 117-a7 (i.e., seven instances), and node group 115-b includes virtual machine 117-bl through virtual machine 117-b7 (i.e., seven instances). Each virtual machine 117 may run on physical compute node inside the cloud-based computing environment 105.

[0020] Utilizing a quantity of seven virtual machines 117 for each node group 115 may support effective automatic updating of the cloud infrastructure configuration 111 with near zero downtime in accordance with the techniques described herein. However, embodiments of the present disclosure are not limited thereto.

[0021] For example, the quantity of node groups 115 and the quantity of virtual machines 117 for each node group 115 may be configured according to target specifications of a given project. In an example implementation, the cloud infrastructure configuration 111 may include a minimum of two node groups 115 (e.g., node group 115-a, node group 115-b) and two virtual machines 117 (e.g., virtual machine 117-al, virtual machine 117-bl) respectively assigned to the two node groups 115. Expressed another way, the cloud infrastructure configuration 111 may include a single virtual machine 117 per each node group 115, and a minimum of two node groups 115. In another example, the cloud infrastructure configuration71CCS-511084-WO-2_BHI0587PCTIll may include multiple virtual machines 117 per each node group 115, and a minimum of two node groups 115.

[0022] The cloud-based computing environment 105 may include, for each virtual machine 117, a machine image 120 that contains the state of the virtual machine 117, including the operating system, applications, and data associated with the virtual machine 117. For example, machine image 120-a may contain the respective states of virtual machine 117-al through virtual machine 117-a7. Each machine image 120 includes a virtual disk that holds a bootable operating system and provides templates for file systems of a virtual machine 117.

[0023] The system 100 may support features for configuring the cloud-based computing environment 105. For example, the system 100 provides features for automatically updating the cloud infrastructure configuration 111 with near zero downtime.

[0024] As will be described herein, aspects of the system 100 overcome shortcomings associated with some other manual approaches for updating a cloud infrastructure configuration.

[0025] For example, the system 100 includes a configuration engine 125 which may implement an updater platform described herein. The configuration engine 125 may include a code pipeline 130. The configuration engine 125 may include and implement a set of scripts (e.g., Python scripts or the like) and deployment files. In the example illustrated at FIG. 1, the configuration engine 125 may be in communication with the node group 115-a, the node group 115-b, or another node group 115 (not illustrated). Embodiments of the present disclosure are not limited thereto, and the configuration engine 125 may communicate (e.g., exchange data via wired or wireless techniques) with any components (e.g., a cluster 110) included in the cloud-based computing environment 105.

[0026] A deployment file (also referred to herein as deployments) is a building block for managing containerized applications in a Kubernetes cluster (e.g., cluster 110). A deployment file is an API resource and a higher-level abstraction that provides a declarative way to manage and scale a set of identical pods. Each node group 115 can have multiple pods, and each pod may be run on a virtual machine 117 included in the node group 115. Non-limiting examples of the deployment file includes a Kubernetes deployment YAML file (commonly also known as configuration files or manifests).

[0027] The configuration engine 125 may generate a code build 135 for running the deployment files in a target cloud account (e.g., the cloud-based computing environment 105). In some examples, the configuration engine 125 may generate the code build 135 using a build71CCS-511084-WO-2_BHI0587PCTservice (e.g., AWS CodeBuild, or the like) capable of compiling provided source code, running unit tests, and producing artifacts that are ready to deploy.

[0028] The configuration engine 125 may implement process flows (e.g., method 200 and method 300, later described herein at FIG. 2 and FIG. 3) supportive of automatically updating the cloud infrastructure configuration 111 in accordance with one or more embodiments of the present disclosure. The process flows are automated workflows which may cater to fix OS vulnerabilities (e.g., at a virtual machine 117, at a machine image 120) in a proactive manner and without significant customer downtime. Non-limiting examples of the OS vulnerabilities include security issues such as, for example, vulnerabilities to security threats, failure, infection, and the like.

[0029] The configuration engine 125 may access data from any of the components of system 100 such as, for example, cloud-based computing environment 105, sensors 140, an IOT core 145, a service 150 (e.g., an object storage service), a job scheduler 155 (e.g., a cron scheduler, or the like). So as not to obstruct from FIG. 1, communication lines between the configuration engine 125 and other components of the system 100 (e.g., sensors 140, IOT core 145, service 150, a job scheduler 155, or the like) are not illustrated. The configuration engine 125 may aggregate the data, forward the data, process the data, and / or provide additional data to any of the components in association with implementing features of the system 100 described herein.

[0030] Non-limiting examples of technical benefits provided by the configuration engine 125 and associated process flow include: proactive vulnerability fixes, effectively addressing system security threats, elimination of manual intervention, near zero customer downtime, an auto-upgrade service catalog product version, and zero (or reduced) configuration error occurrence via automation.

[0031] Aspects of the features provided by the system 100 are cloud-agnostic. The configuration engine 125 may be compatible with various cloud platforms of different cloud providers, regardless of underlying infrastructure or operating dependencies of the cloud platforms.

[0032] As described herein, the system 100 provides automated application and database failover with minimum manual intervention. The system 100 provides automated application and database failover, with near- zero downtime, by automatically identifying and resolving issues in environments with a node group 115 of a cluster 110 (for example, vulnerabilities associated with an operating system (OS) running on a virtual machine 117 included in the node group 115), using cloud-native architecture. For example, the system 10071CCS-511084-WO-2_BHI0587PCTprovides a custom automated workflow capable of fixing OS vulnerabilities to function, end to end, within about 20 minutes considering the example specifications: 1 cluster 110, 1 node group 115, 7 virtual machines 117. In contrast, for example, other approaches for fixing such vulnerabilities according to the same specifications may take up to about 3 to 5 hours.

[0033] The updated platform enabled by the system 100 may update an application in the cloud-based computing environment 105 in an automatic manner, with effective accuracy and reduced downtime. For example, the system 100 provides automated production traffic handling (e.g., handling data traffic 156) which may ensure near zero downtime for customers. In some embodiments, the application may be an application which supports data operations (e.g., data monitoring, measurement, and the like) for an entire CCUS value chain, which includes capture, storage, transportation, and utilization.

[0034] The system 100 integrates cloud data, artificial intelligence of things (AIoT), edge computing, and machine learning in providing automation and digitalization. Through the integration, the system 100 may effectively provide automated operations supportive of AIoT solutions for an industry to achieve near- zero downtime, zero faults, and zero carbon emissions with respect to CCUS operations.

[0035] The sensors 140 (also referred to herein as device sensors) may respectively be associated with measuring performance of connected assets 141 associated with CCUS operations. In the example illustrated at FIG. 1, the connected assets 141 may include asset 141-a (e.g., an industrial plant), asset 141-b (e.g., a utilization plant), asset 141-c (e.g., a storage site (well or reservoir)) (also referred to herein as a sequestration site), asset 141-d (e.g., a compressor), and asset 141-e (e.g., a processing plant, for example, a chilled ammonia process plant I DAC). The sensors 140 may provide measured data in real-time or based on other criteria (e.g., a temporal period, a trigger condition, or the like). In some aspects, the sensors 140 may provide metrics associated with a performance parameter between different connected assets 141. In some aspects, the sensors 140 and the connected assets 141 may exchange data with one another.

[0036] For example, sensor 140-a may provide GHG / flue gas metrics associated with asset 141-a. In another example, sensor 140-b may provide pipeline metrics (e.g., CO2 transportation metric). For example, sensor 140-b may provide flow, temperature, and pressure data regarding the flow of CO2 between different connected assets 141 (e.g., between asset 141-b, asset 141-c, and / or asset 141-d). Accordingly, for example, sensor 140-b may provide metrics associated with transporting a product (e.g., CO2) associated with the CCUS value chain between different connected assets 141. Similarly, for example, the system 100 may71CCS-511084-WO-2_BHI0587PCTinclude other sensors 140-b (not illustrated) capable of providing pipeline metrics (e.g., flow, temperature, and pressure data) regarding the flow of CO2 between other connected assets 141 (e.g., between asset 141-d and asset 141-e, between asset 141-a and asset 141-e, and the like).

[0037] In another example, sensors 140-c associated with the asset 141-c may provide sensor data associated with a well site. For example, sensors 140-c may respectively provide pressure and temperature (PT) gauge electrical and optical data, distributed acoustic and temperature data, and surface metering data (e.g., associated with zone flow and wellhead protection (WHP)) associated with the well site. In another example, sensor 140-d may provide metrics related to the health of the asset 141-d and case operations. For example, sensor 140-d may provide pressure, volume, and temperature measurements associated with the asset 141-d. In an example, the sensor 140-d may measure timeseries tags real-time readings. The realtime readings may include different types of flow, volume, and temperature. In another example, sensor 140-e may provide data related to actual carbon capture by the asset 141-e versus target metrics. For example, sensor 140-e may provide pressure, volume, and temperature measurements associated with the asset 141-e. In an example, the sensor 140-e may measure timeseries tags real-time readings. The real-time readings may include different types of flow, volume, and temperature.

[0038] The IOT core 145 may enable secure two-way communication between internet-connected devices (e.g., sensors 140) and services with device gateway and device SDK capabilities. For example, the IOT core 145 may enable communication between sensors 140 and the cloud-based computing environment 105.

[0039] The service 150 may be an object storage service that provides object storage through a web service interface.

[0040] At 155, the system 100 may provide data traffic 156 (e.g., external traffic, customer live data) to the cloud-based computing environment 105. The data traffic 156 may include, for example, data provided by sensors 140. Accordingly, for example, the system 100 may provide data from an edge of a network to the cloud-based computing environment 105.

[0041] FIG. 2 illustrates an example flowchart of a method 200 in accordance with one or more embodiments of the present disclosure. The method 200 is an example computer-implemented method that may be implemented by the configuration engine 125 described herein.

[0042] At 205, the method 200 includes determining a vulnerability associated with node group 115-a included in the cloud-based computing environment 105. For example, at 205, the method 200 may include identifying that a vulnerability associated with the node group71CCS-511084-WO-2_BHI0587PCT115-a exists. In an example, the node group 115-a includes a set of first virtual machines 117 (e.g., virtual machine 117-al through virtual machine 117-a7), and the method 200 may include determining the vulnerability is associated with an operating system running on virtual machine 117-a7.

[0043] At 210, the method 200 includes deploying node group 115-b in the cloud-based computing environment 105 in response to determining the vulnerability associated with the node group 115-a.

[0044] At 215, the method 200 includes transferring work from the node group 115-a to the node group 115-b.

[0045] In an example, transferring the work from the node group 115-a to the node group 115-b includes transferring at least a portion of the work to a virtual machine 117 among a set of second virtual machines 117-b (e.g., virtual machine 117-bl through virtual machine 117-b7) included in the node group 115-b. For example, the method may include transferring the work to virtual machine 117-b7, which is running a different version of the operating system running on the virtual machine 117-a7.

[0046] In some embodiments, the method 200 may include autonomously transferring the work from the node group 115 -a to the node group 115-b while replacing machine images (e.g., Amazon machine images (AMIs)) (i.e., vulnerable available machines) from the node group 115-a to the node group 115-b when a machine image rotation script (e.g., an AMI rotation script) from code build 135 is triggered.

[0047] In an example, the set of first virtual machines 117-a (e.g., virtual machine 117-al through virtual machine 117-a7) included in the node group 115-a may be respectively different from the set of second virtual machines 117-b (e.g., virtual machine 117-bl through virtual machine 117-b7) included in the node group 115-b. That is, for example, in creating the node group 115-b, the method 200 may include deploying virtual machine 117-bl through virtual machine 117-b7 in place of virtual machine 117-al through virtual machine 117-a7.

[0048] In another example, the set of first virtual machines 117-a (e.g., virtual machine 117-al through virtual machine 117-a7) included in the node group 115-a may partially overlap the set of second virtual machines 117-b (e.g., virtual machine 117-bl through virtual machine 117-b7) included in the node group 115-b. That is, for example, in creating the node group 115-b, the method 200 may include (not illustrated) maintaining virtual machine 117-al through virtual machine 117-a6, for which no vulnerability is detected, and deploying virtual machine 117-b7 in place of the virtual machine 117-a7, for which a vulnerability is detected.71CCS-511084-WO-2_BHI0587PCT

[0049] In some aspects, the node group 115-b may not yet be included or configured in the infrastructure configuration 111. In some other aspects, the node group 115-b may be already included in the cloud-based computing environment 105 but not currently in use in the cloud infrastructure configuration 111. That is, for example, embodiments of the present disclosure may include temporarily storing and swapping virtual machines 117 and / or entire node groups 115, and the storing may support relatively quick updating of the cloud infrastructure configuration 111 (e.g., through swapping individual virtual machines 117 and / or swapping entire node groups 115) with minimal downtime.

[0050] Accordingly, for example, the method 200 may include modifying the cloud infrastructure configuration 111 of the cloud-based computing environment 105 in response to determining the vulnerability associated with the node group 115-a.

[0051] At 220, the method 200 includes remediating the vulnerability associated with the node group 115-a (i.e., the vulnerability associated with the operating system running on the virtual machine 117-a7). Remediating the vulnerability may include, for example, identifying and fixing a security flaw associated with the operating system running on the virtual machine 117-a7.

[0052] At 225, the method 200 includes transferring the work from the node group 115-b to the node group 115-a, after or while remediating the vulnerability associated with the node group 115-a. Accordingly, for example, the method 200 may include returning the work back to the node group 115-a. The method 200 may include returning the portion of the work, which was transferred to the virtual machine 117-b7, back to the virtual machine 117-a7. In some embodiments, after the work is returned to the node group 115-a and the virtual machine 117-a7, the node group 115-b and virtual machine 117-b7 may be freed (e.g., since work is transferred away from the node group 115-b and virtual machine 117-b7). As each node group 115 is a logical collection of virtual machines 117, the method 200 may include maintaining the node groups 115 (e.g., node group 115-a and node group 115-b), but deleting any underlying virtual machines 117 (e.g., EC2 machines) which are rotated (and had vulnerabilities).

[0053] In some aspects, the described work which is transferred between node groups 115 using the techniques described herein is associated with data operations associated with a CCUS value chain, and the data operations may include data monitoring and measurement. The data operations may include monitoring, measuring, and processing of data traffic 156.

[0054] FIG. 3 illustrates an example flowchart of a method 300 in accordance with one or more embodiments of the present disclosure. The method 300 is an example computer-71CCS-511084-WO-2_BHI0587PCTimplemented method that may be implemented by the example aspects of the configuration engine 125 described herein. The method 300 may be implemented as an automated end-to-end workflow for automatically updating the cloud infrastructure configuration 111 with near zero downtime in CCUS operations.

[0055] At 305, the method 300 may include feeding data traffic 156 from a customer on a real-time basis to an application (or feeding the data traffic 156 to a customer device associated with running the application). The data traffic 156 may be provided by devices such as, for example, sensors 140, IOT core 145, or service 150. The data traffic 156 may be customer data associated with data operations of a CCUS value chain as described herein. In an example, the application may be running on node group 115-a. For example, the application may be running on one or more virtual machines 117 included in node group 115-a.

[0056] At 310, the method 300 may include triggering a specific job. For example, the job scheduler 155 may trigger execution of a specific job. In an example, the job scheduler 155 may trigger execution of the job based on a schedule. Additionally, or alternatively, the job may be manually triggered (e.g., based on a user input).

[0057] At 315, the method 300 may include executing or running a script at the code pipeline 130. For example, the configuration engine 125 may execute or run a script at the code pipeline 130. The script may be an automation pipeline script which runs scripts and commands in a sequence in association with automating a process, and in which the output of one script becomes the input for the next script in the series.

[0058] At 320, the method 300 may include running one or more jobs on a target server. For example, the configuration engine 125 may run one or more jobs on a target server. In an example, the configuration engine 125 may run one or more jobs on a virtual machine 117 (e.g., virtual machine 117-a7) of node group 115-a. In an example, the jobs may be included in code build 135 and be generated using a build service as described with reference to FIG. 1.

[0059] At 325, the method 300 may include rotating virtual machines 117 (e.g., virtual machine 117-al through virtual machine 117-a7) included in node group 115-a (in this example, referred to as ‘Node Group 1’). In an example, the method 300 may include executing a machine image rotation script (e.g., an AMI rotation script) for rotating the virtual machines 117. In some aspects, rotating the virtual machines 117 may include rotating out (e.g., removing) a virtual machine 117-a (e.g., virtual machine 117-a7) for which a security flaw has been determined as described herein.

[0060] In an example, rotating the virtual machines 117 may include importing other virtual machines 117 to the node group 115-a as ready-to-use instances from an existing71CCS-511084-WO-2_BHI0587PCTenvironment (e.g., a user’s on-premises virtualization infrastructure), in which the other virtual machines 117 are pre-built and meet target IT security, configuration management, and compliance requirements. In some aspects, rotating the virtual machines 117 may include exporting the imported virtual machines 117 back to the existing environment.

[0061] At 330, the method 300 may include transferring work from the node group 115-a to the node group 115-b (in this example, referred to as ‘Node Group 2’). Transferring the work may include aspects of transferring work as described with reference to 215 of FIG.2). In an example, the configuration engine 125 may transfer the work from the node group 115-a to the node group 115-b.

[0062] In an example of transferring work at 330, the method 300 may include transferring the traffic flow of the application running on node group 115-a to another existing node group 115 included in the cloud infrastructure configuration 111. For example, the method 300 may include transferring the traffic flow of the application to node group 115-b. In some embodiments, the method 300 may include transferring the traffic flow of the application to node group 115-b, while (or after) rotating the virtual machines 117 (e.g., virtual machine 117-al through virtual machine 117-a7) included in node group 115-a. In some embodiments, the method 300 may include transferring the traffic flow of the application to a virtual machine 117-b (e.g., virtual machine 117-b7, or multiple virtual machines 117-b) of the node group 115-b.

[0063] At 335, the method 300 may include rotating virtual machines 117 (e.g., virtual machine 117-bl through virtual machine 117-b7) included in node group 115-b. In an example, the method 300 may include executing a machine image rotation script (e.g., an AMI rotation script) described herein for rotating the virtual machines 117. In some aspects, rotating the virtual machines 117 may include rotating out (e.g., removing) a virtual machine 117-b to which the work (and traffic flow) was previously transferred.

[0064] At 340, the method 300 may include transferring work from the node group 115-b back to the node group 115-a. Transferring the work may include aspects of transferring work as described with reference to 225 of FIG. 2). In an example, the configuration engine 125 may transfer the work from the node group 115-b to the node group 115-a.

[0065] In an example of transferring work at 340, the method 300 may include transferring the traffic flow of the application running on node group 115-b back to node group 115-a. In some embodiments, the method 300 may include transferring the traffic flow of the application to node group 115-a, while (or after) rotating the virtual machines 117 (e.g., virtual machine 117-bl through virtual machine 117-b7) included in node group 115-b. In some71CCS-511084-WO-2_BHI0587PCTembodiments, the method 300 may include transferring the traffic flow of the application to a virtual machine 117-a (e.g., virtual machine 117-a7, or multiple virtual machines 117-a) of the node group 115-a.

[0066] In an example, the method 300 may include repairing the security flaw of the virtual machine 117-a (e.g., virtual machine 117-a7) which was rotated out (e.g., removed) from node group 115-a. At 340, the method 300 may include transferring the traffic flow of the application back to the virtual machine 117-a (e.g., virtual machine 117-a7) after the security flaw is repaired and the virtual machine 117-a is rotated back into the node group 115-a.

[0067] At 350, the method 300 may include distributing traffic load among both node group 115-a and node group 115-b based on a case in which node group 115-a and node group 115-b are completely operational (e.g., full capacity of each node group 115, no security flaws are present). For example, for a case in which node group 115-a and node group 115-b are completely operational, vulnerabilities of node group 115-a and node group 115-b have been remediated.

[0068] It is understood that embodiments of the present disclosure are capable of being implemented in conjunction with any suitable type of computing environment now known or later developed.

[0069] For example, FIG. 4 depicts a block diagram of a processing system 400, which can be used for implementing the techniques described herein. For example, aspects described herein of the systems described herein (e.g., system 100, cloud-based computing environment 105, configuration engine 125) may be implemented by the processing system 400.

[0070] In examples, processing system 400 has one or more central processing units (processors) 421a, 421b, 421c, etc. (collectively or generically referred to as processor(s) 421 and / or as processing device(s)). In aspects of the present disclosure, each processor 421 can include a reduced instruction set computer (RISC) microprocessor. Processors 421 are coupled to system memory (e.g., random access memory (RAM) 424) and various other components via a system bus 433. Read only memory (ROM) 422 is coupled to system bus 433 and can include a basic input / output system (BIOS), which controls certain basic functions of processing system 400.

[0071] Further illustrated are an input / output (FO) adapter 427 and a communications adapter 426 coupled to system bus 433. FO adapter 427 can be a small computer system interface (SCSI) adapter that communicates with a hard disk 423 and / or a tape storage drive 425 or any other similar component. FO adapter 427, hard disk 423, and tape storage drive 425 are collectively referred to herein as mass storage 434. Operating system 440 for execution on71CCS-511084-WO-2_BHI0587PCTprocessing system 400 can be stored in mass storage 434. A network adapter 426 interconnects system bus 433 with an outside network 436 enabling processing system 400 to communicate with other such systems.

[0072] A display (e.g., a display monitor) 435 is connected to system bus 433 by display adaptor 432, which can include a graphics adapter to improve the performance of graphics intensive applications and a video controller. In one aspect of the present disclosure, adapters 426, 427, and / or 432 can be connected to one or more I / O busses that are connected to system bus 433 via an intermediate bus bridge (not shown). Suitable I / O buses for connecting peripheral devices such as hard disk controllers, network adapters, and graphics adapters typically include common protocols, such as the Peripheral Component Interconnect (PCI). Additional input / output devices are shown as connected to system bus 433 via user interface adapter 428 and display adapter 432. A keyboard 429, mouse 430, and speaker 431 can be interconnected to system bus 433 via user interface adapter 428, which can include, for example, a Super I / O chip integrating multiple device adapters into a single integrated circuit.

[0073] In some aspects of the present disclosure, processing system 400 includes a graphics processing unit 437. Graphics processing unit 437 is a specialized electronic circuit designed to manipulate and alter memory to accelerate the creation of images in a frame buffer intended for output to a display. In general, graphics processing unit 437 is very efficient at manipulating computer graphics and image processing and has a highly parallel structure that makes it more effective than general-purpose CPUs for algorithms where processing of large blocks of data is done in parallel.

[0074] Thus, as configured herein, processing system 400 includes processing capability in the form of processors 421, storage capability including system memory (e.g., RAM 424), and mass storage 434, input means such as keyboard 429 and mouse 430, and output capability including speaker 431 and display 435. In some aspects of the present disclosure, a portion of system memory (e.g., RAM 424) and mass storage 434 collectively store an operating system 440 to coordinate the functions of the various components shown in processing system 400.

[0075] Embodiments of the present disclosure support computer implemented methods of real-time monitoring and root cause identification performed by the system 100 and processing system 400 described herein. In some aspects, the methods may be implemented by an integrated asset model supportive of real time monitoring of a CCUS value chain as described herein.71CCS-511084-WO-2_BHI0587PCT

[0076] FIG. 5 illustrates an example flowchart of a method 500 in accordance with one or more embodiments of the present disclosure. The method 500 is an example computer-implemented method that may be implemented by the example aspects of a system and / or a computing device as described herein (e.g., system 100, processing system 400).

[0077] At 505, the method 500 includes determining a vulnerability associated with a first node group included in a cloud-based computing environment.

[0078] At 510, the method 500 includes deploying a second node group in the cloudbased computing environment in response to determining the vulnerability associated with the first node group.

[0079] At 515, the method 500 includes transferring work from the first node group to the second node group.

[0080] In some aspects, the first node group includes a set of first virtual machines; and the vulnerability is associated with an operating system running on a first virtual machine among the set of first virtual machines.

[0081] In some aspects, transferring the work from the first node group to the second node group includes transferring at least a portion of the work to a second virtual machine among a set of second virtual machines included in the second node group; and the second virtual machine is running a different version of the operating system running on the first virtual machine.

[0082] In some aspects, the method 500 may include remediating the vulnerability associated with the first node group; and transferring the work from the second node group to the first node group, after remediating the vulnerability associated with the first node group.

[0083] In some aspects, the second node group is an existing node group included in the cloud-based computing environment.

[0084] In some aspects, the work is associated with data operations associated with a carbon capture, utilization, and storage value chain, and the data operations include data monitoring and measurement.

[0085] In some aspects, transferring the work from the first node group to the second node group includes transferring traffic flow of an application running on a first virtual machine included in the first node group to a second virtual machine included in the second node group.

[0086] In some aspects, the traffic flow includes data associated with an end-to-end carbon capture, utilization, and storage (CCUS) value chain.

[0087] In some aspects, the method 500 may include rotating a first virtual machine out of the first node group, where the vulnerability is associated with an operating system71CCS-511084-WO-2_BHI0587PCTrunning on the first virtual machine, where transferring the work from the first node group to the second node group is after or during the rotating the first virtual machine out of the first node group.

[0088] In some aspects, the method 500 may include rotating a second virtual machine out of the second node group; and transferring the work from the second node group to the first node group, where transferring the work from the second node group to the first node group is after or during the rotating the second virtual machine out of the second node group.

[0089] In some aspects, the method 500 may include distributing a traffic load among the first node group and the second node group, where distributing the traffic load is after transferring the work from the second node group to the first node group.

[0090] In the descriptions of the flowcharts herein, the operations may be performed in a different order than the order shown, or the operations may be performed in different orders or at different times. Certain operations may also be left out of the flowcharts, one or more operations may be repeated, or other operations may be added to the flowcharts. The process flows are automated workflows which may be implemented by systems (e.g., system 100, system 400) and computing devices described herein in association with fixing OS vulnerabilities (e.g., at a virtual machine 117, at a machine image 120) in a proactive manner.

[0091] Set forth below are some embodiments of the foregoing disclosure:

[0092] Embodiment 1. A computer-implemented method comprising: determining a vulnerability associated with a first node group comprised in a cloud-based computing environment; deploying a second node group in the cloud-based computing environment in response to determining the vulnerability associated with the first node group; and transferring work from the first node group to the second node group.

[0093] Embodiment 2. The computer-implemented method of Embodiment 1, wherein: the first node group comprises a set of first virtual machines; and the vulnerability is associated with an operating system running on a first virtual machine among the set of first virtual machines.

[0094] Embodiment 3. The computer-implemented method of any of Embodiment 1 through Embodiment 2, wherein: transferring the work from the first node group to the second node group comprises transferring at least a portion of the work to a second virtual machine among a set of second virtual machines comprised in the second node group; and the second virtual machine is running a different version of the operating system running on the first virtual machine.71CCS-511084-WO-2_BHI0587PCT

[0095] Embodiment 4. The computer-implemented method of any of Embodiment 1 through Embodiment 3, further comprising: remediating the vulnerability associated with the first node group; and transferring the work from the second node group to the first node group, after remediating the vulnerability associated with the first node group.

[0096] Embodiment 5. The computer-implemented method of any of Embodiment 1 through Embodiment 4, wherein: the second node group is an existing node group comprised in the cloud-based computing environment.

[0097] Embodiment 6. The computer-implemented method of any of Embodiment 1 through Embodiment 5, wherein: the work is associated with data operations associated with a carbon capture, utilization, and storage value chain, and the data operations comprise data monitoring and measurement.

[0098] Embodiment 7. The computer-implemented method of any of Embodiment 1 through Embodiment 6, wherein transferring the work from the first node group to the second node group comprises transferring traffic flow of an application running on a first virtual machine comprised in the first node group to a second virtual machine comprised in the second node group.

[0099] Embodiment 8. The computer-implemented method of any of Embodiment 1 through Embodiment 7, wherein the traffic flow comprises data associated with an end-to-end carbon capture, utilization, and storage (CCUS) value chain.

[0100] Embodiment 9. The computer-implemented method of any of Embodiment 1 through Embodiment 8, further comprising: rotating a first virtual machine out of the first node group, wherein the vulnerability is associated with an operating system running on the first virtual machine, wherein transferring the work from the first node group to the second node group is after or during the rotating the first virtual machine out of the first node group.

[0101] Embodiment 10. The computer- implemented method of any of Embodiment 1 through Embodiment 9, further comprising: rotating a second virtual machine out of the second node group; and transferring the work from the second node group to the first node group, wherein transferring the work from the second node group to the first node group is after or during the rotating the second virtual machine out of the second node group.

[0102] Embodiment 11. The computer- implemented method of any of Embodiment 1 through Embodiment 10, further comprising: distributing a traffic load among the first node group and the second node group, wherein distributing the traffic load is after transferring the work from the second node group to the first node group.71CCS-511084-WO-2_BHI0587PCT

[0103] Embodiment 12. A system comprising: a hardware processor; and a non-transitory computer-readable medium storing instructions that, when executed by the hardware processor, cause the hardware processor to perform operations comprising: determining a vulnerability associated with a first node group comprised in a cloud-based computing environment; deploying a second node group in the cloud-based computing environment in response to determining the vulnerability associated with the first node group; and transferring work from the first node group to the second node group.

[0104] Embodiment 13. The system of Embodiment 12, wherein: the first node group comprises a set of first virtual machines; and the vulnerability is associated with an operating system running on a first virtual machine among the set of first virtual machines.

[0105] Embodiment 14. The system of any of Embodiment 12 through Embodiment 13, wherein the instructions, when executed by the hardware processor, cause the hardware processor to perform further operations comprising: transferring the work from the first node group to the second node group comprises transferring at least a portion of the work to a second virtual machine among a set of second virtual machines comprised in the second node group; and the second virtual machine is running a different version of the operating system running on the first virtual machine.

[0106] Embodiment 15. The system of any of Embodiment 12 through Embodiment 14, wherein the instructions, when executed by the hardware processor, cause the hardware processor to perform further operations comprising: remediating the vulnerability associated with the first node group; and transferring the work from the second node group to the first node group, after remediating the vulnerability associated with the first node group.

[0107] Embodiment 16. The system of any of Embodiment 12 through Embodiment 15, wherein the second node group is an existing node group comprised in the cloud-based computing environment.

[0108] Embodiment 17. The system of any of Embodiment 12 through Embodiment 16, wherein the work is associated with data operations associated with a carbon capture, utilization, and storage value chain, and the data operations comprise data monitoring and measurement.

[0109] Embodiment 18. The system of any of Embodiment 12 through Embodiment 17, wherein transferring the work from the first node group to the second node group comprises transferring traffic flow of an application running on a first virtual machine comprised in the first node group to a second virtual machine comprised in the second node group.71CCS-511084-WO-2_BHI0587PCT

[0110] Embodiment 19. The system of any of Embodiment 12 through Embodiment 18, wherein the traffic flow comprises data associated with an end-to-end carbon capture, utilization, and storage (CCUS) value chain.

[0111] Embodiment 20. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform operations comprising: determining a vulnerability associated with a first node group comprised in a cloud-based computing environment; deploying a second node group in the cloud-based computing environment in response to determining the vulnerability associated with the first node group; and transferring work from the first node group to the second node group.

[0112] The use of the terms “a” and “an” and “the” and similar referents in the context of describing the invention (especially in the context of the following claims) are to be construed to cover both the singular and the plural, unless otherwise indicated herein or clearly contradicted by context. Further, it should be noted that the terms “first,” “second,” and the like herein do not denote any order, quantity, or importance, but rather are used to distinguish one element from another. The terms “about”, “substantially” and “generally” are intended to include the degree of error associated with measurement of the particular quantity based upon the equipment available at the time of filing the application. For example, “about” and / or “substantially” and / or “generally” can include a range of ± 8% of a given value.

[0113] The teachings of the present disclosure may be used in a variety of well operations. These operations may involve using one or more treatment agents to treat a formation, the fluids resident in a formation, a borehole, and I or equipment in the borehole, such as production tubing. The treatment agents may be in the form of liquids, gases, solids, semi-solids, and mixtures thereof. Illustrative treatment agents include, but are not limited to, fracturing fluids, acids, steam, water, brine, anti-corrosion agents, cement, permeability modifiers, drilling muds, emulsifiers, demulsifiers, tracers, flow improvers etc. Illustrative well operations include, but are not limited to, hydraulic fracturing, stimulation, tracer injection, cleaning, acidizing, steam injection, water flooding, cementing, etc.

[0114] While the invention has been described with reference to an exemplary embodiment or embodiments, it will be understood by those skilled in the art that various changes may be made and equivalents may be substituted for elements thereof without departing from the scope of the invention. In addition, many modifications may be made to adapt a particular situation or material to the teachings of the invention without departing from the essential scope thereof. Therefore, it is intended that the invention not be limited to the71CCS-511084-WO-2_BHI0587PCTparticular embodiment disclosed as the best mode contemplated for carrying out this invention, but that the invention will include all embodiments falling within the scope of the claims. Also, in the drawings and the description, there have been disclosed exemplary embodiments of the invention and, although specific terms may have been employed, they are unless otherwise stated used in a generic and descriptive sense only and not for purposes of limitation, the scope of the invention therefore not being so limited.

Claims

71CCS-511084-WO-2_BHI0587PCTCLAIMSWhat is claimed is:

1. A computer- implemented method characterized by:determining a vulnerability associated with a first node group comprised in a cloudbased computing environment;deploying a second node group in the cloud-based computing environment in response to determining the vulnerability associated with the first node group; andtransferring work from the first node group to the second node group.

2. The computer-implemented method of claim 1, wherein:the first node group comprises a set of first virtual machines; andthe vulnerability is associated with an operating system running on a first virtual machine among the set of first virtual machines.

3. The computer-implemented method of claim 2, wherein:transferring the work from the first node group to the second node group comprises transferring at least a portion of the work to a second virtual machine among a set of second virtual machines comprised in the second node group; andthe second virtual machine is running a different version of the operating system running on the first virtual machine.

4. The computer-implemented method of claim 1, further comprising: remediating the vulnerability associated with the first node group; and transferring the work from the second node group to the first node group, after remediating the vulnerability associated with the first node group.

5. The computer-implemented method of claim 1, wherein:the second node group is an existing node group comprised in the cloud-based computing environment.

6. The computer-implemented method of claim 1, wherein:the work is associated with data operations associated with a carbon capture, utilization, and storage value chain, and the data operations comprise data monitoring and measurement.

7. The computer- implemented method of claim 1, wherein transferring the work from the first node group to the second node group comprises transferring traffic flow of an application running on a first virtual machine comprised in the first node group to a second virtual machine comprised in the second node group.71CCS-511084-WO-2_BHI0587PCT8. The computer-implemented method of claim 7, wherein the traffic flow comprises data associated with an end-to-end carbon capture, utilization, and storage (CCUS) value chain.

9. The computer-implemented method of claim 1, further comprising: rotating a first virtual machine out of the first node group, wherein the vulnerability is associated with an operating system running on the first virtual machine,wherein transferring the work from the first node group to the second node group is after or during the rotating the first virtual machine out of the first node group.

10. The computer-implemented method of claim 1, further comprising: rotating a second virtual machine out of the second node group; andtransferring the work from the second node group to the first node group, wherein transferring the work from the second node group to the first node group is after or during the rotating the second virtual machine out of the second node group.

11. The computer-implemented method of claim 10, further comprising: distributing a traffic load among the first node group and the second node group, wherein distributing the traffic load is after transferring the work from the second node group to the first node group.

12. A system characterized by:a hardware processor; anda non-transitory computer-readable medium storing instructions that, when executed by the hardware processor, cause the hardware processor to perform operations comprising: determining a vulnerability associated with a first node group comprised in a cloudbased computing environment;deploying a second node group in the cloud-based computing environment in response to determining the vulnerability associated with the first node group; andtransferring work from the first node group to the second node group.

13. The system of claim 12, wherein:the first node group comprises a set of first virtual machines; andthe vulnerability is associated with an operating system running on a first virtual machine among the set of first virtual machines.

14. The system of claim 13, wherein the instructions, when executed by the hardware processor, cause the hardware processor to perform further operations comprising:71CCS-511084-WO-2_BHI0587PCTtransferring the work from the first node group to the second node group comprises transferring at least a portion of the work to a second virtual machine among a set of second virtual machines comprised in the second node group; andthe second virtual machine is running a different version of the operating system running on the first virtual machine.

15. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform operations comprising:determining a vulnerability associated with a first node group comprised in a cloudbased computing environment;deploying a second node group in the cloud-based computing environment in response to determining the vulnerability associated with the first node group; andtransferring work from the first node group to the second node group.

Images