Admission Controller Automating Change Tickets for Kubernetes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing change control systems in large-scale enterprise environments often delay code deployment to production due to limited access and training for submitting change requests, and can be circumvented by developers, leading to uncontrolled changes, especially in container orchestration systems like Kubernetes where AD authentication may not be available.
Innovation Solution
A deployment interface that includes an admission controller, mutating and validating responders, and a change management system to enforce change control by requiring change tickets for code deployment, automating the submission and validation of these tickets, and ensuring compliance with change policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual change request submission is required with limited access, then security and control are improved, but deployment time and productivity deteriorate
Solution Approach 1:
The system enables self-service automation where the deployment pipeline automatically submits change requests, attaches deployment objects, and tracks approval status without requiring manual intervention from developers. This maintains security controls while eliminating the time burden of manual processes.
Solution Approach 2:
The system performs preliminary actions by pre-submitting change requests and attaching deployment objects before actual code deployment. This ensures change control compliance is established in advance, allowing faster execution during the actual deployment phase.
2Reliability
If manual change request processes are used, then control over changes is improved, but the process can be circumvented by developers, leading to uncontrolled changes
Solution Approach 1:
The system introduces an intermediary admission controller that sits between the deployment pipeline and the production environment. This mediator automatically enforces change control policies by intercepting deployment requests, verifying change ticket approval status, and preventing unauthorized deployments without requiring developers to manually navigate complex approval processes.
Solution Approach 2:
The system implements feedback mechanisms where the admission controller continuously monitors the status of change requests and deployment objects, automatically updating the deployment pipeline based on approval status. This creates a closed-loop control system that enforces policies consistently without manual intervention.
3Reliability
If AD authentication is used for access control, then security is improved, but it cannot be implemented in container orchestration systems like Kubernetes
Solution Approach 1:
The system creates a universal change control framework that works across different orchestration systems including Kubernetes, Azure DevOps, and GitHub Actions. By implementing authentication and authorization through the admission controller layer rather than relying on AD integration, the system maintains security controls while being compatible with multiple platforms.
Data Source
AI summary
A method, comprising: receiving, by an admission controller, a deployment object associated with code that is desired to be deployed to a production system; detecting, by a first responder, whether the deployment object is associated with a change ticket and, when the deployment object is not associated with a change ticket, submitting a change ticket that is associated with the deployment object, the change ticket being submitted by the first responder; detecting, by a second responder, whether the change ticket, that is associated with the deployment object, is allowed, and, when the change ticket is allowed, authorizing a deployment of the code, the deployment being authorized by the second responder; and deploying the code to a production system when the deployment of the code has been authorized by the second responder, the code being deployed by the admission controller.