Access Manager for CI Build Jobs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems in continuous integration environments lack the ability to regulate data access via specific communication protocols, leading to security and reliability issues, as well as poor resource utilization and delays in job execution.
Innovation Solution
An access manager is introduced to manage data access by implementing system-based and pipeline-based access lists, which allow or restrict communication protocols for jobs executing on computing nodes, using a filtering agent to enforce these rules and resolve conflicting access privileges.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data access is unrestricted in continuous integration environments, then job execution speed is maintained, but security and reliability deteriorate due to unauthorized data access via communication protocols
Solution Approach 1:
The patent introduces an access manager as an intermediary component that sits between the build system and external data sources. This access manager enforces access lists that control which communication protocols (FTP, HTTP, SMTP, etc.) can be used by build jobs to access external data, thereby maintaining security without completely blocking data access paths
Solution Approach 2:
The system performs preliminary configuration of access lists before build jobs execute. Administrators pre-define which protocols are allowed or restricted for specific build pipelines, so that when jobs run, the security policies are already in place and do not delay execution. The access manager is configured in advance to enforce these policies transparently during job execution
2Reliability
If communication protocols are restricted for all jobs, then system-wide security is improved, but individual job flexibility and adaptability deteriorate
Solution Approach 1:
The access control system is segmented into multiple levels: system-wide access lists that apply to all builds, and pipeline-specific access lists that can override or supplement system defaults. This segmentation allows different security policies to be applied to different build pipelines based on their specific needs, maintaining both system-wide security and individual job flexibility
Solution Approach 2:
Different security policies (access lists) are applied locally to different build pipelines rather than using a single uniform policy for all jobs. Each pipeline can have customized protocol restrictions or allowances tailored to its specific requirements, while still operating within the overall system security framework
3Reliability
If access lists are implemented to control communication protocols, then unauthorized data access is prevented, but system complexity increases due to managing multiple access lists and resolving conflicts
Solution Approach 1:
The access manager implements feedback mechanisms that automatically detect and resolve conflicts between system-wide and pipeline-specific access lists. When a conflict is detected (e.g., a protocol is restricted at the system level but allowed at the pipeline level), the system automatically applies resolution rules and logs the decisions, reducing the manual complexity of managing multiple access lists
Data Source
AI summary
The technology disclosed herein enables managing data access by communication protocols in continuous integration environments. An example method comprises scheduling, by a processor, a software build job to execute on a computing node of a computer system; identifying a first list specifying a first set of access privileges by the software job to a first set of communication protocols, wherein the first list is exclusively associated with the software build job; identifying a second list comprising a second set of access privileges to a second set of communication protocols, wherein the second list is specific to the computer system; and responsive to determining that the access privileges of the first list do not conflict with the access privileges of the second list, causing a filtering agent operating on the computing node to enforce the access privileges of the first list and the access privileges of the second list.