Cloud Agent Manager Plugin for Cross-Platform VM Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing the lifecycle of software agents installed on customer-owned compute instances in cloud environments is challenging due to limited access and visibility for cloud providers, especially when dealing with provider-owned and third-party agents, requiring efficient installation, updating, and uninstallation across diverse platform types and versions.
Innovation Solution
An agent management service in a provider-owned service tenancy manages the lifecycle of agents by providing agent inventory information, enabling plugins in customer compute instances to request and install or update agents based on platform types and versions, utilizing a data plane and object storage repositories to facilitate centralized management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If provider-owned agents are installed on customer-owned compute instances to gain visibility for software assurance, then the cloud provider can monitor and assure compliance, but the cloud provider has limited access to manage the agent lifecycle due to tenancy isolation
Solution Approach 1:
The patent introduces an agent management service as an intermediary component that runs within the customer's tenancy but is owned and controlled by the cloud provider. This service acts as a mediator between the provider's need to manage agents and the customer's tenancy isolation requirements. The service receives requests from compute instances, manages agent deployment, updates, and removal, thereby enabling reliable software assurance while maintaining ease of operation despite tenancy boundaries.
2Reliability
If agents are installed on multiple compute instances across different platform types, then comprehensive monitoring coverage is achieved, but the complexity of managing agent installation and updates increases
Solution Approach 1:
The agent management service is designed as a universal platform that handles multiple agent types across diverse compute instances with different platform types (operating systems, hardware architectures). It provides unified functionality for agent deployment, version management, and updates across all platforms, thereby achieving comprehensive monitoring coverage while reducing management complexity through standardized processes.
Solution Approach 2:
The service segments agent management by platform type, maintaining separate agent objects for different operating systems and hardware architectures. This segmentation allows the system to handle platform-specific requirements independently while providing a unified management interface, thus achieving broad coverage without overwhelming complexity.
3Reliability
If the cloud provider wants to control agent updates and versions for security purposes, then security compliance is improved, but the provider needs extensive access rights that conflict with customer tenancy isolation
Solution Approach 1:
The agent management service serves as a trusted intermediary that operates within the customer's tenancy with explicit permissions. It enables the cloud provider to control agent security and compliance without requiring broad access rights to the entire tenancy. The service receives authenticated requests from compute instances and manages agent updates, thereby achieving security compliance while preserving tenancy isolation and access flexibility.
4Reliability
If agents are periodically updated across all compute instances, then software assurance is maintained, but the time and resources required for updates increase
Solution Approach 1:
The agent management service implements a self-service model where compute instances autonomously communicate with the service to request and receive agent updates. Instead of the provider pushing updates to all instances, the instances pull updates when needed, reducing the time and resources required for updates while maintaining software assurance through automated version management.
Data Source
AI summary
A unified security agent manager plugin within a virtual machine compute instance manages at least one agent installed within the compute instance of a cloud environment. The plugin periodically receives agent inventory information, where the agent inventory information identifies (i) a plurality of platform types of the agent, and (ii) for each platform type, one or more deployable versions of the agent. The plugin selects a platform type from the plurality of platform types. The plugin compares the one or more deployable versions corresponding to the selected platform type with a version of the agent currently installed in the compute instance. If the version currently installed in the compute instance is older than the one or more deployable versions, the plugin fetches an agent object corresponding to a deployable version from an object storage repository, and updates the version currently installed in the compute instance to the fetched deployable version.