Container Patch Sync Using Image Manifests Across Multiple Nodes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for redeploying and upgrading containers in IT infrastructure face challenges in managing patch availability and security vulnerabilities, particularly with Common Vulnerabilities and Exposures (CVE), leading to inefficiencies and potential security risks due to the lack of timely information on patch availability and impact on multiple interdependent applications.
Innovation Solution
The implementation of a Multi-Repository Image Patch Status Graph Producer (MRIPSGP) and Consumer (MRIPSGC) modules within automation tools like Ansible, which introduce patchStatus and patchAvailableDate attributes to image manifests, allowing for intelligent on-demand deployment and upgrade based on user-defined sync modes, ensuring efficient and secure patch management across multiple nodes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If containers are upgraded simultaneously across multiple nodes, then deployment speed is improved, but version compatibility control becomes difficult and security errors may arise
Solution Approach 1:
The patent introduces a producer module that updates image manifests with planned patch information before actual deployment. This preliminary action records patch availability status and target layer information in advance, allowing the consumer module to make informed decisions about deployment timing and sequencing, thus maintaining version compatibility while enabling efficient upgrades.
Solution Approach 2:
The patent implements a feedback mechanism where the producer module continuously updates the image manifest with patch status information, and the consumer module reads this information to adjust deployment strategies. This feedback loop ensures that deployment decisions are based on current patch availability and compatibility status, resolving the contradiction between speed and reliability.
2Reliability
If patches are continuously delivered to multiple versions simultaneously, then security maintenance is improved, but workload complexity increases
Solution Approach 1:
The patent segments the patch management process into two distinct modules: a producer module responsible for updating image manifests with patch information, and a consumer module responsible for reading this information and executing deployments. This segmentation divides the complex workload into manageable, specialized tasks, reducing overall system complexity while maintaining comprehensive security coverage across multiple versions.
Solution Approach 2:
The image manifest serves as an intermediary data structure between the producer module and consumer module. It stores planned patch information, patch status, and target layer details, allowing the system to manage multiple version patches systematically without direct complex interactions between deployment processes, thus reducing workload complexity.
3Reliability
If unimpacted layers are pulled for safe-mode upgrade, then deployment reliability is improved, but download time increases
Solution Approach 1:
The patent implements safe-mode upgrade by pulling only the unimpacted layers of container images rather than complete images. This partial action approach downloads minimal necessary data to verify patch safety, significantly reducing download time while maintaining deployment reliability through selective layer verification.
Data Source
AI summary
Automatic redeploying/upgrade of containers on multiple nodes using an Automated Deployment Software (ADS) having an Automated Deployment Tool (ADT) includes updating the ADS with a planned patch of a target layer, introducing a patchname sync command into the ADT to introduce a required patch type/specific patch and redeploy the containers, updating the ADT with a Producer Module (PM) and a Consumer Module (CM), running the ADT to cause the PM to update an image manifest item attribute, and push the image manifest item/new layer to a repository and running the ADT to cause the CM to read the image manifest item, identify and pull the unimpacted layers, and performing at least one of deploying/upgrading an application, or waiting for an available patch fix and deploying/upgrading the application.