Identity management for software components

A method carried out by one or more computing devices, the method comprising:

• requesting a one-time use credential as a first identity credential for an application component instance using a unique identifier associated with the application component instance;
• receiving a cryptographically generated one-time use credential as the first identity credential for the application component instance based on the unique identifier, in response to the request;
• and
• providing the cryptographically generated one-time use credential by a virtualization engine for use by a container that contains the application component instance.

A method carried out by one or more computing devices, the method comprising:

• in response to a first application component replacement condition for a first application component instance that has a generated first identity credential that is based on a unique identifier, requesting a replacement dynamically-created first identity credential for a replacement component instance of the first application component instance using the unique identifier of the prior first identity credential associated with the first application component instance;
• receiving the dynamically-created replacement first identity credential that includes the cryptographically bound unique identifier of the prior first identity credential associated with the first application component instance;
• requesting a dynamically-created second identity credential for the replacement application component instance of the application using a request signed based on the replacement first identity credential;
• receiving the dynamically-created second identity credential;
• and
• using the dynamically-created second identity credential in a cryptographic function by the replacement application component instance.

One or more computing devices comprising:

• memory that stores executable instructions;
• at least one processor, operatively coupled to execute the executable instructions and based the execution:
• request a one-time use credential as a first identity credential for an application component instance;
• request a dynamically-created second identity credential for the application component instance of the application using a request signed based on the one-time use credential;
• receive the dynamically-created second identity credential;
• and
• use the dynamically-created second identity credential in a cryptographic function by the application component instance.

One or more computing devices comprising:

• memory that stores executable instructions;
• at least one processor, operatively coupled to execute the executable instructions and based the execution:
• request a one-time use credential as a first identity credential for an application component instance using a unique identifier associated with the application component instance;
• receive a cryptographically generated one-time use credential as the first identity credential for the application component instance based on the unique identifier, in response to the request;
• and
• provide the cryptographically generated one-time use credential by a virtualization engine for use by a container that contains the application component instance.

One or more computing devices comprising:

• memory that stores executable instructions;
• at least one processor, operatively coupled to execute the executable instructions and based the execution:
• in response to a first application component replacement condition, requesting a dynamically-created second identity credential for a replacement component instance of the first application component instance using a certificate-signing request signed using a first identity credential associated with the first application component instance;
• receiving the dynamically-created second identity credential that includes a cryptographically bound unique identifier of the first identity credential associated with the first application component instance;
• and
• using the dynamically-created second identity credential with the replacement component instance to perform a cryptographic function.