Securing Serverless Computing Workloads in a Cold Start
AssigneeDell Products L.P.
InventorsIgor Dubrovsky, Stav Sapir, Yair Yotam
Life of this patent
Estimating the term…
Abstract
A system can identify, by a control plane, that a base image has been registered to a first registry that is stored outside of the computing cluster. The system can identify, by the control plane, a trust bundle that corresponds to the base image. The system can send, by the control plane and to a secure pipeline that operates outside of the control plane, a message to update the base image. The system can create, by the secure pipeline, an updated image based on the base image and the trust bundle. The system can send, by the secure pipeline, the updated image to the control plane. The system can store, by the control plane, the updated image in a local registry that is stored on the computing cluster.
Claims20
A system, comprising:
- a processor;
- and
- a memory coupled to the processor, comprising instructions that, in response to execution by the processor, cause the system to perform operations, comprising:
- identifying, by a control plane of a computing cluster, that a base image has been registered to a first registry that is stored outside of the computing cluster;
- identifying, by the control plane, a trust bundle that corresponds to the base image;
- sending, by the control plane and to a secure pipeline that operates outside of the control plane, a message to update the base image;
- creating, by the secure pipeline, an updated image based on the base image and the trust bundle;
- sending, by the secure pipeline, the updated image to the control plane;
- and
- storing, by the control plane, the updated image in a local registry that is stored on the computing cluster.
A method, comprising:
- identifying, by a control plane of a computing cluster of a system comprising a processor, that a base image has been registered, and a corresponding trust bundle;
- sending, by the control plane and to a secure pipeline component of the system that operates outside of the control plane, a message to update the base image;
- creating, by the secure pipeline component, an updated image based on the base image and the corresponding trust bundle;
- sending, by the secure pipeline component, the updated image to the control plane;
- and
- storing, by the control plane, the updated image in a registry that is stored on the computing cluster.
A non-transitory computer-readable medium comprising instructions that, in response to execution, cause a first system comprising a processor to perform operations, comprising:
- identifying, by a control plane of a computing cluster, that a base image has been registered, and a corresponding trust bundle;
- sending, by the control plane and to a second system that operates outside of the control plane, a message to update the base image;
- creating, by the second system, an updated image based on the base image and the corresponding trust bundle;
- sending, by the second system, the updated image to the control plane;
- and
- storing, by the control plane, the updated image in a registry that is stored on the computing cluster.
Dependencies are inferred from the claim text.