Automatic software upgrading in secure enclaves for tenant-specific encryption workloads

An apparatus for updating software code in a multi-tenant system, comprising:

• one or more memories storing processor-executable code;
• and
• one or more processors coupled with the one or more memories and individually or collectively operable to execute the code to cause the apparatus to:
• receive an indication that an updated version of software code to be executed in an isolated execution environment is available for deployment;
• determine a unique identifier associated with the updated version of the software code;
• modify configuration data comprising a first identifier associated with a current version of the software code and a second identifier associated with a previous version of the software code, wherein the modifying comprises updating the second identifier with the first identifier and updating the first identifier with the unique identifier associated with the updated version of the software code;
• generate, based at least in part on the configuration data, an updated key policy, wherein the updated key policy comprises the updated first identifier and the updated second identifier;
• update a key management application programming interface (API) to apply the updated key policy to one or more managed keys, wherein the updated key management API enables the current version of the software code and the updated version of the software code to access the one or more managed keys;
• and
• cause deployment of the updated version of the software code to one or more nodes of the multi-tenant system.

A non-transitory computer-readable medium storing code for updating software code in a multi-tenant system, the code comprising instructions executable by one or more processors to:

• receive an indication that an updated version of software code to be executed in an isolated execution environment is available for deployment;
• determine a unique identifier associated with the updated version of the software code;
• modify configuration data comprising a first identifier associated with a current version of the software code and a second identifier associated with a previous version of the software code, wherein the modifying comprises updating the second identifier with the first identifier and updating the first identifier with the unique identifier associated with the updated version of the software code;
• generate, based at least in part on the configuration data, an updated key policy, wherein the updated key policy comprises the updated first identifier and the updated second identifier;
• update a key management application programming interface (API) by applying the updated key policy to one or more managed keys, wherein the updated key management API enables the current version of the software code and the updated version of the software code to access the one or more managed keys;
• and
• cause deployment of the updated version of the software code to one or more nodes of the multi-tenant system.