Controlling a discovery component, within a virtual environment, that sends authenticated data to a discovery engine outside the virtual environment

• US 9,497,187 B2
• Filed: 12/13/2014
• Issued: 11/15/2016
• Est. Priority Date: 12/13/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Rhames, Daniel P., Griffith, John A., Riedel, Philip R., Schmidt, David L.
• Primary Examiner(s): CHANG, KENNETH W
• Application Number:
  US14/569,698
• Publication Number:
  US 20160173487A1
• Time in Patent Office: 703 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time

Abstract

A discovery bundle component is applied in a virtual image deployed within a virtual environment, wherein the discovery bundle automatically discovers asset information about one or more application bundles applied to the virtual image. The discovery bundle component sends, to a discovery product service, the asset information wrapped with a trusted signed certificate for the discovery product service, wherein the discovery product service is located outside the virtual environment.

Claims

1. A method for managing virtual image discovery, comprising:

applying, using one or more processors, a discovery bundle component in a virtual image deployed within a virtual environment, wherein the discovery bundle component automatically discovers asset information about one or more application bundles applied to the virtual image;

prompting, using the one or more processors, a user to provide an access control list specifying credentials for accessing one or more assets of the virtual image on a deployed system hosting the virtual environment;

in response to the user providing the access control list, storing, using the one or more processors, the access control list in a secured credential vault of the discovery bundle component;

discovering, using the one or more processors, by the discovery bundle component, the asset information for a selection of at least one of the one or more application bundles applied to the virtual image, wherein the access control list comprises the credentials required for accessing the selection of at least one of the one or more application bundles to discover the asset information; and

sending, using the one or more processors, by the discovery bundle component, to a discovery product service, the asset information wrapped with a trusted signed certificate for the discovery product service, without sending the credentials used to access the asset information to the discovery product service, wherein the discovery product service is located outside the virtual environment.

2. The method according to claim 1, further comprising:

preconfiguring, using the one or more processors, the discovery bundle component with the trusted signed certificate of the discovery product service prior to applying the discovery bundle component in the virtual image deployed within the virtual environment, wherein the trusted signed certificate specifies a hostname and an internet protocol address of a host for the discovery product service.

3. The method according to claim 1, wherein applying, using one or more processors, a discovery bundle component in a virtual image deployed within a virtual environment, wherein the discovery bundle component automatically discovers asset information about one or more application bundles applied to the virtual image further comprises:

applying, using the one or more processors, the discovery bundle component in the virtual image deployed within the virtual environment, wherein the virtual environment comprises one of a virtual machine, a logical partition, and a workload partition.

4. The method according to claim 1, wherein applying, using one or more processors, a discovery bundle component in a virtual image deployed within a virtual environment, wherein the discovery bundle component automatically discovers asset information about one or more application bundles applied to the virtual image further comprises:

configuring, using the one or more processors, within the discovery bundle component, the asset information that is discoverable by the discovery bundle component about the selection of at least one of the one or more application bundles wherein the discoverable asset information comprises at least one of operating system information, database information, and application server information, wherein the operating system information comprises at least one of file system information, device information, security settings, and operating system limits, wherein the database information comprises at least one of containers, log devices, cluster information, and tablespaces, wherein the application server information comprises at least one of message queues, cluster members, heap size, and connection pools.

5. The method according to claim 1, wherein sending, using the one or more processors, by the discovery bundle component, to a discovery product service, the asset information wrapped with a trusted signed certificate for the discovery product service, without sending the credentials used to access the asset information to the discovery product service, wherein the discovery product service is located outside the virtual environment further comprises:

sending, using the one or more processors, by the discovery bundle component, the asset information in an initial discovery report to the discovery product service within a first time period after the discovery bundle component is applied to the virtual image deployed in the virtual environment, wherein the discovery product service verifies the trusted signed certificate and registers the virtual image based on the initial discovery report.

6. The method according to claim 1, wherein sending, using the one or more processors, by the discovery bundle component, to a discovery product service, the asset information wrapped with a trusted signed certificate for the discovery product service, without sending the credentials used to access the asset information to the discovery product service, wherein the discovery product service is located outside the virtual environment further comprises:

in response to sending the asset information to the discovery product service, resetting and starting a delta timer using the one or more processors;

in response to the delta timer expiring, discovering, using the one or more processors, whether there is at least one update to the asset information for the virtual image since the delta timer was reset; and

sending, using the one or more processors, an updated discovery report indicating the virtual image is active and comprising the at least one update to the asset information.

7. The method according to claim 1, wherein applying, using one or more processors, a discovery bundle component in a virtual image deployed within a virtual environment, wherein the discovery bundle component automatically discovers asset information about one or more application bundles applied to the virtual image further comprises:

applying, using the one or more processors, the discovery bundle component in the virtual image deployed within the virtual environment on a deployed system connected within a cloud environment.

8. A system for managing virtual image discovery, comprising:

a processor, coupled with a memory, and configured to perform the actions of;

applying a discovery bundle component in a virtual image deployed within a virtual environment, wherein the discovery bundle component automatically discovers asset information about one or more application bundles applied to the virtual image;

prompting a user to provide an access control list specifying credentials for accessing one or more assets of the virtual image on a deployed system hosting the virtual environment;

in response to the user providing the access control list, storing the access control list in a secured credential vault of the discovery bundle component;

discovering, by the discovery bundle component, the asset information for a selection of at least one of the one or more application bundles applied to the virtual image, wherein the access control list comprises the credentials required for accessing the selection of at least one of the one or more application bundles to discover the asset information; and

sending, by the discovery bundle component, to a discovery product service, the asset information wrapped with a trusted signed certificate for the discovery product service, without sending the credentials used to access the asset information to the discovery product service, without sending the credentials used to access the asset information to the discovery product service.

9. The system according to claim 8, wherein the processor is further configured to perform the actions of:

preconfiguring the discovery bundle component with the trusted signed certificate of the discovery product service prior to applying the discovery bundle component in the virtual image deployed within the virtual environment, wherein the trusted signed certificate specifies a hostname and an internet protocol address of a host for the discovery product service.

10. The system according to claim 8, wherein the processor is further configured to perform the actions of:

applying the discovery bundle component in the virtual image deployed within the virtual environment, wherein the virtual environment comprises one of a virtual machine, a logical partition, and a workload partition.

11. The system according to claim 8, wherein the processor is further configured to perform the actions of:

configuring, within the discovery bundle component, the asset information that is discoverable by the discovery bundle component about the selection of at least one of the one or more application bundles wherein the discoverable asset information comprises at least one of operating system information, database information, and application server information, wherein the operating system information comprises at least one of file system information, device information, security settings, and operating system limits, wherein the database information comprises at least one of containers, log devices, cluster information, and tablespaces, wherein the application server information comprises at least one of message queues, cluster members, heap size, and connection pools.

12. The system according to claim 8, wherein the processor is further configured to perform the actions of:

sending, by the discovery bundle component, the asset information in an initial discovery report to the discovery product service within a first time period after the discovery bundle component is applied to the virtual image deployed in the virtual environment, wherein the discovery product service verifies the trusted signed certificate and registers the virtual image based on the initial discovery report.

13. The system according to claim 8, wherein the processor is further configured to perform the actions of:

in response to sending the asset information to the discovery product service, resetting and starting a delta timer using the one or more processors;

in response to the delta timer expiring, discovering whether there is at least one update to the asset information for the virtual image since the delta timer was reset; and

sending an updated discovery report indicating the virtual image is active and comprising the at least one update to the asset information.

14. The system according to claim 8, wherein the processor is further configured to perform the actions of:

applying the discovery bundle component in the virtual image deployed within the virtual environment on a deployed system connected within a cloud environment.

15. A computer program product for managing virtual image discovery, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:

apply a discovery bundle component in a virtual image deployed within a virtual environment, wherein the discovery bundle component automatically discovers asset information about one or more application bundles applied to the virtual image;

prompt a user to provide an access control list specifying credentials for accessing one or more assets of the virtual image on a deployed system hosting the virtual environment;

in response to the user providing the access control list, store the access control list in a secured credential vault of the discovery bundle component;

discover, by the discovery bundle component, the asset information for a selection of at least one of the one or more application bundles applied to the virtual image, wherein the access control list comprises the credentials required for accessing the selection of at least one of the one or more application bundles to discover the asset information; and

send, by the discovery bundle component, to a discovery product service, the asset information wrapped with a trusted signed certificate for the discovery product service, without sending the credentials used to access the asset information to the discovery product service, wherein the discovery product service is located outside the virtual environment.

16. The computer program product according to claim 15, further comprising the program instructions executable by a processor to cause the processor to:

preconfigure the discovery bundle component with the trusted signed certificate of the discovery product service prior to applying the discovery bundle component in the virtual image deployed within the virtual environment, wherein the trusted signed certificate specifies a hostname and an internet protocol address of a host for the discovery product service.

17. The computer program product according to claim 15, further comprising the program instructions executable by a processor to cause the processor to:

apply the discovery bundle component in the virtual image deployed within the virtual environment, wherein the virtual environment comprises one of a virtual machine, a logical partition, and a workload partition.