Abstract: The sizes of image files for deploying software in a computing environment can be reduced according to some examples described herein. In one example, a system can identify base image files that each include at least a predefined amount of dependencies relied upon by target software. The system can then select a particular base image file, from the base image files, having a smallest size as compared to a remainder of the base image files. The system can then build a customized image file from the base image file, where the customized image file is configured for deploying the target software to a computing environment.

Abstract: Processing logic may obtain a resource of a platform fora containerized application. The platform may include custom resources, and an operator that manages the custom resources during runtime of the containerized application. In response to an indication being defined in the resource, processing logic may schedule an upgrade to a new operator. Processing logic may perform one or more pre-installation actions or post-installation actions that are defined in the resource to manage the installation of the new operator in a controlled manner and reduce the risk of incompatibilities between the new operator and the custom resources.

Abstract: A method of generating container image snapshots includes scanning one or more worker nodes of a container cluster to generate an image set describing container images loaded onto the one or more worker nodes. The method also includes analyzing, by a processing device, the image set to generate an image manifest comprising at least some of the container images in the image set. The method also includes generating a snapshot from the image manifest, wherein the snapshot describes a set of container images to be used to build a new worker node. The method also includes storing the snapshot in a local memory of the container cluster. The method also includes, responsive to an instruction to provision the new worker node, loading the set of container images from the local memory to the new worker node and building a container for each of the container images in the set.

Abstract: A system and method of dynamically mapping a network topology of a mesh network of nodes. The method including maintaining, by a processing device of a control node of the mesh network, a network topology map indicating groups of neighboring nodes. The method including determining that a first node of the mesh network discovered a neighbor change event associated with a second node. The method including identifying, based on the network topology map, a group of neighboring nodes of a target node of the mesh network responsive to determining that the first node detected the neighbor change event. The method including transmitting a targeted message to a first neighboring node of the group of neighboring nodes to cause the first neighboring node to notify the group of neighboring nodes of the neighbor change event.

Abstract: Systems and methods for implementing an annotation driven just in time and state-based RBAC policy control are disclosed. The method inserts an annotation into a code base that includes a function. The annotation identifies a resource corresponding to the function. The method compiles the code base into compiled code, which includes inserting, based on the annotation, a first request prior to the function that requests permission to access the resource; and inserting, based on the annotation, a second request subsequent to the function to turn off permission to access the resource. The method then deploys the compiled code to a target environment.

Abstract: The sizes of image files for deploying software in a computing environment can be reduced according to some examples described herein. In one example, a system can identify base image files that each include at least a predefined amount of dependencies relied upon by target software. The system can then select a particular base image file, from the base image files, having a smallest size as compared to a remainder of the base image files. The system can then build a customized image file from the base image file, where the customized image file is configured for deploying the target software to a computing environment.

Abstract: Systems and methods of the disclosure include: identifying, by a cloud resource management system, a cloud resource consumption model associated with one or more cloud resources; generating, by the cloud resource management system, a sequence of instructions implementing a smart contract based on the cloud resource consumption model; sending, to a distributed ledger network, the smart contract; receiving, by the cloud resource management system, cloud resource usage data associated with the one or more cloud resources; and causing, by transmitting a message reflecting the cloud resource usage data to the distributed ledger, the smart contract to be executed.

Abstract: Excessive polling that may result in wasted computing resources and unnecessary network traffic can be avoided using some techniques described herein. In one example, a method can include obtaining historical data indicating execution times associated with computing operations. The method can also include determining polling times to assign to the computing operations by applying a model to the historical data. The method may also include configuring a software application to implement the polling times in relation to polling processes for transmitting requests to execute the computing operations to one or more destinations.

Abstract: A shim layer can be incorporated into a container image for intercepting calls between an upper layer and a lower layer of the container image according to some aspects described herein. For example, a system can build an image file that includes a stacked arrangement of layers configured for deploying a software program within a container. The stacked arrangement of layers can include a lower layer including one or more objects. The stacked arrangement of layers can include an upper layer positioned above the lower layer, where the upper layer includes the software program. And the stacked arrangement of layers can include a shim layer positioned between the lower layer and the upper layer. The shim layer can include a shim, which is configured to intercept calls involving the one or more objects from the software program and responsively allow or reject the calls based on control data.

Abstract: Disclosed are systems and methods for scanning a client codebase for vulnerabilities without exposing the client information. An example method includes receiving, from a client computing device, a scan request to scan a set of encrypted client information to identify vulnerabilities applicable to the client information. The method also includes responsive to the scan request, analyzing, by a processing device, the encrypted client information to generate scan results that identify vulnerabilities applicable to the client information, wherein the analyzing is performed without decrypting the client information. The method also includes returning the scan results to the client, wherein the scan results are in encrypted form when the scan results are generated.

Abstract: Processing logic may generate metadata in view of monitoring a response of each of a plurality of components of an application to past maintenance tasks, wherein the metadata comprises an expected downtime of a first of the plurality of components of the application and a second expected downtime of a second of the plurality of components of the application in response to the expected downtime of the first of the plurality of components. Processing logic may obtain a notification to perform a maintenance task for a first of the plurality of components. In view of the metadata, processing logic may schedule the maintenance task for the first of the plurality of components to coincide with a second maintenance task of the second of the plurality of components.

Abstract: A method includes determining that access permissions associated with a service of a computing system have been revoked, identifying one or more access policy sets including access policy rules associated with the service, removing the access policy rules associated with the service from the one or more access policy sets, and marking one or more decision execution paths of a policy decision point associated with the service with a feature flag.

Abstract: A system and method of dynamically mapping a network topology of a mesh network of nodes. The method including maintaining, by a processing device of a control node of the mesh network, a network topology map indicating groups of neighboring nodes. The method including determining that a first node of the mesh network discovered a neighbor change event associated with a second node. The method including identifying, based on the network topology map, a group of neighboring nodes of a target node of the mesh network responsive to determining that the first node detected the neighbor change event. The method including transmitting a targeted message to a first neighboring node of the group of neighboring nodes to cause the first neighboring node to notify the group of neighboring nodes of the neighbor change event.

Abstract: Excessive polling that may result in wasted computing resources and unnecessary network traffic can be avoided using some techniques described herein. In one example, a method can include obtaining historical data indicating execution times associated with computing operations. The method can also include determining polling times to assign to the computing operations by applying a model to the historical data. The method may also include configuring a software application to implement the polling times in relation to polling processes for transmitting requests to execute the computing operations to one or more destinations.

Abstract: The sizes of image files for deploying software in a computing environment can be reduced according to some examples described herein. In one example, a system can identify base image files that each include at least a predefined amount of dependencies relied upon by target software. The system can then select a particular base image file, from the base image files, having a smallest size as compared to a remainder of the base image files. The system can then build a customized image file from the base image file, where the customized image file is configured for deploying the target software to a computing environment.

Abstract: Systems and methods of the disclosure include: receiving, by a cloud resource provisioning component via a cloud provisioning request application programming interface (API), a cloud resource request; storing the cloud resource request on a cryptographically-protected distributed ledger; receiving, from a first cloud provider, a first cloud resource offer responsive to the cloud resource request; and responsive to receiving, from a node of the cryptographically-protected distributed ledger, a notification of validation of the first cloud resource offer with respect to the cloud resource request, causing the first cloud provider to provision a cloud resource specified by the first cloud resource offer.

Abstract: Systems and methods of the disclosure include: receiving, by a node of a distributed ledger network, first transaction data, wherein the first transaction data comprises an alert derived from a state of a computer system; storing the first transaction data in a first block of the distributed ledger network; receiving, by the node, second transaction data, wherein the second transaction data comprises an identifier of a remedial action performed on the computer system in response to the alert and a result of performing the remedial action; and storing the second transaction data in a block of the distributed ledger network, wherein the block is provided by one of: the first block or a second block.

Abstract: Processing logic may monitor testing of a candidate service with one or more services to determine if one or more criteria are satisfied. The one or more criteria may be defined in a smart contract on a blockchain. In response to the one or more criteria being satisfied, processing logic may initiate a transaction of the blockchain which causes each of the one or more services to validate the one or more criteria. In response to the one or more services validating that the one or more criteria are satisfied, processing logic may promote the candidate service.

Abstract: Processing logic may obtain a resource of a platform fora containerized application. The platform may include custom resources, and an operator that manages the custom resources during runtime of the containerized application. In response to an indication being defined in the resource, processing logic may schedule an upgrade to a new operator. Processing logic may perform one or more pre-installation actions or post-installation actions that are defined in the resource to manage the installation of the new operator in a controlled manner and reduce the risk of incompatibilities between the new operator and the custom resources.