International Business Machines Corporation

Ruriko Kudo

Yuji Watanabe

Kugamoorthy Gajananan

Hirokuni Kitahara

Fumiko Akiyama

Yasuharu Katsuno

A risk dependency platform may obtain a source code for task automation. The risk dependency platform may analyze the source code to determine one or more dependencies associated with the source code. The one or more dependencies may identify referenced source code that are included in the source code by reference. The risk dependency platform may obtain the referenced source code and may decompose the source code and the referenced source code into a plurality of tasks. The plurality of tasks may invoke a plurality of modules that are executables. The risk dependency platform may analyze the plurality of tasks to determine operations that are performed based on the plurality of modules being executed. The risk dependency platform may evaluate the operations to identify one or more risks associated with performing the operations. The risk dependency platform may perform an action based on the one or more risks.

Risk dependency evaluation of a source code for task automation

Methods and systems for verifying a resource definition include simulating an original resource definition to identify at least one change that is made to the original resource definition by a management service. A signature of a received resource definition is generated, omitting portions of the received resource definition that correspond to the at least one identified change. The signature of the received resource definition is compared to a signature of the original resource definition to find a match and to verify the received resource definition. The received resource definition is implemented, responsive to finding the match.

Cluster resource signature verification

A system for controlling access to cluster resources is provided. The system includes one or more processors; and memory operatively coupled to the one or more processors, wherein the one or more processors and the memory form a cluster of computer resources that includes an admission controller configured to receive requests and determine if the request is authorized, a request history database that stores the request information received by the admission controller from a plurality of users, a role design advisor that is configured to adjust permissions for the plurality of users based on a pattern of usage identified from the request history database, and an alert system that communicates an alert to an administrator that a request outside the pattern of requests for the user has been received by the admission controller, wherein the admission controller, request history database, and role design advisor control access to the cluster resources.

Role design advisor

A computer-implemented method for assessing latent security risks in Kubernetes clusters is provided including selecting a service account from a plurality of service accounts defined in namespaces of a cluster, binding a role to the selected service account based on predetermined role-binding data, and determining if the role meets at least one of a first, second, and third conditions based on predetermined role data defining permitted operations for roles, the first condition being that the role can receive secret tokens for pods within a namespace of the namespaces, the second condition being that the role can perform execution operation to other pods, and the third condition being that the role can create DaemonSet, Deployment, StatefulSet, and additional pods on the namespace.

Assessing latent security risks in Kubernetes cluster

One or more computer processors collect logs containing one or more admission requests associated with a new application installation in an empty namespace, wherein the empty namespace is a sandbox representative of a production environment. The one or more computer processors classify the one or more admission requests according to a set of conditions indicating respective levels of trust. The one or more computer processors create a set of candidates for signing containing admissions requests that are classified unsigned. The one or more computer processors generate a security policy for each candidate for signing in the set of candidates for signing.

Clustered application policy generation

A system is provided for automatically closing a server-rack door. A microphone acquires sound data and an acceleration sensor acquires acceleration data. A controller determines at least one time when a volume of the sound data exceeds a threshold. The controller identifies at least one waveform from the acceleration data which matches (i) an opening waveform or (ii) a closing waveform. The controller checks, for each given waveform from among the at least one waveform, if the at least one time is within a time range of the given waveform and, if so, determine that the user is opening or closing the server-rack door by identifying the given waveform as matching the opening or closing waveform. The controller provides a notification of an open status of the server-rack door based on numbers of opening and closing waveforms. The controller automatically closes the server-rack door, responsive to the notification.

Closing server-rack door using acoustic noise and acceleration

A method for checking an integrity of an object to be deployed to a cluster is provided. The method detects a resource creation request. The method, responsive to the request being an initial resource creation request for the object, verifies the integrity of the object based on properties in the request to create a release secret in the cluster for a positive integrity verification result for the object. The release secret represents a specific deployment configuration of the object on the cluster. The method, responsive to the request being other than the initial resource request, checks if the request corresponds to the specific deployment configuration of the object by checking against the release secret in the cluster. The method, responsive to the request corresponding to a deployment of the object and the release secret being present in the cluster, creates a resource requested by the request in the cluster.

Growing community of inventors

Saitama, Japan

Ruriko Kudo