A method and device for visualizing permission relationships in a containerized application management cluster

Abstract

The present invention provides a method and device for visualizing permission relationships in a containerized application management cluster, the method comprising: based on the mapping relationship of permission binding to roles and the mapping relationship of permission binding to users in the containerized application management cluster, generating a permission binding set corresponding to each role, a role set corresponding to each permission binding, a permission binding set corresponding to each user, and a user set corresponding to each permission binding; receiving a permission reference relationship query request; determining a three-layer permission reference relationship from role to permission binding and from permission binding to user corresponding to the permission relationship query request according to the permission binding set corresponding to each role, the role set corresponding to each permission binding, the permission binding set corresponding to each user, and the user set corresponding to each permission binding; and outputting the three-layer permission reference relationship. The present invention can simplify the monitoring of permission reference relationships of a containerized application management cluster.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for visualizing permission relationships in a containerized application management cluster. Background Art

[0002] Kubernetes is an open source platform for automated deployment, expansion, and operation and maintenance of container clusters. Its goal is to make the deployment of containerized applications simple and powerful.

[0003] In the prior art, Kubernetes only provides mapping from role binding to role, and from permission binding to user, but does not provide mapping from role to permission binding, from role to user, from user to role, and from user to permission binding. Therefore, it is quite difficult for Kubernetes cluster administrators to monitor the permission reference relationship of the entire cluster. Summary of the invention

[0004] In view of this, an object of the present invention is to provide a method and apparatus for visualizing permission relationships in a containerized application management cluster, which can simplify the monitoring of permission reference relationships in the containerized application management cluster.

[0005] In order to achieve the above object, the present invention provides the following technical solutions:

[0006] A method for visualizing permission relationships in a containerized application management cluster, comprising:

[0007] Based on the mapping relationship between permission binding and role and the mapping relationship between permission binding and user in the containerized application management cluster, generate a permission binding set corresponding to each role, a role set corresponding to each permission binding, a permission binding set corresponding to each user, and a user set corresponding to each permission binding;

[0008] Receive permission reference relationship query request;

[0009] Determine the three-layer permission reference relationship from role to permission binding and from permission binding to user corresponding to the permission relationship query request according to the permission binding set corresponding to each role, the role set corresponding to each permission binding, the permission binding set corresponding to each user, and the user set corresponding to each permission binding;

[0010] Output the three-layer permission reference relationship.

[0011] A device for visualizing permission relationships in a containerized application management cluster, comprising:

[0012] A generating unit, configured to generate, based on a mapping relationship between permission binding and roles and a mapping relationship between permission binding and users in a containerized application management cluster, a permission binding set corresponding to each role, a role set corresponding to each permission binding, a permission binding set corresponding to each user, and a user set corresponding to each permission binding;

[0013] A receiving unit, used for receiving a permission reference relationship query request;

[0014] A processing unit, configured to determine a three-layer permission reference relationship from role to permission binding and from permission binding to user corresponding to the permission relationship query request according to a permission binding set corresponding to each role, a role set corresponding to each permission binding, a permission binding set corresponding to each user, and a user set corresponding to each permission binding;

[0015] An output unit is used to output the three-layer permission reference relationship.

[0016] An electronic device comprises: at least one processor, and a memory connected to the at least one processor via a bus; the memory stores one or more computer programs executable by the at least one processor; when the at least one processor executes the one or more computer programs, the steps in the above-mentioned method for visualizing permission relationships in a containerized application management cluster are implemented.

[0017] A computer-readable storage medium stores one or more computer programs, which, when executed by a processor, implement the above-mentioned method for visualizing permission relationships in a containerized application management cluster.

[0018] It can be seen from the above technical solution that in the present invention, according to the mapping relationship between permission binding and role in the containerized application management cluster, and the mapping relationship between permission binding and user, a permission binding set corresponding to each role, a role set corresponding to each permission binding, a permission binding set corresponding to each user, and a user set corresponding to each permission binding are generated, and accordingly, a query of three-layer permission reference relationships from role to permission binding and from permission binding to user is provided, thereby simplifying the monitoring of permission reference relationships of the containerized application management cluster. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 This is a flow chart of a method for visualizing permission relationships in a containerized application management cluster according to a first embodiment of the present invention;

[0020] Figure 2 This is a flow chart of a method for visualizing permission relationships in a containerized application management cluster according to Embodiment 2 of the present invention;

[0021] Figures 3 to 7It is a schematic diagram of the permission reference relationship in different scenarios of the embodiment of the present invention;

[0022] Figure 8 It is a structural schematic diagram of a device for visualizing permission relationships in a containerized application management cluster according to an embodiment of the present invention;

[0023] Fig. 9 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the technical solution of the present invention is described in detail below in conjunction with the accompanying drawings and according to embodiments.

[0025] See also Figure 1 , Figure 1 : is a flow chart of a method for visualizing permission relationships in a containerized application management cluster according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0026] Step 101: Based on the mapping relationship between permission binding and role in the containerized application management cluster, and the mapping relationship between permission binding and user, generate a permission binding set corresponding to each role, a role set corresponding to each permission binding, a permission binding set corresponding to each user, and a user set corresponding to each permission binding.

[0027] In the embodiment of the present invention, the containerized application management cluster may be a Kubernetes cluster. The mapping relationship between permissions and roles in the containerized application management cluster and the mapping relationship between permissions and users may be obtained from a yaml description file.

[0028] In the embodiment of the present invention, the roles include roles within the cluster scope (i.e., ClusterRole) and roles within the namespace scope (i.e., Role). The permission binding includes permission binding within the cluster scope (i.e., ClusterRoleBinding) and permission binding within the namespace scope (i.e., RoleBinding).

[0029] Step 102: receiving a permission reference relationship query request;

[0030] Step 103: Determine the three-layer permission reference relationship from role to permission binding and from permission binding to user corresponding to the permission relationship query request according to the permission binding set corresponding to each role, the role set corresponding to each permission binding, the permission binding set corresponding to each user, and the user set corresponding to each permission binding;

[0031] Step 104: Output the three-layer permission reference relationship.

[0032] Figure 1 In the illustrated embodiment of the present invention, based on the mapping relationship between permission bindings and roles in the containerized application management cluster, and the mapping relationship between permission bindings and users, a permission binding set corresponding to each role, a role set corresponding to each permission binding, a permission binding set corresponding to each user, and a user set corresponding to each permission binding are generated, and accordingly, a three-layer permission reference relationship from role to permission binding and from permission binding to user corresponding to a permission reference relationship query request triggered by the user according to demand is determined, which can simplify the monitoring of the permission reference relationship of the containerized application management cluster.

[0033] See also Figure 2 , Figure 2 : is a flow chart of a method for visualizing permission relationships in a containerized application management cluster according to Embodiment 2 of the present invention. Figure 2 As shown, the method comprises the following steps:

[0034] Step 201a: For each role, query the mapping relationship between permission bindings and roles in the containerized application management cluster, and add all permission bindings mapped to the role to the permission binding set corresponding to the role;

[0035] Step 201b: for each permission binding, query the mapping relationship between the permission binding and the role in the containerized application management cluster, and add the role mapped to the permission binding to the role set corresponding to the permission binding;

[0036] Step 201c: for each permission binding, query the mapping relationship between the permission binding and the user in the containerized application management cluster, and add all users to which the permission binding is mapped to the user set corresponding to the permission binding;

[0037] Step 201d: For each user, query the mapping relationship between permission binding and user in the containerized application management cluster, and add all permission bindings mapped to the user to the permission binding set corresponding to the user.

[0038] The above steps 201a to 201d are parallel and have no order of precedence. The above steps 201a to 201d can be implemented Figure 1 The function of step 101 shown is to generate a permission binding set corresponding to each role, a role set corresponding to each permission binding, a permission binding set corresponding to each user, and a user set corresponding to each permission binding based on the mapping relationship between permission binding and role in the containerized application management cluster, and the mapping relationship between permission binding and user.

[0039] Step 202: Receive a permission reference relationship query request.

[0040] In the embodiment of the present invention, the permission reference relationship query request carries a query object; the query object includes a role, permission binding, and a user.

[0041] This step 202 is Figure 1 The illustrated step 102 is the same.

[0042] Step 203a: Determine the target role corresponding to the query object carried in the permission relationship query request according to the permission binding set corresponding to each user and the role set corresponding to each permission binding.

[0043] In the embodiment of the present invention, no matter whether the query object is a role, a permission binding, or a user, it is necessary to find its corresponding target role, that is, according to the upstream and downstream order of roles, permission bindings, and users, find its upstream role as the target role, and then determine the three-layer permission reference relationship from the target role to the permission binding, and from the permission binding to the user.

[0044] In the embodiment of the present invention, determining the target role corresponding to the query object carried by the permission relationship query request according to the permission binding set corresponding to each user and the role set corresponding to each permission binding specifically includes:

[0045] X1. When the query object is a role, determine the role as the target role corresponding to the query object;

[0046] X2. When the query object is a permission binding, query the role set corresponding to each permission binding to determine the role set corresponding to the query object, and determine each role in the role set as the target role corresponding to the query object;

[0047] X3. When the query object is a user, query the permission binding set corresponding to each user to determine the permission binding set corresponding to the query object, query the role set corresponding to each permission binding to determine the role set corresponding to each permission binding in the permission binding set, and determine each role in each role set as the target role corresponding to the query object;

[0048] X4. When the query object is a namespace, all roles in the namespace are determined as target roles corresponding to the query object;

[0049] X5. When the query object is a cluster, all roles in the cluster are determined as target roles corresponding to the query object.

[0050] The above steps X1, X2, X3, X4 and X5 are performed in no particular order.

[0051] Step 203b: According to the permission binding set corresponding to each role and the user set corresponding to each permission binding, determine a three-layer permission reference relationship from each target role to the permission binding and from the permission binding to the user.

[0052] In this step, according to the permission binding set corresponding to each role and the user set corresponding to each permission binding, a three-layer permission reference relationship from each target role to the permission binding and from the permission binding to the user is determined, including:

[0053] Y1. Determine the permission binding set corresponding to the target role based on the permission binding set corresponding to each role;

[0054] Y2. According to the user set corresponding to each permission binding, determine the user set corresponding to each permission binding in the permission binding set corresponding to the target role;

[0055] Y3. Determine the target role, the permission binding set corresponding to the target role, the user set corresponding to each permission binding in the permission binding set corresponding to the target role, and the three-layer permission reference relationship from the target role to the permission binding and from the permission binding to the user.

[0056] Through the above steps 203a and 203b, it is possible to achieve Figure 1 The function of step 103 shown is to determine the three-layer permission reference relationship from role to permission binding and from permission binding to user corresponding to the permission relationship query request based on the permission binding set corresponding to each role, the role set corresponding to each permission binding, the permission binding set corresponding to each user, and the user set corresponding to each permission binding.

[0057] Step 104: Output the three-layer permission reference relationship.

[0058] The following uses Kubernetes as an example to describe the above Figure 1 , Figure 2 The method for visualizing permission relationships in a containerized application management cluster shown is described in detail.

[0059] Assume that the Kubernetes cluster has the following mapping relationship:

[0060] 1)RoleBinding1—Role1, RoleBinding2—Role2, RoleBinding3—Role2.

[0061] 2) RoleBinding1—User1, RoleBinding1—User2, RoleBinding2—User2, RoleBinding2—User3, RoleBinding3—User3.

[0062] 3) ClusterRoleBinding1—ClusterRole1, ClusterRoleBinding1—User1, ClusterRoleBinding1—User3.

[0063] According to the above mapping relationship, we can get:

[0064] 1) The permission binding set corresponding to each role:

[0065] Role1—{RoleBinding1};

[0066] Role2—{RoleBinding2, RoleBinding3};

[0067] ClusterRole1—{ClusterRoleBinding1};

[0068] 2) The role set corresponding to each permission binding (permission binding to role is a one-to-one correspondence, so the role set only includes one role):

[0069] RoleBinding1—{Role1};

[0070] RoleBinding2—{Role2};

[0071] RoleBinding3—{Role2};

[0072] ClusterRoleBinding1—{ClusterRole1};

[0073] 3) Each permission is bound to a corresponding user set:

[0074] RoleBinding1—{User1, User2};

[0075] RoleBinding2—{User2, User3};

[0076] RoleBinding3—{User3};

[0077] ClusterRoleBinding1—{User1, User3}.

[0078] 4) Permission binding for each user

[0079] User1—{RoleBinding1, ClusterRoleBinding1};

[0080] User2—{RoleBinding1, RoleBinding2};

[0081] User3—{RoleBinding2, RoleBinding3, ClusterRoleBinding1};

[0082] Based on the above four results, users can query in different scenarios. The following are examples:

[0083] Assume that the above RoleBinding1, RoleBinding2, RoleBinding3, Role1, and Role2 all belong to the same namespace: namespace1, and that all objects (roles, permission bindings) and all users in namespace1 belong to the same cluster: Cluster1. And define the upstream and downstream relationships in the order of roles, permission bindings, and users: roles are upstream of permission bindings, permission bindings are downstream of roles, permission bindings are upstream of users, and users are downstream of permission bindings.

[0084] Scenario 1: To query the downstream mapping relationship of a permission role under namespace1 (using role name as the key to view permission binding and users), the query object carried in the permission reference relationship query request is the role name, assuming it is Role1. In addition, the permission reference relationship query request can also carry the namespace namespace1.

[0085] Then Role1 is the target role, the permission binding set corresponding to Role1 is {RoleBinding1}, and the user set corresponding to RoleBinding1 is {User1, User2}, so we can get the following: Figure 3 The three-layer permission reference relationship is shown.

[0086] Scenario 2: View the downstream mapping relationship of a cluster permission role within the cluster (such as Cluster1) (view permission binding and users with ClusterRole name as the key). The query object carried in the permission reference relationship query request is the role name, assuming it is ClusterRole1. In addition, the permission reference relationship query request can also carry the cluster name Cluster1.

[0087] ClusterRole1 is the target role, the permission binding set corresponding to ClusterRole1 is {ClusterRoleBinding1}, and the user set corresponding to ClusterRoleBinding1 is {User1, User3}, so we can get the following: Figure 4 The three-layer permission reference relationship is shown.

[0088] Scenario 3: For the upstream and downstream mapping relationships of all permission bindings under namespace1 (using binding name as key to view permission roles and users), the query object carried in the permission reference relationship query request is the permission binding name, assuming it is RoleBinding2. In addition, the permission reference relationship query request can also carry namespace namespace1.

[0089] Then the role set corresponding to RoleBinding2 is {Role2}, and Role2 is the target role. The permission binding set corresponding to Role2 is {RoleBinding2, RoleBinding3}, the user set corresponding to RoleBinding2 is {User2, User3}, and the user set corresponding to RoleBinding3 is {User3}, so we can get the following: Figure 5 The three-layer permission reference relationship is shown.

[0090] Scenario 4: View the upstream and downstream mapping relationships of all cluster permission bindings within a cluster (such as Cluster1) (view permission roles and users using ClusterRoleBinding as the key). The query object carried in the permission reference relationship query request is the permission binding name, assuming it is ClusterRoleBinding1. In addition, the permission reference relationship query request can also carry the cluster name Cluster1.

[0091] The role set corresponding to ClusterRoleBinding1 is {ClusterRole1}, and ClusterRole1 is the target role. The permission binding set corresponding to ClusterRole1 is {ClusterRoleBinding1}, and the user set corresponding to ClusterRoleBinding1 is {User1, User3}. Therefore, the following is obtained as in scenario 2: Figure 4 The three-layer permission reference relationship is shown.

[0092] Scenario 5: View the upstream mapping relationship of a user (User / Group / ServiceAccount. Group and ServiceAccount are not described in this example. Their principles are the same as User and they are both treated as User) (query permission roles and permission bindings using user name as the key). The query object carried in the permission reference relationship query request is the user name, assuming it is User2.

[0093] The permission binding set corresponding to User2 is {RoleBinding1, RoleBinding2}, the role set corresponding to RoleBinding1 is {Role1}, and the role set corresponding to RoleBinding2 is {Role2}. Therefore, Role1 and Role2 are the target roles.

[0094] The permission binding set corresponding to Role1 is {RoleBinding1}, and the user set corresponding to RoleBinding1 is {User1, User3};

[0095] The permission binding set corresponding to Role2 is {RoleBinding2, RoleBinding3}, the user set corresponding to RoleBinding2 is {User2, User3}, and the user set corresponding to RoleBinding3 is {User3};

[0096] Therefore, we can get Figure 6 The three-layer permission reference relationship is shown.

[0097] Scenario 6: The downstream mapping relationship of all permission roles under a certain namespace (view the mapping relationship diagram of all permission roles to permission binding to users). The query object carried in the permission reference relationship query request is the namespace name, assuming it is namespace1.

[0098] Namespace1 has the following roles: Role1, Role2. Therefore, Role1 and Role2 are the target roles.

[0099] The permission binding set corresponding to Role1 is {RoleBinding1}, and the user set corresponding to RoleBinding1 is {User1, User3};

[0100] The permission binding set corresponding to Role2 is {RoleBinding2, RoleBinding3}, the user set corresponding to RoleBinding2 is {User2, User3}, and the user set corresponding to RoleBinding3 is {User3};

[0101] Therefore, as in scenario 5, we get Figure 6 The three-layer permission reference relationship is shown.

[0102] Scenario 7: View the downstream mapping relationship of all cluster permission roles within a cluster (view the permission binding and users of all ClusterRole). The query object carried in the permission reference relationship query request is the cluster name, assuming it is Cluster1.

[0103] There are three roles in cluster Cluster1: Role1, Role2, and ClusterRole1. Therefore, Role1, Role2, and ClusterRole1 are the target roles.

[0104] The permission binding set corresponding to Role1 is {RoleBinding1}, and the user set corresponding to RoleBinding1 is {User1, User3};

[0105] The permission binding set corresponding to Role2 is {RoleBinding2, RoleBinding3}, the user set corresponding to RoleBinding2 is {User2, User3}, and the user set corresponding to RoleBinding3 is {User3};

[0106] The permission binding set corresponding to ClusterRole1 is {ClusterRoleBinding1}, and the user set corresponding to ClusterRoleBinding1 is {User1, User3};

[0107] Therefore, we can get Figure 7 The three-layer permission reference relationship is shown.

[0108] The above is a detailed description of the method for visualizing the permission relationship in the containerized application management cluster according to the embodiment of the present invention. The present invention also provides a device for visualizing the permission relationship in the containerized application management cluster. Figure 8 For detailed explanation:

[0109] See also Figure 8 , Figure 8 It is a device for visualizing the permissions relationship in a containerized application management cluster according to an embodiment of the present invention. Figure 8 As shown, the device comprises:

[0110] A generating unit 801 is used to generate a permission binding set corresponding to each role, a role set corresponding to each permission binding, a permission binding set corresponding to each user, and a user set corresponding to each permission binding based on a mapping relationship between permission binding and roles and a mapping relationship between permission binding and users in a containerized application management cluster;

[0111] The receiving unit 802 is used to receive a permission reference relationship query request;

[0112] The processing unit 803 is used to determine the three-layer permission reference relationship from the role to the permission binding and from the permission binding to the user corresponding to the permission relationship query request according to the permission binding set corresponding to each role, the role set corresponding to each permission binding, the permission binding set corresponding to each user, and the user set corresponding to each permission binding;

[0113] The output unit 804 is used to output the three-layer permission reference relationship.

[0114] Figure 8 In the device shown,

[0115] The generating unit 801 generates a permission binding set corresponding to each role, a role set corresponding to each permission binding, a permission binding set corresponding to each user, and a user set corresponding to each permission binding based on the mapping relationship between permission binding and role and the mapping relationship between permission binding and user in the containerized application management cluster, including:

[0116] For each role, query the mapping relationship between permission bindings and roles in the containerized application management cluster, and add all permission bindings mapped to the role to the permission binding set corresponding to the role;

[0117] For each permission binding, query the mapping relationship between the permission binding and the role in the containerized application management cluster, and add the role mapped to the permission binding to the role set corresponding to the permission binding;

[0118] For each permission binding, query the mapping relationship between the permission binding and the user in the containerized application management cluster, and add all users mapped to the permission binding to the user set corresponding to the permission binding;

[0119] For each user, the mapping relationship between permission binding and user in the containerized application management cluster is queried, and all permission bindings mapped to the user are added to the permission binding set corresponding to the user.

[0120] Figure 8 In the device shown,

[0121] The permission relationship query request carries a query object; the query object includes: role, permission binding, and user;

[0122] The processing unit 803 determines the three-layer permission reference relationship from role to permission binding and from permission binding to user corresponding to the permission relationship query request according to the permission binding set corresponding to each role, the role set corresponding to each permission binding, the permission binding set corresponding to each user, and the user set corresponding to each permission binding, including:

[0123] Determine the target role corresponding to the query object carried in the permission relationship query request according to the permission binding set corresponding to each user and the role set corresponding to each permission binding;

[0124] According to the permission binding set corresponding to each role and the user set corresponding to each permission binding, a three-layer permission reference relationship from each target role to the permission binding and from the permission binding to the user is determined.

[0125] Figure 8 In the device shown,

[0126] The processing unit 803 determines the target role corresponding to the query object carried in the permission relationship query request according to the permission binding set corresponding to each user and the role set corresponding to each permission binding, including:

[0127] When the query object is a role, determining the role as a target role corresponding to the query object;

[0128] When the query object is a permission binding, query the role set corresponding to each permission binding to determine the role set corresponding to the query object, and determine each role in the role set as the target role corresponding to the query object;

[0129] When the query object is a user, query the permission binding set corresponding to each user to determine the permission binding set corresponding to the query object, query the role set corresponding to each permission binding to determine the role set corresponding to each permission binding in the permission binding set, and determine each role in each role set as the target role corresponding to the query object;

[0130] When the query object is a namespace, all roles in the namespace are determined as target roles corresponding to the query object;

[0131] When the query object is a cluster, all roles in the cluster are determined as target roles corresponding to the query object.

[0132] Figure 8 In the device shown,

[0133] The processing unit 803 determines, according to the permission binding set corresponding to each role and the user set corresponding to each permission binding, a three-layer permission reference relationship from each target role to the permission binding and from the permission binding to the user, including:

[0134] According to the permission binding set corresponding to each role, determine the permission binding set corresponding to the target role;

[0135] According to the user set corresponding to each permission binding, determine the user set corresponding to each permission binding in the permission binding set corresponding to the target role;

[0136] The target role, the permission binding set corresponding to the target role, the user set corresponding to each permission binding in the permission binding set corresponding to the target role are determined as, and a three-layer permission reference relationship from the target role to the permission binding and from the permission binding to the user.

[0137] The embodiment of the present invention further provides an electronic device, such as Fig. 9 As shown, the electronic device 900 includes: at least one processor 901, and a memory 902 connected to the at least one processor 901 via a bus; the memory 902 stores one or more computer programs that can be executed by the at least one processor 901; when the at least one processor 901 executes the one or more computer programs, the steps in the above-mentioned method for visualizing permission relationships in the containerized application management cluster are implemented.

[0138] An embodiment of the present invention further provides a computer-readable storage medium, which stores one or more computer programs. When the one or more computer programs are executed by a processor, the method for visualizing permission relationships in the containerized application management cluster is implemented.

[0139] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for visualizing permission relationships in a containerized application management cluster, characterized in that: The method includes: Based on the mapping relationship between permission binding and role and the mapping relationship between permission binding and user in the containerized application management cluster, generate a permission binding set corresponding to each role, a role set corresponding to each permission binding, a permission binding set corresponding to each user, and a user set corresponding to each permission binding; Receive a permission reference relationship query request; the permission reference relationship query request carries a query object; the query object includes: role, permission binding, and user; According to the permission binding set corresponding to each user and the role set corresponding to each permission binding, determine the target role corresponding to the query object carried by the permission reference relationship query request; wherein, when the query object is a role, determine the role as the target role corresponding to the query object; when the query object is a permission binding, query the role set corresponding to each permission binding to determine the role set corresponding to the query object, and determine each role in the role set as the target role corresponding to the query object; when the query object is a user, query the permission binding set corresponding to each user to determine the permission binding set corresponding to the query object, query the role set corresponding to each permission binding to determine the role set corresponding to each permission binding in the permission binding set, and determine each role in each role set as the target role corresponding to the query object; when the query object is a namespace, determine all roles in the namespace as the target role corresponding to the query object; when the query object is a cluster, determine all roles in the cluster as the target role corresponding to the query object; According to the permission binding set corresponding to each role and the user set corresponding to each permission binding, determine the three-layer permission reference relationship from each target role to the permission binding and from the permission binding to the user; Output the three-layer permission reference relationship.

2. The method according to claim 1, characterized in that Based on the mapping relationship between permission binding and role in the containerized application management cluster, and the mapping relationship between permission binding and user, a permission binding set corresponding to each role, a role set corresponding to each permission binding, a permission binding set corresponding to each user, and a user set corresponding to each permission binding are generated, including: For each role, query the mapping relationship between permission bindings and roles in the containerized application management cluster, and add all permission bindings mapped to the role to the permission binding set corresponding to the role; For each permission binding, query the mapping relationship between the permission binding and the role in the containerized application management cluster, and add the role mapped to the permission binding to the role set corresponding to the permission binding; For each permission binding, query the mapping relationship between the permission binding and the user in the containerized application management cluster, and add all users mapped to the permission binding to the user set corresponding to the permission binding; For each user, the mapping relationship between permission binding and user in the containerized application management cluster is queried, and all permission bindings mapped to the user are added to the permission binding set corresponding to the user.

3. The method according to claim 1, characterized in that According to the permission binding set corresponding to each role and the user set corresponding to each permission binding, determine the three-layer permission reference relationship from each target role to the permission binding and from the permission binding to the user, including: According to the permission binding set corresponding to each role, determine the permission binding set corresponding to the target role; According to the user set corresponding to each permission binding, determine the user set corresponding to each permission binding in the permission binding set corresponding to the target role; The target role, the permission binding set corresponding to the target role, and the user set corresponding to each permission binding in the permission binding set corresponding to the target role are determined as a three-layer permission reference relationship from the target role to the permission binding and from the permission binding to the user.

4. A device for visualizing permission relationships in a containerized application management cluster, characterized in that: The device includes: A generating unit, configured to generate, based on a mapping relationship between permission binding and roles and a mapping relationship between permission binding and users in a containerized application management cluster, a permission binding set corresponding to each role, a role set corresponding to each permission binding, a permission binding set corresponding to each user, and a user set corresponding to each permission binding; A receiving unit, configured to receive a permission reference relationship query request; the permission reference relationship query request carries a query object; the query object includes: a role, permission binding, and a user; A processing unit, configured to determine a target role corresponding to a query object carried in the permission reference relationship query request according to a permission binding set corresponding to each user and a role set corresponding to each permission binding; wherein, when the query object is a role, the role is determined as the target role corresponding to the query object; when the query object is a permission binding, the role set corresponding to each permission binding is queried to determine the role set corresponding to the query object, and each role in the role set is determined as the target role corresponding to the query object; when the query object is a user, the permission binding set corresponding to each user is queried to determine the permission binding set corresponding to the query object, the role set corresponding to each permission binding is queried to determine the role set corresponding to each permission binding in the permission binding set, and each role in each role set is determined as the target role corresponding to the query object; when the query object is a namespace, all roles in the namespace are determined as the target roles corresponding to the query object; when the query object is a cluster, all roles in the cluster are determined as the target roles corresponding to the query object; The processing unit is further used to determine a three-layer permission reference relationship from each target role to the permission binding and from the permission binding to the user according to the permission binding set corresponding to each role and the user set corresponding to each permission binding; The output unit is used to output the three-layer permission reference relationship.

5. The device according to claim 4, characterized in that The generating unit generates, based on the mapping relationship between the permission binding and the role in the containerized application management cluster and the mapping relationship between the permission binding and the user, a permission binding set corresponding to each role, a role set corresponding to each permission binding, a permission binding set corresponding to each user, and a user set corresponding to each permission binding, including: For each role, query the mapping relationship between permission bindings and roles in the containerized application management cluster, and add all permission bindings mapped to the role to the permission binding set corresponding to the role; For each permission binding, query the mapping relationship between the permission binding and the role in the containerized application management cluster, and add the role mapped to the permission binding to the role set corresponding to the permission binding; For each permission binding, query the mapping relationship between the permission binding and the user in the containerized application management cluster, and add all users mapped to the permission binding to the user set corresponding to the permission binding; For each user, the mapping relationship between permission binding and user in the containerized application management cluster is queried, and all permission bindings mapped to the user are added to the permission binding set corresponding to the user.

6. The device according to claim 4, characterized in that The processing unit determines, according to the permission binding set corresponding to each role and the user set corresponding to each permission binding, a three-layer permission reference relationship from each target role to the permission binding and from the permission binding to the user, including: According to the permission binding set corresponding to each role, determine the permission binding set corresponding to the target role; According to the user set corresponding to each permission binding, determine the user set corresponding to each permission binding in the permission binding set corresponding to the target role; The target role, the permission binding set corresponding to the target role, and the user set corresponding to each permission binding in the permission binding set corresponding to the target role are determined as a three-layer permission reference relationship from the target role to the permission binding and from the permission binding to the user.

7. An electronic device comprising: at least one processor, and a memory connected to the at least one processor via a bus; The memory stores one or more computer programs that can be executed by the at least one processor; it is characterized in that when the at least one processor executes the one or more computer programs, the method steps described in any one of claims 1-3 are implemented.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more computer programs, and when the one or more computer programs are executed by a processor, the method of any one of claims 1 to 3 is implemented.

Images