Container deployment method and device

Abstract

The application relates to the technical field of key management and application, in particular to a container deployment method and device. The method is applied to a k8s cluster, and the method comprises the following steps: assigning a corresponding key to each accessed user; when a target user deploys a target container, calling a target key corresponding to the target user to perform encryption processing on sensitive information that needs to be encrypted in a first configuration file used for running the target container, so as to obtain a second configuration file containing the sensitive information after encryption; and sending the second configuration file to the target container, so that the target container runs based on the second configuration file.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of key management and application, and particularly relates to a container deployment method and device. BACKGROUND

[0002] As a container application orchestration tool promoted by cncf, k8s manages all resource objects in the cluster managed by k8s, and can realize automatic deployment of container services, business expansion, service rolling upgrade and other functions, and has good scalability and stability and other characteristics. In the container deployment process of the k8s cluster, in order to manage sensitive information of users and applications, a Secret object is used as a processing method of sensitive information, which is mainly suitable for storing sensitive information such as passwords, tokens and ssh keys. These information is stored in secret, and users can directly reference the secret object in the resource.

[0003] However, both the system and the user can create a secret, and use it mutually, that is, a secret object created by one user can be obtained and used by other users, and the encryption method of the secret uses base64 encoding, and other users can decode the original data through base64, and the data security is not high. SUMMARY

[0004] The present application provides a container deployment method and device to solve the problem that sensitive information cannot be isolated by users and the security of sensitive information is not high in the prior art.

[0005] In a first aspect, an embodiment of the present application provides a container deployment method applied to a k8s cluster, and the method comprises the following steps:

[0006] A corresponding key is allocated to each accessed user;

[0007] When a target user deploys a target container, a target key corresponding to the target user is called to encrypt sensitive information that needs to be encrypted in a first configuration file used to run the target container, to obtain a second configuration file containing the encrypted sensitive information;

[0008] The second configuration file is sent to the target container, so that the target container runs based on the second configuration file.

[0009] Optionally, the k8s cluster is integrated with a key management system; and the step of allocating a corresponding key to each accessed user comprises the following steps:

[0010] A corresponding key is allocated to each accessed user based on the key management system.

[0011] Optionally, the method further comprises:

[0012] verifying the user identity of the to-be-accessed user based on a username / password pair input by the to-be-accessed user;

[0013] when the verification is passed, determining that the user accesses.

[0014] Optionally, if the encryption algorithm is asymmetric encryption, the key assigned to each accessed user is a key pair; and the step of calling the target key pair corresponding to the target user for performing encryption processing on the sensitive information that needs to be encrypted in the first configuration file for running the target container comprises:

[0015] calling the public key in the target key pair corresponding to the target user to perform encryption processing on the sensitive information that needs to be encrypted in the first configuration file;

[0016] The method further comprises:

[0017] calling the private key in the target key pair corresponding to the target user to perform decryption processing on the encrypted sensitive information in the second configuration file.

[0018] Optionally, if the encryption algorithm is symmetric encryption, the key assigned to each accessed user is a private key; and the step of calling the target key pair corresponding to the target user for performing encryption processing on the sensitive information that needs to be encrypted in the first configuration file for running the target container comprises:

[0019] calling the private key corresponding to the target user to perform encryption processing on the sensitive information that needs to be encrypted in the first configuration file;

[0020] The method further comprises:

[0021] calling the private key corresponding to the target user to perform decryption processing on the encrypted sensitive information in the second configuration file.

[0022] In a second aspect, the application provides a container deployment apparatus applied to a k8s cluster, the apparatus comprising:

[0023] an allocation unit configured to assign a corresponding key to each accessed user;

[0024] an encryption unit configured to, when a target user deploys a target container, call a target key pair corresponding to the target user for performing encryption processing on sensitive information that needs to be encrypted in a first configuration file for running the target container, to obtain a second configuration file containing the encrypted sensitive information;

[0025] a sending unit configured to send the second configuration file to the target container, so that the target container runs based on the second configuration file.

[0026] Optionally, the k8s cluster is integrated with a key management system; when allocating a corresponding key to each connected user, the allocation unit is specifically configured to:

[0027] Based on the key management system, a corresponding key is allocated to each connected user.

[0028] Optionally, the device further comprises:

[0029] A verification unit, configured to verify the user identity of the user to be accessed based on the user name / password input by the user to be accessed;

[0030] The determination unit is used to determine the user access when the verification is passed.

[0031] Optionally, if the encryption algorithm is asymmetric encryption, the key allocated to each connected user is a key pair; when calling the target key pair corresponding to the target user to encrypt sensitive information to be encrypted in the first configuration file for running the target container, the encryption unit is specifically configured to:

[0032] Calling the public key in the key pair corresponding to the target user to encrypt the sensitive information to be encrypted in the first configuration file;

[0033] The device further comprises:

[0034] The decryption unit is configured to call a private key in a key pair corresponding to the target user to decrypt the encrypted sensitive information in the second configuration file.

[0035] Optionally, if the encryption algorithm is symmetric encryption, the key allocated to each connected user is a private key; when calling the target key corresponding to the target user to encrypt the sensitive information to be encrypted in the first configuration file used to run the target container, the encryption unit is specifically used to:

[0036] Calling the private key corresponding to the target user to encrypt the sensitive information to be encrypted in the first configuration file;

[0037] The device further comprises:

[0038] The decryption unit is configured to call a private key corresponding to the target user to decrypt the encrypted sensitive information in the second configuration file.

[0039] In a third aspect, an embodiment of the present application provides a container deployment device, the container deployment device comprising:

[0040] a memory for storing program instructions;

[0041] The processor is configured to call the program instructions stored in the memory and execute the steps of the method as described in any one of the first aspects above according to the obtained program instructions.

[0042] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the steps of the method described in any one of the above-mentioned first aspects.

[0043] In summary, the container deployment method provided in the embodiment of the present application is applied to a k8s cluster, and the method includes: assigning a corresponding key to each connected user; when detecting that the target user deploys a target container, calling the target key corresponding to the target user to encrypt the sensitive information to be encrypted in the first configuration file used to run the target container, and obtaining a second configuration file containing the encrypted sensitive information; sending the second configuration file to the target container so that the target container runs based on the second configuration file.

[0044] By adopting the container deployment method provided in the embodiment of the present application, a corresponding key is pre-configured for each connected user. When any connected user uses the k8s cluster to deploy a container, the key corresponding to the user can be used to encrypt the sensitive information to be encrypted, thereby realizing user-based isolation of the key, that is, sensitive information encrypted using the key corresponding to a user can only be encrypted based on the key corresponding to the user to obtain the original data, and the use of the key to encrypt the sensitive information greatly enhances the security of the original data. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments of the present application or the description of the prior art. Obviously, the drawings described below are only some embodiments recorded in this application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings of the embodiments of the present application.

[0046] Figure 1 A detailed flowchart of a container deployment method provided in an embodiment of the present application;

[0047] Figure 2 A schematic diagram of the structure of a container deployment device provided in an embodiment of the present application;

[0048] Figure 3 A schematic diagram of the structure of another container deployment device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] The terminology used in the description of the application herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in the description of the application and the appended claims, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It also will be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0050] It is to be understood that, although the terms first, second, third, etc. can be used herein to describe various information, the information should not be limited to these terms. These terms are only used to differentiate one piece of information from another. For example, a first information can also be termed a second information, similarly, a second information can also be termed a first information without departing from the scope of the application. Depending on the context, the word "if' can be interpreted to mean "when" or "in response to determining".

[0051] For example, referring to Figure 1 As shown in the detailed flowchart of a container deployment method provided by the embodiments of the application, the method is applied to a k8s cluster, and the method comprises the following steps:

[0052] Step 100: Assign a corresponding key to each accessed user.

[0053] In the embodiments of the application, the k8s cluster is integrated with a key management system (KMS), and therefore, when a corresponding key is assigned to each accessed user, a preferred implementation manner is to assign a corresponding key to each accessed user based on the key management system.

[0054] That is, a corresponding key can be assigned to each user accessing the k8s cluster by the key management system.

[0055] In actual application, when a user accesses the k8s cluster, the k8s cluster needs to perform identity authentication on the user to be accessed, and therefore, before a corresponding key is assigned to each accessed user in the embodiments of the application, the above container deployment method further comprises the following steps:

[0056] Verify the user identity of the user to be accessed based on the username / password input by the user to be accessed, and when the verification is passed, determine that the user accesses, that is, the user is an accessed user.

[0057] Step 110: When it is detected that the target user deploys the target container, call the target key corresponding to the target user to encrypt the sensitive information that needs to be encrypted in the first configuration file used to run the target container, to obtain a second configuration file containing the encrypted sensitive information.

[0058] In the embodiments of the present application, the accessed users can deploy containers through the k8s cluster. Before the container deployment, the users need to prepare configuration files. During the container deployment and running, the parameters in the configuration files need to be relied on for deployment and running. Moreover, there are many sensitive information (such as passwords, tokens and ssh keys) in the configuration files. Therefore, in order to ensure the security of the sensitive information, special processing needs to be performed on the sensitive information, so that other users cannot obtain the specific content of the sensitive information after obtaining the processed sensitive information. In the embodiments of the present application, when it is detected that the target user is deploying a target container, a key pair allocated for the target user is called to perform encryption processing on sensitive information in a first configuration file used for running the target container.

[0059] In actual application, the encryption algorithm can be asymmetric encryption or symmetric encryption. If the encryption algorithm is asymmetric encryption, the key allocated for each accessed user is a key pair. The step of calling the target key pair corresponding to the target user to perform encryption processing on the sensitive information in the first configuration file used for running the target container includes:

[0060] calling the public key in the key pair corresponding to the target user to perform encryption processing on the sensitive information in the first configuration file.

[0061] If the encryption algorithm is symmetric encryption, the key allocated for each accessed user is a private key. The step of calling the target key pair corresponding to the target user to perform encryption processing on the sensitive information in the first configuration file used for running the target container includes:

[0062] calling the private key in the key pair corresponding to the target user to perform encryption processing on the sensitive information in the first configuration file.

[0063] Step 120: sending the second configuration file to the target container, so that the target container runs based on the second configuration file.

[0064] Specifically, the second configuration file containing the encrypted sensitive information is sent to the target container, so that the target container performs decryption processing on the encrypted sensitive information based on the key pair corresponding to the target user, and runs the container based on the decrypted sensitive information.

[0065] If the encryption algorithm is asymmetric encryption, when the encrypted sensitive information is decrypted, the private key in the key pair corresponding to the target user is called to perform decryption processing on the encrypted sensitive information in the second configuration file.

[0066] If the encryption algorithm is asymmetric encryption, when the encrypted sensitive information is decrypted, the private key corresponding to the target user is called to decrypt the encrypted sensitive information in the second configuration file.

[0067] For example, referring to Figure 2 As shown in the structural schematic diagram of a container deployment device, the metadata backup device is applied to a k8s cluster, and the container deployment device at least includes an allocation unit 20, an encryption unit 21, and a sending unit 22.

[0068] The allocation unit 20 is configured to allocate a corresponding key to each accessed user.

[0069] The encryption unit 21 is configured to, when detecting that a target user deploys a target container, call a target key corresponding to the target user to encrypt sensitive information that needs to be encrypted in a first configuration file used to run the target container, to obtain a second configuration file containing the encrypted sensitive information.

[0070] The sending unit 22 is configured to send the second configuration file to the target container, so that the target container runs based on the second configuration file.

[0071] Optionally, the k8s cluster is integrated with a key management system; when allocating a corresponding key to each accessed user, the allocation unit 20 is specifically configured to:

[0072] Allocate a corresponding key to each accessed user based on the key management system.

[0073] Optionally, the device further includes:

[0074] The verification unit is configured to verify the user identity of a user to be accessed based on a username / password input by the user to be accessed.

[0075] The determination unit is configured to determine that the user is accessed when the verification is passed.

[0076] Optionally, if the encryption algorithm is asymmetric encryption, the key allocated to each accessed user is a key pair; when the encryption unit 21 calls a target key corresponding to the target user to encrypt the sensitive information that needs to be encrypted in the first configuration file used to run the target container, the encryption unit 21 is specifically configured to:

[0077] Call a public key in the key pair corresponding to the target user to encrypt the sensitive information that needs to be encrypted in the first configuration file.

[0078] The device further includes:

[0079] The decryption unit is configured to call a private key in a key pair corresponding to the target user to decrypt the sensitive information encrypted in the second configuration file.

[0080] Optionally, if the encryption algorithm is symmetric encryption, the key assigned to each accessed user is a private key. When the encryption unit 21 is used to call a target key pair corresponding to the target user to encrypt the sensitive information to be encrypted in the first configuration file of the target container, the encryption unit 21 is specifically configured to:

[0081] call the private key corresponding to the target user to encrypt the sensitive information to be encrypted in the first configuration file;

[0082] The apparatus further includes:

[0083] The decryption unit is configured to call a private key corresponding to the target user to decrypt the sensitive information encrypted in the second configuration file.

[0084] The above units can be one or more integrated circuits configured to implement the above methods, for example, one or more application specific integrated circuits (ASICs), or one or more digital signal processors (DSPs), or one or more field programmable gate arrays (FPGAs), etc. For another example, when a certain unit above is implemented in the form of a processing element scheduling code, the processing element can be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call code. For another example, the units can be integrated together in the form of a system on a chip (SOC).

[0085] Further, the container deployment apparatus provided by the embodiments of the present application can be implemented from the hardware layer. The hardware architecture diagram of the container deployment can be seen from Figure 3 As shown in the figure, the container deployment apparatus can include a memory 30 and a processor 31,

[0086] The memory 30 is configured to store program instructions, and the processor 31 calls the program instructions stored in the memory 30 to execute the above method embodiments according to the obtained program instructions. The specific implementation and technical effects are similar, and will not be repeated here.

[0087] Optionally, the present application also provides a container deployment apparatus including at least one processing element (or chip) for executing the above method embodiments.

[0088] Optionally, the present application also provides a program product, for example, a computer readable storage medium, which stores computer executable instructions for causing the computer to execute the above-mentioned method embodiments.

[0089] Here, the machine readable storage medium can be any electronic, magnetic, optical, or other physical storage device that contains or stores information, such as executable instructions, data, etc. For example, the machine readable storage medium can be a RAM (Random Access Memory), a volatile memory, a non-volatile memory, a flash memory, a storage drive (such as a hard drive), a solid state drive, any type of storage disk (such as a compact disk, a DVD, etc.), or similar storage medium, or a combination thereof.

[0090] The system, apparatus, module or unit illustrated in the above embodiments can be specifically implemented by a computer chip or entity, or by a product with certain functions. A typical implementation device is a computer, and the specific form of the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0091] For the convenience of description, the above apparatus is described in various units by function respectively. Of course, the functions of each unit can be implemented in the same or multiple software and / or hardware in the implementation of the present application.

[0092] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the embodiments of the present application can take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to a magnetic disk storage, a CD-ROM, an optical storage, etc.) containing computer usable program code.

[0093] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart or flowsheet block or blocks. Figure 1 one or more flowsheet or flowsheet blocks. Figure 1 one or more flowsheet or flowsheet blocks.

[0094] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart or flowsheet block or blocks. Figure 1 one or more flowsheet or flowsheet blocks. Figure 1 one or more flowsheet or flowsheet blocks.

[0095] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart or flowsheet block or blocks. Figure 1 one or more flowsheet or flowsheet blocks. Figure 1 one or more flowsheet or flowsheet blocks.

[0096] The above only describes the preferred embodiments of the present application and is not used to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of protection of the present application.

Claims

1. A container deployment method, characterized in that: Applied to a k8s cluster, the method includes: Assign a corresponding key to each connected user; When a target user is detected deploying a target container, a target key corresponding to the target user is called to encrypt sensitive information to be encrypted in a first configuration file for running the target container, thereby obtaining a second configuration file containing the encrypted sensitive information, wherein the sensitive information is a password, a token, and an SSH key; Sending the second configuration file to the target container, so that the target container runs based on the second configuration file; The k8s cluster is integrated with a key management system; the steps of assigning a corresponding key to each connected user include: Based on the key management system, a corresponding key is allocated to each connected user.

2. The method according to claim 1, wherein The method further comprises: Verify the user identity of the user to be connected based on the username / password entered by the user to be connected; When the verification is successful, the user is allowed to access.

3. The method according to claim 1 or 2, wherein: If the encryption algorithm is asymmetric encryption, the key assigned to each connected user is a key pair; The step of calling the target key corresponding to the target user to encrypt the sensitive information to be encrypted in the first configuration file used to run the target container includes: Calling the public key in the key pair corresponding to the target user to encrypt the sensitive information to be encrypted in the first configuration file; The method further comprises: The private key in the key pair corresponding to the target user is called to decrypt the encrypted sensitive information in the second configuration file.

4. The method according to claim 1 or 2, wherein: If the encryption algorithm is symmetric encryption, the key assigned to each connected user is the private key; The step of calling the target key corresponding to the target user to encrypt the sensitive information to be encrypted in the first configuration file used to run the target container includes: Calling the private key corresponding to the target user to encrypt the sensitive information to be encrypted in the first configuration file; The method further comprises: The private key corresponding to the target user is called to decrypt the encrypted sensitive information in the second configuration file.

5. A container deployment device, characterized in that: Applied to a k8s cluster, the device includes: A distribution unit, configured to distribute a corresponding key to each connected user; an encryption unit configured to, upon detecting that a target user deploys a target container, invoke a target key corresponding to the target user to encrypt sensitive information to be encrypted in a first configuration file used to run the target container, thereby obtaining a second configuration file containing the encrypted sensitive information, wherein the sensitive information includes a password, a token, and an SSH key; a sending unit, configured to send the second configuration file to the target container, so that the target container runs based on the second configuration file; The k8s cluster is integrated with a key management system; the allocation unit is specifically used to: Based on the key management system, a corresponding key is allocated to each connected user.

6. The device according to claim 5, characterized in that The device further comprises: A verification unit, configured to verify the user identity of the user to be accessed based on the user name / password input by the user to be accessed; The determination unit is used to determine the user access when the verification is passed.

7. The device according to claim 5 or 6, characterized in that If the encryption algorithm is asymmetric encryption, the key allocated to each connected user is a key pair; when calling the target key pair corresponding to the target user to encrypt the sensitive information to be encrypted in the first configuration file for running the target container, the encryption unit is specifically used to: Calling the public key in the key pair corresponding to the target user to encrypt the sensitive information to be encrypted in the first configuration file; The device further comprises: The decryption unit is configured to call a private key in a key pair corresponding to the target user to decrypt the encrypted sensitive information in the second configuration file.

8. The device according to claim 5 or 6, characterized in that If the encryption algorithm is symmetric encryption, the key allocated to each connected user is a private key; when calling the target key corresponding to the target user to encrypt the sensitive information to be encrypted in the first configuration file used to run the target container, the encryption unit is specifically used to: Calling the private key corresponding to the target user to encrypt the sensitive information to be encrypted in the first configuration file; The device further comprises: The decryption unit is configured to call a private key corresponding to the target user to decrypt the encrypted sensitive information in the second configuration file.

Images