Kubernetes cloud native cluster resource deletion protection method, device, equipment and storage medium

Abstract

The present invention discloses a Kubernetes cloud native cluster resource deletion protection method, relates to the field of information technology, solves the technical problem that the resources of a container cluster are accidentally deleted, and the method comprises: an API Server configures and uses a Webhook Server through ValidatingWebhookConfiguration; the API Server receives a request to delete a cascade resource; after the API Server receives the request to delete the cascade resource, an authentication and authorization process is performed, if the authentication process passes, step 4 is executed; otherwise, information prohibiting deletion is returned; an admission controller is entered for compliance verification, if the compliance verification passes, information agreeing to delete is returned; otherwise, information prohibiting deletion is returned. The present invention also discloses a Kubernetes cloud native cluster resource deletion protection device, equipment and storage medium. The present invention protects certain key resources from being deleted by introducing set annotation configurations and admission webhooks, can perform special protection on cascade resources, and allows deletion only when all subordinate resources do not exist, thereby realizing conditional protection of resources.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and more specifically, to a Kubernetes cloud native cluster resource deletion protection method, device, equipment and storage medium. Background Art

[0002] In a Kubernetes cloud-native cluster, there are a large number of resources of various types, some of which are extremely important, such as namespaces, deployments, and user-defined resource definitions (CRDs). The importance of these resources lies in the fact that they are all cascade resources, that is, they are managers or owners of certain other resources. For example, a namespace may contain a container group (pod), and user-defined resources will be associated with custom resources (CR). Once such resources are deleted, kubernetes will adopt a cascade deletion mechanism, that is, when deleting these resources, their subordinate resources will also be deleted, and this deletion is generally irreversible. When certain key system resources are deleted, it may cause serious failures such as system crashes.

[0003] In the current Kubernetes cloud-native cluster, there is no protection mechanism for deleting these resources. There is only a propagationPolicy configuration in the deployment and stateful replica set (statefulSet) to specify whether to delete the generated container group in the foreground, background, or not. The first two configurations will eventually lead to the deletion of all resources. The third configuration can protect the generated container group from being deleted, but their parent resources are still deleted, leaving orphan container groups that are not particularly useful. Therefore, the current existing solutions cannot effectively prevent key and important resources from being accidentally deleted. Summary of the invention

[0004] The technical problem to be solved by the present invention is to address the above-mentioned deficiencies in the prior art. The purpose of the present invention is to provide a Kubernetes cloud native cluster resource deletion protection method, device, equipment and storage medium, which can effectively prevent key and important resources from being accidentally deleted.

[0005] The present invention provides a Kubernetes cloud native cluster resource deletion protection method, comprising:

[0006] Step 1: API Server configures WebhookServer using ValidatingWebhookConfiguration.

[0007] Step 2: The API Server receives a request to delete the cascade resource.

[0008] Step 3: When the API Server receives a request to delete a cascade resource, it performs authentication and authorization. If the authentication passes, it executes step 4; otherwise, it returns a message prohibiting deletion.

[0009] Step 4: Enter the admission controller to perform compliance verification. If the compliance verification passes, the message of consent for deletion is returned; otherwise, the message of prohibition for deletion is returned.

[0010] As a further improvement, the step 4 includes:

[0011] Step 41, enter the Mutating admission controller and execute the pre-configured MutatingAdmissionWebhook in series;

[0012] Step 42, enter the Validating Admission Controller and execute the ValidatingAdmissionWebhook;

[0013] Step 43, the Validating Admission Controller sends a request to delete the cascade resource and information about the cascade resource to the Webhook Server;

[0014] Step 44, the Webhook Server checks the metadata.annotations field of the cascade resource. If caih.io / deletion-prevention exists, it is necessary to further determine the value of caih.io / deletion-prevention; otherwise, it returns the information that the deletion is agreed.

[0015] Step 45, when caih.io / deletion-prevention: true, return information prohibiting deletion;

[0016] Step 46, when caih.io / deletion-prevention: cascade, it is necessary to further determine the subordinate resources of the cascade resource; if there are subordinate resources, return information prohibiting deletion; otherwise, return information agreeing to delete.

[0017] Further, when caih.io / deletion-prevention: true, after deleting caih.io / deletion-prevention: true, the cascade resource can be deleted.

[0018] Furthermore, when caih.io / deletion-prevention:cascade, after the number of subordinate resources of the cascade resource is reduced to 0, the cascade resource can be deleted.

[0019] Furthermore, the cascade resources include at least one of Namespace, CustomResourceDefinition, Deployment, StatefulSet, and ReplicaSet.

[0020] The present invention provides a Kubernetes cloud native cluster resource deletion protection device, the deletion protection device comprising:

[0021] The API Server module is used to configure the use of the Webhook Server through ValidatingWebhookConfiguration, receive requests to delete cascade resources, and send them to the authentication module;

[0022] The authentication module is used to perform the authentication and authorization process. If the authentication process passes, a request to delete the cascade resource is sent to the compliance verification module; otherwise, a message prohibiting deletion is returned;

[0023] The compliance verification module is used to perform compliance verification through the admission controller. If the compliance verification passes, the information that the deletion is allowed is returned; otherwise, the information that the deletion is prohibited is returned.

[0024] As a further improvement, the compliance verification module includes:

[0025] Mutating admission controller module, which is used to serially execute pre-configured MutatingAdmissionWebhooks;

[0026] The Validating Admission Controller module is used to send the request to delete the cascade resource and the information of the cascade resource to the Webhook Server module;

[0027] The Webhook Server module is used to detect the metadata.annotations field of the cascade resource. If caih.io / deletion-prevention exists, it is necessary to further determine the value of caih.io / deletion-prevention; otherwise, it returns the information that agrees to delete.

[0028] When caih.io / deletion-prevention: true, information about prohibiting deletion is returned;

[0029] When caih.io / deletion-prevention: cascade, it is necessary to further determine the subordinate resources of the cascade resource; if there are subordinate resources, return information prohibiting deletion; otherwise, return information agreeing to delete.

[0030] The present invention provides an electronic device, the device comprising a processor and a memory:

[0031] The memory is used to store program code and transmit the program code to the processor;

[0032] The processor is used to execute the above-mentioned deletion protection method according to the instructions in the program code.

[0033] The present invention provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program codes, and the program codes are used to execute the above-mentioned deletion protection method.

[0034] Beneficial Effects

[0035] Compared with the prior art, the present invention has the following advantages:

[0036] The present invention provides effective protection for cascade type resources and improves availability by introducing a resource deletion protection method, and proposes protection levels of different priorities, such as being able to strongly protect resources that need protection, and making it impossible to delete the resources before actively lifting the protection; for example, being able to weakly protect resources that need protection, and allowing them to be deleted as long as certain cascade resource conditions are met. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is the workflow diagram of the method in the present invention;

[0038] Figure 2 It is a framework diagram for practical application of the present invention;

[0039] Figure 3 This is a framework diagram for deleting deployment in the present invention. DETAILED DESCRIPTION

[0040] The present invention will be further described below with reference to the specific embodiments in the accompanying drawings.

[0041] See also Figures 1 to 3 The present invention provides a Kubernetes cloud native cluster resource deletion protection method, comprising:

[0042] Step 1: API Server configures WebhookServer using ValidatingWebhookConfiguration.

[0043] Step 2: The API Server receives a request to delete a cascade resource, where the cascade resource includes at least one of Namespace, CustomResourceDefinition, Deployment, StatefulSet, and ReplicaSet.

[0044] Step 3: When the API Server receives a request to delete a cascade resource, it performs authentication and authorization. If the authentication passes, it executes step 4; otherwise, it returns a message prohibiting deletion.

[0045] Step 4: Enter the admission controller to perform compliance verification. If the compliance verification passes, the message of consent for deletion is returned; otherwise, the message of prohibition for deletion is returned.

[0046] Step 4 includes:

[0047] Step 41, enter the Mutating admission controller and execute the pre-configured MutatingAdmissionWebhook in series;

[0048] Step 42, enter the Validating Admission Controller and execute the ValidatingAdmissionWebhook;

[0049] Step 43, the Validating Admission Controller sends a request to delete the cascade resource and information about the cascade resource to the Webhook Server;

[0050] Step 44, the Webhook Server checks the metadata.annotations field of the cascade resource. If caih.io / deletion-prevention exists, it is necessary to further determine the value of caih.io / deletion-prevention; otherwise, it returns the information that the deletion is agreed.

[0051] Step 45, when caih.io / deletion-prevention: true, return information prohibiting deletion;

[0052] Step 46, when caih.io / deletion-prevention: cascade, it is necessary to further determine the subordinate resources of the cascade resource; if there are subordinate resources, return information prohibiting deletion; otherwise, return information agreeing to delete.

[0053] When caih.io / deletion-prevention: true, cascaded resources can be deleted after deleting caih.io / deletion-prevention: true.

[0054] When caih.io / deletion-prevention: cascade, the cascade resource can be deleted after the number of its subordinate resources is reduced to 0.

[0055] The present invention provides a Kubernetes cloud native cluster resource deletion protection device, which includes:

[0056] The API Server module is used to configure the use of the Webhook Server through ValidatingWebhookConfiguration, receive a request to delete a cascade resource, and send it to the authentication module. The cascade resource includes at least one of Namespace, CustomResourceDefinition, Deployment, StatefulSet, and ReplicaSet;

[0057] The authentication module is used to perform the authentication and authorization process. If the authentication process passes, a request to delete the cascade resource is sent to the compliance verification module; otherwise, a message prohibiting deletion is returned;

[0058] The compliance verification module is used to perform compliance verification through the admission controller. If the compliance verification passes, the information that the deletion is allowed is returned; otherwise, the information that the deletion is prohibited is returned.

[0059] The compliance verification module includes:

[0060] Mutating admission controller module, which is used to serially execute pre-configured MutatingAdmissionWebhooks;

[0061] The Validating Admission Controller module is used to send the request to delete the cascade resource and the information of the cascade resource to the Webhook Server module;

[0062] The Webhook Server module is used to detect the metadata.annotations field of the cascade resource. If caih.io / deletion-prevention exists, it is necessary to further determine the value of caih.io / deletion-prevention; otherwise, it returns the information that agrees to delete.

[0063] When caih.io / deletion-prevention: true, information about prohibiting deletion is returned;

[0064] When caih.io / deletion-prevention: cascade, it is necessary to further determine the subordinate resources of the cascade resource; if there are subordinate resources, return information prohibiting deletion; otherwise, return information agreeing to delete.

[0065] The present invention provides an electronic device, the device comprising a processor and a memory:

[0066] The memory is used to store program code and transmit the program code to the processor;

[0067] The processor is used to execute the above-mentioned deletion protection method according to the instructions in the program code.

[0068] The present invention provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program codes, and the program codes are used to execute the above-mentioned deletion protection method.

[0069] Specific applications of this method

[0070] like Figure 2As shown in the figure, in actual applications, three Master Nodes are used as control nodes. The control nodes are not responsible for running workloads. Only some Kubernetes components run on them in the form of containers, including the application interface server API Server, the controller manager, and the scheduler.

[0071] N Worker Nodes are used as working nodes, and each working node runs the Kubelet component and multiple container groups as workloads.

[0072] The API Server on each Master Node is connected to the distributed database etcd for various resource configuration and status storage within the cluster.

[0073] Each node contains the Kubelet component, which acts as a proxy for the node to communicate with the Kubernetes cluster and also as a management component for the workload container group on the management node. Among them, the API Server is the control component of the kubernetes cluster, which can receive requests for adding, modifying, deleting, and monitoring resources such as Node, and reflect the changes to etcd.

[0074] like Figure 3 As shown, a Webhook Server is used to receive the ValidatingAdmissionWebhook request from the API Server to determine whether a cascade resource can be deleted. There are two deployments, where Deployment 1 is associated with two container groups Pod and has the annotation caih.io / deletion-prevention: cascade; Deployment 2 has no associated container group and has the annotation caih.io / deletion-prevention: true.

[0075] like Figure 1 , Figure 3 As shown, the steps of applying this method are as follows:

[0076] Execute step 1 and submit a ValidatingWebhookConfiguration to the API Server to configure the API Server to use the Webhook Server.

[0077] Execute step 2 and send a request to the API Server to delete deployment 1 and deployment 2.

[0078] Execute step 3. When the api-server receives the request to delete deployment 1 and deployment 2, it will first go through the authentication and authorization process. If it fails, it will return a message prohibiting deletion to the user. If it passes, it will enter the admission controller for compliance verification.

[0079] The specific execution process of admission controller is as follows:

[0080] The request first enters the Mutating admission controller and executes the pre-configured MutatingAdmissionWebhook in serial.

[0081] Then enter the Validating Admission Controller and execute the ValidatingAdmissionWebhook.

[0082] The Validating Admission Controller sends the information about the deployment 1 to be deleted and the deletion operation to the Webhook Server. The Webhook Server checks the deployment 1 and finds that there is a comment caih.io / deletion-prevention: cascade and there are two cascaded container groups in the deployment 1. Therefore, the Webhook Server returns a message to the Validating Admission Controller to interrupt the deletion operation and return information that the deletion is prohibited.

[0083] Similarly, when the request to delete deployment 2 and the deployment information are sent to the Webhook Server, the Webhook Server checks the deployment 2 and finds the annotation caih.io / deletion-prevention: true. Even if the deployment no longer has a cascaded container group, it will still return a message to the Validating Admission Controller to interrupt the deletion operation and return a message prohibiting deletion.

[0084] Execute step 4 to reduce the size of deployment 1 to 0, that is, the number of cascaded container groups becomes 0; delete the annotation caih.io / deletion-prevention: true of deployment 2. And send a request to the API Server to delete deployment 1 and deployment 2 again.

[0085] Execute step 5. After receiving the request, the api-server will go through the preliminary process in step 3. When the deletion request is sent to the Webhook Server, the Webhook Server checks the deployment 1 and finds that there is a comment caih.io / deletion-prevention: cascade, but the deployment no longer has a cascade container group. It returns the information that the ValidatingAdmission Controller agrees to delete the deployment 1.

[0086] The Webhook Server checks the deployment 2 and finds no annotation caih.io / deletion-prevention: true. It returns the information that the Validating Admission Controller agrees to delete the deployment 2.

[0087] The above are only preferred embodiments of the present invention. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the structure of the present invention, which will not affect the effect of the implementation of the present invention and the practicality of the patent.

Claims

1. A Kubernetes cloud native cluster resource deletion protection method, characterized in that: include: Step 1: API Server configures WebhookServer using ValidatingWebhookConfiguration. Step 2: The API Server receives a request to delete the cascade resource. Step 3: When the API Server receives the request to delete the cascaded resource, it performs the authentication and authorization process. If the authentication process passes, it executes step 4. Otherwise, return the information that deletion is prohibited; Step 4: Enter the admission controller for compliance verification. If the compliance verification passes, the message of consent for deletion is returned; Otherwise, return the information that deletion is prohibited; The step 4 comprises: Step 41, enter the Mutating admission controller and execute the pre-configured MutatingAdmissionWebhook in series; Step 42, enter the Validating Admission Controller and execute the ValidatingAdmissionWebhook; Step 43, the Validating Admission Controller sends a request to delete the cascade resource and information about the cascade resource to the Webhook Server; Step 44, the Webhook Server checks the metadata.annotations field of the cascade resource. If caih.io / deletion-prevention exists, it is necessary to further determine the value of caih.io / deletion-prevention; otherwise, it returns the information that the deletion is agreed. Step 45, when caih.io / deletion-prevention: true, return information prohibiting deletion; Step 46, when caih.io / deletion-prevention: cascade, it is necessary to further determine the subordinate resources of the cascade resource; if there are subordinate resources, return information prohibiting deletion; otherwise, return information agreeing to delete.

2. The Kubernetes cloud native cluster resource deletion protection method according to claim 1, characterized in that: When caih.io / deletion-prevention: true, the cascade resource can be deleted after deleting caih.io / deletion-prevention: true.

3. A Kubernetes cloud native cluster resource deletion protection method according to claim 1, characterized in that: When caih.io / deletion-prevention: cascade, the cascade resource can be deleted after the number of subordinate resources of the cascade resource is reduced to 0.

4. The Kubernetes cloud native cluster resource deletion protection method according to any one of claims 1 to 3, characterized in that: The cascade resource includes at least one of Namespace, CustomResourceDefinition, Deployment, StatefulSet, and ReplicaSet.

5. A Kubernetes cloud native cluster resource deletion protection device, characterized in that: The deletion protection device comprises: The APIServer module is used to configure the use of WebhookServer through ValidatingWebhookConfiguration, receive requests to delete cascade resources, and send them to the authentication module; The authentication module is used to perform the authentication and authorization process. If the authentication process passes, a request to delete the cascade resource is sent to the compliance verification module; otherwise, a message prohibiting deletion is returned; The compliance verification module is used to perform compliance verification through the admission controller. If the compliance verification passes, the information of consent for deletion is returned; otherwise, the information of prohibition for deletion is returned; The compliance verification module includes: Mutating admission controller module, which is used to serially execute pre-configured MutatingAdmissionWebhooks; The Validating Admission Controller module is used to send the request to delete the cascade resource and the information of the cascade resource to the Webhook Server module; The Webhook Server module is used to detect the metadata.annotations field of the cascade resource. If caih.io / deletion-prevention exists, it is necessary to further determine the value of caih.io / deletion-prevention; otherwise, it returns the information that agrees to delete. When caih.io / deletion-prevention: true, information about prohibiting deletion is returned; When caih.io / deletion-prevention: cascade, it is necessary to further determine the subordinate resources of the cascade resource; if there are subordinate resources, return information prohibiting deletion; otherwise, return information agreeing to delete.

6. The Kubernetes cloud native cluster resource deletion protection device according to claim 5, characterized in that: The cascade resource includes at least one of Namespace, CustomResourceDefinition, Deployment, StatefulSet, and ReplicaSet.

Images