Pod management method, device and electronic device in container cloud platform

Abstract

The present application provides a pod management method, device and electronic device in a container cloud platform, the method comprising: obtaining metadata of management policy requirements and attribute values ​​of management policy requirements by parsing the log data of the pod; labeling and classifying the metadata of the management policy requirements to obtain metadata labels; generating a policy template of the management policy requirements based on the metadata labels; filling the attribute values ​​of the management policy requirements into the policy template of the management policy requirements to obtain a management policy; passing the management policy to a policy controller in the container cloud platform so that the policy controller manages the pod according to the management policy. The embodiments of the present application can improve the operability of pod management in a container cloud platform.

Description

Technical Field

[0001] The present application relates to the field of cloud technology, and in particular to a pod management method, device and electronic device in a container cloud platform. Background Art

[0002] The container cloud based on the microservice architecture realizes lightweight and elastically scalable container resource scheduling through scheduling strategies. This technology will be one of the important implementation technologies of the 5G MEC cloud native platform. In the container cloud, container application changes and interactions between pods are relatively frequent, so it is necessary to impose safe and reliable management measures on the pods. In the prior art, taking the Kubernetes container cloud as an example, the Kubernetes pod is controlled and managed using the NetworkPolicy plug-in. Due to the lack of a sufficiently flexible policy formulation module in the NetworkPolicy plug-in, the management of the pod using the NetworkPolicy plug-in is less operable. Summary of the invention

[0003] One purpose of the present application is to propose a pod management method, device and electronic device in a container cloud platform, which can improve the operability of pod management in the container cloud platform.

[0004] According to one aspect of an embodiment of the present application, a pod management method in a container cloud platform is disclosed, the method comprising:

[0005] By parsing the log data of the pod, the metadata and attribute values ​​of the management policy requirements are obtained;

[0006] Labeling and classifying the metadata required by the management strategy to obtain metadata labels;

[0007] Based on the metadata tags, generating a policy template for managing policy requirements;

[0008] Filling the attribute value of the management policy requirement into the policy template of the management policy requirement to obtain the management policy;

[0009] The management policy is transmitted to a policy controller in the container cloud platform, so that the policy controller manages the pod according to the management policy.

[0010] According to one aspect of an embodiment of the present application, a pod management device in a container cloud platform is disclosed, the device comprising:

[0011] The log parsing module is configured to parse the log data of the pod to obtain the metadata and attribute values ​​of the management policy requirements;

[0012] A label classification module is configured to label and classify the metadata required by the management policy to obtain metadata labels;

[0013] A template generation module configured to generate a policy template for management policy requirements based on the metadata tag;

[0014] A data filling module, configured to fill the attribute values ​​required by the management policy into the policy template to obtain a management policy;

[0015] The policy delivery module is configured to deliver the management policy to the policy controller in the container cloud platform so that the policy controller manages the pod according to the management policy.

[0016] In an exemplary embodiment of the present application, the device is configured as follows:

[0017] By parsing the log data, abnormal behavior characteristics of the pod are obtained;

[0018] The metadata of the abnormal behavior feature is used as the metadata of the management policy requirement, and the attribute value of the normal behavior feature corresponding to the abnormal behavior feature is used as the attribute value of the management policy requirement.

[0019] In an exemplary embodiment of the present application, the device is configured as follows:

[0020] Acquire the logical relationship between the metadata tags;

[0021] The sub-policy templates preset for each of the metadata tags are called, and the sub-policy templates are connected according to the logical relationship to obtain the policy template of the management policy requirement.

[0022] In an exemplary embodiment of the present application, the device is configured as follows:

[0023] The metadata tag is sent to a policy template library to receive the sub-policy template from the policy template library.

[0024] In an exemplary embodiment of the present application, the device is configured as follows:

[0025] Decomposing the logical relationship step by step to obtain logical operation units constituting the logical relationship;

[0026] The logic operation units are respectively used as corresponding nodes, and the nodes are arranged and connected step by step according to the disassembly order to obtain a logic tree corresponding to the logic relationship;

[0027] The sub-policy template is added as a leaf node to the logic tree to obtain a policy template for the management policy requirement.

[0028] In an exemplary embodiment of the present application, the device is configured as follows:

[0029] The attribute value of the management policy requirement is used as the key value, and the configuration item in the policy template of the management policy requirement is used as the key value name, and the attribute value of the management policy requirement is filled into the policy template of the management policy requirement in a key-value pair manner.

[0030] In an exemplary embodiment of the present application, the policy template includes: an initialization template for specifying initialization parameters, an isolation scope template for specifying a pod isolation scope, a data flow direction template for specifying a pod data flow direction, and an application port template for specifying a pod application port.

[0031] According to one aspect of an embodiment of the present application, an electronic device is disclosed, including: a memory storing computer-readable instructions; and a processor reading the computer-readable instructions stored in the memory to execute any one of the methods described in the above embodiments.

[0032] According to one aspect of an embodiment of the present application, a computer-readable storage medium is disclosed, on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor of a computer, the computer executes any one of the methods described in the above embodiments.

[0033] According to one aspect of the embodiments of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the methods provided in the above various optional implementations.

[0034] In the embodiment of the present application, this process of the pod management method has no restrictions on the type of container cloud platform and can be extended to different types of container cloud platforms, which is highly flexible. In addition, by generating a policy template based on the metadata tags obtained by labeling classification, and then filling the attribute values ​​into the policy template to obtain the management policy, the management policy set for the pod can adaptably meet the needs of the pod, thereby improving the operability of pod management in the container cloud platform.

[0035] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0036] It should be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The above and other objects, features and advantages of the present application will become more apparent by describing in detail exemplary embodiments thereof with reference to the attached drawings.

[0038] Figure 1 A flow chart of a pod management method in a container cloud platform according to an embodiment of the present application is shown.

[0039] Figure 2 A policy template expressed in a logic tree according to an embodiment of the present application is shown.

[0040] Figure 3 The figure shows a management policy expressed in a logic tree according to an embodiment of the present application.

[0041] Figure 4 A schematic diagram of the structure of a container cloud platform according to an embodiment of the present application is shown.

[0042] Figure 5 A flow chart of a pod isolation method according to an embodiment of the present application is shown.

[0043] Figure 6 A block diagram of a pod management device in a container cloud platform according to an embodiment of the present application is shown.

[0044] Figure 7 A hardware diagram of an electronic device according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0045] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these example embodiments are provided so that the description of the present application will be more comprehensive and complete and the concepts of the example embodiments will be fully conveyed to those skilled in the art. The accompanying drawings are only schematic illustrations of the present application and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and thus their repeated description will be omitted.

[0046] In addition, the described features, structures or characteristics may be combined in one or more example embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the example embodiments of the present application. However, those skilled in the art will appreciate that the technical solution of the present application may be practiced while omitting one or more of the specific details, or other methods, components, steps, etc. may be adopted. In other cases, known structures, methods, implementations or operations are not shown or described in detail to avoid obscuring the present application and making the various aspects of the present application obscure.

[0047] Some of the blocks shown in the accompanying drawings are functional entities that do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0048] The present application provides a pod management method in a container cloud platform, the main purpose of which is to improve the operability of pod management in the container cloud platform.

[0049] Figure 1 A pod management method in a container cloud platform according to an embodiment of the present application is shown. The exemplary execution subject of the method is a container cloud platform. The method includes:

[0050] Step S110: Obtain metadata and attribute values ​​of management policy requirements by parsing the log data of the pod;

[0051] Step S120: label and classify the metadata required by the management policy to obtain metadata labels;

[0052] Step S130: Generate a policy template for management policy requirements based on the metadata tags;

[0053] Step S140: Fill the attribute value of the management policy requirement into the policy template of the management policy requirement to obtain the management policy;

[0054] Step S150: pass the management policy to the policy controller in the container cloud platform, so that the policy controller manages the pod according to the management policy.

[0055] In the embodiment of the present application, by parsing the log data of the pod, the problems existing in the pod during operation can be determined, and then on this basis, the metadata of the management policy requirements and the attribute values ​​of the management policy requirements can be obtained in a targeted manner. The metadata of the management policy requirements is mainly used to describe the various attribute components in the management policy requirements; the attribute values ​​of the management policy requirements are mainly used to describe the attribute values ​​of the various attribute components in the management policy requirements.

[0056] After obtaining the metadata of the management policy requirements, the metadata of the management policy requirements are tagged and classified to obtain metadata tags. Then, based on the metadata tags, a policy template that meets the management policy requirements is generated. Then, the attribute values ​​of the management policy requirements are filled into the policy template to obtain the management policy required by the management policy requirements, and then the management policy is passed to the policy controller in the container cloud platform.

[0057] The policy controller in the container cloud platform is mainly used to control the operation policies of various entities or logical bodies in the container cloud platform. Among them, various entities or logical bodies in the container cloud platform include containers and pods. After receiving the management policy, the policy controller can manage the corresponding pod according to the management policy.

[0058] It can be seen that in the embodiment of the present application, this process of the pod management method has no restrictions on the type of container cloud platform and can be extended to different types of container cloud platforms, which is highly flexible. In addition, by generating a policy template based on the metadata tags obtained by labeling classification, and then filling the attribute values ​​into the policy template to obtain the management policy, the management policy set for the pod can adaptively meet the needs of the pod, thereby improving the operability of pod management in the container cloud platform.

[0059] In one embodiment, the abnormal behavior characteristics of the pod are obtained by parsing the log data, the metadata of the abnormal behavior characteristics are used as the metadata of the management policy requirement, and the attribute value of the normal behavior characteristics corresponding to the abnormal behavior characteristics are used as the attribute value of the management policy requirement.

[0060] Specifically, by parsing the log data of the pod, the abnormal behavior characteristics of the pod are obtained. Abnormal behavior characteristics usually include resource anomalies (for example, pod resource quota is full) and network anomalies (for example, the network access frequency between pods exceeds the frequency threshold).

[0061] The metadata of abnormal behavior characteristics is mainly used to describe the attribute composition of abnormal behavior characteristics. Since the management policy requirements are made for the problems that occur during the operation of the pod, the attribute composition of the management policy requirements corresponds to the attribute composition of the abnormal behavior characteristics. Therefore, the metadata of abnormal behavior characteristics is used as the metadata of the management policy requirements.

[0062] Correspondingly, since the attribute values ​​of the management policy requirements are mainly used to accurately regulate the operation process of the pod, eliminate the abnormal behavior of the pod, and make the behavior characteristics of the pod within the normal range, the normal behavior characteristics corresponding to the abnormal behavior characteristics are determined, and then the attribute values ​​of the normal behavior characteristics are used as the attribute values ​​of the management policy requirements.

[0063] In one embodiment, the logical relationship between metadata tags is obtained, sub-policy templates preset for each metadata tag are called, and the sub-policy templates are connected according to the logical relationship to obtain a policy template for the management policy requirement.

[0064] Specifically, the logical relationship between metadata required by the management policy is extracted, and then the logical relationship between metadata is converted into the logical relationship between metadata tags. In addition, the sub-policy template corresponding to each metadata tag is called, and the sub-policy template is used to describe the policy composition of the corresponding metadata tag.

[0065] Then, these sub-policy templates are connected according to the logical relationship between the metadata tags to obtain a policy template for describing the policy composition of the management policy requirements.

[0066] In one embodiment, the metadata tag is sent to a policy template library to receive a sub-policy template from the policy template library.

[0067] Specifically, a policy template library is set up in the container cloud platform, which is used to store sub-policy templates corresponding to all metadata tags, and can respond to metadata tags sent by other components, retrieve corresponding sub-policy templates and return them.

[0068] In one embodiment, the logical relationship is disassembled level by level to obtain the logical operation units that constitute the logical relationship. The logical operation units are respectively used as corresponding nodes, and the nodes are arranged and connected level by level according to the disassembly order to obtain a logical tree corresponding to the logical relationship. The sub-policy template is added to the logical tree as a leaf node to obtain a policy template for managing policy requirements.

[0069] Specifically, after obtaining the logical relationship between metadata tags, the logical operation units are disassembled level by level according to their priorities. The disassembled logical operation units are then used as corresponding nodes, and are arranged and connected level by level while keeping their priorities unchanged, thereby obtaining a logical tree corresponding to the logical relationship. The sub-policy template is then added to the logical tree as a leaf node to obtain a policy template.

[0070] Figure 2 A policy template expressed in a logic tree according to an embodiment of the present application is shown.

[0071] In this embodiment, the management policy expressed by the combination of metadata tags is: (Policy Name: Cloud | Isolation Scope: Pod) & (Network Direction: Egress | (Isolation Scope: Namespace & Application Port: 8080)). Among them, "Policy Name", "Isolation Scope", "Network Direction", "Isolation Scope" and "Application Port" are metadata tags obtained after the metadata labeling classification of the management policy requirements.

[0072] After the logical relationship between the metadata tags is decomposed level by level, the highest priority logic operation unit is “&”, the next priority logic operation units are “|” and “|”, and the next priority logic operation unit is “&”.

[0073] Keeping the priority unchanged, the system connects the nodes step by step according to the disassembly to obtain a logic tree formed by connecting the logic operation units. Then, each metadata tag is added as a leaf node to the logic tree to obtain Figure 2 The policy template shown is expressed as a logical tree.

[0074] In one embodiment, the attribute value of the management policy requirement is used as the key value, and the configuration item in the policy template of the management policy requirement is used as the key value name, and the attribute value of the management policy requirement is filled into the policy template of the management policy requirement in the form of a key-value pair.

[0075] Specifically, after obtaining the attribute value and the policy template, the attribute value is matched with the configuration item in the policy template in a key-value pair manner, and then the attribute value is filled into the policy template to obtain the corresponding management policy.

[0076] Figure 3 The management strategy expressed in a logic tree according to an embodiment of the present application is shown.

[0077] Specifically, Figure 3 Shown is Figure 2 In the embodiment, the management policy obtained after the attribute values ​​are filled in the policy template. In this embodiment, the management policy expressed by the combination of metadata tags is: (Policy Name: Cloud | Isolation Scope: Pod) & (Network Direction: Egress | (Isolation Scope: Namespace & Application Port: 8080)). Among them, "Cloud", "Pod", "Egress", "Namespace" and "8080" are the attribute values ​​required by the management policy.

[0078] Fill the above attribute values ​​into Figure 2 After the policy template shown, we get Figure 3 The management strategy shown is expressed as a logic tree.

[0079] In one embodiment, the policy template includes: an initialization template for specifying initialization parameters, an isolation scope template for specifying a pod isolation scope, a data flow direction template for specifying a pod data flow direction, and an application port template for specifying a pod application port.

[0080] Specifically, the initialization template involves the initialization parameters required for policy initialization. The isolation range target is used to specify the range within which the pod is isolated. The data flow template is used to specify the egress and ingress directions of the pod's network data. The application port template is used to specify which application port the pod uses to communicate with other components.

[0081] Figure 4 A schematic diagram of the structure of a container cloud platform according to an embodiment of the present application is shown. Figure 5 A flow chart of a pod isolation method according to an embodiment of the present application is shown.

[0082] Combination Figure 4 as well as Figure 5 In one embodiment, in the Kubernetes container cloud platform, the pod is deployed in the Node node, and the policy controller for managing the pod is deployed in the Master node.

[0083] Compared with the Master node in the prior art, this embodiment adds a policy generator, which adaptively generates management policies for the pod by applying the pod management method provided in this application, so that the policy controller implements various management measures on the pod according to the management policies generated by the policy generator.

[0084] In the process of generating management policies, the policy generator's processing mainly includes the following parts: log analysis, metadata tag acquisition, policy template generation, and attribute value filling.

[0085] Specifically, the policy generator collects log data related to the pod, parses the collected log data, and extracts the abnormal behavior characteristics of the pod. Based on the extracted abnormal behavior characteristics, it determines whether the pod is abnormal. If not, there is no need to isolate the pod; if so, a corresponding isolation strategy needs to be formulated to isolate the pod.

[0086] After determining that the pod is abnormal, the policy generator labels and classifies the metadata of the management policy requirements to obtain metadata labels. The metadata labels are then sent to the policy template library, from which the corresponding policy template is retrieved. The attribute values ​​of the management policy requirements are then filled into the policy template to generate an isolation policy for the pod. The policy generator passes the generated isolation policy to the policy controller, which then executes the isolation policy to isolate the pod.

[0087] Figure 6 A pod management device in a container cloud platform according to an embodiment of the present application is shown, and the device includes:

[0088] The log parsing module 210 is configured to obtain metadata of the management policy requirements and attribute values ​​of the management policy requirements by parsing the log data of the pod;

[0089] The tag classification module 220 is configured to classify the metadata required by the management policy into tags to obtain metadata tags;

[0090] A template generation module 230, configured to generate a policy template for management policy requirements based on the metadata tag;

[0091] A data filling module 240 is configured to fill the attribute values ​​required by the management policy into the policy template to obtain a management policy;

[0092] The policy delivery module 250 is configured to deliver the management policy to the policy controller in the container cloud platform so that the policy controller manages the pod according to the management policy.

[0093] In an exemplary embodiment of the present application, the device is configured as follows:

[0094] By parsing the log data, abnormal behavior characteristics of the pod are obtained;

[0095] The metadata of the abnormal behavior feature is used as the metadata of the management policy requirement, and the attribute value of the normal behavior feature corresponding to the abnormal behavior feature is used as the attribute value of the management policy requirement.

[0096] In an exemplary embodiment of the present application, the device is configured as follows:

[0097] Acquire the logical relationship between the metadata tags;

[0098] The sub-policy templates preset for each of the metadata tags are called, and the sub-policy templates are connected according to the logical relationship to obtain the policy template of the management policy requirement.

[0099] In an exemplary embodiment of the present application, the device is configured as follows:

[0100] The metadata tag is sent to a policy template library to receive the sub-policy template from the policy template library.

[0101] In an exemplary embodiment of the present application, the device is configured as follows:

[0102] Decomposing the logical relationship step by step to obtain logical operation units constituting the logical relationship;

[0103] The logic operation units are respectively used as corresponding nodes, and the nodes are arranged and connected step by step according to the disassembly order to obtain a logic tree corresponding to the logic relationship;

[0104] The sub-policy template is added as a leaf node to the logic tree to obtain a policy template for the management policy requirement.

[0105] In an exemplary embodiment of the present application, the device is configured as follows:

[0106] The attribute value of the management policy requirement is used as the key value, and the configuration item in the policy template of the management policy requirement is used as the key value name, and the attribute value of the management policy requirement is filled into the policy template of the management policy requirement in a key-value pair manner.

[0107] In an exemplary embodiment of the present application, the policy template includes: an initialization template for specifying initialization parameters, an isolation scope template for specifying a pod isolation scope, a data flow direction template for specifying a pod data flow direction, and an application port template for specifying a pod application port.

[0108] Reference below Figure 7 The electronic device 30 according to the embodiment of the present application is described. Figure 7 The electronic device 30 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0109] like Figure 7 As shown, the electronic device 30 is in the form of a general computing device. The components of the electronic device 30 may include but are not limited to: at least one processing unit 310, at least one storage unit 320, and a bus 330 connecting different system components (including the storage unit 320 and the processing unit 310).

[0110] The storage unit stores program codes, which can be executed by the processing unit 310, so that the processing unit 310 performs the steps according to various exemplary embodiments of the present invention described in the description of the exemplary method described above in this specification. For example, the processing unit 310 can perform the following steps: Figure 1 The steps shown in .

[0111] The storage unit 320 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 3201 and / or a cache memory unit 3202 , and may further include a read-only memory unit (ROM) 3203 .

[0112] The storage unit 320 may also include a program / utility 3204 having a set (at least one) of program modules 3205, such program modules 3205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0113] Bus 330 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0114] The electronic device 30 may also communicate with one or more external devices 400 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 30, and / or may communicate with any device that enables the electronic device 30 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 350. The input / output (I / O) interface 350 is connected to a display unit 340. Furthermore, the electronic device 30 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 360. As shown, the network adapter 360 communicates with other modules of the electronic device 30 via a bus 330. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 30, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0115] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0116] In an exemplary embodiment of the present application, a computer-readable storage medium is further provided, on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor of a computer, the computer executes the method described in the above method embodiment.

[0117] According to one embodiment of the present application, a program product for implementing the method in the above method embodiment is also provided, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited to this. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0118] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0119] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0120] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0121] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as JAVA, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0122] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0123] In addition, although the steps of the method in the present application are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0124] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0125] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the appended claims.

Claims

1. A pod management method in a container cloud platform, characterized in that: The method comprises: By parsing the pod's log data, the abnormal behavior characteristics of the pod are obtained; Using the metadata of the abnormal behavior feature as metadata of the management policy requirement, and using the attribute value of the normal behavior feature corresponding to the abnormal behavior feature as the attribute value of the management policy requirement; Labeling and classifying the metadata required by the management strategy to obtain metadata labels; Acquire the logical relationship between the metadata tags; Calling sub-policy templates preset for each metadata tag, and connecting the sub-policy templates according to the logical relationship to obtain a policy template for the management policy requirement; Filling the attribute value of the management policy requirement into the policy template of the management policy requirement to obtain the management policy; The management policy is transmitted to a policy controller in the container cloud platform, so that the policy controller manages the pod according to the management policy.

2. The method according to claim 1, characterized in that Calling the sub-strategy templates preset for each metadata tag, including: The metadata tag is sent to a policy template library to receive the sub-policy template from the policy template library.

3. The method according to claim 1, characterized in that Connecting the sub-policy templates according to the logical relationship to obtain the policy template for the management policy requirement includes: Decomposing the logical relationship step by step to obtain logical operation units constituting the logical relationship; The logic operation units are respectively used as corresponding nodes, and the nodes are arranged and connected step by step according to the disassembly order to obtain a logic tree corresponding to the logic relationship; The sub-policy template is added as a leaf node to the logic tree to obtain a policy template for the management policy requirement.

4. The method according to claim 1, characterized in that: Filling the attribute value of the management policy requirement into the policy template of the management policy requirement includes: The attribute value of the management policy requirement is used as the key value, and the configuration item in the policy template of the management policy requirement is used as the key value name, and the attribute value of the management policy requirement is filled into the policy template of the management policy requirement in a key-value pair manner.

5. The method according to claim 1, characterized in that The policy templates include: an initialization template for specifying initialization parameters, an isolation range template for specifying a pod isolation range, a data flow direction template for specifying a pod data flow direction, and an application port template for specifying a pod application port.

6. A pod management device in a container cloud platform, characterized in that: The device comprises: The log parsing module is configured to obtain abnormal behavior characteristics of the pod by parsing the log data of the pod; use the metadata of the abnormal behavior characteristics as the metadata of the management policy requirement, and use the attribute value of the normal behavior characteristics corresponding to the abnormal behavior characteristics as the attribute value of the management policy requirement; A label classification module is configured to label and classify the metadata required by the management policy to obtain metadata labels; A template generation module is configured to obtain the logical relationship between the metadata tags; call the sub-policy templates preset for each metadata tag, and connect the sub-policy templates according to the logical relationship to obtain the policy template of the management policy requirement; A data filling module, configured to fill the attribute values ​​required by the management policy into the policy template to obtain a management policy; The policy delivery module is configured to deliver the management policy to the policy controller in the container cloud platform so that the policy controller manages the pod according to the management policy.

7. An electronic device, characterized in that: include: a memory storing computer-readable instructions; The processor reads the computer readable instructions stored in the memory to execute the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: Computer readable instructions are stored thereon, and when the computer readable instructions are executed by a processor of a computer, the computer is caused to execute the method of any one of claims 1-5.

Images