Anomaly detection methods and devices for resources, storage media, and electronic devices.

Abstract

This invention provides a method, apparatus, storage medium, and electronic device for detecting resource anomalies. The method includes: acquiring routing configuration information of the gateway of a target application; acquiring configuration information of Ingress resources configured in the Namespace resource of a containerized application Kubernetes (K8s), wherein both the Ingress resource and the Namespace resource include tag information of the target application, the Namespace resource is used for resource isolation in K8s, and the Ingress resource is used for traffic distribution in K8s; and performing anomaly detection on the Ingress resource based on the gateway's routing configuration information and the Ingress resource's configuration information. This invention solves the problem of monitoring Ingress resources in related technologies, achieving effective monitoring of Ingress resources.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of communications, and more specifically, to a method and apparatus for detecting resource anomalies, a storage medium, and an electronic device. Background Technology

[0002] With the continuous development of cloud-native technologies and the ongoing cloudification of traditional businesses, the entire business environment is becoming increasingly complex, and the need for interconnection and access between services inside and outside the cloud is becoming more and more urgent. Traditional gateway services only have basic static routing configuration functions, and cannot flexibly manage and dynamically configure the lightweight, multi-tenant, rapid deployment, and elastic scaling characteristics of container services.

[0003] On a Kubernetes-based container cloud platform, users can manage and maintain access routes for their application services within the cluster using Ingress resources to achieve unified access to application services within the cluster. However, when facing external access needs in situations where there is network isolation between the cloud and the outside world, a unified gateway is needed to expose routing information to external applications so that external applications can access services within the cluster.

[0004] However, in existing technologies, users cannot arbitrarily create Ingress resources themselves. A publishing process and a series of pre-processing operations via a backend service are required before they can be used normally. It cannot monitor Ingress resources under a specific namespace category (multiple and variable in number); it can only monitor all or a specific (the number cannot be dynamically changed) namespaces. The namespace must be monitored first, followed by the Ingress resources within that namespace. Furthermore, it lacks duplicate compatibility mechanisms and alerting mechanisms. When an Ingress resource with the same published API address exists in the cluster or is abnormally created, it may cause errors in the upstream service address corresponding to that API, without any task exception alerts. Summary of the Invention

[0005] This invention provides a method and apparatus for detecting resource anomalies, a storage medium, and an electronic device, to at least solve the problem of monitoring Ingress resources in related technologies.

[0006] According to an embodiment of the present invention, a method for detecting resource anomalies is provided, comprising: obtaining routing configuration information of a gateway of a target application; obtaining configuration information of an Ingress resource configured in a Namespace resource in a containerized application Kubernetes (K8s), wherein both the Ingress resource and the Namespace resource include tag information of the target application, the Namespace resource is used for resource isolation in K8s, and the Ingress resource is used for traffic distribution in K8s; and performing anomaly detection on the Ingress resource based on the routing configuration information of the gateway and the configuration information of the Ingress resource.

[0007] According to another embodiment of the present invention, an anomaly detection device for resources is provided, comprising: a first acquisition module, configured to acquire routing configuration information of a gateway of a target application; a second acquisition module, configured to acquire configuration information of Ingress resources configured in the Namespace resource of a containerized application Kubernetes (K8s), wherein both the Ingress resource and the Namespace resource include tag information of the target application, the Namespace resource is used for resource isolation in K8s, and the Ingress resource is used for traffic distribution in K8s; and a first detection module, configured to perform anomaly detection on the Ingress resource based on the routing configuration information of the gateway and the configuration information of the Ingress resource.

[0008] In one exemplary embodiment, the apparatus further includes: a first sending module, configured to send a first request message to the packet manager Helm before obtaining the routing configuration information of the gateway of the target application; wherein the first request message is configured to request Helm to configure the gateway in the target application and to mark the tag information of the target application in the control unit of the Namespace resource.

[0009] In an exemplary embodiment, the apparatus further includes: a first receiving module, configured to receive a second request from a user before obtaining configuration information of the Ingress resource configured in the Namespace resource of the containerized application Kubernetes; and a first establishing module, configured to establish the Ingress resource in the Namespace resource based on the second request information, wherein the tag information of the target application in the Ingress resource is set by the event handling application in the Kubernetes.

[0010] In an exemplary embodiment, the first detection module includes: a first determining unit, configured to add the routing configuration information in the configuration information of the Ingress resource to the routing configuration information in the gateway, and determine N routing configuration information, wherein N is a natural number greater than 1; a second determining unit, configured to determine abnormal routing configuration information from the N routing configuration information; and a first detection unit, configured to perform abnormal detection on the Ingress resource based on the abnormal routing information.

[0011] In one exemplary embodiment, the apparatus further includes: a first sending module, configured to send an abnormality alarm message to a user when it is determined that the Ingress resource is abnormal, wherein the abnormality alarm message is used to warn the user that the Ingress resource is abnormal.

[0012] According to yet another embodiment of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored therein, wherein the computer program is configured to perform the steps in any of the above method embodiments when executed.

[0013] According to yet another embodiment of the present invention, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0014] This invention obtains the routing configuration information of the target application's gateway and the configuration information of the Ingress resource within the Namespace resource configuration of the containerized application's Kubernetes (K8s). Both the Ingress resource and the Namespace resource include the target application's tag information. The Namespace resource is used for resource isolation in K8s, while the Ingress resource is used for traffic distribution in K8s. Furthermore, it performs anomaly detection on the Ingress resource based on the gateway's routing configuration information and the Ingress resource configuration information. This achieves the management and maintenance of Ingress resources. Therefore, it solves the problem of monitoring Ingress resources in related technologies, achieving effective monitoring of Ingress resources. Attached Figure Description

[0015] Figure 1 This is a hardware structure block diagram of a mobile terminal for a resource anomaly detection method according to an embodiment of the present invention.

[0016] Figure 2 This is a flowchart of a resource anomaly detection method according to an embodiment of the present invention;

[0017] Figure 3This is an overall flowchart according to an embodiment of the present invention;

[0018] Figure 4 This is a flowchart of creating a gateway according to an embodiment of the present invention;

[0019] Figure 5 This is a flowchart illustrating the creation of an Ingress resource according to an embodiment of the present invention;

[0020] Figure 6 This is a flowchart of anomaly detection according to an embodiment of the present invention;

[0021] Figure 7 This is a structural block diagram of a resource anomaly detection device according to an embodiment of the present invention. Detailed Implementation

[0022] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings and examples.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0024] The methods and embodiments provided in this application can be executed on a mobile terminal, computer terminal, or similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure block diagram of a mobile terminal for a resource anomaly detection method according to an embodiment of the present invention. Figure 1 As shown, a mobile terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0025] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the resource anomaly detection method in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer programs stored in the memory 104, thereby implementing the aforementioned method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0026] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the mobile terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0027] This embodiment provides a method for detecting resource anomalies. Figure 2 This is a flowchart of a resource anomaly detection method according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps:

[0028] Step S202: Obtain the routing configuration information of the target application's gateway;

[0029] Step S204: Obtain the configuration information of the Ingress resource in the Namespace resource configuration of the containerized application K8s. Both the Ingress resource and the Namespace resource include the tag information of the target application. The Namespace resource is used for resource isolation in K8s, and the Ingress resource is used for traffic distribution in K8s.

[0030] Step S206: Perform anomaly detection on the Ingress resource based on the gateway's routing configuration information and the Ingress resource's configuration information.

[0031] The entity performing the above steps can be a server (e.g., a management server), but is not limited to this.

[0032] In this embodiment, Namespace is a resource in Kubernetes (K8s) that enables resource isolation between different spaces. Ingress is a resource belonging to Namespace. Different target applications within the current business can have multiple Namespaces, and each target application only focuses on the resources within its own Namespace. This embodiment achieves Namespace target application-based segmentation by ensuring that each Namespace contains tag data for the target application. Since Ingress itself is a Namespace, as long as Ingress also contains the same target application tag data as the Namespace, Ingress can also be segmented by target application. The gateway monitoring service can then directly perform categorized monitoring based on the tag data, without being restricted by the dynamic addition or deletion of Namespaces.

[0033] like Figure 3 As shown, the overall process of this embodiment includes the following steps:

[0034] S301, create an Ingress resource in a Namespace with different target application tags, and add the target application tag to the Ingress during creation (consistent with Namespace).

[0035] S302, different Apisix-Ingress-controllers monitor Ingress for different tags.

[0036] S303, Apisix-Ingress-controller converts the monitored Ingress configuration into API route configuration requests and synchronizes them to Apisix-admin.

[0037] S304. After receiving the request, Apisix-admin persists the data to etcd.

[0038] S305, Apisix-gateway, is responsible for handling actual traffic control based on the routing configuration in etcd.

[0039] S306 allows external applications, services, and browsers to access internal services through the addresses, ports, and routes exposed by Apisix-gateway.

[0040] Through the above steps, the routing configuration information of the target application's gateway is obtained, as well as the configuration information of the Ingress resources configured in the Namespace resource of the containerized application's Kubernetes (K8s) container. Both the Ingress and Namespace resources include the target application's tag information. The Namespace resource is used for resource isolation in K8s, while the Ingress resource is used for traffic distribution in K8s. Anomaly detection of the Ingress resource is also performed based on the gateway's routing configuration information and the Ingress resource configuration information. This achieves the management and maintenance of Ingress resources. Therefore, it can solve the problem of monitoring Ingress resources in related technologies, achieving effective monitoring of Ingress resources.

[0041] In one exemplary embodiment, before obtaining the routing configuration information of the target application's gateway, the method further includes:

[0042] Send a first request message to the package manager Helm; wherein the first request message is used to request Helm to configure the gateway in the target application and to mark the tag information of the target application in the control unit in the Namespace resource.

[0043] In this embodiment, the gateway application is launched using the industry-standard Helm Charts package; the open-source apisix helm package is modified to enable apisix to support project tag configuration; and the relevant apisix logic is modified to extend the functionality of apisix, enabling the gateway to perform categorized monitoring based on project tags.

[0044] like Figure 4 As shown, creating a gateway involves the following steps:

[0045] S401, the management service sends the first request information to the Helm service;

[0046] S402, launch the gateway in the specified target application;

[0047] S403. After receiving the request, Helm starts the gateway application according to the corresponding Helm package, and at the same time adds the corresponding target application tag to apisix-Ingress-controller, telling the controller to only monitor Ingress resources under the Namespace with the corresponding tag.

[0048] In one exemplary embodiment, before obtaining the configuration information of the Ingress resource in the Namespace resource configuration of the containerized application Kubernetes, the method further includes:

[0049] Receive the user's second request information;

[0050] Based on the second request information, an Ingress resource is created in the Namespace resource. The tag information of the target application in the Ingress resource is set by the event handling application in Kubernetes.

[0051] This example demonstrates how to create an Ingress resource. Kubernetes uses a mechanism called Webhook, which can intercept resource creation using a chain of responsibility approach, allowing for the addition of custom logic. Therefore, this mechanism is utilized to retrieve the Namespace data of the Ingress during creation, and then add the project tag data from that Namespace to the Ingress, thus giving the Ingress project attributes.

[0052] like Figure 5 As shown, the specific steps include:

[0053] S501 allows users to create Ingress resources in different category namespaces through the management service or cluster backend.

[0054] S502, the Namespace carries the target application category tag information, and the Webhook monitors the Ingress creation event to obtain the Namespace tag information where the Ingress is located;

[0055] S503, the Webhook sets the Namespace tag information into the Ingress, and the Ingress then contains the target application tag information.

[0056] In an exemplary embodiment, anomaly detection of the Ingress resource is performed based on the gateway's routing configuration information and the Ingress resource's configuration information, including:

[0057] Add the routing configuration information from the Ingress resource configuration information to the routing configuration information in the gateway, and determine N routing configuration information, where N is a natural number greater than 1;

[0058] Identify abnormal route configuration information from N route configuration information;

[0059] Anomaly detection is performed on Ingress resources based on abnormal routing information.

[0060] If an abnormality is detected in the Ingress resource, an abnormality alarm message is sent to the user. The abnormality alarm message is used to warn the user that the Ingress resource is abnormal.

[0061] This embodiment is used to detect whether Ingress resources are abnormal. After the Apisix gateway is extended, all routing rules in Ingress will be added. Therefore, the gateway contains all normal and abnormal (duplicate, ineffective) routing configuration data. By combining it with the Ingress data in Kubernetes for simple analysis, it is easy to know which Ingress is abnormal. Subsequently, when the user logs in, the abnormal alarm data will be pushed to the user.

[0062] like Figure 6 As shown, the specific steps include:

[0063] S601, the management service obtains all routing information from api-admin and discovers abnormal routing configurations;

[0064] S602, the management service obtains configuration information from the Ingress from the Kubernetes apiserver;

[0065] S603: The management service aggregates data for secondary analysis, records any problematic Ingress entries, and pushes notifications to users after they log in to the management service.

[0066] In summary, this embodiment provides a more user-friendly, convenient, and versatile way for users to manage and maintain Ingress resources. Users do not need to be aware of the gateway's existence or learn how to use it; they only need to focus on the use and management of Ingress in their original business operations, with no learning curve. It enables categorized monitoring and management of Ingress under different namespaces, supports dynamic addition and deletion of namespaces, and dynamically expands or reduces the monitoring scope without restarting the gateway, making gateway management and business expansion more flexible.

[0067] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0068] This embodiment also provides a resource anomaly detection device, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0069] Figure 7 This is a structural block diagram of a resource anomaly detection device according to an embodiment of the present invention, such as... Figure 7 As shown, the device includes:

[0070] The first acquisition module 72 is used to acquire the routing configuration information of the gateway of the target application;

[0071] The second acquisition module 74 is used to acquire the configuration information of the Ingress resource of the Namespace resource configuration in the containerized application K8s. The Ingress resource and the Namespace resource both include the tag information of the target application. The Namespace resource is used for resource isolation in the K8s, and the Ingress resource is used for traffic distribution in the K8s.

[0072] The first detection module 76 is used to perform anomaly detection on the Ingress resource based on the routing configuration information of the gateway and the configuration information of the Ingress resource.

[0073] In one exemplary embodiment, the above apparatus further includes: a first sending module, configured to send a first request message to the packet manager Helm before obtaining the routing configuration information of the gateway of the target application;

[0074] The first request information is used to request Helm to configure the gateway in the target application and to mark the tag information of the target application in the control unit in the Namespace resource.

[0075] In one exemplary embodiment, the above-described apparatus further includes:

[0076] The first receiving module is used to receive the user's second request information before obtaining the configuration information of the Ingress resource in the Namespace resource configuration of the containerized application Kubernetes.

[0077] The first creation module is used to create the Ingress resource in the Namespace resource based on the second request information, wherein the tag information of the target application in the Ingress resource is set by the event handling application in the K8s.

[0078] In one exemplary embodiment, the first detection module described above includes:

[0079] The first determining unit is used to add the routing configuration information in the configuration information of the Ingress resource to the routing configuration information in the gateway, and determine N routing configuration information, where N is a natural number greater than 1.

[0080] The second determining unit is used to determine abnormal route configuration information from the above N route configuration information;

[0081] The first detection unit is used to perform anomaly detection on the Ingress resource based on the aforementioned abnormal routing information.

[0082] In one exemplary embodiment, the above-described apparatus further includes:

[0083] The first sending module is used to send an abnormality alarm message to the user when it is determined that the Ingress resource is abnormal. The abnormality alarm message is used to warn the user that the Ingress resource is abnormal.

[0084] It should be noted that the above modules can be implemented by software or hardware. For the latter, they can be implemented in the following ways, but are not limited to: all the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0085] Embodiments of the present invention also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to perform the steps in any of the above method embodiments when executed.

[0086] In this embodiment, the computer-readable storage medium described above may be configured to store a computer program for performing the above steps.

[0087] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0088] Embodiments of the present invention also provide an electronic device including a memory and a processor, the memory storing a computer program and the processor being configured to run the computer program to perform the steps in any of the above method embodiments.

[0089] In one exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0090] In one exemplary embodiment, the processor described above may be configured to perform the above steps via a computer program.

[0091] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0092] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0093] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting resource anomalies, characterized in that, include: Obtain the routing configuration information of the target application's gateway; Obtain the configuration information of the Ingress resource in the Namespace resource configuration of the containerized application Kubernetes (K8s). The Ingress resource and the Namespace resource both include the tag information of the target application. The Namespace resource is used for resource isolation in the K8s, and the Ingress resource is used for traffic distribution in the K8s. Anomaly detection is performed on the Ingress resource based on the routing configuration information of the gateway and the configuration information of the Ingress resource. Before obtaining the configuration information of the Ingress resource in the Namespace resource configuration of the containerized application Kubernetes (K8s), the method further includes: receiving a second request from the user; and establishing the Ingress resource in the Namespace resource based on the second request, wherein the tag information of the target application in the Ingress resource is set by the event handling application in the K8s. The anomaly detection of the Ingress resource based on the routing configuration information of the gateway and the configuration information of the Ingress resource includes: adding the routing configuration information in the configuration information of the Ingress resource to the routing configuration information in the gateway, determining N routing configuration information, where N is a natural number greater than 1; determining abnormal routing configuration information from the N routing configuration information; and performing anomaly detection on the Ingress resource based on the abnormal routing configuration information.

2. The method according to claim 1, characterized in that, Before obtaining the routing configuration information of the target application's gateway, the method further includes: Send the first request message to the package manager Helm; The first request information is used to request Helm to configure the gateway in the target application and to mark the tag information of the target application in the control unit in the Namespace resource.

3. The method according to claim 1, characterized in that, The method further includes: If it is determined that the Ingress resource is abnormal, an abnormality alarm message is sent to the user, wherein the abnormality alarm message is used to warn the user that the Ingress resource is abnormal.

4. An anomaly detection device for resources, characterized in that, include: The first acquisition module is used to acquire the routing configuration information of the gateway of the target application; The second acquisition module is used to acquire the configuration information of the Ingress resource in the Namespace resource configuration of the containerized application Kubernetes (K8s). The Ingress resource and the Namespace resource both include the tag information of the target application. The Namespace resource is used for resource isolation in K8s, and the Ingress resource is used for traffic distribution in K8s. The first detection module is used to perform anomaly detection on the Ingress resource based on the routing configuration information of the gateway and the configuration information of the Ingress resource; The device is further configured to receive a second request from a user before obtaining the configuration information of the Ingress resource configured in the Namespace resource of the containerized application K8s; and to establish the Ingress resource in the Namespace resource based on the second request information, wherein the tag information of the target application in the Ingress resource is set by the event handling application in the K8s. The first detection module is further configured to add the routing configuration information in the configuration information of the Ingress resource to the routing configuration information in the gateway, determine N routing configuration information, where N is a natural number greater than 1; determine abnormal routing configuration information from the N routing configuration information; and perform anomaly detection on the Ingress resource based on the abnormal routing configuration information.

5. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the method described in any one of claims 1 to 3.

6. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the method described in any one of claims 1 to 3.

Images