Resource request method, apparatus and system

Abstract

The application discloses a resource request method, device and system, and relates to the technical field of authority management. In the method, when a target user equipment requests a resource, a server can first determine whether a target namespace to which the target resource requested by the target user equipment belongs has a target label identifier. Then, whether the target user equipment has the authority to request the target resource is determined based on the target label identifier and a target resource identifier. When it is determined that the target user equipment has the authority to request the target resource, a target operation is performed on the target resource. Since the resource request method provided by the application can first determine that the target namespace has the target label identifier before determining whether the target user equipment has the authority to request the target resource, the flexibility of requesting the resource is higher.

Description

Technical Field

[0001] This application relates to the field of access control technology, and in particular to a resource request method, apparatus and system. Background Technology

[0002] Currently, most information systems employ the traditional role-based access control (RBAC) authentication model to handle system data permissions. This RBAC model assigns permissions for requesting resources within a namespace to roles, and users acquire certain permissions by inheriting roles.

[0003] In related technologies, permission management based on the RBAC authentication model usually requires pre-defining roles, assigning permissions to roles to request resources in the namespace, and then assigning roles to users, that is, granting users permissions to request resources in the namespace.

[0004] However, when the server receives a resource request for a target resource in the target namespace from the target user device, it can only determine whether the target user device has the permission to request the target resource in the target namespace based on the target user identifier and the target resource identifier carried in the resource request, which is not very flexible. Summary of the Invention

[0005] This application provides a resource request method, apparatus, and system, which can solve the problem of poor flexibility in resource requests in related technologies. The technical solution is as follows:

[0006] On the one hand, a resource request method is provided, applied to a server; the method includes:

[0007] Receive a resource request sent by a target user equipment, wherein the resource request carries the target user identifier of the target user equipment, the target resource identifier of the requested target resource, the target space identifier of the target namespace to which the target resource belongs, and the target operation for the target resource;

[0008] Based on the target user identifier, the target space identifier, the first correspondence between the user identifier and the tag identifier, and the second correspondence between the tag identifier and the space identifier set, it is determined whether the target namespace has a target tag identifier;

[0009] If the target namespace has the target tag identifier, then based on the target tag identifier, the target resource identifier, and the third correspondence between the tag identifier and the resource identifier set, it is determined whether the target user equipment has the permission to request the target resource;

[0010] If it is determined that the target user device has the permission to request the target resource, then the target operation is performed on the target resource.

[0011] Optionally, determining whether the target namespace has a target tag identifier based on the target user identifier, the target space identifier, the first correspondence between the user identifier and the tag identifier, and the second correspondence between the tag identifier and the space identifier includes:

[0012] Based on the target user identifier and the first correspondence between user identifier and tag identifier, the target tag identifier corresponding to the target user identifier is determined;

[0013] Based on the target label identifier and the second correspondence between the label identifier and the spatial identifier set, the target spatial identifier set corresponding to the target label identifier is determined;

[0014] If the target space identifier belongs to the target space identifier set, then the target namespace is determined to have the target tag identifier.

[0015] Optionally, if the target namespace has the target tag identifier, then determining whether the target user equipment has permission to request the target resource based on the target tag identifier, the target resource identifier, and the third correspondence between the tag identifier and the resource identifier set includes:

[0016] If the target namespace has the target tag identifier, then based on the target tag identifier and the third correspondence between the tag identifier and the resource identifier set, the target resource identifier set corresponding to the target tag identifier is determined;

[0017] If the target resource identifier belongs to the target resource identifier set, then it is determined that the target user equipment has the permission to request the target resource.

[0018] Optionally, determining whether the target namespace has a target tag identifier based on the first correspondence between the target user identifier, the target space identifier, the user identifier, and the tag identifier, and the second correspondence between the tag identifier and the set of space identifiers, includes:

[0019] If it is determined that the target user identifier belongs to the user identifier set, then based on the target user identifier, the target space identifier, the first correspondence between the user identifier and the tag identifier, and the second correspondence between the tag identifier and the space identifier set, it is determined whether the target namespace has a target tag identifier;

[0020] The method further includes: if the target user equipment does not belong to the user identifier set, then performing the target operation on the target resource.

[0021] Optionally, before receiving the resource request sent by the target user equipment, the method further includes:

[0022] Add a tag identifier to at least one namespace, and store the space identifier of each namespace with the added tag identifier and a second correspondence between the added tag identifier and the namespace identifier.

[0023] Optionally, the target operation includes at least one of the following: an acquisition operation, a creation operation, an update operation, and a deletion operation.

[0024] On the other hand, a server is provided, the server comprising:

[0025] The receiving module is used to receive a resource request sent by a target user equipment. The resource request carries the target user identifier of the target user equipment, the target resource identifier of the requested target resource, the target space identifier of the target namespace to which the target resource belongs, and the target operation for the target resource.

[0026] The first determining module is used to determine whether the target namespace has a target tag identifier based on the target user identifier, the target space identifier, the first correspondence between the user identifier and the tag identifier, and the second correspondence between the tag identifier and the space identifier set.

[0027] The second determining module is used to determine whether the target user equipment has permission to request the target resource based on the target tag identifier, the target resource identifier, and a third correspondence between the tag identifier and the resource identifier set if the target namespace has the target tag identifier.

[0028] An execution module is configured to perform the target operation on the target resource if it is determined that the target user device has the permission to request the target resource.

[0029] In another aspect, a computer-readable storage medium is provided, wherein instructions are stored therein, which are loaded and executed by a processor to implement the resource request method described above.

[0030] In another aspect, a computer program product is provided, the computer program product comprising instructions that, when executed on a computer, cause the computer to perform the resource request method described above.

[0031] In another aspect, a resource request system is provided, the resource request system comprising: at least one user device, and a server as described above;

[0032] The user equipment is communicatively connected to the server.

[0033] The beneficial effects of the technical solution provided in this application include at least the following:

[0034] This application provides a resource request method, apparatus, and system. In this method, when a target user device requests a resource, the server can first determine whether the target namespace to which the requested resource belongs has a target tag identifier. Then, based on the target tag identifier and the target resource identifier, it determines whether the target user device has permission to request the target resource. If it is determined that the target user device has permission to request the target resource, the target operation is performed on the target resource. Because the resource request method provided in this application can determine whether the target namespace has a target tag identifier before determining whether permission to request the target resource is granted, the resource request is highly flexible. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 This is a schematic diagram of the structure of a resource request system provided in an embodiment of this application;

[0037] Figure 2 This is a flowchart of a resource request method provided in an embodiment of this application;

[0038] Figure 3 This is a flowchart of another resource request method provided in an embodiment of this application;

[0039] Figure 4 This is a structural block diagram of a server provided in an embodiment of this application;

[0040] Figure 5 This is a structural block diagram of the second determining module provided in the embodiments of this application;

[0041] Figure 6 This is a structural block diagram of the third determining module provided in the embodiments of this application;

[0042] Figure 7 This is a structural block diagram of another server provided in an embodiment of this application. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0044] Figure 1 This is a schematic diagram of the structure of a resource request system provided in an embodiment of this application. (Reference) Figure 1 It can be seen that the resource request system 10 may include at least one user device 101 and a server 102. For example... Figure 1 The image shows two user devices 101. These user devices 101 can establish a communication connection with a server 102 via a wired or wireless network. The server 102, also known as a cloud platform, can have data storage and data processing capabilities.

[0045] Each user device 101 and each device in server 102 can be a single server, a server cluster consisting of several servers, or a cloud computing service center. For example, server 102 can connect to multiple user devices 101 and obtain resource requests from each user device 101. Server 102 can determine whether a user device 101 is authorized to perform an operation on a specific resource based on the obtained resource requests, i.e., it performs resource authentication on the user device 101.

[0046] Kubernetes (K8S) is an open-source application used to manage containerized applications across multiple hosts in a cloud platform. Kubernetes aims to make deploying containerized applications simple and efficient. It provides a mechanism for application deployment, planning, updating, and maintenance, enabling enterprises to quickly optimize hardware resource utilization and extend production environment uptime through fault tolerance.

[0047] Kubernetes primarily uses the RBAC authentication model to authenticate user devices. RBAC-based permission management typically requires pre-defining roles, assigning permissions to roles to request resources within a namespace, and then granting roles to users, effectively granting them permissions to request resources within that namespace. In the RBAC authentication model, permissions are only granted; there is no setting for denial.

[0048] In Kubernetes, there are two types of resources: resources within a namespace and resources within a cluster. Resources within a cluster have cluster resource attributes and are typically system resources. By defining roles within a namespace (or cluster) and assigning permissions to those roles to request resources within that namespace (or cluster), users with those roles have the authority to request resources within the namespace (or cluster). Since cluster resources are typically system resources, regular user devices can only request resources within a namespace, not resources within the cluster.

[0049] For example, Deployment, StatefulSet, ConfigMap, and Services are all resources within a namespace.

[0050] In Kubernetes, a role can only be used to grant permissions to request resources within a single namespace; that is, one role must be set up for each namespace. Creating a new namespace requires creating a new role, assigning permissions to that role to request resources within the new namespace, and then binding the user to the new role to grant that permission. This process is inefficient.

[0051] For example, in a scenario where 100 namespaces are dynamically created, a corresponding role needs to be created for each namespace. That is, creating 100 namespaces requires creating 100 roles for each namespace and assigning permissions to each of these 100 roles to request resources in the corresponding namespace, resulting in high management and maintenance costs.

[0052] Figure 2 This is a flowchart illustrating a resource request method provided in an embodiment of this application. This method can be applied to... Figure 1 In the server shown. (Reference) Figure 2 As can be seen, this method may include:

[0053] Step 201: Receive the resource request sent by the target user equipment.

[0054] In this embodiment of the application, after the target user equipment sends a resource request to the server, the server can receive the resource request sent by the target user equipment. The resource request carries the target user identifier of the target user equipment, the target resource identifier of the requested target resource, the target space identifier of the target namespace to which the target resource belongs, and the target operation for the target resource.

[0055] The target user identifier can be a string that uniquely identifies the target user device. Each user device can be assigned a specific role, and each role can be assigned permissions to request resources. The target resource identifier can be a string that uniquely identifies the target resource. The target space identifier can be a string that uniquely identifies the target namespace.

[0056] Step 202: Based on the first correspondence between the target user identifier, the target space identifier, the user identifier, and the tag identifier, and the second correspondence between the tag identifier and the space identifier set, determine whether the target namespace has a target tag identifier.

[0057] In this embodiment, the server may pre-store a first correspondence between user identifiers and tag identifiers, and a second correspondence between tag identifiers and space identifiers. The server can determine the target tag identifier based on the target user identifier and the first correspondence. Subsequently, the server can determine whether the target namespace indicated by the target space identifier has the target tag identifier based on the target space identifier and the second correspondence.

[0058] Among the multiple namespaces stored on the server, some namespaces may have tag identifiers, while others may not. Determining whether the target namespace has a target tag identifier in step 202 can mean: determining whether the target namespace has a tag identifier, and determining whether the tag identifier possessed by the target namespace is the target tag identifier.

[0059] Optionally, for creating a namespace with a specific tag identifier, it is not necessary to create a new role for that namespace after its creation. Instead, simply bind the previously created role (which has a specific tag identifier) ​​to the namespace. This method of creating namespaces is highly efficient. Binding a role to the namespace can mean that the server stores a mapping between user identifiers (since roles can be assigned to users, the user identifier can be understood as a role identifier) ​​and specific tag identifiers, as well as a mapping between specific tag identifiers and namespaces.

[0060] For example, in a scenario where 100 namespaces are dynamically created, only one role needs to be created and assigned the permission to request resources in all 100 namespaces, resulting in low management and maintenance costs.

[0061] Step 203: If the target namespace has a target tag identifier, then based on the target tag identifier, the target resource identifier, and the third correspondence between the tag identifier and the resource identifier set, determine whether the target user device has the permission to request the target resource.

[0062] In this embodiment, the server may pre-store a third correspondence between tag identifiers and resource identifier sets. If the server determines that a target namespace has a target tag identifier, it can determine the target resource identifier set corresponding to the target tag identifier based on the target tag identifier and the pre-stored third correspondence. Further, if the target resource identifier set corresponding to the target tag identifier contains the target resource identifier carried in the resource request, it is determined that the target user equipment has the permission to request the target resource. If the target resource identifier set corresponding to the target tag identifier does not contain the target resource identifier carried in the resource request, it is determined that the target user equipment does not have the permission to request the target resource.

[0063] Optionally, each tag identifier may correspond to at least one resource identifier. The at least one resource identifier corresponding to each tag identifier may constitute a set of resource identifiers.

[0064] Step 204: If it is determined that the target user device has the permission to request the target resource, then perform the target operation on the target resource.

[0065] In this embodiment of the application, if the server determines in step 203 that the target user device has the permission to request the target resource, then the target operation can be performed on the target resource; if the server determines in step 203 that the target user device does not have the permission to request the target resource, then the target operation will not be performed on the target resource.

[0066] Optionally, the target operation may include at least one of the following: a get operation, a create operation, an update operation, and a delete operation. For example, if a resource request carries an update operation for the target resource, the server can perform the update operation on the target resource if it determines that the target user device has the permission to request the target resource. That is, the server can update the target resource based on the resource request sent by the target user device.

[0067] In summary, this application provides a resource request method. In this method, when a target user device requests a resource, the server first determines whether the target namespace to which the requested resource belongs has a target tag identifier. Then, based on the target tag identifier and the target resource identifier, it determines whether the target user device has permission to request the target resource. If it is determined that the target user device has permission to request the target resource, the target operation is performed on the target resource. Because the resource request method provided in this application can determine whether the target namespace has a target tag identifier before determining whether the user device has permission to request the target resource, it offers high flexibility in resource requesting.

[0068] Figure 3 This is a flowchart illustrating a resource request method provided in an embodiment of this application. This method can be applied to... Figure 1 In the server shown. (Reference) Figure 3 As can be seen, this method may include:

[0069] Step 301: Receive the resource request sent by the target user equipment.

[0070] In this embodiment of the application, after the target user equipment sends a resource request to the server, the server can receive the resource request sent by the target user equipment. The resource request carries the target user identifier of the target user equipment, the target resource identifier of the requested target resource, the target space identifier of the target namespace to which the target resource belongs, and the target operation for the target resource.

[0071] The target user identifier can be a string that uniquely identifies the target user device. Each user device can be assigned a specific role, and each role can be assigned permissions to request resources. The target resource identifier can be a string that uniquely identifies the target resource. The target space identifier can be a string that uniquely identifies the target namespace.

[0072] Optionally, the target operation may include at least one of the following: get operation, create operation, update operation, and delete operation.

[0073] Step 302: Determine whether the target user identifier belongs to the user identifier set.

[0074] In this embodiment, the server may pre-store a set of user identifiers. Each user identifier in the set indicates a user device that can be configured to have an extended authentication configuration. Furthermore, user devices indicated by user identifiers not in the set can be configured without an extended authentication configuration. That is, the server can authenticate the user device indicated by each user identifier in the set, without needing to authenticate user devices indicated by user identifiers other than those in the set. This extended authentication configuration can represent the authentication method in steps 303 to 308 below.

[0075] Optionally, if the server determines that the target user identifier belongs to the user identifier set, then perform step 303 below; if the server determines that the target user identifier does not belong to the user identifier set, then directly perform step 309.

[0076] Step 303: Based on the target user identifier and the first correspondence between the user identifier and the tag identifier, determine the target tag identifier corresponding to the target user identifier.

[0077] In this embodiment, the server may pre-store a first correspondence between user identifiers and tag identifiers. The server can determine the target tag identifier corresponding to the target user identifier based on the target user identifier and the first correspondence.

[0078] Optionally, the initial mapping between user identifiers and tag identifiers can be stored on the server after roles are created based on Kubernetes custom resource definitions (CRDs). For example, the specific process of creating roles using CRDs is as follows:

[0079]

[0080] The code above means that when creating a role, the NamespaceLabel attribute can be configured. The NamespaceLabel attribute configuration indicates that the role (Token) can request resources in the namespace with the tag identifier (cos.eniot.io / ou:eap). Here, the role is a Token, and the role Token can be assigned to the user eap, with the user identifier mens35h34ocgbnhu9ikjbvy7jy546c67nejiu89sgbd0pl39b; the tag identifier is cos.eniot.io / ou:eap; and the resource identifier set for the resources that the role (Token) can request is deployments and services. That is, the server can store the mapping between user identifier (mens35h34ocgbnhu9ikjbvy7jy546c67nejiu89sgbd0pl39b) and tag identifier (cos.eniot.io / ou:eap), as well as the mapping between tag identifier (cos.eniot.io / ou:eap) and resource identifier sets (deployments and services).

[0081] Step 304: Based on the target label identifier and the second correspondence between the label identifier and the spatial identifier set, determine the target spatial identifier set corresponding to the target label identifier.

[0082] In this embodiment, after determining the target tag identifier corresponding to the target user identifier, the server can determine the target spatial identifier set corresponding to the target tag identifier based on the target tag identifier and the second correspondence between the tag identifier and the spatial identifier set. The number of spatial identifiers contained in each spatial identifier set can be one or more, and this embodiment does not limit this. Furthermore, the correspondence between the target tag identifier and the target spatial identifier can be used to indicate that the namespace indicated by each spatial identifier in the target spatial identifier set has a target tag identifier.

[0083] The second correspondence may be stored after the server adds tags to at least one namespace before receiving a resource request from the target user device. This second correspondence can be used to represent the relationship between the space identifier of each tagged namespace and the added tag identifiers.

[0084] Optionally, when creating a namespace based on Kubernetes, the server can configure a label for the namespace and store the corresponding space identifier and label identifier for that namespace. Multiple namespaces can be configured with the same label identifier, and space identifiers of namespaces sharing the same label identifier can form a space identifier set. That is, the namespaces indicated by each space identifier in each space identifier set have the same label identifier.

[0085] For example, the process of configuring a label for a namespace when creating a namespace is as follows:

[0086]

[0087] The code above means that when creating a namespace, a tag identifier can be added to the namespace. Here, the namespace identifier is `ou-namespace`, and the tag identifier is `cos.eniot.io / ou:eap`. That is, the server can store the mapping between the namespace identifier (`ou-namespace`) and the tag identifier (`cos.eniot.io / ou:eap`). Of course, after creating multiple namespaces, if the tag identifier added to all of these namespaces is `cos.eniot.io / ou:eap`, then the server can store the mapping between the set of namespace identifiers (which includes the namespace identifiers of all the namespaces) and the tag identifier (`cos.eniot.io / ou:eap`).

[0088] Step 305: Determine whether the target spatial identifier belongs to the target spatial identifier set.

[0089] In this embodiment of the application, the target spatial identifier set may include one or more spatial identifiers. The server may determine whether a target spatial identifier belongs to the target spatial identifier set based on the target spatial identifier carried in the resource request and the target spatial identifier set determined in step 304 above.

[0090] If it is determined that one or more spatial identifiers included in the target spatial identifier set contain an identifier identical to the target spatial identifier, then the target spatial identifier belongs to the target spatial identifier set. Conversely, if it is determined that one or more spatial identifiers included in the target spatial identifier set do not contain an identifier identical to the target spatial identifier, then the target spatial identifier does not belong to the target spatial identifier set. In other words, the server can determine whether a target spatial identifier belongs to the target spatial identifier set by determining whether one or more spatial identifiers included in the target spatial identifier set contain an identifier identical to the target spatial identifier.

[0091] Optionally, if it is determined that the target spatial identifier belongs to the target spatial identifier set, then perform step 306 below; if it is determined that the target spatial identifier does not belong to the target spatial identifier set, then perform step 310 below.

[0092] Step 306: Determine that the target namespace has a target tag identifier.

[0093] In this embodiment of the application, since the namespace indicated by each space identifier in the target space identifier set has a target tag identifier, if it is determined based on step 305 that the target space identifier belongs to the target space identifier set, it can be determined that the target namespace indicated by the target space identifier has a target tag identifier.

[0094] Step 307: Based on the target tag identifier and the third correspondence between the tag identifier and the resource identifier set, determine the target resource identifier set corresponding to the target tag identifier.

[0095] In this embodiment, the server may pre-store a third correspondence between tag identifiers and resource identifier sets. After determining that the target namespace has a target tag identifier, the server can determine the target resource identifier set corresponding to the target tag identifier based on the target tag identifier and the third correspondence.

[0096] Optionally, the third mapping between the tag identifier and the resource identifier set can be stored after the CRD creates the role. For example, after step 303, the server can store the mapping between the tag identifier (cos.eniot.io / ou:eap) and the resource identifier sets (deployments and services).

[0097] Furthermore, the resource indicated by each resource identifier in the target resource identifier set can be requested by the target user equipment. That is, the target user equipment has the permission to request the resource indicated by each resource identifier in the target resource identifier set.

[0098] Step 308: Determine whether the target resource identifier belongs to the target resource identifier set.

[0099] In this embodiment of the application, the target resource identifier set may include one or more resource identifiers. The server may determine whether a target resource identifier belongs to the target resource identifier set based on the target resource identifier carried in the resource request and the target resource identifier set determined in step 307 above.

[0100] If one or more resource identifiers included in the target resource identifier set contain an identifier identical to the target resource identifier, then the target resource identifier belongs to the target resource identifier set. Conversely, if one or more resource identifiers included in the target resource identifier set do not contain an identifier identical to the target resource identifier, then the target resource identifier does not belong to the target resource identifier set. In other words, the server can determine whether a target resource identifier belongs to the target resource identifier set by checking whether one or more resource identifiers included in the target resource identifier set contain an identifier identical to the target resource identifier.

[0101] Optionally, if it is determined that the target resource identifier belongs to the target resource identifier set, then perform step 309 below; if it is determined that the target resource identifier does not belong to the target resource identifier set, then perform step 310 below.

[0102] Step 309: Determine that the target user device has the permission to request the target resource, and perform the target operation on the target resource.

[0103] In this embodiment, since the resource indicated by each resource identifier in the target resource identifier set can be requested by the target user equipment, if it is determined in step 308 that the target resource identifier belongs to the target resource identifier set, it can be determined that the target resource indicated by the target resource identifier can be requested by the target user equipment. That is, the target user equipment has the right to request the target resource.

[0104] Optionally, if the target user device has the permission to request the target resource, the server can perform the target operation on the target resource based on the target operation carried in the resource request.

[0105] In this embodiment of the application, if it is determined in step 302 that the target user identifier does not belong to the user identifier set, it means that the target user device indicated by the target user identifier has the unconditional permission to request the target resource, and step 309 can be executed directly. That is, if the target user identifier does not belong to the user identifier set, the server can directly determine that the target user device has the permission to request the target resource and perform the target operation on the target resource.

[0106] Optionally, the target operation may include at least one of the following: a get operation, a create operation, an update operation, and a delete operation. For example, if a resource request carries an update operation for the target resource, the server can perform the update operation on the target resource if it determines that the target user device has the permission to request the target resource. That is, the server can update the target resource based on the resource request sent by the target user device.

[0107] Step 310: Determine that the target user device does not have permission to request the target resource, and do not perform the target operation on the target resource.

[0108] In this embodiment of the application, if it is determined in step 305 that the target space identifier does not belong to the target space identifier set, it indicates that the target namespace does not have a target tag identifier, and thus indicates that the target user device does not have the permission to request the target resource in the target namespace. Therefore, the server can refrain from performing the target operation on the target resource.

[0109] Furthermore, if it is determined in step 308 above that the target resource identifier does not belong to the target resource identifier set, it means that the target user device does not have the permission to request the target resource. Therefore, the server can refrain from performing the target operation on the target resource.

[0110] It should be noted that the Kubernetes deployed on the server can receive resource requests sent by the target user device through its native Application Service Interface (APIServer). After the APIServer receives the resource request from the target user device, the server can authenticate the target user device based on the resource request and using the RBAC authentication model. Since this application embodiment provides a new authentication method, it is assumed that any user device can be authenticated through the RBAC authentication model. Afterwards, the APIServer can forward the received resource request from the target user device to the network interface (webhook). After the webhook receives the resource request forwarded by the APIServer, the server can execute steps 302 to 310 as described above.

[0111] Optionally, the configuration process for a webhook is as follows:

[0112]

[0113]

[0114] The code above describes a webhook function. Specifically, when a resource request carries the target operation of creating, updating, or deleting a namespace, the request is forwarded to the service `cos-api-admission` under the `op`, on port 443, at path ` / v1 / admissionhook / validating`. After the resource request is processed, other processes in Kubernetes continue.

[0115] It should be noted that the order of the steps in the resource request method provided in this application embodiment can be appropriately adjusted, and the steps can also be added or removed as appropriate. For example, step 310 can be deleted as needed. Any variations that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the protection scope of this application, and therefore will not be elaborated further.

[0116] In summary, this application provides a resource request method. In this method, when a target user device requests a resource, the server first determines whether the target namespace to which the requested resource belongs has a target tag identifier. Then, based on the target tag identifier and the target resource identifier, it determines whether the target user device has permission to request the target resource. If it is determined that the target user device has permission to request the target resource, the target operation is performed on the target resource. Because the resource request method provided in this application can determine whether the target namespace has a target tag identifier before determining whether the user device has permission to request the target resource, it offers high flexibility in resource requesting.

[0117] Figure 4 This is a structural block diagram of a server provided in an embodiment of this application. (Reference) Figure 4 It can be seen that the server 40 may include:

[0118] The receiving module 401 is used to receive a resource request sent by the target user equipment. The resource request carries the target user identifier of the target user equipment, the target resource identifier of the requested target resource, the target space identifier of the target namespace to which the target resource belongs, and the target operation for the target resource.

[0119] The first determining module 402 is used to determine whether a target namespace has a target tag identifier based on a first correspondence between the target user identifier, the target space identifier, the user identifier and the tag identifier, and a second correspondence between the tag identifier and the space identifier set.

[0120] The second determining module 403 is used to determine whether the target user device has the permission to request the target resource based on the target tag identifier, the target resource identifier, and the third correspondence between the tag identifier and the resource identifier set if the target namespace has a target tag identifier.

[0121] Execution module 404 is used to perform the target operation on the target resource if it is determined that the target user device has the permission to request the target resource.

[0122] Optional, see reference Figure 5 The first determining module 402 may include:

[0123] The first determining submodule 4021 is used to determine the target tag identifier corresponding to the target user identifier based on the target user identifier and the first correspondence between the user identifier and the tag identifier.

[0124] The second determining submodule 4022 is used to determine the target spatial identifier set corresponding to the target label identifier based on the target label identifier and the second correspondence between the label identifier and the spatial identifier set.

[0125] The third determining submodule 4023 is used to determine that the target namespace has a target tag identifier if the target space identifier belongs to the target space identifier set.

[0126] Optional, see reference Figure 6 The second determining module 403 may include:

[0127] The fourth determining submodule 4031 is used to determine the target resource identifier set corresponding to the target tag identifier based on the target tag identifier and the third correspondence between the tag identifier and the resource identifier set if the target namespace has a target tag identifier.

[0128] The fifth determination submodule 4032 is used to determine that if the target resource identifier belongs to the target resource identifier set, the target user device has the permission to request the target resource.

[0129] Optionally, the first determining module 402 can be used to determine whether the target namespace has a target tag identifier based on the first correspondence between the target user identifier, the target space identifier, the user identifier and the tag identifier, and the second correspondence between the tag identifier and the space identifier set if the target user identifier is determined to belong to the user identifier set.

[0130] The first determining module 402 can also be used to: if the target user equipment does not belong to the user identifier set, then perform the target operation on the target resource.

[0131] Optionally, before the first determining module 402 receives the resource request sent by the target user equipment, the server may add a tag identifier to at least one namespace and store the space identifier of each namespace with added tags and a second correspondence between the added tag identifiers.

[0132] Optionally, the target operation includes at least one of the following: get operation, create operation, update operation, and delete operation.

[0133] In summary, this application provides a server that, upon receiving a resource request from a target user equipment, first determines whether the target namespace to which the requested resource belongs has a target tag identifier. Then, based on the target tag identifier and the target resource identifier, it determines whether the target user equipment has permission to request the target resource. If it is determined that the target user equipment has permission to request the target resource, the target operation is performed on the target resource. Because the server provided in this application can first determine whether the target namespace has a target tag identifier before determining whether the user equipment has permission to request the target resource, the server offers high flexibility when requesting resources.

[0134] Figure 7 This is a structural block diagram of another server provided in an embodiment of this application. See also... Figure 7 The server 50 may include a processor 501 and a memory 502. The memory 502 may store a computer program, and when the processor 501 executes the computer program, it can implement the resource request method provided in the above-described method embodiments, for example... Figure 2 or Figure 3 The method shown.

[0135] This application provides a computer-readable storage medium storing instructions that are loaded and executed by a processor to implement the resource request method provided in the above-described method embodiments, for example, implementing... Figure 2 or Figure 3 The method shown.

[0136] This application provides a computer program product containing instructions that, when run on a computer, cause the computer to execute the resource request method provided in the above-described method embodiments, for example, to execute... Figure 2 or Figure 3 The method shown.

[0137] The above description is merely an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A resource request method, characterized in that, Applied to a server; the method includes: Receive a resource request sent by a target user equipment, wherein the resource request carries the target user identifier of the target user equipment, the target resource identifier of the requested target resource, the target space identifier of the target namespace to which the target resource belongs, and the target operation for the target resource; Based on the target user identifier, the target space identifier, the first correspondence between the user identifier and the tag identifier, and the second correspondence between the tag identifier and the space identifier set, it is determined whether the target namespace has a target tag identifier; If the target namespace has the target tag identifier, then based on the target tag identifier, the target resource identifier, and the third correspondence between the tag identifier and the resource identifier set, the target resource identifier set corresponding to the target tag identifier is determined, and the target user equipment has the permission to request the resource indicated by each resource identifier in the target resource identifier set; Based on the target resource identifier and the set of target resource identifiers, determine whether the target user equipment has the authority to request the target resource; If it is determined that the target user equipment has the permission to request the target resource, then the target operation is performed on the target resource; The step of determining whether the target namespace has a target tag identifier based on the target user identifier, the target space identifier, the first correspondence between the user identifier and the tag identifier, and the second correspondence between the tag identifier and the set of space identifiers includes: Based on the target user identifier and the first correspondence between user identifier and tag identifier, the target tag identifier corresponding to the target user identifier is determined; Based on the target tag identifier and the second correspondence between the tag identifier and the spatial identifier set, the target spatial identifier set corresponding to the target tag identifier is determined. The namespaces indicated by each spatial identifier in each spatial identifier set have the same tag identifier. The correspondence between the target tag identifier and the target spatial identifier set means that the namespaces indicated by each spatial identifier in the target spatial identifier set have the target tag identifier. If the target space identifier belongs to the target space identifier set, then the target namespace is determined to have the target tag identifier.

2. The method according to claim 1, characterized in that, The step of determining whether the target user equipment has permission to request the target resource based on the target resource identifier and the set of target resource identifiers includes: If the target resource identifier belongs to the target resource identifier set, then it is determined that the target user equipment has the permission to request the target resource.

3. The method according to claim 1 or 2, characterized in that, The step of determining whether the target namespace has a target tag identifier based on the target user identifier, the target space identifier, the first correspondence between the user identifier and the tag identifier, and the second correspondence between the tag identifier and the set of space identifiers includes: If it is determined that the target user identifier belongs to the user identifier set, then based on the target user identifier, the target space identifier, the first correspondence between the user identifier and the tag identifier, and the second correspondence between the tag identifier and the space identifier set, it is determined whether the target namespace has a target tag identifier; The method further includes: if the target user equipment does not belong to the user identifier set, then performing the target operation on the target resource.

4. The method according to claim 3, characterized in that, Before receiving the resource request sent by the target user equipment, the method further includes: Add a tag identifier to at least one namespace, and store the space identifier of each namespace with the added tag identifier and a second correspondence between the added tag identifier and the namespace identifier.

5. The method according to claim 1 or 2, characterized in that, The target operation includes at least one of the following: retrieval operation, creation operation, update operation, and deletion operation.

6. A server, characterized in that, The server includes: The receiving module is used to receive a resource request sent by a target user equipment. The resource request carries the target user identifier of the target user equipment, the target resource identifier of the requested target resource, the target space identifier of the target namespace to which the target resource belongs, and the target operation for the target resource. The first determining module is used to determine whether the target namespace has a target tag identifier based on the target user identifier, the target space identifier, the first correspondence between the user identifier and the tag identifier, and the second correspondence between the tag identifier and the space identifier set. The second determining module is configured to, if the target namespace has the target tag identifier, determine the target resource identifier set corresponding to the target tag identifier based on the target tag identifier, the target resource identifier, and a third correspondence between the tag identifier and the resource identifier set; and determine whether the target user equipment has permission to request the target resource based on the target resource identifier and the target resource identifier set, wherein the target user equipment has permission to request the resource indicated by each resource identifier in the target resource identifier set. An execution module is configured to perform the target operation on the target resource if it is determined that the target user device has the permission to request the target resource; The first determining module includes: The first determining submodule is used to determine the target tag identifier corresponding to the target user identifier based on the target user identifier and the first correspondence between the user identifier and the tag identifier; The second determining submodule is used to determine the target spatial identifier set corresponding to the target tag identifier based on the target tag identifier and the second correspondence between the tag identifier and the spatial identifier set. The namespaces indicated by each spatial identifier in each spatial identifier set have the same tag identifier. The correspondence between the target tag identifier and the target spatial identifier set means that the namespaces indicated by each spatial identifier in the target spatial identifier set have the target tag identifier. The third determining submodule is used to determine that the target namespace has the target tag identifier if the target space identifier belongs to the target space identifier set.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that are loaded and executed by a processor to implement the resource request method according to any one of claims 1 to 5.

8. A computer program product, characterized in that, The computer program product includes instructions that, when executed on a computer, cause the computer to perform the resource request method according to any one of claims 1 to 5.

9. A resource request system, characterized in that, The resource request system includes: at least one user device, and the server as described in claim 6; The user equipment is communicatively connected to the server.

Images