A web console and access cluster method, system, device, and medium

Abstract

The present application discloses a web console and a method, system, device, and medium for accessing a cluster, which are applied to a web server in a web console, receive a target command sent by a user interface in the web console, and the target command includes a kubectl-class command obtained after the user interface filters the received initial command; determine the target cluster access rights of the user role in the user interface; based on the target command and the target cluster access rights, obtain the corresponding target resource in the k8s cluster of the web console; and return the target resource to the user interface. In the present application, the user interface only transmits the target command of the kubectl class to the web server, which can prevent the user interface from sending other instructions to maliciously operate the k8s cluster, and can ensure the security of the k8s cluster; in addition, it can prevent the user interface from obtaining resources outside its own authority, and can ensure the access security of cluster resources.

Description

Technical Field

[0001] The present application relates to the field of container technology, and more specifically, to a web console and a cluster access method, system, device, and medium. Background Art

[0002] Container cluster (k8s, kubernetes) is an open source container cluster management system. Based on Docker (application container engine) technology, it provides a series of complete functions such as deployment and operation, resource scheduling, service discovery and dynamic scaling for containerized applications, which improves the convenience of large-scale container cluster management. At the bottom of the container cluster, the only entry point for managing cluster resources is to call the API server interface through the corresponding method. Kubectl is the official command line tool (CLI) of Kubernetes and is a must-have management tool for Kubernetes users and administrators. Kubectl provides a large number of subcommands to facilitate users to manage various functions in the Kubernetes cluster. Kubectl organizes and converts the commands entered by users on the command line into information that can be recognized by the API server, thereby realizing an effective way to manage various k8s resources.

[0003] However, kubectl is only used at the bottom layer of the cluster. For operation and maintenance administrators, who have the root privileges of the cluster and can directly access the bottom layer of the cluster, it is normal for them to use the kubectl command. However, for the container platform, ordinary users cannot directly access the bottom layer. The container platform provides services to users through the interface. To access the cluster through the interface, there needs to be a way to view the cluster resources. Through the interface, kubectl commands can be used just like at the bottom layer. For this reason, the Web console came into being.

[0004] At present, each product in the industry has its own Web console. These Web consoles are similar, and basically rely on the kubectl tool, and various encapsulations and modifications are performed based on kubectl. However, these modifications are relatively complex, and they add multiple checks based on their own logic. For example, in KubeSphere, the pod of its Web console will always occupy the underlying resources, which will cause resource waste, and because it carries various other Linux commands, users can operate the underlying non-k8s resources. In addition, the security of the Web console is the primary guarantee of cluster security. For clusters operated from the user's perspective rather than the operation and maintenance administrator's perspective, ensuring the user's operation security can ensure the cluster's security. In this process, the operation and maintenance administrator usually has more professional knowledge and can execute various commands without error. However, for cluster users, users only use cluster resources and do not need to perform other operations on the cluster and the nodes where they are located. Therefore, a secure way to access cluster resources is needed.

[0005] In summary, how to securely access cluster resources is a problem that currently needs to be solved urgently by those skilled in the art. Summary of the invention

[0006] The purpose of this application is to provide a method for accessing a cluster through a web console, which can solve the technical problem of how to securely access cluster resources to a certain extent. This application also provides a web console and a system, device, and computer-readable storage medium for accessing a cluster.

[0007] In order to achieve the above objectives, this application provides the following technical solutions:

[0008] A method for accessing a cluster from a web console, applied to a web server in a web console, includes:

[0009] Receiving a target command sent by a user interface in the web console, wherein the target command includes a kubectl class command obtained by filtering an initial command received by the user interface;

[0010] Determine the target cluster access rights of the user role in the user interface;

[0011] Based on the target command and the target cluster access rights, obtain the corresponding target resource in the k8s cluster of the web console;

[0012] Return the target resource to the user interface.

[0013] Preferably, obtaining corresponding target resources in the k8s cluster of the web console based on the target command and the target cluster access rights includes:

[0014] Determine, among multiple kubectl processes isolated from each other, a target kubectl process of the target kubectl command;

[0015] Through the target kubectl process, based on the target command and the target cluster access rights, the corresponding target resources are obtained in the k8s cluster of the web console.

[0016] Preferably, after receiving the target command sent by the user interface in the web console and before determining the target cluster access rights of the user role in the user interface, the method further includes:

[0017] Authenticating the user role in the user interface;

[0018] If the authentication is successful, the step of determining the target cluster access rights of the user role in the user interface is performed.

[0019] Preferably, returning the target resource to the user interface includes:

[0020] Format the target resource into a target json string;

[0021] Transmit the target json string to the user interface.

[0022] Preferably, the receiving a target command sent by the user interface in the web console includes:

[0023] Based on the WebSocket protocol, receiving the target command sent by the user interface in the web console;

[0024] The returning the target resource to the user interface includes:

[0025] Based on the WebSocket protocol, the target resource is returned to the user interface.

[0026] A method for accessing a cluster from a web console, applied to a user interface in a web console, includes:

[0027] Receive initial command;

[0028] Filter the initial command, and use the filtered knbectl class command as the target command;

[0029] Transmitting the target command to the web server in the web console, so that the web server determines the target cluster access rights of the user role in the user interface, and based on the target command and the target cluster access rights, obtains the corresponding target resource in the k8s cluster of the web console;

[0030] Receive the target resource returned by the web server.

[0031] A web console access cluster system, applied to a web server in a web console, includes:

[0032] A first receiving module is used to receive a target command sent by the user interface in the web console, where the target command includes a kubectl class command obtained by filtering the received initial command by the user interface;

[0033] A first determination module, configured to determine target cluster access rights of a user role in the user interface;

[0034] A first acquisition module is used to acquire corresponding target resources in the k8s cluster of the web console based on the target command and the target cluster access rights;

[0035] The first transmission module is used to return the target resource to the user interface.

[0036] An electronic device, comprising:

[0037] Memory for storing computer programs;

[0038] A processor is used to implement the steps of any of the above methods for accessing a cluster through a web console when executing the computer program.

[0039] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any of the above methods for accessing a cluster from a web console are implemented.

[0040] A web console, comprising:

[0041] A user interface, for receiving an initial command; filtering the initial command, and using the filtered knbectl class command as a target command; transmitting the target command to a web server in the web console;

[0042] The web server is used to determine the target cluster access rights of the user role in the user interface; based on the target command and the target cluster access rights, obtain the corresponding target resources in the k8s cluster of the web console; and return the target resources to the user interface.

[0043] The present application provides a method for accessing a cluster from a web console, which is applied to a web server in a web console, receives a target command sent by a user interface in the web console, wherein the target command includes a kubectl-class command obtained after the user interface filters the received initial command; determines the target cluster access rights of the user role in the user interface; obtains the corresponding target resource in the k8s cluster of the web console based on the target command and the target cluster access rights; and returns the target resource to the user interface. In the present application, the user interface only transmits the target command of the kubectl class to the web server, which can avoid the user interface from sending other instructions to maliciously operate the k8s cluster, and can ensure the security of the k8s cluster; in addition, the web server can obtain the corresponding target resource in the k8s cluster of the web console based on the target command and the target cluster access rights, which can avoid the user interface from obtaining resources outside its own authority, and can ensure the access security of cluster resources. The present application provides a web console and a cluster access system, an electronic device, and a computer-readable storage medium, which also solve corresponding technical problems. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0045] Figure 1 A flowchart of a method for accessing a cluster from a web console provided in an embodiment of the present application;

[0046] Figure 2 This is a schematic diagram of permissions in the web console;

[0047] Figure 3 This is a schematic diagram of the kubectl process;

[0048] Figure 4 This is a schematic diagram of a WebSocket long connection;

[0049] Figure 5 Another schematic diagram of a WebSocket persistent connection;

[0050] Figure 6This is a schematic diagram of the kubectl process interacting with the apiserver in the k8s cluster through the spdy protocol;

[0051] Figure 7 Another flow chart of a method for accessing a cluster from a web console provided in an embodiment of the present application;

[0052] Figure 8 A schematic diagram of the structure of a web console access cluster system provided in an embodiment of the present application;

[0053] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0054] Fig.10 Another structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0056] Container cluster (k8s, kubernetes) is an open source container cluster management system. Based on Docker (application container engine) technology, it provides a series of complete functions such as deployment and operation, resource scheduling, service discovery and dynamic scaling for containerized applications, which improves the convenience of large-scale container cluster management. At the bottom of the container cluster, the only entry point for managing cluster resources is to call the API server interface through the corresponding method. Kubectl is the official command line tool (CLI) of Kubernetes and is a must-have management tool for Kubernetes users and administrators. Kubectl provides a large number of subcommands to facilitate users to manage various functions in the Kubernetes cluster. Kubectl organizes and converts the commands entered by users on the command line into information that can be recognized by the API server, thereby realizing an effective way to manage various k8s resources.

[0057] However, kubectl is only used at the bottom layer of the cluster. For operation and maintenance administrators, who have the root privileges of the cluster and can directly access the bottom layer of the cluster, it is normal for them to use the kubectl command. However, for the container platform, ordinary users cannot directly access the bottom layer. The container platform provides services to users through the interface. To access the cluster through the interface, there needs to be a way to view the cluster resources. Through the interface, kubectl commands can be used just like at the bottom layer. For this reason, the Web console came into being.

[0058] At present, each product in the industry has its own Web console. These Web consoles are similar, basically relying on the kubectl tool, and various encapsulations and modifications are performed based on kubectl. However, these modifications are relatively complex, and multiple checks are added based on their own logic. For example, in KubeSphere, the pod of its Web console will always occupy the underlying resources, which will cause resource waste, and because it carries various other Linux commands, users can operate the underlying non-k8s resources. In addition, the security issue of the Web console is the primary guarantee of cluster security. For clusters operated from the user's perspective rather than the operation and maintenance administrator's perspective, ensuring the user's operational safety can ensure the security of the cluster. In this process, the operation and maintenance administrator usually has more professional knowledge and can execute various commands without error. However, for cluster users, users only use cluster resources and do not need to perform other operations on the cluster and the nodes where they are located. Therefore, a method of securely accessing cluster resources is needed. The web console access cluster method provided in this application can securely access cluster resources.

[0059] See also Figure 1 , Figure 1 A flowchart of a method for accessing a cluster from a web console provided in an embodiment of the present application.

[0060] A method for accessing a cluster from a web console provided in an embodiment of the present application is applied to a web server in a web console and may include the following steps:

[0061] Step S101: receiving a target command sent by a user interface in a web console, where the target command includes a kubectl class command obtained by filtering an initial command received by the user interface.

[0062] In actual applications, after the user interface in the web console receives the initial command input by the user, it can filter the initial command to obtain the target command of the kubectl class, and only send the target command to the web server. Correspondingly, the web server can receive the target command sent by the user interface.

[0063] It should be noted that the user actually operates the master node where the cluster is located through the Web console, and all commands are executed on the master node, that is, the user command will eventually be executed on the master node, and the master node is essentially an operating system, and k8s is a service installed on the operating system. In theory, users can execute any command on the master node, not just the kubectl command. Through the Web console, users can send any command to the master node, which will cause great security risks. Other users other than operation and maintenance managers, if they use unsafe commands, will damage the cluster. In this application, because the target command sent by the user interface is only a command of the kubectl class, the user interface cannot send other types of commands to the web server, and the kubectl class commands belong to the security commands in the web console, so the user cannot use other commands to attack the k8s cluster in the web console, which can ensure the security of the k8s cluster. In addition, in a specific application scenario, the user interface can receive the initial command input by the user based on the component xterm.js, and can filter the initial command to obtain the target command by the medium command filter, etc. This application is not specifically limited here.

[0064] Step S102: Determine the target cluster access permission of the user role in the user interface.

[0065] In actual applications, because there are multiple levels of user permissions in the k8s container platform, such as super administrator, domain administrator, VDC administrator, etc. Figure 2 As shown in the figure, for the cluster, the resources that users with different permissions can access should be limited, and unauthorized access must be controlled. That is, when users with different permissions access the cluster through the Web console, they should be able to perform corresponding levels of access control. To this end, after receiving the target command sent by the user interface in the web console, the web server must also determine the target cluster access rights of the user role in the user interface. Specifically, the web server can first obtain the identity information of the user role in the user interface, and then determine the target cluster access rights of the user role in the user interface based on the identity information of the user role.

[0066] In a specific application scenario, after receiving the target command sent by the user interface in the web console, the web server can also authenticate the user role in the user interface before determining the target cluster access rights of the user role in the user interface; if the authentication is successful, the step of determining the target cluster access rights of the user role in the user interface is executed; if the authentication is not successful, the target command may not be executed and the corresponding resource acquisition request may be terminated. In this process, the web server can authenticate the user role based on the token, etc., which is not specifically limited in this application.

[0067] Step S103: Based on the target command and the target cluster access rights, the corresponding target resources are obtained in the k8s cluster of the web console.

[0068] Step S104: Return the target resource to the user interface.

[0069] In actual applications, after the web server determines the target cluster access rights of the user role in the user interface, it can obtain the corresponding target resources in the k8s cluster of the web console based on the target command and the target cluster access rights, and return the target resources to the user interface so that the user interface can present the target resources to the user.

[0070] In specific application scenarios, the web server can obtain the target resources from the k8s cluster based on the kubectl process in the process of obtaining the corresponding target resources in the k8s cluster of the web console based on the target command and the target cluster access rights. In order to avoid the situation where multiple users use one kubectl process and the resource acquisition fails, and one kubectl cannot implement multi-user command execution, multiple isolated kubectl processes can be set in the web server, and the web server determines the target kubectl process corresponding to the target kubectl command in multiple isolated kubectl processes; and through the target kubectl process, based on the target command and the target cluster access rights, obtain the corresponding target resources in the k8s cluster of the web console, such as Figure 3 As shown in the figure, etc. This can ensure the security and continuity of the target command. In addition, when the user exits or closes the Web console, the web server can close the kubectl process belonging to this user and release resources, thereby ensuring kubectl access by multiple users.

[0071] In a specific application scenario, when the web server returns the target resource to the user interface, considering that the format of the target resource in the k8s cluster may not meet the display requirements of the user interface, in order to enable the user interface to display the target resource normally, the target resource can be formatted into a target json string; the target json string is transmitted to the user interface. In addition, it should be noted that a command parser can be set in the web server, and the command parser executes the steps of formatting the target resource into a target json string and transmitting the target json string to the user interface. Furthermore, when it is necessary to convert the format of the target command transmitted by the user interface, the command parser can also convert the format of the target command, such as converting the target command into the corresponding format of the kubectl command and supplementing the parameters, etc. This application does not make specific limitations here.

[0072] In a specific application scenario, when the web server is receiving the target commands sent by the user interface in the web console, because the Web console is a continuous interactive process, the web server and the user interface can maintain timely information interaction through the WebSocket protocol. That is, the web server can quickly receive the target commands sent by the user interface in the web console based on the WebSocket protocol; correspondingly, in the process of returning the target resources to the user interface, the target resources can be quickly returned to the user interface based on the WebSocket protocol. It should be noted that WebSocket is a two-way communication protocol that implements full-duplex communication between the browser and the server. After the connection is established, both the WebSocket server and the client can actively send or receive data to each other. The client and the server only need to complete a handshake to create a persistent connection between the two. The WebSocket long connection can be as follows Figure 4 and Figure 5 As shown, etc.

[0073] It should be noted that in specific application scenarios, the kubectl process can use the spdy protocol to interact with the apiserver in the k8s cluster to obtain target resources. The process can be as follows: Figure 6 As shown, the kubectl command is sent to the apiserver through the spdy protocol, the apiserver sends the command to the kubelet, the kubelet searches for the real target resource and returns the result to the apiserver through the ProxyStream, and the apiserver returns the result to kubectl, thereby completing the process of receiving the returned command execution result from kubectl.

[0074] The present application provides a method for accessing a cluster from a web console, which is applied to a web server in a web console, receives a target command sent by a user interface in the web console, wherein the target command includes a kubectl-class command obtained after the user interface filters the received initial command; determines the target cluster access rights of the user role in the user interface; obtains the corresponding target resource in the k8s cluster of the web console based on the target command and the target cluster access rights; and returns the target resource to the user interface. In the present application, the user interface only transmits the target command of the kubectl class to the web server, which can prevent the user interface from sending other instructions to maliciously operate the k8s cluster, and can ensure the security of the k8s cluster; in addition, the web server can obtain the corresponding target resource in the k8s cluster of the web console based on the target command and the target cluster access rights, which can prevent the user interface from obtaining resources beyond its own authority, and can ensure the access security of cluster resources.

[0075] See also Figure 7 , Figure 7 Another flow chart of a method for accessing a cluster from a web console provided in an embodiment of the present application.

[0076] A method for accessing a cluster from a web console provided in an embodiment of the present application is applied to a user interface in a web console and may include the following steps:

[0077] Step S201: receiving an initial command.

[0078] Step S202: Filter the initial command and use the filtered knbectl type command as the target command.

[0079] Step S203: Transmit the target command to the web server in the web console so that the web server determines the target cluster access rights of the user role in the user interface, and obtains the corresponding target resources in the k8s cluster of the web console based on the target command and the target cluster access rights.

[0080] Step S204: receiving the target resource returned by the web server.

[0081] The description of the corresponding steps in a method for accessing a cluster from a web console provided in an embodiment of the present application can be found in the above embodiment and will not be repeated here.

[0082] See also Figure 8 , Figure 8 A schematic diagram of the structure of a web console accessing a cluster system provided in an embodiment of the present application.

[0083] An embodiment of the present application provides a web console access cluster system, which is applied to a web server in a web console and may include:

[0084] The first receiving module 101 is used to receive a target command sent by a user interface in a web console, where the target command includes a kubectl class command obtained by filtering an initial command received by the user interface;

[0085] A first determination module 102, configured to determine target cluster access rights of a user role in a user interface;

[0086] The first acquisition module 103 is used to acquire the corresponding target resource in the k8s cluster of the web console based on the target command and the target cluster access permission;

[0087] The first transmission module 104 is used to return the target resource to the user interface.

[0088] An embodiment of the present application provides a web console access cluster system, which is applied to a web server in a web console. The first acquisition module may include:

[0089] A first determining unit is used to determine a target kubectl process of a target kubectl command among multiple kubectl processes isolated from each other;

[0090] The first acquisition unit is used to acquire corresponding target resources in the k8s cluster of the web console through a target kubectl process based on a target command and target cluster access rights.

[0091] A web console access cluster system provided in an embodiment of the present application is applied to a web server in a web console and may further include:

[0092] The first authentication module is used to authenticate the user role in the user interface after the first receiving module receives the target command sent by the user interface in the web console and before the first determining module determines the target cluster access rights of the user role in the user interface; if the authentication is successful, the first determining module is prompted to execute the step of determining the target cluster access rights of the user role in the user interface.

[0093] An embodiment of the present application provides a web console access cluster system, which is applied to a web server in a web console. The first transmission module may include:

[0094] The first formatting unit is used to format the target resource into a target json string;

[0095] The first transmission unit is used to transmit the target JSON string to the user interface.

[0096] An embodiment of the present application provides a web console access cluster system, which is applied to a web server in a web console. The first receiving module may include:

[0097] A first receiving unit is used to receive a target command sent by a user interface in a web console based on a WebSocket protocol;

[0098] The first transmission module may include:

[0099] The second transmission unit is used to return the target resource to the user interface based on the WebSocket protocol.

[0100] The web console access cluster system provided in the embodiment of the present application is applied to a web server in the web console and a user interface in the web console, and may include:

[0101] A second receiving module, used for receiving an initial command;

[0102] The first filtering module is used to filter the initial command and use the filtered knbectl type command as the target command;

[0103] The second transmission module is used to transmit the target command to the web server in the web console, so that the web server determines the target cluster access rights of the user role in the user interface, and obtains the corresponding target resources in the k8s cluster of the web console based on the target command and the target cluster access rights;

[0104] The third receiving module is used to receive the target resource returned by the web server.

[0105] The present application also provides a web console, including:

[0106] A user interface is used to receive an initial command; filter the initial command, and use the filtered knbectl class command as a target command; and transmit the target command to a web server in a web console;

[0107] The web server is used to determine the target cluster access rights of the user role in the user interface; based on the target command and the target cluster access rights, obtain the corresponding target resources in the k8s cluster of the web console; and return the target resources to the user interface.

[0108] The description of the corresponding components in a web console provided in an embodiment of the present application can be found in the above embodiment and will not be repeated here.

[0109] The present application also provides an electronic device and a computer-readable storage medium, both of which have the corresponding effects of the web console access cluster method provided in the embodiment of the present application. Fig. 9 , Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0110] An electronic device provided in an embodiment of the present application includes a memory 201 and a processor 202. The memory 201 stores a computer program. When the processor 202 executes the computer program, the following steps are implemented:

[0111] Receive the target command sent by the user interface in the web console, where the target command includes the kubectl class command obtained by filtering the initial command received by the user interface;

[0112] Determine the target cluster access permissions for the user role in the UI;

[0113] Based on the target command and target cluster access rights, obtain the corresponding target resources in the k8s cluster of the web console;

[0114] Returns the target resource to the user interface.

[0115] An electronic device provided in an embodiment of the present application includes a memory 201 and a processor 202. A computer program is stored in the memory 201. When the processor 202 executes the computer program, the following steps are implemented: among multiple kubectl processes isolated from each other, a target kubectl process of a target kubectl command is determined; through the target kubectl process, based on the target command and the target cluster access rights, the corresponding target resources are obtained in the k8s cluster of the web console.

[0116] An electronic device provided in an embodiment of the present application includes a memory 201 and a processor 202. A computer program is stored in the memory 201. When the processor 202 executes the computer program, the following steps are implemented: after receiving a target command sent by a user interface in a web console, before determining the target cluster access rights of the user role in the user interface, the user role in the user interface is authenticated; if the authentication is successful, the step of determining the target cluster access rights of the user role in the user interface is executed.

[0117] An electronic device provided in an embodiment of the present application includes a memory 201 and a processor 202. The memory 201 stores a computer program. When the processor 202 executes the computer program, the following steps are implemented: formatting a target resource into a target JSON string; transmitting the target JSON string to a user interface.

[0118] An electronic device provided in an embodiment of the present application includes a memory 201 and a processor 202. A computer program is stored in the memory 201. When the processor 202 executes the computer program, the following steps are implemented: based on the WebSocket protocol, a target command sent by a user interface in a web console is received; based on the WebSocket protocol, a target resource is returned to the user interface.

[0119] An electronic device provided in an embodiment of the present application includes a memory 201 and a processor 202. A computer program is stored in the memory 201. When the processor 202 executes the computer program, the following steps are implemented: receiving an initial command; filtering the initial command, and using the filtered knbectl class command as the target command; transmitting the target command to the web server in the web console, so that the web server determines the target cluster access rights of the user role in the user interface, and obtains the corresponding target resources in the k8s cluster of the web console based on the target command and the target cluster access rights; and receiving the target resources returned by the web server.

[0120] See also Fig.10 , another electronic device provided in the embodiment of the present application may also include: an input port 203 connected to the processor 202, used to transmit commands input from the outside to the processor 202; a display unit 204 connected to the processor 202, used to display the processing results of the processor 202 to the outside; a communication module 205 connected to the processor 202, used to realize the communication between the electronic device and the outside. The display unit 204 can be a display panel, a laser scanning display, etc.; the communication mode adopted by the communication module 205 includes but is not limited to mobile high-definition link technology (HML), universal serial bus (USB), high-definition multimedia interface (HDMI), wireless connection: wireless fidelity technology (WiFi), Bluetooth communication technology, low-power Bluetooth communication technology, and communication technology based on IEEE802.11s.

[0121] An embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0122] Receive the target command sent by the user interface in the web console, where the target command includes the kubectl class command obtained by filtering the initial command received by the user interface;

[0123] Determine the target cluster access permissions for the user role in the UI;

[0124] Based on the target command and target cluster access rights, obtain the corresponding target resources in the k8s cluster of the web console;

[0125] Returns the target resource to the user interface.

[0126] An embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: among multiple kubectl processes isolated from each other, a target kubectl process of a target kubectl command is determined; through the target kubectl process, based on the target command and the target cluster access rights, the corresponding target resources are obtained in the k8s cluster of the web console.

[0127] An embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: after receiving a target command sent by a user interface in a web console, before determining the target cluster access rights of the user role in the user interface, the user role in the user interface is authenticated; if the authentication is successful, the step of determining the target cluster access rights of the user role in the user interface is executed.

[0128] An embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: formatting a target resource into a target JSON string; and transmitting the target JSON string to a user interface.

[0129] An embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: based on the WebSocket protocol, receiving a target command sent by a user interface in a web console; based on the WebSocket protocol, returning a target resource to the user interface.

[0130] An embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: receiving an initial command; filtering the initial command, and using the filtered knbectl class command as the target command; transmitting the target command to the web server in the web console, so that the web server determines the target cluster access rights of the user role in the user interface, and obtains the corresponding target resources in the k8s cluster of the web console based on the target command and the target cluster access rights; and receiving the target resources returned by the web server.

[0131] The computer-readable storage medium involved in the present application includes random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the technical field.

[0132] For the description of the relevant parts of the web console and access cluster system, electronic device, and computer-readable storage medium provided in the embodiments of the present application, please refer to the detailed description of the corresponding parts in the web console access cluster method provided in the embodiments of the present application, which will not be repeated here. In addition, the parts of the above technical solutions provided in the embodiments of the present application that are consistent with the implementation principles of the corresponding technical solutions in the prior art are not described in detail to avoid excessive elaboration.

[0133] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0134] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for accessing a cluster from a web console, characterized in that: Applied to the web server in the web console, including: Receiving a target command sent by a user interface in the web console, wherein the target command includes a kubectl class command obtained by filtering an initial command received based on a component xterm.js by the user interface; Determine the target cluster access rights of the user role in the user interface; Based on the target command and the target cluster access rights, obtain the corresponding target resource in the k8s cluster of the web console; Returning the target resource to the user interface; Wherein, based on the target command and the target cluster access rights, obtaining the corresponding target resource in the k8s cluster of the web console includes: Determine, among multiple kubectl processes isolated from each other, a target kubectl process of the target kubectl command; Through the target kubectl process, based on the target command and the target cluster access rights, the corresponding target resources are obtained in the k8s cluster of the web console; and after the user exits or closes the Web console, the kubectl process belonging to the user is closed to release resources; The returning the target resource to the user interface includes: Format the target resource into a target json string; Transmit the target json string to the user interface.

2. The method according to claim 1, characterized in that After receiving the target command sent by the user interface in the web console and before determining the target cluster access rights of the user role in the user interface, the method further includes: Authenticating the user role in the user interface; If the authentication is successful, the step of determining the target cluster access rights of the user role in the user interface is performed.

3. A method for accessing a cluster from a web console, characterized in that: The user interface used in the web console includes: Receive initial commands based on the component xterm.js; Filter the initial command, and use the filtered knbectl class command as the target command; Transmitting the target command to the web server in the web console, so that the web server determines the target cluster access rights of the user role in the user interface, and based on the target command and the target cluster access rights, obtains the corresponding target resource in the k8s cluster of the web console; Receiving the target resource returned by the web server; The web server obtains the corresponding target resources in the k8s cluster of the web console based on the target command and the target cluster access rights, including: determining the target kubectl process of the target kubectl command among multiple kubectl processes isolated from each other; obtaining the corresponding target resources in the k8s cluster of the web console based on the target command and the target cluster access rights through the target kubectl process; and after the user exits or closes the Web console, the kubectl process belonging to the user is closed to release resources; The web server returns the target resource to the user interface, including: formatting the target resource into a target json string; transmitting the target json string to the user interface.

4. A web console access cluster system, characterized in that: Applied to the web server in the web console, including: A first receiving module is used to receive a target command sent by the user interface in the web console, wherein the target command includes a kubectl class command obtained by filtering an initial command received based on a component xterm.js by the user interface; A first determination module, configured to determine target cluster access rights of a user role in the user interface; A first acquisition module is used to acquire corresponding target resources in the k8s cluster of the web console based on the target command and the target cluster access rights; A first transmission module, used for returning the target resource to the user interface; Wherein, the first acquisition module includes: A first determining unit is used to determine a target kubectl process of the target kubectl command among a plurality of kubectl processes isolated from each other; A first acquisition unit is used to acquire corresponding target resources in the k8s cluster of the web console through the target kubectl process based on the target command and the target cluster access rights; and after the user exits or closes the Web console, the kubectl process belonging to the user is closed to release resources; Wherein, the first transmission module includes: A first formatting unit, used to format the target resource into a target json string; The first transmission unit is used to transmit the target JSON string to the user interface.

5. An electronic device, characterized in that: include: Memory for storing computer programs; A processor is used to implement the steps of the method for accessing a cluster from a web console as claimed in any one of claims 1 to 3 when executing the computer program.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for accessing a cluster from a web console as claimed in any one of claims 1 to 3 are implemented.

7. A web console, characterized in that: include: User interface for receiving initial commands based on the component xterm.js; Filter the initial command, and use the filtered knbectl class command as the target command; Transmitting the target command to a web server in the web console; The web server is used to determine the target cluster access rights of the user role in the user interface; based on the target command and the target cluster access rights, obtain the corresponding target resource in the k8s cluster of the web console; Returning the target resource to the user interface; The web server obtains the corresponding target resources in the k8s cluster of the web console based on the target command and the target cluster access rights, including: determining the target kubectl process of the target kubectl command among multiple kubectl processes isolated from each other; obtaining the corresponding target resources in the k8s cluster of the web console based on the target command and the target cluster access rights through the target kubectl process; and after the user exits or closes the Web console, closing the kubectl process belonging to the user to release resources; The web server returns the target resource to the user interface, including: formatting the target resource into a target json string; transmitting the target json string to the user interface.

Images