An instance incubation system and method based on user isolation

Abstract

The present invention relates to the technical field of cloud service resource management, and provides an instance incubation system and method based on user isolation. The system of the present invention includes: a cloud management platform, a product center, a tenant center, a cluster service agent, and a cloud cluster. The method of the present invention includes: the product center calls the tenant center to create a product tenant, and installs a cloud service product in the namespace of the product tenant in the cloud cluster; the cloud management platform calls the tenant center to create a common tenant; the cloud management platform calls the product center to incubate instances in the namespace of the corresponding tenant in the cloud cluster. According to the user isolation-based instance incubation system and method of an exemplary embodiment of the present invention, by configuring namespaces and security resources for tenants, and incubating instances through the product center, it is possible to achieve resource isolation and permission isolation between tenants and management components through centralized service incubation instances, thereby improving the overall security of the cluster.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud service resource management, and in particular to an instance incubation system and method based on user isolation. Background Art

[0002] In the cloud service scenario, there are two types of resources in the cloud service cluster. One type is the resources that maintain the operation of the cluster and services. This type of resource includes basic system components and service components. These components need to communicate with each other, check and repair faults, or incubate new instances for other components or tenants to use. The other type is the resources that belong to tenants. Tenants obtain ownership and use rights of cloud service resources through purchase or other means.

[0003] In the actual management application of cluster resources, since the resources belonging to the tenants and the resources within the cluster run in the same cluster, if the tenants' permissions are not controlled, unpredictable risks will occur, such as: users illegally elevating their own permissions, modifying or deleting cluster configurations, obtaining system components or other tenants' information, destroying services, maliciously exploiting vulnerabilities in system component product dependencies, reading other components or tenants' information, etc.

[0004] Therefore, how to distinguish the permissions of ordinary tenants and cloud service product components so that cloud service product components can view and access resources in other namespaces and modify resources in their own namespace, while ordinary tenants are only allowed to view and access but not modify resources in their own namespace, has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] In view of this, in order to overcome the shortcomings of cluster role permission management in existing cloud service resource management technologies, the present invention configures namespaces and security resources for tenants, and incubates instances through a product center, thereby achieving resource isolation and permission isolation between instances incubated through centralized services and tenants and management components.

[0006] In one aspect, the present invention provides an instance incubation system based on user isolation, comprising:

[0007] The cloud management platform is used to call the tenant center to create common tenants and call the product center to incubate instances in the tenant's namespace in the cloud cluster. It is also used to display the products of the product center and provide registration, login, and instance purchase services for common tenants.

[0008] The product center is used to launch cloud service products through the product center, send a request to create a product tenant to the tenant center, install cloud service products in the namespace of the product tenant in the cloud cluster, send a request to incubate an instance to the cluster service agent based on the received request to purchase the instance, store the instance status persistently, and return the instance information to the cloud management platform for ordinary tenants to call;

[0009] A tenant center, which is used to, upon receiving a request to create a product tenant, distinguish between already created product tenants and uncreated product tenants by judging, generate corresponding product tenant information, certificate files and permission files for the uncreated product tenants, and call the cluster service agent with the product tenant information, certificate files and permission files; and is used to, upon receiving a request to create a common tenant, distinguish between already created common tenants and uncreated common tenants by judging, generate corresponding common tenant information, certificate files and permission files for the uncreated common tenants, and call the cluster service agent with the common tenant information, certificate files and permission files;

[0010] Cluster service agent, used to create cluster resources corresponding to product tenants in the cloud cluster according to product tenant information, certificate files and permission files in the tenant center, create cluster resources corresponding to product tenants in the cloud cluster according to common tenant information, certificate files and permission files in the tenant center, incubate instances into the cloud cluster according to received incubation instance requests, check the incubation status of instances in the cloud cluster, and call back the instance status and instance information of successfully incubated instances to the product center;

[0011] Cloud clusters are used to run services that carry the cloud management platform, product center, tenant center, and cluster service agent, and to install cloud products to provide external services.

[0012] In another aspect, the present invention provides an instance incubation method based on user isolation, comprising:

[0013] Step S1: The product center calls the tenant center to create a product tenant and installs the cloud service product in the namespace of the product tenant in the cloud cluster;

[0014] Step S2: The cloud management platform calls the tenant center to create a common tenant;

[0015] Step S3: The cloud management platform calls the product center to incubate the namespace instance of the corresponding tenant in the cloud cluster.

[0016] Furthermore, step S1 of the instance incubation method based on user isolation of the present invention comprises:

[0017] Step S11: Launch the cloud service product through the product center and send a request to create a product tenant to the tenant center;

[0018] Step S12: After receiving the request to create a product tenant, the tenant center distinguishes between the product tenants that have been created and the product tenants that have not been created;

[0019] Step S13: using the tenant center to generate corresponding product tenant information, certificate file and permission file for the uncreated product tenant, and calling the cluster service agent with the product tenant information, certificate file and permission file;

[0020] Step S14: The cluster service agent creates cluster resources corresponding to the product tenant in the cloud cluster according to the product tenant information, certificate file, and permission file of the tenant center;

[0021] Step S15: Install the cloud service product in the namespace of the product tenant in the cloud cluster through the product center.

[0022] Furthermore, step S12 of the instance incubation method based on user isolation of the present invention includes: the tenant center checks whether there is a record of the received request; when there is a record of the request, checks whether the cluster resources corresponding to the requested product tenant have been generated and are in normal status; when the cluster resources corresponding to the requested product tenant have been generated and are in normal status, determines that the product tenant corresponding to the request has been created, and returns information that the product tenant has been successfully created to the product center.

[0023] Furthermore, in step S13 of the instance incubation method based on user isolation of the present invention, the tenant center is used to generate corresponding product tenant information, certificate files and permission files for the uncreated product tenants, including:

[0024] Step S131: the tenant center generates product tenant information for an uncreated product tenant according to a request to create a product tenant, wherein the product tenant information includes basic product tenant information, product information, and product specifications;

[0025] Step S132: The tenant center issues a product tenant certificate file based on the root certificate. The certificate file has administrator user attributes, and has the ability to access resources in other namespaces across namespaces, and to view and modify the level of resources in the current namespace;

[0026] Step S133: The tenant center generates an authority file based on the product tenant certificate file;

[0027] Step S134: The tenant center stores the product tenant information, certificate files, and permission files in a persistent manner.

[0028] Furthermore, step S14 of the instance incubation method based on user isolation of the present invention includes:

[0029] Step S141: the cluster proxy service creates a namespace according to the permission file of the product tenant;

[0030] Step S142: The cluster proxy service creates a role permission with administrator user attributes according to the created namespace;

[0031] Step S143: the cluster proxy service creates a cluster role permission with administrator user attributes according to the created role permission;

[0032] Step S144: the cluster proxy service creates corresponding cluster role binding attributes according to the created cluster role permissions;

[0033] Step S145: The cluster proxy service returns information that the product tenant is successfully created to the product center.

[0034] Furthermore, step S15 of the instance incubation method based on user isolation of the present invention includes:

[0035] Step S151: The product center obtains corresponding installation files, management component information, and management component installation packages according to product tenant information;

[0036] Step S152: the product center calls the cluster service agent to install the management component installation package into the cloud cluster;

[0037] Step S153: The cluster service agent checks the installation status of the management component installation package in the cloud cluster, and calls back the product information of the successful installation to the product center;

[0038] Step S154: The product center persistently stores the received product information and returns the product information to the cloud management platform for display.

[0039] Furthermore, step S2 of the instance incubation method based on user isolation of the present invention includes:

[0040] Step S21: Send a request to create a common tenant to the tenant center through the cloud management platform;

[0041] Step S22: After receiving the request to create a common tenant, the tenant center distinguishes between the common tenants that have been created and the common tenants that have not been created;

[0042] Step S23: using the tenant center to generate corresponding common tenant information, certificate files and authority files for common tenants that have not been created, and calling the cluster service agent with the common tenant information, certificate files and authority files;

[0043] Step S24: The cluster service agent creates cluster resources corresponding to common tenants in the cloud cluster according to the common tenant information, certificate files, and permission files of the tenant center.

[0044] Furthermore, step S22 of the instance incubation method based on user isolation of the present invention includes: the tenant center checks whether there is a record of the received request, and when there is a record of the request, checks whether the cluster resources corresponding to the requested common tenant have been generated and whether the status is normal; when the cluster resources corresponding to the requested common tenant have been generated and the status is normal, it is determined that the common tenant corresponding to the request has been created, and information on the successful creation of the common tenant is returned to the product center.

[0045] Furthermore, in step S23 of the instance incubation method based on user isolation of the present invention, the tenant center is used to generate corresponding common tenant information, certificate files and permission files for common tenants that have not been created, including:

[0046] Step S231: the tenant center generates product tenant information for an uncreated common tenant according to a request to create a product tenant, wherein the product tenant information includes basic information of the common tenant, product information, and security restriction information;

[0047] Step S232: The tenant center issues a common tenant certificate file based on the root certificate. The certificate file has access user attributes and has the level of read and write access to objects in the current namespace;

[0048] Step S233: The tenant center generates an authority file based on the common tenant certificate file;

[0049] Step S234: The tenant center stores common tenant information, certificate files, and authority files in a persistent manner.

[0050] Furthermore, step S24 of the instance incubation method based on user isolation of the present invention includes:

[0051] Step S241: the cluster proxy service creates a namespace according to the permission file of the common tenant;

[0052] Step S242: the cluster proxy service creates a role permission to access user attributes according to the created namespace;

[0053] Step S243: the cluster proxy service creates a cluster role permission with access to user attributes according to the created role permission;

[0054] Step S244: the cluster proxy service creates corresponding cluster role binding attributes according to the created cluster role permissions;

[0055] Step S245: The cluster proxy service returns information that the common tenant has been successfully created to the cloud management platform.

[0056] Furthermore, step S3 of the instance incubation method based on user isolation of the present invention includes:

[0057] Step S31: the cloud management platform forwards the request of the common tenant to purchase the instance to the product center, where the request includes the common tenant information, product information and product specifications;

[0058] Step S32: the product center sends a request for incubating an instance to the cluster service agent according to the received request for purchasing the instance;

[0059] Step S33: the cluster service agent incubates the instance into the cloud cluster according to the received request for incubating the instance;

[0060] Step S34: the cluster service agent checks the incubation status of the instances in the cloud cluster, and calls back the instance status and instance information of the successfully incubated instances to the product center;

[0061] Step S35: The product center stores the instance status persistently and returns the instance information to the cloud management platform for ordinary tenants to call.

[0062] The instance incubation system and method based on user isolation of the present invention has the following beneficial effects:

[0063] 1. The highest level certificate file (root certificate) is only stored in the tenant center. All service certificates are issued by the root certificate, and no service can obtain root user permissions;

[0064] 2. Products and common tenants correspond to namespaces one by one, which provides good isolation between services;

[0065] 3. Cloud service products do not directly incubate instances. Instead, the cluster service agent is directly called to incubate instances through the product center to avoid security risks caused by the introduction of cloud service products.

[0066] 4. Cloud service products can only view and access permissions of other namespaces, but cannot modify or delete other namespaces;

[0067] 5. Ordinary tenants have very low permission levels, with only viewing and access rights to their own namespace, which prevents users from escalating permissions or performing other risky operations.

[0068] In summary, the instance incubation system and method based on user isolation of the present invention can improve the security of the entire cluster. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0070] Figure 1 The diagram is an architecture diagram of an instance incubation system based on user isolation according to the first exemplary embodiment of the present invention.

[0071] Figure 2 The figure is a flow chart of an instance incubation method based on user isolation according to the second exemplary embodiment of the present invention.

[0072] Figure 3 The figure is a flow chart of an instance incubation method based on user isolation according to the third exemplary embodiment of the present invention.

[0073] Figure 4 This is a timing diagram of an instance incubation method based on user isolation according to the third exemplary embodiment of the present invention.

[0074] Figure 5 The figure is a flow chart of an instance incubation method based on user isolation according to the fourth exemplary embodiment of the present invention.

[0075] Figure 6 This is a timing diagram of an instance incubation method based on user isolation according to the fourth exemplary embodiment of the present invention.

[0076] Figure 7 The figure is a flow chart of an instance incubation method based on user isolation according to the fifth exemplary embodiment of the present invention.

[0077] Figure 8 This is a timing diagram of an instance incubation method based on user isolation according to the fifth exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0078] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0079] It should be noted that the following embodiments and features in the embodiments may be combined with each other in the absence of conflict; and, based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making any creative work are within the scope of protection of the present disclosure.

[0080] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0081] The theoretical technology of the present invention is briefly described as follows:

[0082] The present invention issues certificates of different levels to different types of tenants, so that common tenants can only access resources under this namespace, thereby achieving the purpose of isolation between tenants and between tenants and system components.

[0083] For the product center, each cloud service product managed by it is a business component. It needs to access other resources across namespaces and call various services. Therefore, it is necessary to create a tenant (product tenant) with cluster-level permissions for each cloud service product so that the cloud service product can provide services normally. For the cloud management platform, relying on the users (ordinary tenants) managed by the tenant center, for cluster security considerations, it only needs to grant namespace-level permissions and incubate all tenant resources (instances) under the tenant's namespace, so that the tenant can only operate the resources under this namespace. After the basic information of the tenant and the cluster resources are successfully created, the information that the tenant has been successfully created will be returned to the cloud management platform. After the tenant chooses to purchase on the page, the cloud management platform will incubate the instance requested for incubation into the tenant's namespace in the cluster through the cluster service agent, and check it. After success, record the status and provide it to the tenant for use.

[0084] The permissions in the solution of the present invention are divided into three levels. The tenant center holds the root certificate, has the highest permissions, and has all cluster permissions. Product tenants have the role attributes of administrator users, have cluster-level access permissions, have the ability to access resources in other namespaces across namespaces, and have the ability to view and modify resources in this namespace, but do not have the permissions and levels to modify resources in other namespaces. Ordinary tenants have the role attributes of access users, have access permissions at the level of this namespace, and cannot access any resources outside this namespace. They also do not have the permissions and levels to modify objects in this namespace.

[0085] Figure 1 FIG. 1 is an architecture diagram of an instance incubation system based on user isolation according to an exemplary first embodiment of the present invention. Figure 1 As shown, the system of this embodiment includes:

[0086] The cloud management platform is used to call the tenant center to create common tenants and call the product center to incubate instances in the tenant's namespace in the cloud cluster. It is also used to display the products of the product center and provide registration, login, and instance purchase services for common tenants.

[0087] The product center is used to launch cloud service products through the product center, send a request to create a product tenant to the tenant center, install cloud service products in the namespace of the product tenant in the cloud cluster, send a request to incubate an instance to the cluster service agent based on the received request to purchase the instance, store the instance status persistently, and return the instance information to the cloud management platform for ordinary tenants to call;

[0088] A tenant center, which is used to, upon receiving a request to create a product tenant, distinguish between already created product tenants and uncreated product tenants by judging, generate corresponding product tenant information, certificate files and permission files for the uncreated product tenants, and call the cluster service agent with the product tenant information, certificate files and permission files; and is used to, upon receiving a request to create a common tenant, distinguish between already created common tenants and uncreated common tenants by judging, generate corresponding common tenant information, certificate files and permission files for the uncreated common tenants, and call the cluster service agent with the common tenant information, certificate files and permission files;

[0089] Cluster service agent, used to create cluster resources corresponding to product tenants in the cloud cluster according to product tenant information, certificate files and permission files in the tenant center, create cluster resources corresponding to product tenants in the cloud cluster according to common tenant information, certificate files and permission files in the tenant center, incubate instances into the cloud cluster according to received incubation instance requests, check the incubation status of instances in the cloud cluster, and call back the instance status and instance information of successfully incubated instances to the product center;

[0090] Cloud clusters are used to run services that carry the cloud management platform, product center, tenant center, and cluster service agent, and to install cloud products to provide external services.

[0091] Figure 2 This is a flow chart of an instance incubation method based on user isolation according to an exemplary second embodiment of the present invention. The method of this embodiment includes:

[0092] Step S1: The product center calls the tenant center to create a product tenant and installs the cloud service product in the namespace of the product tenant in the cloud cluster;

[0093] Step S2: The cloud management platform calls the tenant center to create a common tenant;

[0094] Step S3: The cloud management platform calls the product center to incubate the namespace instance of the corresponding tenant in the cloud cluster.

[0095] Figure 3 is a flowchart of an instance incubation method based on user isolation according to an exemplary third embodiment of the present invention. Figure 2 A preferred embodiment of the method shown, Figure 4 is a timing diagram of step S1 of the method of this embodiment, such as Figure 3 and Figure 4 As shown, step S1 of the method of this embodiment includes:

[0096] Step S11: Launch the cloud service product through the product center and send a request to create a product tenant to the tenant center;

[0097] Step S12: After receiving the request to create a product tenant, the tenant center distinguishes between the product tenants that have been created and the product tenants that have not been created;

[0098] Step S13: using the tenant center to generate corresponding product tenant information, certificate file and permission file for the uncreated product tenant, and calling the cluster service agent with the product tenant information, certificate file and permission file;

[0099] Step S14: The cluster service agent creates cluster resources corresponding to the product tenant in the cloud cluster according to the product tenant information, certificate file, and permission file of the tenant center;

[0100] Step S15: Install the cloud service product in the namespace of the product tenant in the cloud cluster through the product center.

[0101] Specifically, in practical applications, such as Figure 3 and Figure 4 As shown, step S1 of the method of this embodiment is implemented in the following manner.

[0102] Step S12 of the method of this embodiment includes: the tenant center checks whether there is a record of the received request; if there is a record of the request, checks whether the cluster resources corresponding to the requested product tenant have been generated and are in normal status; if the cluster resources corresponding to the requested product tenant have been generated and are in normal status, determines that the product tenant corresponding to the request has been created, and returns information that the product tenant has been successfully created to the product center.

[0103] In step S13 of the method of this embodiment, the tenant center is used to generate corresponding product tenant information, certificate files, and permission files for the uncreated product tenant, including:

[0104] Step S131: the tenant center generates product tenant information for an uncreated product tenant according to a request to create a product tenant, wherein the product tenant information includes basic product tenant information, product information, and product specifications;

[0105] Step S132: The tenant center issues a product tenant certificate file based on the root certificate. The certificate file has administrator user attributes, and has the ability to access resources in other namespaces across namespaces, and to view and modify the level of resources in the current namespace;

[0106] Step S133: The tenant center generates an authority file based on the product tenant certificate file;

[0107] Step S134: The tenant center stores the product tenant information, certificate files, and permission files in a persistent manner.

[0108] In step S132 of the method of this embodiment, the tenant certificate file does not have the authority and level to modify resources in other namespaces.

[0109] Step S14 of the method of this embodiment includes:

[0110] Step S141: the cluster proxy service creates a namespace according to the permission file of the product tenant;

[0111] Step S142: The cluster proxy service creates a role permission with administrator user attributes according to the created namespace;

[0112] Step S143: the cluster proxy service creates a cluster role permission with administrator user attributes according to the created role permission;

[0113] Step S144: the cluster proxy service creates corresponding cluster role binding attributes according to the created cluster role permissions;

[0114] Step S145: The cluster proxy service returns information that the product tenant is successfully created to the product center.

[0115] Step S15 of the method of this embodiment includes:

[0116] Step S151: The product center obtains corresponding installation files, management component information, and management component installation packages according to product tenant information;

[0117] Step S152: the product center calls the cluster service agent to install the management component installation package into the cloud cluster;

[0118] Step S153: The cluster service agent checks the installation status of the management component installation package in the cloud cluster, and calls back the product information of the successful installation to the product center;

[0119] Step S154: The product center persistently stores the received product information and returns the product information to the cloud management platform for display.

[0120] Figure 5 is a flowchart of an instance incubation method based on user isolation according to an exemplary fourth embodiment of the present invention. Figure 2 A preferred embodiment of the method shown, Figure 6 is a timing diagram of step S2 of the method of this embodiment, such as Figure 5 and Figure 6 As shown, step S2 of the method of this embodiment includes:

[0121] Step S21: Send a request to create a common tenant to the tenant center through the cloud management platform;

[0122] Step S22: After receiving the request to create a common tenant, the tenant center distinguishes between the common tenants that have been created and the common tenants that have not been created;

[0123] Step S23: using the tenant center to generate corresponding common tenant information, certificate files and authority files for common tenants that have not been created, and calling the cluster service agent with the common tenant information, certificate files and authority files;

[0124] Step S24: The cluster service agent creates cluster resources corresponding to common tenants in the cloud cluster according to the common tenant information, certificate files, and permission files of the tenant center.

[0125] Specifically, in practical applications, such as Figure 5 and Figure 6 As shown, step S2 of the method of this embodiment is implemented in the following manner.

[0126] Step S22 of the method of this embodiment includes: the tenant center checks whether there is a record of the received request. When there is a record of the request, it checks whether the cluster resources corresponding to the common tenant of the request have been generated and whether the status is normal. When the cluster resources corresponding to the common tenant of the request have been generated and the status is normal, it is determined that the common tenant corresponding to the request has been created, and information on the successful creation of the common tenant is returned to the product center.

[0127] In step S23 of the method of this embodiment, the tenant center is used to generate corresponding common tenant information, certificate files, and permission files for common tenants that have not been created, including:

[0128] Step S231: the tenant center generates product tenant information for an uncreated common tenant according to a request to create a product tenant, wherein the product tenant information includes basic information of the common tenant, product information, and security restriction information;

[0129] Step S232: The tenant center issues a common tenant certificate file based on the root certificate. The certificate file has access user attributes and has the level of read and write access to objects in the current namespace;

[0130] Step S233: The tenant center generates an authority file based on the common tenant certificate file;

[0131] Step S234: The tenant center stores common tenant information, certificate files, and authority files in a persistent manner.

[0132] In step S232 of the method of this embodiment, the common tenant certificate file does not have the authority and level to modify objects in the current namespace.

[0133] Step S24 of the method of this embodiment includes:

[0134] Step S241: the cluster proxy service creates a namespace according to the permission file of the common tenant;

[0135] Step S242: the cluster proxy service creates a role permission to access user attributes according to the created namespace;

[0136] Step S243: the cluster proxy service creates a cluster role permission with access to user attributes according to the created role permission;

[0137] Step S244: the cluster proxy service creates corresponding cluster role binding attributes according to the created cluster role permissions;

[0138] Step S245: The cluster proxy service returns information that the common tenant has been successfully created to the cloud management platform.

[0139] Figure 7 is a flowchart of an instance incubation method based on user isolation according to an exemplary fifth embodiment of the present invention. Figure 2 A preferred embodiment of the method shown, Figure 8 is a timing diagram of step S3 of the method of this embodiment, such as Figure 7 and Figure 8 As shown, step S3 of the method of this embodiment includes:

[0140] Step S31: the cloud management platform forwards the request of the common tenant to purchase the instance to the product center, where the request includes the common tenant information, product information and product specifications;

[0141] Step S32: the product center sends a request for incubating an instance to the cluster service agent according to the received request for purchasing the instance;

[0142] Step S33: the cluster service agent incubates the instance into the cloud cluster according to the received request for incubating the instance;

[0143] Step S34: the cluster service agent checks the incubation status of the instances in the cloud cluster, and calls back the instance status and instance information of the successfully incubated instances to the product center;

[0144] Step S35: The product center stores the instance status persistently and returns the instance information to the cloud management platform for ordinary tenants to call.

[0145] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. An instance incubation system based on user isolation, characterized in that: The system comprises: The cloud management platform is used to call the tenant center to create common tenants and call the product center to incubate instances in the tenant's namespace in the cloud cluster. It is also used to display the products of the product center and provide registration, login, and instance purchase services for common tenants. The product center is used to launch cloud service products through the product center, send a request to create a product tenant to the tenant center, install cloud service products in the namespace of the product tenant in the cloud cluster, send a request to incubate an instance to the cluster service agent based on the received request to purchase the instance, store the instance status persistently, and return the instance information to the cloud management platform for ordinary tenants to call; A tenant center, which is used to, upon receiving a request to create a product tenant, distinguish between already created product tenants and uncreated product tenants by judging, generate corresponding product tenant information, certificate files and permission files for the uncreated product tenants, and call the cluster service agent with the product tenant information, certificate files and permission files; and is used to, upon receiving a request to create a common tenant, distinguish between already created common tenants and uncreated common tenants by judging, generate corresponding common tenant information, certificate files and permission files for the uncreated common tenants, and call the cluster service agent with the common tenant information, certificate files and permission files; Cluster service agent, used to create cluster resources corresponding to product tenants in the cloud cluster according to product tenant information, certificate files and permission files in the tenant center, create cluster resources corresponding to product tenants in the cloud cluster according to common tenant information, certificate files and permission files in the tenant center, incubate instances into the cloud cluster according to received incubation instance requests, check the incubation status of instances in the cloud cluster, and call back the instance status and instance information of successfully incubated instances to the product center; Cloud clusters are used to run services that carry the cloud management platform, product center, tenant center, and cluster service agent, and to install cloud products to provide external services.

2. An instance incubation method based on user isolation according to the system of claim 1, characterized in that: The method comprises: Step S1: The product center calls the tenant center to create a product tenant and installs the cloud service product in the namespace of the product tenant in the cloud cluster; Step S2: The cloud management platform calls the tenant center to create a common tenant; Step S3: The cloud management platform calls the product center to incubate the namespace instance of the corresponding tenant in the cloud cluster.

3. The instance incubation method based on user isolation according to claim 2, characterized in that: Step S1 includes: Step S11: Launch the cloud service product through the product center and send a request to create a product tenant to the tenant center; Step S12: After receiving the request to create a product tenant, the tenant center distinguishes between the product tenants that have been created and the product tenants that have not been created; Step S13: using the tenant center to generate corresponding product tenant information, certificate file and permission file for the uncreated product tenant, and calling the cluster service agent with the product tenant information, certificate file and permission file; Step S14: The cluster service agent creates cluster resources corresponding to the product tenant in the cloud cluster according to the product tenant information, certificate file, and permission file of the tenant center; Step S15: Install the cloud service product in the namespace of the product tenant in the cloud cluster through the product center.

4. The instance incubation method based on user isolation according to claim 3, characterized in that: Step S12 includes: the tenant center checks whether there is a record of the received request. When there is a record of the request, it checks whether the cluster resources corresponding to the requested product tenant have been generated and are in normal status. When the cluster resources corresponding to the requested product tenant have been generated and are in normal status, it is determined that the product tenant corresponding to the request has been created, and information indicating successful creation of the product tenant is returned to the product center.

5. The instance incubation method based on user isolation according to claim 3, characterized in that: In step S13, the tenant center is used to generate corresponding product tenant information, certificate files, and permission files for the uncreated product tenant, including: Step S131: the tenant center generates product tenant information for an uncreated product tenant according to a request to create a product tenant, wherein the product tenant information includes basic product tenant information, product information, and product specifications; Step S132: The tenant center issues a product tenant certificate file based on the root certificate. The certificate file has administrator user attributes, and has the ability to access resources in other namespaces across namespaces, and to view and modify the level of resources in the current namespace; Step S133: The tenant center generates an authority file based on the product tenant certificate file; Step S134: The tenant center stores the product tenant information, certificate files, and permission files in a persistent manner.

6. The instance incubation method based on user isolation according to claim 3, characterized in that: Step S14 includes: Step S141: the cluster proxy service creates a namespace according to the permission file of the product tenant; Step S142: The cluster proxy service creates a role permission with administrator user attributes according to the created namespace; Step S143: the cluster proxy service creates a cluster role permission with administrator user attributes according to the created role permission; Step S144: the cluster proxy service creates corresponding cluster role binding attributes according to the created cluster role permissions; Step S145: The cluster proxy service returns information that the product tenant is successfully created to the product center.

7. The instance incubation method based on user isolation according to claim 3, characterized in that: Step S15 includes: Step S151: The product center obtains corresponding installation files, management component information, and management component installation packages according to product tenant information; Step S152: the product center calls the cluster service agent to install the management component installation package into the cloud cluster; Step S153: The cluster service agent checks the installation status of the management component installation package in the cloud cluster, and calls back the product information of the successful installation to the product center; Step S154: The product center persistently stores the received product information and returns the product information to the cloud management platform for display.

8. The instance incubation method based on user isolation according to claim 2, characterized in that: Step S2 comprises: Step S21: Send a request to create a common tenant to the tenant center through the cloud management platform; Step S22: After receiving the request to create a common tenant, the tenant center distinguishes between the common tenants that have been created and the common tenants that have not been created; Step S23: using the tenant center to generate corresponding common tenant information, certificate files and authority files for common tenants that have not been created, and calling the cluster service agent with the common tenant information, certificate files and authority files; Step S24: The cluster service agent creates cluster resources corresponding to common tenants in the cloud cluster according to the common tenant information, certificate files, and permission files of the tenant center.

9. The instance incubation method based on user isolation according to claim 8, characterized in that: Step S22 includes: the tenant center checks whether there is a record of the received request. When there is a record of the request, it checks whether the cluster resources corresponding to the requested common tenant have been generated and are in normal status. When the cluster resources corresponding to the requested common tenant have been generated and are in normal status, it is determined that the common tenant corresponding to the request has been created, and information on successful creation of the common tenant is returned to the product center.

10. The instance incubation method based on user isolation according to claim 8, characterized in that: In step S23, the tenant center is used to generate corresponding common tenant information, certificate files, and permission files for common tenants that have not been created, including: Step S231: the tenant center generates product tenant information for an uncreated common tenant according to a request to create a product tenant, wherein the product tenant information includes basic information of the common tenant, product information, and security restriction information; Step S232: The tenant center issues a common tenant certificate file based on the root certificate. The certificate file has access user attributes and has the level of read and write access to objects in the current namespace; Step S233: The tenant center generates an authority file based on the common tenant certificate file; Step S234: The tenant center stores common tenant information, certificate files, and authority files in a persistent manner.

11. The instance incubation method based on user isolation according to claim 8, characterized in that: Step S24 includes: Step S241: the cluster proxy service creates a namespace according to the permission file of the common tenant; Step S242: the cluster proxy service creates a role permission to access user attributes according to the created namespace; Step S243: the cluster proxy service creates a cluster role permission with access to user attributes according to the created role permission; Step S244: the cluster proxy service creates corresponding cluster role binding attributes according to the created cluster role permissions; Step S245: The cluster proxy service returns information that the common tenant has been successfully created to the cloud management platform.

12. The instance incubation method based on user isolation according to claim 2, characterized in that: Step S3 includes: Step S31: the cloud management platform forwards the request of the common tenant to purchase the instance to the product center, where the request includes the common tenant information, product information and product specifications; Step S32: the product center sends a request for incubating an instance to the cluster service agent according to the received request for purchasing the instance; Step S33: the cluster service agent incubates the instance into the cloud cluster according to the received request for incubating the instance; Step S34: the cluster service agent checks the incubation status of the instances in the cloud cluster, and calls back the instance status and instance information of the successfully incubated instances to the product center; Step S35: The product center stores the instance status persistently and returns the instance information to the cloud management platform for ordinary tenants to call.

Images