A method, device and system for managing cluster access rights

Abstract

The present invention discloses a method, device and system for managing cluster access rights, and relates to the field of cloud computing technology. A specific implementation of the method includes: automatically obtaining the access rights policy of a first cluster managed among multiple clusters; and obtaining the access rights information between the first cluster and one or more associated second clusters contained in the access rights policy; automatically updating the access rights information contained in the access rights policy when changes are detected in the resources of the one or more second clusters; and dynamically managing multiple clusters using the updated access rights information. The method of the embodiment of the present invention overcomes the problem of poor flexibility in managing cluster access rights in the existing methods, and improves the real-time and efficiency of managing cluster access rights.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to a method, device and system for managing cluster access rights. Background Art

[0002] As the complexity of Internet application systems increases, data interaction between multiple clusters can usually be used to improve the data processing capabilities of Internet application systems. Depending on the business scenarios of the application, it is often necessary to manage access rights between clusters when processing data interaction between clusters.

[0003] The current method for handling access rights between clusters is that technicians configure each cluster that needs to interact according to the set interactive access rights (such as black and white lists); when the resources associated with the access rights change in the cluster, the technicians need to manually change the access rights; the existing method has the problems of poor flexibility in managing cluster access rights, poor real-time performance and low efficiency. Summary of the invention

[0004] In view of this, the embodiments of the present invention provide a method, device and system for managing cluster access rights, which can automatically obtain the access rights policy of the first cluster managed among multiple clusters; and obtain the access rights information between the first cluster and one or more associated second clusters contained in the access rights policy; when the resource of the one or more second clusters is monitored to change, the access rights information contained in the access rights policy is automatically updated; and multiple clusters are dynamically managed using the updated access rights information. The method of the embodiments of the present invention overcomes the problem of poor flexibility in managing cluster access rights in the existing methods, and improves the real-time and efficiency of managing cluster access rights.

[0005] To achieve the above-mentioned purpose, according to one aspect of an embodiment of the present invention, a method for managing cluster access rights is provided, characterized in that it includes: obtaining an access rights policy of a first cluster; the access rights policy includes access rights information between the first cluster and one or more second clusters associated with it; when a change is detected in the resources of any associated second cluster, updating the access rights information corresponding to the second cluster included in the access rights policy according to the change result of the resources of the second cluster; and managing the access rights between the first cluster and the associated second cluster using the updated access rights policy.

[0006] Optionally, the method for managing cluster access rights further includes: upon detecting a change in resources of the first cluster, updating the access rights information corresponding to the first cluster contained in the access rights policy according to the change results of the first cluster resources; and using the updated access rights policy to manage the access rights between the first cluster and the associated second cluster.

[0007] Optionally, updating the access permission information corresponding to the second cluster contained in the access permission policy includes: adding an annotation containing the cluster identifier of the second cluster to the access permission information corresponding to the second cluster; indicating a resource change in the second cluster through the cluster identifier contained in the annotation; and limiting the access permission of the first cluster to the second cluster through the access permission policy combined with the annotation when the first cluster accesses the second cluster.

[0008] Optionally, obtaining the access permission policy of the first cluster includes: obtaining configuration information of the first cluster; determining cluster information of one or more second clusters associated with the first cluster based on the configuration information; obtaining preset access permission information between the first cluster and one or more second clusters, and generating the access permission policy of the first cluster based on the preset access permission information.

[0009] Optionally, obtaining the preset access permission information between the first cluster and one or more of the second clusters includes: parsing the preset access permission information from a preset configuration file, and / or parsing the preset access permission information from custom permission data contained in the first cluster, wherein the custom permission data is obtained based on the expansion of cluster native permission data.

[0010] Optionally, the method for managing cluster access rights further comprises: the first cluster includes a rights controller; and the rights controller is used to execute the steps of obtaining the access rights policy of the first cluster and updating the access rights policy.

[0011] Optionally, the method for managing cluster access rights further includes: using the permission controller to start the first controller and the second controller for the first cluster to which it belongs; using the first controller to monitor resource changes of the first cluster; and using the second controller to monitor resource changes of one or more second clusters associated with the first cluster.

[0012] To achieve the above object, according to a second aspect of an embodiment of the present invention, a device for managing cluster access rights is provided, comprising: a policy acquisition module, a permission change module, and a permission management module; wherein:

[0013] The policy acquisition module is used to acquire the access permission policy of the first cluster; the access permission policy includes access permission information between the first cluster and one or more second clusters associated with it;

[0014] The permission change module is configured to update the access permission information corresponding to the second cluster included in the access permission policy according to the change result of the resources of any associated second cluster when monitoring the change of the resources of the second cluster;

[0015] The management permission module is used to manage the access permission between the first cluster and the associated second cluster by using the updated access permission policy.

[0016] Optionally, the device for managing cluster access rights is further used to: upon detecting a change in the resources of the first cluster, update the access rights information corresponding to the first cluster contained in the access rights policy according to the change results of the first cluster resources; and use the updated access rights policy to manage the access rights between the first cluster and the associated second cluster.

[0017] Optionally, the device for managing cluster access rights is used to update the access right information corresponding to the second cluster contained in the access right policy, including: adding an annotation containing the cluster identifier of the second cluster to the access right information corresponding to the second cluster; indicating a resource change in the second cluster through the cluster identifier contained in the annotation; and when the first cluster accesses the second cluster, limiting the access rights of the first cluster to the second cluster through the access right policy combined with the annotation.

[0018] Optionally, the device for managing cluster access rights is used to obtain the access rights policy of the first cluster, including: obtaining configuration information of the first cluster; determining cluster information of one or more second clusters associated with the first cluster based on the configuration information; obtaining preset access rights information between the first cluster and one or more second clusters, and generating the access rights policy of the first cluster based on the preset access rights information.

[0019] Optionally, the device for managing cluster access rights is used to obtain preset access rights information between the first cluster and one or more second clusters, including: parsing the preset access rights information from a preset configuration file, and / or parsing the preset access rights information from custom permission data contained in the first cluster, wherein the custom permission data is obtained based on the expansion of cluster native permission data.

[0020] Optionally, the device for managing cluster access rights is further used for: the first cluster includes an access rights controller; and using the access rights controller to execute the steps of obtaining the access rights policy of the first cluster and updating the access rights policy.

[0021] Optionally, the device for managing cluster access rights is further used to: use the permission controller to start the first controller and the second controller for the first cluster to which it belongs; use the first controller to monitor resource changes of the first cluster; use the second controller to monitor resource changes of one or more second clusters associated with the first cluster.

[0022] To achieve the above object, according to a third aspect of an embodiment of the present invention, a device for managing cluster access rights is provided, comprising: a policy acquisition module, a permission change module, and a permission management module; wherein:

[0023] The policy acquisition module is used to acquire the access permission policy of the first cluster; the access permission policy includes access permission information between the first cluster and one or more second clusters associated with it;

[0024] The permission change module is configured to update the access permission information corresponding to the first cluster included in the access permission policy according to the change result of the first cluster resources when monitoring that the resources of the first cluster have been changed;

[0025] The management authority module is used to manage the access authority between the first cluster and the associated second cluster by using the updated access authority policy.

[0026] To achieve the above-mentioned purpose, according to the fourth aspect of an embodiment of the present invention, a system for managing cluster access rights is provided, characterized in that it includes: multiple communicatively connected clusters; wherein one or more of the clusters are configured with the device for managing cluster access rights as described in the second aspect or the device for managing cluster access rights as described in the third aspect.

[0027] To achieve the above-mentioned purpose, according to the fifth aspect of an embodiment of the present invention, an electronic device for managing cluster access rights is provided, characterized in that it includes: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement any method as described in the above-mentioned method for managing cluster access rights.

[0028] To achieve the above-mentioned purpose, according to a sixth aspect of an embodiment of the present invention, a computer-readable medium is provided, on which a computer program is stored, characterized in that when the program is executed by a processor, any method as described in the above-mentioned method for managing cluster access rights is implemented.

[0029] An embodiment of the above invention has the following advantages or beneficial effects: it can automatically obtain the access permission policy of the first cluster managed among multiple clusters; and obtain the access permission information between the first cluster and one or more associated second clusters contained in the access permission policy; when it is monitored that the resources of the one or more second clusters have changed, the access permission information contained in the access permission policy is automatically updated; and multiple clusters are dynamically managed using the updated access permission information. The method of the embodiment of the present invention overcomes the problem of poor flexibility in managing cluster access permissions in the existing method, and improves the real-time and efficiency of managing cluster access permissions.

[0030] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0032] Figure 1 It is a flowchart of a method for managing cluster access rights provided by an embodiment of the present invention;

[0033] Figure 2 is a schematic diagram of a managed cluster structure provided by an embodiment of the present invention;

[0034] Figure 3 It is a flowchart for managing cluster access rights provided by an embodiment of the present invention;

[0035] Figure 4 It is a structural diagram of a device for managing cluster access rights provided by an embodiment of the present invention;

[0036] Figure 5 It is a structural diagram of a system for managing cluster access rights provided by an embodiment of the present invention;

[0037] Figure 6 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0038] Figure 7 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0039] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0040] like Figure 1 As shown, an embodiment of the present invention provides a method for managing cluster access rights, which may include the following steps:

[0041] Step S101: Acquire the access permission policy of the first cluster; the access permission policy includes access permission information between the first cluster and one or more second clusters associated with the first cluster;

[0042] Specifically, in one embodiment of the present invention, the method for managing cluster access rights can be used for any cluster among the multiple clusters being managed. Figure 2 It shows multiple clusters with data interaction: cluster 1, cluster 2... cluster N; Figure 2 As shown, for cluster 1, cluster 1 has an association relationship with cluster 2, cluster 3, and cluster 4 (for example, data interaction or data synchronization, etc.); when the first cluster is cluster 1, cluster 2, cluster 3, and cluster 4 are multiple second clusters associated with cluster 1; similarly, for cluster 2, cluster 2 has an association relationship with cluster 1 and cluster 4, when the first cluster is cluster 2, cluster 1 and cluster 4 are multiple second clusters associated with cluster 2.

[0043] Furthermore, the access permission policy of the first cluster is obtained; wherein the access permission policy is a policy for interactive access permissions of node resources between multiple clusters. Taking the kubernetes cluster as an example, in a kubernetes cluster, each node pod has an independent IP address. According to the business scenario, pods between multiple kubernetes clusters can access each other to achieve data interaction. Usually, when data is interacted, for one cluster, it is often necessary to manage the access permissions of other clusters that are allowed (or prohibited) to access and / or allowed (or prohibited) to be accessed, that is, to set the access permission policy of the first cluster.

[0044] Further, obtaining the access permission policy of the first cluster includes: obtaining the configuration information of the first cluster; determining the cluster information of one or more second clusters associated with the first cluster according to the configuration information; obtaining the preset access permission information between the first cluster and one or more second clusters, and generating the access permission policy of the first cluster based on the preset access permission information. Wherein, the cluster information of each second cluster associated with the first cluster can be determined by obtaining the configuration information of the first cluster; for example, the first cluster is kubernetes cluster 1, and the configuration file kubeconfig of kubernetes cluster 1 itself is obtained, and the configuration files kubeconfig corresponding to multiple other clusters associated with kubernetes cluster 1 are obtained; for the first cluster, through its own configuration files and configuration files of other clusters, each second cluster associated with the first cluster can be parsed, for example, if kubernetes cluster 1 has communication connection and data interaction with kubernetes cluster 2 and kubernetes cluster 3, it is determined that the second clusters associated with the first cluster kubernetes cluster 1 include kubernetes cluster 2, kubernetes cluster 3, etc.; further, obtaining the preset access permission information between the first cluster and one or more second clusters, and generating the access permission policy of the first cluster based on the preset access permission information.Among them, the preset access permission information can be parsed from the configuration file configured by the R&D personnel for the first cluster; and / or parsed from the custom permission data of the first cluster; specifically, the access permission information can include: access direction: accessing other clusters or being accessed by other clusters (Ingress and / or Egress), the IP address segment allowed for access set for the access direction (including one or more port numbers associated with the IP address), or the IP address segment prohibited for access (including one or more port numbers associated with the IP address), the resource identifier allowed (or prohibited) for access (such as namespace identifier, node resource identifier, etc.), the communication protocol used for access, node type, node role, node whitelist, etc.; the preset configuration file can be a file containing various types of access permission information (for example, a text file, a database file, etc.); further, the custom permission data contained in the first cluster can be a file containing various types of access permission information (for example, a text file, a database file, etc.); further, the custom permission data contained in the first cluster can be a file containing various types of access permission information (for example, a text file, a database file, etc.); The custom permission data is obtained by extending the native permission data of the cluster; taking the kubernetes cluster as an example, the custom permission data can be obtained by extending the native NetworkPolicy configuration of the kubernetes cluster, for example: setting the custom permission data NewNpSpec of the CRD (CustomResourceDefinition) type, NewNpSpec is obtained by extending NpSpec, where NpSpec is the native permission data; the specific information of the native permission data is set in v1.NetworkPolicy, for example: you can set in v1.NetworkPolicy which IP+Port corresponding nodes one or more pods can access in the Egress direction, or which IP+Port corresponding nodes can be accessed in the Ingress direction. Among them, the data example of NewNpSpec extending NpSpec is as follows:.

[0045] type NewNpSpec struct{ / / NewNpSpec represents custom permission data

[0046] ClusterList[]string`json:"clusterlist…"` / / ClusterList represents a list of multiple clusters. The specific list data can be obtained from the data in json format;

[0047] NpSpec v1.NetworkPolicy`json:"npspec..."` / / NpSpec represents native permission data. Specific permission data can be obtained from the data in json format.}

[0048] That is, obtaining the preset access permission information between the first cluster and one or more of the second clusters includes: parsing the preset access permission information from a preset configuration file, and / or parsing the preset access permission information from custom permission data contained in the first cluster, wherein the custom permission data is obtained based on the expansion of cluster native permission data.

[0049] Further, the access permission policy of the first cluster is generated based on the preset access permission information. It can be understood that the access permission policy includes specific access permission information.

[0050] Step S102: when it is monitored that a change occurs to a resource of any associated second cluster, the access permission information corresponding to the second cluster included in the access permission policy is updated according to the change result of the resource of the second cluster.

[0051] Specifically, the controller (e.g., controller1) included in the first cluster can be used to monitor whether the resources of one or more second clusters related to the first cluster have changed according to the set rules (e.g., set time intervals, business triggers, etc.), where the resource changes are, for example, node resource addition, node resource update, node resource deletion, namespace resource change, etc. In the case of determining that a change has occurred, the access permission information related to the change result is updated according to the change result, that is, the access permission information corresponding to the second cluster contained in the relevant access permission policy is updated; for example, cluster 1 monitors that cluster 2 deletes node 1, and node 1 is a node that cluster 1 prohibits access to in the access permission information, then the access permission information can be updated accordingly (e.g., the access permission information for node 1 is deleted). Taking the kubernetes cluster as an example, after monitoring the resource changes of any one or more second clusters, the ipBlock field (IP address segment contained in the access permission information) of Ingress and Egress (access direction) in the NetworkPolicy associated with the first cluster can be dynamically screened and updated according to the access permission information defined in the custom permission data, so as to achieve the technical effect of updating the access permission information corresponding to the second cluster contained in the access permission policy.

[0052] Furthermore, the first cluster monitors changes in resources of any associated second cluster, and / or monitors changes in its own resources, that is, the first cluster monitors changes in various resources (e.g., namespace resources, node resources, etc.) contained in itself. Specifically, the controller (e.g., controller2) contained in the first cluster can be used to monitor changes in resources related to the first cluster according to set rules (e.g., set time intervals, business triggers, etc.). When a change is determined, the access permission information related to the change result is updated according to the change result, and the updated access permission policy is used to manage the access permission between the first cluster and the associated second cluster. That is, when a change is monitored in the resources of the first cluster, the access permission information corresponding to the first cluster contained in the access permission policy is updated according to the change result of the resources of the first cluster; the access permission between the first cluster and the associated second cluster is managed using the updated access permission policy.

[0053] Further preferably, updating the access permission information corresponding to the second cluster contained in the access permission policy includes: adding an annotation containing the cluster identifier of the second cluster to the access permission information corresponding to the second cluster; indicating the situation that the second cluster has a resource change through the cluster identifier contained in the annotation, so that when the first cluster accesses the second cluster, the access permission of the first cluster to access the second cluster is limited by the access permission policy combined with the annotation. Specifically, when updating the access permission information corresponding to the second cluster contained in the access permission policy for the first cluster, an annotation can be added to identify the second cluster where the resource change has occurred, or the cluster itself; wherein, for example, the second cluster is cluster 2, and the cluster identifier is "cluster2", then an annotation in the key-value format for "cluster2" can be added, such as key newnpfrom, value cluster2; similarly, when it is necessary to update the access permission information contained in the access permission policy for the resource change of the first cluster itself, an annotation in the key-value format can be added, such as key newnpfrom, value is the cluster identifier of the first cluster, such as cluster1. It can be understood that by combining the access permission policy with the added annotations, a historical record of updating the access permission policy of the first cluster due to resource changes in the first cluster and any cluster in one or more second clusters associated with the first cluster can be obtained, thereby improving the accuracy and efficiency of managing access permission policies.

[0054] Step S103: using the updated access permission policy to manage the access permission between the first cluster and the associated second cluster.

[0055] Specifically, the first cluster uses the access permission policy to manage the access permissions between the first cluster and the associated second cluster. For example, taking the kubernete cluster as an example, you can set which IP+Port corresponding nodes can be accessed by one or more pod nodes in the Egress direction (i.e., access permissions), or which IP+Port corresponding nodes can be accessed in the Ingress direction (i.e., access permissions). Furthermore, the first cluster can interact with the business server apiserver contained in the cluster through the access permission policy, and access the corresponding data layer through network plug-ins (such as calico, kube-router, cilium, etc.) to achieve access permission management.

[0056] like Figure 3 As shown, an embodiment of the present invention provides a method for managing cluster access rights, which may include the following steps:

[0057] Step S301: The authority controller corresponding to the cluster is initialized to obtain configuration information.

[0058] Specifically, the first cluster includes a permission controller, and it can be understood that each of the multiple clusters managed by the embodiment of the method of the present invention includes a permission controller. That is, the first cluster includes a permission controller; the permission controller is used to perform the steps of obtaining the access permission policy of the first cluster and updating the access permission policy.

[0059] Furthermore, an authority controller npcontroller may be installed and deployed for each cluster; the authority controller npcontroller may run in any node server of the cluster to which it belongs; or may run in a server independent of each cluster.

[0060] Preferably, npcontroller can be used to obtain configuration information of the first cluster during the initialization phase. The configuration information includes, for example, a first cluster configuration file (such as the kubeconfig file of the first cluster) and second cluster configuration files (such as the kubeconfig file of the second cluster) of other managed clusters (including one or more second clusters). At the same time, the authority controller is also used to interact with the apiservers of multiple clusters.

[0061] Furthermore, the permission controller npcontroller can be used to execute the step of updating the access policy when it is detected that the resources of any second cluster are changed.

[0062] Step S302: Use the first controller to monitor resource changes of the first cluster. Specifically, use the authority controller to start the first controller and the second controller for the first cluster to which it belongs.

[0063] Step S303: using the second controller to monitor resource changes of one or more of the second clusters associated with the first cluster.

[0064] That is, the authority controller is used to start the first controller and the second controller for the first cluster to which it belongs; the first controller is used to monitor resource changes of the first cluster; and the second controller is used to monitor resource changes of one or more second clusters associated with the first cluster.

[0065] The order of step S302 and step S303 is only an example, and the order of the operations of step S302 and step S303 can be any one step first, or they can be performed simultaneously.

[0066] Step S304: according to the change result of the resources of the second cluster, update the access permission information corresponding to the second cluster included in the access permission policy.

[0067] That is, the permission controller is used to execute the steps of obtaining the access permission policy of the first cluster and updating the access permission policy after monitoring the resource change of the second cluster.

[0068] The data layer can use plug-ins (for example, calico, kube-router, cilium and other plug-ins) to dynamically monitor npcontroller's changes to the NetworkPolicy resources of this cluster (i.e., the first cluster), and automatically issue corresponding data layer rules to manage cluster access rights from the data level according to the data layer rules.

[0069] like Figure 4 As shown, an embodiment of the present invention provides a device 400 for managing cluster access rights, including: a policy acquisition module 401, a permission change module 402, and a permission management module 403; wherein,

[0070] The policy acquisition module 401 is used to acquire the access permission policy of the first cluster; the access permission policy includes access permission information between the first cluster and one or more second clusters associated with it;

[0071] The permission change module 402 is used to update the access permission information corresponding to the second cluster included in the access permission policy according to the change result of the resources of any associated second cluster when monitoring the change of the resources of the second cluster;

[0072] The management permission module 403 is used to manage the access permission between the first cluster and the associated second cluster by using the updated access permission policy.

[0073] Optionally, when the permission change module 402 detects a change in the resources of the first cluster, the permission change module 402 updates the access permission information corresponding to the first cluster contained in the access permission policy according to the change result of the resources of the first cluster; the management permission module 403 uses the updated access permission policy to manage the access permissions between the first cluster and the associated second cluster.

[0074] like Figure 5 As shown, an embodiment of the present invention provides a system 500 for managing cluster access rights, comprising: a plurality of clusters connected by communication; wherein one or more of the clusters is configured with a device 400 for managing cluster access rights;

[0075] Among them, the change permission module 402 included in the device for managing cluster access rights 400 is used to update the access permission information corresponding to the second cluster contained in the access permission policy according to the change result of the resources of any associated second cluster when a change is detected in the resources of the second cluster; or to update the access permission information corresponding to the first cluster contained in the access permission policy according to the change result of the resources of the first cluster when a change is detected in the resources of the first cluster.

[0076] An embodiment of the present invention also provides an electronic device for managing cluster access rights, including: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the method provided in any of the above embodiments.

[0077] An embodiment of the present invention further provides a computer-readable medium on which a computer program is stored. When the program is executed by a processor, the method provided in any of the above embodiments is implemented.

[0078] Figure 6 An exemplary system architecture 600 is shown to which the method for managing cluster access rights or the apparatus for managing cluster access rights according to the embodiments of the present invention can be applied.

[0079] like Figure 6As shown, system architecture 600 may include terminal devices 601, 602, 603, network 604 and server 605. Network 604 is used to provide a medium for communication links between terminal devices 601, 602, 603 and server 605. Network 604 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0080] Users can use terminal devices 601, 602, 603 to interact with server 605 through network 604 to receive or send messages, etc. Various client applications can be installed on terminal devices 601, 602, 603, such as electronic shopping mall client applications, web browser applications, search applications, instant messaging tools, and email clients.

[0081] The terminal devices 601 , 602 , and 603 may be various electronic devices having a display screen and supporting various client applications, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0082] The server 605 may be a server that provides various services, such as a background management server that provides support for client applications used by users using terminal devices 601, 602, and 603. The cluster may include one or more servers 605; the background management server may process received service requests and feed back service data to the terminal device.

[0083] It should be noted that the method for managing cluster access rights provided in the embodiment of the present invention is generally executed by the server 605 , and accordingly, the device for managing cluster access rights is generally disposed in the server 605 .

[0084] It should be understood that Figure 6 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0085] Reference below Figure 7 , which shows a schematic diagram of the structure of a computer system 700 of a terminal device suitable for implementing an embodiment of the present invention. Figure 7 The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0086] like Figure 7As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the system 700 are also stored. The CPU 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0087] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, a mouse, etc.; an output section 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage section 708 as needed.

[0088] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the central processing unit (CPU) 701, the above-mentioned functions defined in the system of the present invention are executed.

[0089] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0090] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0091] The modules and / or units involved in the embodiments of the present invention may be implemented in software or hardware. The modules and / or units described may also be provided in a processor. For example, they may be described as follows: a processor includes a policy acquisition module, a permission change module, and a permission management module. The names of these modules do not, in some cases, constitute limitations on the modules themselves. For example, the policy acquisition module may also be described as a "module for acquiring access rights policy for the first cluster."

[0092] As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device includes: obtaining the access permission policy of the first cluster; the access permission policy includes access permission information between the first cluster and one or more second clusters associated with it; when a change is detected in the resources of any associated second cluster, the access permission information corresponding to the second cluster included in the access permission policy is updated according to the change result of the resources of the second cluster; and the access permission between the first cluster and the associated second cluster is managed using the updated access permission policy.

[0093] The embodiments of the present invention can automatically obtain the access permission policy of the first cluster managed among multiple clusters; and obtain the access permission information between the first cluster and one or more associated second clusters contained in the access permission policy; and automatically update the access permission information contained in the access permission policy when changes are detected in the resources of the one or more second clusters; and dynamically manage multiple clusters using the updated access permission information. The method of the embodiments of the present invention overcomes the problem of poor flexibility in managing cluster access permissions in the existing methods, and improves the real-time and efficiency of managing cluster access permissions.

[0094] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for managing cluster access rights, characterized in that: include: Get the access permission policy of the first cluster; The access permission policy includes access permission information between the first cluster and one or more second clusters associated with it; wherein the access permission policy is a policy for interactive access permission of node resources between multiple clusters; When a change is detected in resources of any associated second cluster, updating the access permission information corresponding to the second cluster included in the access permission policy according to the change result of the resources of the second cluster; The updated access permission policy is used to manage the access permission between the first cluster and the associated second cluster.

2. The method according to claim 1, characterized in that Further including: When a change is detected in resources of the first cluster, updating the access permission information corresponding to the first cluster included in the access permission policy according to the change result of the resources of the first cluster; The updated access permission policy is used to manage the access permission between the first cluster and the associated second cluster.

3. The method according to claim 1, characterized in that Updating the access permission information corresponding to the second cluster included in the access permission policy includes: An annotation including the cluster identifier of the second cluster is added to the access permission information corresponding to the second cluster; the cluster identifier included in the annotation is used to indicate a resource change in the second cluster; and when the first cluster accesses the second cluster, the access permission of the first cluster to access the second cluster is limited by combining the access permission policy with the annotation.

4. The method according to claim 1, characterized in that: Get the access permission policy of the first cluster, including: Acquire configuration information of the first cluster; and determine cluster information of one or more second clusters associated with the first cluster according to the configuration information; The preset access permission information between the first cluster and one or more of the second clusters is obtained, and the access permission policy of the first cluster is generated based on the preset access permission information.

5. The method according to claim 4, characterized in that Acquiring preset access permission information between the first cluster and one or more of the second clusters includes: Parsing the preset access permission information from a preset configuration file, and / or, The preset access permission information is parsed from the custom permission data included in the first cluster, wherein the custom permission data is obtained by expanding the native permission data of the cluster.

6. The method according to claim 1, characterized in that Further including: The first cluster includes an authority controller; The permission controller is used to execute the steps of obtaining the access permission policy of the first cluster and updating the access permission policy.

7. The method according to claim 6, characterized in that Further including: Using the authority controller to start a first controller and a second controller for the first cluster to which the authority controller belongs; Using the first controller to monitor resource changes of the first cluster; The second controller is used to monitor resource changes of one or more second clusters associated with the first cluster.

8. A device for managing cluster access rights, characterized in that: include: Get policy module, change authority module and management authority module; among them, The acquisition policy module is used to acquire the access permission policy of the first cluster; the access permission policy includes access permission information between the first cluster and one or more second clusters associated with it; wherein the access permission policy is a policy for interactive access permission of node resources between multiple clusters; The permission change module is configured to update the access permission information corresponding to the second cluster included in the access permission policy according to the change result of the resources of any associated second cluster when monitoring the change of the resources of the second cluster; The management permission module is used to manage the access permission between the first cluster and the associated second cluster by using the updated access permission policy.

9. The device according to claim 8, characterized in that Further including: When the permission change module monitors that the resources of the first cluster are changed, the permission change module updates the access permission information corresponding to the first cluster included in the access permission policy according to the change result of the resources of the first cluster; The access rights between the first cluster and the associated second cluster are managed by the management permission module using the updated access permission policy.

10. A system for managing cluster access rights, characterized in that: include: A plurality of communicatively connected clusters; wherein one or more of the clusters is configured with the device for managing cluster access rights as claimed in claim 8 or the device for managing cluster access rights as claimed in claim 9.

11. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 7.

12. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images