A single-container certificate management method, device, storage medium and electronic equipment

Abstract

The application belongs to the technical field of Kubernetes container cloud, and particularly relates to a single container certificate management method, device, storage medium and electronic equipment. The method comprises the following steps: kube-apiserver judges whether a Pod needs to be configured with a certificate according to a label of the Pod, and adds an init container for the Pod if the Pod needs to be configured with the certificate; a certificate creation recycling service creates a certificate signing request containing an IP of the Pod for the Pod, and saves the certificate signing request to a Secret created for the Pod; a certificate signing service signs a certificate of the Pod according to the certificate signing request, and saves the signed certificate to the Secret; the init container downloads the signed certificate to a specified directory of the Pod after listening to the certificate signing of the Pod, and the init container ends and exits; and a business container starts using the signed certificate from the specified directory. The application proposes an architecture idea for managing certificates for a single Pod, strengthens the security of container communication in a cluster, and completely automates and dynamizes certificate management.

Description

Technical Field

[0001] This invention belongs to the field of Kubernetes container cloud technology, specifically relating to a method, device, storage medium, and electronic device for managing single container certificates. Background Technology

[0002] Kubernetes is a container orchestration tool that supports various types of workloads, such as Deployments and DaemonSets. Several Pods managed by the same workload share the workload's configuration, so these Pods are mostly equivalent.

[0003] Kubernetes provides a watch mechanism, through which programs can listen for write operations (such as create, update, and delete) on specific objects of a certain type of resource. When a write operation occurs on a specific object of that type of resource, the listener (usually called a controller) will receive an event for that resource object. Based on this event, the listener can perform some custom operations. For example, kube-controller-manager is a collection of multiple controllers. When it detects that a Deployment object has been created, it will create the specified number of Pod objects contained in the Deployment object.

[0004] Kubernetes supports two types of webhooks: validating-webhooks and mutating-webhooks. A mutating-webhook can be a user-defined service. When the kube-apiserver receives a request to create a resource object (such as a Pod), if the resource object's annotations or tags match the definition of a mutating-webhook, the kube-apiserver will invoke the corresponding mutating-webhook service. The mutating-webhook service can modify (mutate) the resource object's YAML orchestration file, such as adding, deleting, updating, or querying content, and then return the modified content to the kube-apiserver. Finally, the kube-apiserver persists this resource object's orchestration file to etcd.

[0005] Currently, Kubernetes itself can manage certificates for its components (such as kube-apiserver); the open-source cert-manager can manage certificates on an application-by-application basis, meaning that when a group of Pods are exposed externally through Ingress, cert-manager can create and sign certificates for the Ingress object. However, there is currently no technical solution for managing certificates for a single Pod container.

[0006] For example, Chinese invention patent CN112511504A discloses a Kubernetes Pod communication encryption method. This method is applicable to Kubernetes-based container platforms. It involves adding an HAProxy container to the application's Pod and using the HAProxy container to encrypt the application's communication. This invention uses the HAProxy container to encrypt communication between Pods in a Kubernetes-based container cloud platform. During communication, authentication is performed using digital certificates, preventing unauthorized personnel from passing the security authentication, thereby improving network security. This invention is a unified, flexible, and universal Kubernetes Pod communication encryption method applicable to all Pods in a Kubernetes-based container platform. It is evident that it still does not create certificates for individual Pods.

[0007] However, in some real-world scenarios, we must configure certificates for individual Pods. For example, when deploying a monitoring system on Kubernetes, we typically run NodeExporter as Daemoset, and then Prometheus collects data from the NodeExporter container on each node. To prevent other programs from accessing sensitive monitoring data from NodeExporter, we usually need to configure it with basic authentication and HTTPS. Therefore, we need to configure a certificate for each NodeExporter container. Summary of the Invention

[0008] To address the aforementioned problems in existing technologies, this invention provides a method, apparatus, storage medium, and electronic device for managing single container certificates. It proposes an architectural approach for managing certificates for a single Pod, enhances the security of communication between containers within a cluster, and enables fully automated and dynamic certificate management.

[0009] The present invention adopts the following technical solution:

[0010] The first aspect of this invention provides a method for managing a single container certificate, comprising the steps of:

[0011] The kube-apiserver determines whether a Pod needs to be configured with a certificate based on its tag. If so, it adds an init container for the Pod.

[0012] The certificate creation and recycling service creates a certificate signing request for the Pod containing the Pod's IP address and saves the certificate signing request to the Secret created for the Pod.

[0013] The certificate signing service signs the certificate for the Pod based on the certificate signing request and saves the signed certificate to the Secret.

[0014] After the init container detects the certificate signature of the Pod, it downloads the signed certificate to the specified directory of the Pod, and then the init container ends and exits.

[0015] The business container starts using the signed certificate from the specified directory.

[0016] As a preferred option, the Pod's label is added to its orchestration file when the Pod is created.

[0017] As a preferred option, the specified directory is specified in the Pod's tag.

[0018] As a preferred embodiment, the certificate creation and recycling service also creates a private key for the Pod and saves the private key to the Secret created for the Pod.

[0019] As a preferred solution, when a Pod is deleted, the certificate creation and recycling service deletes the Secret corresponding to that Pod.

[0020] A second aspect of the present invention provides a single container certificate management device, including an init container adding module, a certificate creation and recycling module, and a certificate signing module connected in sequence, and also includes a directory module and a business container module connected in sequence, wherein the directory module is connected to the init container adding module;

[0021] The init container adds a module to determine whether a Pod needs to be configured with a certificate based on its tag. If so, it adds an init container to the Pod.

[0022] The certificate creation and recycling module is used to create a certificate signing request for a Pod that contains the Pod's IP address, and save the certificate signing request to the Secret created for the Pod.

[0023] The certificate signing module is used to sign the certificate of the Pod according to the certificate signing request, and save the signed certificate to the Secret corresponding to the Pod.

[0024] After signing the certificate corresponding to the Pod, the init container downloads the signed certificate to the specified directory corresponding to the Pod and then exits.

[0025] The directory module is used to store signed certificates in a specified directory;

[0026] The business container module is used to start the application from a specified directory using a signed certificate.

[0027] As a preferred embodiment, the device also includes a Pod creation module that is connected to the init container addition module and the certificate creation and recycling module respectively;

[0028] The Pod creation module is used to create Pods and add tags and specify directories in the Pod's orchestration file.

[0029] As a preferred option, the certificate creation and recycling module includes a first listening unit, which is used to listen for Pod creation events;

[0030] When a Pod is created, the certificate creation and recycling module creates a certificate signing request for that Pod, which includes the Pod's IP address, and saves the certificate signing request to the Secret created for that Pod.

[0031] As a preferred option, the first listening unit is also used to listen for Pod deletion events;

[0032] The certificate creation and recycling module deletes the Secret associated with a Pod when it is deleted.

[0033] As a preferred option, the init container includes a second listening unit, which is used to monitor whether the certificate has been signed.

[0034] A third aspect of the present invention provides a computer-readable storage medium storing computer instructions for causing the computer to perform a single container certificate management method as described in the first aspect and any one of the first aspects of the present invention.

[0035] A fourth aspect of the present invention provides an electronic device, including: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform a single container certificate management method as described in the first aspect and any one of the first aspects of the present invention.

[0036] The beneficial effects of this invention are:

[0037] 1. Propose an architectural approach for managing certificates for individual Pods, enhance the security of communication between containers within the cluster, and fully automate and dynamically manage certificates.

[0038] 2. Resolved the issue of requiring different domain names for certificates when multiple containers have different IPs under the same workload.

[0039] 3. The issue of needing to replace the certificate due to IP changes after the container restarts automatically.

[0040] 4. It is non-intrusive to containers, and business containers do not need to be modified or adapted. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 This is a flowchart of a single container certificate management method according to an embodiment of the present invention;

[0043] Figure 2 This is a structural block diagram of a single container certificate management device according to an embodiment of the present invention;

[0044] Figure 3 This is a schematic diagram of the structure of a computer-readable storage medium provided according to an embodiment of the present invention;

[0045] Figure 4 This is a schematic diagram of the structure of an electronic device provided according to an embodiment of the present invention. Detailed Implementation

[0046] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that, unless otherwise specified, the following embodiments and features described therein can be combined with each other.

[0047] Example 1:

[0048] The complexity of managing certificates for a single Pod lies in the following: (1) the domain name of the Pod certificate must contain the IP address of the Pod in order to enable secure access via HTTPS plus the Pod's IP address; (2) the Pod's IP address is only assigned after the Pod is created; and (3) each Pod has a different IP address. Based on these factors, we cannot statically configure a certificate for a Pod before it is created.

[0049] Based on the above difficulties, referring to Figure 1 As shown, this embodiment provides a method for managing a single container certificate, including the following steps:

[0050] First, create a Kubernetes cluster and deploy the "injection service" within it as a mutating-webhook. Then, deploy the "certificate creation and deletion service" and "certificate signing service" as containers within the cluster. Store ca.key and ca.crt in a secret within the cluster and mount them to the "certificate signing service" container.

[0051] Users create workloads or Pods using kubectl and add specific annotations or tags to the Pod's YAML orchestration file.

[0052] The Pod orchestration file should include the following annotation, indicating that the Pod should be configured with a certificate and in which directory of the container the signed certificate should be mounted:

[0053] apiVersion: v1

[0054] kind: Pod

[0055] metadata:

[0056] annotations:

[0057] configure-tls: true

[0058] cert-dir: / etc / pki

[0059] name: node-exporter

[0060] spec:

[0061] containers:

[0062] - name: node-exporter

[0063] Image: node-exporter:v1.0.0

[0064] The kube-apiserver determines whether a Pod needs certificate configuration based on its annotations or tags. If so, it calls the injection service to add an init container to the Pod. The injection service is a service that runs as a Kubernetes mutating-webhook and is responsible for injecting the init container into Pods that need certificate configuration. Before the Pod's orchestration file is actually written to Etcd, the kube-apiserver calls this service to inject the init container into the Pod.

[0065] The injection service will inject the init container into the orchestration file of the modified Pod:

[0066] apiVersion: v1

[0067] kind: Pod

[0068] metadata:

[0069] annotations:

[0070] configure-tls: true

[0071] cert-dir: / etc / pki

[0072] name: node-exporter

[0073] spec:

[0074] volumes:

[0075] - name: cert-dir

[0076] emptyDir: {}

[0077] initContainers:

[0078] - name: init

[0079] image: init:v1.0.0

[0080] volumeMounts:

[0081] name: cert-dir

[0082] mountPath: / etc / pki

[0083] containers:

[0084] - name: node-exporter

[0085] Image: node-exporter:v1.0.0

[0086] volumeMounts:

[0087] name: cert-dir

[0088] mountPath: / etc / pki

[0089] Upon receiving the injection service response, kube-apiserver persists the final YAML file of the Pod to etcd.

[0090] The certificate creation and recycling service (a controller responsible for listening for the creation and deletion events of Pods that require certificate configuration) listens for the creation event of such Pods. Upon detecting the creation event, it creates a certificate signing request for the Pod containing the Pod's IP address, which is included in the domain name of the certificate signing request file. The certificate signing request is then saved to the `server.csr` field of the Secret (a resource type used for data storage in Kubernetes) created for the Pod, named `PodIP`. The certificate creation and recycling service also creates a private key for the Pod upon detecting its creation event and saves it to the `server.csr` field of the Secret.

[0091] The certificate signing service listens for the creation event of the signing request, then uses the CA to sign the certificate for the Pod according to the certificate signing request, and saves the signed certificate to the server.crt field of Secret.

[0092] After the init container detects the certificate signature of the Pod, it downloads the signed certificate to the specified directory of the Pod. The init container then exits. The specified directory of the Pod is specified in the annotation or tag of the Pod orchestration file.

[0093] After the init container finishes running, the business container starts using the signed certificate from the specified directory.

[0094] When a Pod is deleted, the certificate creation and recycling service listens for the Pod deletion event and deletes the secret (i.e., certificate) corresponding to that Pod.

[0095] This invention provides an architectural approach for managing certificates for a single Pod, enhancing the security of communication between containers within a cluster, and fully automating and dynamically managing certificates. It solves the problem of multiple containers with different IPs requiring different domain names for the same workload. It automatically adapts to the issue of needing to replace certificates due to IP changes after a container restart. Furthermore, it is non-intrusive to containers, requiring no modifications or adaptations to business containers.

[0096] Example 2:

[0097] Reference Figure 2 As shown, this embodiment provides a single container certificate management device, including an init container adding module, a certificate creation and revocation module, and a certificate signing module connected in sequence, and also includes a directory module and a business container module connected in sequence, with the directory module connected to the init container adding module;

[0098] The init container adds a module to determine whether a Pod needs to be configured with a certificate based on its tag. If so, it adds an init container to the Pod.

[0099] The certificate creation and recycling module is used to create a certificate signing request for a Pod that contains the Pod's IP address, and save the certificate signing request to the Secret created for the Pod.

[0100] The certificate signing module is used to sign the certificate of the Pod according to the certificate signing request, and save the signed certificate to the Secret corresponding to the Pod.

[0101] After signing the certificate corresponding to the Pod, the init container downloads the signed certificate to the specified directory corresponding to the Pod and then exits.

[0102] The directory module is used to store signed certificates in a specified directory;

[0103] The business container module is used to start the application from a specified directory using a signed certificate.

[0104] Specifically:

[0105] The device also includes a Pod creation module that is connected to the init container addition module and the certificate creation and recycling module, respectively;

[0106] The Pod creation module is used to create Pods and add tags and specify directories in the Pod's orchestration file.

[0107] The certificate creation and recycling module includes a first listening unit, which is used to listen for Pod creation events;

[0108] When a Pod is created, the certificate creation and recycling module creates a certificate signing request for that Pod, which includes the Pod's IP address, and saves the certificate signing request to the Secret created for that Pod.

[0109] The first listening unit is also used to listen for Pod deletion events;

[0110] The certificate creation and recycling module deletes the Secret associated with a Pod when it is deleted.

[0111] The init container includes a second listening unit, which is used to monitor whether the certificate has been signed.

[0112] It should be noted that the single container certificate management device provided in this embodiment is similar to that in Embodiment 1, and will not be described in detail here.

[0113] Example 3:

[0114] Reference Figure 3 As shown, this embodiment of the invention also provides a storage medium storing a computer program 601. When executed by a processor, this program implements the steps of a single container certificate management method described in the above embodiments. Those skilled in the art will understand that all or part of the processes in the methods described in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in Embodiment 1 above.

[0115] The storage medium may be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium may also include combinations of the above types of memory.

[0116] Example 4:

[0117] Reference Figure 4 As shown, this embodiment of the invention also provides an electronic device, which may include a processor 51 and a memory 52, wherein the processor 51 and the memory 52 can be connected via a bus or other means. Figure 4 Taking the example of a connection between China and Israel via a bus.

[0118] Processor 51 can be a central processing unit (CPU). Processor 51 can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0119] The memory 52, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the corresponding program instructions / modules in the embodiments of the present invention. The processor 51 executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions, and modules stored in the memory 52, thereby implementing a single container certificate management method in the first embodiment described above.

[0120] The memory 52 may include a program storage area and a data storage area. The program storage area may store applications required for operating the device and at least one function; the data storage area may store data created by the processor 51, etc. Furthermore, the memory 52 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 52 may optionally include memory remotely located relative to the processor 51, and these remote memories may be connected to the processor 51 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0121] The one or more modules are stored in the memory 52, and when executed by the processor 51, they perform a single container certificate management method as described in Embodiment 1.

[0122] The specific details of the above-mentioned electronic device can be understood by referring to the relevant descriptions and effects in Embodiment 1, and will not be repeated here.

[0123] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made by those skilled in the art to the technical solutions of the present invention without departing from the spirit of the present invention should fall within the protection scope of the present invention.

Claims

1. A method for managing a single container certificate, characterized in that, Including the following steps: The kube-apiserver determines whether a Pod needs to be configured with a certificate based on its tag. If so, it adds an init container for the Pod. The certificate creation and recycling service creates a certificate signing request for the Pod containing the Pod's IP address and saves the certificate signing request to the Secret created for the Pod. The certificate signing service signs the certificate for the Pod based on the certificate signing request and saves the signed certificate to the Secret. After the init container detects the certificate signature of the Pod, it downloads the signed certificate to the specified directory of the Pod, and then the init container ends and exits. The business container starts using the signed certificate from the specified directory.

2. The method for managing a single container certificate according to claim 1, characterized in that, The Pod's label is added to its orchestration file when the Pod is created.

3. The method for managing a single container certificate according to claim 2, characterized in that, The specified directory is specified in the Pod's tag.

4. The method for managing a single container certificate according to claim 1, characterized in that, The certificate creation and recycling service also creates a private key for the Pod and saves the private key to the Secret created for the Pod.

5. The method for managing a single container certificate according to claim 1, characterized in that, When a Pod is deleted, the Certificate Creation and Recycling Service deletes the Secret associated with that Pod.

6. A single container certificate management device, characterized in that, It includes the init container addition module, certificate creation and recycling module, and certificate signing module connected in sequence, as well as the connected directory module and business container module. The directory module is connected to the init container addition module. The init container adds a module to determine whether a Pod needs to be configured with a certificate based on its tag. If so, it adds an init container to the Pod. The certificate creation and recycling module is used to create a certificate signing request for a Pod that contains the Pod's IP address, and save the certificate signing request to the Secret created for the Pod. The certificate signing module is used to sign the certificate of the Pod according to the certificate signing request, and save the signed certificate to the Secret corresponding to the Pod. After signing the certificate corresponding to the Pod, the init container downloads the signed certificate to the specified directory corresponding to the Pod and then exits. The directory module is used to store signed certificates in a specified directory; The business container module is used to start the application from a specified directory using a signed certificate.

7. A single container certificate management device according to claim 6, characterized in that, The device also includes a Pod creation module that is connected to the init container addition module and the certificate creation and recycling module, respectively; The Pod creation module is used to create Pods and add tags and specify directories in the Pod's orchestration file.

8. A single container certificate management device according to claim 7, characterized in that, The certificate creation and recycling module includes a first listening unit, which is used to listen for Pod creation events; When a Pod is created, the certificate creation and recycling module creates a certificate signing request for that Pod, which includes the Pod's IP address, and saves the certificate signing request to the Secret created for that Pod.

9. A single container certificate management device according to claim 8, characterized in that, The first listening unit is also used to listen for Pod deletion events; The certificate creation and recycling module deletes the Secret associated with a Pod when it is deleted.

10. A single container certificate management device according to claim 6, characterized in that, The init container includes a second listening unit, which is used to monitor whether the certificate has been signed.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to perform a single container certificate management method as described in any one of claims 1-5.

12. An electronic device, characterized in that, include: A memory and a processor are communicatively connected, the memory storing computer instructions, and the processor executing the computer instructions to perform a single container certificate management method as described in any one of claims 1-5.

Images