Automatic key management methods, devices, electronic equipment and storage media

Abstract

This invention provides an automatic key management method, apparatus, electronic device, and storage medium. The method includes: upon receiving a distributed storage system cluster deployment instruction, invoking a distributed storage orchestration system to deploy the distributed storage system cluster; invoking a key manager, which, when the deployment progress of the distributed storage system cluster reaches a specified stage, obtains key generation information and generates a first user key based on the key generation information; the key generation information is the information required to generate the first user key; and storing the first user key in a container orchestration platform. This reduces the workload of administrators, lowers labor costs, improves the efficiency of key generation and storage, and thus improves overall deployment and management efficiency.

Description

Technical Field

[0001] This invention relates to the fields of cloud computing storage and key technology, and in particular to an automatic key management method, device, electronic device and storage medium. Background Technology

[0002] Distributed storage systems offer advantages such as high performance, high availability, and high scalability, and have gained support from numerous cloud computing vendors and are widely used. After deploying a distributed storage system cluster, to prevent data tampering during network transmission, the distributed storage system uses an encryption authentication protocol for identity verification. This verification method utilizes the distributed storage system's key for authentication.

[0003] Distributed storage system keys can include keys used for interactions between distributed storage systems, administrator keys between the control node and the administrator, and user keys between the control node and users. Regarding user keys, in existing technologies, configuration requires the administrator to manually generate user keys for client users after deploying the distributed storage system cluster. These user keys are then imported into the container orchestration platform using a markup language such as YAML, where the platform stores them. However, this manual key generation and storage method is costly and inefficient. Summary of the Invention

[0004] In view of the above problems, a method, apparatus, electronic device and storage medium for automatic key management is provided to overcome the above problems or at least partially solve the above problems.

[0005] To address the above problems, this invention discloses an automatic key management method, the method comprising:

[0006] Upon receiving a deployment instruction for a distributed storage system cluster, the distributed storage orchestration system is invoked, and the distributed storage orchestration system deploys the distributed storage system cluster.

[0007] The key manager is invoked, and when the deployment progress of the distributed storage system cluster reaches a specified progress, the key manager obtains key generation information and generates a first user key based on the key generation information; the key generation information is the information required to generate the first user key.

[0008] Store the first user key in the container orchestration platform.

[0009] Optionally, the specified progress refers to the completion of startup of the control node in the distributed storage system cluster;

[0010] The step of obtaining key generation information by the key manager when the deployment progress of the distributed storage system cluster reaches a specified progress includes:

[0011] The key manager polls a designated tool in the distributed storage orchestration system to detect whether a management IP address exists in the designated tool; the management IP address is the IP address of the control node, which is sent to the designated tool by the control node after startup is complete;

[0012] If a management IP address exists in the specified tool, obtain the key generation information.

[0013] Optionally, if a management IP address exists in the designated tool, obtaining the key generation information includes:

[0014] If a management IP address exists in the specified tool, obtain the management IP address from the specified tool, and obtain the storage pool name of the distributed storage system cluster, the user information of the first user, and the administrator key from the distributed storage orchestration system.

[0015] Optionally, the specified progress refers to the completion of deployment of the distributed storage system cluster;

[0016] The step of obtaining key generation information by the key manager when the deployment progress of the distributed storage system cluster reaches a specified progress includes:

[0017] When the key manager detects that the distributed storage system cluster has been deployed, it retrieves the first configuration file from a specified location to obtain the key generation information.

[0018] The first configuration file is pre-generated and stored in the specified location.

[0019] Optionally, the method further includes:

[0020] The administrator key is obtained from the distributed storage orchestration system, and the storage pool name of the distributed storage system cluster and the user information of the first user are extracted from the received configuration instructions;

[0021] The first configuration file is generated based on the administrator key, the storage pool name, the user information of the first user, and the management IP address received from the designated tool of the distributed storage orchestration system, and the first configuration file is stored in the designated location; the management IP address is the IP address of the control node in the distributed storage system cluster, and the management IP address is sent by the control node after startup is completed.

[0022] Optionally, the method further includes:

[0023] The key manager receives the user information of the second user and the storage pool name of the distributed storage system cluster from the management terminal.

[0024] The key manager obtains the administrator key and the management IP address from the obtained key generation information;

[0025] The key manager generates a second user key based on the second user's user information, the storage pool name of the distributed storage system cluster, the administrator key, and the management IP address;

[0026] The second user key is stored in the container orchestration platform.

[0027] Optionally, storing the first user key in the container orchestration platform includes:

[0028] A second configuration file is generated based on the user information and the key of the first user.

[0029] A preset application programming interface (API) is invoked, and the API loads the second configuration file into the container orchestration platform for storage.

[0030] This invention also provides an automatic key management device, the device comprising:

[0031] The deployment module is used to invoke the distributed storage orchestration system upon receiving a distributed storage system cluster deployment instruction, so that the distributed storage orchestration system can deploy the distributed storage system cluster.

[0032] The key generation module is used to call the key manager, which, when the deployment progress of the distributed storage system cluster reaches a specified progress, obtains key generation information and generates a first user key based on the key generation information; the key generation information is the information required to generate the first user key.

[0033] The first key storage module is used to store the first user key in the container orchestration platform.

[0034] This invention also provides an electronic device, including a memory and one or more programs, wherein one or more programs are stored in the memory and configured to be executed by one or more processors, the one or more programs including a key automatic management method as described in any of the embodiments of this invention.

[0035] This invention also provides a readable storage medium that, when the instructions in the storage medium are executed by the processor of an electronic device, enables the electronic device to perform the automatic key management method as described in any of the embodiments of this invention.

[0036] Optionally, the specified progress refers to the completion of deployment of the distributed storage system cluster;

[0037] The key generation module is specifically used for:

[0038] When the key manager detects that the distributed storage system cluster has been deployed, it retrieves the first configuration file from a specified location to obtain the key generation information.

[0039] The first configuration file is pre-generated and stored in the specified location.

[0040] Optionally, the device further includes:

[0041] The first acquisition module is used to acquire the administrator key from the distributed storage orchestration system, and to extract the storage pool name of the distributed storage system cluster and the user information of the first user from the received configuration instructions;

[0042] The first generation module is used to generate the first configuration file based on the administrator key, the storage pool name, the user information of the first user, and the management IP address received from the designated tool of the distributed storage orchestration system, and to store the first configuration file in the designated location; the management IP address is the IP address of the control node in the distributed storage system cluster, and the management IP address is sent by the control node after startup is completed.

[0043] Optionally, the device further includes:

[0044] The receiving module is used to receive user information of the second user and the storage pool name of the distributed storage system cluster sent by the management terminal from the key manager;

[0045] The second acquisition module is used by the key manager to obtain the administrator key and the management IP address from the acquired key generation information;

[0046] The second generation module is used by the key manager to generate a second user key based on the user information of the second user, the storage pool name of the distributed storage system cluster, the administrator key, and the management IP address.

[0047] The second key storage module is used to store the second user key in the container orchestration platform.

[0048] Compared with the prior art, the embodiments of the present invention have the following advantages:

[0049] In this embodiment of the invention, upon receiving a deployment instruction for a distributed storage system cluster, step 5 invokes a distributed storage orchestration system to deploy the distributed storage system cluster.

[0050] The group invokes the key manager, which, upon reaching a specified deployment progress in the distributed storage system cluster, retrieves key generation information and generates a first user key based on this information. The key generation information is the necessary data for generating the first user key. The first user key is then...

[0051] The key is stored in the container orchestration platform. Compared to manually generating and storing user keys, in embodiment 0 of this invention, the distributed storage system cluster is deployed using a distributed storage orchestration system.

[0052] The system calls the key manager to automatically obtain key generation information, generates a first user key for the first user based on the key generation information, and automatically stores the first user key in the container orchestration platform. This can reduce the workload of the administrator, reduce labor costs, improve the efficiency of key generation and storage, and thus improve the overall deployment efficiency and management efficiency. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 This is a flowchart illustrating the steps of an automatic key management method provided in an embodiment of the present invention;

[0055] Figure 2 This is a schematic diagram of the structure of an automatic key management system provided in an embodiment of the present invention;

[0056] Figure 3 This is a structural block diagram of an automatic key management device provided in an embodiment of the present invention. Detailed Implementation

[0057] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention.

[0058] This is not an exhaustive list of embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention.

[0059] Reference Figure 1 The diagram illustrates a flowchart of an automatic key management method provided by an embodiment of the present invention. The method may specifically include the following steps:

[0060] Step 101: Upon receiving a distributed storage system cluster deployment instruction, the distributed storage orchestration system is invoked, and the distributed storage system cluster is deployed by the distributed storage orchestration system.

[0061] The specific type of distributed storage system can be set according to actual needs. For example, the distributed storage system can be Ceph, GFS, HDFS, Swift, or Lustre. In one implementation, Ceph can be used as the distributed storage system. Ceph is an open-source distributed storage system that includes object storage, block devices, and a file system. It features high reliability, easy installation, and simple management, and can easily manage massive amounts of data. Ceph possesses enterprise-level storage capabilities. It achieves high availability distributed storage by organizing a large number of nodes, which communicate with each other to replicate data and dynamically redistribute data.

[0062] A distributed storage orchestration system is an automatically managed, automatically scaled, and automatically healed distributed storage orchestration system specifically designed for object, block, and / or file storage services in cloud-native environments. For example, a distributed storage orchestration system could be Rook. Distributed storage orchestration systems support automatic deployment, startup, configuration, allocation, scaling up / down, upgrades, migrations, disaster recovery, monitoring, and resource management. To achieve all these functions, a distributed storage orchestration system relies on an underlying container orchestration platform. The distributed storage orchestration system provides a convenient storage solution for the container orchestration platform. The distributed storage orchestration system itself does not provide storage but rather provides an adaptation layer between the container orchestration platform and the storage system, simplifying the deployment and maintenance of the storage system. The specific type of container orchestration platform can be configured according to actual needs; for example, the container orchestration platform could be a Kubernetes platform, an OpenShift platform, etc.

[0063] In one implementation approach, Kubernetes can be chosen as the container orchestration platform. Kubernetes is an open-source platform for the automated deployment, scaling, and operation of container clusters. It allows for rapid and efficient response to user needs, quick and predictable application deployment, rapid application scaling, and seamless integration with new application functionalities. Kubernetes saves resources and optimizes hardware resource usage, providing a complete open-source solution for container orchestration and management. If a user wants to install software on the Kubernetes platform but needs a place to store persistent data for the software to function, they can deploy a distributed storage system cluster using a distributed storage orchestration system and then use this cluster for data storage on the Kubernetes platform.

[0064] This invention combines the advantages of distributed storage orchestration systems and distributed storage systems. It leverages the ability of a distributed storage orchestration system to manage distributed storage systems. Upon receiving a distributed storage system cluster deployment instruction, it invokes the distributed storage orchestration system to deploy the distributed storage system cluster. The distributed storage system cluster deployment instruction can be triggered when the deployment of a distributed storage system cluster is required.

[0065] Step 102: Invoke the key manager. When the deployment progress of the distributed storage system cluster reaches a specified progress, the key manager obtains key generation information and generates a first user key based on the key generation information. The key generation information is the information required to generate the first user key.

[0066] In this embodiment of the invention, the key manager can be pre-created and can be implemented as a script. When the key manager is invoked, it can be done by running the invocation script. Accordingly, the pre-created key manager can have the function of obtaining the information required to generate the first user key and the function of generating the first user key based on the key generation information. The invocation script can be run upon receiving a key manager startup command. The invocation script can include Ceph auth commands to invoke the key manager.

[0067] Furthermore, after the deployment of the distributed storage system cluster begins, a script is directly triggered to invoke the key manager. Correspondingly, the key manager can determine whether the deployment progress of the distributed storage system cluster has reached a specified progress level. If it has, it triggers the operation of obtaining key generation information and generating a first user key based on that information. It should be noted that the script can also be triggered to invoke the key manager when the deployment progress of the distributed storage system cluster reaches a specified progress level, thereby triggering the key manager to obtain key generation information and generate a first user key based on that information. The specified progress level can be set according to actual needs, and this embodiment does not impose any limitations on it. The script can be inserted into the distributed storage orchestration system, or it can be deployed in the automatic key management system; this embodiment does not impose any limitations on it.

[0068] Step 103: Store the first user key in the container orchestration platform.

[0069] The container orchestration platform has the function of storing keys. Specifically, the container orchestration platform may include a key storage module, which can be dedicated to storing user keys. In this embodiment of the invention, the user keys of the distributed storage system cluster generated by the key manager can be loaded into the key storage module of the container orchestration platform, which then stores the user keys of the distributed storage system cluster. Automatic key management is achieved by automatically generating and storing user keys.

[0070] In summary, the automatic key management method provided in this embodiment, upon receiving a deployment instruction for a distributed storage system cluster, invokes a distributed storage orchestration system to deploy the distributed storage system cluster. It then invokes a key manager, which, when the deployment progress of the distributed storage system cluster reaches a specified stage, obtains key generation information and generates a first user key based on this information. The key generation information contains the necessary information for generating the first user key. Finally, the first user key is stored in a container orchestration platform. Compared to manually generating and storing user keys, this embodiment, when deploying a distributed storage system cluster using a distributed storage orchestration system, automatically invokes a key manager to obtain key generation information, generates a first user key for the first user based on this information, and automatically stores the first user key in the container orchestration platform. This reduces the workload of administrators, lowers labor costs, improves the efficiency of key generation and storage, and ultimately improves overall deployment and management efficiency.

[0071] Optionally, in one implementation, the specified progress can be the completion of startup of the control node in the distributed storage system cluster. Accordingly, the step of obtaining key generation information by the key manager when the deployment progress of the distributed storage system cluster reaches the specified progress can specifically include:

[0072] Step S21: The key manager polls a designated tool in the distributed storage orchestration system to detect whether a management IP address exists in the designated tool; the management IP address is the IP address of the control node, which is sent to the designated tool by the control node after startup is complete.

[0073] Step S22: If a management IP address exists in the specified tool, obtain the key generation information.

[0074] The designated tool in the distributed storage orchestration system can be a tool used to receive management IP addresses within the system. For example, the designated tool could be a tool provided within the distributed storage orchestration system responsible for receiving management IP addresses. For instance, the designated tool could be a Ceph tool. Key generation information may include the management IP address. During the deployment of a distributed storage system cluster, the deployment and startup of control nodes within the cluster are involved. Once the control node in the distributed storage system cluster has started, it sends its IP address to the designated tool. Accordingly, in this embodiment, the presence of a management IP address in the designated tool can be used to detect whether the control node in the distributed storage system cluster has started.

[0075] Specifically, if the management IP address is present in the specified tool, it can be determined that the control node in the distributed storage system cluster has been started and the deployment progress of the distributed storage system cluster has reached the specified progress. If the management IP address is not present in the specified tool, it can be determined that the control node in the distributed storage system cluster has not been started and the deployment progress of the distributed storage system cluster has not reached the specified progress.

[0076] Furthermore, the key manager can poll a specified tool at a preset period. This preset period can be set according to actual needs; for example, it can be 10 seconds, 15 seconds, or 1 minute, etc. Taking a preset period of 10 seconds as an example, the specified tool can be polled every 10 seconds. Specifically, polling the specified tool can involve checking whether a management IP address exists within the specified tool.

[0077] In this embodiment, the key manager polls a designated tool in the distributed storage orchestration system to detect the presence of a management IP address. The management IP address is the IP address of the control node, which is sent to the designated tool by the control node after startup. If the management IP address is present in the designated tool, key generation information is obtained. This allows key generation information to be obtained and the key generation process to begin before deployment is complete—that is, after the deployment progress reaches the point where the control node in the distributed storage system cluster has finished starting up. This, to some extent, enables more timely key generation.

[0078] Optionally, in this embodiment of the disclosure, the key generation information may specifically include the management IP address, the storage pool name of the distributed storage system cluster, the user information of the first user, and the administrator key. The step of obtaining the key generation information when the management IP address exists in the specified tool may specifically include:

[0079] Step S221: If a management IP address exists in the specified tool, obtain the management IP address from the specified tool, and obtain the storage pool name of the distributed storage system cluster, the user information of the first user, and the administrator key from the distributed storage orchestration system.

[0080] In this embodiment, the storage pool name and the first user's user information in the distributed storage orchestration system can be extracted by the distributed storage orchestration system from the received configuration instructions. This configuration instruction can be the same as the aforementioned distributed storage system cluster deployment instruction; that is, the distributed storage system cluster deployment instruction can carry the storage pool name and the first user's user information. Accordingly, the distributed storage orchestration system can directly parse the received distributed storage system cluster deployment instruction to extract the storage pool name and the first user's user information. Of course, the configuration instruction can be a different instruction from the aforementioned distributed storage system cluster deployment instruction; the administrator can send additional configuration instructions to the key management system. It should be noted that in this embodiment, the storage pool name and the first user's user information can also be directly sent to the key manager in the form of a configuration file. Accordingly, the key manager can then obtain the management IP address and administrator key from the distributed storage orchestration system to obtain key generation information.

[0081] The storage pool name carried in the configuration command can be generated according to a preset naming rule. For example, the preset naming rule could be xxx_volumes, and the distributed storage system cluster could be named rbd. Therefore, according to the preset naming rule, the storage pool name generated for this distributed storage system cluster could be rbd_volumes. In one example of this invention, each distributed storage system cluster can have a corresponding management IP address, which can be an IP address within the internal network. For example, the management IP address could be 192.168.1.2.

[0082] The administrator key stored in the distributed storage orchestration system can be generated by the distributed storage orchestration system according to a preset generation algorithm, or it can be pre-installed in the distributed storage orchestration system. For example, the distributed storage orchestration system can call a specified tool to generate the administrator key according to a preset generation algorithm. For instance, the administrator key could be AQDruhpfQHVLERAA9scTE.

[0083] Furthermore, the aforementioned user information may include user accounts and user permissions for the distributed storage system cluster. The first user can be a cluster user registered for the distributed storage system cluster. By generating a user key for the first user, the first user can easily access the distributed storage system cluster. There can be multiple first users. In this embodiment, a user key can be generated for any first user based on the administrator key, management IP address, storage pool name, and the user information of that first user, resulting in a single first user key. Correspondingly, multiple first user keys can be automatically generated for multiple first users. Compared to the prior art where administrators need to manually generate corresponding user keys for each first user, leading to a large workload for administrators, this embodiment can conveniently generate multiple user keys, thereby reducing the workload for administrators and improving generation efficiency.

[0084] Alternatively, in another implementation, the specified progress can be the completion of deployment of the distributed storage system cluster. Accordingly, the step of obtaining key generation information by the key manager when the deployment progress of the distributed storage system cluster reaches the specified progress can specifically include:

[0085] Step S31: When the key manager detects that the distributed storage system cluster has been deployed, it retrieves the first configuration file from a designated location to obtain the key generation information; wherein, the first configuration file is pre-generated and stored in the designated location.

[0086] In this embodiment of the disclosure, the designated location can be set according to actual needs. For example, the designated location can be a container orchestration platform. Specifically, the distributed storage orchestration system can import the key generation information as a first configuration file into the file storage module of the container orchestration platform. The distributed storage orchestration system can generate a corresponding filename for the first configuration file. The filename can be randomly generated, for example, randomly generated as RookCephCluster. Then, RookCephCluster can be used as the filename of the first configuration file, and the first configuration file and its corresponding filename can be stored in the file storage module, so that the corresponding first configuration file can be found later based on the filename. Furthermore, the first configuration file can be in YAML format. The above examples are only used to enable those skilled in the art to better understand the embodiments of the present invention, and the present invention does not limit this. Of course, other parts of the key management system can also be responsible for generating and storing the first configuration file, and this embodiment of the disclosure does not limit this.

[0087] Furthermore, the key manager can determine that the distributed storage system cluster has been deployed successfully upon receiving a deployment completion instruction from the distributed storage orchestration system. This deployment completion instruction may carry a file identifier for the first configuration file, which can be the filename of the first configuration file. Upon receiving the deployment completion instruction from the distributed storage orchestration system, the key manager can retrieve the corresponding configuration information, i.e., obtain the key generation information, from the file storage module of the container orchestration platform based on the file identifier of the first configuration file.

[0088] In this embodiment of the disclosure, a first configuration file is generated and stored in a designated location. With the distributed storage system cluster already deployed, the key manager can directly obtain the first configuration file from the designated location to obtain the key generation information, thereby ensuring information acquisition efficiency to a certain extent.

[0089] In this embodiment of the invention, the key generation information may include the storage pool name, management IP address, administrator key, and user information of the distributed storage system cluster. During the deployment of the distributed storage system cluster using the distributed storage orchestration system, this embodiment can automatically generate a first configuration file based on the storage pool name, management IP address, administrator key, and user information of the distributed storage system cluster. Therefore, the first configuration file may include the storage pool name, management IP address, administrator key, and user information of the distributed storage system cluster. Accordingly, obtaining the first configuration file yields the key generation information. In one example of this invention, before a user calls the distributed storage orchestration system to deploy the distributed storage system cluster, they can input the storage pool name of the distributed storage system cluster and the user information of the first user, sending the storage pool name of the distributed storage system cluster and the user information of the first user to the distributed storage orchestration system in the form of configuration instructions. The distributed storage orchestration system can generate the first configuration information during the deployment process.

[0090] Optionally, the embodiments of this disclosure may further include the following steps:

[0091] Step S41: Obtain the administrator key from the distributed storage orchestration system, and extract the storage pool name of the distributed storage system cluster and the user information of the first user from the received configuration instructions.

[0092] Step S42: Generate the first configuration file based on the administrator key, the storage pool name, the user information of the first user, and the management IP address received from the designated tool of the distributed storage orchestration system, and store the first configuration file in the designated location; the management IP address is the IP address of the control node in the distributed storage system cluster, and the management IP address is sent by the control node after startup is completed.

[0093] In this embodiment, the administrator key can be generated by the distributed storage orchestration system according to a preset generation algorithm, or it can be pre-installed in the distributed storage orchestration system. Accordingly, the distributed storage orchestration system can generate its own key or read the pre-installed administrator key to obtain the administrator key. This configuration instruction can be the same as the aforementioned distributed storage system cluster deployment instruction; that is, the distributed storage system cluster deployment instruction can carry the storage pool name and the user information of the first user. Accordingly, the distributed storage orchestration system can directly parse the received distributed storage system cluster deployment instruction to extract the storage pool name and the user information of the first user. Of course, the configuration instruction can be a different instruction from the aforementioned distributed storage system cluster deployment instruction; the administrator can send additional configuration instructions to the key management system.

[0094] Furthermore, the administrator key, storage pool name, first user's information, and management IP address can be packaged according to the configuration file format to obtain the first configuration file. In this embodiment of the disclosure, the information required to generate the user key is stored in a designated location in the form of the first configuration file, which facilitates subsequent retrieval and use to some extent.

[0095] In this embodiment of the invention, after obtaining the key generation information, the key for the distributed storage system cluster is automatically generated based on the key generation information. In one example, the storage pool name, management IP address, administrator key, and user information of the first user in the distributed storage system cluster can be used as inputs to a preset key logic algorithm, and the output of the algorithm can be used as the first user key, thereby automatically generating the first user key for the distributed storage system cluster. For example, the key for the distributed storage system cluster could be msEncq5dcAUObVKg. The above examples are only used to enable those skilled in the art to better understand the embodiments of the present invention, and the present invention does not limit it.

[0096] Optionally, the step of storing the first user key in the container orchestration platform may specifically include:

[0097] Step 1031: Generate a second configuration file based on the user information and the first user key of the first user.

[0098] Step 1032: Call the preset application programming interface (API) to load the second configuration file into the container orchestration platform, so as to store the second configuration file through the container orchestration platform.

[0099] The second configuration file can be a YAML file. The user information of the first user and the first user key can be stored and packaged according to the configuration file format to obtain the second configuration file. The preset Application Programming Interface (API) can be an interface with data storage capabilities. This API can be called to load the first user key into the container orchestration platform in the form of the second configuration file, where the container orchestration platform stores the second configuration file. Specifically, the preset API can automatically load the second configuration file into the key storage module of the container orchestration platform, where the key storage module stores the second configuration file.

[0100] Optionally, after the distributed storage system cluster is deployed, new users may want to join the cluster. Accordingly, user keys can be generated for the new users through steps S51 to S54 below.

[0101] Step S51: The key manager receives the user information of the second user and the storage pool name of the distributed storage system cluster sent by the management terminal.

[0102] Step S52: The key manager obtains the administrator key and the management IP address from the obtained key generation information.

[0103] Step S53: The key manager generates a second user key based on the second user's user information, the storage pool name of the distributed storage system cluster, the administrator key, and the management IP address.

[0104] Step S54: Store the second user key in the container orchestration platform.

[0105] In this embodiment, the management terminal can be a terminal used by an administrator, such as a computer, mobile phone, etc. The second user can be a newly added user. Specifically, the management terminal can send the second user's user information and the storage pool name of the distributed storage system cluster to be joined to the key manager. Specifically, a script with sending functionality can be invoked to implement the sending. Further, the key manager can obtain the administrator key and management IP address from the key generation information previously obtained, which includes storage pool names that match the storage pool names sent by the management terminal. Then, based on the second user's user information, the storage pool name of the distributed storage system cluster, the administrator key, and the management IP address, a user key can be generated for the second user, thus obtaining the second user key. There can be one or more second users, and the method for generating the second user key can be referred to the aforementioned description, which will not be repeated here.

[0106] The second user key is stored in the container orchestration platform. Specifically, a third configuration file is generated based on the second user's information and the second user key. A preset application programming interface (API) is called, and this API loads the third configuration file into the container orchestration platform for storage. The specific implementation method is similar to the aforementioned method for generating and storing the second configuration file, and will not be repeated here.

[0107] In this embodiment, a key manager can automatically generate a second user key for a newly added second user and automatically store the second user key in the container orchestration platform. This further reduces the manual cost of generating user keys for newly added users and further improves the efficiency of key generation and storage.

[0108] This invention can be applied to distributed storage system clusters. Specifically, the distributed storage system cluster can be used as the execution entity. Upon receiving a deployment instruction, it invokes a distributed storage orchestration system to perform cluster deployment and a key manager to generate a first user key. The key manager can be deployed within the distributed storage system cluster or on other devices. Finally, the first user key can be stored in the container orchestration platform by calling a pre-defined application programming interface (API).

[0109] It should be noted that the aforementioned distributed storage orchestration system, distributed storage system, and container orchestration platform can be deployed in the same cluster. Alternatively, they can be deployed in different clusters; for example, the distributed storage system can be deployed in a first server cluster, the distributed storage orchestration system in a second server cluster, and the container orchestration platform in a third server cluster. Accordingly, the first server cluster, the second server cluster, and the third server cluster can form an automatic key management system. That is, the automatic key management system can be a cluster composed of the aforementioned first server cluster, second server cluster, and third server cluster. In this embodiment of the invention, the automatic key management system can be used as the execution entity.

[0110] refer to Figure 2 This diagram illustrates the structure of an automatic key management system 200 according to an embodiment of the present invention. The automatic key management system 200 includes a distributed storage orchestration system 201, a distributed storage system 202, a key manager 203, and a container orchestration platform 204. The specific working process of the automatic key management system 200 is as follows:

[0111] 1. The automatic key management system 200 receives deployment instructions for the distributed storage system cluster;

[0112] 2. Invoke the distributed storage orchestration system 201 to deploy the distributed storage system cluster of distributed storage system 202;

[0113] 3. The key automatic management system 200 generates the first configuration file;

[0114] 4. After the distributed storage orchestration system 201 is deployed, the key manager 203 is triggered to automatically generate the first user key according to the first configuration file;

[0115] 5. After the key manager 203 generates the first user key, it automatically loads the first user key into the container orchestration platform 204 through a preset application programming interface;

[0116] 6. The container orchestration platform 204 stores the first user key.

[0117] In this embodiment of the invention, upon receiving a deployment instruction for a distributed storage system cluster, a distributed storage orchestration system is invoked to deploy the cluster. Then, once the cluster deployment is complete, a key manager is invoked to generate the first user key for the cluster. This first user key is then loaded into the container orchestration platform for storage. This embodiment of the invention automatically generates the first user key and loads it into the container orchestration platform during the deployment process, thus automatically creating, configuring, and updating keys. This significantly reduces the workload of administrators, improves deployment and management efficiency, and enhances accuracy.

[0118] This invention also provides an automatic key management device, the device comprising:

[0119] refer to Figure 3 The diagram shows a structural block diagram of an automatic key management device provided in an embodiment of the present invention, which may specifically include the following modules:

[0120] The deployment module 301 is used to call the distributed storage orchestration system upon receiving a distributed storage system cluster deployment instruction, so that the distributed storage orchestration system can deploy the distributed storage system cluster.

[0121] The key generation module 302 is used to call the key manager, which, when the deployment progress of the distributed storage system cluster reaches a specified progress, obtains key generation information and generates a first user key based on the key generation information; the key generation information is the information required to generate the first user key.

[0122] The first key storage module 303 is used to store the first user key to the container orchestration platform.

[0123] Optionally, the specified progress refers to the completion of startup of the control node in the distributed storage system cluster;

[0124] The key generation module 302 is specifically used for:

[0125] The key manager polls a designated tool in the distributed storage orchestration system to detect whether a management IP address exists in the designated tool; the management IP address is the IP address of the control node, which is sent to the designated tool by the control node after startup is complete;

[0126] If a management IP address exists in the specified tool, obtain the key generation information.

[0127] Optionally, the key generation module 302 is further configured to:

[0128] If a management IP address exists in the specified tool, obtain the management IP address from the specified tool, and obtain the storage pool name of the distributed storage system cluster, the user information of the first user, and the administrator key from the distributed storage orchestration system.

[0129] Optionally, the specified progress refers to the completion of deployment of the distributed storage system cluster;

[0130] The key generation module 302 is specifically used for:

[0131] When the key manager detects that the distributed storage system cluster has been deployed, it retrieves the first configuration file from a specified location to obtain the key generation information.

[0132] The first configuration file is pre-generated and stored in the specified location.

[0133] Optionally, the device further includes:

[0134] The first acquisition module is used to acquire the administrator key from the distributed storage orchestration system, and to extract the storage pool name of the distributed storage system cluster and the user information of the first user from the received configuration instructions;

[0135] The first generation module is used to generate the first configuration file based on the administrator key, the storage pool name, the user information of the first user, and the management IP address received from the designated tool of the distributed storage orchestration system, and to store the first configuration file in the designated location; the management IP address is the IP address of the control node in the distributed storage system cluster, and the management IP address is sent by the control node after startup is completed.

[0136] Optionally, the device further includes:

[0137] The receiving module is used to receive user information of the second user and the storage pool name of the distributed storage system cluster sent by the management terminal from the key manager;

[0138] The second acquisition module is used by the key manager to obtain the administrator key and the management IP address from the acquired key generation information;

[0139] The second generation module is used by the key manager to generate a second user key based on the user information of the second user, the storage pool name of the distributed storage system cluster, the administrator key, and the management IP address.

[0140] The second key storage module is used to store the second user key in the container orchestration platform.

[0141] Optionally, the first key storage module 303 is specifically used for:

[0142] A second configuration file is generated based on the user information and the key of the first user.

[0143] A preset application programming interface (API) is invoked, and the API loads the second configuration file into the container orchestration platform for storage.

[0144] In summary, the automatic key management device provided in this embodiment, upon receiving a deployment instruction for a distributed storage system cluster, invokes a distributed storage orchestration system to deploy the distributed storage system cluster. It then invokes a key manager, which, when the deployment progress of the distributed storage system cluster reaches a specified stage, obtains key generation information and generates a first user key based on this information. The key generation information is the information required to generate the first user key. Finally, the first user key is stored in a container orchestration platform. Compared to manually generating and storing user keys, this embodiment, when deploying a distributed storage system cluster using a distributed storage orchestration system, automatically invokes a key manager to obtain key generation information, generates a first user key for the first user based on this information, and automatically stores the first user key in the container orchestration platform. This reduces the workload of administrators, lowers labor costs, improves the efficiency of key generation and storage, and thus improves overall deployment and management efficiency.

[0145] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0146] This invention also provides an electronic device, including a memory and one or more programs, wherein one or more programs are stored in the memory and configured to be executed by one or more processors. The one or more programs include methods for performing automatic key management as described in any of the embodiments of this invention. Exemplarily, the electronic device may be a cluster composed of the first server cluster, the second server cluster, and the third server cluster described above.

[0147] This invention also provides a readable storage medium that, when the instructions in the storage medium are executed by the processor of an electronic device, enables the electronic device to perform the automatic key management method as described in any of the embodiments of this invention.

[0148] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0149] It should be noted that all information and data acquired in the embodiments of this invention were obtained with the authorization of the information / data holder. All actions involving the acquisition of signals, information, or data in this application were performed in accordance with the relevant data protection laws and policies of the country where the application is located, and with the authorization of the respective device owner.

[0150] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0151] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0152] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0153] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0154] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the present invention.

[0155] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0156] The present invention provides a detailed description of an automatic key management method, apparatus, electronic device, and readable storage medium. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for automatic management of keys, characterized in that, The method comprises: In the case of receiving the distributed storage system cluster deployment instruction, calling the distributed storage arrangement system, and deploying the distributed storage system cluster by the distributed storage arrangement system; Calling the key manager, and in the case that the deployment progress of the distributed storage system cluster reaches a specified progress, acquiring key generation information by the key manager, and generating a first user key based on the key generation information; the key generation information is the information required to generate the first user key; Automatically loading the first user key to the container arrangement platform through a preset application program interface; In the case that the specified progress is that a control node in the distributed storage system cluster has completed starting; The key generation information is acquired by the key manager in the case that the deployment progress of the distributed storage system cluster reaches a specified progress, comprising: Polling a specified tool in the distributed storage arrangement system by the key manager to detect whether there is a management IP address in the specified tool; the management IP address is the IP address of the control node, and the management IP address is sent to the specified tool by the control node in the case that the control node has completed starting; In the case that there is a management IP address in the specified tool, the key generation information is acquired.

2. The method of claim 1, wherein, In the case that there is a management IP address in the specified tool, the management IP address is acquired from the specified tool, and the storage pool name of the distributed storage system cluster, the user information of the first user, and the administrator key are acquired from the distributed storage arrangement system. The specified progress is that the distributed storage system cluster has completed deployment; 3. The method of claim 1, wherein, The key generation information is acquired by the key manager in the case that the deployment progress of the distributed storage system cluster reaches a specified progress, comprising: The first configuration file is acquired from a specified position by the key manager in the case that it is detected that the distributed storage system cluster has completed deployment, so as to obtain the key generation information; The first configuration file is pre-generated and stored in the specified position. The method further comprises:

4. The method of claim 3, wherein, The administrator key is acquired by the distributed storage arrangement system, and the storage pool name of the distributed storage system cluster and the user information of the first user are extracted from the received configuration instruction; The first configuration file is generated according to the administrator key, the storage pool name, the user information of the first user, and the management IP address received in the specified tool of the distributed storage arrangement system, and the first configuration file is stored in the specified position; the management IP address is the IP address of the control node in the distributed storage system cluster, and the management IP address is sent by the control node in the case that the control node has completed starting. The method further comprises:

5. The method according to any of claims 1 to 4, characterized in that, The user information of a second user and the storage pool name of the distributed storage system cluster are received by the key manager from a management terminal; ​ obtaining, by the key manager, an administrator key and the management IP address from the obtained key generation information; generating, by the key manager, a second user key according to user information of the second user, a storage pool name of the distributed storage system cluster, the administrator key, and the management IP address; storing the second user key to the container orchestration platform.

6. The method according to any one of claims 1 to 4, characterized in that, The storing the first user key to the container orchestration platform comprises: generating a second configuration file according to the user information of the first user and the first user key; calling a preset application program interface, and loading the second configuration file into the container orchestration platform by the application program interface, so as to store the second configuration file through the container orchestration platform.

7. A key automatic management apparatus characterized by comprising: The apparatus comprises: a deployment module configured to call a distributed storage orchestration system to deploy a distributed storage system cluster when a distributed storage system cluster deployment instruction is received; a key generation module configured to call a key manager to obtain key generation information and generate a first user key based on the key generation information when a deployment progress of the distributed storage system cluster reaches a specified progress; the key generation information is information required for generating the first user key; a first key storage module configured to automatically load the first user key to a container orchestration platform through a preset application program interface; when the specified progress is that a control node in the distributed storage system cluster has completed starting, the key generation module is further configured to: poll a specified tool in the distributed storage orchestration system to detect whether there is a management IP address in the specified tool; the management IP address is an IP address of the control node, and the management IP address is sent by the control node to the specified tool when the control node has completed starting; and obtain the key generation information when the management IP address exists in the specified tool.

8. The apparatus of claim 7, wherein, The specified progress is that the distributed storage system cluster has completed deployment. The key generation module is specifically configured to: obtain the first configuration file from a specified location to obtain the key generation information when it is detected that the distributed storage system cluster has completed deployment, by the key manager; The first configuration file is pre-generated and stored in the specified location.

9. The apparatus of claim 8, wherein, The apparatus further comprises: a first obtaining module configured to obtain an administrator key by the distributed storage orchestration system, and extract a storage pool name of the distributed storage system cluster and user information of a first user from a received configuration instruction. The first generation module is configured to generate the first configuration file according to the administrator key, the storage pool name, user information of the first user, and a management IP address received from a specified tool of the distributed storage arrangement system, and store the first configuration file to the specified location; the management IP address is an IP address of a control node in the distributed storage system cluster, and the management IP address is sent by the control node after the control node is started.

10. The apparatus of any of claims 7-9, wherein, The apparatus further includes: The receiving module is configured to receive, by the key manager, user information of a second user and a storage pool name of the distributed storage system cluster sent by a management terminal; The second obtaining module is configured to obtain, by the key manager, an administrator key and the management IP address from the obtained key generation information; The second generation module is configured to generate, by the key manager, a second user key according to the user information of the second user, the storage pool name of the distributed storage system cluster, the administrator key, and the management IP address; The second key storage module is configured to store the second user key to the container arrangement platform.

11. An electronic device, comprising: The computer program product includes a memory, and one or more programs stored in the memory and configured to be executed by one or more processors, and the one or more programs include a key automatic management method for executing any one of the method claims 1-6.

12. A readable storage medium, characterized by, When the instructions in the storage medium are executed by the processor of the electronic device, the electronic device can execute the key automatic management method of any one of the method claims 1-6.

Images