Data access request processing method and device
By deploying a proxy server in the container orchestration engine cluster, judging and converting the permission information of data access requests, the problem of insufficient data security in traditional data access methods is solved, and safe and efficient data access is achieved, which is suitable for more application scenarios.
Patent Information
- Application Number
- CN202211592748.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-12-13
- Publication Date
- 2024-12-13
- Estimated Expiration
- 2042-12-13
AI Technical Summary
In container orchestration engine clusters, traditional data access methods cannot guarantee the security of data. Anyone can access it as long as they know the access address, resulting in the risk of data leakage.
By deploying a proxy server in the container orchestration engine cluster, setting up data status monitoring tasks using the preset internal service disclosure mode, obtaining data access requests and determining their permission information, converting it to the target format if the permission information is met, and sending To the container orchestration engine cluster to access the target data.
Implement the setting of data access permissions, avoid data leakage caused by access address leakage, improve the security of data access, and handle data access requests through proxy servers, reducing the workload of load balancer settings and improving convenience , suitable for more application scenarios.
Smart Images
Figure CN116016668B_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to the field of data processing technology, and in particular to a method, device, computer equipment and storage medium for processing a data access request. Background Art
[0002] During the operation of the container orchestration engine cluster, a data status monitoring task can be created in the container orchestration engine cluster to monitor the running status of tasks in the container orchestration engine cluster.
[0003] Users can obtain the running status of the task by accessing the dashboard of the data status detection task. In traditional technology, users can obtain the corresponding data by publicly providing services on static ports; or they can access the data by accessing the public IP in the cluster through the load balancer. However, when accessing data through the above methods, anyone can access it as long as they know the access address, and the security of the data cannot be guaranteed. Summary of the invention
[0004] Based on this, it is necessary to provide a method, apparatus, computer device, storage medium and computer program product for processing data access requests to improve the security and convenience of data access in response to the above technical problems.
[0005] In a first aspect, an embodiment of the present disclosure provides a method for processing a data access request, the method being applied to a proxy server, the proxy server being deployed in a container orchestration engine cluster, the container orchestration engine cluster being provided with a data status monitoring task through a preset internal service disclosure mode, the method comprising:
[0006] Obtaining a data access request and an account number corresponding to the data access request;
[0007] If the data access request complies with the permission information corresponding to the account, convert the format of the data access request into a target format that matches the container orchestration engine cluster to obtain a converted data access request;
[0008] The converted data access request is sent to the container orchestration engine cluster to access the target data through the data status monitoring task.
[0009] In one embodiment, after obtaining the data access request and the account corresponding to the data access request, the method further includes:
[0010] Determining attribute information of the account;
[0011] When the attribute information of the account meets the preset condition, it is determined whether the data access request meets the permission information corresponding to the account.
[0012] In one of the embodiments, when the data access request complies with the permission information corresponding to the account, converting the format of the data access request into a target format that matches the container orchestration engine cluster includes:
[0013] Acquire target data corresponding to the data access request and permission information corresponding to the account, wherein the permission information includes namespace information and accessible application information accessible to the account;
[0014] Acquire a target namespace and a target application to which the target data belongs;
[0015] In a case where the target namespace and the target application match the permission information, the format of the data access request is converted into a target format that matches the container orchestration engine cluster.
[0016] In one embodiment, converting the format of the data access request into a target format that matches the container orchestration engine cluster includes:
[0017] Obtaining a target parameter and an identifier of a preset field corresponding to the data access request, wherein the target parameter includes target namespace information and target application information;
[0018] Determining a format configuration rule corresponding to the container orchestration engine cluster;
[0019] The target parameter and the identifier of the preset field are converted into a target format according to the format configuration rule.
[0020] In one embodiment, sending the converted data access request to the container orchestration engine cluster includes:
[0021] Obtaining a request category corresponding to the data access request;
[0022] The converted data access request is sent to the container orchestration engine cluster according to a request sending method corresponding to the request category.
[0023] In a second aspect, an embodiment of the present disclosure further provides a device for processing a data access request, the device being applied to a proxy server, the proxy server being deployed in a container orchestration engine cluster, the container orchestration engine cluster being provided with a data status monitoring task through a preset internal service disclosure mode, the device comprising:
[0024] An acquisition module, used to acquire a data access request and an account number corresponding to the data access request;
[0025] a conversion module, configured to convert the format of the data access request into a target format that matches the container orchestration engine cluster, to obtain a converted data access request, if the data access request conforms to the permission information corresponding to the account;
[0026] A sending module is used to send the converted data access request to the container orchestration engine cluster to access the target data through the data status monitoring task.
[0027] In one embodiment, the acquisition module further includes:
[0028] A determination module, used to determine attribute information of the account;
[0029] The judgment module is used to judge whether the data access request complies with the permission information corresponding to the account when the attribute information of the account complies with the preset conditions.
[0030] In one embodiment, the conversion module includes:
[0031] A first acquisition submodule, configured to acquire target data corresponding to the data access request and permission information corresponding to the account, wherein the permission information includes namespace information and accessible application information accessible to the account;
[0032] A second acquisition submodule is used to acquire a target namespace and a target application to which the target data belongs;
[0033] The first conversion submodule is configured to convert the format of the data access request into a target format that matches the container orchestration engine cluster when the target namespace and the target application match the permission information.
[0034] In one embodiment, the conversion module includes:
[0035] A third acquisition submodule is used to acquire a target parameter and an identifier of a preset field corresponding to the data access request, wherein the target parameter includes target namespace information and target application information;
[0036] A first determination submodule, configured to determine a format configuration rule corresponding to the container orchestration engine cluster;
[0037] The second conversion submodule is used to convert the target parameter and the identifier of the preset field into a target format according to the format configuration rule.
[0038] In one embodiment, the sending module includes:
[0039] A fourth acquisition submodule, used to acquire a request category corresponding to the data access request;
[0040] The first sending submodule is configured to send the converted data access request to the container orchestration engine cluster according to a request sending method corresponding to the request category.
[0041] In a third aspect, an embodiment of the present disclosure further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any one of the methods in the embodiments of the present disclosure are implemented.
[0042] In a fourth aspect, the embodiments of the present disclosure further provide a computer-readable storage medium, wherein a computer program is stored thereon, and when the computer program is executed by a processor, the steps of any one of the methods in the embodiments of the present disclosure are implemented.
[0043] In a fifth aspect, the embodiments of the present disclosure further provide a computer program product, wherein the computer program product includes a computer program, and when the computer program is executed by a processor, the steps of any one of the methods in the embodiments of the present disclosure are implemented.
[0044] In the disclosed embodiment, a data status monitoring task is set in a container orchestration engine cluster through a preset internal service disclosure mode, and a proxy server is deployed in the container orchestration engine cluster. When data access is desired, the proxy server receives the data access request, determines whether the data access request complies with the corresponding permission information, converts the data access request into a target format if it complies, and sends it to the container orchestration engine cluster, thereby enabling access to target data through the data status monitoring task, achieving the setting of data access permissions, avoiding the problem of data leakage caused by access address leakage, and improving the security of data access; and processing data access requests through the proxy server does not require setting ports or load balancers, is not limited by the number of ports, reduces the workload of setting the load balancer, has low implementation difficulty, improves the convenience of data access implementation, and can be applied to more application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS
[0045] Figure 1 A flowchart of a method for processing a data access request in an embodiment;
[0046] Figure 2 A flowchart of a method for processing a data access request in an embodiment;
[0047] Figure 3 A flowchart of a method for processing a data access request in an embodiment;
[0048] Figure 4 A flowchart of a method for processing a data access request in an embodiment;
[0049] Figure 5 A flowchart of a method for processing a data access request in an embodiment;
[0050] Figure 6 A schematic diagram of a scenario of a method for processing a data access request in an embodiment;
[0051] Figure 7 is a structural block diagram of a device for processing data access requests in one embodiment;
[0052] Figure 8 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION
[0053] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure more clear, the embodiments of the present disclosure are further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the embodiments of the present disclosure and are not used to limit the embodiments of the present disclosure.
[0054] In one embodiment, Figure 1 As shown, a method for processing a data access request is provided, the method is applied to a proxy server, the proxy server is deployed in a container orchestration engine cluster, and a data status monitoring task is set in the container orchestration engine cluster through a preset internal service disclosure mode, the method includes:
[0055] Step S110, obtaining a data access request and an account number corresponding to the data access request;
[0056] Specifically, the method is applied to a proxy server, which is deployed in a container orchestration engine cluster, and a data status detection task is set in the container orchestration engine cluster through a preset internal service disclosure mode. In one example, the proxy server is exposed through a preset internal service disclosure mode. Among them, the preset internal service disclosure mode is usually set in advance according to the actual application scenario. The internal service disclosure mode refers to the service being only disclosed within the container orchestration engine cluster, and external data requests cannot be directly accessed. In one example, the preset internal service disclosure mode can be set to ClusterIP. The container orchestration engine can be used to manage containerized applications on multiple hosts in a cloud platform, which can make the deployment of containerized applications simpler and more efficient. In one example, the container orchestration engine can be set to Kubernetes, and the container orchestration engine cluster can correspond to a Kubernetes cluster. In this embodiment, the monitoring and management of the cluster data status can be achieved by creating a data status detection task in the cluster, wherein, since the data status detection task is set through a preset internal service disclosure mode, external data access requests cannot be directly reached. In one example, the data status detection task can be set as a Flink real-time computing task. After the task is started normally, an internally accessible Flink dashboard is generated to obtain the corresponding data resources accessible within the cluster, wherein the corresponding data resources can be obtained through a uniform resource identifier. In one example, the data access request is set as an external data access request. In one example, the proxy server includes a Proxy service.
[0057] In the disclosed embodiment, after the account sends a data access request, the proxy server receives the data access request, obtains the data access request, and determines the account corresponding to the data access request, wherein the account corresponding to the data access request includes the account sending the data access request. In one example, when determining the account, the corresponding account can be directly obtained through the account information included in the data access request; when the data access request is sent through a preset platform, the corresponding account can also be determined based on the account settings in the platform corresponding to the data access request.
[0058] Step S120, when the data access request complies with the permission information corresponding to the account, convert the format of the data access request into a target format that matches the container orchestration engine cluster, to obtain a converted data access request;
[0059] In the disclosed embodiment, different accounts may correspond to different permissions, and the permission information of the account may be determined according to the account corresponding to the data request. Among them, the permission information of the account may include the access permission setting of the account to the data in the cluster. According to the account corresponding to the data access request, it is determined whether the data access request conforms to the permission information corresponding to the account. When it conforms, it can be considered that the account can access the data; when it does not conform, it can be considered that the account does not have the permission to access the data and may not respond to the data access request. The permission information of the account can reflect the data content that the account can access. Usually, the data access request corresponds to the target data that you want to access. Through the judgment of the data access request and the permission information, it can be determined whether the target data is within the access permission of the account. In an example, the permission information of the account is usually set in advance according to the actual application scenario, for example, the corresponding access permission is set by the role corresponding to the account or the department to which the account belongs, and the permission information of the account is obtained. When the data access request conforms to the permission information corresponding to the account, the format of the data access request is converted into the target format, wherein the target format matches the container orchestration engine cluster, and the converted data access request is obtained. In an example, the format may include but is not limited to field rules, etc. Since the fields corresponding to the data access request are received through the proxy server, the fields in the data access request may not comply with the rules of the fields accessible within the cluster, and format conversion is required. In one example, the target format may include a uniform resource identifier accessible within the container orchestration engine cluster, and the data access request is converted into a uniform resource identifier accessible within the container orchestration engine cluster according to the parameter information of the data access request, so that subsequent data access can be achieved.
[0060] Step S130: Send the converted data access request to the container orchestration engine cluster to access the target data through the data status monitoring task.
[0061] In the disclosed embodiment, the converted data access request is sent to the container orchestration engine cluster, so that the target data can be accessed through the data status monitoring task. The converted data access request can be sent to the internal address corresponding to the preset internal service disclosure mode. Since the internal data can be accessed through the preset internal service disclosure mode, the internal target data can be accessed through the data status monitoring task. The target data is the data that is desired to be accessed corresponding to the data access request.
[0062] In the disclosed embodiment, a data status monitoring task is set in a container orchestration engine cluster through a preset internal service disclosure mode, and a proxy server is deployed in the container orchestration engine cluster. When data access is desired, the proxy server receives the data access request, determines whether the data access request complies with the corresponding permission information, converts the data access request into a target format if it complies, and sends it to the container orchestration engine cluster, thereby enabling access to target data through the data status monitoring task, achieving the setting of data access permissions, avoiding the problem of data leakage caused by access address leakage, and improving the security of data access; and processing data access requests through the proxy server does not require setting ports or load balancers, is not limited by the number of ports, reduces the workload of setting the load balancer, has low implementation difficulty, improves the convenience of data access implementation, and can be applied to more application scenarios.
[0063] In one embodiment, Figure 2 As shown, after obtaining the data access request and the account corresponding to the data access request, it also includes:
[0064] Step S140, determining attribute information of the account;
[0065] Step S150, when the attribute information of the account meets the preset conditions, it is determined whether the data access request meets the permission information corresponding to the account.
[0066] In the embodiment of the present disclosure, after obtaining the data access request and the account corresponding to the data access request, the account is judged. The attribute information of the account is determined, wherein the attribute information of the account may include but is not limited to the account role, the department to which the account belongs, etc., and different accounts may correspond to different attribute information. It is judged whether the attribute information of the account meets the preset conditions, wherein the preset conditions are usually set according to the actual application scenario. For example, in one example, it can be set that the user corresponding to the account is an administrator; it can also be set that the user corresponding to the account and the task owner belong to the same department or role. When the attribute of the account does not meet the preset conditions, it can be considered that the account does not have access rights at this time and cannot access the data. In one example, when the attribute information of the account does not meet the preset conditions, no processing can be performed; or a notification message that the account has no authority can be returned. When the attribute information of the account meets the preset conditions, it can be considered that the account has access rights at this time, and further judgment can be made. At this time, it is judged whether the data access request meets the authority information corresponding to the account according to the specific information of the data access request.
[0067] The disclosed embodiments can directly determine whether an account has access rights through the account's attribute information and the setting of preset conditions, and continue to execute the next step of processing when the account has access rights, thereby excluding data access requests sent by accounts without access rights, thereby ensuring the security of data within the cluster. Furthermore, through multiple levels of judgment of the account's attribute information and permission information, it is possible to improve the accuracy and efficiency of account permission judgment while reducing the workload of data processing, thereby further ensuring the security and convenience of data access.
[0068] In one embodiment, Figure 3 As shown, when the data access request complies with the permission information corresponding to the account, converting the format of the data access request into a target format that matches the container orchestration engine cluster includes:
[0069] Step S121, obtaining target data corresponding to the data access request and permission information corresponding to the account, wherein the permission information includes namespace information and accessible application information accessible to the account;
[0070] Step S122, obtaining the target namespace and target application to which the target data belongs;
[0071] Step S123: When the target namespace and the target application match the permission information, convert the format of the data access request into a target format that matches the container orchestration engine cluster.
[0072] In an embodiment of the present disclosure, the target data corresponding to the data access request and the permission information corresponding to the account are obtained, the target data includes the data that the data access request wants to access, and the permission information corresponding to the account includes the namespace information and the accessible application information that the account can access. In one example, the data in the cluster can correspond to different namespaces, and the accessible namespaces corresponding to different accounts may be different. For example, the namespace accessible to the account can be set to include the namespace corresponding to the department to which the account belongs, and the association relationship between the account and the corresponding accessible namespace information can be set in advance according to the actual application scenario. Since the cluster may include multiple applications, the accessible applications corresponding to different accounts may also be different. In one example, the association relationship between the account and the corresponding accessible application information can be set in advance according to the actual application scenario. According to the data access request, the target data and the target namespace and target application to which the target data belongs can be determined. Determine whether the target namespace and the target application match the permission information of the account. If they match, it can be considered that the target namespace is a namespace accessible to the account and the target application is an application accessible to the account, that is, the account has the permission to access the target data, the permission check passes, and the data access request is formatted, and the format of the data access request is converted into a target format that matches the container orchestration engine cluster to achieve subsequent request forwarding and data access. When the target namespace and the target application do not match the permission information of the account, it can be considered that the target namespace is not a namespace accessible to the account and / or the target application is not an application accessible to the account, that is, the account does not have the permission to access the target data, the permission check fails, and data access cannot be performed. In one example, when there is no match, an exception notification message can be returned. In one example, it can be determined first whether the target namespace matches, and if it matches, it is determined whether the target application matches; if there is no match, the exception notification message is directly returned without continuing to match the target application. In one example, the namespace can include Namespace. In one example, the target namespace and the target application can be directly obtained through the data access request, or can be determined through the target data corresponding to the data access request.
[0073] The disclosed embodiment determines permission information through the target namespace and target application corresponding to the data access request, thereby eliminating data access requests that do not match the permission information of the account, and realizes the division of permissions for different accounts. Different accounts can correspond to different accessible data areas, ensuring the security of data access. The determination method is simple and accurate, reducing the problem of data leakage caused by permission setting problems.
[0074] In one embodiment, Figure 4As shown, converting the format of the data access request into a target format that matches the container orchestration engine cluster includes:
[0075] Step S124, obtaining a target parameter and an identifier of a preset field corresponding to the data access request, wherein the target parameter includes target namespace information and target application information;
[0076] Step S125, determining a format configuration rule corresponding to the container orchestration engine cluster;
[0077] Step S126: converting the target parameter and the identifier of the preset field into a target format according to the format configuration rule.
[0078] In the disclosed embodiment, when the data access request is formatted, the target parameter and the identifier of the preset field corresponding to the data access request are obtained. Generally, the data access request includes multiple fields, corresponding to multiple parameters, and the target parameter is part or all of the multiple parameters. In the present embodiment, since the purpose of the data access request is to access the data, the target parameter is set according to the purpose of the data access request, including the target namespace information and the target application information. The target data corresponding to the data access request can be located through the target namespace information and the target application information. In one example, the access path of the target data can be determined by the target namespace and the target application; the access path of the target data can also be determined directly through the parameters of the data access request. For example, the target parameter can also include the access path of the target data. The preset field is usually set according to the actual application scenario. In one example, the identifier of the preset field can be set to include a uniform resource locator (Uniform Resource Locator, abbreviated as URL), and the uniform resource identifier can be used to locate the target data, wherein the uniform resource identifier usually refers to a string used to identify the location resource. In one example, the identifier of the preset field can be obtained by intercepting the field corresponding to the data access request, for example, the wildcard-adapted back-end uniform resource identifier in the field corresponding to the data access request can be intercepted. After obtaining the target parameter and the identifier of the preset field, the format configuration rule corresponding to the container orchestration engine cluster is determined, and the target parameter and the identifier of the preset field are converted into the target format according to the format configuration rule, wherein the target format includes the format accessible within the container orchestration engine cluster. In one example, when performing format conversion, different data access requests can be adapted by preset symbol characters, for example, " / **" is used to adapt all requests. In a possible implementation, when format conversion is performed on the data access request, " / **" is used to adapt all requests through the rules configured by RequestMapping, and the target application information and the target namespace information of the task corresponding to the data access request are obtained by parsing the parameters in the proxy service. The wildcard-adapted back-end URL is obtained by intercepting RequestURL; the obtained target application information, target namespace information, and back-end URL are assembled into a URL accessible within the cluster, thereby realizing the format conversion of the data access request.
[0079] The disclosed embodiments can realize access of external data access requests to internal data of a cluster by converting the target parameters and identifiers corresponding to data access requests into a target format corresponding to a cluster; and because the converted target format is accessible within the cluster, rule configuration and adaptation of all requests are realized, which can be applied to more application scenarios, thereby improving the convenience of data access within the cluster and enhancing the user experience.
[0080] In one embodiment, Figure 5 As shown, sending the converted data access request to the container orchestration engine cluster includes:
[0081] Step S131, obtaining a request category corresponding to the data access request;
[0082] Step S132: Send the converted data access request to the container orchestration engine cluster according to the request sending method corresponding to the request category.
[0083] In the embodiment of the present disclosure, when sending a data access request, the request category corresponding to the data access request is obtained, the request sending method corresponding to the request category is determined, and the converted data access request is sent to the container orchestration engine cluster according to the corresponding request sending method. Among them, when the proxy server performs proxy forwarding, it is necessary to call the corresponding request sending method according to the request category for forwarding. In an example, the request category corresponding to the data access request may include the request method corresponding to the data access request, and the proxy server calls different forwarding methods according to different request methods to forward the request. For example, when the proxy server is an HttpProxy proxy, the request method (Method) corresponding to the obtained data access request is GET, then proxy.get() is executed for proxy forwarding. In an example, the request category may include but is not limited to GET, POST, etc.
[0084] The disclosed embodiment implements proxy forwarding by sending requests according to the request category corresponding to the data access request, and transfers the data access request through the proxy server, thereby ensuring the normal sending of the data access request in the application scenario where the proxy server is deployed, providing the prerequisite for the setting of access rights, and enabling internal access to the cluster through the proxy server, thereby ensuring the security of the data.
[0085] Figure 6 is a schematic diagram of a method for processing a data access request according to an exemplary embodiment, with reference to Figure 6As shown, the user account sends a data access request, and the proxy server performs permission judgment and verification after receiving the data access request. When the permission judgment and verification are passed, the data access request is sent to the dashboard corresponding to the data status monitoring task, and the data status monitoring task and the proxy server are deployed through the preset internal service disclosure mode. In this embodiment, the container orchestration engine cluster includes a Kubernetes cluster, the data status monitoring task includes a Flink real-time computing task, the dashboard corresponding to the data status monitoring task includes a Flink dashboard, and the preset internal service disclosure mode includes a ClusterIP mode. Specifically, first set up the environment, create a Flink real-time computing task to the Kubernetes cluster through the ClusterIP exposure method, and after the task is started normally, an internally accessible Flink dashboard will be generated, and the corresponding cluster internally accessible URL will be obtained; deploy a proxy service in the same Kubernetes cluster, and expose the proxy service in the form of ClusterIP. When processing data access requests, first check permissions to determine the user to whom the account belongs and the relationship between the tasks and whether the user is an administrator or belongs to the same department and role as the task owner. If not, the corresponding scenario is marked as "UNAUTHORIZED", and a message indicating that the user does not have permission is returned. If the request is forwarded to the Flink dashboard in Kubernetes, check whether the corresponding Namespace exists in the cluster. If not, the corresponding scenario is marked as "NO_NAMESPACE", and an exception message is returned. If it exists, continue the process. Check whether the corresponding Flink application exists in the cluster. If not, the corresponding scenario is marked as "NO_DEPLOYMENT", and an exception message is returned. If it exists, continue the process. When forwarding a request, the proxy service calls the corresponding Method according to the Method corresponding to the request for proxy forwarding. In this embodiment, when forwarding a request, the parameters in the request are formatted and reassembled. Specifically, through the rules configured by RequestMapping, " / **" is used to adapt all requests, and the application name and Namespace parameters of the task are obtained by parsing the parameters in the proxy service. The wildcard-adapted suffix URL is obtained by intercepting the RequestURL, and then the application name, Namespace, and suffix URL obtained above are assembled into a URL accessible inside Kubernetes.In an example, the format conversion can be performed according to the following conversion rules. The request before conversion corresponds to "http: / / localhost / flink-dashboard / app / {app} / depart / {depart_namespace} / # / job / a", where "{app}" corresponds to the application name variable and "{depart_namespace}" corresponds to the namespace variable, that is, Namespace, which is obtained after conversion.
[0086] "http: / / {app}-rest.{depart_namespace}:8081 / # / job / a"; in the actual application process, the application name variable and the namespace variable correspond to the obtained application name parameter and Namespace parameter. For example, the received request corresponds to
[0087] "http: / / localhost / flink-dashboard / app / app_name / depart / namespace_name / # / job / a", after format conversion according to the above conversion rules, we get
[0088] "http: / / app_name-rest.namespace_name:8081 / # / job / a".
[0089] The disclosed embodiment, based on the ClusterIP mode, deploys a proxy service within the same Kubernetes cluster, parses the information corresponding to the external request, parses the request parameters, reassembles the internal access link, and forwards all requests to the internal address exposed by ClusterIP; at the same time, completes the verification of user and task access rights before forwarding the request. Through the disclosed embodiment, after service-oriented, it can adapt to Flink tasks under all namespaces; increases user access rights and verification, improves the security of data within the cluster, and can be applied to more application scenarios; and there is no restriction on the Nodeport port, which improves the convenience and efficiency of data access and reduces the workload of data processing; avoids the operation of creating an Ingress for each ClusterIP task, improves the efficiency of data access, and reduces the workload of data processing.
[0090] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the accompanying drawings may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the steps or stages in other steps.
[0091] Based on the same inventive concept, the disclosed embodiment also provides a data access request processing device for implementing the data access request processing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of the one or more data access request processing devices provided below can refer to the limitations of the data access request processing method above, and will not be repeated here.
[0092] In one embodiment, Figure 7 As shown, a data access request processing device 700 is provided, the device is applied to a proxy server, the proxy server is deployed in a container orchestration engine cluster, and a data status monitoring task is set in the container orchestration engine cluster through a preset internal service disclosure mode, and the device includes:
[0093] An acquisition module 710 is used to acquire a data access request and an account number corresponding to the data access request;
[0094] A conversion module 720 is used to convert the format of the data access request into a target format that matches the container orchestration engine cluster, to obtain a converted data access request, if the data access request conforms to the permission information corresponding to the account;
[0095] The sending module 730 is used to send the converted data access request to the container orchestration engine cluster to access the target data through the data status monitoring task.
[0096] In one embodiment, the acquisition module further includes:
[0097] A determination module, used to determine attribute information of the account;
[0098] The judgment module is used to judge whether the data access request complies with the permission information corresponding to the account when the attribute information of the account complies with the preset conditions.
[0099] In one embodiment, the conversion module includes:
[0100] A first acquisition submodule, configured to acquire target data corresponding to the data access request and permission information corresponding to the account, wherein the permission information includes namespace information and accessible application information accessible to the account;
[0101] A second acquisition submodule is used to acquire a target namespace and a target application to which the target data belongs;
[0102] The first conversion submodule is configured to convert the format of the data access request into a target format that matches the container orchestration engine cluster when the target namespace and the target application match the permission information.
[0103] In one embodiment, the conversion module includes:
[0104] A third acquisition submodule is used to acquire a target parameter and an identifier of a preset field corresponding to the data access request, wherein the target parameter includes target namespace information and target application information;
[0105] A first determination submodule, configured to determine a format configuration rule corresponding to the container orchestration engine cluster;
[0106] The second conversion submodule is used to convert the target parameter and the identifier of the preset field into a target format according to the format configuration rule.
[0107] In one embodiment, the sending module includes:
[0108] A fourth acquisition submodule, used to acquire a request category corresponding to the data access request;
[0109] The first sending submodule is configured to send the converted data access request to the container orchestration engine cluster according to a request sending method corresponding to the request category.
[0110] Each module in the above-mentioned data access request processing device can be implemented in whole or in part by software, hardware or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.
[0111] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 8As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as data access requests. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for processing data access requests is implemented.
[0112] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the embodiment of the present disclosure, and does not constitute a limitation on the computer device to which the embodiment of the present disclosure is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.
[0113] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.
[0114] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.
[0115] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.
[0116] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of the present disclosure are all information and data authorized by the user or fully authorized by all parties.
[0117] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the embodiments of the present disclosure can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in the embodiments of the present disclosure may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited thereto. The processor involved in each embodiment provided in the embodiments of the present disclosure may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited thereto.
[0118] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0119] The above-described embodiments only express several implementation methods of the embodiments of the present disclosure, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the patent of the embodiments of the present disclosure. It should be pointed out that, for those of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the embodiments of the present disclosure, and these all belong to the protection scope of the embodiments of the present disclosure. Therefore, the protection scope of the embodiments of the present disclosure shall be subject to the attached claims.
Claims
1. A method for processing a data access request, characterized in that: The method is applied to a proxy server, which is deployed in a container orchestration engine cluster. A data status monitoring task is set in the container orchestration engine cluster through a preset internal service disclosure mode. In the preset internal service disclosure mode, the service is disclosed within the container orchestration engine cluster, and an external data request cannot be directly accessed. The method includes: Obtaining a data access request and an account number corresponding to the data access request; If the data access request complies with the permission information corresponding to the account, convert the format of the data access request into a target format that matches the container orchestration engine cluster to obtain a converted data access request; The converted data access request is sent to the container orchestration engine cluster to access the target data through the data status monitoring task; the sending of the converted data access request to the container orchestration engine cluster includes: sending the converted data access request to the internal address corresponding to the preset internal service disclosure mode.
2. The method according to claim 1, characterized in that After obtaining the data access request and the account number corresponding to the data access request, the method further includes: Determining attribute information of the account; When the attribute information of the account meets the preset condition, it is determined whether the data access request meets the permission information corresponding to the account.
3. The method according to claim 1, characterized in that The step of converting the format of the data access request into a target format that matches the container orchestration engine cluster when the data access request complies with the permission information corresponding to the account includes: Acquire target data corresponding to the data access request and permission information corresponding to the account, wherein the permission information includes namespace information and accessible application information accessible to the account; Acquire a target namespace and a target application to which the target data belongs; In a case where the target namespace and the target application match the permission information, the format of the data access request is converted into a target format that matches the container orchestration engine cluster.
4. The method according to claim 1, characterized in that: The converting the format of the data access request into a target format that matches the container orchestration engine cluster includes: Obtaining a target parameter and an identifier of a preset field corresponding to the data access request, wherein the target parameter includes target namespace information and target application information; Determining a format configuration rule corresponding to the container orchestration engine cluster; The target parameter and the identifier of the preset field are converted into a target format according to the format configuration rule.
5. The method according to claim 1, characterized in that The sending the converted data access request to the container orchestration engine cluster includes: Obtaining a request category corresponding to the data access request; The converted data access request is sent to the container orchestration engine cluster according to a request sending method corresponding to the request category.
6. A data access request processing device, characterized in that: The device is applied to a proxy server, which is deployed in a container orchestration engine cluster. A data status monitoring task is set in the container orchestration engine cluster through a preset internal service disclosure mode. In the preset internal service disclosure mode, the service is disclosed within the container orchestration engine cluster, and an external data request cannot be directly accessed. The device includes: An acquisition module, used to acquire a data access request and an account number corresponding to the data access request; a conversion module, configured to convert the format of the data access request into a target format that matches the container orchestration engine cluster, to obtain a converted data access request, if the data access request conforms to the permission information corresponding to the account; A sending module is used to send the converted data access request to the container orchestration engine cluster to access the target data through the data status monitoring task; the sending of the converted data access request to the container orchestration engine cluster includes: sending the converted data access request to the internal address corresponding to the preset internal service disclosure mode.
7. The device according to claim 6, characterized in that In the acquisition module, it further includes: A determination module, used to determine attribute information of the account; The judgment module is used to judge whether the data access request complies with the permission information corresponding to the account when the attribute information of the account complies with the preset conditions.
8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the processor implements the steps of the method for processing a data access request according to any one of claims 1 to 5.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for processing a data access request according to any one of claims 1 to 5 are implemented.
10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method for processing a data access request according to any one of claims 1 to 5 are implemented.