Method and apparatus for resource control of multi-cluster namespace

Abstract

The application discloses a resource control method and device for multiple clusters of namespaces, which can be applied to the fields of cloud computing, big data, intelligent supply chain and the like. A specific embodiment of the method comprises: obtaining a namespace processing request of a target user, the namespace processing request being used for requesting to process resource data corresponding to a target namespace from a target cluster in multiple container orchestration engine clusters; verifying the namespace processing request according to a relationship data model through a master cluster in the multiple container orchestration engine clusters, the relationship data model representing a corresponding relationship between an existing namespace in the multiple container orchestration engine clusters, a creating user and a cluster to which the creating user belongs; and in response to the verification being passed, processing the resource data corresponding to the target namespace from the target cluster according to the namespace processing request. In the application, resource management control of the namespaces in the multiple container orchestration engine clusters is realized, and consistency of resource control permissions in the multiple engine clusters is ensured.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to container orchestration engine technology, and more particularly to a method, apparatus, computer-readable medium, and electronic device for resource control of namespaces in a multi-cluster environment. Background Technology

[0002] In existing technologies, Kubernetes clusters provide services for dividing resources within a namespace into isolated groups, and also provide namespace access control services for user accounts or service accounts. For example, a Role object can only be used to grant access permissions to resources within a single namespace. However, currently, there is no effective technical solution to achieve namespace resource control across multiple clusters. Summary of the Invention

[0003] This application provides a method, apparatus, computer-readable medium, and electronic device for resource control of namespaces in a multi-cluster environment.

[0004] In a first aspect, embodiments of this application provide a resource control method for namespaces in multiple clusters, comprising: obtaining a namespace processing request from a target user, wherein the namespace processing request is used to request the processing of resource data corresponding to a target namespace from a target cluster among multiple container orchestration engine clusters; verifying the namespace processing request through a master cluster among multiple container orchestration engine clusters based on a relational data model, wherein the relational data model is used to characterize the correspondence between existing namespaces in multiple container orchestration engine clusters, the namespace creator user, and the container orchestration engine cluster to which the namespace belongs; and in response to determining that the master cluster verification is successful, processing the resource data corresponding to the target namespace from the target cluster according to the namespace processing request.

[0005] In some examples, the namespace processing request is a namespace creation request, and the above-mentioned verification of the namespace processing request based on the relational data model through the master cluster in multiple container orchestration engine clusters includes: determining, through the master cluster, whether the relational data model includes a target correspondence related to the target namespace, or, based on the fact that the relational data model includes a target correspondence related to the target namespace, whether the creation user in the target correspondence is consistent with the target user, and whether the container orchestration engine cluster in the target correspondence is consistent with the target cluster.

[0006] In some examples, the above response to determining that the primary cluster verification is successful, processing resource data corresponding to the target namespace from the target cluster according to the namespace processing request, includes: in response to determining through the primary cluster that the relational data model does not include the target correspondence related to the target namespace, or that the relational data model includes the target correspondence related to the target namespace, the creating user in the target correspondence is consistent with the target user, and the container orchestration engine cluster in the target correspondence is inconsistent with the target cluster, creating the target namespace from the target cluster according to the namespace creation request, and allocating resource data to the target namespace.

[0007] In some examples, the above method also includes updating the relational data model based on the target namespace created by the target user in the target cluster.

[0008] In some examples, the namespace processing request is a namespace deletion request, and the above-mentioned verification of the namespace processing request based on the relational data model through the master cluster in multiple container orchestration engine clusters includes: determining, through the master cluster, whether the target correspondence related to the target namespace in the relational data model is consistent with the correspondence between the target namespace, target user and target cluster represented by the namespace deletion request.

[0009] In some examples, the above response to determining that the primary cluster verification is successful, processing the resource data corresponding to the target namespace from the target cluster according to the namespace processing request, includes: in response to determining through the primary cluster the target correspondence related to the target namespace in the relational data model, which is consistent with the correspondence between the target namespace, target user, and target cluster represented by the namespace deletion request, deleting the target namespace from the target cluster according to the namespace deletion request.

[0010] In some examples, the above method also includes: deleting the correspondence between the target namespace, target user, and target cluster in the relational data model.

[0011] Secondly, embodiments of this application provide a resource control device for namespaces in multiple clusters, comprising: an acquisition unit configured to acquire a namespace processing request from a target user, wherein the namespace processing request requests processing of resource data corresponding to a target namespace from a target cluster among multiple container orchestration engine clusters; a verification unit configured to verify the namespace processing request through a master cluster among multiple container orchestration engine clusters based on a relational data model, wherein the relational data model represents the correspondence between existing namespaces in multiple container orchestration engine clusters, the namespace creator, and the container orchestration engine cluster to which the namespace belongs; and a processing unit configured to, in response to determining that the master cluster verification is successful, process the resource data corresponding to the target namespace from the target cluster according to the namespace processing request.

[0012] In some examples, the namespace processing request is a namespace creation request, and the aforementioned verification unit is further configured to: determine, through the main cluster, whether the relational data model includes a target correspondence related to the target namespace, or, based on the inclusion of a target correspondence related to the target namespace in the relational data model, whether the creating user in the target correspondence is consistent with the target user, and whether the container orchestration engine cluster in the target correspondence is consistent with the target cluster.

[0013] In some examples, the aforementioned processing unit is further configured to: in response to determining through the primary cluster that the relational data model does not include the target mapping related to the target namespace, or based on the fact that the target mapping includes the target mapping related to the target namespace in the relational data model, the creating user in the target mapping is consistent with the target user, and the container orchestration engine cluster in the target mapping is inconsistent with the target cluster, create the target namespace from the target cluster according to the namespace creation request, and allocate resource data for the target namespace.

[0014] In some examples, the above apparatus further includes an update unit configured to update the relational data model based on the target namespace created by the target user in the target cluster.

[0015] In some examples, the namespace processing request is a namespace deletion request, and the aforementioned verification unit is further configured to: determine, through the main cluster, whether the target correspondence in the relational data model related to the target namespace is consistent with the correspondence between the target namespace, target user, and target cluster represented by the namespace deletion request.

[0016] In some examples, the aforementioned processing unit is further configured to: in response to determining, through the primary cluster, the target correspondence related to the target namespace in the relational data model, which is consistent with the correspondence between the target namespace, target user, and target cluster represented by the namespace deletion request, delete the target namespace from the target cluster according to the namespace deletion request.

[0017] In some examples, the above apparatus further includes a deletion unit configured to delete the correspondence between the target namespace, the target user, and the target cluster in the relational data model.

[0018] Thirdly, embodiments of this application provide a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, it implements the method as described in any implementation of the first aspect.

[0019] Fourthly, embodiments of this application provide an electronic device, including: one or more processors; and a storage device storing one or more programs thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation of the first aspect.

[0020] The resource control method and apparatus for namespaces in multiple clusters provided in this application obtains a namespace processing request from a target user, wherein the namespace processing request requests the processing of resource data corresponding to a target namespace from a target cluster among multiple container orchestration engine clusters; the namespace processing request is verified by the master cluster among the multiple container orchestration engine clusters according to a relational data model, wherein the relational data model is used to represent the correspondence between existing namespaces, namespace creators, and the container orchestration engine clusters to which the namespaces belong in the multiple container orchestration engine clusters; in response to determining that the master cluster verification is successful, the resource data corresponding to the target namespace is processed from the target cluster according to the namespace processing request, thereby managing multiple container orchestration engine clusters in a federated manner based on the relational data model, realizing resource management and control of namespaces in multiple container orchestration engine clusters, ensuring the consistency of resource control permissions in multiple container orchestration engine clusters, and improving the availability and applicability of namespaces in multi-cluster scenarios. Attached Figure Description

[0021] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0022] Figure 1 This is an exemplary system architecture diagram in which one embodiment of this application can be applied;

[0023] Figure 2This is a flowchart of an embodiment of the multi-cluster namespace resource control method according to this application;

[0024] Figure 3 This is a schematic diagram illustrating an application scenario of the multi-cluster namespace resource control method according to this embodiment;

[0025] Figure 4 This is a flowchart of yet another embodiment of the multi-cluster namespace resource control method according to this application;

[0026] Figure 5 This is a flowchart of yet another embodiment of the multi-cluster namespace resource control method according to this application;

[0027] Figure 6 This is a flowchart of a specific embodiment of the multi-cluster namespace resource control method according to this application;

[0028] Figure 7 This is a schematic diagram of an example according to this application;

[0029] Figure 8 This is a structural diagram of one embodiment of the multi-cluster namespace resource control device according to this application;

[0030] Figure 9 This is a schematic diagram of the structure of a computer system suitable for implementing the embodiments of this application. Detailed Implementation

[0031] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0032] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0033] Figure 1 An exemplary architecture 100 of the resource control method and apparatus for namespaces of multiple clusters that can be applied according to this application is shown.

[0034] like Figure 1As shown, the system architecture 100 may include terminal devices 101, 102, and 103, a network 104, and a server 105. The communication connections between terminal devices 101, 102, and 103 form a network topology. Network 104 serves as the medium for providing communication links between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables, etc.

[0035] Users can use terminal devices 101, 102, and 103 to interact with the container orchestration engine deployed in server 105 via network 104 to receive or send messages, etc. Terminal devices 101, 102, and 103 can be hardware or software that supports network connectivity for data interaction and processing. When terminal devices 101, 102, and 103 are hardware, they can be various electronic devices that support network connectivity, information acquisition, interaction, display, and processing functions, including but not limited to smartphones, tablets, e-book readers, laptops, and desktop computers. When terminal devices 101, 102, and 103 are software, they can be installed in the aforementioned electronic devices. They can be implemented as multiple software programs or software modules, for example, to provide distributed services, or as a single software program or software module. No specific limitations are made here.

[0036] Server 105 can be a server providing various services. For example, in response to namespace processing requests received from terminal devices 101, 102, and 103, it manages multiple container orchestration engine clusters in a federated manner based on a relational data model. This enables resource management and control of namespaces across multiple container orchestration engine clusters, ensuring consistency of resource control permissions. The relational data model represents the correspondence between existing namespaces, namespace creators, and the container orchestration engine clusters to which the namespaces belong. As an example, server 105 could be a cloud server.

[0037] It should be noted that a server can be either hardware or software. When the server is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or as a single server. When the server is software, it can be implemented as multiple software programs or software modules (such as software programs or software modules used to provide distributed services), or as a single software program or software module. No specific limitations are made here.

[0038] It should also be noted that the multi-cluster namespace resource control method provided in the embodiments of this application can be executed by a server, by a terminal device, or by a combination of both. Correspondingly, the various parts (e.g., units) of the multi-cluster namespace resource control device can be entirely located in the server, entirely located in the terminal device, or separately located in the server and the terminal device.

[0039] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Any number of terminal devices, networks, and servers can be included depending on implementation needs. When the electronic devices on which the multi-cluster namespace resource control method runs do not need to transmit data with other electronic devices, the system architecture may consist only of the electronic devices (e.g., servers or terminal devices) on which the multi-cluster namespace resource control method runs.

[0040] Continue to refer to Figure 2 The flowchart 200 illustrates an embodiment of a resource control method for namespaces in a multi-cluster architecture, including the following steps:

[0041] Step 201: Obtain the target user's namespace processing request.

[0042] In this embodiment, the execution entity of the multi-cluster namespace resource control method (e.g.) Figure 1 The terminal device or server in the container orchestration engine cluster can obtain the namespace processing request from the target user. The namespace processing request is used to request the processing of resource data corresponding to the target namespace from the target cluster within multiple container orchestration engine clusters.

[0043] As an example, a namespace processing request is a namespace creation request. A namespace creation request is used to request the creation of a namespace in a target cluster among multiple container orchestration engine clusters. The namespace creation request includes information such as the namespace to be created (i.e., the target namespace), the user who created the namespace (i.e., the target user), and the container orchestration engine cluster in which the namespace is created (i.e., the target cluster among multiple container orchestration engine clusters).

[0044] As another example, the namespace processing request is a namespace deletion request. A namespace deletion request is used to request the deletion of a namespace in a target cluster across multiple container orchestration engine clusters. The namespace creation request includes information such as the namespace to be deleted (i.e., the target namespace), the user deleting the namespace (i.e., the target user), and the container orchestration engine cluster from which the namespace is to be deleted (i.e., the target cluster among multiple container orchestration engine clusters).

[0045] In this embodiment, the container orchestration engine is an engine for deploying applications based on containerization technology, such as Kubernetes, Docker, etc.

[0046] Step 202: Verify namespace processing requests based on the relational data model through the master cluster in multiple container orchestration engine clusters.

[0047] In this embodiment, the aforementioned execution entity can verify namespace processing requests through the master cluster in multiple container orchestration engine clusters, based on a relational data model. The relational data model represents the correspondence between existing namespaces in the multiple container orchestration engine clusters, the users who created the namespaces, and the container orchestration engine clusters to which the namespaces belong.

[0048] Based on a preset determination method, the aforementioned execution entity can pre-determine the primary cluster from multiple container orchestration engine clusters. As an example, the execution entity can determine the container orchestration engine cluster indicated by a received primary cluster selection instruction from a user (e.g., an operator of the container orchestration engine cluster) as the primary cluster. As another example, the execution entity can employ an election method, with each of the multiple container orchestration engine clusters voting to determine the primary cluster based on the number of votes received from each cluster.

[0049] The primary cluster contains a relational data model representing the correspondence between existing namespaces, namespace creators, and the container orchestration engine clusters to which the namespaces belong across multiple container orchestration engine clusters. Taking a Kubernetes cluster as an example, the aforementioned execution entity can use Kubernetes' CRD (Custom Resource Define) extension pattern to define a relational data model to describe the correspondence between existing namespaces, namespace creators, and the container orchestration engine clusters to which the namespaces belong across multiple container orchestration engine clusters.

[0050] In this embodiment, the aforementioned execution entity can verify whether the correspondence carried in the namespace processing request exists in the relational data model based on the correspondence included in the relational data model. Specifically, the correspondence carried in the namespace processing request is the correspondence between the target namespace, target user, and target cluster within the namespace processing request.

[0051] In some optional implementations of this embodiment, when the namespace processing request is a namespace creation request, the above-mentioned execution entity can perform the above step 202 in the following manner: through the main cluster, determine whether the relational data model includes a target correspondence related to the target namespace, or, based on the fact that the relational data model includes a target correspondence related to the target namespace, whether the creation user in the target correspondence is consistent with the target user, and whether the container orchestration engine cluster in the target correspondence is consistent with the target cluster.

[0052] If the relational data model includes a target mapping related to the target namespace, it indicates that a namespace with the same name as the target namespace already exists in multiple container orchestration engine clusters; otherwise, it indicates that a namespace with the same name as the target namespace does not exist in multiple container orchestration engine clusters.

[0053] The target mapping relationship related to the target namespace includes the target namespace itself. Based on the target mapping relationship related to the target namespace in the relational data model, if the creating user in the target mapping relationship is the same as the target user, but the container orchestration engine cluster in the target mapping relationship is different from the target cluster, it indicates that the creating user of the target namespace created the target namespace in another container orchestration engine cluster.

[0054] As an example, the relational data model includes the mapping "User U—Namespace a—Container Orchestration Engine Cluster A," indicating that User U has created namespace a in container orchestration engine cluster A. The aforementioned execution entity then receives another namespace creation request from User U, which includes the mapping "User U—Namespace a—Container Orchestration Engine Cluster B." During the verification process, the target mapping "User U—Namespace a—Container Orchestration Engine Cluster A" related to namespace a in the namespace creation request is determined in the relational data model. Based on this, it is verified that the creating user "User U" in the target mapping is consistent with the target user "User U," and that "Container Orchestration Engine Cluster A" in the target mapping is inconsistent with the target cluster "Container Orchestration Engine Cluster B."

[0055] In this implementation, the verification points for namespace creation requests are clearly defined, which improves the targeting of namespace creation requests during the verification process, as well as the efficiency and accuracy of information processing.

[0056] In some optional implementations of this embodiment, when the namespace processing request is a namespace deletion request, the above-mentioned execution entity can perform the above step 202 in the following way: through the main cluster, determine whether the target correspondence related to the target namespace in the relational data model is consistent with the correspondence between the target namespace, target user and target cluster represented by the namespace deletion request.

[0057] When the correspondence between the target namespace, target user, and target cluster represented by the namespace deletion request is consistent with the target correspondence in the relational data model, it indicates that the target user has the permission to process the namespace corresponding to the target correspondence according to the namespace deletion request, and the main cluster verifies the namespace deletion request; otherwise, it indicates that the target user does not have the permission to process the namespace corresponding to the target correspondence according to the namespace deletion request, and the main cluster fails to verify the namespace deletion request.

[0058] In this implementation, the verification points for namespace deletion requests are clearly defined, which improves the targeting of namespace deletion requests during the verification process, as well as the efficiency and accuracy of the information processing.

[0059] Step 203: In response to the confirmation that the primary cluster has passed verification, process the resource data corresponding to the target namespace from the target cluster according to the namespace processing request.

[0060] In this embodiment, the aforementioned execution entity can, in response to the determination that the main cluster verification has passed, process the resource data corresponding to the target namespace from the target cluster according to the namespace processing request.

[0061] A namespace processing request represents a target user's request to process resource data corresponding to a target namespace from a target cluster in multiple container orchestration engine clusters. When the namespace processing request is verified, the aforementioned execution entity can process the resource data corresponding to the target namespace from the target cluster according to the namespace processing request.

[0062] As an example, the aforementioned execution entity can listen to Namespace events (such as creation and deletion) of the current Kubernetes cluster through an Operator (permission controller) in Kubernetes, and assign Namespace resource operation permissions to the target user's account in the cluster, such as creating Role and RoleBinding resources.

[0063] In some optional implementations of this embodiment, when the namespace processing request is a namespace creation request, the execution entity can perform step 203 as follows: in response to determining through the main cluster that the relational data model does not include the target correspondence related to the target namespace, or based on the relational data model including the target correspondence related to the target namespace, the creation user in the target correspondence is consistent with the target user, and the container orchestration engine cluster in the target correspondence is inconsistent with the target cluster, the target namespace is created from the target cluster according to the namespace creation request, and resource data is allocated to the target namespace.

[0064] In this implementation, if the relational data model does not include the target correspondence related to the target namespace, or if the target correspondence related to the target namespace included in the relational data model indicates that the cluster to which the target namespace previously created by the target user belongs is different from the cluster to which the target namespace currently to be created by the target user belongs, it indicates that the namespace creation request has been verified, and the aforementioned execution entity can create the target namespace from the target cluster and allocate resource data to the target namespace.

[0065] In this implementation, the verification conditions for namespace creation requests are clearly defined, which helps to improve the efficiency and accuracy of the resource allocation process.

[0066] For namespace creation requests, after verifying the namespace creation request and processing the corresponding resources, the aforementioned execution entity can also perform the following operations: update the relational data model based on the target namespace created by the target user in the target cluster.

[0067] As an example, the aforementioned execution entity can add the correspondence between "target user - target namespace - target cluster" to the relational data model.

[0068] In this implementation, the real-time updating of the relational data model improves the comprehensiveness of the relational data in the relational data model, which helps to improve the accuracy of the verification process for namespace processing requests.

[0069] In some optional implementations of this embodiment, when the namespace processing request is a namespace deletion request, the above-mentioned execution entity can perform the above step 203 in the following manner: in response to determining the target correspondence related to the target namespace in the relational data model through the main cluster, which is consistent with the correspondence between the target namespace, target user and target cluster represented by the namespace deletion request, the target namespace is deleted from the target cluster according to the namespace deletion request.

[0070] In this implementation, the user deleting the namespace only has the permission to delete the namespace if the user who created the namespace is also the user who deleted it.

[0071] In this implementation, the verification conditions for namespace deletion requests are clearly defined, which helps to improve the efficiency and accuracy of the resource deletion process.

[0072] In response to a namespace deletion request, after the aforementioned execution entity verifies the namespace deletion request and performs the corresponding processing, the aforementioned execution entity can also perform the following operation: delete the correspondence between the target namespace, the target user, and the target cluster in the relational data model.

[0073] In this implementation, the real-time updating of the relational data model improves the timeliness of relational data in the relational data model, which helps to improve the accuracy of the verification process for namespace processing requests.

[0074] See also Figure 3 , Figure 3 This is a schematic diagram 300 illustrating an application scenario of the multi-cluster namespace resource control method according to this embodiment. Figure 3 In this application scenario, multiple container orchestration engine clusters 301, 302, and 303 provide application support services to numerous users. The master cluster 303 within these clusters has a relational data model 304. This model represents the correspondence between existing namespaces, namespace creators, and the respective container orchestration engine clusters within the clusters. Each cluster retrieves a namespace processing request from a target user and reports it to the master cluster. This request requests the processing of resource data corresponding to a target namespace from the target cluster. The master cluster verifies the namespace processing request based on the relational data model. Upon successful verification by the master cluster, the master cluster processes the resource data corresponding to the target namespace from the target cluster according to the request.

[0075] The method provided in the above embodiments of this application obtains a namespace processing request from a target user, wherein the namespace processing request requests the processing of resource data corresponding to a target namespace from a target cluster among multiple container orchestration engine clusters; verifies the namespace processing request through a relational data model in the master cluster among multiple container orchestration engine clusters, wherein the relational data model represents the correspondence between existing namespaces, namespace creators, and the container orchestration engine clusters to which the namespaces belong in multiple container orchestration engine clusters; in response to determining that the master cluster verification is successful, the resource data corresponding to the target namespace is processed from the target cluster according to the namespace processing request, thereby managing multiple container orchestration engine clusters in a federated manner based on the relational data model, realizing resource management and control of namespaces in multiple container orchestration engine clusters, ensuring the consistency of resource control permissions in multiple container orchestration engine clusters, and improving the availability and applicability of namespaces in multi-cluster scenarios.

[0076] Continue to refer to Figure 4 The illustration shows a schematic flow 400 of an embodiment of a multi-cluster namespace resource control method according to this application, including the following steps:

[0077] Step 401: Obtain the target user's namespace creation request.

[0078] The namespace creation request is used to request the creation of a target namespace from a target cluster in multiple container orchestration engine clusters.

[0079] Step 402: Through the master cluster in multiple container orchestration engine clusters, determine whether the relational data model includes a target correspondence related to the target namespace, or, based on the fact that the relational data model includes a target correspondence related to the target namespace, whether the creating user in the target correspondence is consistent with the target user, and whether the container orchestration engine cluster in the target correspondence is consistent with the target cluster.

[0080] The relational data model is used to characterize the correspondence between existing namespaces in multiple container orchestration engine clusters, the users who created the namespaces, and the container orchestration engine clusters to which the namespaces belong.

[0081] Step 403: In response to determining through the primary cluster that the relational data model does not include the target correspondence related to the target namespace, or based on the fact that the relational data model includes the target correspondence related to the target namespace, the creation user in the target correspondence is consistent with the target user, and the container orchestration engine cluster in the target correspondence is inconsistent with the target cluster, the target namespace is created from the target cluster according to the namespace creation request, and resource data is allocated to the target namespace.

[0082] Step 404: Update the relational data model based on the target namespace created by the target user in the target cluster.

[0083] As can be seen from this embodiment, with Figure 2 Compared with the corresponding embodiments, the process 800 of the multi-cluster namespace resource control method in this embodiment specifically illustrates the namespace creation process and the relational data model update process in a multi-cluster scenario. It realizes the resource management and control of namespaces in multiple container orchestration engine clusters, ensures the consistency of resource control permissions in multiple container orchestration engine clusters, and improves the availability and applicability of namespaces in multi-cluster scenarios.

[0084] Continue to refer to Figure 5 The illustration shows a schematic flow 500 of an embodiment of a multi-cluster namespace resource control method according to this application, including the following steps:

[0085] Step 501: Obtain the target user's namespace deletion request.

[0086] The namespace deletion request is used to request the deletion of a target namespace from a target cluster in multiple container orchestration engine clusters.

[0087] Step 502: Through the master cluster in multiple container orchestration engine clusters, determine whether the target correspondence in the relational data model related to the target namespace is consistent with the correspondence between the target namespace, target user and target cluster represented by the namespace deletion request.

[0088] The relational data model is used to characterize the correspondence between existing namespaces in multiple container orchestration engine clusters, the users who created the namespaces, and the container orchestration engine clusters to which the namespaces belong.

[0089] Step 503: In response to determining the target correspondence related to the target namespace in the relational data model through the main cluster, which is consistent with the correspondence between the target namespace, target user, and target cluster represented by the namespace deletion request, the target namespace is deleted from the target cluster according to the namespace deletion request.

[0090] Step 504: Delete the correspondence between the target namespace, target user, and target cluster in the relational data model.

[0091] As can be seen from this embodiment, with Figure 2Compared with the corresponding embodiments, the process 500 of the multi-cluster namespace resource control method in this embodiment specifically illustrates the namespace deletion process and the relational data model update process in a multi-cluster scenario. This realizes the resource management and control of namespaces in multiple container orchestration engine clusters, ensures the consistency of resource control permissions in multiple container orchestration engine clusters, and improves the availability and applicability of namespaces in multi-cluster scenarios.

[0092] Continue to refer to Figure 6 To further illustrate the resource control method for namespaces in multi-cluster architectures, the following specific implementation example 600 is provided:

[0093] 1. For each cluster in a multi-container orchestration engine cluster, the Kube-apiserver component can receive namespace processing requests from the users it serves. Namespace processing requests can be namespace creation requests or namespace deletion requests.

[0094] 2. The container orchestration engine cluster intercepts namespace processing requests via webhooks and reports these requests to the master cluster among multiple container orchestration engine clusters. The master cluster verifies the namespace processing requests using a relational data model.

[0095] 3. The primary cluster determines the verification result and feeds it back to the container orchestration engine cluster corresponding to the namespace processing request. Specifically, for a namespace creation request, verification passes if the primary cluster determines that the relational data model does not include the target mapping related to the target namespace, or if the relational data model includes the target mapping related to the target namespace, the creating user in the target mapping matches the target user, and the container orchestration engine cluster in the target mapping is different from the target cluster. For a namespace deletion request, verification passes if the primary cluster determines that the target mapping related to the target namespace in the relational data model matches the mapping between the target namespace, target user, and target cluster represented by the namespace deletion request.

[0096] 4. The container orchestration engine cluster listens to the Namespace event of the current cluster through an Operator (access controller). When a namespace processing request is verified, the resources of the target namespace are processed for the target user in the target cluster corresponding to the namespace processing request, such as creating Role and RoleBinding resources. Related data in the container orchestration engine cluster is stored in the ETCD storage system.

[0097] Continue to refer to Figure 7 The diagram shows an example 700 of a namespace creation request.

[0098] Namespace creation request 1 for the cicd account: Create the namespace ns-cicd in Kubernetes cluster A. Since the namespace ns-cicd does not exist in multiple Kubernetes clusters, the cicd account can successfully create the namespace ns-cicd in cluster A and assign the corresponding resource permissions to this namespace.

[0099] Namespace creation request 2 for the cicd account: Create the namespace ns-cicd in Kubernetes cluster N (not Kubernetes cluster A). The namespace ns-cicd has already been used by the cicd account in cluster A. The cicd account can successfully create the namespace ns-cicd in cluster N and allocate resource permissions for this namespace ns-cicd in cluster N.

[0100] Namespace creation request 3 for the trade account: Create namespace ns-cicd in Kubernetes cluster A. Because namespace ns-cicd is already in use by a user other than the current account (cicd), the trade account cannot successfully create namespace ns-cicd in cluster A.

[0101] Namespace creation request 4 for the trade account: Create namespace ns-cicd in Kubernetes cluster N. Because namespace ns-cicd is already in use by a non-current account (cicd) in Kubernetes cluster N, the trade account cannot successfully create namespace ns-cicd in cluster N.

[0102] Continue to refer to Figure 8 As an implementation of the methods shown in the above figures, this application provides an embodiment of a resource control device for a multi-cluster namespace, which is similar to... Figure 2 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0103] like Figure 8As shown, the multi-cluster namespace resource control device includes: an acquisition unit 801, configured to acquire a namespace processing request from a target user, wherein the namespace processing request is used to request the processing of resource data corresponding to a target namespace from a target cluster among multiple container orchestration engine clusters; a verification unit 802, configured to verify the namespace processing request through a master cluster among multiple container orchestration engine clusters according to a relational data model, wherein the relational data model is used to characterize the correspondence between existing namespaces in multiple container orchestration engine clusters, the namespace creator user, and the container orchestration engine cluster to which the namespace belongs; and a processing unit 803, configured to, in response to determining that the master cluster verification is successful, process the resource data corresponding to the target namespace from the target cluster according to the namespace processing request.

[0104] In some optional implementations of this embodiment, the namespace processing request is a namespace creation request, and the verification unit 802 described above is further configured to: determine, through the main cluster, whether the relational data model includes a target correspondence related to the target namespace, or, based on the fact that the relational data model includes a target correspondence related to the target namespace, whether the creating user in the target correspondence is consistent with the target user, and whether the container orchestration engine cluster in the target correspondence is consistent with the target cluster.

[0105] In some optional implementations of this embodiment, the processing unit 803 is further configured to: in response to determining through the main cluster that the relational data model does not include the target correspondence related to the target namespace, or based on the relational data model including the target correspondence related to the target namespace, the creating user in the target correspondence is consistent with the target user, and the container orchestration engine cluster in the target correspondence is inconsistent with the target cluster, create the target namespace from the target cluster according to the namespace creation request, and allocate resource data for the target namespace.

[0106] In some optional implementations of this embodiment, the above apparatus further includes: an update unit (not shown in the figure), configured to update the relational data model based on the target namespace created by the target user in the target cluster.

[0107] In some optional implementations of this embodiment, the namespace processing request is a namespace deletion request, and the verification unit 802 is further configured to: determine, through the main cluster, whether the target correspondence related to the target namespace in the relational data model is consistent with the correspondence between the target namespace, target user and target cluster represented by the namespace deletion request.

[0108] In some optional implementations of this embodiment, the processing unit 803 is further configured to: in response to determining, through the main cluster, the target correspondence related to the target namespace in the relational data model is consistent with the correspondence between the target namespace, target user and target cluster represented by the namespace deletion request, and delete the target namespace from the target cluster according to the namespace deletion request.

[0109] In some optional implementations of this embodiment, the above apparatus further includes: a deletion unit (not shown in the figure), configured to delete the correspondence between the target namespace, the target user, and the target cluster in the relational data model.

[0110] In this embodiment, the acquisition unit in the multi-cluster namespace resource control device acquires the namespace processing request of the target user. The namespace processing request requests the processing of resource data corresponding to the target namespace from the target cluster among multiple container orchestration engine clusters. The verification unit verifies the namespace processing request through the master cluster among multiple container orchestration engine clusters based on a relational data model. The relational data model represents the correspondence between existing namespaces, namespace creators, and the container orchestration engine clusters to which the namespaces belong. In response to confirming that the master cluster verification is successful, the processing unit processes the resource data corresponding to the target namespace from the target cluster according to the namespace processing request. Thus, based on the relational data model, multiple container orchestration engine clusters are managed in a federated manner, realizing resource management and control of namespaces in multiple container orchestration engine clusters, ensuring the consistency of resource control permissions in multiple container orchestration engine clusters, and improving the availability and applicability of namespaces in multi-cluster scenarios.

[0111] The following is for reference. Figure 9 It illustrates a device suitable for implementing embodiments of this application (e.g., Figure 1 The diagram shows the structure of the computer system 900 of the devices 101, 102, 103, and 105. Figure 9 The device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0112] like Figure 9As shown, the computer system 900 includes a processor (e.g., CPU, Central Processing Unit) 901, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 902 or programs loaded from storage section 908 into random access memory (RAM) 903. The RAM 903 also stores various programs and data required for the operation of the system 900. The processor 901, ROM 902, and RAM 903 are interconnected via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0113] The following components are connected to I / O interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to I / O interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 910 as needed so that computer programs read from it can be installed into storage section 908 as needed.

[0114] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 909, and / or installed from removable medium 911. When the computer program is executed by processor 901, it performs the functions defined in the methods of this application.

[0115] It should be noted that the computer-readable medium of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0116] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—as well as conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the client computer, partially on the client computer, as a standalone software package, partially on the client computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the client computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0117] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0118] The units described in the embodiments of this application can be implemented in software or hardware. The described units can also be located in a processor; for example, they can be described as: a processor including an acquisition unit, a verification unit, and a processing unit. The names of these units do not necessarily limit the unit itself. For example, the verification unit can also be described as "a unit that verifies namespace processing requests based on a relational data model through the master cluster in multiple container orchestration engine clusters, wherein the relational data model is used to characterize the correspondence between existing namespaces in multiple container orchestration engine clusters, the namespace creator, and the container orchestration engine cluster to which the namespace belongs."

[0119] In another aspect, this application also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs, which, when executed by the device, cause the computer device to: obtain a namespace processing request from a target user, wherein the namespace processing request requests processing of resource data corresponding to a target namespace from a target cluster among multiple container orchestration engine clusters; verify the namespace processing request according to a relational data model through the master cluster among the multiple container orchestration engine clusters, wherein the relational data model characterizes the correspondence between existing namespaces in the multiple container orchestration engine clusters, the namespace creator user, and the container orchestration engine cluster to which the namespace belongs; and, in response to determining that the master cluster verification is successful, process the resource data corresponding to the target namespace from the target cluster according to the namespace processing request.

[0120] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A resource control method for namespaces in a multi-cluster environment, comprising: Obtain the namespace processing request of the target user, wherein the namespace processing request is used to request the processing of resource data corresponding to the target namespace from the target cluster in multiple container orchestration engine clusters; By using the master cluster among the multiple container orchestration engine clusters, it is verified whether the correspondence between the target namespace, the target user, and the target cluster in the namespace processing request exists in the relational data model. The relational data model is used to characterize the correspondence between the existing namespaces, the namespace creation users, and the container orchestration engine clusters to which the namespaces belong in the multiple container orchestration engine clusters. In response to the determination that the primary cluster verification is successful, the resource data corresponding to the target namespace is processed from the target cluster according to the namespace processing request.

2. The method according to claim 1, wherein, The namespace processing request is a namespace creation request, and The step of verifying the namespace processing request based on a relational data model through the master cluster in the plurality of container orchestration engine clusters includes: Through the main cluster, determine whether the relational data model includes a target correspondence related to the target namespace, or, based on the fact that the relational data model includes a target correspondence related to the target namespace, whether the creating user in the target correspondence is consistent with the target user, and whether the container orchestration engine cluster in the target correspondence is consistent with the target cluster. The target correspondence is a correspondence that includes the target namespace.

3. The method according to claim 2, wherein, In response to determining that the primary cluster verification has passed, the step of processing the resource data corresponding to the target namespace from the target cluster according to the namespace processing request includes: In response to determining through the primary cluster that the relational data model does not include target correspondences related to the target namespace, or based on the relational data model including target correspondences related to the target namespace, the creating user in the target correspondence is consistent with the target user, and the container orchestration engine cluster in the target correspondence is inconsistent with the target cluster, the target namespace is created from the target cluster according to the namespace creation request, and resource data is allocated to the target namespace.

4. The method according to claim 3, wherein, Also includes: Update the relational data model based on the target namespace created by the target user in the target cluster.

5. The method according to claim 1, wherein, The namespace processing request is a namespace deletion request, and The step of verifying the namespace processing request based on a relational data model through the master cluster in the plurality of container orchestration engine clusters includes: Through the main cluster, determine whether the target correspondence relationship related to the target namespace in the relational data model is consistent with the correspondence relationship between the target namespace, the target user, and the target cluster represented by the namespace deletion request. The target correspondence relationship includes the correspondence relationship of the target namespace.

6. The method according to claim 5, wherein, In response to determining that the primary cluster verification has passed, the step of processing the resource data corresponding to the target namespace from the target cluster according to the namespace processing request includes: In response to determining the target correspondence related to the target namespace in the relational data model through the primary cluster, and finding that it is consistent with the correspondence between the target namespace, the target user, and the target cluster represented by the namespace deletion request, the target namespace is deleted from the target cluster according to the namespace deletion request.

7. The method according to claim 6, wherein, Also includes: Delete the correspondence between the target namespace, the target user, and the target cluster in the relational data model.

8. A resource control device for a multi-cluster namespace, comprising: The acquisition unit is configured to acquire the namespace processing request of the target user, wherein the namespace processing request is used to request the processing of resource data corresponding to the target namespace from the target cluster in multiple container orchestration engine clusters; The verification unit is configured to verify, through the master cluster among the plurality of container orchestration engine clusters, whether the correspondence between the target namespace, the target user, and the target cluster in the namespace processing request exists in the relational data model, wherein the relational data model is used to characterize the correspondence between the existing namespaces, the namespace creation users, and the container orchestration engine clusters to which the namespaces belong in the plurality of container orchestration engine clusters. The processing unit is configured to, in response to determining that the primary cluster verification has passed, process the resource data corresponding to the target namespace from the target cluster according to the namespace processing request.

9. A computer-readable medium having a computer program stored thereon, wherein, When the program is executed by the processor, it implements the method as described in any one of claims 1-7.

10. An electronic device, comprising: One or more processors; Storage device, on which one or more programs are stored, When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-7.

Images