Resource access method, apparatus, device, and computer storage medium

Abstract

The application discloses a resource access method and device, equipment and a computer storage medium, and relates to the technical field of container cloud, wherein when a gateway device determines that a target object needs to access multiple resource spaces in a container cloud platform according to a target resource access request sent by the target object, the gateway device requests administrator permission information of a target project associated with the target object and a target resource space identifier set from the container cloud platform according to object permission information carried in the target resource access request, and performs update processing on the resource access request. The updated target resource access request is sent to the container cloud platform, so that the container cloud platform returns the obtained target resource to the target object after obtaining the target resource in the multiple target resource spaces according to the administrator permission information, thereby meeting the access demand of the target object for the multiple resource spaces, ensuring that a project of the container cloud platform normally provides application services for users, and improving the availability of the container cloud platform.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, in particular to the technical field of container clouds, and provides a resource access method and device, equipment and a computer storage medium. BACKGROUND

[0002] With the continuous development of cloud native technology, traditional businesses are continuously carried out in the form of cloud services, and the overall business environment is becoming more and more complex. Users' demand for obtaining resources in the container cloud platform is increasingly common. In related technologies, users usually access resource information in a specific resource space in the container cloud platform through a service account or a digital certificate provided by the container cloud platform. In order to ensure resource security, the access permission of each service account or digital certificate is fixed in a single resource space, and there is no permission to access resource information in other resource spaces in the container cloud platform.

[0003] For example, the kubernetes platform usually adopts role-based access control (RBAC) to bind roles that are granted access permissions of a specific namespace to each user and service process, so as to limit the access permission range of the user and the service process, so that they can only access resource information in a specific single resource space, and have no permission to access resource information in other resource spaces.

[0004] However, a project is introduced into the container cloud platform at present, and each project can include multiple resource spaces. When a user is associated with a project, multiple resource spaces under the project can be accessed by the user. According to the current access control strategy, a user can only access a specific resource space, so that only the resources of a resource space are returned each time the user accesses, which causes the project to fail to normally provide application services for the user, and reduces the usability of the container cloud platform. SUMMARY

[0005] The embodiments of the present application provide a resource access method, device, equipment and computer storage medium, which are used to enable a project of a container cloud platform to normally provide application services for a user and improve the usability of the container cloud platform.

[0006] In one aspect, a resource access method is provided, applied to a gateway device, and the method comprises:

[0007] Based on a target resource access request sent by a target object, it is determined that the target object needs to access multiple resource spaces in a container cloud platform;

[0008] based on the object permission information carried in the target resource access request, request the container cloud platform to obtain administrator permission information of a target project associated with the target object and a target resource space identifier set, the target resource space identifier set indicating at least one target resource space in the target project that the target object has permission to access;

[0009] based on the administrator permission information and the target resource space identifier set, update process the resource access request;

[0010] send the updated target resource access request to the container cloud platform, so that the container cloud platform returns the obtained target resource to the target object based on the administrator permission information.

[0011] In one aspect, a resource access method is provided, applied to a container cloud platform, and the method comprises:

[0012] receive a parameter acquisition request sent by a gateway device, the parameter acquisition request carrying object permission information of a target object, the parameter acquisition request being sent by the gateway device in response to a target resource access request sent by the target object, the target resource access request indicating that the target object needs to access multiple resource spaces in a container cloud platform;

[0013] based on the object permission information, determine administrator permission information of a target project associated with the target object and a target resource space identifier set, and return the administrator permission information and the target resource space identifier set to the gateway device, the target resource space identifier set indicating at least one target resource space in the target project that the target object has permission to access;

[0014] receive an updated target resource access request sent by the gateway device, the updated target resource access request carrying the administrator permission information and the target resource space identifier set;

[0015] based on the administrator permission information and the target resource space identifier set, obtain target resources in the at least one target resource space, and return the target resources to the target object.

[0016] In one aspect, a resource access device is provided, applied to a gateway device, and the device comprises:

[0017] a determination unit configured to determine, based on a target resource access request sent by a target object, that the target object needs to access multiple resource spaces in a container cloud platform;

[0018] The acquisition unit is configured to acquire, based on object permission information carried by the target resource access request, administrator permission information of a target project associated with the target object and a target resource space identifier set from a container cloud platform, the target resource space identifier set indicating at least one target resource space in the target project that the target object has permission to access;

[0019] The updating unit is configured to perform updating processing on the resource access request based on the administrator permission information and the target resource space identifier set.

[0020] The sending unit is configured to send the updated target resource access request to the container cloud platform, so that the container cloud platform returns target resources obtained in the at least one target resource space to the target object based on the administrator permission information.

[0021] Optionally, the updating unit is specifically configured to:

[0022] generate target request parameters according to a preset request parameter rule based on respective resource space identifiers of the at least one target resource space;

[0023] fill a request parameter field in the target resource access request based on the target request parameters;

[0024] replace the object permission information carried by the target resource access request based on the administrator permission information.

[0025] Optionally, the determining unit is specifically configured to:

[0026] receive a resource access request sent by the target object, the resource access request carrying request parameter information;

[0027] determine a number of resource spaces required to be accessed by the target object based on the request parameter information;

[0028] If it is determined that the number of resource spaces required to be accessed is not one, it is determined that the target object needs to access multiple resource spaces in the container cloud platform.

[0029] Optionally, the determining unit is specifically configured to:

[0030] If it is determined that the number of resource spaces required to be accessed is one, the resource access request is sent to the container cloud platform.

[0031] In one aspect, a resource access device is provided, applied to a container cloud platform, and the device comprises:

[0032] The first receiving unit is configured to receive a parameter acquisition request sent by a gateway device, the parameter acquisition request carrying object permission information of a target object, the parameter acquisition request being sent by the gateway device in response to a target resource access request sent by the target object, the target resource access request indicating that the target object needs to access a plurality of resource spaces in a container cloud platform.

[0033] The first returning unit is configured to determine administrator permission information of a target project associated with the target object and a target resource space identifier set based on the object permission information, and return the administrator permission information and the target resource space identifier set to the gateway device, the target resource space identifier set indicating at least one target resource space in the target project that the target object has permission to access.

[0034] The second receiving unit is configured to receive an updated target resource access request sent by the gateway device, the updated target resource access request carrying the administrator permission information and the target resource space identifier set.

[0035] The second returning unit is configured to obtain a target resource in the at least one target resource space based on the administrator permission information and the target resource space identifier set, and return the target resource to the target object.

[0036] Specifically, the first returning unit is specifically configured to:

[0037] determine whether the parameter acquisition request passes a legality check based on the object permission information;

[0038] if the parameter acquisition request passes the legality check, determine a target project associated with the target object and administrator permission information corresponding to the target project based on the object permission information;

[0039] determine the at least one target resource space that the target object has permission to access from the target project based on the object permission information;

[0040] determine the target resource space identifier set based on respective target resource space identifiers of the at least one target resource space.

[0041] Specifically, the second returning unit is specifically configured to:

[0042] determine a corresponding target resource query strategy from a preset resource query strategy set based on a request type indicated by the target request parameter; each resource query strategy in the resource query strategy set corresponds to each request type in a one-to-one manner.

[0043] Based on the target resource query strategy, target resources in at least one target resource space corresponding to a target resource space identifier set indicated by the target request parameter are acquired.

[0044] In an aspect, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any of the above methods when executing the computer program.

[0045] In an aspect, a computer storage medium is provided, which stores computer program instructions executable by a processor, wherein the processor implements the steps of any of the above methods when executing the computer program instructions.

[0046] In an aspect, a computer program product is provided, which includes a computer program stored in a computer readable storage medium. A processor of a computer device reads the computer program from the computer readable storage medium, and the processor executes the computer program, so that the computer device executes the steps of any of the above methods.

[0047] The beneficial effects of the embodiments of the present application are as follows:

[0048] In the embodiments of the present application, the gateway device determines, according to a target resource access request sent by a target object, that the target object needs to access multiple resource spaces in a container cloud platform, and according to object permission information carried by the target resource access request, requests the container cloud platform to acquire administrator permission information of a target project associated with the target object and a target resource space identifier set, and updates the resource access request, and sends the updated target resource access request to the container cloud platform, so that the container cloud platform returns the target resources obtained in the multiple target resource spaces to the target object according to the administrator permission information. In this method, when the gateway device determines that multiple resource spaces need to be accessed, the target object initiates a resource access request, and the container cloud platform acquires the target resource space identifier set of the multiple target resource spaces in the target project to which the target object has permission to access and the administrator permission information of the target project, and updates the resource access request based on the above information, so that the target object can access the resources in the multiple resource spaces of the container cloud platform, meet the access demand of the target object to the multiple resource spaces, ensure that the project of the container cloud platform normally provides application services for users, and improve the availability of the container cloud platform.

[0049] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed to be used in the embodiments or the related art description will be briefly introduced. Obviously, the drawings in the following description only constitute a part of the present application, and all other drawings obtained by those of ordinary skill in the art without creative work based on the provided drawings can also be obtained.

[0051] Figure 1 An application scenario schematic diagram provided by the embodiments of the present application;

[0052] Figure 2 An interaction schematic diagram of a resource access method provided by the embodiments of the present application;

[0053] Figure 3 A schematic diagram of a container cloud platform processing a parameter acquisition request provided by the embodiments of the present application;

[0054] Figure 4 A structural schematic diagram of a client interacting with a container cloud platform through a gateway device provided by the embodiments of the present application;

[0055] Figure 5 A flow schematic diagram of another resource access method provided by the embodiments of the present application;

[0056] Figure 6 A structural schematic diagram of a resource access device provided by the embodiments of the present application;

[0057] Figure 7 A structural schematic diagram of another resource access device provided by the embodiments of the present application;

[0058] Figure 8 A structural schematic diagram of a computer device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments only constitute a part of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work belong to the scope of protection of the present application. In the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined with each other at will. And, although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that here.

[0060] To facilitate understanding of the technical solutions provided in the embodiments of this application, some key terms used in the embodiments of this application will be explained below:

[0061] Container cluster management system: An open-source container orchestration and management tool that supports automated deployment, large-scale scalability, and application containerization management. Kubernetes (K8s) is an example of a container cluster management system. When deploying an application, multiple instances of that application are typically deployed to load balance application requests. Kubernetes allows the creation of multiple containers, each running an application instance. Through built-in load balancing strategies, it enables the management, discovery, and access of this group of application instances without requiring complex manual configuration and processing by operations personnel.

[0062] Container technology: A virtualization technology that enables the deployment and execution of applications by isolating the runtime environments required by different applications or services. Container technology packages an application and its dependent software and libraries together to form an independent software unit that can run in any environment. Common container engines include Docker and Kubernetes.

[0063] Role-Based Access Control (RBAC): Each role has different permissions. By associating users with roles and roles with permissions, different permissions are indirectly granted to users, simplifying permission management.

[0064] Resource space, also known as namespace, defines a scope to provide a range, isolating resources. Any operation on a resource within this scope is performed within that resource space, not globally. Namespaces cannot overlap; resources in different namespaces, even with the same name, are distinct.

[0065] A project is a custom resource definition (CRD) in a container cloud platform, used to isolate resources between different resource spaces and control access by users outside the container cloud platform. Each project in a container cloud platform consists of multiple resource spaces associated with objects. A project provides corresponding application and resource services to its associated objects by combining resource information from multiple resource spaces. Depending on the project services required by the object, the resource spaces that the object has permission to access within the project also differ. To ensure resource security, container cloud platforms often use strategies such as RBAC to restrict object access permissions, ensuring that objects can only access resource information from a specific resource space. Only the project administrator has permission to access all resource spaces within the project, thus preventing the project from properly combining resource information from multiple resource spaces to provide resources and services to objects.

[0066] The account-service component is a component of a container cloud platform, which provides permission management, user management, project management, resource space management and other management functions for the container cloud platform, ensures the security, reliability and manageability of the container cloud platform, and provides efficient, secure and controllable cloud platform services for users. Different permissions can be provided for different users by classifying and grouping the users, so that the users can only access the resources and services authorized by them, and the permission management function is realized. The accounts of different users are added, deleted and modified to realize user management. Different resource spaces are divided into different projects and associated with users, so that the projects can provide corresponding resource services for users through resources in multiple resource spaces.

[0067] The apiserver component is one of the core components of the container cloud platform, which is responsible for providing REST API interfaces for container cluster management and is the hub of data interaction and communication in the container cluster. The apiserver component also provides authentication and authorization, data verification, security management and cluster state management functions for the container cluster, including managing and monitoring various state information in the cluster, such as node status, container status, resource usage, etc.; controlling and adjusting the allocation and usage of resources such as CPU, memory, disk space, etc. in the container cluster to ensure reasonable resource allocation and improve resource utilization; and performing permission control and access control on various resources in the cluster to ensure that only authorized users and applications can access and manage resources and services in the cluster, implement security management functions, and improve the security of the cluster.

[0068] The design idea of the embodiments of the present application is briefly introduced as follows:

[0069] Container technology, as a new virtualization technology derived from the field of cloud native technology, plays an important role in cloud computing and container cloud fields. The rise of container technology has given birth to a series of application orchestration management systems such as K8s, Docker swarm and Mesosphere. Among them, K8s has become the leader in the field of container orchestration with its powerful application orchestration capabilities and intelligent scheduling algorithms. With the continuous development of cloud native technology, traditional businesses are increasingly provided through cloud services, and the overall business environment is becoming increasingly complex. Users have increasingly common needs for resource acquisition in container cloud platforms. In related technologies, users usually access resource information in a specific resource space in a container cloud platform through a service account or a digital certificate provided by the container cloud platform. In order to ensure resource security, the access permission of each service account or digital certificate is fixed in a single resource space, and there is no permission to access resource information in other resource spaces in the container cloud platform.

[0070] Taking the K8s container cloud platform as an example, it usually adopts role-based permission access control, a role that is granted access permission of a specific namespace is bound to each user and service process, etc. subject, to limit the access permission range of the user and the service process, so that it can only access the resource information in a specific single resource space, and has no permission to access the resource information in other resource spaces.

[0071] However, at present, projects are introduced into the container cloud platform, each project can contain multiple resource spaces, when a user is associated with a project, multiple resource spaces under the project can be accessed by the user, and according to the current access control strategy, a user can only access a specific resource space, so each time of access will only return the resources of a resource space, which causes the project to be unable to normally provide application services for the user, and directly expanding the permission range of the user to the administrator who can access all resource spaces in the K8s container cloud platform will bring risks to the resource security of the K8s container cloud platform.

[0072] In view of the above problems, the embodiments of the present application provide a resource access method, which comprises the following steps: a gateway device obtains, according to a resource access request initiated by a target object, a target resource space identifier set of multiple target resource spaces in a target project to which the target object has access permission and administrator permission information of the target project from a container cloud platform, and updates the resource access request based on the above information, so that the target object can access the resources of multiple resource spaces in the container cloud platform without modifying the request behavior of the target object, meets the access demand of the target object to multiple resource spaces, ensures that the project of the container cloud platform normally provides application services for the user, and at the same time, the container cloud platform only returns the resource information of the target resource space to which the target object has access permission, accurately controls the access permission range of the target object in the container cloud platform, avoids directly expanding the permission range of the target object to the administrator permission that can access all resource spaces in the container cloud platform, and brings risks to the resource security of the container cloud platform, and protects the resource security of the container cloud platform.

[0073] In order to further protect the resource security of the container cloud platform, in the embodiments of the present application, the container cloud platform needs to determine whether the target object is a legal user of the container cloud platform and whether the target object has access permission to the resources of the container cloud platform according to the object permission information carried by the parameter acquisition request, and perform a legality verification operation, and only after determining that the parameter acquisition request is legal, the administrator permission information and the target resource space identifier set are returned to the gateway device, which fundamentally avoids the possibility that an illegal user obtains the resources of the container cloud platform, and improves the resource security of the container cloud platform.

[0074] The following will introduce some application scenarios to which the technical solutions of the embodiments of the present application can be applied. It should be noted that the following application scenarios are only used to illustrate the embodiments of the present application and are not limited. In the specific implementation process, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0075] The technical solutions provided by the embodiments of the present application can be applied to resource access scenarios of any container cloud platform, for example, a container cloud platform based on a K8s framework, which will not be enumerated one by one here. As shown in Figure 1 The technical solutions provided by the embodiments of the present application can be applied to resource access scenarios of any container cloud platform, for example, a container cloud platform based on a K8s framework, which will not be enumerated one by one here. As shown in

[0076] The gateway device 101 is connected to the terminal device 103 and the container cloud platform 102, and provides a unified access portal for the terminal device 103 to access the container cloud platform, so as to realize the device for communication between the user equipment and the container cloud platform. It can be used to transfer data between the local storage system of the terminal device 103 and the cloud storage service of the container cloud platform, and to convert and filter different protocols, provide network isolation, IP address conversion, load balancing, access control and other functions. The gateway device can be a hardware device, a software device or a virtual device, which commonly includes but is not limited to a router, a firewall, a virtual private network (VPN) gateway, etc.

[0077] The container cloud platform 102 is a cloud computing platform based on container technology, which is used to deploy, manage and run containerized application programs through a unified platform, and has functions of automatic deployment, load balancing, container orchestration, etc. The types of container cloud platforms include but are not limited to kubernetes, Docker swarm, Mesosphere, Rancher, OpenShift or Cloud Foundry, etc. The container cloud platform can run on servers, virtual machines and other devices. The server can be a standalone physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery network (CDN), and basic cloud computing services such as big data and artificial intelligence platforms, but is not limited thereto.

[0078] The terminal device 103 can be a mobile phone, a personal computer (PC), a tablet computer (PAD), a notebook computer, a desktop computer, a mobile Internet device (MID), or any device that can be connected to the container cloud platform through the gateway device to provide local services for users, and the embodiments are not limited specifically. The terminal device 103 can access the application programming interface (API) provided by the container cloud platform through the gateway device to obtain various application services and resources provided by the container cloud platform.

[0079] The gateway device 101, the container cloud platform 102, and the terminal device 103 can be connected through a network 140, which can be a wireless network such as a mobile cellular network, for example, a fourth generation (4G) network, a fifth generation (5G) network, or a new radio (NR) network, or a wireless fidelity (WIFI) network, and can also be other possible networks, and the embodiments of the present application are not limited thereto.

[0080] It should be noted that, Figure 1 The number of the gateway device 101, the container cloud platform 102, and the terminal device 103 is not limited, and the embodiments of the present application are not limited specifically. Figure 1 The components and structures shown are only exemplary and are not limited, and in actual scenarios, other components and structures can also be provided according to needs.

[0081] Of course, the method provided by the embodiments of the present application is not limited to the Figure 1 The application scenarios shown can also be used in other possible application scenarios, and the embodiments of the present application are not limited. The functions that can be achieved by the devices in the Figure 1 application scenarios shown will be described in the subsequent method embodiments, and will not be described here in more detail.

[0082] The resource access method provided by the exemplary embodiments of the present application will be described below in combination with the above-described application scenarios and with reference to the accompanying drawings. It should be noted that the above-described application scenarios are only shown to facilitate understanding of the spirit and principles of the present application, and the embodiments of the present application are not limited in this respect.

[0083] Referring to Figure 2 FIG. 1 is a schematic diagram of the interaction of the resource access method provided by the embodiments of the present application, and the specific implementation process of the method is as follows:

[0084] Step 201: The target object initiates a target resource access request.

[0085] In the embodiments of the present application, the target object can initiate a target resource access request to the container cloud platform through the terminal device to communicate and interact with the container cloud platform. The target resource access request carries the resource space information of the container cloud platform that the target object needs to access, which is used to obtain the data or other service resources stored in the resource space from the container cloud platform. For example, the terminal device can initiate a Hyper Text Transfer Protocol (HTTP) request to the container cloud platform to obtain the service resources of a World Wide Web (Web) application from the corresponding resource space.

[0086] In a possible implementation, taking K8s as an example, the target object can initiate a resource access request by operating the terminal device, using a command line tool (such as kubectl), an API client (such as a Kubernetes API Python client), or a Kubernetes Web console, and the like to access the K8s cluster through the Kubernetes API to obtain target resources. In order to ensure the security of the resources of the container cloud platform, the container cloud platform usually provides security mechanisms to protect the containers and data resources therein, such as Role-Based Access Control (RBAC), network isolation, and encryption, and the terminal device needs to be authenticated, authorized, and the like to obtain the resource information that it has the right to access.

[0087] Step 202: The gateway device determines that the target object needs to access multiple resource spaces in the container cloud platform based on the target resource access request sent by the target object.

[0088] In the embodiments of the present application, the resource access request sent by the terminal device will be forwarded to the container cloud platform through the gateway device, but the container cloud platform limits the access permission range of the object, and each object can only access the resource information in a specific resource space, so that the request of the target object to access the resource information in multiple resource spaces in the container cloud platform cannot be normally responded by the container cloud platform. In the embodiments of the present application, the gateway device receives the resource access request sent by the terminal device, and does not directly forward it to the container cloud platform, but determines whether the target object needs to access multiple resource spaces, so as to determine whether to perform subsequent update processing and the like, so as to ensure that the target object can normally access the resource information in multiple resource spaces in the container cloud platform.

[0089] In a possible implementation, the gateway device receives a resource access request sent by a target object, determines the number of resource spaces required to be accessed by the target object according to request parameter information carried in the resource access request, and if it is determined that the number of resource spaces required to be accessed by the target object is not one, it is determined that the target object needs to access multiple resource spaces in the container cloud platform, and subsequent processing is performed. When it is determined that the number of resource spaces required to be accessed by the target object is one, the gateway device does not need to further process the resource access request, and can directly send the resource access request to the container cloud platform.

[0090] Specifically, taking the K8s container cloud platform as an example, the request parameter information can be resource space name information carried in the resource access request. When the gateway device receives the resource access request sent by the target object, it is determined according to the routing matching rule that the request is a resource access request for the K8s cluster, and the resource access request is parsed to obtain a uniform resource locator (URL) corresponding to the resource access request. The number of resource space names carried in the resource access request is determined through request parameter information such as namespace= and namespace! = in the URL, so as to determine the number of resource spaces required to be accessed by the target object.

[0091] Step 203: The gateway device sends a parameter acquisition request to the container cloud platform based on the object permission information carried in the target resource access request.

[0092] In the embodiment of the application, the target resource access request also carries object permission information that can represent the identity information and permission information of the target object. After determining that the target object needs to access multiple resource spaces in the container cloud platform, the gateway device will send a parameter acquisition request to the container cloud platform according to the object permission information, so as to obtain the administrator permission information of the target project associated with the target object from the container cloud platform through the object permission information carried in the parameter acquisition request, and the target resource space identifier set indicating at least one target resource space in the target project that the target object has permission to access.

[0093] In a possible implementation, taking the K8s container cloud platform as an example, the object permission information carried in the target resource access request can be a digital certificate, an API key or other forms of security tokens used by the target object to access resources in the container cloud platform, such as X-Remote-User or Authorization parameters in the resource access request. The container cloud platform can identify the user identity information corresponding to the X-Remote-User or Authorization parameter through an identity authentication service.

[0094] Step 204: The container cloud platform determines the administrator permission information of the target project associated with the target object and the target resource space identifier set based on the object permission information.

[0095] Step 205: The container cloud platform returns the administrator permission information of the target project associated with the target object and the target resource space identifier set to the gateway device.

[0096] In the embodiments of the present application, the container cloud platform receives the parameter acquisition request sent by the gateway device, determines the identity information of the target object according to the object permission information carried thereby, determines the target project associated with the target object, the administrator permission information of the target project, and the plurality of target resource space identifiers in the target project to which the target object has access permission from the pre-stored mapping relationship between the project and the associated object, and returns the above information to the gateway device.

[0097] In a possible implementation, in order to further ensure the resource security of the container cloud platform, the container cloud platform will first determine whether the parameter acquisition request passes the legality check according to the object permission information, and after determining that the parameter acquisition request is legal, determine the target project associated with the target object and the administrator permission information corresponding to the target project according to the object permission information, determine the plurality of target resource spaces to which the target object has access permission from the target project, determine the target resource space identifier set according to the target resource space identifiers of the plurality of target resource spaces, and return the above information to the gateway device.

[0098] Specifically, taking the K8s container cloud platform as an example, the Account-service component in the K8s container cloud platform can process the parameter acquisition request sent by the gateway device. As shown in Figure 3 The Account-service service component parses the parameter acquisition request it receives, obtains the object permission information such as X-Remote-User or Authorization carried by the parameter acquisition request, and performs legality check on the parameter acquisition request according to the above object permission information, including format verification on the object permission information, judging whether the object permission information is correct, judging whether the corresponding target object is a legal user of the K8s cluster according to the object permission information, whether the target object has access permission to the resources in the cluster, etc. After determining that the parameter acquisition request passes the legality check, the target project associated with the target object, the administrator permission information of the target project, and the resource space identifiers corresponding to the plurality of target resource spaces to which the target object has access permission are determined from the pre-stored mapping relationship between the project and the associated object, and the above information is returned to the gateway device.

[0099] Step 206: The gateway device performs update processing on the target resource access request based on the administrator permission information and the target resource space identifier set.

[0100] Step 207: The gateway device sends the updated target resource access request to the container cloud platform.

[0101] In the embodiment of the application, the gateway device updates the target resource access request sent by the target object for accessing multiple resource spaces in the container cloud platform according to the administrator permission information associated with the target object and the target resource space identifier set returned by the container cloud platform, and forwards the updated target resource access request to the container cloud platform.

[0102] In a possible implementation, the gateway device can generate target request parameters according to the resource space identifiers corresponding to each target resource space returned by the container cloud platform in one-to-one manner according to the pre-set request parameter rules, fill the request parameter field in the target resource access request with the target request parameters, and replace the object permission information carried by the target resource access request with the administrator permission information returned by the container cloud platform, to complete the update processing of the target resource access request.

[0103] Specifically, the gateway device can update the URL corresponding to the target resource access request through the URL rewriting technology, including replacing the Authorization or X-Remote-User object permission information carried by the target resource access request with the administrator permission information returned by the container cloud platform, generating fieldSelector=metadata.namespace=target request parameters according to the pre-set request parameter rules, and adding each target resource space identifier corresponding to each resource space that the target object has permission to access in the target object returned by the container cloud platform into the target request parameters, so that the final rewritten URL carries the resource space identifier information of the multiple target resource spaces in the target project that the target object needs to access and the administrator permission information of the target project, thereby expanding the access permission of the target object while controlling the target object to only obtain the resource information under the target resource space that the target object has permission to access.

[0104] Step 208: The container cloud platform obtains the target resource in at least one target resource space according to the updated target resource access request.

[0105] Step 209: The container cloud platform returns the target resource to the target object.

[0106] In the embodiment of the application, the container cloud platform receives the updated target resource access request forwarded by the gateway device, filters the target resource in each target resource space that the target object has permission to access from the numerous resource spaces in the container cloud platform through the administrator permission information and the target resource space identifier set carried by the updated target resource access request, and sends the target resource to the target object, to meet the demand of the target object for accessing multiple resource spaces in the container cloud platform.

[0107] In a possible implementation, taking the K8s container cloud platform as an example, the container cloud platform receives the updated target resource access request forwarded by the gateway device, and an apiserver component thereof will perform corresponding resource filtering processing according to the updated target resource access request to obtain target resources and return to the target object.

[0108] Specifically, the apiserver component parses the updated target resource access request to obtain the administrator permission information and the target resource space identifier set carried thereby, performs legality verification on the administrator permission information, determines that the administrator permission information is correct and has the permission to access the target project, queries each target resource space corresponding to each target resource space identifier through a resource filter, integrates the resource information of each target resource space obtained, and returns to the target object.

[0109] In a possible implementation, the updated target resource access request carries a target request parameter representing the target resource space identifier set. After the container cloud platform receives the target resource request forwarded by the gateway device, the corresponding target resource query strategy can be determined from a preset resource query strategy set according to the request type indicated by the target request parameter, and then the target resources in each target resource space corresponding to each target resource space identifier indicated by the target request parameter can be obtained through the target resource query strategy.

[0110] Specifically, taking the K8s container cloud platform as an example, the fieldSelector and other resource filters used by the Apiserver component in the K8s container cloud platform only support resource filtering according to namespace= and namespace!= request parameters, while the target request parameter carried by the updated target resource access request is of the fieldSelector=metadata.namespace= type. Therefore, the present application extends the resource filtering function of the Apiserver component, and extends multiple resource query strategies corresponding to the request parameter types for the apiserver component, including multiple resource query strategies supporting namespace=, namespace!= request parameters and fieldSelector=metadata.namespace= request parameters. Therefore, after the K8s container cloud platform receives the resource access request forwarded by the gateway device, the apiserver component can select the resource query strategy corresponding to the request type of the resource access request according to the request parameter carried by the resource access request, and obtain the target resources in each target resource space corresponding to each target resource space identifier through the resource query strategy.

[0111] Below, the scheme of the embodiments of the present application is introduced in combination with specific examples, referring to Figure 4 and Figure 5 shown, Figure 4 a structure schematic diagram of a client interacting with a container cloud platform through a gateway device provided by the embodiments of the present application, Figure 5 a flowchart of another resource access method provided by the embodiments of the present application, the specific implementation process of the method is as follows:

[0112] Step 501: the target object initiates a target resource access request for accessing the apiserver through the client.

[0113] Step 502: the gateway device receives the target resource access request initiated by the client, judges whether the target object needs to access multiple resource spaces, if yes, jumps to step 504, if not, jumps to step 503.

[0114] Step 503: the gateway device directly forwards the target resource access request to the apiserver.

[0115] It should be noted that in the case where the gateway device determines that the target object needs to access multiple resource spaces, the gateway device will not directly forward the target resource access request to the apiserver, that is, step 503 is not executed, and step 503 is an optional step.

[0116] Step 504: the gateway device initiates a parameter acquisition request to the account-service component according to the object permission information (X-Remote-User or Authorization parameter) carried by the target resource access request.

[0117] Step 505: the account-service component determines the administrator permission information of the target project associated with the target object and the target resource space identifier set corresponding to the target resource space to which the target object has access permission according to the object permission information carried by the parameter acquisition request, and returns to the gateway device.

[0118] Step 506: the gateway device rewrites the url of the target resource access request according to the administrator permission information and the target resource space identifier set, and obtains an updated target resource access request.

[0119] Step 507: the gateway device forwards the updated target resource access request to the apiserver.

[0120] Step 508: The apiserver determines whether the target resource access request received contains a target request parameter (fieldSelector = metadata.namespace =), and if so, step 510 is performed, and if not, step 509 is performed.

[0121] Step 509: According to the request parameter information (namespace =, namespace!=) carried by the target resource access request representing the resource space name, the resource information corresponding to the single resource space required to be accessed by the target object is returned to the client.

[0122] Step 510: According to the multiple target resource space identifiers indicated by the target request parameter, the multiple target resources corresponding to the multiple target resource spaces are queried one by one, and are uniformly returned to the client.

[0123] See Figure 6 Based on the same inventive concept, the embodiments of the present application also provide a resource access device 60 applied to a gateway device, which comprises:

[0124] A determination unit 601 is configured to determine, based on a target resource access request sent by a target object, that the target object needs to access multiple resource spaces in a container cloud platform;

[0125] An acquisition unit 602 is configured to acquire, based on object permission information carried by the target resource access request, administrator permission information of a target project associated with the target object and a target resource space identifier set from the container cloud platform, the target resource space identifier set indicating at least one target resource space in the target project that the target object has permission to access;

[0126] An updating unit 603 is configured to update and process the resource access request based on the administrator permission information and the target resource space identifier set;

[0127] A sending unit 604 is configured to send the updated target resource access request to the container cloud platform, so that the container cloud platform returns the target resources obtained in the at least one target resource space to the target object based on the administrator permission information.

[0128] Optionally, the updating unit 603 is specifically configured to:

[0129] Generate a target request parameter according to a preset request parameter rule based on the resource space identifier of each of the at least one target resource space;

[0130] Fill a request parameter field in the target resource access request based on the target request parameter;

[0131] Replace the object permission information carried by the target resource access request based on the administrator permission information.

[0132] Optionally, the determining unit 601 is specifically configured to:

[0133] receive a resource access request sent by a target object, the resource access request carrying request parameter information;

[0134] determine the number of resource spaces required to be accessed by the target object based on the request parameter information;

[0135] If the number of resource spaces required to be accessed is not one, it is determined that the target object needs to access multiple resource spaces in the container cloud platform.

[0136] Optionally, the determining unit 601 is specifically configured to:

[0137] If the number of resource spaces required to be accessed is one, the resource access request is sent to the container cloud platform.

[0138] See Figure 7 , based on the same inventive concept, the embodiment of the application further provides a resource access device 70 applied to a container cloud platform, the device comprises:

[0139] The first receiving unit 701 is configured to receive a parameter acquisition request sent by a gateway device, the parameter acquisition request carrying object permission information of a target object, the parameter acquisition request being sent by the gateway device in response to a target resource access request sent by the target object, the target resource access request indicating that the target object needs to access multiple resource spaces in the container cloud platform.

[0140] The first returning unit 702 is configured to determine administrator permission information of a target project associated with the target object and a target resource space identifier set based on the object permission information, and return the administrator permission information and the target resource space identifier set to the gateway device, the target resource space identifier set indicating at least one target resource space in the target project that the target object has permission to access.

[0141] The second receiving unit 703 receives an updated target resource access request sent by the gateway device, the updated target resource access request carrying the administrator permission information and the target resource space identifier set.

[0142] The second returning unit 704 is configured to obtain a target resource in at least one target resource space based on the administrator permission information and the target resource space identifier set, and return the target resource to the target object.

[0143] Specifically, the first returning unit 702 is specifically configured to:

[0144] Based on the object permission information, it is determined whether the parameter acquisition request passes the legality check;

[0145] If the legality check is passed, based on the object permission information, a target project associated with the target object and administrator permission information corresponding to the target project are determined.

[0146] Based on the object permission information, at least one target resource space to which the target object has access is determined from the target project.

[0147] Based on the target resource space identifier of each of the at least one target resource space, a target resource space identifier set is determined.

[0148] Specifically, the second returning unit 704 is specifically configured to:

[0149] Based on the request type indicated by the target request parameter, a corresponding target resource query strategy is determined from a preset resource query strategy set, wherein each resource query strategy in the resource query strategy set corresponds to each request type one by one.

[0150] Based on the target resource query strategy, target resources in at least one target resource space corresponding to the target resource space identifier set indicated by the target request parameter are acquired.

[0151] For the convenience of description, each part is divided into units (or modules) according to functions and is described respectively. Of course, in the implementation of the present application, the functions of each unit (or module) can be realized in the same or multiple software or hardware. The device can be used to execute the method shown in each embodiment of the present application, therefore, the functions of each functional module of the device can be referred to the description of the foregoing embodiments, and will not be described in detail.

[0152] Please refer to Figure 8 , based on the same technical concept, the present application also provides a computer device, which can be, for example, a gateway device or a container cloud platform as shown in Figure 1 In an embodiment, the computer device can include a memory 801, a communication module 803 and one or more processors 802 as shown.

[0153] The memory 801 is used to store the computer program executed by the processor 802. The memory 801 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, and the data storage area can store various operation instruction sets, etc.

[0154] The memory 801 can be a volatile memory (English: volatile memory), such as a random access memory (English: random-access memory, abbreviated as RAM); the memory 801 can also be a non-volatile memory (English: non-volatile memory), such as a read-only memory, a flash memory, a hard disk drive (English: hard disk drive, abbreviated as HDD) or a solid-state drive (English: solid-state drive, abbreviated as SSD); or the memory 801 is any other medium capable of carrying or storing desired program code in the form of instructions or data structures and capable of being accessed by a computer, but not limited to this. The memory 801 can be a combination of the above-mentioned memories.

[0155] The processor 802 can include one or more central processing units (English: central processing unit, abbreviated as CPU) or digital processing units and the like. The processor 802 is used to call the computer program stored in the memory 801 to realize the above-mentioned resource access method.

[0156] The communication module 803 is used for communication with other network devices.

[0157] The specific connection medium between the above-mentioned memory 801, communication module 803 and processor 802 is not limited in the embodiments of the present application. In the embodiments of the present application, the memory 801 and the processor 802 are connected through the bus 804, and the bus 804 is described by a thick line in the drawings, and the connection mode between other components is only schematically described, and is not limited. The bus 804 can be divided into an address bus, a data bus, a control bus and the like. For the convenience of description, only one thick line is described in the drawings, but it is not described that there is only one bus or only one type of bus. Figure 8 Figure 8 Figure 8

[0158] The memory 801 stores a computer storage medium, and the computer storage medium stores computer executable instructions. The computer executable instructions are used to realize the resource access method of the embodiments of the present application, and the processor 802 is used to execute the resource access method of each embodiment.

[0159] Based on the same inventive concept, the embodiments of the present application also provide a storage medium, and the storage medium stores a computer program. When the computer program instructions run on the computer, the computer processor executes the steps of the resource access method according to the various embodiments of the present application described in the specification.

[0160] ​​​In some possible implementation, each aspect of the resource access method provided by the present application can also be implemented as a program product in the form of a program code, which is used to make the computer device execute the steps of the resource access method according to various exemplary embodiments of the present application described above in the specification, when the program product runs on the computer device, for example, the computer device can execute the steps of each embodiment.

[0161] The program product can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium may, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection having one or more wires, a portable disc, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0162] The program product of the embodiments of the present application can adopt a portable compact disc read-only memory (CD-ROM) and include program code, and can run on a computing device. However, the program product of the present application is not limited thereto, and in the present application, the readable storage medium can be any tangible medium containing or storing a program, which can be used or combined with a command execution system, device or apparatus.

[0163] The readable signal medium can include a data signal propagating in a baseband or as a part of a carrier wave, in which a readable program code is carried. Such a propagating data signal can adopt various forms, including but not limited to electromagnetic signals, optical signals or any suitable combination of the above. The readable signal medium can also be any readable medium other than the readable storage medium, which can send, propagate or transmit a program for use by or in combination with a command execution system, device or apparatus.

[0164] The program code contained on the readable medium can be transmitted by any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0165] The program code may, for example, be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computing device, partly on the user's computing device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device or entirely on the remote computing device or server. In the latter scenario, the remote computing device can be connected to the user's computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, for example, through the Internet using an Internet Service Provider.

[0166] It should be noted that, although in the foregoing detailed description several units or sub-units of the apparatus are mentioned, such division into units or sub-units is purely exemplary and not mandatory. Indeed, according to an embodiment of the present application, features and functionalities of two or more units described above can be embodied in one unit. Conversely, features and functionalities of one unit described above can be further divided into several units.

[0167] Moreover, although the operations of the method(s) herein can be described in a particular, sequential order, this order is not meant to be a limitation and is not intended to imply that

[0168] Those of skill in the art would understand that information and signals can be represented using any of a variety of different technologies and techniques. For example, data, instructions, commands, information, signals, bits, symbols, and chips that can be referenced throughout the above description can be represented by voltages, currents, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof.

[0169] While the preferred embodiments of the application have been described above, it should be understood that they have been presented by way of example only, and not limitation. Numerous changes to the embodiments can be made in addition to those described above without departing from the spirit of the application. Accordingly, the scope of the application is defined only by the appended claims, rather than the description and the exemplary embodiments.

[0170] Obviously, many modifications and variations of the present application are possible in light of the above teachings. It is, therefore, to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. A resource access method, characterized by, The method applied to a gateway device comprises: Based on a target resource access request sent by a target object, it is determined that the target object needs to access multiple resource spaces in a container cloud platform, the target resource access request is used to request to obtain a target resource, the target resource is stored in the multiple resource spaces, and resources in different resource spaces are isolated from each other; Based on object permission information carried in the target resource access request, administrator permission information of a target project associated with the target object and a target resource space identifier set are requested from the container cloud platform, the target resource space identifier set indicates at least one target resource space in the target project that the target object has permission to access, an administrator of the target project has permission to access all resource spaces in the target project, and the permission of the administrator is higher than that of the target object; Based on the administrator permission information and the target resource space identifier set, the target resource access request is updated; The updated target resource access request is sent to the container cloud platform, so that the container cloud platform returns the obtained target resource to the target object based on the administrator permission information.

2. The method of claim 1, wherein, The method further comprises: Based on the at least one target resource space identifier of each resource space, target request parameters are generated according to a preset request parameter rule; Based on the target request parameters, request parameter fields in the target resource access request are filled; Based on the administrator permission information, the object permission information carried in the target resource access request is replaced.

3. The method of claim 1, wherein, Based on a target resource access request sent by a target object, it is determined that the target object needs to access multiple resource spaces in a container cloud platform, comprising: The resource access request sent by the target object is received, and the resource access request carries request parameter information; Based on the request parameter information, the number of resource spaces that the target object needs to access is determined; If it is determined that the number of resource spaces that need to be accessed is not one, it is determined that the target object needs to access multiple resource spaces in the container cloud platform.

4. The method of claim 3, wherein, After determining the number of resource spaces that the target object needs to access based on the request parameter information, the method further comprises: If it is determined that the number of resource spaces that need to be accessed is one, the resource access request is sent to the container cloud platform.

5. A resource access method, characterized by, The method applied to a container cloud platform comprises: A parameter acquisition request sent by a gateway device is received, the parameter acquisition request carries object permission information of a target object, the parameter acquisition request is sent by the gateway device in response to a target resource access request sent by the target object, the target resource access request indicates that the target object needs to access multiple resource spaces in a container cloud platform, the target resource access request is used to request to obtain a target resource, the target resource is stored in the multiple resource spaces, and resources in different resource spaces are isolated from each other; determine administrator permission information of a target project associated with the target object and a target resource space identifier set based on the object permission information, and return the administrator permission information and the target resource space identifier set to the gateway device, the target resource space identifier set indicating at least one target resource space in the target project that the target object has permission to access, an administrator of the target project having permission to access all resource spaces in the target project, the administrator's permission being higher than the target object's permission; receive an updated target resource access request sent by the gateway device, the updated target resource access request carrying the administrator permission information and the target resource space identifier set; based on the administrator permission information and the target resource space identifier set, obtain target resources in the at least one target resource space, and return the target resources to the target object.

6. The method of claim 5, wherein, determining administrator permission information of a target project associated with the target object and a target resource space identifier set based on the object permission information, and return the administrator permission information and the target resource space identifier set to the gateway device, the target resource space identifier set indicating at least one target resource space in the target project that the target object has permission to access, an administrator of the target project having permission to access all resource spaces in the target project, the administrator's permission being higher than the target object's permission; based on the object permission information, determine whether the parameter acquisition request passes a legality check; if the legality check is passed, determine a target project associated with the target object based on the object permission information, and administrator permission information corresponding to the target project; based on the object permission information, determine, from the target project, the at least one target resource space that the target object has permission to access; based on respective target resource space identifiers of the at least one target resource space, determine the target resource space identifier set.

7. The method of claim 5, wherein, The target resource access request carries a target request parameter, and the target request parameter represents the target resource space identifier set. After receiving the updated target resource access request sent by the gateway device, the method further includes: based on a request type indicated by the target request parameter, determine a corresponding target resource query strategy from a preset resource query strategy set, wherein each resource query strategy in the resource query strategy set corresponds to each request type one by one; based on the target resource query strategy, obtain target resources in at least one target resource space corresponding to the target resource space identifier set indicated by the target request parameter. The device is applied to a gateway device and includes:

8. A resource access method apparatus characterized by, a determination unit configured to determine, based on a target resource access request sent by a target object, that the target object needs to access a plurality of resource spaces in a container cloud platform, the target resource access request being used to request to obtain target resources, the target resources being stored in the plurality of resource spaces, resources in different resource spaces being isolated from each other; ​ The acquisition unit is configured to acquire, based on object permission information carried by the target resource access request, administrator permission information of a target project associated with the target object and a target resource space identifier set from the container cloud platform, the target resource space identifier set indicating at least one target resource space in the target project that the target object has permission to access, an administrator of the target project having permission to access all resource spaces in the target project, and the administrator's permission being higher than the target object's permission; The updating unit is configured to update the resource access request based on the administrator permission information and the target resource space identifier set; The sending unit is configured to send the updated target resource access request to the container cloud platform, so that the container cloud platform returns the target resource obtained in the at least one target resource space to the target object based on the administrator permission information.

9. A resource access method apparatus characterized by, The application is applied to a container cloud platform, and the device comprises: The first receiving unit is configured to receive a parameter acquisition request sent by a gateway device, the parameter acquisition request carrying object permission information of a target object, the parameter acquisition request being sent by the gateway device in response to a target resource access request sent by the target object, the target resource access request indicating that the target object needs to access a plurality of resource spaces in the container cloud platform, and the target resource access request being used to acquire a target resource, the target resource being stored in the plurality of resource spaces, and resources in different resource spaces being isolated from each other; The first returning unit is configured to determine administrator permission information of a target project associated with the target object and a target resource space identifier set based on the object permission information, and return the administrator permission information and the target resource space identifier set to the gateway device, the target resource space identifier set indicating at least one target resource space in the target project that the target object has permission to access, an administrator of the target project having permission to access all resource spaces in the target project, and the administrator's permission being higher than the target object's permission; The second receiving unit is configured to receive an updated target resource access request sent by the gateway device, the updated target resource access request carrying the administrator permission information and the target resource space identifier set; The second returning unit is configured to acquire a target resource in the at least one target resource space based on the administrator permission information and the target resource space identifier set, and return the target resource to the target object. 10.A computer device, comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, and characterized in that: The processor implements the steps of the method in any one of claims 1 to 7 when executing the computer program.

Images