A resource access method and device, a cloud hosting system, and an electronic device

Abstract

The application relates to the technical field of computers, and particularly discloses a resource access method and device, a cloud hosting system and electronic equipment, which are applied to a target middleware; the target middleware is any one of a plurality of middlewares deployed in a container cluster; a control plane and a custom CRD resource of each tenant are also deployed in the container cluster, and each middleware is previously associated with the control plane and the custom CRD resource of a unique tenant; the method comprises the following steps: listening to whether the previously associated CRD resource is updated; when the update is listened to, determining the CRD resource subjected to the update as a target CRD resource; and reporting the target CRD resource to the previously associated target control plane, so that the target control plane acquires the target CRD resource. It can be seen that, according to the scheme, the isolated access of the CRD resources of the multi-tenants can be ensured, and system resource waste is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a resource access method and device, a cloud hosting system and an electronic device. BACKGROUND

[0002] As an infrastructure layer for inter-service communication, a service mesh is used to manage the communication between services. The service mesh includes a data plane and a control plane, wherein the data plane in the service mesh is composed of proxy components responsible for routing, load balancing, service discovery, health checking and authorization / authentication; the control plane in the service mesh is used to configure the behavior of the data plane.

[0003] In order to simplify the governance of services, cloud vendors can cloud host the control plane in the service mesh of a tenant. When cloud hosting is performed, the control plane and custom CRD (Custom Resource Definition) resources of the tenant are usually deployed in a container cluster, so that by modifying the custom resources deployed in the container cluster, the control plane can perceive the change of the configuration, and then the custom resources are converted into the configuration content of the proxy components, so as to achieve the purpose of controlling various configuration contents of the data plane.

[0004] For cloud hosting of the control plane, the control plane and the CRD resources of multiple tenants are involved, which requires that the control planes of different tenants cannot access each other's CRD resources, that is, the isolated access of the CRD resources of multiple tenants.

[0005] In the related art, the control plane and the corresponding CRD resources of each tenant are deployed in a separate container cluster; and then in the resource access process, when the control plane in any container cluster detects that the CRD resources in the container cluster are updated, the control plane directly reads the CRD resources of the container cluster. In this way, the isolated access of the CRD resources of multiple tenants is achieved.

[0006] However, setting up an independent container cluster for each tenant will cause waste of system resources of the container cluster. It can be seen that, while ensuring the isolated access of the CRD resources of multiple tenants, how to reduce the waste of system resources is a problem to be solved. SUMMARY

[0007] The purpose of the embodiments of the present application is to provide a resource access method and device, a cloud hosting system and an electronic device, so as to reduce the waste of system resources while ensuring the isolated access of the CRD resources of multiple tenants.

[0008] The specific technical solutions are as follows:

[0009] In a first aspect, an embodiment of the present application provides a resource access method applied to a target middleware; the target middleware is any one of a plurality of middlewares deployed in a container cluster; the container cluster also has control planes and custom CRD resources of each tenant deployed therein; each middleware is pre-associated with a control plane and a custom CRD resource of a unique tenant;

[0010] The method comprises:

[0011] listening to whether the pre-associated CRD resource is updated;

[0012] when the update is listened to, determining the updated CRD resource as a target CRD resource;

[0013] reporting the target CRD resource to the pre-associated target control plane, so that the target control plane acquires the target CRD resource.

[0014] Optionally, the control planes of different tenants have different namespaces, and the control plane and the CRD resource of each tenant have the same namespace;

[0015] The way that each middleware is pre-associated with a control plane and a custom CRD resource of a unique tenant comprises that each middleware has the same namespace as the control plane and the CRD resource of a unique tenant;

[0016] The listening to whether the pre-associated CRD resource is updated comprises:

[0017] listening to whether the CRD resource with the same namespace is updated;

[0018] The reporting the target CRD resource to the pre-associated target control plane comprises:

[0019] reporting the target CRD resource to the target control plane with the same namespace.

[0020] Optionally, the reporting the target CRD resource to the pre-associated target control plane comprises:

[0021] if a resource update inquiry request sent by the pre-associated target control plane is received, reporting the target CRD resource to the pre-associated target control plane.

[0022] Optionally, each middleware is a mesh configuration protocol (MCP) middleware.

[0023] In a second aspect, an embodiment of the present application provides a container cluster, wherein a plurality of middlewares and control planes and custom CRD resources of each tenant are deployed, each of the middlewares is previously associated with the control plane and the custom CRD resource of a unique tenant;

[0024] a target middleware, configured to listen to whether the previously associated CRD resource is updated, and when the update is listened to, determine the updated CRD resource as a target CRD resource, and report the target CRD resource to the previously associated target control plane, wherein the target middleware is any one of the plurality of middlewares;

[0025] the target control plane, configured to receive the target CRD resource reported by the target middleware.

[0026] Optionally, the namespaces of the control planes of different tenants are different, and the control plane and the CRD resource of each tenant have the same namespace.

[0027] The manner that each of the middlewares is previously associated with the control plane and the custom CRD resource of a unique tenant includes that the namespace of each of the middlewares is the same as that of the control plane and the CRD resource of a unique tenant.

[0028] The target middleware listens to whether the previously associated CRD resource is updated, and includes:

[0029] listening to whether the CRD resource with the same namespace is updated;

[0030] The target middleware reports the target CRD resource to the previously associated target control plane, and includes:

[0031] reporting the target CRD resource to the target control plane with the same namespace.

[0032] In a third aspect, an embodiment of the present application provides a cloud hosting system, comprising a management platform and a container cluster, wherein the container cluster is deployed with a plurality of middlewares and control planes and custom CRD resources of each tenant, and each of the middlewares is previously associated with the control plane and the custom CRD resource of a unique tenant.

[0033] The management platform is configured to update the CRD resource of the tenant in the container cluster when a resource update instruction for any tenant is received.

[0034] The target middleware in the container cluster is configured to listen to whether the pre-associated CRD resource is updated; when the update is listened to, the CRD resource that is updated is determined as a target CRD resource; and the target CRD resource is reported to the pre-associated target control plane, so that the target control plane distributes the target CRD resource to the data plane on the tenant side.

[0035] The target middleware is any one of the plurality of middlewares.

[0036] Optionally, the namespaces of the control planes of different tenants are different, and the control plane and the CRD resource of each tenant have the same namespace.

[0037] The manner in which each middleware pre-associates the control plane and the custom CRD resource of a unique tenant includes that each middleware is uniquely associated with the control plane and the namespace of the CRD resource of a unique tenant.

[0038] The target middleware listens to whether the pre-associated CRD resource is updated, including:

[0039] listening to whether the CRD resource with the same namespace is updated;

[0040] The target middleware reports the target CRD resource to the pre-associated target control plane, including:

[0041] The target CRD resource is reported to the target control plane with the same namespace.

[0042] Optionally, the container cluster management platform is further configured to:

[0043] output the namespaces of the control planes in the container cluster;

[0044] When the control instruction for the target namespace in each namespace is received, the control plane of the target namespace responds to the target control instruction.

[0045] In a fourth aspect, an embodiment of the present application provides a resource access device applied to a target middleware; the target middleware is any one of a plurality of middlewares deployed in a container cluster; the control plane and the custom CRD resource of each tenant are also deployed in the container cluster; and each middleware pre-associates the control plane and the custom CRD resource of a unique tenant.

[0046] The device includes:

[0047] A listening module is configured to listen to whether the pre-associated CRD resource is updated.

[0048] The determining module is configured to determine, when the update is monitored, a CRD resource on which the update occurs as a target CRD resource;

[0049] The reporting module is configured to report the target CRD resource to a target control plane pre-associated with the target CRD resource, so that the target control plane acquires the target CRD resource.

[0050] Optionally, the control planes of different tenants have different namespaces, and the control plane and the CRD resource of each tenant have the same namespace.

[0051] The manner in which each middleware pre-associates the control plane and the custom CRD resource of a unique tenant includes that the control plane and the CRD resource of each middleware are uniquely associated with a unique tenant and have the same namespace.

[0052] The listening module is specifically configured to:

[0053] Listen to whether the CRD resource with the same namespace is updated.

[0054] The reporting module is specifically configured to:

[0055] Report the target CRD resource to the target control plane with the same namespace.

[0056] Optionally, the reporting module is specifically configured to:

[0057] If a resource update inquiry request sent by the target control plane pre-associated with the target CRD resource is received, the target CRD resource is reported to the target control plane pre-associated with the target CRD resource.

[0058] Optionally, each middleware is a mesh configuration protocol (MCP) middleware.

[0059] In a fifth aspect, an electronic device is provided, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete mutual communication through the communication bus;

[0060] The memory is used to store a computer program.

[0061] The processor is used to execute the program stored on the memory, and implement the steps of the resource access method.

[0062] In a sixth aspect, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program. When the computer program is executed by a processor, the steps of the resource access method are implemented.

[0063] In a seventh aspect, the embodiments of the present application further provide a computer program product containing instructions, which, when executed on a computer, cause the computer to perform the steps of any of the resource access methods described above.

[0064] The embodiments of the present application have the following beneficial effects:

[0065] In the scheme provided by the embodiments of the present application, the control plane and the CRD resource of the multi-tenant are deployed in the same container cluster, and a plurality of intermediaries are deployed in the container cluster, each of which is pre-associated with the control plane and the custom CRD resource of a unique tenant; further, the target intermediary deployed in the container cluster listens to whether the CRD resource pre-associated therewith is updated; when the update is listened to, the CRD resource that is updated is determined as the target CRD resource; then, the target CRD resource is reported to the target control plane pre-associated with the target intermediary, so that the target control plane acquires the target CRD resource. As can be seen, for the multi-tenant, by deploying the control plane and the CRD resource of the multi-tenant in the same container cluster, the number of container clusters can be greatly reduced, thereby reducing the waste of system resources of the container cluster; and in the container cluster, a plurality of intermediaries are deployed, each of which is pre-associated with the control plane and the CRD resource of a unique tenant, so that the control plane can perceive the update of the CRD resource of the same tenant through the intermediary pre-associated therewith, and acquire the CRD resource of the same tenant that is updated. As can be seen, through the scheme, the isolated access of the CRD resource of the multi-tenant can be ensured while reducing the waste of system resources. In addition, by deploying the control plane of the multi-tenant in the same container cluster, the operation and maintenance personnel of the cloud vendor hosting the control plane can be facilitated in operation and maintenance management.

[0066] Of course, implementing any product or method of the present application does not necessarily require achieving all the advantages described above at the same time. BRIEF DESCRIPTION OF DRAWINGS

[0067] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and other embodiments can also be obtained by those skilled in the art based on these drawings.

[0068] Figure 1 A schematic diagram of the principle of the cloud hosting scheme in the related art;

[0069] Figure 2 A flowchart of a resource access method provided by the embodiments of the present application;

[0070] Figure 3Another flowchart of a resource access method provided by an embodiment of the present application;

[0071] Figure 4 Principle diagram of a cloud hosting solution of a resource access method provided by an embodiment of the present application;

[0072] Figure 5 A resource reading diagram of a resource access method provided by an embodiment of the present application;

[0073] Figure 6 A structural diagram of a cloud hosting system provided by an embodiment of the present application;

[0074] Figure 7 A structural diagram of a resource access device provided by an embodiment of the present application;

[0075] Figure 8 Block diagram of an electronic device for implementing a resource access method in an embodiment of the present application. DETAILED DESCRIPTION

[0076] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art based on the present application are within the scope of protection of the present application.

[0077] Next, first, the professional terms involved in the embodiments of the present application are introduced:

[0078] Service mesh: the service mesh is defined as a special infrastructure layer for managing communication between services, where the service is a functional module capable of realizing a certain data processing function. The service mesh has the following functions:

[0079] (1) Traffic management: through simple rule configuration and traffic routing, the traffic and API (Application Program Interface) calls between services can be controlled; the configuration of services such as fuses, timeouts, and retries is simplified;

[0080] (2) Observability: through tracking, monitoring, and logging, workers can better understand services and quickly discover and fix problems;

[0081] (3) Security: authentication, authorization, and communication encryption can be managed at the proxy level, and policies can be executed in various services through rapid configuration changes.

[0082] The service mesh has two parts: the data plane and the control plane.

[0083] Data Plane: The data plane in a service mesh consists of proxy components responsible for routing, load balancing, service discovery, health checking, and authorization / authentication. These proxies run alongside each instance of a service, intercepting all incoming and outgoing user traffic.

[0084] Control Plane: The control plane in a service mesh is used to provide configuration content to the data plane and control the data plane. It consists of APIs and functional plugins for managing data plane behavior. The tenant's operations personnel can configure the behavior of the data plane in the service mesh by accessing the control plane.

[0085] Managed Service Mesh Control Plane: Cloud vendors host the control plane in the service mesh to simplify service governance, including traffic routing and splitting management between service calls, authentication security for inter-service communication, and grid observability capabilities, thereby greatly reducing the work burden of development and operation.

[0086] CRD Resource: A custom resource written in YAML format, which contains rules that are deployed together with the control plane in the cloud when hosting, and the control plane is responsible for discovering these rules and converting them into operational configurations for the data plane. For example, the CRD resource can be a resourcedefinition.yaml file that records rules for traffic management, load balancing, and the like.

[0087] Container Cluster: Consists of storage nodes, service nodes, and control nodes. All cluster states are saved in storage nodes, control nodes run control ends of service nodes of the cluster, and service nodes are host nodes that actually run application containers. A processing end is running on each service node to control containers, images, and storage, etc.

[0088] In related technologies, the control plane and corresponding CRD resources of each tenant are deployed in a separate container cluster. Then, in the resource access process, when the control plane in any container cluster detects that the CRD resources in the container cluster are updated, the control plane directly reads the CRD resources of the container cluster. In this way, the isolation access of multi-tenant CRD resources is achieved.

[0089] For example, as shown in Figure 1 by deploying the control plane and data plane in the cloud vendor environment and the tenant environment respectively, the service mesh instance and the service runtime environment lifecycle management can be decoupled to a certain extent, and the control plane in the service mesh is hosted, thereby reducing the work burden of development and operation. When hosting the service mesh control plane, first, the cloud vendor needs to deploy a separate container cluster for each tenant, as shown in Figure 1As shown, for three tenants, three container clusters are deployed in the cloud vendor environment; then, the control plane of the service mesh of the tenant and the CRD resource are deployed in each container cluster; then, the tenant modifies the CRD resource deployed in the container cluster to make the control plane of the same tenant aware of the change of the configuration content; then, the control plane of the same tenant converts the rule content written in YAML, that is, the updated CRD resource, into the configuration content of the data plane, so as to control various configuration contents of the data plane. However, for each tenant to set an independent container cluster, since each container cluster needs to deploy some necessary system components, such as APIServer component, scheduler component and controller manager component and the like, a large number of container clusters need to deploy a large number of system components, thus causing waste of system resources of the container cluster.

[0090] Based on the above, in order to ensure the isolated access of the multi-tenant CRD resource while reducing the waste of system resources, the application provides a resource access method, device, cloud hosting system and electronic equipment.

[0091] Firstly, a resource access method provided by an embodiment of the application is introduced.

[0092] The resource access method provided by the embodiment of the application is applied to a target middleware; the target middleware is any one of a plurality of middlewares deployed in a container cluster; the container cluster also deploys a control plane and a custom CRD resource of each tenant, and each middleware is pre-associated with a control plane and a custom CRD resource of a unique tenant. Wherein, the custom resource can be a resource set in some special demand scenario in addition to the default resource in the Kubernetes open source system which can meet the demand of most daily system deployment and management, for example, the resource content of the custom resource can be rule content for traffic management, rule content for load balancing and the like.

[0093] It should be noted that the so-called control plane is a collection of control ends of a plurality of services of a tenant, that is, a collection of a plurality of control ends, and the data plane is a collection of processing ends of a plurality of services of a tenant. Wherein, each control end in the control plane can be deployed in a container, each control end can read all CRD resources of the container cluster where it is located, then filter, filter the CRD resource matched with the corresponding service, and control the behavior of the corresponding service by converting the CRD resource matched with the corresponding service into the configuration content of the data plane. In addition, the control plane and the data plane can be considered as functional programs provided by the cloud vendor, the control plane is hosted by the cloud vendor, and the data plane is deployed together with the corresponding service of the tenant.

[0094] In addition, some necessary system components are also deployed in the container cluster, for example: an APIServer component, a scheduler component and a controller manager component. Among them, the APIServer component is responsible for responding to the management request of the user, conducting command and coordination work, and the CRD resource is deployed in the component; the scheduler component is to bind the container to be scheduled to a suitable node according to a certain scheduling algorithm; and the controller manager component is a collection of a group of controllers, which is responsible for controlling and managing corresponding resources, such as replicas and node nodes.

[0095] The resource access method provided by the embodiment of the application can include the following steps:

[0096] Listen to whether the pre-associated CRD resource is updated;

[0097] When the update is listened to, the CRD resource that is updated is determined as a target CRD resource;

[0098] The target CRD resource is reported to the pre-associated target control plane, so that the target control plane obtains the target CRD resource.

[0099] In the scheme provided by the embodiment of the application, the control plane and the CRD resource of the multi-tenant are deployed in the same container cluster, and a plurality of middlewares are deployed in the container cluster, and each middleware is pre-associated with the control plane and the custom CRD resource of a unique tenant; further, whether the CRD resource pre-associated with the target middleware in the container cluster is updated is listened to; when the update is listened to, the CRD resource that is updated is determined as a target CRD resource; and then, the target CRD resource is reported to the target control plane pre-associated with the target middleware, so that the target control plane obtains the target CRD resource. It can be seen that, for the multi-tenant, by deploying the control plane and the CRD resource of the multi-tenant in the same container cluster, the number of container clusters can be greatly reduced, thereby reducing the waste of system resources of the container cluster; and in the container cluster, a plurality of middlewares are deployed, and each middleware is pre-associated with the control plane and the CRD resource of a unique tenant, so that the control plane can perceive the update of the CRD resource of the same tenant through the middleware pre-associated therewith, and obtain the CRD resource of the same tenant that is updated. It can be seen that, through the scheme, the isolated access of the CRD resource of the multi-tenant can be ensured while reducing the waste of system resources. In addition, by deploying the control plane of the multi-tenant in the same container cluster, the operation and maintenance personnel of the cloud vendor hosting the control plane can be facilitated in operation and maintenance management.

[0100] The resource access method provided by the embodiment of the present application will be described below with reference to the drawings.

[0101] As shown in the figure, the resource access method provided by the embodiment of the present application can include the following steps: Figure 2

[0102] S201, listening to whether the pre-associated CRD resource is updated;

[0103] In this embodiment, a plurality of middlewares, control planes of each tenant and custom CRD resources are deployed in the container cluster, each middleware is pre-associated with a control plane and a custom CRD resource of a unique tenant, and each middleware can listen to whether the pre-associated CRD resource is updated.

[0104] It can be understood that, since each middleware is pre-associated with a control plane and a custom CRD resource of a unique tenant, by listening to whether the pre-associated CRD resource is updated through the target middleware, the target control plane pre-associated with the target middleware can timely acquire the pre-associated CRD resource when the pre-associated CRD resource is updated, and the pre-associated CRD resource and the target control plane belong to the same tenant. That is, each middleware is equivalent to a bridge for connecting the control plane and the CRD resource of a unique tenant associated with the middleware, thereby facilitating the isolated management of the CRD resources of multiple tenants. Wherein, listening to whether the pre-associated CRD resource is updated can specifically mean listening to whether the pre-associated CRD resource is modified, deleted or added with a new resource. The implementation of pre-associating each middleware with a control plane and a custom CRD resource of a unique tenant can be various. For example, the implementation of pre-associating each middleware with a control plane and a custom CRD resource of a unique tenant can include: pre-establishing a one-to-one correspondence between the control plane of each tenant and the middleware, that is, assigning a control plane to each middleware; then establishing a correspondence between each middleware and a specified CRD resource, wherein the specified CRD resource corresponding to each middleware is a CRD resource belonging to the same tenant as the control plane corresponding to the middleware; thereby establishing an association between each middleware and a control plane and a custom CRD resource of a unique tenant. In this implementation, the naming of the CRD resource of each tenant can be related to the identification of the tenant, so that the tenant to which the CRD resource belongs can be identified based on the identification of the tenant, thereby facilitating the construction and update of the correspondence between the middleware and the CRD resource. Other implementation methods will be described later in combination with other embodiments.

[0105] ​The CRD resource updating manner can be various. For example, the CRD resource updating manner can include that an operation personnel submits a resource updating instruction for any tenant through an operation interface of the management platform, and then the management platform updates the CRD resource of the tenant in the container cluster when receiving the resource updating instruction.

[0106] The target middleware can listen to the updating of the pre-associated CRD resource in various manners. For example, the target middleware can listen to whether the pre-associated CRD resource is updated through a port in communication with the management platform, or listen to whether the pre-associated CRD resource is updated based on historical resource information of the pre-associated CRD resource. The historical resource information is resource information of the CRD resource that has been previously issued to the corresponding control plane, and can include a file name, a version number, a data size, and the like of the CRD resource.

[0107] In addition, each middleware can be an MCP (Mesh Configuration Protocol) middleware, through which the middleware can interact with other components in the container cluster for configuration. It should be noted that the specific type of the middleware is not limited in the embodiments of the present application as long as the scheme provided by the embodiments of the present application can be implemented.

[0108] S202, when the updating is listened to, determining the updated CRD resource as a target CRD resource;

[0109] It can be understood that since the CRD resource listened to by the target middleware can be multiple, that is, the CRD resource pre-associated with the target middleware can be multiple, when the pre-associated CRD resource is updated, the updated CRD resource needs to be determined as a target CRD resource. Thus, the target CRD resource can be read and reported to the pre-associated target control plane.

[0110] S203, reporting the target CRD resource to the pre-associated target control plane, so that the target control plane acquires the target CRD resource.

[0111] After detecting an updated target CRD resource, the target middleware reports the target CRD resource to the target control plane pre-associated with it, enabling the target control plane to obtain the target CRD resource. Subsequently, after obtaining the target CRD resource, the target control plane can replace it with the data plane's configuration content to control the data plane's behavior.

[0112] Alternatively, in one specific implementation, when the target middleware determines the target CRD resource, it can directly report the determined target CRD resource to the target control plane.

[0113] Optionally, in another specific implementation, the target CRD resource is reported to the pre-associated target control plane, including:

[0114] If a resource update query request is received from a pre-associated target control plane, the target CRD resource is reported to the pre-associated target control plane.

[0115] For example, the target control plane can periodically send resource update query requests to the target middleware, so that after receiving the resource query request, the target middleware reads the target CRD resource and reports it to the pre-associated target control plane. Thus, after the target control plane reads the target CRD resource through the target middleware, it can replace the target CRD resource with the configuration content of the data plane to control the behavior of the data plane.

[0116] In the scheme provided by the embodiment of the application, the control plane and the CRD resource of the multi-tenant are deployed in the same container cluster, and a plurality of middlewares are deployed in the container cluster, each of which is pre-associated with the control plane and the custom CRD resource of a unique tenant; then, the target middleware deployed in the container cluster is used to listen to whether the CRD resource pre-associated with the target middleware is updated; when the update is listened to, the CRD resource that is updated is determined as a target CRD resource; then, the target CRD resource is reported to the target control plane pre-associated with the target middleware, so that the target control plane acquires the target CRD resource. It can be seen that, for the multi-tenant, the control plane and the CRD resource of the multi-tenant are deployed in the same container cluster, so that the number of container clusters can be greatly reduced, thereby reducing the waste of system resources of the container cluster; and in the container cluster, a plurality of middlewares are deployed, each of which is pre-associated with the control plane and the CRD resource of a unique tenant, so that the control plane can perceive the update of the CRD resource of the same tenant through the middleware pre-associated with the control plane and acquire the CRD resource of the same tenant that is updated. It can be seen that, through the scheme, the isolated access of the CRD resource of the multi-tenant can be ensured while the waste of system resources is reduced. In addition, the control plane of the multi-tenant is deployed in the same container cluster, so that the operation and maintenance personnel of the cloud vendor hosting the control plane can be facilitated in operation and maintenance management.

[0117] Optionally, in another embodiment of the application, the namespaces of the control planes of different tenants are different, and the control plane and the CRD resource of each tenant have the same namespace.

[0118] The manner that each middleware is pre-associated with the control plane and the custom CRD resource of a unique tenant includes that the namespace of each middleware is the same as the namespace of the control plane and the CRD resource of a unique tenant.

[0119] In the embodiment, the namespace is used to distinguish the control planes of different tenants from the naming dimension. The namespace, also referred to as the name space, is a set of names for unique identification. In specific applications, the namespace of the control plane can be set through the namespace attribute of the control plane, and the control plane of a tenant corresponds to a namespace, and the control plane and the CRD resource of the tenant are set with the same namespace. In addition, a plurality of containers can be deployed in the control plane of a tenant, and the plurality of containers share a namespace.

[0120] It can be understood that, since the control planes of different tenants are provided with different namespaces, and each middleware and each CRD resource of each tenant are also provided with namespaces, whether each middleware has an association with each control plane and the custom CRD resource can be determined by determining whether the namespaces provided by the control plane, the middleware and the CRD resource are the same.

[0121] In addition, it should be noted that, in order to achieve the purpose of tenant isolation, one control plane can correspond to one middleware, that is, each middleware is uniquely associated with the namespace of the control plane of one tenant. Therefore, the control plane can obtain the CRD resource with the same namespace as the control plane through the middleware corresponding to the control plane.

[0122] In the embodiment, as shown in FIG. 3, Figure 3 The method comprises steps S301-S303:

[0123] S301, listening to whether the CRD resource with the same namespace is updated;

[0124] It can be understood that, since each middleware is uniquely associated with the namespace of the control plane of one tenant, the CRD resource with the same namespace as the target middleware is the CRD resource with the same namespace as the target control plane. At this time, by listening to whether the CRD resource with the same namespace is updated, the target control plane can read the CRD resource in time when the CRD resource is updated.

[0125] S302, when the update is listened to, determining the updated CRD resource as a target CRD resource;

[0126] The content of step 302 is similar to the content of step S202 described above, which will not be described here.

[0127] S303, reporting the target CRD resource to the target control plane with the same namespace, so that the target control plane obtains the target CRD resource.

[0128] It can be understood that, since the target CRD resource and the target control plane have the same namespace, the target CRD resource and the target control plane are the CRD resource and the control plane of the container cluster for the same tenant, so that the target control plane can access the CRD resource belonging to the tenant, and will not read the CRD resource of other tenants. Therefore, the isolated access of the CRD resource of the multi-tenant is realized.

[0129] In this embodiment, for multi-tenancy, by deploying the control plane and CRD resources of the multi-tenancy in the same container cluster, the number of container clusters can be greatly reduced, thereby reducing the waste of system resources of the container cluster; and the same namespace is set for the control plane and CRD resources of each tenant, and each tenant's control plane is associated with a middleware, so that the control plane can access the tenant's own CRD resources through the middleware, thereby achieving isolated access of the CRD resources of multi-tenancy. It can be seen that the present scheme can guarantee the isolated access of the CRD resources of multi-tenancy while reducing the waste of system resources. In addition, by deploying the control plane of multi-tenancy in the same container cluster, it is convenient for the operation and maintenance personnel of the cloud vendor hosting the control plane to perform operation and maintenance management.

[0130] In order to better understand the present scheme, a specific example of an embodiment of the present application is described below. Figure 4 and Figure 5 In order to better understand the present scheme, a specific example of an embodiment of the present application is described below.

[0131] Figure 4 A principle diagram of a cloud hosting scheme applying the resource access method provided by the embodiment of the present application is shown. As shown in Figure 4 , the data plane of each tenant is deployed in the tenant environment, and the control plane corresponding to each tenant data plane is deployed in the cloud vendor environment. By deploying the control plane and the data plane in different running environments, the life cycle management of the service mesh instance and the service running time environment can be decoupled to a certain extent.

[0132] In the cloud vendor environment, the control plane of each tenant is deployed in a container cluster, and different namespaces are set for the control plane of each tenant, for example: Figure 4 The "namespace-1" can be the namespace set for the control plane of tenant A, and the "namespace-2" can be the namespace set for the control plane of tenant B. And the MCP middleware and the CRD resources of each tenant are also deployed under the namespace set for the control plane of each tenant, that is, the MCP middleware and the CRD resources corresponding to the control plane of the tenant are set with the same namespace. In this deployment mode, only one system component of the container cluster needs to be deployed, reducing the resource occupation of the system component; at the same time, all the control planes of the tenants are in one container cluster, and when managing the service mesh control plane under different tenants, it is not necessary to enter different container clusters for management, and the operation and maintenance personnel only need to switch the namespace in the same container cluster to manage the control plane of different tenants, which can reduce the work burden of the operation and maintenance personnel.

[0133] In the tenant environment, the data plane is a set of processing ends for a plurality of services of the tenant, each processing end in the data plane is located in a service node in the container cluster, that is, in a container in the container cluster, and each processing end corresponds to a service. The service can call the processing end corresponding to the service to communicate with the processing ends corresponding to other services to realize the calling between different services.

[0134] Figure 5 A schematic diagram of the control plane reading the CRD resource under its own namespace is shown. As shown in Figure 5 , since the MCP middleware is deployed in each namespace, the way in which the control plane reads the CRD resource is set to be read from the MCP middleware through the MCP middleware, and then the MCP middleware is responsible for listening to and reading all CRD resources under the namespace. In this way, multi-tenant CRD isolation is achieved, and the control planes hosted by different tenants will not read the CRD resources of the other party.

[0135] Corresponding to the above method embodiment, the embodiment of the application also provides a container cluster, wherein a plurality of middlewares, control planes of each tenant, and custom CRD resources are deployed in the container cluster, each middleware is pre-associated with the control plane and the custom CRD resource of a unique tenant;

[0136] a target middleware, configured to listen to whether the pre-associated CRD resource is updated, when the update is listened to, determine the CRD resource that is updated as a target CRD resource, and report the target CRD resource to the pre-associated target control plane; wherein the target middleware is any one of the plurality of middlewares;

[0137] The target control plane is configured to receive the target CRD resource reported by the target middleware.

[0138] Optionally, the namespaces of the control planes of different tenants are different, and the control plane and the CRD resource of each tenant have the same namespace;

[0139] The pre-association of each middleware with the control plane and the custom CRD resource of a unique tenant includes that the namespace of each middleware is the same as that of the control plane and the CRD resource of a unique tenant;

[0140] The target middleware listens to whether the pre-associated CRD resource is updated, including:

[0141] listening to whether the CRD resource with the same namespace is updated;

[0142] The target middleware reports the target CRD resource to the pre-associated target control plane, including:

[0143] report the target CRD resource to a target control plane having the same namespace.

[0144] For specific function implementation of each component included in the container cluster, refer to the corresponding content in the method embodiments above, which will not be repeated here.

[0145] According to the above-mentioned method embodiments, the embodiments of the present application also provide a cloud hosting system, as shown in the figure, the system includes a management platform 610 and a container cluster 620; wherein the container cluster 620 is deployed with a plurality of middlewares, and the control plane and the custom CRD resource of each tenant, each middleware is pre-associated with the control plane and the custom CRD resource of a unique tenant; Figure 6

[0146] The management platform 610 is used for updating the CRD resource of the tenant in the container cluster when receiving the resource update instruction of any tenant;

[0147] The target middleware in the container cluster 620 is used for listening whether the pre-associated CRD resource is updated; when listening to the update, determining the updated CRD resource as the target CRD resource; reporting the target CRD resource to the pre-associated target control plane, so that the target control plane issues the target CRD resource to the data plane on the tenant side;

[0148] Wherein, the target middleware is any one of the plurality of middlewares.

[0149] Optionally, the namespaces of the control planes of different tenants are different, and the control plane and the CRD resource of each tenant have the same namespace;

[0150] The way that each middleware is pre-associated with the control plane and the custom CRD resource of a unique tenant includes that the namespace of each middleware is the same as the control plane and the CRD resource of a unique tenant;

[0151] The target middleware listens whether the pre-associated CRD resource is updated, including:

[0152] Listening whether the CRD resource having the same namespace is updated;

[0153] The target middleware reports the target CRD resource to the pre-associated target control plane, including:

[0154] Reporting the target CRD resource to the target control plane having the same namespace.

[0155] Optionally, the container cluster management platform is further used for: ​

[0156] outputting a namespace of each control plane in the container cluster;

[0157] when receiving a management instruction for a target namespace in each namespace, responding to the target management instruction to the control plane of the target namespace.

[0158] The specific function implementation of each component included in the system can refer to the corresponding content in the above method embodiments, which will not be repeated here.

[0159] According to the above-mentioned method embodiments, the embodiment of the application also provides a resource access device applied to a target middleware, such as Figure 7 As shown in the figure, the device comprises:

[0160] The listening module 710 is configured to listen to whether the pre-associated CRD resource is updated;

[0161] The determining module 720 is configured to, when listening to the update, determine the updated CRD resource as a target CRD resource;

[0162] The reporting module 730 is configured to report the target CRD resource to the pre-associated target control plane, so that the target control plane acquires the target CRD resource.

[0163] Optionally, the namespaces of the control planes of different tenants are different, and the control plane and the CRD resource of each tenant have the same namespace;

[0164] The manner that each middleware is pre-associated with the control plane and the custom CRD resource of a unique tenant comprises that each middleware is uniquely associated with the control plane and the namespace of the CRD resource of a unique tenant.

[0165] The listening module is specifically configured to:

[0166] listen to whether the CRD resource with the same namespace is updated;

[0167] The reporting module is specifically configured to:

[0168] report the target CRD resource to the target control plane with the same namespace.

[0169] Optionally, the reporting module is specifically configured to:

[0170] if a resource update inquiry request sent by the pre-associated target control plane is received, report the target CRD resource to the pre-associated target control plane.

[0171] Optionally, each middleware is a mesh configuration protocol (MCP) middleware.

[0172] The embodiment of the present application also provides an electronic device, such as Figure 8 As shown in the figure, the electronic device comprises a processor 801, a communication interface 802, a memory 803 and a communication bus 804, wherein the processor 801, the communication interface 802 and the memory 803 complete mutual communication through the communication bus 804,

[0173] The memory 803 is used for storing a computer program.

[0174] The processor 801 is used for executing the program stored in the memory 803, so as to realize the steps of any resource access method provided by the embodiment of the present application.

[0175] The communication bus mentioned in the above electronic device can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or only one type of bus.

[0176] The communication interface is used for communication between the above electronic device and other devices.

[0177] The memory can comprise a random access memory (RAM) and can also comprise a non-volatile memory (NVM), for example at least one disk memory. Optionally, the memory can also be at least one storage device located away from the aforementioned processor.

[0178] The processor mentioned above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc. and can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component.

[0179] In yet another embodiment of the present application, a computer readable storage medium is provided, which stores a computer program. The computer program, when executed by a processor, implements the steps of any of the above described resource access methods.

[0180] In yet another embodiment of the present application, a computer program product containing instructions, which when executed on a computer, causes the computer to perform the steps of any of the above described resource access methods.

[0181] In the above described embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer readable storage medium, or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be transferred from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) manner. The computer readable storage medium can be any available medium accessible by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be magnetic media (for example, floppy disk, hard disk, magnetic tape), optical media (for example, DVD), or semiconductor media (for example, solid state disk (SSD)) and the like.

[0182] It should be noted that, in this document, the terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the processes, methods, articles or devices including a series of elements not only include those elements, but also include other elements not explicitly listed or inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "including a" does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0183] Each of the embodiments in the specification is described in a relevant manner, and the same or similar parts between the embodiments can be referred to each other. Each of the embodiments focuses on the difference from other embodiments. In particular, for the system and device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiments.

[0184] The above description is merely the preferred embodiments of the present application, but not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A resource access method, characterized in that, It is applied to the target middleware; the target middleware is any one of multiple middlewares deployed in the container cluster; the container cluster also deploys the control plane and custom CRD resources of each tenant, and each middleware is pre-associated with the control plane and custom CRD resources of a unique tenant; The method includes: Listen for updates to pre-associated CRD resources; When an update is detected, the CRD resource that was updated is identified and used as the target CRD resource. The target CRD resource is reported to the pre-associated target control plane so that the target control plane can acquire the target CRD resource; Among them, the control planes of different tenants have different namespaces, and each tenant's control plane and CRD resources have the same namespace; The way each middleware is pre-associated with a unique tenant's control plane and custom CRD resources includes: each middleware uniquely shares the same namespace as a tenant's control plane and CRD resources; The monitoring of whether the pre-associated CRD resources have been updated includes: Monitor whether CRD resources in the same namespace have been updated; The step of reporting the target CRD resource to the pre-associated target control plane includes: The target CRD resource is reported to the target control plane with the same namespace.

2. The method according to claim 1, characterized in that, The step of reporting the target CRD resource to the pre-associated target control plane includes: If a resource update query request is received from a pre-associated target control plane, the target CRD resource is reported to the pre-associated target control plane.

3. The method according to any one of claims 1-2, characterized in that, Each of these middleware components is a Mesh Configuration Protocol (MCP) middleware.

4. A container cluster, characterized in that, The container cluster is deployed with multiple middlewares, as well as control planes and custom CRD resources for each tenant. Each middleware is pre-associated with a unique tenant's control plane and custom CRD resources. The target middleware is used to monitor whether the pre-associated CRD resources have been updated; when an update is detected, the updated CRD resource is identified as the target CRD resource; the target CRD resource is reported to the pre-associated target control plane; wherein, the target middleware is any one of a plurality of middlewares; The target control plane is used to receive the target CRD resources reported by the target middleware; Among them, the control planes of different tenants have different namespaces, and each tenant's control plane and CRD resources have the same namespace; The way each middleware is pre-associated with a unique tenant's control plane and custom CRD resources includes: each middleware uniquely shares the same namespace as a tenant's control plane and CRD resources; The target middleware monitors whether the pre-associated CRD resources have been updated, including: Monitor whether CRD resources in the same namespace have been updated; The target middleware reports the target CRD resource to the pre-associated target control plane, including: The target CRD resource is reported to the target control plane with the same namespace.

5. A cloud hosting system, characterized in that, This includes a management platform and a container cluster; wherein, the container cluster deploys multiple middleware, as well as the control plane and custom CRD resources of each tenant, and each middleware is pre-associated with the control plane and custom CRD resources of a unique tenant; The management platform is used to update the CRD resources of any tenant in the container cluster when it receives a resource update instruction for any tenant. The target middleware in the container cluster is used to monitor whether the pre-associated CRD resources have been updated; when an update is detected, the updated CRD resource is identified as the target CRD resource; the target CRD resource is reported to the pre-associated target control plane, so that the target control plane can distribute the target CRD resource to the tenant's data plane. Wherein, the target middleware is any one of the plurality of middlewares; Different tenants have different namespaces for their control planes, and each tenant's control plane and CRD resources have the same namespace. The way each middleware is pre-associated with a unique tenant's control plane and custom CRD resources includes: each middleware uniquely shares the same namespace as a tenant's control plane and CRD resources; The monitoring of whether the pre-associated CRD resources have been updated includes: Monitor whether CRD resources in the same namespace have been updated; The step of reporting the target CRD resource to the pre-associated target control plane includes: The target CRD resource is reported to the target control plane with the same namespace.

6. A resource access device, characterized in that, It is applied to the target middleware; the target middleware is any one of multiple middlewares deployed in the container cluster; the container cluster also deploys the control plane and custom CRD resources of each tenant, and each middleware is pre-associated with the control plane and custom CRD resources of a unique tenant; The device includes: The monitoring module is used to monitor whether the pre-associated CRD resources have been updated; The determination module is used to determine the CRD resource that has been updated when an update is detected, and use it as the target CRD resource. The reporting module is used to report the target CRD resource to the pre-associated target control plane so that the target control plane can obtain the target CRD resource; Among them, the control planes of different tenants have different namespaces, and each tenant's control plane and CRD resources have the same namespace; The way each middleware is pre-associated with a unique tenant's control plane and custom CRD resources includes: each middleware uniquely shares the same namespace as a tenant's control plane and CRD resources; The monitoring of whether the pre-associated CRD resources have been updated includes: Monitor whether CRD resources in the same namespace have been updated; The step of reporting the target CRD resource to the pre-associated target control plane includes: The target CRD resource is reported to the target control plane with the same namespace.

7. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the steps of the method described in any one of claims 1-3.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 1-3.

Images