A k8s permission management system based on Keycloak

Abstract

The present invention relates to the field of cluster management technology, and in particular to a k8s permission management system based on Keycloak. In the k8s permission management system based on Keycloak, the client module configures the k8s client, creates a k8s dynamic client, and completes the addition, deletion, modification and query operations of resources; the Keycloak authentication module implements unified identity authentication management; the custom role-based access control RBAC module defines roles and configures the binding relationship between users and roles; the permission verification module performs permission verification before each request; the logging and auditing module records the verification results and sets alarms. The k8s permission management system based on Keycloak implements unified identity authentication management, improves the flexibility and efficiency of permission management, is simple and easy to use, can be seamlessly connected with the existing system, and reduces the cost of use and maintenance.

Description

Technical Field

[0001] The present invention relates to the technical field of cluster management, and in particular to a k8s authority management system based on Keycloak. Background Art

[0002] With the rapid development of cloud computing technology, Kubernetes, or k8s for short, has been widely used as a powerful container orchestration tool. Kubernetes can provide powerful resource management and scheduling capabilities to help enterprises achieve automated deployment, expansion and management of applications. However, as the scale of Kubernetes clusters expands and usage scenarios become more complex, how to safely and effectively manage user permissions has become an important issue.

[0003] The existing Kubernetes permission management mainly relies on the role-based access control (RBAC) mechanism. Although role-based access control (RBAC) can achieve fine-grained permission control, in actual applications, managing and maintaining complex role-based access control (RBAC) policies is still a challenging task. Especially in a multi-tenant environment, the division and management of permissions between different users and teams requires a more flexible and efficient solution. In addition, it is also difficult for Kubernetes' native permission management tools to connect to the company's existing identity authentication and permission management systems (such as Lightweight Directory Access Protocol LDAP, Open Authorization OAuth, Security Assertion Markup Language SAML, etc.).

[0004] In order to achieve the docking of multiple authentication systems and role-based access control (RBAC), the present invention proposes a k8s permission management system based on Keycloak. Summary of the invention

[0005] In order to make up for the defects of the prior art, the present invention provides a simple and efficient k8s permission management system based on Keycloak.

[0006] The present invention is achieved through the following technical solutions:

[0007] A k8s permission management system based on Keycloak, characterized by:

[0008] The client module is responsible for configuring the k8s client and creating a k8s dynamic client;

[0009] If the resource that the user wants to operate does not belong to the custom resource definition CRD (Custom Resource Definitions) resource, call the operation method of the corresponding resource in the k8s client to complete the resource addition, deletion, modification and query operations;

[0010] If the resource that the user wants to operate belongs to a custom resource definition CRD resource, the operation method of the custom resource definition CRD resource in the k8s dynamic client is called to complete the resource addition, deletion, modification and query operations;

[0011] Keycloak authentication module, responsible for installing Keycloak, monitoring user registration, update and deletion events, synchronizing changed data to the local database, and realizing unified identity authentication management;

[0012] Customize the role-based access control (RBAC) module, which is responsible for defining roles in keycloak or custom clients, and configuring the binding relationship between users and roles to ensure that each user is assigned to the correct role;

[0013] The permission verification module is responsible for implementing middleware on the client side through filters or interceptors to intercept requests. It calls the custom role-based access control (RBAC) module before each request to verify permissions and ensure that the user has the permission to operate the resource.

[0014] The logging and auditing module is responsible for recording the results of each permission verification. The audit log is saved in a secure location for query and analysis when needed, and alarms are set to notify administrators when abnormal permission access occurs.

[0015] The implementation steps of the client module to configure the k8s client are as follows:

[0016] S1.1. Determine the K8s resource types that need to be supported, including container groups Pod, services Service, deployment Deployment, configuration items ConfigMap and custom resource definition CRD;

[0017] S1.2. Determine the supported operations, including create, read, update, and delete;

[0018] S1.3. Install the K8s client library;

[0019] S1.4. Install the YAML (YAML Ain't Markup Language) parsing library;

[0020] S1.5. Use the Kube configuration function kubernetes.config.load_kube_config() to load the local Kube configuration kubeconfig file and configure the k8s client.

[0021] After receiving the YAML file provided by the user, the client module performs the following operations:

[0022] S2.1. Use the PyYAML library to parse the YAML file provided by the user and convert it into a Python dictionary object;

[0023] S2.2, extract the API version apiVersion and type kind and the namespace metadata.namespace field from the YAML file to identify the resource type;

[0024] S2.3. Determine whether the resource to be operated by the user belongs to a custom resource definition CRD (Custom Resource Definitions) resource based on the parsed value of the type kind field:

[0025] If its type kind does not belong to the custom resource definition CRD, the YAML file is converted into JSON format, and the operation method of the corresponding resource in the k8s client is called according to the user's operation type to complete the resource addition, deletion, modification and query operations;

[0026] If its type kind belongs to custom resource definition CRD, call the custom resource definition CRD query interface of the k8s client according to the type kind to obtain the custom resource definition CRD detailed information corresponding to the type kind; parse the custom resource definition CRD detailed information to obtain the application programming interface API group spec.group, resource type spec.names.kind, plural form of the resource spec.names.plural, singular and plural name spec.names of the resource type and singular form singular field.

[0027] The client module first converts the YAML file of type kind belonging to the custom resource definition CRD into JSON format, and then calls the operation method of the custom resource definition CRD in the k8s dynamic client according to the user's operation type, and passes in the application programming interface API group spec.group, resource type spec.names.kind, plural form of the resource spec.names.plural, singular and plural names of the resource type spec.names and singular form singular field, and the namespace metadata.namespace field obtained in step S2.2 to complete the resource addition, deletion, modification and query operations.

[0028] The Keycloak authentication module implements unified identity authentication management. The steps are as follows:

[0029] S3.1. Install keycloak. Keycloak connects to the user's existing permission management system, including the Lightweight Directory Access Protocol LDAP system, the Open Authorization OAuth system, and the Security Assertion Markup Language SAML system, to achieve unified identity authentication management;

[0030] S3.2. Create a new tenant Realm in Keycloak to isolate different user groups;

[0031] S3.3. Create a client under the tenant Realm and configure the client's callback URL and valid redirect URI to interact with the custom client.

[0032] S3.4. Listen to user registration, update and deletion events through the keycloak program interface Admin REST API;

[0033] When changes in user information are detected, the changed data is synchronized to the local database, including the user's registration information and role information.

[0034] The custom role-based access control RBAC module first defines roles in keycloak or a custom client, and each role corresponds to a set of permissions;

[0035] At the same time, clarify the specific content of each permission, including reading Pods and creating Deployments, to ensure that the permission description is clear and easy to understand.

[0036] The logging and auditing module records the results of each permission verification, including the time of the request, the user, the operation type, the resource type and the result.

[0037] A k8s permission management device based on Keycloak, characterized in that it includes a memory and a processor; the memory is used to store a computer program, and the processor is used to implement the above-mentioned system when executing the computer program.

[0038] A readable storage medium, characterized in that: a computer program is stored on the readable storage medium, and the computer program implements the above-mentioned system when executed by a processor.

[0039] The beneficial effects of the present invention are as follows: the k8s permission management system based on Keycloak realizes unified identity authentication management through Keycloak, improves the flexibility and efficiency of permission management, is simple and easy to use, can be seamlessly connected with the existing system, and reduces the cost of use and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0041] Attached Figure 1 This is a schematic diagram of the k8s permission management system based on Keycloak of the present invention. DETAILED DESCRIPTION

[0042] In order to enable those skilled in the art to better understand the technical solutions in the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0043] As attached Figure 1 As shown in the figure, the k8s permission management system based on Keycloak includes client module, Keycloak authentication module, custom role-based access control RBAC module, permission verification module, logging and auditing module;

[0044] The client module is responsible for configuring the k8s client and creating a k8s dynamic client;

[0045] If the resource that the user wants to operate does not belong to the custom resource definition CRD (Custom Resource Definitions) resource, call the operation method of the corresponding resource in the k8s client to complete the resource addition, deletion, modification and query operations;

[0046] If the resource that the user wants to operate belongs to a custom resource definition CRD resource, the operation method of the custom resource definition CRD resource in the k8s dynamic client is called to complete the resource addition, deletion, modification and query operations;

[0047] The implementation steps of the client module to configure the k8s client are as follows:

[0048] S1.1. Determine the K8s resource types that need to be supported, including container groups Pod, services Service, deployment Deployment, configuration items ConfigMap and custom resource definition CRD;

[0049] S1.2. Determine the supported operations, including create, read, update, and delete;

[0050] S1.3. Install the K8s client library;

[0051] S1.4. Install the YAML (YAML Ain't Markup Language) parsing library;

[0052] S1.5. Use the Kube configuration function kubernetes.config.load_kube_config() to load the local Kube configuration kubeconfig file and configure the k8s client.

[0053] After receiving the YAML file provided by the user, the client module performs the following operations:

[0054] S2.1. Use the PyYAML library to parse the YAML file provided by the user and convert it into a Python dictionary object;

[0055] S2.2, extract the API version apiVersion and type kind and the namespace metadata.namespace field from the YAML file to identify the resource type;

[0056] S2.3. Determine whether the resource to be operated by the user belongs to a custom resource definition CRD (Custom Resource Definitions) resource based on the parsed value of the type kind field:

[0057] If its type kind does not belong to the custom resource definition CRD, the YAML file is converted into JSON format, and the operation method of the corresponding resource in the k8s client is called according to the user's operation type to complete the resource addition, deletion, modification and query operations;

[0058] If its type kind belongs to custom resource definition CRD, call the custom resource definition CRD query interface of the k8s client according to the type kind to obtain the custom resource definition CRD detailed information corresponding to the type kind; parse the custom resource definition CRD detailed information to obtain the application programming interface API group spec.group, resource type spec.names.kind, plural form of the resource spec.names.plural, singular and plural name spec.names of the resource type and singular form singular field.

[0059] The client module first converts the YAML file of type kind belonging to the custom resource definition CRD into JSON format, and then calls the operation method of the custom resource definition CRD in the k8s dynamic client according to the user's operation type, and passes in the application programming interface API group spec.group, resource type spec.names.kind, plural form of the resource spec.names.plural, singular and plural names of the resource type spec.names and singular form singular field, and the namespace metadata.namespace field obtained in step S2.2 to complete the resource addition, deletion, modification and query operations.

[0060] Keycloak authentication module, responsible for installing Keycloak, monitoring user registration, update and deletion events, synchronizing changed data to the local database, and realizing unified identity authentication management;

[0061] The Keycloak authentication module implements unified identity authentication management. The steps are as follows:

[0062] S3.1. Install keycloak. Keycloak connects to the user's existing permission management system, including the Lightweight Directory Access Protocol LDAP system, the Open Authorization OAuth system, and the Security Assertion Markup Language SAML system, to achieve unified identity authentication management;

[0063] S3.2. Create a new tenant Realm in Keycloak to isolate different user groups;

[0064] S3.3. Create a client under the tenant Realm and configure the client's callback URL and valid redirect URI to interact with the custom client.

[0065] S3.4. Listen to user registration, update and deletion events through the keycloak program interface Admin REST API;

[0066] When changes in user information are detected, the changed data is synchronized to the local database, including the user's registration information and role information.

[0067] Customize the role-based access control (RBAC) module, which is responsible for defining roles in keycloak or custom clients, and configuring the binding relationship between users and roles to ensure that each user is assigned to the correct role;

[0068] The custom role-based access control RBAC module first defines roles in keycloak or a custom client, and each role corresponds to a set of permissions;

[0069] At the same time, clarify the specific content of each permission, including reading Pods and creating Deployments, to ensure that the permission description is clear and easy to understand.

[0070] The permission verification module is responsible for implementing middleware on the client side through filters or interceptors to intercept requests. It calls the custom role-based access control (RBAC) module before each request to verify permissions and ensure that the user has the permission to operate the resource.

[0071] The logging and auditing module is responsible for recording the results of each permission verification. The audit log is saved in a secure location for query and analysis when needed, and alarms are set to notify administrators when abnormal permission access occurs.

[0072] The logging and auditing module records the results of each permission verification, including the time of the request, user, operation type, resource type and result.

[0073] The Keycloak-based k8s permission management device includes a memory and a processor; the memory is used to store a computer program, and the processor is used to implement the above system when executing the computer program.

[0074] The readable storage medium stores a computer program, and the computer program implements the above system when executed by the processor.

[0075] Compared with the existing technology, the k8s permission management system based on Keycloak has the following characteristics:

[0076] First, it can be seamlessly connected with the company's existing system: unified identity authentication management can be achieved through Keycloak without modifying the company's existing user system.

[0077] Second, efficient permission management: Through the customized role-based access control (RBAC) mechanism, dynamic adjustment and real-time effectiveness of permissions are achieved, improving the flexibility and efficiency of permission management.

[0078] Third, secure permission control: Through permission verification and log recording, the security and traceability of operations can be ensured.

[0079] Fourth, simple and easy to use: It provides a simple and easy-to-use client interface, which reduces the cost of use and maintenance and improves the efficiency of user operations.

[0080] The embodiment described above is only one specific implementation of the present invention. Common changes and substitutions made by those skilled in the art within the scope of the technical solution of the present invention should be included in the protection scope of the present invention.

Claims

1. A k8s permission management system based on Keycloak, characterized by: include: The client module is responsible for configuring the k8s client and creating a k8s dynamic client; If the resource that the user wants to operate does not belong to the custom resource definition CRD resource, the operation method of the corresponding resource in the k8s client is called to complete the resource addition, deletion, modification and query operations; If the resource that the user wants to operate belongs to a custom resource definition CRD resource, the operation method of the custom resource definition CRD resource in the k8s dynamic client is called to complete the resource addition, deletion, modification and query operations; Keycloak authentication module, responsible for installing Keycloak, monitoring user registration, update and deletion events, synchronizing changed data to the local database, and realizing unified identity authentication management; Customize the role-based access control (RBAC) module, which is responsible for defining roles in keycloak or custom clients, and configuring the binding relationship between users and roles to ensure that each user is assigned to the correct role; The permission verification module is responsible for implementing middleware on the client side through filters or interceptors to intercept requests. It calls the custom role-based access control (RBAC) module before each request to verify permissions and ensure that the user has the permission to operate the resource. The logging and auditing module is responsible for recording the results of each permission verification. The audit log is saved in a secure location for query and analysis when needed, and alarms are set to notify administrators when abnormal permission access occurs.

2. According to the Keycloak-based k8s rights management system of claim 1, it is characterized by: The implementation steps of the client module to configure the k8s client are as follows: S1.

1. Determine the K8s resource types that need to be supported, including container groups Pod, services Service, deployment Deployment, configuration items ConfigMap and custom resource definition CRD; S1.

2. Determine the supported operations, including create, read, update, and delete; S1.

3. Install the K8s client library; S1.

4. Install the YAML parsing library; S1.

5. Use the Kube configuration function kubernetes.config.load_kube_config() to load the local Kube configuration kubeconfig file and configure the k8s client.

3. According to the Keycloak-based k8s rights management system of claim 2, it is characterized in that: After receiving the YAML file provided by the user, the client module performs the following operations: S2.

1. Use the PyYAML library to parse the YAML file provided by the user and convert it into a Python dictionary object; S2.2, extract the API version apiVersion and type kind and the namespace metadata.namespace field from the YAML file to identify the resource type; S2.

3. Determine whether the resource to be operated by the user belongs to a custom resource definition CRD resource based on the parsed value of the type kind field: If its type kind does not belong to the custom resource definition CRD, the YAML file is converted into JSON format, and the operation method of the corresponding resource in the k8s client is called according to the user's operation type to complete the resource addition, deletion, modification and query operations; If its type kind belongs to custom resource definition CRD, call the custom resource definition CRD query interface of the k8s client according to the type kind to obtain the custom resource definition CRD detailed information corresponding to the type kind; parse the custom resource definition CRD detailed information to obtain the application programming interface API group spec.group, resource type spec.names.kind, plural form of the resource spec.names.plural, singular and plural name spec.names of the resource type and singular form singular field.

4. According to the Keycloak-based k8s rights management system of claim 3, it is characterized in that: The client module first converts the YAML file of type kind belonging to the custom resource definition CRD into JSON format, and then calls the operation method of the custom resource definition CRD in the k8s dynamic client according to the user's operation type, and passes in the application programming interface API group spec.group, resource type spec.names.kind, plural form of the resource spec.names.plural, singular and plural names of the resource type spec.names and singular form singular field, and the namespace metadata.namespace field obtained in step S2.2 to complete the resource addition, deletion, modification and query operations.

5. According to the Keycloak-based k8s rights management system of claim 1, it is characterized in that: The Keycloak authentication module implements unified identity authentication management. The steps are as follows: S3.

1. Install keycloak. Keycloak connects to the user's existing permission management system, including the Lightweight Directory Access Protocol LDAP system, the Open Authorization OAuth system, and the Security Assertion Markup Language SAML system, to achieve unified identity authentication management; S3.

2. Create a new tenant Realm in Keycloak to isolate different user groups; S3.

3. Create a client under the tenant Realm and configure the client's callback URL and valid redirect URI to interact with the custom client. S3.

4. Listen to user registration, update and deletion events through the keycloak program interface Admin REST API; When changes in user information are detected, the changed data is synchronized to the local database, including the user's registration information and role information.

6. The Keycloak-based k8s rights management system according to claim 1 is characterized in that: The custom role-based access control RBAC module first defines roles in keycloak or a custom client, and each role corresponds to a set of permissions; At the same time, clarify the specific content of each permission, including reading Pods and creating Deployments, to ensure that the permission description is clear and easy to understand.

7. The k8s permission management system based on Keycloak according to claim 1 is characterized in that: The logging and auditing module records the results of each permission verification, including the time of the request, user, operation type, resource type and result.

8. A k8s permission management device based on Keycloak, characterized by: The system comprises a memory and a processor; the memory is used to store a computer program, and the processor is used to implement the system as claimed in any one of claims 1 to 7 when executing the computer program.

9. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by a processor, the system according to any one of claims 1 to 7 is implemented.

Images