An encryption method and apparatus

Abstract

This application provides an encryption method and apparatus, applied in the field of data processing technology, for encrypting Kubernetes resources and improving data storage security. The method includes receiving a first encrypted configuration file; obtaining a second encrypted configuration file from the platform; determining a first object based on the first and second encrypted configuration files; the first object being a Kubernetes object present in the first encrypted configuration file but not present in the second encrypted configuration file; adding the first object to the second encrypted configuration file to obtain a third encrypted configuration file; and encrypting Kubernetes resources on the platform based on all Kubernetes objects in the third encrypted configuration file.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to an encryption method and apparatus. Background Technology

[0002] With technological advancements, Kubernetes has gradually become an industry-recognized container orchestration and scheduling platform. It automates the deployment, scaling, and operation of application containers, becoming a fundamental infrastructure in the cloud-native field. Consequently, many enterprises have built Kubernetes cloud platforms and migrated their businesses to them. However, as more and more services are deployed within Kubernetes clusters, optimizing the cloud platform becomes a crucial issue for operations personnel, particularly regarding security. Because some commonly used business configuration information is stored in plaintext in the cloud platform's database, significant security vulnerabilities exist. Kubernetes' built-in encryption methods require complex configuration, are difficult to operate, and cannot encrypt historically stored data.

[0003] Therefore, how to encrypt Kubernetes resources and improve the security of data storage is an urgent problem to be solved. Summary of the Invention

[0004] This application provides an encryption method and apparatus for encrypting Kubernetes resources and improving data storage security.

[0005] In a first aspect, embodiments of this application provide an encryption method, including:

[0006] Receive a first encrypted configuration file; the first encrypted configuration file includes at least one first Kubernetes object, which is used to indicate the Kubernetes resource to be encrypted in the Kubernetes-based container orchestration and scheduling platform;

[0007] Obtain a second encrypted configuration file from the platform. The second encrypted configuration file includes at least one second Kubernetes object, which is used to indicate Kubernetes resources in the platform with a security level greater than a threshold.

[0008] Based on the first encrypted configuration file and the second encrypted configuration file, the first object is determined; the first object is a Kubernetes object that exists in the first encrypted configuration file but does not exist in the second encrypted configuration file.

[0009] Add the first object to the second encrypted configuration file to obtain the third encrypted configuration file;

[0010] The Kubernetes resources in the platform are encrypted based on all Kubernetes objects in the third encryption configuration file.

[0011] In this method, the first encryption configuration file includes a first Kubernetes object (which can be understood as a new object), and the second encryption configuration file includes a second Kubernetes object (which can be understood as a historical object). Based on the first and second encryption configuration files, the newly added Kubernetes resource to be encrypted (i.e., the Kubernetes resource indicated by the first object) can be determined. The first object is added to the second encryption configuration file to obtain a third encryption configuration file. This third encryption configuration file then encrypts all Kubernetes resources indicated by all Kubernetes objects in the third encryption configuration file. This allows for encryption protection of all Kubernetes resources that need protection, improving data storage security. Furthermore, operations personnel only need to configure the first Kubernetes object in the first encryption configuration file, eliminating the need for complex manual encryption configuration. This reduces the workload for operations personnel, minimizes errors, and effectively ensures the correctness of encryption.

[0012] Optionally, the first encrypted configuration file also includes a first key and first data; before obtaining the second encrypted configuration file from the platform, it further includes: encoding the first data according to a preset encoding method to obtain the second key; and determining that the first key and the second key are the same.

[0013] In this method, the first data in the first encrypted configuration file configured by the operation and maintenance personnel is encoded to obtain the second key. It is determined that the second key is the same as the first key, that is, it is determined that the operation and maintenance personnel used the same encoding method as the preset encoding method to encode the first data. This can verify the legitimacy of the operation and maintenance personnel's identity and improve the reliability of the embodiments of this application.

[0014] Optionally, the Kubernetes resources in the platform are encrypted based on all Kubernetes objects in the third encryption configuration file, including: if a third Kubernetes object exists in the third encryption configuration file and the Kubernetes resource indicated by the third Kubernetes object is not encrypted, then the Kubernetes resource indicated by the third Kubernetes object is encrypted using the first key.

[0015] In this method, the first key is used to encrypt the unencrypted Kubernetes resource corresponding to the third Kubernetes object in the third encrypted configuration file, so that the unencrypted Kubernetes resource that needs to be protected is encrypted and protected, which can improve the security of data storage.

[0016] Optionally, Kubernetes resources in the platform are encrypted based on all Kubernetes objects in the third encryption configuration file, including: if a fourth Kubernetes object exists in the third encryption configuration file and the Kubernetes resource indicated by the fourth Kubernetes object has been encrypted using the first key, then the first key is used to encrypt the Kubernetes resources indicated by other objects besides the fourth Kubernetes object.

[0017] In this method, the first key is used to encrypt Kubernetes resources that are not encrypted using the first key, ensuring that all Kubernetes resources indicated by Kubernetes objects in the third encryption configuration file are encrypted using the first key. This ensures that Kubernetes resources with higher security levels (i.e., those requiring special protection) are encrypted and protected, thereby improving the security of data storage.

[0018] Optionally, the Kubernetes resources in the platform are encrypted based on all Kubernetes objects in the third encryption configuration file, including: if there is a fifth Kubernetes object in the third encryption configuration file, and the Kubernetes resource indicated by the fifth Kubernetes object has been encrypted with a third key, and the third key is different from the first key, then the encrypted Kubernetes resource indicated by the fifth Kubernetes object is decrypted using the third key, and the decrypted Kubernetes resource is encrypted using the first key.

[0019] In this method, Kubernetes resources encrypted with a third key are decrypted and then encrypted with a first key, which unifies the encryption method of all Kubernetes resources and facilitates the management of Kubernetes resources.

[0020] Optionally, before encrypting the Kubernetes resources in the platform based on all Kubernetes objects in the third encrypted configuration file, the method further includes: determining a second object based on the first encrypted configuration file and the second encrypted configuration file, wherein the second object is a Kubernetes object that does not exist in the first encrypted configuration file but exists in the second encrypted configuration file; and deleting the second object from the third encrypted configuration file.

[0021] In this method, Kubernetes objects that do not need to be encrypted (i.e., the second object) are determined based on the first and second encryption configuration files. The second object is then deleted from the third encryption configuration file, avoiding subsequent encryption of the Kubernetes resources indicated by the second object. This method can accurately encrypt only the Kubernetes resources that need encryption protection, saving computing resources.

[0022] Optionally, the method also includes: decrypting the encrypted Kubernetes resource indicated by the second object.

[0023] In this method, if the Kubernetes resource indicated by the second object that does not require encryption is already encrypted, it can be decrypted to avoid consuming too many resources and to prevent resource clutter.

[0024] Optionally, the first encrypted configuration file may also include the storage path of the second encrypted configuration file. Obtaining the second encrypted configuration file from the platform includes: determining whether a file exists at the storage location indicated by the storage path; if it exists, determining that the file is the second encrypted configuration file; if it does not exist, creating an empty file and using the empty file as the second encrypted configuration file.

[0025] In this method, the existence of the second encrypted configuration file is ensured by the storage path of the second encrypted configuration file in the first encrypted configuration file, thereby guaranteeing subsequent encryption configuration and improving the reliability of the embodiments of this application.

[0026] Secondly, embodiments of this application provide an encryption device, including:

[0027] The receiving unit is configured to: receive a first encrypted configuration file; the first encrypted configuration file includes at least one first Kubernetes object, the first Kubernetes object being used to indicate the Kubernetes resource to be encrypted in a Kubernetes-based container orchestration and scheduling platform;

[0028] The acquisition unit is used to: acquire a second encrypted configuration file from the platform, the second encrypted configuration file including at least one second Kubernetes object, the second Kubernetes object being used to indicate Kubernetes resources in the platform with a security level greater than a threshold;

[0029] The processing unit is configured to: determine a first object based on a first encrypted configuration file and a second encrypted configuration file; the first object is a Kubernetes object that exists in the first encrypted configuration file but does not exist in the second encrypted configuration file; add the first object to the second encrypted configuration file to obtain a third encrypted configuration file; and encrypt the Kubernetes resources in the platform based on all the Kubernetes objects in the third encrypted configuration file.

[0030] Optionally, the first encrypted configuration file also includes a first key and first data; before the acquisition unit obtains the second encrypted configuration file from the platform, the processing unit is further configured to: encode the first data according to a preset encoding method to obtain the second key; and determine that the first key and the second key are the same.

[0031] Optionally, when the processing unit encrypts Kubernetes resources in the platform based on all Kubernetes objects in the third encryption configuration file, it is configured to: if a third Kubernetes object exists in the third encryption configuration file and the Kubernetes resource indicated by the third Kubernetes object is not encrypted, then encrypt the Kubernetes resource indicated by the third Kubernetes object using the first key.

[0032] Optionally, when the processing unit encrypts Kubernetes resources in the platform based on all Kubernetes objects in the third encryption configuration file, it is configured to: if a fourth Kubernetes object exists in the third encryption configuration file and the Kubernetes resource indicated by the fourth Kubernetes object has been encrypted using the first key, then use the first key to encrypt the Kubernetes resources indicated by other objects besides the fourth Kubernetes object.

[0033] Optionally, when the processing unit encrypts Kubernetes resources in the platform based on all Kubernetes objects in the third encryption configuration file, it performs the following: if a fifth Kubernetes object exists in the third encryption configuration file, and the Kubernetes resource indicated by the fifth Kubernetes object has been encrypted using a third key, and the third key is different from the first key, then the third key is used to decrypt the encrypted Kubernetes resource indicated by the fifth Kubernetes object, and the first key is used to encrypt the decrypted Kubernetes resource.

[0034] Optionally, before encrypting the Kubernetes resources in the platform based on all Kubernetes objects in the third encrypted configuration file, the processing unit is further configured to: determine a second object based on the first encrypted configuration file and the second encrypted configuration file, wherein the second object is a Kubernetes object that does not exist in the first encrypted configuration file but exists in the second encrypted configuration file; and delete the second object from the third encrypted configuration file.

[0035] Optionally, the processing unit is also used to: decrypt the encrypted Kubernetes resource indicated by the second object.

[0036] Optionally, the first encrypted configuration file also includes the storage path of the second encrypted configuration file. When the acquisition unit acquires the second encrypted configuration file from the platform, it is used to: determine whether a file exists at the storage location indicated by the storage path; if it exists, determine that the file is the second encrypted configuration file; if it does not exist, create an empty file and use the empty file as the second encrypted configuration file.

[0037] Thirdly, embodiments of this application provide an electronic device including at least one processor, which, when executing a computer program stored in a memory, causes the method as described in the first aspect or any optional implementation of the first aspect to be implemented.

[0038] Fourthly, embodiments of this application provide a computer-readable storage medium for storing instructions that, when executed, cause the method as described in the first aspect or any optional implementation of the first aspect to be implemented.

[0039] Fifthly, embodiments of this application provide a computer program product, including computer program code, which, when executed on a computer, causes the method as described in the first aspect or any optional implementation of the first aspect to be implemented.

[0040] The technical effects or advantages of one or more technical solutions provided in the second, third, fourth and fifth aspects of this application can all be explained by the corresponding technical effects or advantages of one or more technical solutions provided in the first aspect. Attached Figure Description

[0041] Figure 1 A flowchart of an encryption method provided in an embodiment of this application;

[0042] Figure 2 An example diagram illustrating a Kubernetes resource encryption method provided in this application embodiment;

[0043] Figure 3A specific method example diagram of an encryption configuration module provided in this application embodiment is shown;

[0044] Figure 4 A structural diagram of an encryption device provided in an embodiment of this application;

[0045] Figure 5 This is a structural diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0046] The data collection, dissemination, and use in this application all comply with relevant national laws and regulations.

[0047] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0048] The technical solution of this application will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of this application and the specific features in the embodiments are detailed descriptions of the technical solution of this application, rather than limitations on the technical solution of this application. In the absence of conflict, the embodiments of this application and the technical features in the embodiments can be combined with each other.

[0049] It should be understood that "multiple" in the description of the embodiments of this application refers to two or more. "First," "second," etc., in the embodiments of this application are used to distinguish different objects, not to describe a specific order. The term "and / or" in the embodiments of this application is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Furthermore, the term "comprising" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices. In the embodiments of this application, a module refers to a part of a software system that has independent functionality.

[0050] With technological advancements, Kubernetes has gradually become a commonly used container orchestration and scheduling platform in the financial industry. It automates the deployment, scaling, and operation of application containers, becoming a fundamental infrastructure in the cloud-native domain. Consequently, many enterprises have built Kubernetes cloud platforms and migrated their businesses to them. However, as more and more services are deployed within Kubernetes clusters, cloud platform developers and operators need to consider and address the requirements of various business groups, optimizing the cloud platform, including but not limited to functional, performance, and security optimizations.

[0051] With everything now interconnected, the accompanying security risks can trigger a series of security issues, leading to increased emphasis on security across various industries. For cloud platform Kubernetes clusters, the most prominent need is for secure encryption. Currently, all services within a Kubernetes cluster need to interact with the backend open-source Extended Distributed Key-Value (ETCD) database through the APIserver component to store or retrieve data before proceeding to the next step. Commonly used business configuration information (such as Kubernetes Secrets and Configmaps, i.e., second Kubernetes objects) is stored in plaintext in ETCD. If ETCD information is leaked or maliciously compromised, the business configuration information stored in Secrets and Configmaps can be illegally obtained, posing a significant security threat to the business. Therefore, encrypting and storing Kubernetes resources such as Secrets and Configmaps for storing business information is extremely important and can effectively improve the security of cloud platforms and project applications.

[0052] Currently, to address the aforementioned security encryption requirements, the Kubernetes community provides a solution to encrypt resources such as Secrets and Configmaps in Kubernetes, enabling data to be stored in encrypted form in the ETCD database. Specifically: 1. A random key needs to be created, typically obtained by base64 encoding a 32-byte hash code; 2. Create a YAML file of type EncryptionConfiguration (i.e., the second encryption configuration file). In this YAML file object, fill in the Kubernetes objects to be encrypted (e.g., Secrets, Configmaps, etc., i.e., the second Kubernetes object), the encryption hash created above, and specify the encryption strength (i.e., the encryption algorithm, such as secretbox, aesgcm, aescbc, etc.); 3. Mount the above YAML file to the Kubernetes API server and restart the API server; 4. Since restarting the API server only ensures encryption of subsequently created Kubernetes resources but not existing Kubernetes resources, a full update operation is also required.

[0053] The above describes the configuration of an encryption key. Subsequent key rotation is required periodically, which involves creating new keys, re-editing the YAML file for the `EncryptionConfiguration` resource type, restarting the API server, and updating existing resources. If the object to be encrypted changes (e.g., no longer wanting to encrypt Configmap resources, or adding encrypted Pod resources), and this involves changes to the Kubernetes object in the `EncryptionConfiguration` file, an additional step is needed: when deleting an object, change it to a keyless form, update existing resources, and then delete it; when adding a new object, configure it with an encryption key and update existing resources.

[0054] As the steps above show, the current Kubernetes community-provided solution is quite cumbersome. First, it requires creating a key and performing base64 encoding. Next, it involves editing the encryption configuration file, creating a YAML file of type `EncryptionConfiguration`, and specifying the Kubernetes resource object to be encrypted, the key, and the encryption algorithm. Since `EncryptionConfiguration` is not a visual or instantiated resource within the Kubernetes cluster and is a rarely used configuration, even professional Kubernetes operators may not have extensive knowledge of its configuration files, increasing the difficulty and skill requirements for operators. Furthermore, the key rotation and encryption object modification processes involve many steps, including changing the key algorithm, adding or deleting resources, restarting the API server, and updating existing resources. These steps all require manual operation, increasing the risk of errors. Configuration errors or manual operation mistakes can lead to incorrect encryption of Kubernetes objects, resulting in data corruption in ETCD and even causing the Kubernetes cluster to crash.

[0055] In view of this, this application provides an encryption method. A first encryption configuration file, easily configured by operations personnel, includes at least one first Kubernetes object. A second encryption configuration file in a container orchestration platform contains at least one second Kubernetes object. New and / or deleted Kubernetes objects are identified. Addition and / or deletion operations are then performed in the second encryption configuration file to obtain a third encryption configuration file. All Kubernetes objects in the third encryption configuration file indicate Kubernetes resources that require encryption protection. Therefore, by encrypting Kubernetes resources in the platform based on all Kubernetes objects in the third encryption configuration file, encryption protection of Kubernetes resources that require protection can be achieved. This eliminates the need for complex encryption configuration operations by operations personnel, reducing their workload, minimizing the risk of errors, and improving the security of Kubernetes resource storage.

[0056] It is understood that the encryption method provided in this application embodiment can be applied to any electronic device with processing capabilities, which has a communication connection with the above-mentioned Kubernetes-based container orchestration and scheduling platform, or is deployed on the container orchestration and scheduling platform, for example, as a plugin of the container orchestration platform.

[0057] See Figure 1 The flowchart below illustrates an encryption method provided in this application embodiment, which includes steps S101 to S105:

[0058] S101, Receive the first encrypted configuration file.

[0059] The first encryption configuration file includes at least one first Kubernetes object, which indicates the Kubernetes resource to be encrypted in a Kubernetes-based container orchestration and scheduling platform.

[0060] For example, the first encryption configuration file is configured by the operations and maintenance personnel. The operations and maintenance personnel determine the Kubernetes resources that need to be encrypted, and then configure the corresponding first Kubernetes object in the first encryption configuration file. The first Kubernetes object can be some commonly used business configuration information or more important privacy-sensitive data information, such as Kubernetes secrets, configuration maps, and other resources. Alternatively, the first Kubernetes object can be determined according to the actual situation.

[0061] It is understandable that the Kubernetes resource indicated by the first Kubernetes object is the Kubernetes resource that currently needs to be encrypted.

[0062] In one possible embodiment, the first encryption configuration file further includes a first key and first data; before proceeding to the next step, the method further includes: encoding the first data according to a preset encoding method to obtain a second key, and determining that the first key and the second key are the same.

[0063] The first data is a random key set by the operations and maintenance personnel that has not been base64 encoded, such as a 32-bit hash code. The first key is the key obtained by base64 encoding the first data.

[0064] After receiving the first encrypted configuration file from the operations and maintenance personnel, it is necessary to verify the identity of the operations and maintenance personnel. The first data received can be encoded according to the preset encoding method, that is, the same encoding method used by the legitimate operations and maintenance personnel (i.e., the base64 encoding mentioned above), to obtain the second key.

[0065] If the second key is the same as the first key, it means that the operator's identity is legitimate, and subsequent Kubernetes resource encryption processing can be carried out.

[0066] If the second key is different from the first key, it indicates that the operator's identity is invalid or the key is incorrect. The processing procedure will then be terminated, and an error alarm will be output to indicate that there is a problem with the first key and the first key information needs to be re-verified.

[0067] This can prevent unauthorized users from tampering with the encryption of Kubernetes resources, and avoid security risks such as unauthorized decryption of important Kubernetes resources leading to information leakage. It can also prevent errors when operations and maintenance personnel manually fill in or copy and paste.

[0068] S102. Obtain the second encrypted configuration file from the platform.

[0069] The second encrypted configuration file includes at least one second Kubernetes object, which is used to indicate Kubernetes resources in the platform with a security level greater than a threshold.

[0070] It is understandable that after verifying the legitimate identity of the operations and maintenance personnel, a second encrypted configuration file is obtained from the platform to prevent the leakage of important information.

[0071] For example, the security level is used to classify all Kubernetes resources in the platform according to their importance or the degree of security protection required. The higher the security level, the more important the resource is and the higher the degree of security protection required. Therefore, for Kubernetes resources with a security level greater than the threshold, their corresponding second Kubernetes object can be stored in the second encrypted configuration file for subsequent encryption and other processing.

[0072] It is understandable that the Kubernetes resource indicated by the second Kubernetes object is a historical Kubernetes resource that needs to be encrypted, which may include Kubernetes resources that have been encrypted before, or Kubernetes resources that have not yet been encrypted.

[0073] S103. Determine the first object based on the first encrypted configuration file and the second encrypted configuration file.

[0074] The first object is a Kubernetes object that exists in the first encrypted configuration file but does not exist in the second encrypted configuration file.

[0075] It is understandable that by comparing at least one first Kubernetes object and at least one second Kubernetes object, the newly added Kubernetes object in the first Kubernetes object is determined, i.e., the first object.

[0076] S104. Add the first object to the second encryption configuration file to obtain the third encryption configuration file.

[0077] It is understandable that adding the first object from the first Kubernetes object to the second encryption configuration file results in the third encryption configuration file, which makes it easier to obtain all the Kubernetes resources that need to be encrypted, and thus facilitates the subsequent encryption of these Kubernetes resources.

[0078] S105. Encrypt the Kubernetes resources on the platform based on all Kubernetes objects in the third encryption configuration file.

[0079] The Kubernetes resources indicated by the second Kubernetes object mentioned in S102 above are historical Kubernetes resources that need to be encrypted. This may include Kubernetes resources that have been encrypted before, or Kubernetes resources that have not yet been encrypted. That is, the Kubernetes resources indicated by all Kubernetes objects in the third encryption configuration file may also include encrypted Kubernetes resources and / or unencrypted Kubernetes resources. Therefore, this application provides examples of three specific encryption methods for the above situations.

[0080] Example 1: If a third Kubernetes object exists in the third encryption configuration file, and the Kubernetes resource indicated by the third Kubernetes object is not encrypted, then the first key is used to encrypt the Kubernetes resource indicated by the third Kubernetes object.

[0081] For example, if this is the first time the encryption method provided in this application embodiment is used to encrypt Kubernetes resources, that is, before this, at least one second Kubernetes object in the second encryption configuration file indicated Kubernetes resources that were not encrypted, and consequently all Kubernetes objects in the third encryption configuration file indicated Kubernetes resources that were not encrypted, then the first key can be used directly to encrypt these Kubernetes resources.

[0082] Example 2: If a fourth Kubernetes object exists in the third encryption configuration file, and the Kubernetes resource indicated by the fourth Kubernetes object has been encrypted using the first key, then the first key is used to encrypt the Kubernetes resources indicated by other objects besides the fourth Kubernetes object.

[0083] For example, this is not the first time that the encryption method provided in this application embodiment has been used to encrypt Kubernetes resources. That is, the above encryption method has been used to encrypt the Kubernetes resources indicated by the second Kubernetes object in the second encryption configuration file before, and the key used is the same as the first key used in this encryption. Therefore, in the third encryption configuration file, only the Kubernetes resources indicated by the first object are not encrypted. Then, the first key can be used to encrypt the Kubernetes resources indicated by the first object.

[0084] Example 3: If a fifth Kubernetes object exists in the third encryption configuration file, and the Kubernetes resource indicated by the fifth Kubernetes object has been encrypted with a third key, and the third key is different from the first key, then the third key is used to decrypt the encrypted Kubernetes resource indicated by the fifth Kubernetes object, and the first key is used to encrypt the decrypted Kubernetes resource.

[0085] For example, this is not the first time that the encryption method provided in this application embodiment has been used to encrypt Kubernetes resources. That is, the above encryption method has been used to encrypt the Kubernetes resources indicated by the second Kubernetes object in the second encryption configuration file before, but the key used is different from the first key used for this encryption. In this case, the Kubernetes resources indicated by the second Kubernetes object need to be decrypted first, and then the first key is used to encrypt all the Kubernetes resources indicated by the Kubernetes objects in the third encryption configuration file.

[0086] In this way, all Kubernetes resources indicated by Kubernetes objects in the third encryption configuration file are encrypted in the same way, which improves the security of data storage and facilitates unified management of encrypted resources.

[0087] In this method, the first encrypted configuration file includes a first Kubernetes object (which can be understood as a new object), and the second encrypted configuration file includes a second Kubernetes object (which can be understood as a historical object). Based on the first and second encrypted configuration files, the newly added Kubernetes resource to be encrypted (i.e., the first object) can be determined. The first object is then added to the second encrypted configuration file to obtain a third encrypted configuration file. This allows for the encryption of all Kubernetes resources that require protection, improving data storage security. Furthermore, operations personnel only need to configure the first Kubernetes object in the first encrypted configuration file, eliminating the need for complex manual encryption configurations, thus reducing the workload for operations personnel and minimizing the possibility of errors.

[0088] In one possible design, the first configuration file may also include an encryption method that encrypts the Kubernetes resources indicated by all Kubernetes objects in the third encryption configuration file.

[0089] In this way, different encryption methods (such as secretbox, aesgcm, aescbc, etc.) can be set each time the operations and maintenance personnel enter the configuration file. This means that different encryption methods and different keys can be used each time the Kubernetes resources are re-encrypted, which can further improve the security of Kubernetes resource storage.

[0090] In one possible design, prior to S105, the method may further include: determining a second object based on a first encrypted configuration file and a second encrypted configuration file, wherein the second object is a Kubernetes object that does not exist in the first encrypted configuration file but exists in the second encrypted configuration file; and deleting the second object from the third encrypted configuration file.

[0091] It is understood that at least one first Kubernetes object in the first encryption configuration file indicates a Kubernetes resource to be encrypted. The second encryption configuration file may contain a Kubernetes object that is not in the first encryption configuration file, namely a second object. The Kubernetes resource indicated by the second object does not need to be encrypted. Therefore, the second object can be deleted from the third encryption configuration file, so that only the Kubernetes resources that need to be encrypted can be precisely encrypted, saving computing resources.

[0092] Furthermore, if the Kubernetes resource indicated by the second object is encrypted, it can be decrypted. This avoids resource clutter and facilitates resource management.

[0093] In one possible design, the first encrypted configuration file also includes the storage path of the second encrypted configuration file. Before S102, the method further includes: determining whether a file exists at the storage location indicated by the storage path; if it exists, determining that the file is the second encrypted configuration file; if it does not exist, creating an empty file and using the empty file as the second encrypted configuration file.

[0094] For example, before performing subsequent encryption, it is necessary to ensure the existence of a second encryption configuration file. If the second encryption configuration file does not exist in the preset storage path, an empty file needs to be created as the second encryption configuration file, and the second Kubernetes object in the second encryption configuration file is also empty.

[0095] It is understood that the above-described implementation methods can be implemented individually or in combination.

[0096] The following is an example of a possible combination embodiment. See also Figure 2 This is an example of a Kubernetes resource encryption method provided in the embodiments of this application.

[0097] First, receive the configuration manifest file (i.e., the first encrypted configuration file) input by the operations and maintenance personnel.

[0098] Specifically, the first encryption configuration file includes the un-ase64 encoded key (i.e., the first data), corresponding to the uncode-hash-code field; the base64 encoded key (i.e., the first key), corresponding to the encode-hash-code field; the list of Kubernetes objects to be encrypted (i.e., at least one first Kubernetes object), corresponding to the resources-list field; the encryption algorithm, corresponding to the encrypt-algorithm field; the storage path of the EncryptionConfiguration yaml file (i.e., the second encryption configuration file), corresponding to the encrypt-conf-path field; and the storage path of the Kubernetes Apiserver yaml file, corresponding to the apiserver-conf-path field.

[0099] For example, such as Figure 2 As shown, the Kubernetes object to be encrypted may include a secret and a configmap. The encryption algorithm can use the AESCBC encryption mode.

[0100] Then, each code module is invoked to encrypt the Kubernetes resource to be encrypted according to the configuration information in the configuration manifest file.

[0101] Specifically, the first step is to call the key verification module to verify whether the key passed by the user is correct, and also to verify the legitimacy of the user's identity. For example, using the method described in the above embodiment, the `uncode-hash-code` field in the configuration manifest file is encoded using base64 encoding. It is then confirmed whether the encoded `uncode-hash-code` field is the same as the `encode-hash-code` field in the configuration manifest file. If they are the same, the verification passes; if they are different, it indicates that the key or user identity is incorrect, the program terminates, and an alarm message is output, prompting the user to re-verify the key information.

[0102] Then, the EncryptionConfiguration file management module is invoked to ensure the existence of the EncryptionConfiguration yaml file. For example, using the method described in the above embodiment, the encrypt-conf-path field in the configuration manifest file is read to determine if the EncryptionConfiguration yaml file exists in the path corresponding to this field. If it does not exist, an empty file needs to be created as the EncryptionConfiguration yaml file.

[0103] Next, the encryption configuration module is invoked to configure the key, algorithm rotation, and the addition or deletion of encryption objects.

[0104] For example, see Figure 3 This is a specific method example of an encryption configuration module provided in an embodiment of this application.

[0105] 1. Read the resources-list field in the configuration manifest to obtain the list of Kubernetes objects to be encrypted, i.e., the list of new resources.

[0106] 2. Based on the encrypt-conf-path field in the configuration manifest file, retrieve the EncryptionConfiguration yaml file from the corresponding storage path, and obtain the old resource list from the file, which is the list of encrypted Kubernetes objects stored in the past.

[0107] As you can understand, this example assumes that Kubernetes resources are not being encrypted for the first time, and the Kubernetes object stored in the EncryptionConfigurationyaml file is the previously encrypted Kubernetes object. However, this is not the only example.

[0108] 3. Determine the Kubernetes objects to be added and / or deleted based on the old resource list and the new resource list.

[0109] For example, if there are Kubernetes objects that need to be deleted, or if there are both Kubernetes objects that need to be deleted and Kubernetes objects that need to be added, the methods include:

[0110] (1) Set the encryption algorithm in the EncryptionConfiguration yaml file to an empty key (i.e., no encryption), and decrypt all Kubernetes resources indicated by Kubernetes objects in the EncryptionConfiguration yaml file.

[0111] For example, Kubernetes resources are stored in an ETCD database.

[0112] (2) Read the encrypt-conf-path and apiserver-conf-path fields to ensure that the APIServer has mounted the EncryptionConfiguration file, and then restart the APIServer.

[0113] (3) Deletion verification can be performed by creating a Kubernetes resource indicated by a Kubernetes object to be deleted and comparing the created Kubernetes resource with the Kubernetes resource stored in the ETCD database indicated by the Kubernetes object to confirm that the Kubernetes resource stored in the ETCD has been decrypted.

[0114] (4) If the deletion verification output indicates that the Kubernetes resource is still in an encrypted state, then fault recovery is required. After checking whether the corresponding configuration files, fields, etc. are set correctly and automatically correcting any incorrect configuration information or fields, the deletion verification method in (3) is executed again.

[0115] (5) If the result of the deletion verification indicates that the Kubernetes resource has been decrypted, the key full application module will decrypt all existing Kubernetes resources indicated by the Kubernetes objects that need to be deleted.

[0116] (6) Delete the Kubernetes object that needs to be deleted in the EncryptionConfiguration yaml file.

[0117] The above steps complete the deletion of Kubernetes objects that need to be deleted. The following steps describe the encryption configuration for newly added Kubernetes objects.

[0118] (1) Add the new Kubernetes object to the EncryptionConfiguration yaml file.

[0119] (2) Read the encrypt-algorithm field in the configuration manifest file to obtain the encryption algorithm; and read the encode-hash-code field to obtain the new key; configure the encryption algorithm and the new key in the EncryptionConfiguration yaml file.

[0120] (3) Read the encrypt-conf-path and apiserver-conf-path fields to ensure that the APIServer has mounted the EncryptionConfiguration file, and then restart the APIServer.

[0121] (4) Encryption verification: Similar to the deletion verification method described above, create all Kubernetes resources indicated by Kubernetes objects in the EncryptionConfiguration yaml file, and compare the created Kubernetes resources with the Kubernetes resources stored in the ETCD database indicated by the Kubernetes objects to confirm that the Kubernetes resources stored in ETCD are encrypted.

[0122] (5) If the encryption verification output indicates that the Kubernetes resource stored in ETCD is still in a decrypted state or the encryption algorithm is incompatible, then fault recovery is required. After checking whether the corresponding configuration files, fields, etc. are set correctly and automatically correcting any incorrect configuration information or fields, the encryption verification method in (4) is executed again.

[0123] (6) If the structure of the encryption verification output indicates that the Kubernetes resource stored in ETCD has been correctly encrypted, the key full application module will encrypt the Kubernetes resources indicated by the Kubernetes objects in all existing EncryptionConfiguration yaml files.

[0124] This completes the encryption configuration for encrypted Kubernetes resources.

[0125] For example, if only newly added Kubernetes objects exist, and according to the example above, taking the case where Kubernetes resources are not being encrypted for the first time, and the Kubernetes objects stored in the EncryptionConfiguration yaml file are the previously encrypted Kubernetes objects; then firstly, the Kubernetes objects stored in the EncryptionConfiguration yaml file are decrypted using the key from the previous encryption, and then the newly added Kubernetes objects are used for encryption configuration. This achieves encryption configuration for cases where only newly added Kubernetes objects exist.

[0126] In this way, operations and maintenance personnel do not need to consider the meaning of each field in the EncryptionConfiguration yaml file, which fields should be configured, or how to mount the EncryptionConfiguration yaml file to the Apiserver yaml file. They only need to configure simple information to achieve encrypted configuration of Kubernetes resources, which greatly reduces the difficulty of understanding for operations and maintenance personnel, reduces the risk of errors, improves the security of data storage, and avoids data corruption in ETCD, Kubernetes cluster crashes, and other situations.

[0127] The methods provided in the embodiments of this application have been described above. The apparatus provided in the embodiments of this application will be described below.

[0128] Based on the same technical concept, embodiments of this application provide an encryption device, which includes a module / unit / means for executing the method performed by the electronic device with processing capabilities described in the above method embodiments. This module / unit / means can be implemented in software, or in hardware, or implemented by hardware executing corresponding software.

[0129] For example, see Figure 4 The device 400 includes:

[0130] The receiving unit 401 is configured to: receive a first encrypted configuration file; the first encrypted configuration file includes at least one first Kubernetes object, the first Kubernetes object being used to indicate the Kubernetes resource to be encrypted in a Kubernetes-based container orchestration and scheduling platform;

[0131] The acquisition unit 402 is used to: acquire a second encrypted configuration file from the platform, the second encrypted configuration file including at least one second Kubernetes object, the second Kubernetes object being used to indicate Kubernetes resources in the platform with a security level greater than a threshold;

[0132] Processing unit 403 is configured to: determine a first object based on a first encrypted configuration file and a second encrypted configuration file; the first object is a Kubernetes object that exists in the first encrypted configuration file but does not exist in the second encrypted configuration file; add the first object to the second encrypted configuration file to obtain a third encrypted configuration file; and encrypt Kubernetes resources in the platform based on all Kubernetes objects in the third encrypted configuration file.

[0133] It should be understood that all relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0134] Based on the same technical concept, see [link / reference] Figure 5 This application also provides an electronic device 500, comprising:

[0135] At least one processor 501; and a communication interface 503 communicatively connected to the at least one processor 501; the at least one processor 501 causes the electronic device 500 to execute the method steps performed by the Kanban in the above method embodiment through the communication interface 503 by executing instructions stored in the memory 502.

[0136] Optionally, the memory 502 is located outside the electronic device 500.

[0137] Optionally, the electronic device 500 includes a memory 502 connected to the at least one processor 501, and the memory 502 contains instructions executable by the at least one processor 501. (See attached image) Figure 5 The dashed line indicates that the memory 502 is optional for the electronic device 500.

[0138] The at least one processor 501 and the memory 502 can be coupled through an interface circuit or integrated together, which is not limited here.

[0139] This application embodiment does not limit the specific connection medium between at least one processor 501, memory 502, and communication interface 503. This application embodiment... Figure 5 At least one processor 501, memory 502, and communication interface 503 are connected via a bus 504. Figure 5 The connections between other components are shown in bold and are for illustrative purposes only, not as limiting information. This bus section can be an address bus, data bus, control bus, etc. For ease of illustration, Figure 5 It is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0140] It should be understood that the processor mentioned in the embodiments of this application can be implemented in hardware or software. When implemented in hardware, the processor can be a logic circuit, integrated circuit, etc. When implemented in software, the processor can be a general-purpose processor, implemented by reading software code stored in memory.

[0141] For example, the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0142] It should be understood that the memory mentioned in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which acts as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate Synchronous DRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct RAM (DR RAM).

[0143] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA, or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, the memory (storage module) can be integrated into the processor.

[0144] It should be noted that the memories described herein are intended to include, but are not limited to, these and any other suitable types of memories.

[0145] Based on the same technical concept, embodiments of this application also provide a computer-readable storage medium for storing instructions that, when executed, cause a computer to perform the method steps performed by any of the devices in the above method embodiments.

[0146] Based on the same technical concept, this application also provides a computer program product, including computer program code, which, when the computer program code is run on a computer, causes the method steps executed by any device in the above method embodiments to be implemented.

[0147] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0148] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0149] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0150] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0151] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. An encryption method, characterized in that, include: Receive the first encrypted configuration file; The first encryption configuration file includes at least one first Kubernetes object and a first key, wherein the first Kubernetes object is used to indicate the Kubernetes resource to be encrypted in a Kubernetes-based container orchestration and scheduling platform; Obtain a second encrypted configuration file from the platform, the second encrypted configuration file including at least one second Kubernetes object, the second Kubernetes object being used to indicate Kubernetes resources in the platform with a security level greater than a threshold; Based on the first encrypted configuration file and the second encrypted configuration file, a first object is determined; the first object is a Kubernetes object that exists in the first encrypted configuration file but does not exist in the second encrypted configuration file. Add the first object to the second encrypted configuration file to obtain the third encrypted configuration file; Encrypt Kubernetes resources in the platform based on all Kubernetes objects in the third encryption configuration file; Wherein, if this is not the first time encrypting Kubernetes resources in the Kubernetes-based container orchestration and scheduling platform, then encrypting the Kubernetes resources in the platform according to all Kubernetes objects in the third encryption configuration file includes: If a fifth Kubernetes object exists in the third encrypted configuration file, and the Kubernetes resource indicated by the fifth Kubernetes object has been encrypted using a third key, and the third key is different from the first key, then the encrypted Kubernetes resource indicated by the fifth Kubernetes object is decrypted using the third key, and the decrypted Kubernetes resource is encrypted using the first key.

2. The method as described in claim 1, characterized in that, The first encrypted configuration file also includes first data; Before obtaining the second encrypted configuration file from the platform, the process also includes: The first data is encoded according to a preset encoding method to obtain a second key; It is determined that the first key is the same as the second key.

3. The method as described in claim 2, characterized in that, The step of encrypting Kubernetes resources on the platform based on all Kubernetes objects in the third encryption configuration file includes: If a third Kubernetes object exists in the third encrypted configuration file, and the Kubernetes resource indicated by the third Kubernetes object is not encrypted, then the first key is used to encrypt the Kubernetes resource indicated by the third Kubernetes object.

4. The method as described in claim 2, characterized in that, If this is not the first time encrypting Kubernetes resources in the Kubernetes-based container orchestration and scheduling platform, then encrypting the Kubernetes resources in the platform according to all Kubernetes objects in the third encryption configuration file further includes: If a fourth Kubernetes object exists in the third encrypted configuration file, and the Kubernetes resource indicated by the fourth Kubernetes object has been encrypted using the first key, then the first key is used to encrypt the Kubernetes resources indicated by other objects besides the fourth Kubernetes object.

5. The method as described in claim 1, characterized in that, Before encrypting Kubernetes resources in the platform based on all Kubernetes objects in the third encryption configuration file, the following steps are also included: The second object is determined based on the first encrypted configuration file and the second encrypted configuration file; the second object is a Kubernetes object that does not exist in the first encrypted configuration file but exists in the second encrypted configuration file. Delete the second object from the third encrypted configuration file.

6. The method as described in claim 5, characterized in that, The method further includes: Decrypt the encrypted Kubernetes resource indicated by the second object.

7. The method according to any one of claims 1-6, characterized in that, The first encrypted configuration file also includes the storage path of the second encrypted configuration file; Obtain the second encrypted configuration file from the platform, including: Determine whether a file exists at the storage location indicated by the storage path; If it exists, then the file is determined to be the second encrypted configuration file.

8. An encryption device, characterized in that, include: The receiving unit is used to: receive the first encrypted configuration file; The first encryption configuration file includes at least one first Kubernetes object and a first key, wherein the first Kubernetes object is used to indicate the Kubernetes resource to be encrypted in a Kubernetes-based container orchestration and scheduling platform; The acquisition unit is configured to: acquire a second encrypted configuration file from the platform, the second encrypted configuration file including at least one second Kubernetes object, the second Kubernetes object being used to indicate Kubernetes resources in the platform with a security level greater than a threshold; The processing unit is configured to: determine a first object based on the first encrypted configuration file and the second encrypted configuration file; the first object is a Kubernetes object that exists in the first encrypted configuration file but does not exist in the second encrypted configuration file; add the first object to the second encrypted configuration file to obtain a third encrypted configuration file; and encrypt the Kubernetes resources in the platform based on all Kubernetes objects in the third encrypted configuration file. Wherein, if this is not the first time encrypting Kubernetes resources in the Kubernetes-based container orchestration and scheduling platform, then when the processing unit encrypts the Kubernetes resources in the platform according to all Kubernetes objects in the third encryption configuration file, it is specifically used for: If a fifth Kubernetes object exists in the third encrypted configuration file, and the Kubernetes resource indicated by the fifth Kubernetes object has been encrypted using a third key, and the third key is different from the first key, then the encrypted Kubernetes resource indicated by the fifth Kubernetes object is decrypted using the third key, and the decrypted Kubernetes resource is encrypted using the first key.

9. An electronic device, characterized in that, include: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the steps included in the method as described in any one of claims 1-7 according to the obtained program instructions.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is configured to have a computer program, the computer program including program instructions that, when executed by a computer, cause the method as described in any one of claims 1-7 to be implemented.

11. A computer program product, characterized in that, The computer program product includes: computer program code, which, when run on a computer, causes the computer to perform the method described in any one of claims 1-7.

Images