Application deployment isolation method and system applied to container cloud scene and medium

Abstract

The invention discloses an application deployment isolation method and system applied to a container cloud scene, and a medium, mainly relates to the technical field of application deployment isolation, and is used for solving the problems that an existing kubernetes container cloud scene cannot perform automatic application deployment, cannot limit application deployment on nodes which are safely controlled by different organizations, and cannot perform application deployment isolation. And physical isolation and network isolation cannot be realized. Comprising the following steps: deploying an application on a node corresponding to a security domain special pool when the security domain special pool with the same security level as the application exists; when the intra-organization security domain special pool with the same security level as the application does not exist, determining whether the organization A has an organization shared resource pool with the same security level as the application or not; and when the organization shared resource pool with the same security level as the application does not exist or the node capable of deploying the application does not exist in the organization shared resource pool, determining whether the node with the same security level as the application exists in the platform shared resource pool or not.

Description

Technical Field

[0001] The present application relates to the field of application deployment isolation technology, and in particular to an application deployment isolation method, system, and medium for use in a container cloud scenario. Background Art

[0002] Kubernetes is the industry standard for container cloud orchestration. Building a private container cloud around Kubernetes, constructing enterprise applications, and performing cloud-based transformation can greatly improve the efficiency of automated management and application delivery.

[0003] The existing Kubernetes container cloud scenario provides an isolation mechanism based on namespaces. Namespaces are an abstract mechanism for isolating resources within a cluster. By placing different resources in different namespaces, limited multi-tenant isolation is achieved. When deploying applications, administrators must use labels or specify node names to match appropriate nodes for deployment. Labels can be used to identify node characteristics, such as resource quotas and environment, so that applications can select nodes that meet their requirements for deployment.

[0004] However, each tenant organization in a private cloud manages its own node resources, requiring administrators to manually deploy applications. Furthermore, because configuration is performed using labels or specific node names, if the current organization does not have a corresponding label or node name, it is impossible to restrict application deployment to nodes under security management of different organizations, and physical and network isolation cannot be achieved.

[0005] Therefore, there is an urgent need for an application deployment isolation method, system and medium for container cloud scenarios to solve the problems that existing Kubernetes container cloud scenarios cannot automatically deploy applications, cannot limit application deployment to nodes securely managed by different organizations, and thus cannot achieve physical and network isolation. Summary of the Invention

[0006] In response to the above-mentioned deficiencies in the prior art, the present application provides an application deployment isolation method, system, and medium for container cloud scenarios to solve the problems that existing Kubernetes container cloud scenarios cannot automatically deploy applications, cannot limit application deployment to nodes that are securely managed by different organizations, and thus cannot achieve physical and network isolation.

[0007] In a first aspect, the present application provides an application deployment isolation method applied to a container cloud scenario, the method comprising: In the container cloud scenario, create a platform shared resource pool, an organization shared resource pool corresponding to each organization, and an organization-wide security domain dedicated pool. Integrate the resource pool as a custom resource into the container cloud's storage system, add node resources to the resource pool, and configure security levels and preset access security policies for each resource pool. When any organization A needs to deploy an application, obtain the application's security level. Determine whether there is an organization-wide security domain dedicated pool with the same security level as the application in organization A. If there is a security domain dedicated pool with the same security level as the application, deploy the application on the node corresponding to the security domain dedicated pool. If there is no node in the security domain dedicated pool that can deploy the application, return an application deployment failure message. ; When there is no dedicated pool for the security domain within the organization with the same security level as the application, determine whether organization A has an organization shared resource pool with the same security level as the application; when there is an organization shared resource pool with the same security level as the application, deploy the application on a node with the same security level; when there is no organization shared resource pool with the same security level as the application or there is no node in the organization shared resource pool that can deploy the application, determine whether there is a node with the same security level as the application in the platform shared resource pool; when there is a node with the same security level as the application and the node meets the preset application deployment conditions, deploy the application on the node with the same security level; otherwise, return the application deployment failure information.

[0008] The application deployment isolation method provided in the embodiments of this application creates resource pools of different levels (platform shared resource pool, organization shared resource pool, and organization-specific security domain pool) and configures corresponding security levels and preset access security policies. This method ensures that applications can only be deployed in resource pools that meet their security levels. Different preset access security policies can be configured for different resource pools, thereby controlling access to nodes within each resource pool. This helps prevent unauthorized applications from accessing or being deployed on sensitive nodes. Furthermore, traditional Kubernetes container cloud scenarios cannot automatically deploy applications or restrict application deployment to nodes under security control by different organizations. This application, however, uses an automated process to automatically deploy applications on nodes with corresponding security levels based on the application's security level and resource pool. Applications with a specific security level can be deployed in a security domain-specific pool. If no nodes are available in the security domain-specific pool, deployment is halted, avoiding the issue of being unable to restrict application deployment to nodes under security control by different organizations. Furthermore, this application provides clear security level and resource pool divisions, reducing deployment failures caused by resource contention or security policy conflicts. When a node that meets the application security level cannot be found, the system will return a deployment failure message, avoiding potential errors and conflicts.

[0009] In one implementation of the present application, the resource pool is divided into at least: a platform unallocated shared resource pool, a platform shared resource pool, an organization unallocated resource pool, an organization shared resource pool, and an organization security domain dedicated pool; adding node resources to the resource pool specifically includes: Add new node resources to the platform's unallocated shared resource pool; based on external triggers, determine the organization or platform shared resource pool corresponding to the new node resources; wherein, there is a correspondence between the organization and the organization's unallocated resource pool, the organization's shared resource pool, and the organization's internal security domain dedicated pool. The security levels configured for the organization's shared resource pool and the organization's internal security domain dedicated pool under the same organization are different, and the same security level corresponds to only one platform shared resource pool; when the new node resources correspond to an organization, add the new node resources to the organization's unallocated resource pool corresponding to the organization; based on external triggers, determine the organization's shared resource pool or the organization's internal security domain dedicated pool corresponding to the new node resources in the organization's unallocated resource pool; wherein, the organization corresponds to the organization's shared resource pool and the organization's internal security domain dedicated pool, and the security levels of the organization's shared resource pool and the organization's internal security domain dedicated pool are different.

[0010] The application deployment isolation method provided in the embodiment of the present application ensures the security and isolation of resources by creating exclusive resource pools for different organizations (organization unallocated resource pool, organization shared resource pool and organization internal security domain dedicated pool) and configuring different security levels.

[0011] In one implementation of the present application, the method also includes: when the node resources in the organization shared resource pool or the security domain dedicated pool within the organization are released, they can be returned to the organization unallocated resource pool corresponding to the current organization; when the node resources in the organization unallocated resource pool or the platform shared resource pool are released, they can be returned to the platform unallocated shared resource pool.

[0012] In one implementation of the present application, when there is a security domain dedicated pool with the same security level as the application, the application is deployed on the node corresponding to the security domain dedicated pool, specifically including: reading the processing power, memory size, and network bandwidth of the nodes in the security domain dedicated pool, and deploying the application on any node that meets the preset requirements of processing power, memory size, and network bandwidth.

[0013] In one implementation of the present application, there is no node capable of deploying an application in the security domain dedicated pool, specifically including: All node resources of the nodes in the security domain dedicated pool are released, and there are no nodes in the security domain dedicated pool; the processing power, memory size, and network bandwidth of all nodes in the security domain dedicated pool do not meet the preset application deployment conditions; there are no nodes in the organization shared resource pool that can deploy applications, specifically including: all node resources of the nodes in the organization shared resource pool are released, and there are no nodes in the organization shared resource pool; the processing power, memory size, and network bandwidth of all nodes in the organization shared resource pool do not meet the preset application deployment conditions.

[0014] In one implementation of the present application, the preset access security policy is any one or more security policies in Kubernetes; the security levels include at least: internal disclosure, several confidentiality levels, and the second confidentiality level, and the security level of any resource pool cannot be modified.

[0015] In a second aspect, the present application provides an application deployment isolation system for a container cloud scenario, the system comprising: The resource pool creation module is used to create a platform shared resource pool, an organization shared resource pool corresponding to each organization, and an organization security domain dedicated pool in the container cloud scenario, integrate the resource pool as a custom resource into the storage system of the container cloud, add node resources to the resource pool, and configure the security level and preset access security policy for each resource pool; the application deployment module is used to obtain the security level of the application when any organization A needs to deploy an application; determine whether there is an organization security domain dedicated pool with the same security level as the application in organization A, and when there is a security domain dedicated pool with the same security level as the application, deploy the application on the node corresponding to the security domain dedicated pool; when there is no node in the security domain dedicated pool that can deploy the application, Returns application deployment failure information; when there is no dedicated pool for the security domain within the organization with the same security level as the application, determines whether organization A has an organization shared resource pool with the same security level as the application; when there is an organization shared resource pool with the same security level as the application, deploys the application on a node with the same security level; when there is no organization shared resource pool with the same security level as the application or there is no node in the organization shared resource pool that can deploy the application, determines whether there is a node with the same security level as the application in the platform shared resource pool; when there is a node with the same security level as the application and the node meets the preset application deployment conditions, deploys the application on the node with the same security level; otherwise, returns application deployment failure information.

[0016] In one implementation of the present application, the resource pool creation module includes a node configuration unit for adding new node resources to the platform's unallocated shared resource pool; based on external triggers, determining the organization or platform shared resource pool corresponding to the new node resources; wherein, there is a correspondence between the organization and the organization's unallocated resource pool, the organization's shared resource pool, and the organization's internal security domain dedicated pool, and the security levels of the organization's shared resource pool and the organization's internal security domain dedicated pool under the same organization are different, and the same security level corresponds to only one platform shared resource pool; when the new node resources correspond to an organization, the new node resources are added to the organization's unallocated resource pool corresponding to the organization; based on external triggers, determining the organization's shared resource pool or the organization's internal security domain dedicated pool corresponding to the new node resources in the organization's unallocated resource pool; wherein, the organization corresponds to the organization's shared resource pool and the organization's internal security domain dedicated pool, and the security levels of the organization's shared resource pool and the organization's internal security domain dedicated pool are different.

[0017] In one implementation of the present application, the resource pool creation module includes a node release unit, which can return to the organization's unallocated resource pool corresponding to the current organization when the node resources in the organization's shared resource pool or the organization's internal security domain dedicated pool are released; when the node resources in the organization's unallocated resource pool or the platform's shared resource pool are released, they can return to the platform's unallocated shared resource pool.

[0018] In a third aspect, the present application provides a non-volatile computer storage medium on which computer instructions are stored. When the computer instructions are executed, they implement an application deployment isolation method applied to a container cloud scenario as described above.

[0019] Those skilled in the art will appreciate that this application has at least the following beneficial effects: By creating resource pools of different levels (platform shared resource pool, organization shared resource pool, and organization-specific security domain pool), and configuring corresponding security levels and preset access security policies, this method ensures that applications can only be deployed in resource pools that meet their security levels. At the same time, different preset access security policies can be configured for different resource pools to control access to nodes within each resource pool. This helps prevent unauthorized applications from accessing or being deployed on sensitive nodes. In addition, traditional Kubernetes container cloud scenarios cannot automatically deploy applications or restrict application deployment on nodes that are securely controlled by different organizations. This application uses an automated process to automatically deploy applications on nodes with corresponding security levels based on the application's security level and resource pool. When the application security level is more special, it can be deployed in a security domain-specific pool with a specific security level. When there are no nodes in the security domain-specific pool with a specific security level, deployment is stopped, avoiding the problem of being unable to restrict application deployment on nodes that are securely controlled by different organizations. That is, the application deployment involved in this application is only installed on the nodes corresponding to the resource pool corresponding to the organization and the platform shared resource pool, avoiding the problem of being unable to restrict application deployment on nodes that are securely managed by different organizations, and improving the security control of server resource isolation and application isolation in multi-tenant scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Some embodiments of the present disclosure are described below with reference to the accompanying drawings, in which: Figure 1 This is a flow chart of an application deployment isolation method applied to a container cloud scenario provided by an embodiment of the present application.

[0021] Figure 2 This is a schematic diagram of the internal structure of an application deployment isolation system applied to a container cloud scenario provided by an embodiment of the present application. DETAILED DESCRIPTION

[0022] It should be understood by those skilled in the art that the embodiments described below are merely preferred embodiments of the present disclosure and do not imply that the present disclosure can only be implemented through these preferred embodiments. These preferred embodiments are merely intended to explain the technical principles of the present disclosure and are not intended to limit the scope of protection of the present disclosure. Based on the preferred embodiments provided by the present disclosure, all other embodiments obtained by those skilled in the art without creative effort should still fall within the scope of protection of the present disclosure.

[0023] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0024] The technical solutions proposed in the embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0025] The embodiment provides an application deployment isolation method applied to a container cloud scenario, such as Figure 1 As shown, the method provided in the embodiment of the present application mainly includes the following steps: Step 110: Create a platform shared resource pool, an organization shared resource pool corresponding to each organization, and a dedicated pool for the security domain within the organization in the container cloud scenario, integrate the resource pool as a custom resource into the storage system of the container cloud, add node resources to the resource pool, and configure the security level and preset access security policy for each resource pool.

[0026] It should be noted that the specific security level and preset access security policy corresponding to the resource pool can be preset by technical personnel in this field according to the planning of the resource pool and the allocation of nodes. In addition, the preset access security policy is the security policy in kubernetes, such as Ingress, Egress, firewall rules and other configurations, which are used to limit the security control of internal and external access to the application. In addition, the preset access security policy can also include that multiple applications of an organization can communicate with each other if they are deployed to nodes with the same security level. Applications on nodes across organizations and security levels are not allowed to communicate with each other. In addition, the number of organizational shared resource pools and security domain dedicated pools within each organization is not consistent, and can be set by technical personnel in this field according to actual needs.

[0027] In some embodiments, resource pools can be divided into the following categories: platform unallocated shared resource pool, platform shared resource pool, organization unallocated resource pool, organization shared resource pool, and dedicated pool for security domain within the organization.

[0028] Each organization's shared resource pool and dedicated pool within its security domain must be assigned a security level to restrict access. Security levels can be defined as: Public, Level 1 Confidential, Level 2 Confidential, Level 3 Confidential, etc. Once a security level is assigned, it cannot be modified.

[0029] Specifically, when a new server is added to a container cloud cluster, it first enters the unallocated state and is managed by the unallocated resource pool. System administrators can then allocate servers in the pool to different organizations, automatically assigning them to the organization's unallocated resource pool.

[0030] Platform shared resource pool: You can create multiple platform shared resource pools with different security levels. Each pool is bound to an unchangeable security level.

[0031] Organization unallocated resource pool: A manageable resource pool under an organization. Node resources can be allocated to shared resource pools within the organization or dedicated pools within the organization's security domains.

[0032] Organization shared resource pool: Multiple organization shared resource pools with different security levels can be created on demand. Each organization shared resource pool is bound to an unmodifiable security level.

[0033] Security domain dedicated pool: Multiple security domain dedicated pools with different security levels can be created on demand, and resource pools are created for specific confidentiality levels. This security domain dedicated pool cannot be shared within the organization. Nodes entering the dedicated pool will receive the highest security guarantee, such as creating a confidential security domain dedicated pool. Applications that require confidentiality level control will be deployed in this dedicated pool, and applications with other confidentiality levels will be restricted from being deployed on its nodes. When deploying an application, if there is a corresponding dedicated pool, available nodes will be searched from the dedicated pool first. An organization can only define one security domain dedicated pool for one security level. It is not allowed to define security domain dedicated pools with multiple confidentiality levels, and shared access to dedicated node resources is prohibited.

[0034] Based on the above description, add node resources to the resource pool, specifically: Add new node resources to the platform's unallocated shared resource pool; based on external triggers, determine the organization or platform shared resource pool corresponding to the new node resources; wherein, there is a correspondence between the organization and the organization's unallocated resource pool, the organization's shared resource pool, and the organization's internal security domain dedicated pool. The security levels configured for the organization's shared resource pool and the organization's internal security domain dedicated pool under the same organization are different, and the same security level corresponds to only one platform shared resource pool; when the new node resources correspond to an organization, add the new node resources to the organization's unallocated resource pool corresponding to the organization; based on external triggers, determine the organization's shared resource pool or the organization's internal security domain dedicated pool corresponding to the new node resources in the organization's unallocated resource pool; wherein, the organization corresponds to the organization's shared resource pool and the organization's internal security domain dedicated pool, and the security levels of the organization's shared resource pool and the organization's internal security domain dedicated pool are different.

[0035] Furthermore, nodes in a resource pool can be released from the pool and returned to the unallocated resource pool at the previous level. After resetting and initializing the node, it can be reallocated to a resource pool of a different security level. This allows for mechanisms such as node cleanup and reallocation.

[0036] As an example, when node resources in the organization shared resource pool or the organization's internal security domain dedicated pool are released, the node resources can return to the organization's unallocated resource pool corresponding to the current organization; when node resources in the organization's unallocated resource pool or the platform shared resource pool are released, the node resources can return to the platform's unallocated shared resource pool.

[0037] In addition, the overall resource pool implementation solution can be: Abstract resource pool objects define various resource pool structures at the platform and organizational levels. Resource pools created by system administrators or platform administrators are integrated into the storage system of the container cloud as custom resources (CRD). ControllerManager components are also provided to monitor user resource pool creation / modification / deletion operations. The Reconciler component is then notified to manage node resources, create corresponding resource pool resources, and update the relationship between resource pools and nodes. At the same time, network and security control policies are added to the nodes in the resource pool to limit network communication between nodes. Multiple applications of an organization can communicate with each other if they are deployed to nodes with the same security level. Applications on nodes across organizations and security levels are not allowed to communicate with each other. This implements a resource pool security mechanism based on security levels, completely isolating application deployment and communication between applications.

[0038] Step 120: When any organization A needs to deploy an application, obtain the security level of the application; determine whether there is an intra-organizational security domain dedicated pool with the same security level as the application in organization A; if there is a security domain dedicated pool with the same security level as the application, deploy the application on the node corresponding to the security domain dedicated pool; if there is no node in the security domain dedicated pool that can deploy the application, return application deployment failure information.

[0039] It should be noted that this step can be implemented by the Container Cloud Scheduler (kube-scheduler). The Container Cloud Scheduler obtains the security level of the application and first searches the security domain dedicated pool to see if there is a security domain dedicated pool with the corresponding security level. (The existence of a security domain dedicated pool with the corresponding security level indicates that the application has higher deployment restrictions and can only be deployed on nodes in the security domain dedicated pool).

[0040] In addition, the specific solution for deploying the application on a node in the security domain dedicated pool can be: Read the processing power, memory size, and network bandwidth of the nodes in the security domain dedicated pool, and deploy the application on any node that meets the preset requirements of processing power, memory size, and network bandwidth.

[0041] Step 130: When there is no dedicated pool for the security domain within the organization with the same security level as the application, determine whether organization A has an organization shared resource pool with the same security level as the application; when there is an organization shared resource pool with the same security level as the application, deploy the application on a node with the same security level; when there is no organization shared resource pool with the same security level as the application or there is no node in the organization shared resource pool that can deploy the application, determine whether there is a node with the same security level as the application in the platform shared resource pool; when there is a node with the same security level as the application and the node meets the preset application deployment conditions, deploy the application on the node with the same security level; otherwise, return an application deployment failure message.

[0042] In some embodiments, there are no nodes in the security domain dedicated pool that can deploy applications. Specifically, it may be: All node resources of the nodes in the security domain dedicated pool are released, and there are no nodes in the security domain dedicated pool; the processing power, memory size, and network bandwidth of all nodes in the security domain dedicated pool do not meet the preset application deployment conditions.

[0043] In some embodiments, there is no node in the organization's shared resource pool that can deploy the application. Specifically, it may be: All node resources of the nodes in the organization shared resource pool are released, and there are no nodes in the organization shared resource pool; the processing power, memory size, and network bandwidth of all nodes in the organization shared resource pool do not meet the preset application deployment conditions.

[0044] As can be seen from the preceding description, this embodiment defines resource pool planning, implementation, and a secure scheduling mechanism for application deployment, enabling unified and efficient management of server resources for different tenants within the container cloud. This ensures secure scheduling of application deployment and enhances the security control of server resource isolation and application isolation in multi-tenant scenarios.

[0045] In addition, this application Figure 2 An application deployment isolation system for container cloud scenarios is provided in the embodiment of this application. Figure 2 As shown, the system provided in the embodiment of the present application mainly includes: The resource pool creation module 210 is used to create a platform shared resource pool, an organization shared resource pool corresponding to each organization, and a dedicated pool for the security domain within the organization in the container cloud scenario, integrate the resource pool as a custom resource into the storage system of the container cloud, add node resources to the resource pool, and configure the security level and preset access security policy for each resource pool.

[0046] The resource pool creation module 210 includes a node configuration unit, which is used to add new node resources to the platform's unallocated shared resource pool; based on external triggers, the organization or platform shared resource pool corresponding to the new node resources is determined; wherein, there is a correspondence between the organization and the organization's unallocated resource pool, the organization's shared resource pool and the organization's internal security domain dedicated pool, and the security levels configured for the organization's shared resource pool and the organization's internal security domain dedicated pool under the same organization are different, and the same security level corresponds to only one platform shared resource pool; when the new node resources correspond to an organization, the new node resources are added to the organization's unallocated resource pool corresponding to the organization; based on external triggers, the organization's shared resource pool or the organization's internal security domain dedicated pool corresponding to the new node resources in the organization's unallocated resource pool is determined; wherein, the organization corresponds to the organization's shared resource pool and the organization's internal security domain dedicated pool, and the security levels of the organization's shared resource pool and the organization's internal security domain dedicated pool are different.

[0047] The resource pool creation module 210 includes a node release unit, which can return to the organization's unallocated resource pool corresponding to the current organization when the node resources in the organization's shared resource pool or the organization's internal security domain dedicated pool are released; when the node resources in the organization's unallocated resource pool or the platform's shared resource pool are released, they can return to the platform's unallocated shared resource pool.

[0048] The application deployment module 220 is used to obtain the security level of the application when any organization A needs to deploy the application; determine whether there is an intra-organizational security domain dedicated pool with the same security level as the application in organization A; when there is a security domain dedicated pool with the same security level as the application, deploy the application on the node corresponding to the security domain dedicated pool; when there is no node in the security domain dedicated pool that can deploy the application, return an application deployment failure message; when there is no intra-organizational security domain dedicated pool with the same security level as the application, determine whether there is an organization shared resource pool with the same security level as the application in organization A; when there is an organization shared resource pool with the same security level as the application, deploy the application on a node with the same security level; when there is no organization shared resource pool with the same security level as the application or there is no node in the organization shared resource pool that can deploy the application, determine whether there is a node with the same security level as the application in the platform shared resource pool; when there is a node with the same security level as the application and the node meets the preset application deployment conditions, deploy the application on the node with the same security level; otherwise, return an application deployment failure message.

[0049] In addition, an embodiment of the present application further provides a non-volatile computer storage medium on which executable instructions are stored. When the executable instructions are executed, an application deployment isolation method applied to a container cloud scenario as described above is implemented.

[0050] Thus far, the technical solutions of the present disclosure have been described in conjunction with the foregoing multiple embodiments. However, it is easy for those skilled in the art to understand that the scope of protection of the present disclosure is not limited to these specific embodiments. Without departing from the technical principles of the present disclosure, those skilled in the art may split and combine the technical solutions in the above-mentioned various embodiments, and may also make equivalent changes or replacements to the relevant technical features. Any changes, equivalent replacements, improvements, etc. made within the technical concepts and / or technical principles of the present disclosure will fall within the scope of protection of the present disclosure.

Claims

1. An application deployment isolation method applied to a container cloud scenario, characterized in that: The method comprises: In the container cloud scenario, create a platform shared resource pool, an organization shared resource pool corresponding to each organization, and a dedicated pool for the security domain within the organization. Integrate the resource pool as a custom resource into the storage system of the container cloud, add node resources to the resource pool, and configure the security level and preset access security policy for each resource pool. When any organization A needs to deploy an application, obtain the security level of the application; determine whether there is an intra-organization security domain dedicated pool with the same security level as the application in organization A. If there is a security domain dedicated pool with the same security level as the application, deploy the application on the node corresponding to the security domain dedicated pool; if there is no node in the security domain dedicated pool that can deploy the application, return application deployment failure information; When there is no dedicated pool for the security domain within the organization with the same security level as the application, determine whether organization A has an organizational shared resource pool with the same security level as the application; when there is an organizational shared resource pool with the same security level as the application, deploy the application on a node with the same security level; when there is no organizational shared resource pool with the same security level as the application or there is no node in the organizational shared resource pool that can deploy the application, determine whether there is a node with the same security level as the application in the platform shared resource pool; when there is a node with the same security level as the application and the node meets the preset application deployment conditions, deploy the application on the node with the same security level; otherwise, return application deployment failure information.

2. The application deployment isolation method applied to the container cloud scenario according to claim 1 is characterized in that: The resource pool is divided into at least: platform unallocated shared resource pool, platform shared resource pool, organization unallocated resource pool, organization shared resource pool, and dedicated pool for security domain within the organization; Add node resources to the resource pool, including: Add new node resources to the platform's unallocated shared resource pool; Based on external triggers, determine the organization or platform shared resource pool corresponding to the newly added node resources; among them, there is a corresponding relationship between the organization and the organization's unallocated resource pool, the organization's shared resource pool, and the organization's internal security domain dedicated pool. The security levels configured for the organization's shared resource pool and the organization's internal security domain dedicated pool under the same organization are different, and the same security level corresponds to only one platform shared resource pool; When the newly added node resources correspond to an organization, the newly added node resources are added to the organization's unallocated resource pool corresponding to the organization; Based on external triggers, determine the organization shared resource pool or the organization security domain dedicated pool corresponding to the newly added node resources in the organization's unallocated resource pool; among them, the organization corresponds to the organization shared resource pool and the organization security domain dedicated pool, and the security levels of the organization shared resource pool and the organization security domain dedicated pool are different.

3. The application deployment isolation method applied to the container cloud scenario according to claim 2 is characterized in that: The method further comprises: When the node resources in the organization's shared resource pool or the organization's internal security domain dedicated pool are released, they can be returned to the organization's unallocated resource pool corresponding to the current organization; When node resources in the organization's unallocated resource pool or the platform's shared resource pool are released, they can be returned to the platform's unallocated shared resource pool.

4. The application deployment isolation method applied to the container cloud scenario according to claim 1 is characterized in that: When there is a security domain dedicated pool with the same security level as the application, the application is deployed on the node corresponding to the security domain dedicated pool, including: Read the processing power, memory size, and network bandwidth of the nodes in the security domain dedicated pool, and deploy the application on any node that meets the preset requirements of processing power, memory size, and network bandwidth symbols.

5. The application deployment isolation method applied to the container cloud scenario according to claim 1 is characterized in that: There are no nodes in the security domain dedicated pool that can deploy applications, including: All node resources of nodes in the security domain dedicated pool are released, and there are no nodes in the security domain dedicated pool; The processing capacity, memory size, and network bandwidth of all nodes in the security domain dedicated pool do not meet the preset application deployment conditions; There are no nodes in the organization's shared resource pool that can deploy applications. Specifically: All node resources of nodes in the organization's shared resource pool are released, and there are no nodes in the organization's shared resource pool; The processing power, memory size, and network bandwidth of all nodes in the organization's shared resource pool do not meet the preset application deployment conditions.

6. The application deployment isolation method applied to the container cloud scenario according to claim 1 is characterized in that: The preset access security policy is any one or more security policies in Kubernetes; The security levels include at least: internal disclosure, several confidentiality levels, and the second confidentiality level, and the security level of any resource pool cannot be modified.

7. An application deployment isolation system applied to a container cloud scenario, characterized in that: The system comprises: The resource pool creation module is used to create a platform shared resource pool, an organization shared resource pool corresponding to each organization, and a dedicated pool for the security domain within the organization in the container cloud scenario, integrate the resource pool as a custom resource into the storage system of the container cloud, add node resources to the resource pool, and configure the security level and preset access security policy for each resource pool; The application deployment module is used to obtain the security level of the application when any organization A needs to deploy the application; determine whether there is an intra-organization security domain dedicated pool with the same security level as the application in organization A, and when there is a security domain dedicated pool with the same security level as the application, deploy the application on the node corresponding to the security domain dedicated pool; when there is no node in the security domain dedicated pool that can deploy the application, return the application deployment failure information; when there is no intra-organization security domain dedicated pool with the same security level as the application, determine whether there is an organization shared resource pool with the same security level as the application in organization A; when there is an organization shared resource pool with the same security level as the application, deploy the application on the node with the same security level; when there is no organization shared resource pool with the same security level as the application or there is no node in the organization shared resource pool that can deploy the application, determine whether there is a node with the same security level as the application in the platform shared resource pool; when there is a node with the same security level as the application and the node meets the preset application deployment conditions, deploy the application on the node with the same security level; otherwise, return the application deployment failure information.

8. The application deployment isolation system applied to the container cloud scenario according to claim 7 is characterized in that: The resource pool creation module includes a node configuration unit, Used to add new node resources to the platform's unallocated shared resource pool; Based on external triggers, determine the organization or platform shared resource pool corresponding to the newly added node resources; among them, there is a corresponding relationship between the organization and the organization's unallocated resource pool, the organization's shared resource pool, and the organization's internal security domain dedicated pool. The security levels configured for the organization's shared resource pool and the organization's internal security domain dedicated pool under the same organization are different, and the same security level corresponds to only one platform shared resource pool; When the newly added node resources correspond to an organization, the newly added node resources are added to the organization's unallocated resource pool corresponding to the organization; Based on external triggers, determine the organization shared resource pool or the organization security domain dedicated pool corresponding to the newly added node resources in the organization's unallocated resource pool; among them, the organization corresponds to the organization shared resource pool and the organization security domain dedicated pool, and the security levels of the organization shared resource pool and the organization security domain dedicated pool are different.

9. The application deployment isolation system applied to the container cloud scenario according to claim 7 is characterized in that: The resource pool creation module includes a node release unit, When the node resources in the organization's shared resource pool or the organization's internal security domain dedicated pool are released, they can be returned to the organization's unallocated resource pool corresponding to the current organization; When node resources in the organization's unallocated resource pool or the platform's shared resource pool are released, they can be returned to the platform's unallocated shared resource pool.

10. A non-volatile computer storage medium, characterized in that: Computer instructions are stored thereon, and when the computer instructions are executed, the application deployment isolation method applied to the container cloud scenario as described in any one of claims 1-6 is implemented.

Images