Kerberos application deployment method and device

Abstract

The invention provides a Kerberos application deployment method and device, and belongs to the technical field of software deployment, and the method comprises the steps: configuring a configuration item for Kerberos application operation; constructing a multi-CPU (Central Processing Unit) architecture mirror image of the Kerberos application; the method comprises the following steps: establishing a Kubernetes cluster for operating a containerized application; and deploying the Kerberos application in a containerized Kubernetes cluster on the basis of the configuration item and the multi-CPU architecture mirror image. According to the method and the device, containerized deployment of the Kerberos application is realized, the Kerberos instances running in different environments are ensured to have the same dependency item and configuration, the problem caused by inconsistent environments is eliminated, each Kerberos instance is enabled to run independently, and the problems of resource contention and mutual interference are solved. Moreover, the Kerberos application examples can be quickly started and stopped, and the application examples can be expanded and reduced according to requirements, so that the use requirements of dynamic changes are met, the deployment is simple and convenient, and the practicability is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of software deployment, and in particular to a Kerberos application deployment method and device. Background Art

[0002] With the rapid development of Internet technology, computer networks have become increasingly popular, and network security issues have become increasingly prominent. Kerberos is a computer network authentication protocol used to authenticate personal communications in a secure manner in an insecure network. This protocol is a set of computer software developed with a client / server structure in software design, and can perform mutual authentication, that is, both the client and the server can authenticate each other. It can be used to prevent eavesdropping, prevent replay attacks, protect data integrity, etc. It is a system that uses a symmetric key system for key management.

[0003] There are two ways to deploy Kerberos applications in the prior art. One is the traditional deployment method, that is, deploying directly on the local system, and the other is deploying based on a virtual machine. The first method has the following technical problems: if you need to run multiple different instances of an application, you cannot share multiple instances on the same server, and because the test environment and the production environment are quite different, production environment problems cannot be discovered during testing. The second method has the following technical problems: because virtual machines require some exclusive resources, the utilization of hardware is inefficient.

[0004] Therefore, there is an urgent need to provide a Kerberos application deployment method and device to eliminate the technical problems of low deployment efficiency and inefficient hardware utilization caused by complex deployment process. Summary of the invention

[0005] In view of this, it is necessary to provide a Kerberos application deployment method and device to solve the technical problems existing in the prior art that the deployment process is complex, resulting in low deployment efficiency and inefficient hardware utilization.

[0006] On the one hand, in order to solve the above technical problems, the present invention provides a Kerberos application deployment method, comprising: Configure the configuration items for running Kerberos applications; Build a multi-CPU architecture image for Kerberos applications; Build a Kubernetes cluster to run containerized applications; The Kerberos application is deployed in the containerized Kubernetes cluster based on the configuration item and the multi-CPU architecture image.

[0007] In a possible implementation, the configuration items for configuring the operation of the Kerberos application include: Get the basic configuration items for running the Kerberos application; Acquire environment variables, and configure the basic configuration items based on the environment variables to obtain the configuration items.

[0008] In a possible implementation, the basic configuration items include a kdc.conf configuration file, a krb5.conf configuration file, and an administrator authority configuration item; The kdc.conf configuration file includes kdc default configuration, kdc realm configuration, Kerberos application database module configuration and Kerberos application log record configuration; The KDC default configuration includes the network port used by the KDC key distribution center, the TCP port, and the maximum packet size for sending responses in UDP; The kdc realm configuration includes the host name of the kdc and the host name of the Kerberos management server; The krb5.conf configuration file includes the default behavior and option configuration items of the Kerberos library, the configuration item for mapping the server host name to the server realm, the configuration item for the non-hierarchical cross-realm authentication path, and the configuration item for the server host IP address of the KDC.

[0009] In a possible implementation manner, after configuring the basic configuration item based on the environment variable to obtain the configuration item, the method further includes: Create a storage database data path and write the initialization database for the Kerberos application; Instructions for starting the krb5kdc, kadmind daemons and creating administrators.

[0010] In a possible implementation, the step of building a multi-CPU architecture image of a Kerberos application includes: After starting Docker buildx, create a scripted image file; Determine the image builder, target platform, and HTTP proxy server during the build process; Building a multi-CPU architecture image of a Kerberos application based on the image script file, the image builder, the target platform, and the HTTP proxy server; The multi-CPU architecture image is stored in a private image library.

[0011] In a possible implementation, before building the multi-CPU architecture image of the Kerberos application, the method further includes: Container configuration items to configure the container; The container configuration items include the private image repository address, whether Docker buildx is available, driver specification, and data storage location.

[0012] In a possible implementation, the deploying the Kerberos application based on the configuration item and the multi-CPU architecture image to run on the containerized Kubernetes cluster includes: Create the plugin parameters and basic properties of the storage plugin for the Kubernetes cluster; Determine the deployment content of the Kerberos application to the containerized Kubernetes cluster based on the plug-in parameters, the basic attributes, the configuration items, and the multi-CPU architecture image; A project tool is constructed, and a deployment process of the deployment content is determined based on the project tool, and the Kerberos application is deployed on the containerized Kubernetes cluster for operation based on the deployment process.

[0013] In a possible implementation, the deployment content includes: StatefulSets, Services, and configuration parameters of Kerberos applications.

[0014] In a possible implementation, the Kerberos application deployment method further includes: Testing whether the Kerberos application deployed in the containerized Kubernetes cluster is available based on multiple test items; The test items include viewing existing subject accounts, adding subjects, authenticating subjects, viewing a list of authenticated accounts, viewing kdc log files, and viewing kadmind service logs.

[0015] On the other hand, the present invention also provides a Kerberos application deployment device, comprising: Kerberos application configuration unit, used to configure the configuration items of Kerberos application operation; A multi-CPU architecture image building unit, used to build a multi-CPU architecture image of a Kerberos application; Kubernetes cluster building unit, used to build a Kubernetes cluster that runs containerized applications; A Kerberos application deployment unit is used to deploy the Kerberos application in the containerized Kubernetes cluster based on the configuration item and the multi-CPU architecture image.

[0016] The beneficial effects of the present invention are as follows: the Kerberos application deployment method provided by the present invention can enable the Kerberos application to run successfully under any CPU by constructing a multi-CPU architecture image of the Kerberos application, realize seamless migration across platforms and clouds, and do not need to manually write files for each CPU, thereby reducing the complexity of the process of Kerberos application deployment and improving the applicability of Kerberos applications. In addition, based on the containerized Kubernetes cluster that is built, the containerized deployment of the Kerberos application is realized, ensuring that the running Kerberos instances in different environments have the same dependencies and configurations, eliminating the problems caused by environmental inconsistencies, allowing each Kerberos instance to run independently, and solving the problems of resource contention and mutual interference. In addition, the containerized Kerberos application can quickly start and stop the Kerberos application instance, expand and reduce the application instance as needed, meet the dynamically changing usage requirements, make the deployment simple and convenient, and increase practicality.

[0017] Furthermore, the present invention deploys the Kerberos application in the containerized Kubernetes cluster and utilizes the efficient management and scheduling of the Kubernetes cluster to further improve the deployment efficiency of the Kerberos application and adapt to the dynamically changing usage requirements of the Kerberos application. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0019] Figure 1 A schematic diagram of a flow chart of an embodiment of the Kerberos application deployment method provided by the present invention; Figure 2 For the present invention Figure 1 A schematic flow chart of an embodiment of step S101; Figure 3 For the present invention Figure 1 A schematic flow chart of an embodiment of step S102; Figure 4 For the present invention Figure 1 A schematic diagram of an embodiment of step S104 Figure 5 A schematic diagram of the structure of an embodiment of the Kerberos application deployment device provided by the present invention; Figure 6A schematic diagram of the structure of an embodiment of the Kerberos application deployment device provided by the present invention. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0021] It should be understood that the schematic drawings are not drawn to scale. The flowchart used in the present invention shows the operations implemented according to some embodiments of the present invention. It should be understood that the operations of the flowchart can be implemented out of order, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art, under the guidance of the content of the present invention, can add one or more other operations to the flowchart, and can also remove one or more operations from the flowchart. Some of the block diagrams shown in the accompanying drawings are functional entities, which do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor systems and / or microcontroller systems.

[0022] Reference to an "embodiment" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiment may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0023] The present invention provides a Kerberos application deployment method and device, which are respectively described below.

[0024] Before showing the implementation example, the authentication process of Kerberos application is introduced first. The authentication process is as follows: Enter the command: kinit principal account, password on the client -----> AS queries the user from the database -----> Return TGT ticket to the client (used to apply for services, such as accessing HDFS, YARN) -----> The client takes TGT to TGS for verification -----> TGS queries the database for relevant information about the service. After successful verification, a Server Ticket will be obtained, which grants the user access to a specific service (if the user wants to access HDFS, then the user can only access HDFS) -----> The client can use the server ticket to access services. For example, access HDFS, YARN, HIVE.

[0025] Among them, there are three roles in Kerberos: server, client and KDC (authentication server).

[0026] The concepts in Kerberos are introduced as follows: KDC: Key Distribution Center, responsible for storing user information, managing and issuing tickets, installed on the server, KDC consists of three parts: AS, database, and TGS. AS refers to the authentication server, the database refers to the account that stores users and services, and TGS refers to the ticket authorization server.

[0027] The KDC runs kadmind and krb5kdc. Kadmind is the process that manages the Kerberos server. A program called kadmin uses kadmind to maintain the principal database and policy configuration.

[0028] Realm is a field or scope managed by Kerberos, called a Realm.

[0029] Principal (account) includes user account, service account, User account format: primary@realm, such as text@Dameng.com Service account format: primary / hostname@realm, kadmin / admin has the broadest permissions and is used to fully manage the Kerberos database; The permissions of admin / admin can be subdivided or restricted according to needs. Keytab refers to a key file. User authentication in Kerberos uses passwords or key files to prove identity and store passwords for each user account.

[0030] Figure 1 A schematic diagram of an embodiment of the Kerberos application deployment method provided by the present invention is shown in FIG. Figure 1 As shown, the Kerberos application deployment method includes: S101, configure the configuration items for running the Kerberos application; S102, building a multi-CPU architecture image of a Kerberos application; S103. Build a Kubernetes cluster to run containerized applications; S104. Deploy the Kerberos application in the containerized Kubernetes cluster based on the configuration items and the multi-CPU architecture image.

[0031] The image in step S102 can be understood as a medium similar to an installation package. Once released on a computer, it has a specific function, which is called a container instance. The difference between a Docker image and an installation package is that after it is instantiated, it is not a software, but a collection of software processes. This set of processes exists independently on the computer and does not interfere with other software processes on the computer. They have independent IP addresses and independent operating systems. They are physically contained, but not subordinate to each other in terms of sovereignty.

[0032] It should be understood that the Kubernetes cluster for running containerized applications in step S103 is built based on the containerization platform Docker, which allows developers to package applications and all their dependencies into an independent unit called a container. This container can run in any environment that supports Docker, providing a lightweight, portable and self-contained deployment solution.

[0033] Compared with the prior art, the Kerberos application deployment method provided by the embodiment of the present invention can enable the Kerberos application to run successfully under any CPU by constructing a multi-CPU architecture image of the Kerberos application, realize seamless migration across platforms and clouds, and do not need to manually write files for each CPU, thereby reducing the complexity of the process of Kerberos application deployment and improving the applicability of Kerberos applications. In addition, based on the containerized Kubernetes cluster built, the containerized deployment of the Kerberos application is realized, ensuring that the running Kerberos instances in different environments have the same dependencies and configurations, eliminating the problems caused by environmental inconsistencies, allowing each Kerberos instance to run independently, and solving the problems of resource contention and mutual interference. In addition, the containerized Kerberos application can quickly start and stop the Kerberos application instance, expand and reduce the application instance as needed, meet the dynamically changing usage requirements, make the deployment simple and convenient, and increase practicality.

[0034] Furthermore, the embodiment of the present invention deploys the Kerberos application in the containerized Kubernetes cluster, utilizing the efficient management and scheduling of the Kubernetes cluster, thereby further improving the deployment efficiency of the Kerberos application and adapting to the dynamically changing usage requirements of the Kerberos application.

[0035] In some embodiments of the present invention, Figure 2 As shown, step S101 includes: S201, obtaining basic configuration items for running the Kerberos application; S202: Obtain environment variables, and configure basic configuration items based on the environment variables to obtain configuration items.

[0036] The embodiment of the present invention configures basic configuration items through the acquired environment variables, so that the obtained configuration items are more compatible with the Kerberos application and the operating environment.

[0037] In some embodiments of the present invention, the basic configuration items include a kdc.conf configuration file, a krb5.conf configuration file, and an administrator authority configuration item; The kdc.conf configuration file includes the kdc default configuration, kdc realm configuration, Kerberos application database module configuration, and Kerberos application logging configuration; The default configuration of KDC includes the network port used by the KDC key distribution center, the TCP port, and the maximum packet size for sending responses in UDP. The kdc realm configuration includes the host name of the kdc and the host name of the Kerberos management server; The krb5.conf configuration file includes the default behavior and option configuration items for the Kerberos library, the configuration items for mapping server host names to server realms, the configuration items for non-hierarchical cross-realm authentication paths, and the configuration items for the server host IP address of the KDC.

[0038] Since the Kerberos application needs to use the database and administrator privileges during the authentication process, after step S202, the following steps are also included: Create a storage database data path and write the initialization database for the Kerberos application; Instructions for starting the krb5kdc, kadmind daemons and creating administrators.

[0039] The embodiment of the present invention can ensure the successful operation of the Kerberos application by creating a database data path, writing an initialization database, starting the krb5kdc and kadmind daemon processes and creating administrator instructions.

[0040] In some embodiments of the present invention, Figure 3 As shown, step S102 includes: S301. After starting Docker buildx, create a mirror script (Dockerfile); S302, determining the image builder, the target platform, and the HTTP proxy server during the building process; S303, building a multi-CPU architecture image of the Kerberos application based on the image script file, the image builder, the target platform and the HTTP proxy server; S304, storing the multi-CPU architecture image in the image private library.

[0041] Among them, Docker buildx is a plug-in in Docker. The relevant configuration of Docker buildx is to enable the Kerberos image to run on various CPU architecture platforms.

[0042] Enable Docker buildx via the Docker environment variable "experimental".

[0043] Among them, Dockerfile is a text file that contains instructions for building images. Each instruction builds a layer of the image, so the content of each instruction is to describe how the layer of the image should be built.

[0044] It should be noted that the multiple CPUs in the embodiments of the present invention refer to CPUs such as Arm64, Amd64, and Arm32.

[0045] In a specific embodiment of the present invention, the command to complete the build of a multi-CPU architecture image is: docker buildxbuild --no-cache --builder=dmcca-builder --platform="linux / amd64,linux / arm64" --push --build-arg NO_PROXY=apache.aa.io --build-arg HTTP_PROXY=http: / / proxy.aa.io:38009 --build-arg HTTPS_PROXY=http: / / proxy.aa.io:38009 --provenance=false -t harbor.dmg.io / dmcca / kerberos:4.4.4 .

[0046] To achieve successful construction of a multi-CPU architecture image, before step S102, the following steps are also included: Container configuration items to configure the container; Container configuration items include the private image repository address, whether Docker buildx is available, driver specification, and data storage location.

[0047] In a specific embodiment of the present invention, the container configuration items for configuring the container are specifically: "data-root": " / opt / docker-data", (data storage location); "experimental": true, (available with Docker buildx); "insecure-registries": ["192.168.115.208:5000","192.168.115.208"], (mirror private library address); "exec-opts": ["native.cgroupdriver=systemd"], (driver specific).

[0048] In some embodiments of the present invention, Figure 4 As shown, step S104 includes: S401. Create plugin parameters and basic properties of the storage plugin for the Kubernetes cluster. S402, determining the deployment content of the Kerberos application deployed to the containerized Kubernetes cluster based on the plug-in parameters, basic properties, configuration items, and multi-CPU architecture images; S403: Build a project tool, determine a deployment process of the deployment content based on the project tool, and deploy the Kerberos application on a containerized Kubernetes cluster to run based on the deployment process.

[0049] The plug-in parameters and basic properties in step S401 are specifically: parameters: storage parameters, storage provider-specific parameters, such as storage type, file system type, etc.; Metadata: metadata information, including the name of the storage class; Provisioner: specifies the storage provider used to dynamically configure PV (Persistent Volume); reclaimPolicy: reclaim policy, specifies the reclaim policy of the PV when the PVC (Persistent Volume Claim) is deleted. Common values ​​are Delete and Retain; mountOptions: specifies the options used when mounting the volume; volumeBindingMode: volume binding mode; Kubernetes automatically creates PVs based on the definition to permanently store and manage pod application data in Kubernetes.

[0050] Among them, PV is a piece of network storage in the cluster configured by the administrator and is a resource in the cluster, just like a node is a cluster resource. PV is a capacity plugin, like Volumes, but its lifecycle is independent of any single pod using PV. This API object captures the details of the storage implementation, including NFS, iSCSI, or cloud provider-specific storage systems.

[0051] PVC is a request for storage by a user, similar to pod. Pod consumes node resources, PVC consumes PV resources. Pod can request specific levels of resources (CPU and memory). Declaration can request specific size and access mode (for example, can read / write once or read-only many times).

[0052] There is a one-to-one correspondence between PVC and PV.

[0053] It should be noted that, in order to further improve the efficiency of generating deployment content, in some embodiments of the present invention, step S402 is specifically: using the helm tool to write the deployment content of the Kerberos application deployed to the containerized Kubernetes cluster.

[0054] Among them, Helm is the package manager of Kubernetes, which consists of the client component helm and the server component Tiller. It can package a group of Kubernetes resources for unified management.

[0055] The embodiment of the present invention uses the helm tool to write the deployment content of the Kerberos application deployed to the containerized Kubernetes cluster, which can improve the generation / writing efficiency of the deployment content and further improve the efficiency of the Kerberos application deployment.

[0056] In a specific embodiment of the present invention, the deployment content includes: StatefulSets, Services, and configuration parameters of Kerberos applications.

[0057] Specifically, each Kerberos node is managed by a StatefulSet to ensure that each node has a stable network identifier and persistent storage.

[0058] Configuration parameters for StatefulSets include: Define statefulsets metadata information and selector.

[0059] Defines the detailed specifications of the Pod, including container and other resource configurations.

[0060] Defines the metadata of the pod metadata, including name, label, and annotation.

[0061] Define the template configuration of each Pod in the pod template.

[0062] Define containers and their related configuration.

[0063] Define the mount path, files and other configuration information of the storage volume in the pod container. Mount the Kerberos configuration krb5.conf file to the specified directory of the container.

[0064] Define the environment variable env in the pod container.

[0065] Defines the network port configuration for the application in the pod container.

[0066] Define the resource cpu and memory configuration limits of resources in the pod container.

[0067] Define storage application templates, persistent storage volume templates volumeClaimTemplates, used to create independent PVCs for each Pod.

[0068] Services include Headless Services and LoadBalancer or NodePort type Services. Headless Services are used to enable nodes to communicate with each other within the cluster through the DNS discovery mechanism, while externally accessible Services are used to provide external access portals.

[0069] The configuration parameters of Services include: Define service metadata information.

[0070] Define the service load balancer.

[0071] The ports section of the service defines the detailed port configuration of the service.

[0072] The configuration parameters for Kerberos applications include: In the values.yaml file, the parameter values ​​of the Kerberos kdc.conf and krb5.conf configuration files are defined in the form of key and value pairs. That is, the main parameter values ​​of Kerberos are uniformly defined in the values.yaml file.

[0073] Create ConfigMap: used to generate the krb5.conf file to store Kerberos configuration parameters, and use the helm template expression to read the parameter values ​​in the values.yaml file to replace the values ​​in the template.

[0074] In a specific embodiment of the present invention, building a project tool in step S403 specifically includes: using a makefile to automatically build a project tool.

[0075] The deployment process is as follows: docker image, image building module.

[0076] helm template, debug template: check whether the template rendering is correct before actual deployment.

[0077] helm install, install the module.

[0078] helm upgrade, project update module. helm uninstall, project uninstall module.

[0079] To ensure that the deployed Kerberos application is feasible, in some embodiments of the present invention, after step S104, the following steps are further included: Test the availability of the Kerberos application deployed in the containerized Kubernetes cluster based on multiple test items; The test items include viewing existing principal accounts, adding principals, authenticating principals, viewing the list of authenticated accounts, viewing kdc log files, and viewing kadmind service logs.

[0080] The embodiment of the present invention verifies whether the Kerberos application is available by testing multiple test items, thereby ensuring the reliability of the deployed Kerberos application.

[0081] In summary, the Kerberos application deployment method proposed in the embodiment of the present invention is more lightweight, faster to start, and occupies less resources than traditional virtual machines, so that containerized Kerberos applications can be quickly started and expanded to meet high concurrency and dynamically changing authentication requirements. The container provides a resource isolation mechanism to ensure that each Kerberos instance runs independently to avoid resource contention and mutual interference. Containerized Kerberos applications can run on any platform that supports containers, achieving seamless migration across platforms and clouds.

[0082] In order to better implement the Kerberos application deployment method in the embodiment of the present invention, based on the Kerberos application deployment method, the embodiment of the present invention also provides a Kerberos application deployment device, such as Figure 5 As shown, the Kerberos application deployment device 500 includes: A Kerberos application configuration unit 501, used to configure configuration items for running the Kerberos application; A multi-CPU architecture image building unit 502 is used to build a multi-CPU architecture image of a Kerberos application; A Kubernetes cluster building unit 503 is used to build a Kubernetes cluster that runs containerized applications; The Kerberos application deployment unit 504 is used to deploy the Kerberos application in the containerized Kubernetes cluster based on the configuration items and the multi-CPU architecture image.

[0083] The Kerberos application deployment device 500 provided in the above embodiment can implement the technical solution described in the above Kerberos application deployment method embodiment. The specific implementation principles of the above modules or units can refer to the corresponding contents in the above Kerberos application deployment method embodiment, which will not be repeated here.

[0084] like Figure 6 As shown, the present invention also provides a Kerberos application deployment device 600. The Kerberos application deployment device 600 includes a processor 601, a memory 602 and a display 603. Figure 6 Only some components of the Kerberos application deployment device 600 are shown, but it should be understood that it is not required to implement all of the shown components, and more or fewer components may be implemented instead.

[0085] In some embodiments, the processor 601 may be a central processing unit (CPU), a microprocessor or other data processing chip, and is used to run program codes or process data stored in the memory 602, such as the Kerberos application deployment method of the present invention.

[0086] In some embodiments, the processor 601 may be a single server or a server group. The server group may be centralized or distributed. In some embodiments, the processor 601 may be local or remote. In some embodiments, the processor 601 may be implemented in a cloud platform. In one embodiment, the cloud platform may include a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, an internal cloud, a multi-cloud, etc., or any combination thereof.

[0087] In some embodiments, the memory 602 may be an internal storage unit of the Kerberos application deployment device 600, such as a hard disk or memory of the Kerberos application deployment device 600. In other embodiments, the memory 602 may also be an external storage device of the Kerberos application deployment device 600, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc., equipped on the Kerberos application deployment device 600.

[0088] Furthermore, the memory 602 may include both an internal storage unit of the Kerberos application deployment device 600 and an external storage device. The memory 602 is used to store application software for installing the Kerberos application deployment device 600 and various data.

[0089] In some embodiments, the display 603 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, etc. The display 603 is used to display information of the Kerberos application deployment device 600 and to display a visual user interface. The components 601-603 of the Kerberos application deployment device 600 communicate with each other via a system bus.

[0090] In some embodiments of the present invention, when the processor 601 executes the Kerberos application deployment program in the memory 602, the following steps may be implemented: Configure the configuration items for running Kerberos applications; Build a multi-CPU architecture image for Kerberos applications; Build a Kubernetes cluster to run containerized applications; Deploy Kerberos applications in containerized Kubernetes clusters based on configuration items and multi-CPU architecture images.

[0091] It should be understood that: when the processor 601 executes the Kerberos application deployment program in the memory 602, in addition to the above functions, other functions may also be implemented, and details may refer to the description of the above corresponding method embodiments.

[0092] Furthermore, the embodiment of the present invention does not specifically limit the type of the Kerberos application deployment device 600 mentioned. The Kerberos application deployment device 600 may be a portable Kerberos application deployment device such as a mobile phone, a tablet computer, a personal digital assistant (PDA), a wearable device, a laptop computer, etc. Exemplary embodiments of portable Kerberos application deployment devices include but are not limited to portable Kerberos application deployment devices equipped with IOS, Android, Microsoft or other operating systems. The above-mentioned portable Kerberos application deployment device may also be other portable Kerberos application deployment devices. It should also be understood that in some other embodiments of the present invention, the Kerberos application deployment device 600 may not be a portable Kerberos application deployment device, but a desktop computer with a touch-sensitive surface (such as a touch panel).

[0093] Accordingly, an embodiment of the present invention also provides a computer-readable storage medium, which is used to store computer-readable programs or instructions. When the program or instructions are executed by a processor, the steps or functions in the Kerberos application deployment method provided in the above-mentioned method embodiments can be implemented.

[0094] Those skilled in the art will appreciate that all or part of the processes of the above-mentioned embodiments can be implemented by instructing related hardware (such as a processor, a controller, etc.) through a computer program, and the computer program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0095] The above is a detailed introduction to a Kerberos application deployment method and device provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A Kerberos application deployment method, characterized in that: include: Configure the configuration items for running Kerberos applications; Build a multi-CPU architecture image for Kerberos applications; Build a Kubernetes cluster to run containerized applications; The Kerberos application is deployed in the containerized Kubernetes cluster based on the configuration item and the multi-CPU architecture image.

2. The Kerberos application deployment method according to claim 1, characterized in that: The configuration items for configuring the operation of the Kerberos application include: Get the basic configuration items for running the Kerberos application; Acquire environment variables, and configure the basic configuration items based on the environment variables to obtain the configuration items.

3. The Kerberos application deployment method according to claim 2, characterized in that: The basic configuration items include kdc.conf configuration file, krb5.conf configuration file and administrator authority configuration items; The kdc.conf configuration file includes kdc default configuration, kdc domain configuration, Kerberos application database module configuration and Kerberos application log record configuration; The KDC default configuration includes the network port used by the KDC key distribution center, the TCP port, and the maximum packet size for sending responses in UDP; The kdc realm configuration includes the host name of the kdc and the host name of the Kerberos management server; The krb5.conf configuration file includes the default behavior and option configuration items of the Kerberos library, the configuration item for mapping the server host name to the server realm, the configuration item for the non-hierarchical cross-realm authentication path, and the configuration item for the server host IP address of the KDC.

4. The Kerberos application deployment method according to claim 3, characterized in that: After configuring the basic configuration item based on the environment variable to obtain the configuration item, the method further includes: Create a storage database data path and write the initialization database for the Kerberos application; Instructions for starting the krb5kdc, kadmind daemons and creating administrators.

5. The Kerberos application deployment method according to claim 1, characterized in that: The multi-CPU architecture image of building a Kerberos application includes: After starting Docker buildx, create a scripted image file; Determine the image builder, target platform, and HTTP proxy server during the build process; Building a multi-CPU architecture image of a Kerberos application based on the image script file, the image builder, the target platform, and the HTTP proxy server; The multi-CPU architecture image is stored in a private image library.

6. The Kerberos application deployment method according to claim 5, characterized in that: Before building the multi-CPU architecture image of the Kerberos application, the following steps are also included: Container configuration items to configure the container; The container configuration items include the private image repository address, whether Docker buildx is available, driver specification, and data storage location.

7. The Kerberos application deployment method according to claim 1, characterized in that: The step of deploying the Kerberos application based on the configuration item and the multi-CPU architecture image to run on the containerized Kubernetes cluster includes: Create the plugin parameters and basic properties of the storage plugin for the Kubernetes cluster; Determine the deployment content of the Kerberos application to the containerized Kubernetes cluster based on the plug-in parameters, the basic attributes, the configuration items, and the multi-CPU architecture image; A project tool is constructed, and a deployment process of the deployment content is determined based on the project tool, and the Kerberos application is deployed on the containerized Kubernetes cluster for operation based on the deployment process.

8. The Kerberos application deployment method according to claim 7, characterized in that: The deployment content includes: StatefulSets, Services, and configuration parameters of Kerberos applications.

9. The Kerberos application deployment method according to claim 1, characterized in that: The Kerberos application deployment method further includes: Testing whether the Kerberos application deployed in the containerized Kubernetes cluster is available based on multiple test items; The test items include viewing existing subject accounts, adding subjects, authenticating subjects, viewing a list of authenticated accounts, viewing kdc log files, and viewing kadmind service logs.

10. A Kerberos application deployment device, characterized in that: include: Kerberos application configuration unit, used to configure the configuration items of Kerberos application operation; A multi-CPU architecture image building unit, used to build a multi-CPU architecture image of a Kerberos application; Kubernetes cluster building unit, used to build a Kubernetes cluster that runs containerized applications; A Kerberos application deployment unit is used to deploy the Kerberos application in the containerized Kubernetes cluster based on the configuration item and the multi-CPU architecture image.

Images