Access control method and platform for multi-cluster container terminal, and computer readable medium

Abstract

The invention provides an access control method and platform for a multi-cluster container terminal and a computer readable medium, and the scheme can provide an intuitive management interface, so that a user can conveniently check the current state of the container terminal through the interface, and meanwhile, the user can conveniently check the current state of the container terminal by utilizing pre-configured permission information and access control operation input by the user. According to the access control method and the access control device, the kubconfig file required by the access control is automatically acquired, and the kubconfig file is utilized to initiate the access control request to the specific container under the specific cluster, so that the access control authority is effectively managed in a cross-cluster manner, convenient and uniform access control is realized, the usability is better, and the professional requirement on a user is lower.

Description

Technical Field

[0001] The present application relates to the field of information technology, and in particular to an access control method, platform and computer-readable medium for multi-cluster container terminals. Background Art

[0002] In the IT architecture of modern enterprises, the widespread adoption of containerization and microservices architecture has led to a sharp increase in the demand for multi-cluster Kubernetes environments. Multi-cluster environments allow organizations to deploy and manage applications across geographical locations, improve availability and flexibility, and achieve load balancing and fault isolation. However, this also brings new challenges for access control and security management, especially in operating container terminals, which require effective management of access rights across clusters to ensure security and compliance.

[0003] In the existing Kubernetes multi-cluster environment, access control for container terminals often requires users to log in to the management node of each Kubernetes business cluster, or log in to the computing node where each container is located to use the container management tool. During the access control process, users need to log in to the corresponding management node or computing node according to their own access rights, and the passwords corresponding to each node need to be used during the login process. Therefore, the entire access control process is relatively cumbersome, and it is impossible to provide an intuitive and unified access control entrance. It requires high professionalism of access users and is not easy to use. Summary of the invention

[0004] An object of the present application is to provide an access control method, platform and computer-readable medium for multi-cluster container terminals.

[0005] To achieve the above object, the present application provides an access control method for a multi-cluster container terminal, the method comprising:

[0006] Perform authentication when the user logs in to determine the permission information corresponding to the user, where the permission information includes the access control permission that the user has to the first container in the first Kubernetes service cluster;

[0007] Displaying container information about the first container in the first Kubernetes service cluster;

[0008] When the user's access control operation is obtained, query the kubeconfig file of the second Kubernetes business cluster, wherein the second Kubernetes business cluster is one of the first Kubernetes business clusters and is specified by the user's access control operation;

[0009] Initiate an access control request corresponding to the access control operation to the interface service component through the kubeconfig file, so that the interface service component controls the second container to execute the corresponding operation instruction and returns the execution result, wherein the second container is a container in the second kubernetes service cluster and is specified by the access control request;

[0010] The execution result is displayed to the user.

[0011] Further, initiating an access control request corresponding to the access control operation to the interface service component through the kubeconfig file includes:

[0012] If the certificate of the kubeconfig file of the second kubernetes business cluster exists and the certificate of the kubeconfig file has not expired, an access control request corresponding to the access control operation is initiated to the interface service component through the kubeconfig file.

[0013] Furthermore, the method further comprises:

[0014] If the certificate of the kubeconfig file of the second kubernetes business cluster does not exist, or the certificate of the kubeconfig file has expired, use the super user authority to request the interface service component to issue a new certificate, and use the issued new certificate to assemble a new kubeconfig file;

[0015] An access control request corresponding to the access control operation is initiated to the interface service component through the new kubeconfig file.

[0016] Furthermore, container information about the first container in the first Kubernetes service cluster is displayed, including:

[0017] An interactive interface for displaying container information about the first container is displayed to the user, and the interactive interface provides an interactive entry for access control operations, so that the user can input access control operations through the interactive entry provided by the interactive interface.

[0018] Further, an access control request corresponding to the access control operation is initiated to the interface service component through the kubeconfig file, so that the interface service component controls the second container to execute the corresponding operation instruction and returns the execution result, wherein the second container is a container in the second kubernetes business cluster and is specified by the access control request, including:

[0019] An access control request corresponding to the access control operation is initiated to the interface service component through the kubeconfig file, so that after receiving the access control request, the interface service component forwards it to the kubelet process corresponding to the second container, and the kubelet process executes the corresponding operation instructions on the second container and returns the execution result.

[0020] Furthermore, the access control request and the execution result are transmitted via a websocket connection.

[0021] Furthermore, the method further comprises:

[0022] Pre-configure corresponding permission information for the user.

[0023] Furthermore, the corresponding permission information is pre-configured for the user, including:

[0024] Configure a preset project group, wherein the project group includes access control permissions for a first container in a first Kubernetes service cluster;

[0025] Add the user to the project group and configure the corresponding read-write role so that the user obtains the corresponding permission information.

[0026] Based on another aspect of the present application, a cloud-native management platform for access control of multi-cluster container terminals is also provided, the platform comprising a memory for storing computer program instructions and a processor for executing computer program instructions, wherein when the computer program instructions are executed by the processor, the device is triggered to execute the access control method for the multi-cluster container terminals.

[0027] The embodiment of the present application further provides a computer-readable medium on which computer program instructions are stored. The computer program instructions can be executed by a processor to implement the access control method for the multi-cluster container terminal.

[0028] Compared with the prior art, the present application provides an access control scheme for multi-cluster container terminals, which can perform authentication and authorization when a user logs in, and determine the permission information corresponding to the user, wherein the permission information includes the user's access control permission to the first container in the first kubernetes business cluster, thereby displaying container information about the first container in the first kubernetes business cluster to the user, so that the user can conveniently perform access control on container terminals distributed in different clusters through a unified interface. When the user's access control operation is obtained, the kubeconfig file of the second kubernetes business cluster is queried, and then an access control request corresponding to the access control operation is initiated to the interface service component through the kubeconfig file, so that the interface service component controls the second container to execute the corresponding operation instruction, and returns and displays the execution result. Therefore, this solution can provide an intuitive management interface, which allows users to view the current status of the container terminal through this interface. At the same time, it can use the pre-configured permission information and the access control operations entered by the user to automatically obtain the kubeconfig file required for this access control, and use the kubeconfig file to initiate an access control request to a specific container under a specific cluster, thereby effectively managing access control permissions across clusters and achieving convenient and unified access control, which is easier to use and requires less professionalism from users. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0030] Figure 1 A processing flow chart of an access control method for a multi-cluster container terminal provided in an embodiment of the present application;

[0031] Figure 2 This is a schematic diagram of an interactive interface for displaying container information about the first container to a user in an embodiment of the present application;

[0032] Figure 3 A schematic diagram of the interaction process when the solution in the embodiment of the present application is used to implement unified access control of container terminals in a multi-cluster environment;

[0033] The same or similar reference numerals in the drawings represent the same or similar components. DETAILED DESCRIPTION

[0034] The present application is described in further detail below in conjunction with the accompanying drawings.

[0035] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0036] In a typical configuration of the present application, the terminal and the equipment of the service network each include one or more processors (CPU), input / output interface, network interface and memory.

[0037] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0038] Computer readable media include permanent and non-permanent, removable and non-removable media, and can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, modules of programs or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by a computing device.

[0039] An embodiment of the present application provides an access control method for multi-cluster container terminals. The method can provide an intuitive management interface, which is convenient for users to view the current status of the container terminal through the interface. At the same time, the pre-configured permission information and the access control operation input by the user can be used to automatically obtain the kubeconfig file required for this access control, and use the kubeconfig file to initiate an access control request to a specific container under a specific cluster, thereby effectively managing access control permissions across clusters and realizing convenient and unified access control, which has better ease of use and lower requirements on user expertise.

[0040] In actual scenarios, the execution subject of the access control method may include user devices, network devices, or devices formed by integrating user devices and network devices through a network, or may also be an application running on the above devices. The user devices include but are not limited to various terminal devices such as computers, mobile phones, and tablet computers; the network devices include but are not limited to network hosts, single network servers, servers concentrated in multiple network servers, or servers in a distributed cloud network. Here, the distributed cloud network is composed of a large number of hosts or network servers based on cloud computing.

[0041] Figure 1 The processing flow of a method for access control of a multi-cluster container terminal provided in an embodiment of the present application is shown. The method can be applied to a cloud native management platform, which is used to perform unified and convenient access control on container terminals in a multi-cluster environment. The specific processing flow includes at least the following steps:

[0042] Step S101, performing authentication when a user logs in, and determining the authority information corresponding to the user.

[0043] In actual scenarios, users can log in to the cloud native management platform through a browser or client application. During the login process, the cloud native management platform will authenticate the user to confirm the user's identity and corresponding permission information to ensure the security of the platform. The permission information includes the user's access control rights to the first container in the first Kubernetes business cluster. For example, for each user, a corresponding account can be created in the cloud native management platform in advance. The account is bound to the user's identity information. At the same time, the administrator of the cloud native management platform can also configure corresponding access control permissions for the user, so that the user has the permission to operate certain specific containers in certain Kubernetes business clusters, such as the permission to create, delete, modify, and view certain container groups. In this embodiment, the first container is a container for which the user has access control permissions, and the first Kubernetes business cluster is the Kubernetes business cluster where the first container is located.

[0044] Step S102: display container information about the first container in the first Kubernetes service cluster.

[0045] After the user logs in to the cloud native management platform, the cloud native management platform can provide a group container service management function, and display container information about the first container in the first Kubernetes business cluster to the user, so that the user can view each container with access control permissions, so that each container can be operated and managed conveniently.

[0046] In some embodiments of the present application, when displaying container information about the first container in the first Kubernetes service cluster, the cloud native management platform may display an interactive interface about the container information of the first container to the user, and the interactive interface provides an interactive entrance for access control operations, so that the user can input access control operations through the interactive entrance provided by the interactive interface, such as Figure 2 As shown, unified access control of container terminals in different business clusters can be performed more conveniently and efficiently.

[0047] Step S103, when the user's access control operation is obtained, query the kubeconfig file of the second Kubernetes business cluster.

[0048] The second kubernetes business cluster is one of the first kubernetes business clusters and is specified by the access control operation of the user. For example, if it is determined based on the permission information of a user User1 that the containers that user User1 has access control permissions to are container-1 and container-2 in computing node node1 under kubernetes business cluster Cluster1, and container-3 and container-4 in computing node node2 under kubernetes business cluster Cluster2, then the first kubernetes business clusters in this embodiment are Cluster1 and Cluster2, and the first containers are container-1, container-2, container-3, and container-4. When the user needs to perform access control operations on the container container-3, since the container container-3 is located in the kubernetes business cluster Cluster2, the second kubernetes business cluster specified by this access control operation is Cluster2. At this time, the cloud native management platform needs to query the kubeconfig file of the kubernetes business cluster Cluster2 in order to access the container container-3 in the kubernetes business cluster Cluster2 through this kubeconfig file. In actual scenarios, each kubernetes business cluster has a corresponding unique primary key. After the user enters the access control operation, the unique primary key can be used to determine the kubernetes business cluster that the user wants to operate, and the kubeconfig file corresponding to the kubernetes business cluster can be queried.

[0049] Because the kubeconfig file includes the necessary content such as certificates to access the Kubernetes business cluster, the cloud native management platform needs to obtain the correct kubeconfig file before initiating an access control request, so that it can initiate access control for specific containers in the second Kubernetes business cluster.

[0050] Step S104: Initiate an access control request corresponding to the access control operation to the interface service component through the kubeconfig file, so that the interface service component controls the second container to execute the corresponding operation instruction and returns the execution result.

[0051] In order to ensure smooth access to the second kubernetes business cluster, the cloud native management platform can check the Kubeconfig file before initiating the access control request to determine whether it contains the correct certificate. If the certificate of the kubeconfig file of the second kubernetes business cluster exists and the certificate of the kubeconfig file has not expired, the cloud native management platform can initiate an access control request corresponding to the access control operation to the interface service component through the kubeconfig file to complete the corresponding access control operation.

[0052] However, when the certificate of the kubeconfig file of the second kubernetes business cluster does not exist, or the certificate of the kubeconfig file has expired, it is impossible to directly initiate an access control request corresponding to the access control operation to the interface service component through the kubeconfig file. At this time, the cloud native management platform will use the super user authority to request the interface service component to issue a new certificate, and use the issued new certificate to assemble a new kubeconfig file, and then initiate an access control request corresponding to the access control operation to the interface service component through the new kubeconfig file.

[0053] In actual scenarios, the kubeconfig file can be stored in a database used by the cloud native management platform. For example, in this embodiment, a PostgreSQL relational database can be used to store kubeconfig files. After a new kubeconfig file is generated, the new kubeconfig file can be stored in the database so that when access control processing is performed later, the required kubeconfig file can be queried from the database.

[0054] In the scenario of this embodiment, the interface service component may be kube-apiserver, which is responsible for exposing the Kubernetes application program interface to users and receiving and processing access control requests from the cloud native management platform. In the actual processing process, the cloud native management platform may initiate an access control request corresponding to the access control operation to the interface service component through the kubeconfig file, so that after receiving the access control request, the interface service component forwards it to the kubelet process corresponding to the second container, and the kubelet process executes the corresponding operation instruction on the second container and returns the execution result.

[0055] The kubelet process is a daemon process running on each computing node, responsible for managing the containers on the computing nodes. After receiving the access control request, the interface service component will forward it to the kubelet process of the computing node where the container is located. After the kubelet process receives the access control request, it will parse the request and execute the corresponding operation instructions on the second container based on the parsed content. In the actual scenario, the exec command can be used when executing the operation instruction, and the execution result is returned through the established long connection after the execution is completed, so as to realize the data transmission between the container and the cloud native management platform. For example, the access control request and execution result described in this embodiment are transmitted via a websocket connection.

[0056] Step S105, the execution result is displayed to the user. Thus, after inputting the access control operation, the user can intuitively see the result of the access control, which is easier to use. The specific display method can be completed by using the front-end component, for example, in this embodiment, xterm can be used to realize the display of relevant information.

[0057] In order to more effectively manage cross-cluster access control permissions, in this solution, corresponding permission information can be pre-configured for the user to ensure that each user has access control permissions to specific containers in a specific Kubernetes business cluster.

[0058] In order to implement permission configuration more conveniently, the concept of project group is introduced in this solution. Before assigning permissions to users, a preset project group can be configured, and the project group includes access control permissions to the first container in the first kubernetes business cluster. When creating a user, the user can be added to the project group and the corresponding read-write role can be configured so that the user can obtain the corresponding permission information. In this way, it is more convenient for new users to join. You only need to add the new user to the corresponding project group to assign the corresponding access control permissions to the user. There is no need to assign permissions separately. When operating containers in different kubernetes business clusters, there is no need to bother to obtain the machine information of each node in different kubernetes business clusters. The corresponding access control operations can be completed conveniently and automatically based on the access control permissions.

[0059] Figure 3 The interactive process of implementing unified access control container terminals in a multi-cluster environment by using the solution of an embodiment of the present application is shown, including the following steps:

[0060] Step S301, the user authenticates and logs in to the cloud native management platform. The cloud native management platform provides a cluster container service management function, which can display the container information of the first container to which the user has access control authority under the first Kubernetes business cluster.

[0061] Step S302, when the user performs an access control operation on a container with access control permissions through the cloud native management platform, the cloud native management platform queries the database for the kubeconfig file of the second Kubernetes cluster through the access control permissions corresponding to the user.

[0062] In step S303, the cloud native management platform determines whether the certificate of the queried kubeconfig file exists and whether the certificate has expired. If the certificate does not exist or has expired, the cloud native management platform uses the permission of the super user to request the interface service component kube-apiserver to issue a new certificate, assemble it into a new kubeconfig file and save it to the database, and then execute the subsequent step S404. If the certificate exists and has not expired, the cloud native management platform directly executes the subsequent step S404.

[0063] In step S304, the cloud native management platform initiates a WebSocket persistent connection to the kube-apiserver through user Kubeconfig and sends an access control request.

[0064] In step S305, the kube-apiserver obtains the access control request, queries the ETCD database, obtains information such as the node where the second container is located, the container ID, and the like, and sends the access control request to the kubelet process of the node where the second container is located based on the queried information.

[0065] In step S306, the kubelet process runs the exec command corresponding to the access control operation in the second container, thereby implementing access control on the second container. In this process, the access control request and execution result generated by the access control operation input by the user will be transmitted through the established WebSocket long connection, so that the cloud native management platform can display relevant information about the container through the front-end component xterm.

[0066] Based on the same inventive concept, a cloud-native management platform for access control of multi-cluster container terminals is also provided in an embodiment of the present application. The method corresponding to the management platform is the access control method of multi-cluster container terminals in the aforementioned embodiment, and its principle of solving the problem is similar to that of the method. The cloud-native management platform for access control of multi-cluster container terminals provided in an embodiment of the present application includes a memory for storing computer program instructions and a processor for executing computer program instructions, wherein when the computer program instructions are executed by the processor, the device is triggered to implement the methods and / or technical solutions of the aforementioned multiple embodiments of the present application.

[0067] The specific implementation of the cloud native management platform may include user devices, network devices, or devices formed by integrating user devices and network devices through a network, or may also be applications running on the above devices. The user devices include but are not limited to various terminal devices such as computers, mobile phones, and tablet computers; the network devices include but are not limited to network hosts, single network servers, servers concentrated in multiple network servers, or servers in a distributed cloud network. The distributed cloud network described here is composed of a large number of hosts or network servers based on cloud computing.

[0068] In particular, the methods and / or embodiments in the embodiments of the present application may be implemented as computer software programs. For example, the embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes program code for executing the method shown in the flowchart. When the computer program is executed by the processing unit, the above functions defined in the method of the present application are executed.

[0069] It should be noted that the computer-readable medium described in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device.

[0070] In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0071] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0072] The flow chart or block diagram in the accompanying drawings shows the possible architecture, function and operation of the equipment, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated system for hardware that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0073] As another aspect, the present application further provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more computer program instructions, which may be executed by a processor to implement the methods and / or technical solutions of the above multiple embodiments of the present application.

[0074] It should be noted that the present application can be implemented in software and / or a combination of software and hardware, for example, can be implemented using an application specific integrated circuit (ASIC), a general purpose computer or any other similar hardware device. In certain embodiments, the software program of the present application can be executed by a processor to implement the above steps or functions. Similarly, the software program of the present application (including related data structures) can be stored in a computer-readable recording medium, for example, a RAM memory, a magnetic or optical drive or a floppy disk and similar devices. In addition, some steps or functions of the present application can be implemented using hardware, for example, as a circuit that cooperates with a processor to perform each step or function.

[0075] It is obvious to those skilled in the art that the present application is not limited to the details of the above exemplary embodiments, and that the present application can be implemented in other specific forms without departing from the spirit or basic features of the present application. Therefore, from any point of view, the embodiments should be regarded as exemplary and non-restrictive, and the scope of the present application is defined by the attached claims rather than the above description, and it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present application. Any figure mark in the claims should not be regarded as limiting the claims involved. In addition, it is obvious that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in the device claim can also be implemented by one unit or device through software or hardware. The words "first" and "second" are used to indicate names, but do not indicate any specific order. For example, the "first container" in the embodiment of the present application refers to a container to which the user has access control authority, the "first Kubernetes business cluster" refers to the Kubernetes business cluster where the container to which the user has access control authority is located, the "second container" refers to the container that is the object of operation when the user performs a certain access control operation, which may be one of the first containers, and the "second Kubernetes business cluster" refers to the Kubernetes business cluster where the second container is located, which may be one of the first Kubernetes business clusters. The numerical order of the serial numbers corresponding to the steps does not indicate any specific execution order, and each step can be executed in any order combination as long as it complies with the execution logic.

Claims

1. A method for controlling access to multi-cluster container terminals, characterized in that: The method comprises: Perform authentication when the user logs in to determine the permission information corresponding to the user, where the permission information includes the access control permission that the user has to the first container in the first Kubernetes service cluster; Displaying container information about the first container in the first Kubernetes service cluster; When the user's access control operation is obtained, query the kubeconfig file of the second Kubernetes business cluster, wherein the second Kubernetes business cluster is one of the first Kubernetes business clusters and is specified by the user's access control operation; Initiate an access control request corresponding to the access control operation to the interface service component through the kubeconfig file, so that the interface service component controls the second container to execute the corresponding operation instruction and returns the execution result, wherein the second container is a container in the second kubernetes service cluster and is specified by the access control request; The execution result is displayed to the user.

2. The method according to claim 1, characterized in that Initiating an access control request corresponding to the access control operation to the interface service component through the kubeconfig file, including: If the certificate of the kubeconfig file of the second kubernetes business cluster exists and the certificate of the kubeconfig file has not expired, an access control request corresponding to the access control operation is initiated to the interface service component through the kubeconfig file.

3. The method according to claim 2, characterized in that The method further comprises: If the certificate of the kubeconfig file of the second kubernetes business cluster does not exist, or the certificate of the kubeconfig file has expired, use the super user authority to request the interface service component to issue a new certificate, and use the issued new certificate to assemble a new kubeconfig file; An access control request corresponding to the access control operation is initiated to the interface service component through the new kubeconfig file.

4. The method according to claim 1, characterized in that: Display container information about the first container in the first Kubernetes service cluster, including: An interactive interface for displaying container information about the first container is displayed to the user, and the interactive interface provides an interactive entry for access control operations, so that the user can input access control operations through the interactive entry provided by the interactive interface.

5. The method according to claim 1, characterized in that Initiating an access control request corresponding to the access control operation to the interface service component through the kubeconfig file, so that the interface service component controls the second container to execute the corresponding operation instruction and returns the execution result, wherein the second container is a container in the second kubernetes service cluster and is specified by the access control request, including: An access control request corresponding to the access control operation is initiated to the interface service component through the kubeconfig file, so that after receiving the access control request, the interface service component forwards it to the kubelet process corresponding to the second container, and the kubelet process executes the corresponding operation instructions on the second container and returns the execution result.

6. The method according to claim 5, characterized in that The access control request and execution result are transmitted via a websocket connection.

7. The method according to claim 1, characterized in that The method further comprises: Pre-configure corresponding permission information for the user.

8. The method according to claim 7, characterized in that Pre-configure corresponding permission information for the user, including: Configure a preset project group, wherein the project group includes access control permissions for a first container in a first Kubernetes service cluster; Add the user to the project group and configure the corresponding read-write role so that the user obtains the corresponding permission information.

9. A cloud native management platform for multi-cluster container terminal access control, the platform comprising a memory for storing computer program instructions and a processor for executing computer program instructions, wherein: When the computer program instructions are executed by the processor, the platform is triggered to execute the method according to any one of claims 1 to 8.

10. A computer readable medium having computer program instructions stored thereon, wherein the computer program instructions can be executed by a processor to implement the method according to any one of claims 1 to 8.

Images