Resource change method and device, equipment, medium and program product

Abstract

The embodiment of the invention discloses a resource change method and device, equipment, a medium and a program product. The method is applied to an access controller in a cloud native platform, and the cloud native platform comprises a plurality of servers. The method comprises the following steps: intercepting a to-be-processed target resource change request in the cloud native platform; obtaining a target security auditing result obtained after the target resource change request is subjected to security auditing; and under the condition that the target security auditing result comprises an approved change result, sending a target change execution instruction corresponding to the target resource change request to the server, so that the server responds to the target change execution instruction and executes a target resource change operation corresponding to the target resource change request.

Description

Technical Field

[0001] The present specification relates to the field of computer technology, and in particular to a resource change method, device, equipment, medium and program product. Background Art

[0002] With the rapid development and widespread application of cloud-native technologies, the rapid iteration of cloud-native information may not undergo sufficient security checks, which may easily introduce vulnerabilities or configuration errors. Applications that have not undergone security assessments are released online through cloud-native platforms, which may lead to security risks such as data leakage, system intrusion, or violation of laws. Summary of the invention

[0003] The embodiments of this specification provide a resource change method, device, equipment, medium and program product, which not only prevents unaudited resource changes from being mistakenly or maliciously deployed to the server cluster of the cloud native platform, improving the security of resource changes, but also realizes the safe change of cloud native platform resources by configuring an admission controller in the cloud native platform, reducing the difficulty of resource change management and maintenance of the cloud native platform. The above technical solution is as follows:

[0004] In a first aspect, an embodiment of the present specification provides a resource change method, which is applied to an admission controller in a cloud native platform, wherein the cloud native platform includes multiple servers, and the admission controller is built into the server; the method includes:

[0005] Intercept pending target resource change requests in the above cloud native platform;

[0006] Obtain the target security audit result obtained after the security audit of the above target resource change request;

[0007] When the target security audit result includes an approved change result, a target change execution instruction corresponding to the target resource change request is sent to the server, so that the server responds to the target change execution instruction and executes the target resource change operation corresponding to the target resource change request.

[0008] In a possible implementation, intercepting the pending target resource change request in the cloud native platform includes:

[0009] The target resource change request to be processed in the above-mentioned cloud native platform is intercepted according to preset rules; the above-mentioned preset rules include user identity interception rules and / or change behavior interception rules.

[0010] In a possible implementation, intercepting the pending target resource change request in the cloud native platform according to a preset rule includes:

[0011] If the target triggering user corresponding to the target resource change request to be processed in the above-mentioned cloud native platform does not belong to a non-intercepting user, intercepting the above-mentioned target resource change request; the above-mentioned non-intercepting user is used to represent a user who can directly change resources on the above-mentioned cloud native platform without security review;

[0012] and / or

[0013] When the target resource change operation corresponding to the target resource change request to be processed in the above-mentioned cloud native platform includes a risk change operation, the above-mentioned target resource change request is intercepted; the above-mentioned risk change operation includes at least one of the following: create operation, delete operation, and modify operation.

[0014] In a possible implementation, the target security audit result obtained after the target resource change request is security audited includes:

[0015] Forwarding the target resource change request to the security audit end, so that the security audit end performs a security audit based on the target resource change request to obtain a corresponding target security audit result;

[0016] Receive the target security audit result returned by the security audit terminal.

[0017] In a possible implementation, after intercepting the target resource change request to be processed in the cloud native platform, and obtaining the target security audit result obtained after the target resource change request has been subjected to security audit, the method further includes:

[0018] Obtain the target historical change information of the target triggering user corresponding to the target resource change request;

[0019] The target security audit result obtained after the security audit of the target resource change request mentioned above includes:

[0020] Sending the target resource change request and the target historical change information to the security audit end, so that the security audit end performs a security audit on the target resource change request based on the target historical change information to obtain a corresponding target security audit result;

[0021] Receive the target security audit result returned by the security audit terminal.

[0022] In a possible implementation, after obtaining the target security audit result obtained after the target resource change request has been security audited, the method further includes:

[0023] If the above target security review result includes a rejection of the change result, the above target resource change request is terminated;

[0024] The target security audit result is returned to the user end of the target triggering user corresponding to the target resource change request.

[0025] In a possible implementation, the target security audit result further includes rejection-related information corresponding to the rejection change result; the rejection-related information includes at least one of the following: rejection reason, rejection change content;

[0026] The above-mentioned returning the above-mentioned target security audit result to the user end of the target triggering user corresponding to the above-mentioned target resource change request includes:

[0027] The above-mentioned rejection change result and the corresponding rejection related information are returned to the user end of the target trigger user corresponding to the above-mentioned target resource change request, so that the above-mentioned user end adjusts the above-mentioned target resource change request based on the above-mentioned rejection related information, and sends the adjusted above-mentioned target resource change request to the above-mentioned server.

[0028] In a possible implementation, after sending the target change execution instruction corresponding to the target resource change request to the server so that the server responds to the target change execution instruction and executes the target resource change operation corresponding to the target resource change request, the method further includes:

[0029] Receive the target execution result corresponding to the target resource change operation returned by the server;

[0030] The target execution result is forwarded to the user end of the target triggering user corresponding to the target resource change request.

[0031] In a second aspect, an embodiment of the present specification provides a resource change device, which is applied to an admission controller in a cloud native platform, wherein the cloud native platform includes multiple servers, and the admission controller is built into the server; the resource change device includes:

[0032] An interception module, used to intercept pending target resource change requests in the above cloud native platform;

[0033] The first acquisition module is used to obtain the target security audit result obtained after the target resource change request has been security audited;

[0034] The sending module is used to send the target change execution instruction corresponding to the target resource change request to the above-mentioned server when the above-mentioned target security audit result includes an approved change result, so that the above-mentioned server responds to the above-mentioned target change execution instruction and executes the target resource change operation corresponding to the above-mentioned target resource change request.

[0035] In a possible implementation, the above interception module is specifically used to:

[0036] The target resource change request to be processed in the above-mentioned cloud native platform is intercepted according to preset rules; the above-mentioned preset rules include user identity interception rules and / or change behavior interception rules.

[0037] In a possible implementation, the above interception module is specifically used to:

[0038] If the target triggering user corresponding to the target resource change request to be processed in the above-mentioned cloud native platform does not belong to a non-intercepting user, intercepting the above-mentioned target resource change request; the above-mentioned non-intercepting user is used to represent a user who can directly change resources on the above-mentioned cloud native platform without security review; and / or

[0039] When the target resource change operation corresponding to the target resource change request to be processed in the above-mentioned cloud native platform includes a risk change operation, the above-mentioned target resource change request is intercepted; the above-mentioned risk change operation includes at least one of the following: create operation, delete operation, and modify operation.

[0040] In a possible implementation, the first acquisition module includes:

[0041] A first sending unit is used to forward the target resource change request to a security audit terminal, so that the security audit terminal performs a security audit based on the target resource change request to obtain a corresponding target security audit result;

[0042] The receiving unit is used to receive the target security audit result returned by the security audit terminal.

[0043] In a possible implementation, the resource changing device further includes:

[0044] The second acquisition module is used to obtain the target history change information of the target triggering user corresponding to the target resource change request;

[0045] The first acquisition module includes:

[0046] A second sending unit is used to send the target resource change request and the target historical change information to the security audit end, so that the security audit end performs a security audit on the target resource change request based on the target historical change information to obtain a corresponding target security audit result;

[0047] The receiving unit is used to receive the target security audit result returned by the security audit terminal.

[0048] In a possible implementation, the resource changing device further includes:

[0049] A change termination module, used to terminate the target resource change request when the target security audit result includes a change rejection result;

[0050] The return module is used to return the above-mentioned target security audit result to the user end of the target triggering user corresponding to the above-mentioned target resource change request.

[0051] In a possible implementation, the target security audit result further includes rejection-related information corresponding to the rejection change result; the rejection-related information includes at least one of the following: rejection reason, rejection change content;

[0052] The above-mentioned return module is specifically used to: return the above-mentioned rejection change result and the corresponding above-mentioned rejection related information to the user end of the target trigger user corresponding to the above-mentioned target resource change request, so that the above-mentioned user end adjusts the above-mentioned target resource change request based on the above-mentioned rejection related information, and sends the adjusted above-mentioned target resource change request to the above-mentioned server.

[0053] In a possible implementation, the resource changing device further includes:

[0054] A receiving module, used for receiving the target execution result corresponding to the target resource change operation returned by the server;

[0055] The forwarding module is used to forward the above target execution result to the user end of the target triggering user corresponding to the above target resource change request.

[0056] In a third aspect, an embodiment of this specification provides an electronic device, including: a processor and a memory;

[0057] The processor is connected to the memory;

[0058] The above-mentioned memory is used to store executable program code;

[0059] The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the resource changing method provided by the first aspect of the embodiment of this specification or any possible implementation of the first aspect.

[0060] In a fourth aspect, an embodiment of the present specification provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the resource change method provided by the first aspect of the embodiment of the present specification or any possible implementation of the first aspect.

[0061] In a fifth aspect, an embodiment of the present specification provides a computer program product comprising instructions, which, when the above-mentioned computer program product runs on a computer or a processor, enables the above-mentioned computer or the above-mentioned processor to execute the resource change method provided by the first aspect of the embodiment of the present specification or any possible implementation method of the first aspect.

[0062] In the embodiment of this specification, a target resource change request to be processed in the cloud native platform is intercepted; a target security audit result obtained after the target resource change request has been security audited is obtained;

[0063] In the case where the target security audit result includes an approved change result, a target change execution instruction corresponding to the target resource change request is sent to the server, so that the server responds to the target change execution instruction and executes the target resource change operation corresponding to the target resource change request. By using the cloud native access mechanism, all resource change requests of the cloud native platform are intercepted for security audit evaluation before actual execution. Only when the target security audit result includes an approved change will the server be triggered to execute the corresponding resource change operation. This not only avoids unaudited resource changes from being erroneously or maliciously deployed to the server cluster of the cloud native platform, thereby improving the security of resource changes, but also realizes secure changes of cloud native platform resources by configuring an admission controller in the cloud native platform, thereby reducing the difficulty of resource change management and maintenance of the cloud native platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the technical solutions in the embodiments of this specification, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0065] Figure 1 A schematic diagram of the architecture of a resource change system provided as an exemplary embodiment of this specification;

[0066] Figure 2 A flowchart of a resource change method provided as an exemplary embodiment of this specification;

[0067] Figure 3 A flowchart of another resource change method provided as an exemplary embodiment of this specification;

[0068] Figure 4 A schematic diagram of an implementation process of a resource change method provided by an exemplary embodiment of this specification;

[0069] Figure 5A schematic diagram of the structure of a resource changing device provided as an exemplary embodiment of this specification;

[0070] Figure 6 The present invention is a schematic diagram of the structure of an electronic device provided by an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0071] The technical solutions in the embodiments of this specification will be described clearly and completely below in conjunction with the drawings in the embodiments of this specification.

[0072] The terms "first", "second", "third", etc. in this specification and claims and the above drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units inherent to these processes, methods, products or devices.

[0073] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions. For example, the target identity information, target historical change information, etc. involved in this specification are all obtained with full authorization.

[0074] The cloud native platform is a technical system and methodology based on the cloud computing model that fully utilizes the advantages of the cloud platform to build and run applications. It focuses on modern technologies such as containers, microservices, and DevOps, and emphasizes the use of cloud services' elasticity, scalability, automation, and agility to build and deploy applications. Through high integration and automation, it achieves rapid iteration, efficient deployment, and elastic scaling of applications.

[0075] Cloud-native resource changes generally refer to operations that adjust or update the configuration or status of cloud resources such as computing, networking, and storage in a cloud-native environment.

[0076] In related cloud-native resource change technologies, resource changes and security audits of cloud-native platforms (such as Kubernetes) are often managed through the Software Development Lifecycle (SDL) control method, which usually involves integrating the cloud-native environment into the software development, deployment, and operation and maintenance processes of the entire organization. In this model, all cloud-native changes triggered by external systems will follow a well-defined, end-to-end management process. This SDL control method mainly includes the following steps:

[0077] (1) Triggering a change request: A developer or operator initiates a change request at a certain stage of software development (such as code submission, application building, or deployment process). The request is usually triggered by a CI / CD pipeline or automated deployment tool and may include pushing new code, updating configuration, or expanding services.

[0078] (2) Review and testing: Before a change request enters the cloud native environment, it needs to go through a predefined review and testing process. This may include code review, automated testing (unit testing, integration testing, etc.), security scanning, and performance evaluation.

[0079] (3) Security Audit: Before the request is finally deployed to the cloud native environment, a dedicated security audit step will be triggered. The security team will assess the impact of the change and review whether it complies with security practices and compliance requirements.

[0080] The SDL control method in the above-mentioned related technologies has the following main problems when implementing resource change notifications and security audits on cloud native platforms (such as Kubernetes):

[0081] (1) Consistency risk: Triggering change notifications on the SDL platform rather than the cloud native platform itself may cause consistency issues. For example, some changes that are not triggered by the SDL platform may lead to omissions in security assessments and cause security risks.

[0082] (2) Integration complexity: SDL management and control often requires more complex integration between cloud native platforms and other platforms, which may increase the difficulty of configuration, maintenance and management.

[0083] Based on this, the embodiments of this specification provide a resource change method. By using the cloud native access mechanism, all resource change requests of the cloud native platform will be intercepted for security audit assessment before actual execution. Only when the target security audit result includes approval of the change will the server be triggered to execute the corresponding resource change operation. This not only avoids unaudited resource changes from being mistakenly or maliciously deployed to the server cluster of the cloud native platform, thereby improving the security of resource changes, but also realizes the secure change of cloud native platform resources by configuring the admission controller in the cloud native platform, thereby reducing the difficulty of resource change management and maintenance of the cloud native platform.

[0084] Please refer to the following Figure 1 , which is a schematic diagram of the architecture of a resource change system provided by an exemplary embodiment of this specification. Figure 1 As shown, the resource change system includes: a user end 110 and a cloud native platform end 120. Among them:

[0085] The user terminal 110 may be a user terminal corresponding to a user such as a developer or operator who triggers a cloud native resource change. The user terminal 110 may be, but is not limited to, installed with a resource change program or application, so that the user can use the resource change program or application to trigger the resource change processing of the cloud native platform. It can interact with the cloud native platform terminal 120 through the network, such as sending a target resource change request to the cloud native platform terminal 120, receiving the target resource change result fed back by the cloud native platform terminal 120, etc. The user terminal 110 can be hardware or software. When the user terminal 110 is hardware, it can be various electronic devices, including but not limited to smart watches, smart phones, tablet computers, laptop portable computers, and desktop computers. When the user terminal 110 is software, it can be installed in the electronic devices listed above, which can be implemented as multiple software or software modules (for example: used to provide distributed services), or it can be implemented as a single software or software module, which is not specifically limited here.

[0086] The cloud native platform end 120 may be a cloud native platform that provides application building and deployment and resource change services, and may be composed of multiple servers, wherein at least one server is provided with an admission controller, which is used to intercept the pending target resource change request after the server (e.g., API server) receives the target resource change request and before processing the target resource change request, and obtain the target security audit result obtained after the target resource change request has been audited; finally, when the target security audit result includes an approved change result, a target change execution instruction corresponding to the target resource change request is sent to the server, so that the server responds to the target change execution instruction and executes the target resource change operation corresponding to the target resource change request. The server of the cloud native platform end 120 may be, but is not limited to, a hardware server, a virtual server, a cloud server, etc.

[0087] It can be understood that the admission controller can be deployed in a distributed manner in the form of a container in any one or more of the multiple servers of the cloud native platform, and the embodiments of this specification are not limited to this.

[0088] Alternatively, if Figure 1 As shown, the resource change system may also include, but is not limited to, a security audit terminal 130. The security audit terminal 130 may be a terminal corresponding to a security auditor such as a security engineer who is responsible for the security of the cloud native platform. The security audit terminal 130 may be, but is not limited to, installed with a security assessment program or application, so that the security auditor can use the security assessment change program or application to implement security audit processing of cloud native platform resource changes. After the security audit terminal 130 completes the security audit of the target resource change request, the corresponding target security audit result may be returned to the admission controller of the cloud native platform, so that the admission controller determines whether the server of the cloud native platform is to perform the target resource change operation corresponding to the target resource change request based on the target security audit result.

[0089] The network may be a medium that provides a communication link between any two of the user end 110, the cloud native platform end 120, and the security audit end 130, or may be the Internet including network devices and transmission media, but is not limited thereto. The transmission medium may be a wired link, such as but not limited to coaxial cable, optical fiber, and digital subscriber line (DSL), or a wireless link, such as but not limited to wireless fidelity (WIFI), Hypertext Transfer Protocol (HTTP), Bluetooth, and mobile device networks.

[0090] Understandably, Figure 1The number of user terminals 110, cloud native platform terminals 120, and security audit terminals 130 in the resource change system shown is only for example. In a specific implementation, the resource change system may include any number of user terminals 110, cloud native platform terminals 120, and security audit terminals 130, and this specification embodiment does not specifically limit this. For example, but not limited to, the user terminal 110 may be a user terminal cluster composed of multiple user terminals, the cloud native platform terminal 120 may be a cloud native platform terminal cluster composed of multiple cloud native platform terminals, and the security audit terminal 130 may be a security audit terminal cluster composed of multiple security audit terminals.

[0091] In order to solve the problems existing in the above-mentioned related technologies, Figure 1 , introduces the resource change method provided by the embodiment of this specification. For details, please refer to Figure 2 , which is a flow chart of a resource change method provided by an exemplary embodiment of this specification. Figure 2 As shown, the resource change method includes the following steps:

[0092] S202, intercepting a pending target resource change request in the cloud native platform.

[0093] Specifically, when a user wants to change resources in a cloud native platform, such as but not limited to creating, updating or deleting Pod, Service and other resources, the user can send a corresponding target resource change request to the server of the cloud native platform (such as an API server) through the user end based on the cloud native platform interface or tool (such as kubectl) or other CI / CD tools. In the cloud native platform, before processing the target resource change request, the server will directly call the configured admission controller to intercept these pending target resource change requests to prevent the cloud native platform server from directly processing the target resource change request that has not passed the security review and causing security risks. The above-mentioned pending target resource change request is a resource change request for which the corresponding target resource change operation has not yet been executed in the cloud native platform.

[0094] Optionally, preset rules for intercepting resource change requests of the cloud native platform may be pre-set in the admission controller. After the server in the cloud native platform detects or receives the target resource change request sent by the user end, before processing the target resource change request, that is, executing the target resource change operation corresponding to the target resource change request, the admission controller in the cloud native platform will be called to intercept the target resource change request according to the preset rules. The above preset rules may include, but are not limited to, user identity interception rules and / or change behavior interception rules. For example, but not limited to, when the target triggering user corresponding to the target resource change request does not belong to a non-intercepting user, the target resource change request is intercepted. The non-intercepting user is used to represent users who can directly make resource changes to the cloud native platform without security audits; and / or, when the target resource change operation corresponding to the target resource change request includes a risk change operation, the target resource change request is intercepted. The risk change operation includes at least one of the following: create operation, delete operation, and modify operation.

[0095] Furthermore, the above-mentioned target resource change request may carry the target identity information of the target triggering user, and the admission controller may be pre-set with the non-intercepting identity information of at least one non-intercepting user. When the admission controller detects that the target identity information carried by the target resource change request to be processed in the cloud native platform does not match each non-intercepting identity information, it indicates that the target triggering user is a risky user, and the target resource change request triggered by it will be intercepted. After receiving the target resource change request, the server in the cloud native platform cannot immediately execute the corresponding target resource change operation, and needs to obtain the target change execution instruction issued by the admission controller before it can be executed, so as to avoid the problem that the rapid iteration process of cloud native information may not undergo sufficient security checks and easily introduce vulnerabilities or configuration errors, and ensure the security of resource changes. When the admission controller detects that the target identity information carried by the target resource change request to be processed in the cloud native platform matches a non-intercepting identity information, it indicates that the target triggering user is not a risky user, and the target resource change request triggered by it will not be intercepted. After receiving the target resource change request, the server in the cloud native platform can directly execute the corresponding target resource change operation.

[0096] Furthermore, one or more target resource change operations may be requested in the target resource change request, such as but not limited to create operations, delete operations, modify operations, query operations, etc. For different cloud native platforms, different change operations or the same change operation may cause different security risks. The admission controller of the cloud native platform may be pre-set with corresponding risk change operation types. When the admission controller detects that the target resource change operation corresponding to the target resource change request to be processed in the cloud native platform includes a risk change operation, it means that this change is likely to cause security problems, and the target resource change request will be intercepted for security review. Risk change operations include at least one of the following: create operations, delete operations, and modify operations. The risk change operations corresponding to different cloud native platforms may be the same or different, and can be set according to the performance of the cloud native platform and the actual research and development needs. This description is an embodiment and is not limited to this. When the admission controller detects that the target resource change operations corresponding to the target resource change requests to be processed in the cloud native platform do not include risky change operations, it means that this change will not cause security issues for the cloud native platform. In this case, the target resource change request may not be intercepted for security audit, so that the server in the cloud native platform can directly execute the corresponding target resource change operation after receiving the target resource change request, thereby avoiding the problem that the target resource change request that does not pose any security risk at all is intercepted for invalid security audit, wasting security audit resources, and affecting the processing efficiency of such target resource change requests.

[0097] It can be understood that the preset rules for the admission controller to intercept pending target resource change requests in the cloud native platform may include, in addition to the above-mentioned user identity interception rules and change behavior interception rules, change time interception rules (intercepting target resource change requests triggered or need to be processed within the target time period), change device interception rules (intercepting target resource change requests triggered by target devices or intercepting target resource change requests triggered by non-target devices), change frequency interception rules (intercepting target resource change requests triggered by target triggering users or target devices whose change frequency is greater than a threshold), etc. The specific rules can be set according to the actual resource change requirements of the cloud native platform, and the embodiments of this specification are not limited to this.

[0098] S204, obtaining a target security audit result obtained after the target resource change request has undergone security audit.

[0099] Specifically, after intercepting the target resource change request to be processed in the cloud native platform, the admission controller can first obtain the target resource change information corresponding to the above target resource change request (for example, but not limited to request content, request time, historical request status, etc.), and obtain the target security audit result corresponding to the target resource change request based on the target resource change information.

[0100] Optionally, a security audit program or a security audit model may be pre-set in the admission controller. After intercepting the pending target resource change request in the cloud native platform, the security audit program or the security audit model may be directly used to perform a security audit on the target resource change request to obtain a corresponding target security audit result.

[0101] Optionally, after intercepting the target resource change request to be processed in the cloud native platform, the admission controller may also forward the target resource change request to the security audit end, so that the security audit end performs a security audit based on the target resource change request to obtain the corresponding target security audit result, and returns it to the admission controller. The admission controller may receive the target security audit result returned by the security audit end through the network. After the above-mentioned security audit end receives the target resource change request sent by the admission controller or the target resource change information corresponding to the target resource change request, it may notify the security engineer to conduct a corresponding security review or directly use the security audit program installed on the security audit end or the set security audit model to conduct a corresponding security audit to evaluate whether the target resource change request complies with the corresponding security policy and compliance requirements of the cloud native platform. After the security audit end completes the corresponding security audit, the obtained target security audit result may be returned to the admission controller in the form of, but not limited to, an HTTP response.

[0102] It can be understood that the above security audit process may include but is not limited to at least one of the above security detection steps such as code analysis, dependency checking, and container image scanning.

[0103] S206, when the target security audit result includes an approved change result, sending a target change execution instruction corresponding to the target resource change request to the server, so that the server responds to the target change execution instruction and executes the target resource change operation corresponding to the target resource change request.

[0104] Specifically, when the target security audit result includes an approved change result, it means that the target resource change request has no security risk. Then, a target change execution instruction corresponding to the target resource change request can be sent to the server to trigger the server to respond to the target change execution instruction and execute the target resource change operation corresponding to the target resource change request.

[0105] In an embodiment of the present specification, a target resource change request sent by a user terminal to a server of a cloud native platform is intercepted; a target security audit result obtained after a security audit of the target resource change request is obtained; and when the target security audit result includes an approval change result, a target change execution instruction corresponding to the target resource change request is sent to the server, so that the server responds to the target change execution instruction and executes the target resource change operation corresponding to the target resource change request, thereby using a cloud native access mechanism so that all resource change requests of the cloud native platform are intercepted for security audit evaluation before actual execution, and only when the target security audit result includes an approval change will the server be triggered to execute the corresponding resource change operation, thereby avoiding unaudited resource changes from being mistakenly or maliciously deployed to a server cluster of the cloud native platform, thereby improving the security of resource changes, and realizing centralized control of resource changes of the cloud native platform by setting an admission controller at the server level of the cloud native platform, thereby simplifying integration with other security platforms. Cloud native supports standardized interfaces, and there is no need to install additional middleware or agents to connect different systems, thereby reducing additional integration steps and possible errors, and reducing the difficulty of resource change management and maintenance of the cloud native platform.

[0106] Please refer to the following Figure 3 , which is a flowchart of another resource change method provided by an exemplary embodiment of this specification. Figure 3 As shown, the resource change method includes the following steps:

[0107] S302, intercepting a pending target resource change request in the cloud native platform.

[0108] Specifically, S302 is consistent with S202 and will not be repeated here.

[0109] S304, obtaining the target history change information of the target triggering user corresponding to the target resource change request.

[0110] Specifically, after intercepting the target resource change request to be processed in the cloud native platform, the admission controller can first obtain the target historical change information of the target trigger user corresponding to the above target resource change request, such as but not limited to the historical change request time, historical change request operation, historical change request number / frequency, etc.

[0111] S306, sending the target resource change request and the target historical change information to the security audit end, so that the security audit end performs a security audit on the target resource change request based on the target historical change information, and obtains a corresponding target security audit result.

[0112] Specifically, the admission controller can send the target resource change request and its corresponding target historical change information to the security audit end, so that the security audit end performs a security audit on the target resource change request based on the target historical change information, and obtains the corresponding target security audit result. For example, but not limited to, comparing the difference between the historical change request time, the historical change request operation and the request time corresponding to the target resource change request and the target resource change request operation, or judging whether the number / frequency of historical change requests is greater than the upper limit value. If the difference is too large, or the number / frequency of historical change requests is greater than the upper limit value, it means that the target resource change request has risks, and the change is rejected. Otherwise, the change is approved or a further security audit assessment is performed based on the specific content of the target resource change request operation.

[0113] S308, receiving the target security audit result returned by the security audit terminal.

[0114] Specifically, after the security audit end completes the corresponding security audit, the target security audit result obtained can be returned to the admission controller in the form of, but not limited to, HTTP response. The admission controller can receive the target security audit result returned by the security audit end.

[0115] S310, when the target security audit result includes an approved change result, sending a target change execution instruction corresponding to the target resource change request to the server, so that the server responds to the target change execution instruction and executes the target resource change operation corresponding to the target resource change request.

[0116] Specifically, S310 is consistent with S206 and will not be described in detail here.

[0117] In some possible embodiments, after the target change execution instruction corresponding to the target resource change request is sent to the server so that the server responds to the target change execution instruction and executes the target resource change operation corresponding to the target resource change request, the admission controller can also receive the target execution result corresponding to the target resource change operation returned by the server, and forward the target execution result to the user end of the target trigger user corresponding to the target resource change request.

[0118] Please continue to refer to Figure 3 ,like Figure 3 As shown, in the above S308, after receiving the target security audit result returned by the security audit terminal, the resource change method may also include but is not limited to:

[0119] S312: When the target security audit result includes a change rejection result, the target resource change request is terminated.

[0120] Specifically, when the target security audit result includes a rejection of the change result, it means that there is a security risk in the target resource change request. In this case, a target change abort instruction corresponding to the target resource change request can be sent to the server, so that the server responds to the target change abort instruction, aborts the target resource change request, and does not execute the target resource change operation corresponding to the target resource change request.

[0121] S314, returning the target security audit result to the user end.

[0122] Specifically, when the target security audit result includes a rejection of the change result, after the access controller terminates the target resource change request, it can also return the target security audit result to the user end of the target triggering user corresponding to the target resource change request, so that the target triggering user can promptly understand the processing status of the target resource change request triggered by it.

[0123] Furthermore, the target security audit result also includes rejection-related information corresponding to the rejection change result, and the rejection-related information includes at least one of the following: rejection reason, rejection change content. After obtaining the target security audit result, the admission controller can directly return the rejection change result and the corresponding rejection-related information to the user end, so that the user end adjusts the target resource change request based on the rejection-related information, sends the adjusted target resource change request to the server, and then re-executes the above S302, thereby improving the pass rate and efficiency of resource changes to a certain extent.

[0124] Please refer to the following Figure 4 , which is a schematic diagram of the overall implementation process of a resource change method provided by an exemplary embodiment of this specification. Figure 4 As shown, the resource change method includes the following steps:

[0125] 1. The user (user end) initiates a target resource change request to the API server of the cloud native platform through the cloud native platform interface or tool (such as kubectl) or other CI / CD tools. In the cloud native platform, the API server calls the configured admission controller to intercept the target resource change request before processing the resource change request.

[0126] 2. The admission controller forwards the target resource change request to the security audit platform (security audit end). The security audit platform receives the target resource change request and displays it in the security engineer's review queue.

[0127] 3. Security engineers can review on the security audit platform to assess whether the target resource change request complies with the organization's security policies and compliance requirements.

[0128] 4. After the security engineer completes the review, the change request is approved or rejected based on the evaluation results. The security audit platform generates the corresponding target security audit result and returns the security audit result to the admission controller in the form of an HTTP response.

[0129] 5. If the target resource change request is approved, the admission controller will send a signal to execute the operation (target change execution instruction) to the API server (execution node) of the cloud native platform; if the target resource change request is rejected, the admission controller will terminate the target resource change request and return the reason for rejection to the requesting user (user end), that is, enter step 7.

[0130] 6. After the admission controller sends a signal to execute the operation to the API server (execution node) of the cloud native platform, the cloud native platform executes the target resource change operation and returns the corresponding target execution result to the admission controller after the execution is completed.

[0131] 7. The user (client) can receive the target execution result returned by the admission controller, or a detailed description of the rejection of the target resource change request (such as the rejection reason, the rejected change content, etc.). If the target resource change request triggered by it is rejected, the user can adjust its target resource change request based on the rejection reason, rejected change content and other rejection-related information fed back, and re-initiate the process.

[0132] Please refer to the following Figure 5 , which is a schematic diagram of a resource change device provided by an exemplary embodiment of this specification. The resource change device is applied to an admission controller in a cloud native platform, the cloud native platform includes multiple servers, and the admission controller is built into the servers; Figure 5 As shown, the resource changing device 500 includes:

[0133] An interception module 510 is used to intercept target resource change requests to be processed in the above-mentioned cloud native platform;

[0134] The first acquisition module 520 is used to obtain the target security audit result obtained after the target resource change request has been security audited;

[0135] The sending module 530 is used to send the target change execution instruction corresponding to the target resource change request to the above-mentioned server when the above-mentioned target security audit result includes an approved change result, so that the above-mentioned server responds to the above-mentioned target change execution instruction and executes the target resource change operation corresponding to the above-mentioned target resource change request.

[0136] In a possible implementation, the interception module 510 is specifically used to:

[0137] The target resource change request to be processed in the above-mentioned cloud native platform is intercepted according to preset rules; the above-mentioned preset rules include user identity interception rules and / or change behavior interception rules.

[0138] In a possible implementation, the interception module 510 is specifically used to:

[0139] If the target triggering user corresponding to the target resource change request is not a non-intercepting user, intercept the target resource change request; the non-intercepting user is used to represent a user who can directly change resources on the cloud native platform without security audit; and / or

[0140] When the target resource change operation corresponding to the target resource change request to be processed in the above-mentioned cloud native platform includes a risk change operation, the above-mentioned target resource change request is intercepted; the above-mentioned risk change operation includes at least one of the following: create operation, delete operation, and modify operation.

[0141] In a possible implementation, the first acquisition module 520 includes:

[0142] A first sending unit is used to forward the target resource change request to a security audit terminal, so that the security audit terminal performs a security audit based on the target resource change request to obtain a corresponding target security audit result;

[0143] The receiving unit is used to receive the target security audit result returned by the security audit terminal.

[0144] In a possible implementation, the resource changing device 500 further includes:

[0145] The second acquisition module is used to obtain the target history change information of the target triggering user corresponding to the target resource change request;

[0146] The first acquisition module 510 includes:

[0147] A second sending unit is used to send the target resource change request and the target historical change information to the security audit end, so that the security audit end performs a security audit on the target resource change request based on the target historical change information to obtain a corresponding target security audit result;

[0148] The receiving unit is used to receive the target security audit result returned by the security audit terminal.

[0149] In a possible implementation, the resource changing device 500 further includes:

[0150] A change termination module, used to terminate the target resource change request when the target security audit result includes a change rejection result;

[0151] The return module is used to return the above-mentioned target security audit result to the user end of the target triggering user corresponding to the above-mentioned target resource change request.

[0152] In a possible implementation, the target security audit result further includes rejection-related information corresponding to the rejection change result; the rejection-related information includes at least one of the following: rejection reason, rejection change content;

[0153] The above-mentioned return module is specifically used to: return the above-mentioned rejection change result and the corresponding above-mentioned rejection related information to the user end of the target trigger user corresponding to the above-mentioned target resource change request, so that the above-mentioned user end adjusts the above-mentioned target resource change request based on the above-mentioned rejection related information, and sends the adjusted above-mentioned target resource change request to the above-mentioned server.

[0154] In a possible implementation, the resource changing device 500 further includes:

[0155] A receiving module, used for receiving the target execution result corresponding to the target resource change operation returned by the server;

[0156] The forwarding module is used to forward the above target execution result to the user end of the target triggering user corresponding to the above target resource change request.

[0157] The division of the modules in the above-mentioned resource change device is only for illustration. In other embodiments, the resource change device can be divided into different modules as needed to complete all or part of the functions of the above-mentioned resource change device. The implementation of each module in the resource change device provided in the embodiments of this specification can be in the form of a computer program. The computer program can be run on an admission controller or a server. The program modules constituted by the computer program can be stored in the memory of the admission controller or the server. When the computer program is executed by the processor, all or part of the steps of the resource change method described in the embodiments of this specification are implemented.

[0158] See next Figure 6 , which is a schematic diagram of the structure of an electronic device provided by an exemplary embodiment of this specification. Figure 6 As shown, the electronic device 600 may include: at least one processor 610, at least one communication bus 620, a user interface 630, at least one network interface 640, and a memory 650. The communication bus 620 may be used to realize the connection and communication of the above components.

[0159] The user interface 630 may include a display screen (Display) and a camera (Camera), and the optional user interface may also include a standard wired interface and a wireless interface.

[0160] Among them, the network interface 640 may optionally include a Bluetooth module, a near field communication (NFC) module, a wireless fidelity (Wi-Fi) module, etc.

[0161] The processor 610 may include one or more processing cores. The processor 610 uses various interfaces and lines to connect various parts of the entire electronic device 600, and executes various functions and processes data of the routing electronic device 600 by running or executing instructions, programs, code sets or instruction sets stored in the memory 650, and calling data stored in the memory 650. Optionally, the processor 610 can be implemented in at least one hardware form of digital signal processing (DSP), field programmable gate array (FPGA), and programmable logic array (PLA). The processor 610 can integrate one or a combination of a processor (Central Processing Unit, CPU), a graphics processor (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; and the modem is used to process wireless communication. It is understandable that the above-mentioned modem may not be integrated into the processor 610, but may be implemented by a separate chip.

[0162] The memory 650 may include a random access memory (RAM) or a read-only memory (ROM). Optionally, the memory 650 includes a non-transitory computer-readable medium. The memory 650 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 650 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as an interception function, a resource change function, a forwarding function, etc.), instructions for implementing the above-mentioned method embodiments, etc.; the data storage area may store data involved in the above-mentioned method embodiments, etc. The memory 650 may optionally be at least one storage device located away from the aforementioned processor 610. As Figure 6 As shown, the memory 650 as a computer storage medium may include an operating system, a network communication module, a user interface module, and an application program.

[0163] In some possible embodiments, the electronic device 600 is the resource changing device mentioned in the above embodiments, and the processor 610 can be used to call the application stored in the memory 650, and specifically perform the following operations:

[0164] Intercept pending target resource change requests in the cloud native platform; obtain target security audit results after the target resource change requests have undergone security audits; and when the target security audit results include approved change results, send target change execution instructions corresponding to the target resource change requests to the server, so that the server responds to the target change execution instructions and executes the target resource change operation corresponding to the target resource change request.

[0165] In some possible embodiments, when the processor 610 executes the interception of the pending target resource change request in the cloud native platform, it is specifically configured to execute:

[0166] The target resource change request to be processed in the above-mentioned cloud native platform is intercepted according to preset rules; the above-mentioned preset rules include user identity interception rules and / or change behavior interception rules.

[0167] In some possible embodiments, when the processor 610 executes the above-mentioned interception of the target resource change request to be processed in the cloud native platform according to the preset rule, it is specifically used to execute:

[0168] When the target trigger user corresponding to the target resource change request to be processed in the above-mentioned cloud native platform does not belong to a non-intercepting user, the above-mentioned target resource change request is intercepted; the above-mentioned non-intercepting user is used to represent users who can directly make resource changes to the above-mentioned cloud native platform without security review; and / or, when the target resource change operation corresponding to the target resource change request to be processed in the above-mentioned cloud native platform includes a risk change operation, the above-mentioned target resource change request is intercepted; the above-mentioned risk change operation includes at least one of the following: create operation, delete operation, and modify operation.

[0169] In some possible embodiments, when the processor 610 executes the above-mentioned acquisition of the target security audit result obtained after the security audit of the target resource change request, it is specifically used to execute:

[0170] The target resource change request is forwarded to the security audit end, so that the security audit end performs a security audit based on the target resource change request to obtain a corresponding target security audit result; and the target security audit result returned by the security audit end is received.

[0171] In some possible embodiments, after the processor 610 executes the interception of the target resource change request to be processed in the cloud native platform, and after obtaining the target security audit result obtained after the security audit of the target resource change request, it is further used to execute:

[0172] Obtain the target historical change information of the target triggering user corresponding to the target resource change request.

[0173] When the processor 610 executes the step of obtaining the target security audit result obtained after the target resource change request has been security audited, the processor 610 is specifically configured to execute:

[0174] The target resource change request and the target historical change information are sent to the security audit end, so that the security audit end performs a security audit on the target resource change request based on the target historical change information to obtain the corresponding target security audit result; and the target security audit result returned by the security audit end is received.

[0175] In some possible embodiments, after executing the above-mentioned acquisition of the target security audit result obtained after the above-mentioned target resource change request has been security audited, the above-mentioned processor 610 is further used to execute:

[0176] In the case where the target security audit result includes a rejection of the change result, the target resource change request is terminated; and the target security audit result is returned to the user end of the target triggering user corresponding to the target resource change request.

[0177] In some possible embodiments, the target security audit result further includes rejection-related information corresponding to the rejection change result; the rejection-related information includes at least one of the following: rejection reason, rejection change content;

[0178] When the processor 610 returns the target security audit result to the user end of the target triggering user corresponding to the target resource change request, it is specifically used to execute:

[0179] The above-mentioned rejection change result and the corresponding rejection related information are returned to the user end of the target trigger user corresponding to the above-mentioned target resource change request, so that the above-mentioned user end adjusts the above-mentioned target resource change request based on the above-mentioned rejection related information, and sends the adjusted above-mentioned target resource change request to the above-mentioned server.

[0180] In some possible embodiments, after the processor 610 executes the target change execution instruction corresponding to the target resource change request to send to the server, so that the server responds to the target change execution instruction and executes the target resource change operation corresponding to the target resource change request, it is further configured to execute:

[0181] Receive the target execution result corresponding to the target resource change operation returned by the server; forward the target execution result to the user end of the target triggering user corresponding to the target resource change request.

[0182] The embodiments of this specification also provide a computer-readable storage medium, which stores instructions, and when the instructions are executed on a computer or a processor, the computer or the processor executes one or more steps in the above embodiments. If the components of the resource change device are implemented in the form of software functional units and sold or used as independent products, they can be stored in the computer-readable storage medium.

[0183] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The above computer program product includes one or more computer instructions. When the above computer program instructions are loaded and executed on a computer, the above process or function according to the embodiment of this specification is generated in whole or in part. The above computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable device. The above computer instructions can be stored in a computer-readable storage medium or transmitted by the above computer-readable storage medium. The above computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) mode. The above computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that contains one or more available media integrated. The above-mentioned available media can be magnetic media (for example, floppy disks, hard disks, tapes), optical media (for example, digital versatile disks (DVD)), or semiconductor media (for example, solid-state drives (SSD)), etc.

[0184] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other media that can store program codes. In the absence of conflict, the technical features in this embodiment and the implementation scheme can be combined arbitrarily.

[0185] The embodiments described above are merely preferred embodiments of this specification and are not intended to limit the scope of this specification. Without departing from the design spirit of this specification, various modifications and improvements made to the technical solutions of this specification by ordinary technicians in this field should fall within the scope of protection determined by the claims.

[0186] The above is a description of a specific embodiment of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims and the specification can be performed in an order different from that in the embodiment recorded in the specification and still achieve the desired results. In addition, the process depicted in the drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Claims

1. A resource change method, the method being applied to an admission controller in a cloud native platform, the cloud native platform comprising a plurality of servers; the method comprising: Intercepting pending target resource change requests in the cloud native platform; Obtaining a target security audit result obtained after the target resource change request has undergone security audit; In the case where the target security audit result includes an approved change result, a target change execution instruction corresponding to the target resource change request is sent to the server, so that the server responds to the target change execution instruction and executes the target resource change operation corresponding to the target resource change request.

2. The method according to claim 1, wherein intercepting the pending target resource change request in the cloud native platform comprises: Intercepting pending target resource change requests in the cloud native platform according to preset rules; The preset rules include user identity interception rules and / or change behavior interception rules.

3. The method of claim 2, wherein intercepting the pending target resource change request in the cloud native platform according to a preset rule comprises: If a target triggering user corresponding to the target resource change request to be processed in the cloud native platform does not belong to a non-intercepting user, intercepting the target resource change request; The non-intercepted users are used to represent users who can directly change resources on the cloud native platform without security audit; and / or When the target resource change operation corresponding to the target resource change request to be processed in the cloud native platform includes a risk change operation, the target resource change request is intercepted; the risk change operation includes at least one of the following: a create operation, a delete operation, and a modify operation.

4. The method according to claim 1, wherein obtaining the target security audit result obtained after the target resource change request has undergone security audit comprises: Forwarding the target resource change request to a security audit terminal, so that the security audit terminal performs a security audit based on the target resource change request to obtain a corresponding target security audit result; Receive the target security audit result returned by the security audit terminal.

5. The method according to claim 1, after intercepting the pending target resource change request in the cloud native platform, after obtaining the target security audit result obtained after the target resource change request has undergone security audit, the method further comprises: Obtaining target history change information of the target triggering user corresponding to the target resource change request; The obtaining of the target security audit result obtained after the target resource change request has been security audited includes: Sending the target resource change request and the target historical change information to the security audit end, so that the security audit end performs a security audit on the target resource change request based on the target historical change information to obtain a corresponding target security audit result; Receive the target security audit result returned by the security audit terminal.

6. The method according to claim 1, after obtaining the target security audit result obtained after the target resource change request has been subjected to security audit, the method further comprises: If the target security audit result includes a change rejection result, terminating the target resource change request; The target security audit result is returned to the user end of the target triggering user corresponding to the target resource change request.

7. The method according to claim 6, wherein the target security audit result further includes rejection-related information corresponding to the rejection change result; the rejection-related information includes at least one of the following: rejection reason, rejection change content; The step of returning the target security audit result to the user terminal of the target triggering user corresponding to the target resource change request includes: The rejection change result and the corresponding rejection related information are returned to the user end of the target trigger user corresponding to the target resource change request, so that the user end adjusts the target resource change request based on the rejection related information, and sends the adjusted target resource change request to the server.

8. The method according to claim 1, after sending the target change execution instruction corresponding to the target resource change request to the server so that the server executes the target resource change operation corresponding to the target resource change request in response to the target change execution instruction, the method further comprises: Receiving a target execution result corresponding to the target resource change operation returned by the server; The target execution result is forwarded to the user end of the target triggering user corresponding to the target resource change request.

9. A resource change device, the resource change device is applied to an admission controller in a cloud native platform, the cloud native platform includes multiple servers; The resource changing device comprises: An interception module, used to intercept pending target resource change requests in the cloud native platform; A first acquisition module is used to obtain a target security audit result obtained after the target resource change request has undergone a security audit; A sending module is used to send a target change execution instruction corresponding to the target resource change request to the server when the target security audit result includes an approved change result, so that the server responds to the target change execution instruction and executes the target resource change operation corresponding to the target resource change request.

10. An electronic device comprising: Processor and memory; The processor is connected to the memory; The memory is used to store executable program code; The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method according to any one of claims 1 to 8.

11. A computer storage medium storing a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the method steps according to any one of claims 1 to 8.

12. A computer program product comprising instructions, which, when executed on a computer or a processor, enables the computer or the processor to execute the resource changing method according to any one of claims 1 to 8.

Images