Cloud native container mirror image pre-distribution method and device and storage medium

Abstract

The invention discloses a cloud native container mirror image pre-distribution method and device and a storage medium, and the method comprises the steps: constructing a container mirror image, and pushing the constructed container mirror image to a central warehouse; judging whether container mirror image pre-distribution needs to be carried out or not according to the business logic of the service item to which the container mirror image belongs; and if the judgment result is yes, the container mirror image is pulled from the central warehouse to the slave mirror image warehouse corresponding to each region for caching, and if the judgment result is no, the container mirror image is stored in the central warehouse. The method for pre-distributing the cloud native container mirror image is based on the master-slave architecture mirror image warehouse, can be applied to multi-region, multi-cloud and cross-border container mirror image warehouse cluster products, and has important significance in improving the container mirror image distribution efficiency and saving the network bandwidth and the storage resource cost.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and specifically provides a method, device and storage medium for pre-distributing cloud native container images. Background Art

[0002] With the rapid development of large-scale AI model applications, the construction and deployment of large-scale model applications on cloud computing infrastructure is becoming more and more common. The rapid growth of the parameter magnitude of large models has caused the model files of large-scale model applications to become larger and larger, which poses a challenge to the traditional container image distribution. A container image is a lightweight, executable software package that contains everything needed to run a container - code, runtime environment, libraries, environment variables, and configuration files. The concept of container images is the core part of container technology, which enables containers to run in a consistent manner in different environments without being affected by the host environment. Under the traditional image repository solution, it takes hours or even days to build a container image of hundreds of GB in size, from continuous integration (CI) to continuous deployment (CD), which greatly restricts the iteration efficiency of applications.

[0003] In the current container image repository solution in the industry, container images are stored in a central repository and distributed uniformly by the central repository. The efficiency of image distribution for large model applications is insufficient, especially in a multi-regional and multi-cloud environment. The problem of insufficient distribution efficiency is particularly significant.

[0004] The existing application number is 202311292392.9, and the name is a Chinese invention patent application for a preheating and pulling method and device for image files. The application provides a preheating and pulling method and device for image files, wherein the preheating and pulling method for image files includes: receiving a container image preheating instruction, wherein the container image preheating instruction carries resource configuration information; determining at least one container cluster identifier according to the resource configuration information, and generating image preheating configuration information corresponding to each container cluster identifier; sending each image preheating configuration information to the business container cluster corresponding to each container cluster identifier, so that each business container cluster preheats and pulls the container image file based on the image preheating configuration information. By determining the image preheating configuration information corresponding to each container cluster identifier by the container control cluster, and then sending it to the corresponding business container cluster, the distribution efficiency of the image preheating configuration information is improved; and the container control cluster is used to simultaneously send the preheating and pulling task of the image file to multiple business container clusters, thereby improving the preheating and pulling efficiency of the container image file by the business container cluster. Although the above patent realizes the preheating distribution of images and improves the preheating pulling efficiency of container image files by the business container cluster, it is necessary to preheat the image files and preheat the images according to the container image preheating instructions, and the configuration process is relatively complicated.

[0005] In view of this, the present invention patent is proposed. Summary of the invention

[0006] In response to the above technical problems, the present invention proposes a method, device and storage medium for pre-distributing cloud-native container images, and provides an automatic triggering container image preheating distribution mechanism, which can greatly improve the speed of container image downloading after preheating distribution, thereby improving the distribution efficiency.

[0007] Specifically, the following technical solutions are adopted:

[0008] In a first aspect, the present invention provides a method for pre-distributing a cloud native container image, comprising:

[0009] Build container images and push the built container images to the central warehouse;

[0010] Determine whether container image pre-distribution is required based on the business logic of the service project to which the container image belongs;

[0011] If the judgment is yes, the container image is pulled from the central warehouse to the corresponding image warehouse in each region for caching. If the judgment is no, the container image is saved in the central warehouse.

[0012] As an optional implementation of the present invention, in a cloud native container image pre-distribution method of the present invention, judging whether container image pre-distribution is required according to the business logic of the service project to which the container image belongs includes:

[0013] Get the project name of the service project based on the container image, and get the name of the service it contains based on the project name;

[0014] Get the service topology based on the service name, and then get the region where the service is to be deployed based on the service topology.

[0015] Whether container images need to be pre-distributed is determined by determining whether the services of the service project to which the container image belongs are deployed in the same region.

[0016] As an optional implementation of the present invention, in a cloud native container image pre-distribution method of the present invention, if the judgment is yes, pulling the container image from the central warehouse to the corresponding image warehouse in each region for caching includes:

[0017] According to the service topology, the region where the service is to be deployed is obtained, and the container image is pulled from the central warehouse and cached in the object storage of the slave image warehouse corresponding to each region to be deployed.

[0018] As an optional implementation of the present invention, in a cloud native container image pre-distribution method of the present invention, judging whether container image pre-distribution is required according to the business logic of the service project to which the container image belongs includes:

[0019] Get the project name of the service project based on the container image, and get the name of the service it contains based on the project name;

[0020] Get the configuration information of the service according to the service name;

[0021] Whether container image pre-distribution is required is determined by determining whether service configuration information of the service project to which the container image belongs contains a container image pre-distribution instruction.

[0022] As an optional implementation of the present invention, in a cloud native container image pre-distribution method of the present invention, if the judgment is yes, pulling the container image from the central warehouse to the corresponding image warehouse in each region for caching includes:

[0023] Obtain the pre-distribution target region or pre-distribution target cluster of the container image according to the container image pre-distribution instruction in the service configuration information;

[0024] According to the container image pre-distribution instructions in the service configuration information, the container image is pulled from the central warehouse and cached in the secondary image warehouse of the pre-distribution target region, or in the secondary image warehouse of the pre-distribution target cluster.

[0025] As an optional implementation manner of the present invention, a method for pre-distributing a cloud-native container image of the present invention includes:

[0026] After the service project to which the container image belongs is deployed;

[0027] The cluster to which the service for pre-distribution of container images belongs downloads the container image from the image repository corresponding to the region to which the cluster belongs;

[0028] The cluster to which the service belongs that does not pre-distribute the container image downloads the container image from the central warehouse.

[0029] As an optional implementation manner of the present invention, a method for pre-distributing a cloud-native container image of the present invention includes:

[0030] In the continuous integration (CI) phase of software development, the container image is built, and after the container image is built, it is determined whether the container image needs to be pre-distributed. If so, the container image pre-distribution is automatically triggered;

[0031] During the continuous deployment (CD) phase of software development, the cluster to which the container image is pre-distributed belongs downloads the container image from the image repository corresponding to the region to which the cluster belongs, and the cluster to which the container image is not pre-distributed belongs downloads the container image from the central repository.

[0032] In a second aspect, the present invention provides a cloud native container image pre-distribution device, comprising:

[0033] Container image building module, builds container images;

[0034] A central repository for receiving and storing built container images;

[0035] The container image pre-distribution module determines whether the container image needs to be pre-distributed according to the business logic of the service project to which the container image belongs. If the judgment result is yes, the container image is pre-distributed; if the judgment result is no, the container image is stored in the central warehouse;

[0036] From the image repository, deployed in various regions, when pre-distributing container images, the pre-distributed container images corresponding to each region are pulled from the image repository by the central repository for caching.

[0037] In a third aspect, the present invention provides an electronic device comprising a processor and a memory, wherein the memory is used to store a computer executable program, and when the computer program is executed by the processor, the processor executes the method for pre-distributing a cloud-native container image.

[0038] In a fourth aspect, the present invention provides a computer-readable recording medium storing a computer-executable program, which, when executed, implements the method for pre-distributing a cloud-native container image.

[0039] Compared with the prior art, the present invention has the following beneficial effects:

[0040] The present invention provides a cloud-native container image pre-distribution method. In a multi-region, multi-cloud environment, a master-multiple slave image warehouse architecture of a central warehouse and slave image warehouses located in each region is adopted. The central warehouse serves as a central data source. After the container image is built, a preheating distribution mechanism is automatically triggered. The container image is preheated and distributed on demand in other clouds or other regions. After the preheating distribution, each cloud cluster can download it from the slave image warehouse in its region, which can greatly improve the speed of container image downloading, thereby improving the distribution efficiency. In addition, the traffic pressure of the central warehouse can be dispersed without accessing the central warehouse.

[0041] In addition, a cloud-native container image pre-distribution method of the present invention determines whether container image pre-distribution is needed according to the business logic of the service project to which the container image belongs after the container image is built, thereby automatically triggering the preheating distribution mechanism without the need for complex configuration.

[0042] Therefore, the cloud-native container image pre-distribution method of the present invention, based on the master-slave architecture image repository, can be applied to multi-regional, multi-cloud, and cross-border container image repository cluster products. As the first solution proposed on the market, this solution is of great significance to improving the efficiency of container image distribution and saving network bandwidth and storage resource costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 A flowchart of a method for pre-distributing cloud-native container images according to a first embodiment of the present invention;

[0044] Figure 2 A diagram of a one-master-multiple-slave image repository architecture according to Embodiment 1 of the present invention;

[0045] Figure 3 A specific example flow chart of a method for pre-distributing cloud-native container images according to the first embodiment of the present invention;

[0046] Figure 4 An encryption flow chart of a container image encryption and decryption method according to a second embodiment of the present invention;

[0047] Figure 5 A decryption flow chart of a container image encryption and decryption method according to a second embodiment of the present invention;

[0048] Figure 6 An example diagram of the encryption and decryption process of a container image encryption and decryption method according to the second embodiment of the present invention;

[0049] Figure 7 A schematic diagram of key management of a key management service module in a container image encryption and decryption device according to a second embodiment of the present invention;

[0050] Figure 8 A schematic diagram of the structure of an electronic device according to a third embodiment of the present invention;

[0051] Fig. 9 A schematic diagram of a computer-readable recording medium according to a third embodiment of the present invention. DETAILED DESCRIPTION

[0052] To make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be described clearly and completely in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them.

[0053] Therefore, the following detailed description of the embodiments of the present invention is not intended to limit the scope of the invention claimed for protection, but merely represents some embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features and technical solutions in the embodiments may be combined with each other.

[0055] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0056] In the description of the present invention, it should be noted that the orientation or positional relationship indicated by the terms "upper", "lower", etc. is based on the orientation or positional relationship shown in the drawings, or the orientation or positional relationship in which the invention product is usually placed when in use, or the orientation or positional relationship commonly understood by those skilled in the art. Such terms are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0057] Embodiment 1

[0058] See also Figure 1 As shown, this embodiment provides a method for pre-distributing a cloud native container image, including:

[0059] Build container images and push the built container images to the central warehouse;

[0060] Determine whether container image pre-distribution is required based on the business logic of the service project to which the container image belongs;

[0061] If the judgment is yes, the container image is pulled from the central warehouse to the corresponding image warehouse in each region for caching. If the judgment is no, the container image is saved in the central warehouse.

[0062] This embodiment provides a method for pre-distributing cloud native container images. In a multi-region, multi-cloud environment, a master-slave image repository architecture is adopted, which includes a central repository and slave image repositories located in various regions. For details, see Figure 2As shown in the figure, the central warehouse serves as the central data source. After the container image is built, the preheating distribution mechanism is automatically triggered to preheat and distribute the container image on demand in other clouds or other regions. After preheating and distribution, each cloud cluster can download it from the image warehouse in its region, which can greatly improve the speed of container image downloading, thereby improving the distribution efficiency. In addition, the traffic pressure of the central warehouse can be dispersed without accessing the central warehouse.

[0063] In addition, a cloud-native container image pre-distribution method of this embodiment determines whether container image pre-distribution is needed according to the business logic of the service project to which the container image belongs after the container image is built, thereby automatically triggering the preheating distribution mechanism without the need for complex configuration.

[0064] Therefore, a cloud-native container image pre-distribution method of this embodiment, based on a master-slave architecture image repository, can be applied to multi-regional, multi-cloud, and cross-border container image repository cluster products. As the first solution proposed on the market, this solution is of great significance for improving the efficiency of container image distribution and saving network bandwidth and storage resource costs.

[0065] As an optional implementation of this embodiment, in a cloud native container image pre-distribution method of this embodiment, judging whether container image pre-distribution is required according to the business logic of the service project to which the container image belongs includes:

[0066] Get the project name of the service project based on the container image, and get the name of the service it contains based on the project name;

[0067] Get the service topology based on the service name, and then get the region where the service is to be deployed based on the service topology.

[0068] Whether container images need to be pre-distributed is determined by determining whether the services of the service project to which the container image belongs are deployed in the same region.

[0069] A cloud-native container image pre-distribution method of this embodiment, in order to realize automatic triggering of container image pre-heating distribution, obtains the corresponding service project after the container image is built, and judges whether the related services in the service project are deployed in the same region.

[0070] Specifically, when the services of the service project to which the container image belongs are deployed in different regions, the preheating distribution of the container image is automatically triggered. When the services of the service project to which the container image belongs are deployed in the same region, the preheating distribution of the container image is not triggered. In addition, this embodiment can obtain the region where the service is to be deployed through the service topology. The service topology is the basic information of each service project and can be obtained without configuration.

[0071] Further, in a cloud native container image pre-distribution method of this embodiment, if the judgment is yes, pulling the container image from the central warehouse to the corresponding image warehouse in each region for caching includes:

[0072] According to the service topology, the region where the service is to be deployed is obtained, and the container image is pulled from the central warehouse and cached in the object storage of the slave image warehouse corresponding to each region to be deployed.

[0073] As an optional implementation of this embodiment, in a cloud native container image pre-distribution method of this embodiment, judging whether container image pre-distribution is required according to the business logic of the service project to which the container image belongs includes:

[0074] Get the project name of the service project based on the container image, and get the name of the service it contains based on the project name;

[0075] Get the configuration information of the service according to the service name;

[0076] Whether container image pre-distribution is required is determined by determining whether service configuration information of the service project to which the container image belongs contains a container image pre-distribution instruction.

[0077] A cloud-native container image pre-distribution method of this embodiment can also automatically trigger the pre-heating distribution of the container image through the container image pre-distribution instruction in the service configuration information.

[0078] Further, in a cloud native container image pre-distribution method of this embodiment, if the judgment is yes, pulling the container image from the central warehouse to the corresponding image warehouse in each region for caching includes:

[0079] Obtain the pre-distribution target region or pre-distribution target cluster of the container image according to the container image pre-distribution instruction in the service configuration information;

[0080] According to the container image pre-distribution instructions in the service configuration information, the container image is pulled from the central warehouse and cached in the secondary image warehouse of the pre-distribution target region, or in the secondary image warehouse of the pre-distribution target cluster.

[0081] A cloud-native container image pre-distribution method of the present embodiment, when the pre-heating distribution of the container image is automatically triggered by the container image pre-distribution instruction in the service configuration information, the container image will be pre-heated and distributed to the slave image repository of the target region or target cluster according to the container image pre-distribution instruction, thereby improving the container image distribution efficiency and meeting the service project's requirements for pre-heating distribution of the container image.

[0082] A cloud-native container image pre-distribution method of this embodiment includes:

[0083] After the service project to which the container image belongs is deployed;

[0084] The cluster to which the service for pre-distribution of container images belongs downloads the container image from the image repository corresponding to the region to which the cluster belongs;

[0085] The cluster to which the service belongs that does not pre-distribute the container image downloads the container image from the central warehouse.

[0086] A cloud-native container image pre-distribution method of this embodiment automatically pre-distributes container images to slave image repositories in various regions. In this way, clusters in various regions can directly download container images from the slave image repositories in their corresponding regions for deployment, greatly improving the efficiency of container image distribution.

[0087] As an optional implementation of this embodiment, a cloud native container image pre-distribution method of this embodiment includes:

[0088] In the continuous integration (CI) phase of software development, the container image is built, and after the container image is built, it is determined whether the container image needs to be pre-distributed. If so, the container image pre-distribution is automatically triggered;

[0089] During the continuous deployment (CD) phase of software development, the cluster to which the container image is pre-distributed belongs downloads the container image from the image repository corresponding to the region to which the cluster belongs, and the cluster to which the container image is not pre-distributed belongs downloads the container image from the central repository.

[0090] Specifically, see Figure 3 As shown, a cloud native container image pre-distribution method of this embodiment includes:

[0091] Step S1. In the continuous deployment (CI) process of software development, build the container image and push it to the central warehouse.

[0092] Step S2: Perform logical judgment, combined with actual business logic, to determine whether the container image needs to be preheated. If preheating is required, start the preheating instruction and enter step S3. If preheating is not required, end.

[0093] Step S3: Pull the container image from the central repository.

[0094] Step S4: Send the pulled container image to the object storage for caching.

[0095] Step S5. In the continuous deployment (CD) phase of software development, when each cluster pulls the container image, it downloads it from the object storage of the image warehouse in the local domain without accessing the central warehouse, which can disperse the traffic pressure of the central warehouse. In addition, obtaining it from the image warehouse in the local domain can greatly improve the speed of pulling the container image.

[0096] In this embodiment, CI / CD is the abbreviation of Continuous Integration and Continuous Deployment, which are two important components of modern software development practice, aiming to improve the efficiency and quality of software development. CI generally refers to the software construction process, and CD generally refers to the software deployment process.

[0097] The cluster in this embodiment selects the widely used K8s cluster.

[0098] This embodiment also provides a cloud native container image pre-distribution device, including:

[0099] Container image building module, builds container images;

[0100] A central repository for receiving and storing built container images;

[0101] The container image pre-distribution module determines whether the container image needs to be pre-distributed according to the business logic of the service project to which the container image belongs. If the judgment result is yes, the container image is pre-distributed; if the judgment result is no, the container image is stored in the central warehouse;

[0102] From the image repository, deployed in various regions, when pre-distributing container images, the pre-distributed container images corresponding to each region are pulled from the image repository by the central repository for caching.

[0103] This embodiment provides a cloud native container image pre-distribution device. In a multi-region, multi-cloud environment, a master-multiple slave image warehouse architecture is adopted, which includes a central warehouse and slave image warehouses located in various regions. For details, see Figure 2 As shown in the figure, the central warehouse serves as the central data source. After the container image construction module completes the construction of the container image, the preheating distribution mechanism of the container image pre-distribution module is automatically triggered to preheat and distribute the container image on demand in other clouds or other regions. After preheating and distribution, each cloud cluster can download it from the image warehouse in its region, which can greatly improve the speed of container image downloading, thereby improving the distribution efficiency. In addition, the traffic pressure of the central warehouse can be dispersed without accessing the central warehouse.

[0104] In addition, in a cloud-native container image pre-distribution device of the present embodiment, after the container image construction module completes the construction of the container image, the container image pre-distribution module determines whether the container image needs to be pre-distributed according to the business logic of the service project to which the container image belongs, thereby realizing automatic triggering of the preheating distribution mechanism without the need for complex configuration.

[0105] Therefore, a cloud-native container image pre-distribution device in this embodiment, based on a master-slave architecture image repository, can be applied to multi-regional, multi-cloud, and cross-border container image repository cluster products, which is of great significance for improving container image distribution efficiency and saving network bandwidth and storage resource costs.

[0106] Embodiment 2

[0107] The container image of this embodiment is stored in the object storage of the image warehouse. Under the traditional image warehouse solution, the layer files of the container image are transparent and visible. Any party that obtains the container image layer file can read the content. With the cross-border and cross-regional deployment of large model services, the security risks brought by the model with the distribution of container images also increase. Therefore, the current container image warehouse solution in the industry has deficiencies in the security of container images, especially in a multi-regional and multi-cloud environment, the problem of container image security is particularly significant.

[0108] In view of this, a cloud native container image pre-distribution method of this embodiment encrypts and decrypts the container image when storing the container image object. Figure 4 As shown, the encryption process specifically includes:

[0109] Encrypt container images layer by layer;

[0110] Obtaining the amount of data stored in the layer file to be encrypted, and determining whether the amount of data stored in the layer file to be encrypted is greater than a preset data amount threshold;

[0111] If the judgment result is yes, the first encryption method is used to encrypt the storage data of the to-be-encrypted layer file; if the judgment result is no, the second encryption method is used to encrypt the storage data of the to-be-encrypted layer file.

[0112] In a cloud-native container image pre-distribution method of this embodiment, the encryption process encrypts the layer file (layer) of the container image layer by layer to ensure the data security of the layer file (layer) of the container image. In addition, during the data encryption process, the corresponding encryption method is selected according to the amount of data stored in the layer file (layer) of the data to be encrypted to ensure efficient and reliable data encryption. Therefore, after the layer file (layer) data of the container image is encrypted by the encryption process of this embodiment, even if the container image is leaked, the unauthorized third party cannot use it after obtaining the container image, which greatly improves the security of the container image.

[0113] Therefore, a cloud-native container image pre-distribution method of this embodiment, when performing object storage of container images, an encryption scheme for the layer files of container images can be applied to multi-regional, multi-cloud, and cross-border container image repositories and container cluster products. As the first scheme proposed on the market, this scheme is of great significance to improving the security of container images.

[0114] Furthermore, the step of encrypting the stored data of the to-be-encrypted layer file by using the first encryption method comprises:

[0115] Extracting the stored data in the designated area of ​​the to-be-encrypted layer file as target encrypted data, wherein the data volume of the target encrypted data is a preset encrypted data value, and the preset encrypted data value is less than or equal to a preset data volume threshold;

[0116] The first encryption algorithm is used to encrypt the target encrypted data.

[0117] Specifically, in this embodiment, the designated area of ​​the file to be encrypted that is extracted may be the header or tail data of the file to be encrypted, so that the encrypted data can be obtained from the designated area for decryption.

[0118] Specifically, the step of encrypting the target encrypted data using the first encryption algorithm includes:

[0119] Encrypt the first N bytes of the target encrypted data to obtain the ciphertext length area, which is used to indicate the length of the encrypted ciphertext, where N is a set value;

[0120] Encrypting the stored data after the ciphertext length area of ​​the target encrypted data to obtain the ciphertext area;

[0121] After the target encrypted data is encrypted, the original source data is retained after removing the ciphertext length area and the ciphertext area to obtain a remaining source data area.

[0122] Correspondingly, the storage data of the to-be-encrypted layer file is encrypted using the second encryption method, including:

[0123] A second encryption algorithm is used to encrypt all stored data of the to-be-encrypted layer file. The second encryption algorithm is the same as or different from the first encryption algorithm.

[0124] In the encryption process of this embodiment, for the to-be-encrypted layer file with a small amount of data, all the data in the to-be-encrypted layer file is encrypted using the second encryption algorithm.

[0125] Furthermore, the step of encrypting all stored data of the to-be-encrypted layer file using a second encryption algorithm comprises:

[0126] The second encryption algorithm, which is the same as the first encryption algorithm, is used to encrypt all the stored data of the file in the to-be-encrypted layer;

[0127] Encrypt the first N bytes of all the stored data of the file to be encrypted to obtain the ciphertext length area, which is used to indicate the length of the encrypted ciphertext, where N is a set value;

[0128] The remaining data in the to-be-encrypted layer file excluding the ciphertext length area is encrypted to obtain the ciphertext area.

[0129] Specifically, the first encryption algorithm and the second encryption algorithm of this embodiment both use the AES algorithm, or other encryption algorithms except the AES algorithm, or one of the first encryption algorithm and the second encryption algorithm uses the AES algorithm, and the other uses other encryption algorithms.

[0130] At the same time, a cloud native container image pre-distribution method of this embodiment is described in detail in Figure 5 As shown in the figure, when the cluster client pulls the container image, it decrypts the container image layer by layer;

[0131] Read the stored data in the ciphertext length area of ​​the to-be-decrypted layer file to obtain the ciphertext length N;

[0132] According to the ciphertext length N, read the encrypted data stored in the N-byte ciphertext area after the ciphertext length area in the layer file to be decrypted, and use the decryption private key issued by the image repository to decrypt and obtain the decrypted data;

[0133] After the decryption of the ciphertext area of ​​the to-be-decrypted layer file is completed, if there is a remaining source data area after removing the ciphertext length area and the ciphertext area in the to-be-decrypted layer file, the decrypted data of the ciphertext area and the remaining source data of the remaining source data area are combined to obtain the complete decrypted data of the to-be-decrypted layer file; if there is no remaining source data area after removing the ciphertext length area and the ciphertext area in the to-be-decrypted layer file, the decrypted data of the ciphertext area is the complete decrypted data of the to-be-decrypted layer file.

[0134] As a specific implementation of this embodiment, see Figure 6 As shown, a container image encryption and decryption method of this embodiment has the following detailed process:

[0135] In the continuous integration (CI) process, the container image is built and pushed to the image repository.

[0136] The image repository obtains the AES key pair. For layer files larger than 4MB (the preset data volume threshold), the data of the 4MB (specified area) of the layer header is extracted for encryption. The first 8 bytes (N bytes) of the encrypted data represent the length of the ciphertext, followed by the ciphertext, and then the remaining data. For layer files smaller than 4MB (the preset data volume threshold), the entire layer file is encrypted. Similarly, the first 8 bytes represent the length of the ciphertext, followed by the ciphertext, and there is no remaining data.

[0137] Upload the encrypted layer files to object storage for caching and distribution.

[0138] When the cluster client pulls the image, each layer file obtained is encrypted data and needs to be decrypted before it can be read and used. The decryption process is: first read the first 8 bytes (N bytes) of the file to get the length L of the ciphertext, then read L bytes, use the AES private key issued in advance to decrypt, and combine the decrypted content with the remaining data to obtain a readable and usable layer file.

[0139] This embodiment also provides a container image encryption and decryption device, including an encryption module, which performs layer-by-layer encryption on the container image;

[0140] The encryption module obtains the amount of data stored in the data layer file to be encrypted, and determines whether the amount of data stored in the data layer file to be encrypted is greater than a preset data amount threshold. If the judgment result is yes, the first encryption method is used to encrypt the storage data of the file to be encrypted. If the judgment result is no, the second encryption method is used to encrypt the storage data of the file to be encrypted.

[0141] In the container image encryption and decryption device of the present embodiment, the encryption module encrypts the layer files of the container image layer by layer to ensure the data security of the layer files of the container image. In addition, during the data encryption process, the encryption module selects the corresponding encryption method according to the amount of data stored in the layer files to be encrypted to ensure efficient and reliable data encryption. Therefore, after the layer files of the container image are encrypted by the container image encryption and decryption device of the present embodiment, even if the container image is leaked, the unauthorized third party cannot use the container image after obtaining it, which greatly improves the security of the container image.

[0142] Therefore, a container image encryption and decryption device of this embodiment, an encryption solution for layer files of container images, can be applied to multi-regional, multi-cloud, and cross-border container image repositories and container cluster products. As the first solution proposed on the market, this solution is of great significance to improving the security of container images.

[0143] A container image encryption and decryption device of this embodiment includes a decryption module. When a cluster client pulls a container image, the decryption module decrypts the container image layer by layer.

[0144] The decryption module reads the stored data in the ciphertext length area of ​​the to-be-decrypted layer file to obtain the ciphertext length N;

[0145] The decryption module reads the encrypted data stored in the N-byte ciphertext area after the ciphertext length area in the to-be-decrypted layer file according to the ciphertext length N, and decrypts it using the decryption private key issued by the image repository to obtain the decrypted data;

[0146] After the decryption module completes the decryption of the ciphertext area of ​​the to-be-decrypted layer file, if there is a remaining source data area after the ciphertext length area and the ciphertext area are removed from the to-be-decrypted layer file, the decrypted data of the ciphertext area and the remaining source data of the remaining source data area are combined to obtain the complete decrypted data of the to-be-decrypted layer file; if there is no remaining source data area after the ciphertext length area and the ciphertext area are removed from the to-be-decrypted layer file, the decrypted data of the ciphertext area is the complete decrypted data of the to-be-decrypted layer file.

[0147] The encryption and decryption device of a container image in this embodiment includes a key management service module KMS, see Figure 7 As shown, the key management service module KMS provides an encryption public key for container image encryption to the image repository, and sends a decryption private key for container image decryption to the cluster client.

[0148] Embodiment 2

[0149] The following describes an electronic device embodiment of the present invention, which can be regarded as a specific physical implementation of the method and device embodiments of the present invention. The details described in the electronic device embodiment of the present invention should be regarded as a supplement to the above method or device embodiments; details not disclosed in the electronic device embodiment of the present invention can be implemented with reference to the above method or device embodiments.

[0150] Figure 8 It is a structural diagram of an electronic device of an embodiment of the present invention, which includes a processor and a memory, wherein the memory is used to store a computer executable program, and when the computer program is executed by the processor, the processor executes a cloud native container image pre-distribution method of embodiment one.

[0151] like Figure 8As shown, the electronic device is presented in the form of a general computing device. The processor may be one or more and work in coordination. The present invention does not exclude distributed processing, that is, the processor may be dispersed in different physical devices. The electronic device of the present invention is not limited to a single entity, but may also be the sum of multiple physical devices.

[0152] The memory stores a computer executable program, which is usually a machine-readable code. The computer-readable program can be executed by the processor to enable the electronic device to perform the method of the present invention, or at least part of the steps in the method.

[0153] The memory includes a volatile memory, such as a random access memory unit (RAM) and / or a cache memory unit, and may also be a non-volatile memory, such as a read-only memory unit (ROM).

[0154] Optionally, in this embodiment, the electronic device further includes an I / O interface, which is used for the electronic device to exchange data with an external device. The I / O interface can represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of a variety of bus structures.

[0155] It should be understood that Figure 8 The electronic device shown is only an example of the present invention, and the electronic device of the present invention may also include elements or components not shown in the above examples. For example, some electronic devices also include display units such as display screens, and some electronic devices also include human-computer interaction elements such as buttons, keyboards, etc. As long as the electronic device can execute the computer-readable program in the memory to implement the method of the present invention or at least part of the steps of the method, it can be considered as an electronic device covered by the present invention.

[0156] Fig. 9 Schematic diagram of a computer readable recording medium according to an embodiment of the present invention. Fig. 9As shown, a computer executable program is stored in a computer-readable recording medium, and when the computer executable program is executed, a method for pre-distributing a cloud native container image according to the first embodiment of the present invention is implemented. The computer-readable recording medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable recording medium may also be any readable medium other than a readable recording medium, which may send, propagate, or transmit a program for use by or in combination with an instruction execution system, apparatus, or device. The program code contained on the readable recording medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0157] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0158] Through the above description of the implementation mode, it is easy for those skilled in the art to understand that the present invention can be implemented by hardware capable of executing a specific computer program, such as the system of the present invention, and the electronic processing unit, server, client, mobile phone, control unit, processor, etc. contained in the system. The present invention can also be implemented by computer software that executes the method of the present invention, such as control software executed by a microprocessor, an electronic control unit, a client, a server, etc. However, it should be noted that the computer software that executes the method of the present invention is not limited to being executed by one or a specific hardware entity, and it can also be implemented in a distributed manner by unspecified specific hardware. For computer software, the software product can be stored in a computer-readable recording medium (which can be a CD-ROM, a USB flash drive, a mobile disk, etc.), and can also be distributed and stored on the network, as long as it enables the electronic device to execute the method according to the present invention.

[0159] The above embodiments are only used to illustrate the present invention and are not intended to limit the technical solutions described in the present invention. Although the present invention has been described in detail with reference to the above embodiments, the present invention is not limited to the above specific implementation methods. Therefore, any modification or equivalent replacement of the present invention; and all technical solutions and improvements thereof that do not depart from the spirit and scope of the invention are included in the scope of the claims of the present invention.

Claims

1. A method for pre-distributing cloud native container images, characterized in that: include: Build container images and push the built container images to the central warehouse; Determine whether container image pre-distribution is required based on the business logic of the service project to which the container image belongs; If the judgment is yes, the container image is pulled from the central warehouse to the corresponding image warehouse in each region for caching. If the judgment is no, the container image is saved in the central warehouse.

2. A cloud native container image pre-distribution method according to claim 1, characterized in that: The determining whether to pre-distribute the container image according to the business logic of the service project to which the container image belongs includes: Get the project name of the service project based on the container image, and get the name of the service it contains based on the project name; Get the service topology based on the service name, and then get the region where the service is to be deployed based on the service topology. Whether container images need to be pre-distributed is determined by determining whether the services of the service project to which the container image belongs are deployed in the same region.

3. A cloud native container image pre-distribution method according to claim 2, characterized in that: If the answer is yes, the container image is pulled from the central repository to the corresponding image repository in each region for caching, including: According to the service topology, the region where the service is to be deployed is obtained, and the container image is pulled from the central warehouse and cached in the object storage of the slave image warehouse corresponding to each region to be deployed.

4. The method for pre-distributing cloud native container images according to claim 1, characterized in that: The determining whether to pre-distribute the container image according to the business logic of the service project to which the container image belongs includes: Get the project name of the service project based on the container image, and get the name of the service it contains based on the project name; Get the configuration information of the service according to the service name; Whether container image pre-distribution is required is determined by determining whether service configuration information of the service project to which the container image belongs contains a container image pre-distribution instruction.

5. A cloud native container image pre-distribution method according to claim 4, characterized in that: If the answer is yes, the container image is pulled from the central repository to the corresponding image repository in each region for caching, including: Obtain the pre-distribution target region or pre-distribution target cluster of the container image according to the container image pre-distribution instruction in the service configuration information; According to the container image pre-distribution instructions in the service configuration information, the container image is pulled from the central warehouse and cached in the secondary image warehouse of the pre-distribution target region, or in the secondary image warehouse of the pre-distribution target cluster.

6. A method for pre-distributing cloud native container images according to any one of claims 1 to 5, characterized in that: include: After the service project to which the container image belongs is deployed; The cluster to which the service for pre-distribution of container images belongs downloads the container image from the image repository corresponding to the region to which the cluster belongs; The cluster to which the service belongs that does not pre-distribute the container image downloads the container image from the central warehouse.

7. A cloud native container image pre-distribution method according to claim 6, characterized in that: include: In the continuous integration (CI) phase of software development, the container image is built, and after the container image is built, it is determined whether the container image needs to be pre-distributed. If so, the container image pre-distribution is automatically triggered; During the continuous deployment (CD) phase of software development, the cluster to which the container image is pre-distributed belongs downloads the container image from the image repository corresponding to the region to which the cluster belongs, and the cluster to which the container image is not pre-distributed belongs downloads the container image from the central repository.

8. A cloud native container image pre-distribution device, characterized in that: include: Container image building module, builds container images; A central repository for receiving and storing built container images; The container image pre-distribution module determines whether the container image needs to be pre-distributed according to the business logic of the service project to which the container image belongs. If the judgment result is yes, the container image is pre-distributed; if the judgment result is no, the container image is stored in the central warehouse; From the image repository, deployed in various regions, when pre-distributing container images, the pre-distributed container images corresponding to each region are pulled from the image repository by the central repository for caching.

9. An electronic device comprising a processor and a memory, wherein the memory is used to store a computer executable program, characterized in that: When the computer program is executed by the processor, the processor executes a cloud-native container image pre-distribution method as described in any one of claims 1 to 7.

10. A computer-readable recording medium storing a computer-executable program, characterized in that: When the computer executable program is executed, a cloud-native container image pre-distribution method as described in any one of claims 1 to 7 is implemented.

Images