Container cloud cluster operation execution method and device and electronic equipment

Abstract

The invention relates to the technical field of computers, in particular to an operation execution method and device of a container cloud cluster and electronic equipment. The method comprises the following steps: receiving an operation request sent by a current client under the condition of determining that a target container establishes communication connection with the current client; wherein the operation request is used for indicating the target container to execute specified operation; and when the current client has the permission to instruct the target container to execute the specified operation, instructing the target container to execute the specified operation.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a method, device and electronic device for executing operations of a container cloud cluster. Background Art

[0002] In a cloud platform cluster environment, such as a container cloud cluster based on Kubernetes, if you need to access a service, you need to access it through the virtual Internet Protocol (IP) and port provided by the Service resource. Then, in the container cloud cluster of Kubernetes, it is forwarded to the corresponding Pod according to the specified forwarding rules, and the association between the Service and the Pod depends on the label specified in the Service for maintenance. Therefore, the Pod is the one who is truly responsible for providing work in the container cloud cluster of Kubernetes. In daily work, you often need to log in to the environment where the service is located to check logs or debug programs. When checking logs or debugging programs, users will inevitably perform dangerous operations due to misoperation, causing service crashes or even damage to company assets.

[0003] Therefore, how to reduce the probability of service crash has become an urgent problem to be solved. Summary of the invention

[0004] In order to solve the above technical problems, the present disclosure provides a method, device and electronic device for executing operations of a container cloud cluster.

[0005] The technical solution of the present disclosure is as follows:

[0006] In a first aspect, the present disclosure provides a container cloud cluster server, comprising: a processor, configured to, when determining that a target container has established a communication connection with a current client, control a communicator to receive an operation request sent by a current client; wherein the operation request is used to instruct the target container to perform a specified operation; the processor is further configured to instruct the target container to perform the specified operation when the current client has the authority to instruct the target container to perform the specified operation received by the communicator.

[0007] In a second aspect, the present disclosure provides an operation execution method of a container cloud cluster, comprising: receiving an operation request sent by the current client when it is determined that a target container has established a communication connection with the current client; wherein the operation request is used to instruct the target container to perform a specified operation; and when the current client has the authority to instruct the target container to perform the specified operation, instructing the target container to perform the specified operation.

[0008] In a third aspect, the present disclosure provides an electronic device, comprising: a memory and a processor, the memory being used to store a computer program; the processor being used to enable the electronic device to implement any one of the container cloud cluster operation execution methods provided in the first aspect when executing the computer program.

[0009] In a fourth aspect, the present disclosure provides a computer-readable storage medium, including: a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a computing device, the computing device implements any one of the container cloud cluster operation execution methods provided in the first aspect above.

[0010] In a fifth aspect, the present invention provides a computer program product. When the computer program product runs on a computer, it enables the computer to execute any one of the container cloud cluster operation execution methods provided in the first aspect.

[0011] It should be noted that the above-mentioned computer instructions may be stored in whole or in part on a first computer-readable storage medium. The first computer-readable storage medium may be packaged together with a processor of the operation execution device of the container cloud cluster, or may be packaged separately from the processor of the operation execution device of the container cloud cluster, and this disclosure does not limit this.

[0012] The description of the second, third, fourth and fifth aspects in the present disclosure can refer to the detailed description of the first aspect; and the beneficial effects of the description of the second, third, fourth and fifth aspects can refer to the beneficial effect analysis of the first aspect, which will not be repeated here.

[0013] In the present disclosure, the name of the operation execution device of the container cloud cluster does not limit the device or function module itself. In actual implementation, these devices or function modules may appear with other names. As long as the functions of each device or function module are similar to those of the present disclosure, they fall within the scope of the claims of the present disclosure and their equivalent technologies.

[0014] These and other aspects of the present disclosure will become more apparent from the following description.

[0015] Compared with the prior art, the technical solution provided by the present invention has the following advantages:

[0016] The operation execution method of the container cloud cluster provided by the present invention receives an operation request sent by the current client when it is determined that the target container has established a communication connection with the current client; wherein the operation request is used to instruct the target container to perform a specified operation. By determining whether the current client has the authority to instruct the target container to perform the specified operation, it is possible to avoid the user being able to directly execute the target operation when checking logs or debugging programs. Instead, when the current client has the authority to instruct the target container to perform the specified operation, the target container is instructed to perform the specified operation. When the current client does not have the authority to instruct the target container to perform the specified operation, the target container is not instructed to perform the specified operation, which reduces the number of service crashes, thereby reducing the probability of service crashes, and solving the problem of how to reduce the probability of service crashes. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0019] Figure 1 One of the scenario diagrams of the method for executing the operation of the container cloud cluster provided in the embodiment of the present application;

[0020] Figure 2 A schematic diagram of the structure of a server in the method for executing the operation of a container cloud cluster provided in an embodiment of the present application;

[0021] Figure 3 One of the flowcharts of the method for executing the operation of the container cloud cluster provided in the embodiment of the present application;

[0022] Figure 4 A second scenario diagram of the method for executing the operation of a container cloud cluster provided in an embodiment of the present application;

[0023] Figure 5 A second flowchart of the method for executing the operation of the container cloud cluster provided in an embodiment of the present application;

[0024] Figure 6 A third flowchart of the method for executing the operation of the container cloud cluster provided in an embodiment of the present application;

[0025] Figure 7 A fourth flowchart of the method for executing the operation of a container cloud cluster provided in an embodiment of the present application;

[0026] Figure 8 A fifth flowchart of the method for executing the operation of the container cloud cluster provided in an embodiment of the present application;

[0027] Fig. 9 A schematic diagram of the structure of a container cloud cluster server provided in an embodiment of the present application;

[0028] Fig.10 A schematic diagram of a chip system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0030] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0031] The display device provided in the embodiments of the present application may have various implementation forms, for example, it may be a television, a smart TV, a laser projection device, a monitor, an electronic whiteboard, an electronic table, etc. Figure 1 and Figure 2 This is a specific implementation of the display device of the present application.

[0032] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0033] In some feasible examples, the Pod in the embodiments of the present disclosure is the smallest basic unit of deployment and management in a Kubernetes cluster, with collaborative addressing and collaborative scheduling.

[0034] In some feasible examples, Kubernetes in the embodiments of the present disclosure is referred to as K8s, which is an abbreviation formed by replacing the eight characters "ubernete" in the middle of the name with 8. It is an open source containerized application for managing multiple hosts in a cloud platform. The goal of Kubernetes is to make the deployment of containerized applications simple and powerful. Kubernetes provides a mechanism for application deployment, planning, updating, and maintenance.

[0035] In some feasible examples, Kubelet in the embodiments of the present disclosure is an important component in the Kubernetes cluster, which runs on each node and is responsible for managing containers and Pods on the node.

[0036] In some feasible examples, the Kube-Apiserver in the embodiments of the present disclosure is one of the core components in the Kubernetes architecture. It acts as the front end of the Kubernetes API, handles all requests from the Kubernetes API, and forwards them to other components for processing.

[0037] In some feasible examples, the CRI in the embodiments of the present disclosure defines the service interfaces of the container and the image. Because the container runtime and the image lifecycle are isolated from each other, it is necessary to define two services.

[0038] Figure 1 is a schematic diagram of an operation scenario between a display device and a control device according to one or more embodiments of the present application, such as Figure 1 As shown, the user can operate the display device 200 through the mobile terminal 300 and the control device 100. The control device 100 can be a remote controller, and the communication between the remote controller and the display device includes infrared protocol communication, Bluetooth protocol communication, wireless or other wired methods to control the display device 200. The user can input user instructions through buttons on the remote controller, voice input, control panel input, etc. to control the display device 200. In some embodiments, a mobile terminal, a tablet computer, a computer, a laptop computer, and other smart devices can also be used to control the display device 200.

[0039] In some embodiments, the container cloud cluster server provided by the embodiment of the present application may be the above-mentioned server 400. Wherein, when determining that the target container has established a communication connection with the current client, the server 400 receives an operation request sent by the current client; wherein the operation request is used to instruct the target container to perform a specified operation; when the current client has the authority to instruct the target container to perform the specified operation, the target container is instructed to perform the specified operation.

[0040] In some examples, the cloud cluster server of one or more embodiments is server 400, and the operating system of server 400 is Android system. Figure 2 As shown, the server 400 can be logically divided into an application layer (Applications) (referred to as "application layer") 21, an application framework layer (Application Framework) (referred to as "framework layer") 22, an Android runtime (Android runtime) and system library layer (referred to as "system runtime library layer") 23, and a kernel layer 24.

[0041] Among them, the application layer 21 includes one or more applications. The application can be a system application or a third-party application. The framework layer 22 provides an application programming interface (API) and a programming framework for the application of the application layer 21. The system runtime layer 23 provides support for the upper layer, namely the framework layer 22. When the framework layer 22 is used, the Android operating system will run the C / C++ library contained in the system runtime layer 23 to implement the functions to be implemented by the framework layer 22. The kernel layer 24 serves as a software middleware between the hardware layer and the application layer 21, and is used to manage and control hardware and software resources.

[0042] In some examples, when determining that a communication connection is established between the target container and the current client, the processing unit 201 of the server 400 controls the transceiver unit 202 to receive an operation request sent by the current client; the processing unit 201 of the server 400 has the authority to instruct the target container to execute the specified operation received by the transceiver unit 202 on the current client, and instructs the target container to execute the specified operation.

[0043] Specifically, the storage unit 203 of the server 400 is used to store data such as a computer program of the operation execution method of the container cloud cluster provided by the embodiment of the present disclosure.

[0044] In the following embodiments, the method of the embodiment of the present application is described by taking the server 400 as an example of an execution subject of the operation execution method of the container cloud cluster provided by the embodiment of the present disclosure.

[0045] The present application embodiment provides a method for executing operations of a container cloud cluster, such as Figure 3 As shown, the operation execution method of the container cloud cluster may include S11 and S12.

[0046] S11. When it is determined that a communication connection is established between the target container and the current client, an operation request sent by the current client is received; wherein the operation request is used to instruct the target container to perform a specified operation.

[0047] In some examples, the target container may be a Pod that the user needs to access.

[0048] S12: If the current client has the authority to instruct the target container to perform a specified operation, the target container is instructed to perform the specified operation.

[0049] In some examples, the container cloud cluster server is taken as a Kubernetes cluster, such as Figure 4 As shown in the figure, the Kubernetes cluster includes: client, access controller, Webhook-Controller, Kube-Apiserver, nodes and database. The nodes include target containers, Kubelet and CRI.

[0050] KubeAccessControllerWebhookController Among them, Access-Controller is responsible for establishing a websocket link between the target container and the client, first through the Access-Controller service, and then the Access-Controller service creates a websocket link with the client (although there is an extra layer in the middle, the client and the server are not aware of the intermediate proxy, which does not affect the communication between the client and the server. The intermediate proxy can be understood as a transparent transmission module). In this way, Access-Controller can obtain the input content of the client, and after obtaining the input content, it can send the information to Webhook-Controller. Webhook-Controller is a role-based access control (RBAC) module. The Webhook-Controller determines whether the current client has the permission to instruct the target container to perform the specified operation. If so, it can be executed normally. If not, it directly returns an error to Access-Controller, and then Access-Controller returns a client error, which increases the current user’s inability to execute the command.

[0051] For example, 1. When the client initiates a login terminal request for connecting to the target Pod, the client will establish a Hypertext Transfer Protocol (HTTP) request to Kube-Apiserver. The format of the uniform resource locator (URL) between the client and Kube-Apiserver is http[s]: / / ${api_server} / ns / ${pod_namespace} / pods / ${pod_name} / exec? stdin=true&stdout=true&stderr=true&tty=true&container=${container_name}&command=sh.

[0052] 2. After receiving the client's request, Kube-Apiserver finds the node and Kubelet address and port of the target Pod based on the request, and establishes a streaming proxy connection with Kubelet. The URL format between the Kube-Apiserver service and Kubelet is http[s]: / / ${node_ip}:${Kubelet_port} / exec / ${pod_namespace} / ${pod_name} / ${contai

[0053] ``

[0054] ner_name.

[0055] 3. After Kubelet receives the request from Kube-Apiserver, it forwards the request to the target Pod runtime. Kubelet will continue to proxy the input / output stream (I / O) between Kube-Apiserver and the target Pod runtime.

[0056] 4. The target Pod runtime eventually receives the request from Kubelet and takes the necessary steps to create and execute the process in the target Pod’s namespace and cgroup.

[0057] 5. At this point, the target Pod will establish a websocket connection with the client, and the Access-Controller will intercept the response and initiate a new websocket connection with the client. Therefore, the target Pod is directly connected to the Access-Controller, and the client is also directly connected to the Access-Controller.

[0058] 6. The input sent by the client to the target Pod will first pass through the Access-Controller, which will obtain the specified operation input by the client. The Access-Controller determines whether the current client has the permission to instruct the target container to perform the specified operation. If the permission is granted, the Access-Controller is returned with permission. If the permission is not granted, the Access-Controller is returned with no permission.

[0059] 7. After Access-Controller reads the return content of Webhook-Controller, if the query result returned is permission, it means that the current client has the permission to instruct the target container to perform the specified operation, then no interception is performed and the specified operation is sent to the target Pod. If the query result returned is no permission, it means that the current client does not have the permission to perform the specified operation, then the specified operation is intercepted and will not be sent to the target Pod, and a message is returned to the client indicating that the client does not have permission to perform the specified operation.

[0060] From the above, it can be seen that the present invention proposes an operation execution of a container cloud cluster, which implements a scheme for permission control of Pod terminal user operations based on RBAC (Role-Based Access Control), and implements permission control of user operations in a container scenario through this scheme.

[0061] In some possible implementation examples, combined with Figure 3 ,like Figure 5 As shown, the above S12 can be specifically implemented through the following S120 and S121.

[0062] S120: Perform a query based on the actual identification information of the current client to determine an operation set corresponding to the identification information.

[0063] In some examples, the actual identification information may be information that uniquely identifies the current client, such as one or more of a user account, a device identification code, and a Media Access Control Address (MAC address) of the current client.

[0064] In some examples, in order to facilitate understanding of the operations that each client can perform, a first relationship between the identification information of each client and the operations that can be performed is preconfigured in the server 400. Afterwards, when it is necessary to determine the operations that the client can perform, the first relationship can be queried based on the identification information of the client, thereby obtaining an operation set that the client can perform, and the operation set includes at least one operation.

[0065] S121. When there is a theoretical operation identical to the specified operation in the operation set, determine that the current client has the authority to instruct the target container to execute the specified operation, and instruct the target container to execute the specified operation.

[0066] In some examples, different executable operations are assigned to different clients to prevent unfamiliar users from mistakenly sending specified operations to the target container through the client, such as the operation set set for the client of a new employee includes at least one lookup operation. Therefore, when the new employee uses the client to perform a deletion operation, the server queries the first relationship based on the identification information of the client to determine the operation set corresponding to the client. Since there is no lookup operation identical to the deletion operation in the operation set corresponding to the client, it is determined that the client does not have the permission to perform the deletion operation, so that the server 400 will not execute the request sent by the client to instruct the target container to perform the deletion operation, thereby reducing the number of service crashes of the server 400 and thereby reducing the probability of service crashes. In some feasible examples, combined with Figure 3 ,like Figure 6 As shown, the above S12 can be specifically implemented through the following S122-S124.

[0067] S122: Obtain theoretical role information that can execute the specified operation.

[0068] In some examples, since different users have different proficiency in the operations that can be executed by the server 400, the container cloud cluster operation execution method provided by the embodiment of the present disclosure assigns different executable operations to each role information (such as newcomer, engineer, assistant engineer, etc.). Therefore, when the client executes the target container to perform a specified operation, it can be determined whether the client has the authority to perform the specified operation based on the actual role information of the client.

[0069] S123: Perform a query based on the actual identification information of the current client to determine the actual role information corresponding to the actual identification information.

[0070] In some examples, when the actual identification information is a device identification code or a MAC address, different role information is assigned to different clients, so that the client can control the target container to perform different operations. For example, when the role information set for a new employee's client is a new employee, and the executable theoretical role information of the specified operation sent by the client is an engineer, since the actual identification information of the current client (new employee) is different from the theoretical role information (engineer) that can execute the specified operation, it is determined that the current client does not have the authority to execute the specified operation, so that the server 400 will not execute the request sent by the client to instruct the target container to execute the specified operation, thereby reducing the number of service crashes of the server 400, and thereby reducing the probability of service crashes.

[0071] S124: When there is theoretical role information that is the same as the actual role information, determine that the current client has the authority to instruct the target container to perform the specified operation, and instruct the target container to perform the specified operation.

[0072] In some possible implementation examples, combined with Figure 3 ,like Figure 7 As shown, the above S12 can be specifically implemented through the following S125 and S126.

[0073] S125. Obtain container data of the target container.

[0074] S126: Perform an operation simulation based on the specified operation and container data. If the result of the operation simulation is executable, determine that the current client has the authority to instruct the target container to execute the specified operation, and instruct the target container to execute the specified operation.

[0075] In some examples, in order to avoid the user from performing dangerous operations due to misoperation when checking logs or debugging programs, causing service crashes or even causing damage to company assets, the operation execution method of the container cloud cluster provided by the embodiment of the present disclosure, when the client instructs the target container to perform a specified operation, performs a run simulation based on the container data of the target container and the specified operation that the target container needs to perform, so that the result of the run simulation can be obtained. When the result of the run simulation is not executable, it is determined that the current client does not have the authority to perform the specified operation, so that the server 400 will not execute the command sent by the client to instruct the target container to perform the specified operation, thereby reducing the number of service crashes on the server 400, and thereby reducing the probability of service crashes.

[0076] It should be noted that when the server 400 performs the operation simulation based on the container data of the target container and the specified operation that the target container needs to perform, it does not run directly on the target container, but the server 400 sends the container data of the target container and the specified operation that the target container needs to perform to the backup server. Among them, the backup server and the server 400 have the same data. In this way, the backup server can determine the backup container corresponding to the container data based on the container data of the target container sent by the server 400. Afterwards, the backup server controls the backup container to perform the specified operation, so as to obtain the result of the operation simulation.

[0077] In some examples, the specified operation and container data can be input into the running simulation model to run the simulation and obtain the result of the running simulation. The training process of the running simulation model is as follows:

[0078] The training sample data and the marking result of the training sample data are obtained, wherein the training sample data includes the operation result of executing the historical operation on the historical container data, and the marking result includes any one of executable and non-executable.

[0079] The training sample data is input into the neural network model for learning, and the prediction results of the neural network model for the training sample data are obtained.

[0080] The network parameters of the neural network model are adjusted based on the prediction results and the labeling results until the neural network model converges to obtain a running simulation model.

[0081] In some possible implementation examples, combined with Figure 3 ,like Figure 8 As shown, the above S12 can be specifically implemented through the following S127 and S128.

[0082] S127: Obtain theoretical identification information of historical clients that have executed the specified operation in the history of the target container.

[0083] S128. When there is theoretical identification information that is identical to the actual identification information of the current client, determine that the current client has the authority to instruct the target container to perform the specified operation, and instruct the target container to perform the specified operation.

[0084] In some examples, when the current client has the authority to instruct the target container to perform a specified operation and instructs the target container to perform the specified operation, the actual identification information of the current client can be obtained. When the actual role information is the target role information (such as engineer, assistant engineer, new employee, etc.), the container data of the target container is obtained. A running simulation is performed based on the specified operation and container data. When the result of the running simulation is executable, it is determined that the current client has the authority to instruct the target container to perform the specified operation, and the target container is instructed to perform the specified operation.

[0085] In some examples, the historical moment when the current client last instructed the target container to perform a specified operation (e.g., the historical moment when the user account currently logged in by the current client last instructed the target container to perform a specified operation) is obtained. The time difference between the current moment and the historical moment is calculated. When the time difference is greater than the time threshold, it is determined that the current client has the permission to instruct the target container to perform the specified operation, and the target container is instructed to perform the specified operation.

[0086] In some examples, the historical moment when the current client last instructed the target container to perform a specified operation is obtained, and the time difference between the current moment and the historical moment is calculated. If the time difference is greater than a time threshold, the container data of the target container is obtained. A running simulation is performed based on the specified operation and the container data. If the result of the running simulation is executable, it is determined that the current client has the permission to instruct the target container to perform the specified operation, and the target container is instructed to perform the specified operation.

[0087] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to realize the above functions, it includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.

[0088] The embodiment of the present application can divide the functional modules of the operation execution device of the container cloud cluster according to the above method example. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing unit. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0089] like Fig. 9 As shown, an embodiment of the present application provides a structural diagram of a server 400 , which includes a processor 101 and a communicator 102 .

[0090] The processor 101 is configured to, when it is determined that the target container has established a communication connection with the current client, control the communicator 102 to receive an operation request sent by the current client; wherein the operation request is used to instruct the target container to perform a specified operation; the processor 101 is also configured to instruct the target container to perform the specified operation when the current client has the authority to perform the specified operation received by the communicator 102.

[0091] In some feasible examples, the processor 101 is further configured to perform a query based on the actual identification information of the current client to determine the operation set corresponding to the identification information; the processor 101 is further configured to determine that the current client has the authority to instruct the target container to perform the specified operation when there is a theoretical operation that is the same as the specified operation in the operation set, and instruct the target container to perform the specified operation.

[0092] In some implementable examples, the processor 101 is further configured to control the communicator 102 to obtain theoretical role information that can execute the specified operation; the processor 101 is further configured to query based on the actual identification information of the current client to determine the actual role information corresponding to the actual identification information; the processor 101 is further configured to determine that the current client has the authority to instruct the target container to perform the specified operation when there is theoretical role information identical to the actual role information in the theoretical role information obtained by the communicator 102, and to instruct the target container to perform the specified operation.

[0093] In some implementable examples, the processor 101 is further configured to control the communicator 102 to obtain container data of the target container; the processor 101 is further configured to perform a running simulation based on the specified operation and the container data obtained by the communicator 102, and when the result of the running simulation is executable, it is determined that the current client has the authority to instruct the target container to perform the specified operation, and the target container is instructed to perform the specified operation.

[0094] In some feasible examples, the processor 101 is further configured to control the communicator 102 to obtain theoretical identification information of historical clients that have performed specified operations in the history of the target container; the processor 101 is further configured to determine that the current client has the authority to instruct the target container to perform the specified operation when there is theoretical identification information that is consistent with the actual identification information of the current client in the theoretical identification information obtained by the communicator 102, and to instruct the target container to perform the specified operation.

[0095] Among them, all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, and its role will not be repeated here.

[0096] Of course, the server 400 provided in the embodiment of the present application includes but is not limited to the above modules, for example, the server 400 may also include a memory 103. The memory 103 may be used to store the program code of the server 400, and may also be used to store data generated by the server 400 during operation, such as data in a write request.

[0097] As an example, combining Figure 2 The function implemented by the acquisition unit 202 in the server 400 is the same as the function of the communicator 102 , the function implemented by the processing unit 201 is the same as the function of the processor 101 , and the function implemented by the storage unit 203 is the same as the function of the memory 103 .

[0098] like Fig.10 As shown, an embodiment of the present application also provides a chip system, which can be applied to the server 400 in the aforementioned embodiment. The chip system includes at least one processor 1501 and at least one interface circuit 1502. The processor 1501 can be the processor in the above-mentioned server 400. The processor 1501 and the interface circuit 1502 can be interconnected through a line. The processor 1501 can receive and execute computer instructions from the memory of the above-mentioned server 400 through the interface circuit 1502. When the computer instructions are executed by the processor 1501, the server 400 can execute the various steps performed by the server 400 in the above-mentioned embodiment. Of course, the chip system can also include other discrete devices, which is not specifically limited in the embodiment of the present application.

[0099] The embodiment of the present application also provides a computer-readable storage medium for storing computer instructions executed by the above-mentioned server 400.

[0100] The embodiment of the present application also provides a computer program product, including computer instructions executed by the above-mentioned server 400.

[0101] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A container cloud cluster server, characterized in that: include: The processor is configured to control the communicator to receive an operation request sent by the current client when it is determined that the target container has established a communication connection with the current client; wherein the operation request is used to instruct the target container to perform a specified operation; The processor is further configured to instruct the target container to execute the specified operation received by the communicator when the current client has the authority to instruct the target container to execute the specified operation.

2. The container cloud cluster server according to claim 1, characterized in that: The processor is further configured to query based on the actual identification information of the current client to determine an operation set corresponding to the identification information; The processor is further configured to determine that the current client has the authority to instruct the target container to execute the specified operation when there is a theoretical operation identical to the specified operation in the operation set, and to instruct the target container to execute the specified operation.

3. The container cloud cluster server according to claim 1, characterized in that: The processor is further configured to control the communicator to obtain theoretical role information that can perform the specified operation; The processor is further configured to query based on the actual identification information of the current client to determine the actual role information corresponding to the actual identification information; The processor is further configured to determine that the current client has the authority to instruct the target container to perform the specified operation, and instruct the target container to perform the specified operation when there is theoretical role information identical to the actual role information in the theoretical role information obtained by the communicator.

4. The container cloud cluster server according to claim 1, characterized in that: The processor is further configured to control the communicator to obtain container data of the target container; The processor is further configured to perform an operation simulation based on the specified operation and the container data obtained by the communicator, and if a result of the operation simulation is executable, determine that the current client has permission to instruct the target container to perform the specified operation, and instruct the target container to perform the specified operation.

5. The container cloud cluster server according to claim 1, characterized in that: The processor is further configured to control the communicator to obtain theoretical identification information of a historical client that executes the specified operation in the history of the target container; The processor is further configured to determine that the current client has the authority to instruct the target container to perform the specified operation when there is theoretical identification information that is consistent with the actual identification information of the current client in the theoretical identification information obtained by the communicator, and to instruct the target container to perform the specified operation.

6. A method for executing operations of a container cloud cluster, characterized in that: include: In the case of determining that the target container has established a communication connection with the current client, receiving an operation request sent by the current client; wherein the operation request is used to instruct the target container to perform a specified operation; The current client has the authority to instruct the target container to execute the specified operation, and instructs the target container to execute the specified operation.

7. The method for executing operations of a container cloud cluster according to claim 6, characterized in that: The step of instructing the target container to execute the specified operation when the current client has the authority to execute the specified operation includes: Performing a query based on the actual identification information of the current client to determine an operation set corresponding to the identification information; When there is a theoretical operation identical to the specified operation in the operation set, it is determined that the current client has the authority to instruct the target container to execute the specified operation, and the target container is instructed to execute the specified operation.

8. The method for executing operations of a container cloud cluster according to claim 6, characterized in that: The step of instructing the target container to execute the specified operation when the current client has the authority to execute the specified operation includes: Obtaining theoretical role information that can perform the specified operation; Performing a query based on the actual identification information of the current client to determine the actual role information corresponding to the actual identification information; In the case that there is theoretical role information that is the same as the actual role information, it is determined that the current client has the authority to instruct the target container to perform the specified operation, and the target container is instructed to perform the specified operation.

9. The method for executing operations of a container cloud cluster according to claim 6, characterized in that: The step of instructing the target container to execute the specified operation when the current client has the authority to execute the specified operation includes: Obtaining container data of the target container; An operation simulation is performed based on the specified operation and the container data. When a result of the operation simulation is executable, it is determined that the current client has permission to instruct the target container to execute the specified operation, and the target container is instructed to execute the specified operation.

10. The method for executing operations of a container cloud cluster according to claim 6, characterized in that: The step of instructing the target container to execute the specified operation when the current client has the authority to execute the specified operation includes: Obtain theoretical identification information of a historical client that has executed the specified operation in the history of the target container; When there is theoretical identification information that is identical to the actual identification information of the current client, it is determined that the current client has the authority to instruct the target container to perform the specified operation, and the target container is instructed to perform the specified operation.

Images