Cross-account resource calling method based on cloud computing technology and related equipment

Abstract

The invention provides a cross-account resource calling method based on a cloud computing technology and related equipment. The method is applied to a cloud management system. The cloud management system is used for managing an infrastructure provided with a first service of a first tenant and a second service of a second tenant. The cloud management system obtains an authorization request of a first tenant; the authorization request comprises a tenant identifier of the second tenant, an authorization name and a specific permission of calling the first service by the second service, and creating the specific permission based on the authorization request. And the cloud management system obtains an authority obtaining request which is input by the second tenant and comprises the authorization name and the tenant identifier of the first tenant, and configures the second tenant to obtain the specific authority according to the authority obtaining request. And when the second tenant configures the second service to call the first service, allowing the second service to call the first service according to the specific authority. In this way, the security degree of service scheduling in a cross-service and cross-account scene can be improved, and the efficiency of authority configuration and the utilization rate of resources are improved.

Description

[0001] This application claims the priority of the Chinese patent application filed with the State Intellectual Property Office on July 31, 2023, with application number 202310952497.6 and invention name “Integration method for multiple services across accounts”, the entire contents of which are incorporated by reference in this application. Technical Field

[0002] The present application relates to the field of cloud service technology, and in particular to a cross-account resource calling method and related equipment based on cloud computing technology. Background Art

[0003] In the cloud service scenario, some cloud service platforms provide specific types of resource sharing services. When other services need to use this type of resources when processing business, they use a cross-service approach to call this type of resources. For example, big data services can use container cluster resources provided by container services in a cross-service approach. In this way, multiple services can make full use of specific types of resources provided by the cloud service platform through time division multiplexing.

[0004] Users of cloud services manage and use resources through accounts. Accounts are independent of each other. The resources owned by different accounts are isolated from each other. If a user needs to use resources of other accounts across accounts, authorization from other accounts is required.

[0005] Currently, in the scenario of cross-service and cross-account service resource calls, the authorizing account provides the authorized account with the credential information required to log in to the authorizing account, such as account password, certificate, password, etc. The authorized account uses the credential information to call resources as the authorizing account. However, there are security risks in providing the credential information of the account to other accounts, which may lead to security issues such as other accounts abusing the credential information. Summary of the invention

[0006] The present application provides a cross-account resource calling method and related equipment based on cloud computing technology, which aims to achieve authorization of resource usage permissions across accounts and services with a high degree of security through the authorization name and the tenant identifier of the first tenant, and meet the needs of service resource usage in cross-service and cross-account scenarios.

[0007] In the first aspect, the present application provides a cross-account resource calling method based on cloud computing technology. The method is applied to a cloud management system. The cloud management system is used to manage infrastructure. A first service of a first tenant and a second service of a second tenant are set on the infrastructure. The cloud management system obtains an authorization request input by the first tenant. The authorization request includes the tenant identifier of the second tenant, the authorization name, and the specific authority of the second service to call the first service. The cloud management system creates a specific authority based on the obtained authorization request. The cloud management system obtains the authorization request input by the second tenant, including the authorization name and the tenant identifier of the first tenant, and configures the second tenant to obtain specific permissions according to the authorization request. In this way, the tenant identifier and authorization name of the first tenant can be used to obtain cross-service permissions, without the first tenant revealing the account password, certificate, password and other credential information of the first tenant to the outside, thereby improving the security of cross-account and cross-service calling services. Based on the specific authority, the cloud management system allows the second service to call the first service when the second tenant configures the second service to call the first service. On the basis of realizing a relatively safe cross-service and cross-account calling service, it is convenient to configure services across services and accounts, and improve the utilization rate of services.

[0008] In one possible implementation, the second tenant includes at least one user. After obtaining the authorization request, the cloud management system configures the second service to create at least one second sub-service corresponding to the at least one user and configures the first service to create at least one first sub-service corresponding to the at least one user. When the user configures the second service to call the first service, at least one second sub-service is allowed to call the corresponding at least one first sub-service. In this way, the second sub-service corresponding to the user can call the first sub-service corresponding to the user. In this way, the authorization of specific permissions in the user dimension can be implemented, avoiding the abuse of permissions by users included in the tenant, configuring the call to the first sub-service corresponding to other users, and effectively avoiding security issues caused by abuse of permissions.

[0009] In a possible implementation, the first service is a container service.

[0010] In one possible implementation, the specific permission includes container resource permission. The container resource permission corresponds to the container user. The container resource permission is the permission to use the indicated container resource. In this way, the second tenant can call the container service.

[0011] In a possible implementation, the authorization request input by the second tenant also includes the credential information of the second tenant. According to the credential information, the second tenant is configured to switch its identity to the first tenant so that the second tenant obtains specific permissions. In this way, the identity of the second user can be verified based on the credential information of the second tenant, thereby improving the security of calling the service resources of the first service across accounts and services.

[0012] In a second aspect, the present application provides a cross-account resource calling device based on cloud computing technology, characterized in that the device is applied to a cloud management system, the cloud management system is used to manage infrastructure, a first service of a first tenant and a second service of a second tenant are set on the infrastructure, and the device includes:

[0013] A first acquisition module is used to acquire an authorization request input by the first tenant, where the authorization request includes a tenant identifier of the second tenant, an authorization name, and a specific permission for the second service to call the first service;

[0014] A creation module, used to create the specific permission based on the authorization request;

[0015] A second acquisition module is used to acquire an authorization request input by the second tenant, where the authorization request includes the authorization name and the tenant identifier of the first tenant;

[0016] A first configuration module, configured to configure the second tenant to obtain the specific permission according to the authorization request;

[0017] The second configuration module is used to allow the second service to call the first service when the second tenant configures the second service to call the first service according to the specific permission.

[0018] In a possible implementation manner, the second tenant includes at least one user, and the device further includes:

[0019] a third configuration module, configured to configure the second service to create at least one second sub-service corresponding to the at least one user, and configure the first service to create at least one first sub-service corresponding to the at least one user, according to the authorization request;

[0020] The second configuration module is specifically configured to allow the at least one second sub-service to call the corresponding at least one first sub-service when the at least one user configures the second service to call the first service according to the specific permission.

[0021] In a possible implementation manner, the first service is a container service.

[0022] In a possible implementation manner, the specific permission includes container resource permission, the container resource permission corresponds to a container user, and the container resource permission is permission to use the container resource.

[0023] In a possible implementation, the authorization request includes credential information of the second tenant, and the first configuration module is specifically used to configure the second tenant to switch identity to the first tenant according to the credential information, so that the second tenant obtains the specific authority.

[0024] In a third aspect, the present application provides a computing device cluster, the computing device cluster includes at least one computing device, each computing device includes a processor and a memory; the memory is used to store instructions, and when the computing device cluster is running, the processor in each computing device executes the instructions stored in the memory, so that the computing device cluster executes the cross-account resource calling method based on cloud computing technology in the above-mentioned first aspect or any possible implementation of the first aspect. It should be noted that the memory can be integrated into the processor or can be independent of the processor. Each computing device may also include a bus. The processor is connected to the memory via a bus. The memory may include a readable memory and a random access memory.

[0025] In a fourth aspect, the present application provides a computer-readable storage medium, which stores instructions. When the computer-readable storage medium is run on a computing device cluster (the computing device cluster includes at least one computing device), the computing device cluster executes the cross-account resource calling method based on cloud computing technology as described in the above-mentioned first aspect or any one of the implementation methods of the first aspect.

[0026] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when run on a computing device cluster (the computing device cluster includes at least one computing device), enables the computing device cluster to execute the cross-account resource calling method based on cloud computing technology as described in the above-mentioned first aspect or any one of the implementations of the first aspect.

[0027] Based on the implementations provided in the above aspects, this application can also be further combined to provide more implementations. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A schematic diagram of a scenario provided for an embodiment of the present application;

[0029] Figure 2 A schematic diagram of an application scenario provided for an embodiment of the present application;

[0030] Figure 3 A schematic diagram of a cross-account resource calling method based on cloud computing technology provided in an embodiment of the present application;

[0031] Figure 4 A flowchart of another cross-account resource calling method based on cloud computing technology provided in an embodiment of the present application;

[0032] Figure 5 A schematic diagram of a cross-account resource calling method based on cloud computing technology provided in an embodiment of the present application;

[0033] Figure 6 A schematic diagram of the structure of a cross-account resource calling device based on cloud computing technology provided in an embodiment of the present application;

[0034] Figure 7 A schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0035] Figure 8 A schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application;

[0036] Fig. 9 A schematic diagram of the structure of another computing device cluster provided in an embodiment of the present application. DETAILED DESCRIPTION

[0037] The scheme in the embodiments provided in this application will be described below in conjunction with the drawings in this application.

[0038] The terms "first", "second", etc. in the specification, claims and drawings of this application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances. This is just a way of distinguishing objects with the same attributes when describing the embodiments of this application.

[0039] First, some technical terms involved in the embodiments of the present application are introduced.

[0040] Cloud service refers to the Internet service provided by large-scale server clusters using cloud computing technology to users, which does not require downloading or installation, is available online, is easy to operate, has rich functions, and is inexpensive. In addition, cloud service can provide computing resources and capabilities on demand, with high resource utilization. Among them, cloud services can include different types such as cloud host services and cloud storage services.

[0041] Cloud management systems are used to manage cloud computing infrastructure.

[0042] A container is a running instance created by a Docker image. A node can run multiple containers. The essence of a container is a process, but unlike a process that runs directly on the host, a container process runs in its own independent namespace.

[0043] MapReduce Service has created a highly reliable, highly secure, and easy-to-use operation and maintenance platform, providing large-capacity data storage and analysis capabilities to meet the data storage and processing needs of major companies. Users can independently apply for and use managed Hadoop, Spark, HBase, and Hive services to quickly create clusters on the host, providing batch data storage and computing capabilities for massive data with low real-time requirements.

[0044] Cloud Container Engine (CCE) is used to provide highly reliable and high-performance enterprise-level container application management services, support Kubernetes community native applications and tools, and simplify the construction of automated container operating environments on the cloud.

[0045] When users use cloud services to process business, they will involve cross-service and cross-account resource calls. Take big data services and container services as examples. Figure 1 As shown, this figure is a scenario diagram provided by an embodiment of the present application. Account B of the big data service needs to obtain container cluster resources from the container service. Account A of the container service authorizes Account B of the big data service and provides Account B of the big data service with credential information such as Account A's Secret Access Key (SK), Account Key (AK), Password (token) or certificate. Account B uses Account A's credential information to use the container cluster resources of Account A in the container service.

[0046] However, passing account credential information carries a high security risk. For example, account B may abuse account A's credential information. For example, account B uses account A's resources beyond the authorized permissions. In addition, the validity period of account A's credential information is difficult to control. Account B may continue to use account A's credential information to call resources without authorization before account A's credential information becomes invalid.

[0047] Based on this, an embodiment of the present application provides a cross-account resource calling method based on cloud computing technology. The method is applied to a cloud management system, which is used to manage an infrastructure, and a first service of a first tenant and a second service of a second tenant are set on the infrastructure. The cloud management system obtains an authorization request from the first tenant. The authorization request includes the tenant identifier of the second tenant, the authorization name, and the specific permission for the second service to call the first service. The cloud management system creates a specific permission based on the authorization request. The cloud management system obtains an authorization request input by the second tenant, including the authorization name and the tenant identifier of the first tenant, and configures the second tenant to obtain a specific permission according to the authorization request. According to the specific permission, when the second tenant configures the second service to call the first service, the cloud management system allows the second service to call the first service. In this way, there is no need to use the credential information of the service account of the first tenant to realize resource calling, and authorization in cross-service and cross-account scenarios with a higher degree of security can be achieved, and the efficiency of configuring permissions in cross-service and cross-account scenarios can be improved, and the utilization rate of service resources can be improved.

[0048] The embodiments of this application do not limit the application scenarios of the cross-account resource calling method based on cloud computing technology. As some examples, Figure 2 A schematic diagram of an application scenario provided for an embodiment of the present application. The cross-account resource calling method based on cloud computing technology provided in an embodiment of the present application can be applied to a cloud management system. The cloud management system is used to manage infrastructure. MapReduce services and CCE services are set on the infrastructure. Obtain an authorization request sent by the first tenant of the CCE service. That is, the authorization request sent by the first tenant using account C. The authorization request includes the tenant identifier (account D) of the second tenant of the MapReduce service, the authorization name, and the specific permission for the MapReduce service to call the CCE service. The cloud management system creates specific permissions based on the authorization request. The cloud management system obtains the authorization request input by the second tenant. The authorization request includes the authorization name and the tenant identifier of the first tenant, that is, account C. The cloud management system configures the second tenant to obtain specific permissions based on the authorization request. When the second tenant configures the MapReduce service to call the CCE service, the MapReduce service is allowed to call the CCE service according to the specific permissions.

[0049] It should be noted that the above Figure 2 The application scenarios shown are only examples. The cross-account resource calling method based on cloud computing technology provided in this application can be applied to other cross-service and cross-account calling service resource scenarios. The application scenarios of the cross-account resource calling method based on cloud computing technology provided in the embodiments of this application are not limited to Figure 2 Limitations of the application scenarios shown.

[0050] Next, various non-limiting specific implementations of the cross-account resource calling method based on cloud computing technology provided by this application are described in detail. Figure 3 As shown in the figure, this figure is a flow chart of a cross-account resource calling method based on cloud computing technology provided by an embodiment of the present application. This method can be applied to, for example, the above Figure 2 The cloud management system in the scenario shown. The method includes S301-S309.

[0051] S301: Obtaining an authorization request from the first tenant.

[0052] The first tenant is a tenant of the first service. The first tenant has the right to call the service resources of the first service. The first tenant can trigger an authorization request for the second tenant.

[0053] The authorization request includes the tenant identifier of the second tenant, the authorization name, and the specific permission for the second service to call the first service. The second tenant is the tenant of the second service. The tenant identifier of the second tenant is, for example, the tenant account identifier of the second tenant. The tenant identifier of the first tenant is different from the tenant identifier of the second tenant. The authorization name is used to identify the specific permission.

[0054] In some possible implementations, the specific rights authorized by the first tenant to the second tenant do not exceed the first tenant's rights to use the service resources of the first service.

[0055] As an example, Figure 2 In the application scenario shown, the first service is a container service. The embodiment of the present application does not limit the specific type of service resources of the container service. The container service is, for example, a Kubernetes service.

[0056] In a possible implementation, the specific permission includes container resource permission, which is permission for the second tenant to use the container resource.

[0057] As an example, container resource permissions can be obtained by the administrator of the container service for the container user. Specific permissions correspond to container users. Taking the Kubernetes service as an example, container resource permissions can be permissions corresponding to container users created by the Kubernetes administrator for the container user based on role-based access control (RBAC). Container resource permissions are, for example, access permissions for the global namespace or access permissions for a specified namespace. In this way, the second tenant can configure the second service to call the container service according to the container resource permissions.

[0058] S303: Create specific permissions based on the authorization request.

[0059] A specific permission is created according to the obtained authorization request. The created specific permission is the permission for the second service to call the first service. In a possible implementation, a delegation is created according to the authorization request. The delegation is a collection of permissions, including the specific permission.

[0060] S305: Acquire an authorization request input by the second tenant, where the authorization request includes an authorization name and a tenant identifier of the first tenant.

[0061] The authorization request of the second tenant is used to trigger the configuration of the second tenant to obtain specific permissions. The second tenant generates an authorization request by inputting the tenant ID and authorization name of the first tenant. For example, the second tenant inputs the tenant ID and authorization name of the first tenant through the console (Console User Interface, Console UI) or application program interface (Application Program Interface, API) to trigger the generation of the authorization request.

[0062] The authorization request includes the tenant identifier of the first tenant and the authorization name. The tenant identifier of the first tenant is, for example, the account identifier of the first tenant. The authorization name is used to identify a specific permission. As an example, the specific permission created is a delegation. The authorization name is the delegation name.

[0063] Based on the tenant identifier of the first tenant, the first service can be called using the identity of the tenant identifier of the first tenant. Based on the authorization name, the specific authority can be determined, so as to facilitate calling the first service within the authority scope of the specific authority.

[0064] In a possible implementation, the authorization name is used to query for specific permissions. For example, the cloud management system creates multiple delegations, and the authorization name, ie, delegation name, included in the authorization request is used to query the delegation corresponding to the delegation name.

[0065] S307: According to the authorization request, configure the second tenant to obtain specific permissions.

[0066] By using the authorization request, the specific permission identified by the authorization name and the tenant identification of the first tenant can be determined. The specific permission is configured for the second tenant, so that the second tenant can use the specific permission to configure the second service to call the first service, thereby implementing the authorization of the specific permission.

[0067] It should be noted that, in a possible implementation, the authorization request also includes the credential information of the second tenant. The identity of the second tenant can be verified using the credential information of the second tenant. Based on the credential information of the second tenant, the second tenant is configured to switch its identity to the first tenant, so that the second tenant obtains specific permissions. The embodiment of the present application does not limit the method of switching identities. As an example, the identity of the second tenant is switched based on a unified identity authentication (Identity and Access Management, IAM) service. In this way, the second tenant can obtain specific permissions based on the credential information of the second tenant, thereby improving the security of cross-service and cross-account service resource calls.

[0068] S309: According to the specific permission, when the second tenant configures the second service to call the first service, the second service is allowed to call the first service.

[0069] For the second tenant who obtains specific permissions, when configuring the second service to call the first service, the cloud management system allows the second service to call the first service. It should be noted that the permission scope of the second tenant to configure the second service to call the first service belongs to the permission scope of specific permissions.

[0070] The embodiment of the present application does not limit the triggering method for the second tenant to configure the second service to call the first service. As an example, in the process of using the second service to process the business of the second tenant, when it is detected that the service resources of the first service need to be used, the configuration of the second service to call the first service is automatically triggered. As another example, a configuration request for configuring the second service to call the first service triggered by the second tenant is obtained. The second service is configured to call the first service based on the configuration request.

[0071] Based on the relevant contents of S301-S309 above, it can be known that by using the tenant identifier, authorization name and specific permissions of the second tenant, it is possible to create specific permissions configured for the second tenant and realize cross-account and cross-service authorization. After the second tenant obtains specific permissions based on the authorization request including the authorization name and the tenant identifier of the first tenant, it can configure the second service to call the first service based on the specific permissions. In this way, on the one hand, it can avoid the transmission of credential information such as passwords and certificates, reduce the risk of cross-account service interaction, and realize authorization in cross-service and cross-account scenarios with a higher degree of security. On the other hand, it can improve the efficiency of configuring cross-service and cross-account authorization, meet the needs of service resource use in cross-service and cross-account scenarios, and improve the flexibility of service resource management and service resource utilization.

[0072] In some possible implementation scenarios, the second tenant includes at least one user. In addition to the above steps, see Figure 4As shown, this figure is a flow chart of another cross-account resource calling method based on cloud computing technology provided by an embodiment of the present application. The method also includes the following steps:

[0073] S308: According to the authorization request, configure the second service to create at least one second sub-service corresponding to the at least one user, and configure the first service to create at least one first sub-service corresponding to the at least one user.

[0074] In the case where the second tenant includes at least one user, the specific permission can be a permission authorized in the user dimension. According to the authorization request input by the second tenant, the second service is configured to create at least one second sub-service corresponding to at least one user included in the second tenant, and at least one first sub-service corresponding to at least one user created by the first service is configured. Among them, the second sub-service belongs to the second service and is created within the scope of the second service managed by the second tenant. The first sub-service belongs to the first service and is created within the scope of the first service that can be called within the specific permission obtained by the second tenant based on the authorization request configuration.

[0075] The configured first sub-service and second sub-service both correspond to the users included in the second tenant. In this way, the configuration of service calls in the user dimension can be realized, and the principle of minimum authorization is followed to realize fine-grained authorization.

[0076] Further, S309: according to the specific permission, when the second tenant configures the second service to call the first service, allowing the second service to call the first service specifically includes:

[0077] According to the specific authority, when at least one user configures the second service to call the first service, at least one second sub-service is allowed to call the corresponding at least one first sub-service.

[0078] When the user included in the second tenant configures the second service to call the first service, based on specific permissions, the second sub-service corresponding to the user is allowed to call the first sub-service corresponding to the user. In this way, the first sub-service corresponding to the user is called, and users included in the same tenant are prevented from unauthorizedly calling the first sub-service corresponding to other users, thereby improving the security of authorization.

[0079] As an example, see Figure 5 As shown, this figure is a schematic diagram of a cross-account resource calling method based on cloud computing technology provided by an embodiment of the present application. The first service is a CCE service, and the tenant identifier of the first tenant is account x. The second service is a MapReduce service, and the tenant identifier of the second tenant is account y. The second tenant includes user 1, user 2, and user 3.

[0080] The first tenant logs in to account x and sends an authorization request to the cloud management system. The authorization request includes the tenant ID of the second tenant, namely "account y", the authorization name, namely the delegation number, and the specific permission for the MapReduce service to call the CCE service.

[0081] As an example, the first tenant sends a first authorization request, a second authorization request, and a third authorization request to the cloud management system, respectively. The first authorization request includes account y, CCE_X_1, and specific permissions of user 1. CCE_X_1 is the delegation number. The second authorization request includes account y, CCE_X_2, and specific permissions of user 2. CCE_X_2 is the delegation number. The third authorization request includes account y, CCE_X_3, and specific permissions of user 3. CCE_X_3 is the delegation number.

[0082] The cloud management system obtains the first authorization request, the second authorization request, and the third authorization request, and creates delegate CCE_X_1, delegate CCE_X_2, and delegate CCE_X_3. Delegate CCE_X_1 includes specific permissions of user 1. Delegate CCE_X_2 includes specific permissions of user 2. Delegate CCE_X_3 includes specific permissions of user 3.

[0083] The cloud management system obtains the authorization request input by the second tenant. For example, the authorization request input by user 1 includes CCE_X_1 and account x. The cloud management system configures user 1 to obtain specific permissions created based on the first authorization request. The cloud management system configures the MapReduce service to create a subservice corresponding to user 1, namely MRS_1, and configures the CCE service to create a subservice corresponding to user 1, namely CCE_A. When user 1 configures MRS to call the CCE service, the cloud management system allows MRS1 to call CCE_A.

[0084] In addition, the specific permissions included in the first authorization request include container resource permissions. Container resource permissions are permissions created by the Kubernetes administrator for container users based on RBAC. In this way, user 1 can use MRS_1 to call CCE_A to create a virtual cluster, create a namespace in the cluster of CCE_A, and run workloads on the CCE cluster.

[0085] The cloud management system can also obtain the authorization request of CCE_X_2 and account x entered by user 2. The cloud management system configures user 2 to obtain the specific permissions created based on the second authorization request. The cloud management system configures the MapReduce service to create the subservice corresponding to user 2, namely MRS_2, and configures the CCE service to create the subservice corresponding to user 2, namely CCE_B. When user 2 configures MRS to call the CCE service, MRS_2 is allowed to call CCE_B.

[0086] The cloud management system can also obtain the authorization request of CCE_X_3 and account x entered by user 3. The cloud management system configures user 3 to obtain specific permissions created based on the third authorization request. The cloud management system configures the MapReduce service to create a subservice corresponding to user 3, namely MRS_3, and configures the CCE service to create a subservice corresponding to user 3, namely CCE_C. When user 2 configures MRS to call the CCE service, it allows MRS_2 to call CCE_C.

[0087] It is worth noting that, in this solution, the MapReduce service or CCE service can create sub-services by making logical distinctions within the service through different namespaces to achieve the division of sub-services.

[0088] Based on this, when there are multiple users under a tenant, by configuring the first service or the second service to create sub-services corresponding to the users, when different users are authorized to request to call the service, they can call the sub-services separately to avoid mixing of resources, thereby improving the security of cross-service calls by different users and ensuring high availability and high security of resources.

[0089] The present application also provides a cross-account resource calling device based on cloud computing technology. The cross-account resource calling device based on cloud computing technology is applied to a cloud management system. The cloud management system is used to manage infrastructure. The infrastructure is provided with a first service of a first tenant and a second service of a second tenant. Figure 6 As shown, including:

[0090] A first acquisition module 601 is used to acquire an authorization request input by the first tenant, where the authorization request includes the tenant identifier of the second tenant, an authorization name, and a specific permission for the second service to call the first service;

[0091] A creation module 602, configured to create the specific permission based on the authorization request;

[0092] A second acquisition module 603 is used to acquire an authorization request input by the second tenant, where the authorization request includes the authorization name and the tenant identifier of the first tenant;

[0093] A first configuration module 604, configured to configure the second tenant to obtain the specific permission according to the authorization request;

[0094] The second configuration module 605 is configured to allow the second service to call the first service when the second tenant configures the second service to call the first service according to the specific permission.

[0095] In a possible implementation manner, the second tenant includes at least one user, and the device further includes:

[0096] a third configuration module, configured to configure the second service to create at least one second sub-service corresponding to the at least one user, and to configure the first service to create at least one first sub-service corresponding to the at least one user, according to the authorization request;

[0097] The second configuration module is specifically configured to allow the at least one second sub-service to call the corresponding at least one first sub-service when the at least one user configures the second service to call the first service according to the specific permission.

[0098] In a possible implementation manner, the first service is a container service.

[0099] In a possible implementation manner, the specific permission includes container resource permission, the container resource permission corresponds to a container user, and the container resource permission is permission to use the container resource.

[0100] In a possible implementation, the authorization request includes credential information of the second tenant, and the first configuration module is specifically used to configure the second tenant to switch identity to the first tenant according to the credential information, so that the second tenant obtains the specific authority.

[0101] Among them, the first acquisition module 601, the creation module 602, the second acquisition module 603, the first configuration module 604 and the second configuration module 605 can all be implemented by software, or can be implemented by hardware. Exemplarily, the implementation of the first acquisition module 601 is introduced below by taking the first acquisition module 601 as an example. Similarly, the implementation of the creation module 602, the second acquisition module 603, the first configuration module 604 and the second configuration module 605 can refer to the implementation of the first acquisition module 601.

[0102] As an example of a software functional unit, the first acquisition module 601 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the first acquisition module 601 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code can be distributed in the same region (region) or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code can be distributed in the same availability zone (AZ) or in different AZs, each AZ including a data center or multiple data centers with close geographical locations. Among them, usually a region can include multiple AZs.

[0103] Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

[0104] As an example of a hardware functional unit, the first acquisition module 601 may include at least one computing device, such as a server, etc. Alternatively, the first acquisition module 601 may also be a device implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0105] The multiple computing devices included in the first acquisition module 601 can be distributed in the same region or in different regions. The multiple computing devices included in the first acquisition module 601 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the first acquisition module 601 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0106] It should be noted that, in other embodiments, the first acquisition module 601 can be used to execute any step in the cross-account resource calling method based on cloud computing technology, the creation module 602 can be used to execute any step in the cross-account resource calling method based on cloud computing technology, the second acquisition module 603 can be used to execute any step in the cross-account resource calling method based on cloud computing technology, the first configuration module 604 can be used to execute any step in the cross-account resource calling method based on cloud computing technology, and the second configuration module 605 can be used to execute any step in the cross-account resource calling method based on cloud computing technology. The steps implemented by the first acquisition module 601, the creation module 602, the second acquisition module 603, the first configuration module 604 and the second configuration module 605 can be specified as needed. The first acquisition module 601, the creation module 602, the second acquisition module 603, the first configuration module 604 and the second configuration module 605 respectively implement different steps in the cross-account resource calling method based on cloud computing technology to realize all the functions of the cross-account resource calling device based on cloud computing technology.

[0107] The present application also provides a computing device 700. Figure 7 As shown, computing device 700 includes: bus 702, processor 704, memory 706 and communication interface 708. Processor 704, memory 706 and communication interface 708 communicate through bus 702. Computing device 700 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in computing device 700.

[0108] The bus 702 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7The bus 702 may include a path for transmitting information between various components of the computing device 700 (eg, the memory 706, the processor 704, and the communication interface 708).

[0109] The processor 704 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0110] The memory 706 may include a volatile memory, such as a random access memory (RAM). The processor 704 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0111] The memory 706 stores executable program codes, and the processor 704 executes the executable program codes to respectively implement the functions of the aforementioned first acquisition module 601, creation module 602, second acquisition module 603, first configuration module 604, and second configuration module 605, thereby implementing the cross-account resource calling method based on cloud computing technology. That is, the memory 706 stores instructions for executing the cross-account resource calling method based on cloud computing technology.

[0112] The communication interface 708 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 700 and other devices or communication networks.

[0113] The embodiment of the present application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.

[0114] like Figure 8As shown, the computing device cluster includes at least one computing device 700. The memory 706 in one or more computing devices 700 in the computing device cluster may store the same instructions for executing the cross-account resource calling method based on cloud computing technology.

[0115] In some possible implementations, the memory 706 of one or more computing devices 700 in the computing device cluster may also store partial instructions for executing the cross-account resource calling method based on cloud computing technology. In other words, the combination of one or more computing devices 700 can jointly execute the instructions for executing the cross-account resource calling method based on cloud computing technology.

[0116] It should be noted that the memory 706 in different computing devices 700 in the computing device cluster can store different instructions, which are respectively used to execute part of the functions of the cross-account resource calling device based on cloud computing technology. That is, the instructions stored in the memory 706 in different computing devices 700 can implement the functions of one or more modules of the first acquisition module 601, the creation module 602, the second acquisition module 603, the first configuration module 604 and the second configuration module 605.

[0117] In some possible implementations, one or more computing devices in the computing device cluster may be connected via a network, which may be a wide area network or a local area network. Fig. 9 A possible implementation is shown. Fig. 9 As shown, two computing devices 700A and 700B are connected via a network. Specifically, the network is connected via a communication interface in each computing device. In this type of possible implementation, the memory 706 in the computing device 700A stores instructions for executing the functions of the first acquisition module 601 and the creation module 602. At the same time, the memory 706 in the computing device 700B stores instructions for executing the functions of the second acquisition module 603, the first configuration module 604, and the second configuration module 605.

[0118] Fig. 9 The connection method between the computing device clusters shown can be considered to take into account the needs of the cross-account resource calling method based on cloud computing technology provided in this application, so it is considered to hand over the functions implemented by the second acquisition module 603, the first configuration module 604 and the second configuration module 605 to the computing device 700B for execution.

[0119] It should be understood that Fig. 9 The functions of the computing device 700A shown in FIG. 7 may also be completed by multiple computing devices 700. Similarly, the functions of the computing device 700B may also be completed by multiple computing devices 700.

[0120] The embodiment of the present application also provides a computer program product including instructions. The computer program product may be a software or program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes a cross-account resource calling method based on cloud computing technology.

[0121] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by the computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute a cross-account resource call method based on cloud computing technology.

[0122] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. A cross-account resource calling method based on cloud computing technology, characterized in that: The method is applied to a cloud management system, the cloud management system is used to manage an infrastructure, a first service of a first tenant and a second service of a second tenant are arranged on the infrastructure, the method comprises: Obtaining an authorization request input by the first tenant, the authorization request including the tenant identifier of the second tenant, an authorization name, and a specific permission for the second service to call the first service; Creating the specific permission based on the authorization request; Obtaining an authorization request input by the second tenant, where the authorization request includes the authorization name and the tenant identifier of the first tenant; According to the authorization request, configuring the second tenant to obtain the specific permission; According to the specific permission, when the second tenant configures the second service to call the first service, the second service is allowed to call the first service.

2. The method according to claim 1, characterized in that The second tenant includes at least one user, and the method further includes: According to the authorization request, configure the second service to create at least one second sub-service corresponding to the at least one user, and configure the first service to create at least one first sub-service corresponding to the at least one user; The allowing the second service to call the first service when the second tenant configures the second service to call the first service according to the specific permission includes: According to the specific permission, when the at least one user configures the second service to call the first service, the at least one second sub-service is allowed to call the corresponding at least one first sub-service.

3. The method according to claim 1 or 2, characterized in that: The first service is a container service.

4. The method according to claim 3, characterized in that The specific permissions include container resource permissions, the container resource permissions correspond to container users, and the container resource permissions are permissions for using container resources.

5. The method according to any one of claims 1 to 4, characterized in that: The authorization request includes the credential information of the second tenant, and configuring the second tenant to obtain the specific permission based on the authorization request includes: configuring the second tenant to switch identity to the first tenant based on the credential information so that the second tenant obtains the specific permission.

6. A cross-account resource calling device based on cloud computing technology, characterized in that: The device is applied to a cloud management system, the cloud management system is used to manage infrastructure, the infrastructure is provided with a first service of a first tenant and a second service of a second tenant, and the device includes: A first acquisition module is used to acquire an authorization request input by the first tenant, where the authorization request includes a tenant identifier of the second tenant, an authorization name, and a specific permission for the second service to call the first service; A creation module, used to create the specific permission based on the authorization request; A second acquisition module is used to acquire an authorization request input by the second tenant, where the authorization request includes the authorization name and the tenant identifier of the first tenant; A first configuration module, configured to configure the second tenant to obtain the specific permission according to the authorization request; The second configuration module is used to allow the second service to call the first service when the second tenant configures the second service to call the first service according to the specific permission.

7. The device according to claim 6, characterized in that The second tenant includes at least one user, and the device further includes: a third configuration module, configured to configure the second service to create at least one second sub-service corresponding to the at least one user, and to configure the first service to create at least one first sub-service corresponding to the at least one user, according to the authorization request; The second configuration module is specifically configured to allow the at least one second sub-service to call the corresponding at least one first sub-service when the at least one user configures the second service to call the first service according to the specific permission.

8. The device according to claim 6 or 7, characterized in that The first service is a container service.

9. The device according to claim 8, characterized in that The specific permissions include container resource permissions, the container resource permissions correspond to container users, and the container resource permissions are permissions for using container resources.

10. The device according to any one of claims 6 to 9, characterized in that: The authorization request includes the credential information of the second tenant, and the first configuration module is specifically configured to configure the second tenant to switch identity to the first tenant according to the credential information, so that the second tenant obtains the specific authority.

11. A computing device cluster, characterized in that: comprising at least one computing device, each computing device comprising a processor and a memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1 to 5.

12. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device cluster, the computing device cluster executes the method according to any one of claims 1 to 5.

13. A computer-readable storage medium, characterized in that: The method comprises computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster performs the method according to any one of claims 1 to 5.

Images