Certificate updating method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a certificate updating method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: defining and creating a certificate management object of a first custom resource type of a cluster; generating a current certificate file containing the theme standby name by using the certificate management object, and storing the current certificate file in a cluster; obtaining a first annotation and a theme standby name expected value in the certificate management object; under the condition that it is determined that the theme standby name is modified according to the first annotation and the theme standby name expected value, a new certificate file is generated according to the theme standby name expected value and the current certificate file through the certificate management object; and replacing the current certificate file with the new certificate file. By creating the certificate management object, the user only needs to modify the theme standby name expected value in the certificate management object, the system can automatically update the cluster certificate, the whole cluster control plane does not need to be reconstructed, and the stability of the cluster is improved.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to a certificate updating method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] A digital certificate is a digital certificate that marks the identity information of the communicating parties in Internet communication, and can be used to ensure secure communication between the communicating parties. In a Kubernetes (a container orchestration platform) cluster, the cluster certificate is used to ensure secure communication and user authentication between different components of the cluster. In the process of using the cluster, changes in business needs may require updating the cluster certificate. For example, when a user calls cluster resources through an elastic IP (EIP), the cluster certificate needs to be updated first. The cluster certificate is closely related to the cluster initialization process. If the cluster certificate needs to be changed, it is usually necessary to delete and rebuild the entire cluster control plane. This method will cause the cluster to be temporarily unavailable and will affect the stability of the cluster. Summary of the invention

[0003] Based on this, it is necessary to provide a certificate update method, apparatus, computer device, computer-readable storage medium and computer program product that can improve cluster stability in response to the above technical problems.

[0004] In a first aspect, the present application provides a certificate updating method, the method comprising:

[0005] Define and create a certificate management object for the cluster, where the certificate management object is a first custom resource type;

[0006] generating a current certificate file including a subject alternative name using the certificate management object, and saving the current certificate file to the cluster;

[0007] Obtaining a first annotation and a subject alternative name expected value in the certificate management object;

[0008] In a case where it is determined according to the first annotation and the second annotation that the subject alternative name is modified, generating a new certificate file according to the subject alternative name expected value and the current certificate file using the certificate management object;

[0009] The current certificate file is replaced with the new certificate file.

[0010] In one embodiment, the using the certificate management object to generate a new certificate file according to the subject alternative name expected value and the current certificate file includes:

[0011] Obtaining certificate information and key information from the current certificate file;

[0012] Obtain the subject alternative name expected value from the certificate management object;

[0013] A new certificate file is generated according to the subject alternative name expected value, the certificate information and the key information.

[0014] In one embodiment, before defining and creating the certificate management object of the cluster, the method further includes:

[0015] The cluster and at least one elastic container instance are created by using a container orchestration engine, and the elastic container instance serves as a master node of the cluster.

[0016] In one embodiment, the method further comprises:

[0017] Define and create an instance management object, where the instance management object is a second user-defined resource type;

[0018] After replacing the current certificate file with the new certificate file, updating the second annotation in the instance management object to a first string; the first string is used to indicate that the certificate file in the cluster has been updated;

[0019] The instance update interface of the instance management object is called to save the new certificate file into the elastic container instance.

[0020] In one embodiment, after saving the new certificate file into the elastic container instance, the method further includes:

[0021] The second annotation in the instance management object is updated to a second string; the second string is used to indicate that the certificate file in the elastic container instance has been updated.

[0022] In one embodiment, the method further comprises:

[0023] In the event that the first annotation and the expected value of the subject alternative name are inconsistent, determining that the subject alternative name is modified;

[0024] In a case where the first annotation is consistent with the expected value of the subject alternative name, it is determined that the subject alternative name has not been modified.

[0025] In a second aspect, the present application further provides a certificate updating device, the device comprising:

[0026] A custom resource module, used to define and create a certificate management object of the cluster, wherein the certificate management object is of a first custom resource type;

[0027] An annotation acquisition module, used to acquire the first annotation and the expected value of the subject alternative name in the certificate management object;

[0028] A certificate management module, used to generate a current certificate file including a subject alternative name using the certificate management object, and save the current certificate file to the cluster; and when it is determined that the subject alternative name is modified according to the first annotation and the subject alternative name expected value, generate a new certificate file according to the subject alternative name expected value and the current certificate file using the certificate management object; and replace the current certificate file with the new certificate file.

[0029] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the certificate updating method provided in any of the above embodiments is implemented.

[0030] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the certificate updating method provided in any of the above embodiments is implemented.

[0031] In a fifth aspect, the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the certificate updating method provided in any of the above embodiments.

[0032] The certificate update method, device, computer equipment, computer-readable storage medium and computer program product define and create a certificate management object for the cluster, use the certificate management object to generate a current certificate file containing a subject alternative name, save the current certificate file to the cluster, obtain the first annotation and the subject alternative name expected value in the certificate management object, and when it is determined that the subject alternative name has been modified according to the first annotation and the subject alternative name expected value, use the certificate management object to generate a new certificate file according to the subject alternative name expected value and the current certificate file, and then replace the current certificate file with the new certificate file, thereby realizing the real-time update of the cluster certificate, allowing users to use EIP to call cluster resources, thereby improving the availability of the cluster. In addition, a custom resource type is used to define and create a certificate management object, and the certificate management object is responsible for the generation and update of the cluster certificate. The user only needs to modify the subject alternative name in the certificate management object, and the system can use the certificate management object to automatically generate a new certificate file and replace the original certificate file. The cluster certificate can be updated without rebuilding the cluster control plane, thereby improving the stability of the cluster. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0034] Figure 1 A schematic diagram of a flow chart of a certificate updating method in an embodiment;

[0035] Figure 2 A schematic diagram of a process of using a certificate management object to generate a new certificate file according to a subject alternative name expected value and a current certificate file in one embodiment;

[0036] Figure 3 An application architecture diagram of a certificate update method in an embodiment;

[0037] Figure 4 is a flow chart of a certificate updating method in another embodiment;

[0038] Figure 5 A flowchart of a certificate updating method provided in a more specific embodiment;

[0039] Figure 6 A flowchart of a certificate updating method provided in another more specific embodiment;

[0040] Figure 7 is a structural block diagram of a certificate updating device in an embodiment;

[0041] Figure 8 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0043] In a Kubernetes (a container orchestration platform) cluster, cluster certificates are used to ensure secure communication and user authentication between different components of the cluster. During the use of the cluster, changes in business requirements may require updating the cluster certificate. For example, users may need to call cluster resources through EIP. The cluster certificate is closely related to the cluster initialization process. If the cluster certificate needs to be changed, it is usually necessary to delete and rebuild the entire cluster control plane. This method will cause the cluster to be temporarily unavailable and affect the stability of the cluster.

[0044] Based on this, Figure 1 As shown, the present application provides a certificate updating method, including the following steps 102 to 110.

[0045] Step 102: define and create a certificate management object of the cluster, where the certificate management object is a first custom resource type.

[0046] Custom Resource Definitions (CRD) is a mechanism in the Kubernetes system that allows users to define new resource types based on their business needs. Custom resources can be used to define certificate management objects and specify configuration information such as version, name, and scope. After defining a certificate management object, you can create an instance of the certificate management object and monitor the status of the certificate management object through the certificate management object controller.

[0047] Step 104: Generate a current certificate file including a subject alternative name using the certificate management object, and save the current certificate file to the cluster.

[0048] Among them, Subject Alternative Names (SANs) is an extension field in the X.509 format certificate, which allows multiple identities to be specified, such as multiple domain names, IP addresses, and emails. The certificate management object contains the configuration information of the subject alternative name and configures the PKI (Public Key Infrastructure). The current certificate file contains the CA (Certification Authority) certificate, CA key, API (Application Programming Interface) server certificate, and API server key.

[0049] Specifically, you can first use the certificate management object to automatically generate a CA certificate and CA key, generate an API server certificate and API server key based on the subject alternative name, CA certificate and CA key provided by the certificate management object, and then package the CA certificate, CA key, API server certificate and API server key into the current certificate file. The current certificate file can be saved in the cluster in the form of a PKIsecret.

[0050] Step 106: Get the first annotation and the expected value of the subject alternative name in the certificate management object.

[0051] Annotations are part of the data in a certificate management object that allow users to store additional non-identifying metadata. The first annotation can be used to indicate the subject alternative name corresponding to the certificate that is currently allowed to log into the cluster. The expected value of the subject alternative name is the subject alternative name modified by the user. Exemplarily, the specSANs field in the certificate management object can be used as the expected value of the subject alternative name. The specSANs field is open to users and upstream systems and can be modified by users or upstream systems; the oldSANs field in the certificate management object can be used as the first annotation.

[0052] Step 108: When it is determined that the subject alternative name is modified according to the first annotation and the subject alternative name expected value, a new certificate file is generated according to the subject alternative name expected value and the current certificate file using the certificate management object.

[0053] When the subject alternative name needs to be modified, the upstream system (such as the cluster management platform) will modify the expected value of the subject alternative name of the certificate management object. Therefore, it is possible to determine whether the subject alternative name has been modified based on the first annotation and the expected value of the subject alternative name. After determining that the subject alternative name has been modified, in order to ensure that the new IP can call cluster resources normally, a new certificate file needs to be generated based on the expected value of the subject alternative name and the current certificate file.

[0054] Step 110: Replace the current certificate file with a new certificate file.

[0055] After generating a new certificate file, you can use the new certificate file to replace the current certificate file in the cluster to complete the certificate update for the cluster.

[0056] In an embodiment of the present application, by defining and creating a certificate management object for a cluster, using the certificate management object to generate a current certificate file containing a subject alternative name, and saving the current certificate file to the cluster, obtaining the first annotation and the subject alternative name expected value in the certificate management object, and in the case where it is determined that the subject alternative name has been modified according to the first annotation and the subject alternative name expected value, using the certificate management object, a new certificate file is generated according to the subject alternative name expected value and the current certificate file, and then the current certificate file is replaced with the new certificate file, thereby achieving real-time update of the cluster certificate. In this way, users can use EIP to call cluster resources, thereby improving the availability of the cluster. In addition, by using custom resource types to define and create certificate management objects, and by using the certificate management object to be responsible for the generation and update of cluster certificates, users only need to modify the subject alternative name in the certificate management object, and the system can use the certificate management object to automatically generate a new certificate file and replace the original certificate file, and the cluster certificate can be updated without rebuilding the cluster control plane, thereby improving the stability of the cluster.

[0057] In one embodiment, Figure 2As shown, a new certificate file is generated according to the subject alternative name expected value and the current certificate file by using the certificate management object, including steps 202 to 206.

[0058] Step 202: Obtain the certificate information and key information in the current certificate file.

[0059] The current certificate file contains information such as CA certificate, CA key, API server certificate, and API server key. The certificate information that needs to be obtained here refers to the CA certificate, and the key information that needs to be obtained refers to the CA key.

[0060] Step 204: Get the expected value of the subject alternative name from the certificate management object.

[0061] The user can directly modify the subject alternative name in the certificate management object. Therefore, the expected value of the subject alternative name can be obtained from the certificate management object by calling the API interface.

[0062] Step 206: Generate a new certificate file based on the subject alternative name expected value, certificate information and key information.

[0063] You can use the certificate management object to generate a new API server certificate and a new API server key based on the subject alternative name expected value, CA certificate, and CA key, and package the CA certificate, CA key, new API server certificate, and new API server key into a new certificate file to update the PKI secret in the cluster.

[0064] In this embodiment, by obtaining the certificate information and key information in the current certificate file, obtaining the expected value of the subject alternative name from the certificate management object, and generating a new certificate file based on the expected value of the subject alternative name, certificate information and key information, automatic updating of the cluster certificate file is achieved using the certificate management object.

[0065] In one embodiment, before defining and creating the certificate management object of the cluster, the certificate update method of the present application also includes the step of creating a cluster and at least one elastic container instance using a container orchestration engine.

[0066] The certificate updating method of this embodiment can be applied to Figure 3 In the application architecture shown, the upstream system can be a cluster management platform, a cluster instance created by a serverless architecture container engine, or a cloud service provider. The certificate management object is responsible for generating and updating cluster certificates, and the container management object is used to manage the creation, modification, and deletion of elastic container instances. The upstream system, the certificate management object, and the container management object can communicate through the API interface.

[0067] Among them, Elastic Container Instance (ECI) is a fully managed lightweight container instance service. Users do not need to manage the underlying servers, nor do they need to worry about capacity planning during operation. They can run containers by providing packaged Docker images. You can use common container orchestration tools such as Kubernetes, Docker Swarm, or Apache Mesos to define and create clusters and at least one elastic container instance. The cluster can be managed. A managed cluster is a cluster created using the Serverless Container Engine (SCE). The Serverless Container Engine introduces the concept of serverless into the container engine. Users do not need to purchase nodes, maintain nodes, or plan capacity for clusters. They only need to upload container images to SCE. The cluster control plane of the managed cluster is created by SCE and hosted in the cloud service provider's environment. Users only need to create working nodes. In a managed cluster, an elastic container instance can be used as a master node. In each elastic container instance, the basic components of the cluster, such as the kube-apiserver component and the kube-scheduler component, run.

[0068] In one embodiment, Figure 4 As shown, the certificate updating method of the present application also includes steps 402 to 406.

[0069] Step 402: define and create an instance management object, where the instance management object is a second user-defined resource type.

[0070] The second custom resource type is also a resource type created using custom resources, and is a different resource type from the first custom resource type. Custom resources can be used to define instance management objects, and the version, name, scope, and other related information of the instance management object can be specified. The instance management object is responsible for creating, updating, and deleting elastic container instances. After defining the instance management object, an instance of the instance management object can be created, and the instance management object status can be monitored through the instance management object controller.

[0071] Step 404: After replacing the current certificate file with the new certificate file, update the second annotation in the instance management object to the first string.

[0072] The first string is used to indicate that the certificate file in the cluster has been updated. After replacing the current certificate file with the new certificate file, the upstream system can update the second annotation in the instance management object to the first string to trigger the tuning process of the instance management object controller.

[0073] Step 406: Call the instance update interface of the instance management object to save the new certificate file into the elastic container instance.

[0074] The instance update interface is a component in the instance management object used to update the instance certificate. After the instance management object controller detects that the second annotation is updated to the first string, it can obtain the new certificate file through the corresponding API interface and call the instance update interface of the instance management object to save the new certificate file in the elastic container instance to implement the update of the instance certificate.

[0075] In this embodiment, by defining and creating an instance management object, after replacing the current certificate file with a new certificate file, the second annotation in the instance management object is updated to the first string, and the instance update interface of the instance management object is called to save the new certificate file to the elastic container instance, ensuring that the certificate in the elastic container instance is consistent with the cluster certificate. By using custom resources to create instance management objects and manage elastic container instances, the maintainability of the system is improved, providing users with more stable and efficient control plane support.

[0076] In one embodiment, after the new certificate file is saved in the elastic container instance, the second annotation in the instance management object may also be updated to the second string. The second string is used to indicate that the certificate file in the elastic container instance has been updated. It is understood that after the new certificate file is saved in the elastic container instance, the upstream system may also update the second annotation in the instance management object to the second string to prompt the instance management object controller that the ECI certificate has been updated to the latest and is consistent with the cluster certificate.

[0077] In one embodiment, when the first annotation and the expected value of the subject alternative name are inconsistent, it can be determined that the subject alternative name is modified; when the first annotation and the expected value of the subject alternative name are consistent, it can be determined that the subject alternative name is not modified.

[0078] In a more specific embodiment, the flowchart of the certificate update method of the present application is as follows: Figure 5 shown.

[0079] First, define and create a certificate management object SKC (full name serverless Kubernetes cert). The SKC object contains a field corresponding to the subject alternative name, that is, the SANs field.

[0080] Then, start the tuning process of the SKC object:

[0081] First, determine whether the first annotation exists in the SKC object. If not, add the first annotation "serverless.ccse.ctyn.cn / v1.skc.sans.old". If the first annotation exists, determine whether PKIsecret, that is, the certificate file, exists.

[0082] If the PKI secret does not exist, use the SKC object to generate and configure the PKI secret containing the SANs information. If the PKI secret exists, determine whether the certificate file needs to be updated based on the first annotation and the expected value of the subject alternative name.

[0083] If the first annotation and the expected value of the subject alternative name are consistent, it means that the certificate file does not need to be updated; if the first annotation and the expected value of the subject alternative name are inconsistent, it means that the certificate file needs to be updated. A new PKI secret is regenerated based on the expected value of the subject alternative name in the SKC object and the ca.crt and ca.key in the original PKI secret. The new PKI secret is saved in the cluster to complete the update of the cluster certificate.

[0084] Optionally, in a more specific embodiment, the flowchart of the certificate update method of the present application is as follows: Figure 6 shown.

[0085] First, create the certificate management object SKC and the instance management object CONG (full name: Container Group) respectively. The SKC object contains the field corresponding to the subject alternative name, that is, the SANs field.

[0086] Then, if Figure 5 As shown, the tuning process of the SKC object is completed. After generating a new PKI secret, update the second annotation of the CONG object to "congsRestart=true". After that, start the tuning process of the CONG object:

[0087] First, determine whether an elastic container instance ECI has been created. If the ECI does not exist, create two ECIs. If the ECI exists, determine whether the second annotation is "congsRestart=true".

[0088] If the second annotation is "congsRestart=true", call the API interface that communicates with the SKC controller or the API interface that communicates with the upstream system to obtain a new PKI secret, then call the instance update interface to save the new PKI secret inside the ECI and update the second annotation to "congsRestart=false". If the second annotation does not exist or is "congsRestart=false", end the tuning process of the CONG object.

[0089] For better understanding, a more specific embodiment is listed from the user's perspective to illustrate the beneficial effects of the certificate update method of the present application. The user can complete the update of the cluster certificate by following the steps below:

[0090] (1) Log in to the Container Engine console, activate the ECI service, and create an SCE cluster. The SCE cluster contains two ECI instances in managed mode.

[0091] (2) Connect to the SCE cluster through the kubectl command-line tool, manually edit the SKC object, find the SANs field in the editing interface, add a new EIP line, save and exit the editing interface.

[0092] (3) Check the SKC custom resource object and PKI Secret to confirm that the cluster certificate has been updated. Use the openssl command line tool to view the detailed information of the certificate file and confirm whether the SANs field in the certificate file contains the newly added EIP.

[0093] (4) Enter the ECI instance virtual machine, check the Apiserver certificate, confirm that the certificate is consistent with the latest cluster certificate maintained by the SKC object, and confirm that the SANs field in the certificate contains the newly added EIP.

[0094] (5) Use EIP to access the Apiserver of the cluster, observe whether the access is normal, and confirm that the cluster node information can be successfully obtained.

[0095] It can be understood that users only need to change the SANs field in the SKC object to dynamically update the cluster certificate and ECI instance certificate, avoiding the tedious process of deleting and rebuilding the cluster control plane. Even when business needs change, it will not affect the normal operation of the cluster, thereby improving the stability of the system.

[0096] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0097] Based on the same inventive concept, the embodiment of the present application also provides a certificate update device for implementing the certificate update method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more certificate update device embodiments provided below can refer to the limitations on the certificate update method above, and will not be repeated here.

[0098] In an exemplary embodiment, Figure 7 As shown, a certificate updating device is provided, including: a custom resource module 702, an annotation acquisition module 704 and a certificate management module 706, wherein:

[0099] The custom resource module 702 is used to define and create a certificate management object of the cluster, and the certificate management object is a first custom resource type;

[0100] The annotation acquisition module 704 is used to acquire the first annotation and the subject alternative name expected value in the certificate management object;

[0101] The certificate management module 706 is used to use the certificate management object to generate a current certificate file containing a subject alternative name, and save the current certificate file to the cluster; and when it is determined that the subject alternative name is modified based on the first annotation and the subject alternative name expected value, use the certificate management object to generate a new certificate file based on the subject alternative name expected value and the current certificate file; and replace the current certificate file with the new certificate file.

[0102] In one embodiment, the certificate management module is also used to obtain certificate information and key information in the current certificate file; obtain the subject alternative name expected value from the certificate management object; and generate a new certificate file based on the subject alternative name expected value, certificate information and key information.

[0103] In one embodiment, the certificate updating device further includes a container orchestration module. The container orchestration module is used to create a cluster and at least one elastic container instance using a container orchestration engine, and the elastic container instance serves as a master node of the cluster.

[0104] In one embodiment, the certificate update device further includes an instance management module. The instance management module is used to define and create an instance management object, which is a second custom resource type; after replacing the current certificate file with a new certificate file, the second annotation in the instance management object is updated to a first string; the first string is used to indicate that the certificate file in the cluster has been updated; and the instance update interface of the instance management object is called to save the new certificate file in the elastic container instance.

[0105] In one embodiment, the instance management module is further used to update the second annotation in the instance management object to a second string; the second string is used to indicate that the certificate file in the elastic container instance has been updated.

[0106] In one embodiment, the certificate management module is further used to determine that the subject alternative name is modified when the first annotation and the expected value of the subject alternative name are inconsistent; and to determine that the subject alternative name is not modified when the first annotation and the expected value of the subject alternative name are consistent.

[0107] Each module in the above-mentioned certificate update device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0108] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 8As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (Near Field Communication, NFC) or other technologies. When the computer program is executed by the processor, a certificate update method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0109] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0110] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the certificate updating method provided in any of the above embodiments is implemented.

[0111] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the certificate updating method provided in any of the above embodiments is implemented.

[0112] In one embodiment, a computer program product is provided, including a computer program, which implements the certificate updating method provided in any of the above embodiments when executed by a processor.

[0113] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0114] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0115] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A certificate updating method, characterized in that: The method comprises: Define and create a certificate management object for the cluster, where the certificate management object is a first custom resource type; generating a current certificate file including a subject alternative name using the certificate management object, and saving the current certificate file to the cluster; Obtaining a first annotation and a subject alternative name expected value in the certificate management object; In a case where it is determined according to the first annotation and the subject alternative name expected value that the subject alternative name is modified, generating a new certificate file according to the subject alternative name expected value and the current certificate file using the certificate management object; The current certificate file is replaced with the new certificate file.

2. The method according to claim 1, characterized in that The using the certificate management object to generate a new certificate file according to the subject alternative name expected value and the current certificate file includes: Obtaining certificate information and key information from the current certificate file; Obtain the subject alternative name expected value from the certificate management object; A new certificate file is generated according to the subject alternative name expected value, the certificate information and the key information.

3. The method according to claim 1, characterized in that Before defining and creating the certificate management object of the cluster, the method further includes: The cluster and at least one elastic container instance are created by using a container orchestration engine, and the elastic container instance serves as a master node of the cluster.

4. The method according to claim 3, characterized in that The method further comprises: Define and create an instance management object, where the instance management object is a second user-defined resource type; After replacing the current certificate file with the new certificate file, updating the second annotation in the instance management object to a first string; the first string is used to indicate that the certificate file in the cluster has been updated; The instance update interface of the instance management object is called to save the new certificate file into the elastic container instance.

5. The method according to claim 4, characterized in that After saving the new certificate file in the elastic container instance, the method further includes: The second annotation in the instance management object is updated to a second string; the second string is used to indicate that the certificate file in the elastic container instance has been updated.

6. The method according to claim 1, characterized in that The method further comprises: In the event that the first annotation and the expected value of the subject alternative name are inconsistent, determining that the subject alternative name is modified; In a case where the first annotation is consistent with the expected value of the subject alternative name, it is determined that the subject alternative name has not been modified.

7. A certificate updating device, characterized in that: The device comprises: A custom resource module, used to define and create a certificate management object of the cluster, wherein the certificate management object is of a first custom resource type; An annotation acquisition module, used to acquire the first annotation and the expected value of the subject alternative name in the certificate management object; A certificate management module, used to generate a current certificate file including a subject alternative name using the certificate management object, and save the current certificate file to the cluster; and when it is determined that the subject alternative name is modified according to the first annotation and the subject alternative name expected value, generate a new certificate file according to the subject alternative name expected value and the current certificate file using the certificate management object; and replace the current certificate file with the new certificate file.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images