Certificate updating method and device, computer device, readable storage medium and program product

Abstract

The application relates to a certificate updating method and device, a computer device, a computer readable storage medium and a computer program product. The method comprises the following steps: defining and creating a certificate management object of a first custom resource type of a cluster; generating a current certificate file containing a subject alternative name by using the certificate management object, and saving the current certificate file to the cluster; obtaining a first annotation and a subject alternative name expected value in the certificate management object; in the case that the subject alternative name is determined to be modified according to the first annotation and the subject alternative name expected value, generating a new certificate file according to the subject alternative name expected value and the current certificate file by using the certificate management object; and replacing the current certificate file by using the new certificate file. By creating the certificate management object, a user only needs to modify the subject alternative name expected value in the certificate management object, and the system can automatically realize updating of the cluster certificate, and the whole cluster control plane does not need to be reconstructed, so that the stability of the cluster is improved.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a certificate renewal method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] Digital certificates are digital authentication credentials used in internet communications to identify the parties involved and ensure secure communication. In Kubernetes (a container orchestration platform) clusters, cluster certificates are used to ensure secure communication and user authentication between different cluster components. Changes in business requirements during cluster usage may necessitate updating the cluster certificate. For example, when a user accesses cluster resources via an Elastic IP (EIP), the cluster certificate must be updated first. Cluster certificates are closely linked to the cluster initialization process; changing the cluster certificate typically requires deleting and rebuilding the entire cluster control plane. This approach can cause temporary cluster unavailability and impact cluster stability. Summary of the Invention

[0003] Therefore, it is necessary to provide a certificate update method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can improve cluster stability in response to the above-mentioned technical problems.

[0004] In a first aspect, this application provides a certificate renewal method, the method comprising:

[0005] Define and create a certificate management object for the cluster, wherein the certificate management object is a first custom resource type;

[0006] The certificate management object is used to generate a current certificate file containing alternative subject names, and the current certificate file is saved to the cluster.

[0007] Obtain the first annotation and the expected value of the subject alternative name from the certificate management object;

[0008] If it is determined from the first annotation and the second annotation that the alternative subject name has been modified, a new certificate file is generated using the certificate management object based on the expected value of the alternative subject name and the current certificate file.

[0009] Replace the current certificate file with the new certificate file.

[0010] In one embodiment, generating a new certificate file using the certificate management object based on the expected value of the subject alternative name and the current certificate file includes:

[0011] Obtain the certificate information and key information from the current certificate file;

[0012] Obtain the expected value of the alternative subject name from the certificate management object;

[0013] A new certificate file is generated based on the expected value of the alternative subject name, the certificate information, and the key information.

[0014] In one embodiment, prior to defining and creating the certificate management object for the cluster, the method further includes:

[0015] The cluster and at least one elastic container instance are created using a container orchestration engine, with the elastic container instance serving as the master node of the cluster.

[0016] In one embodiment, the method further includes:

[0017] Define and create an instance management object, wherein the instance management object is a second custom resource type;

[0018] After replacing the current certificate file with the new certificate file, the second annotation in the instance management object is updated to the first string; the first string is used to indicate that the certificate file in the cluster has been updated.

[0019] The instance update interface of the instance management object is invoked to save the new certificate file into the elastic container instance.

[0020] In one embodiment, after saving the new certificate file to the elastic container instance, the method further includes:

[0021] Update the second annotation in the instance management object to a second string; the second string is used to indicate that the certificate file in the elastic container instance has been updated.

[0022] In one embodiment, the method further includes:

[0023] If the first annotation and the expected value of the alternative topic name are inconsistent, it is determined that the alternative topic name has been modified;

[0024] If the first annotation and the expected value of the alternative topic name are consistent, it is determined that the alternative topic name has not been modified.

[0025] Secondly, this application also provides a certificate renewal device, the device comprising:

[0026] A custom resource module is used to define and create certificate management objects for the cluster, wherein the certificate management objects are the first custom resource type;

[0027] The annotation acquisition module is used to acquire the first annotation and the expected value of the subject alternative name in the certificate management object;

[0028] The certificate management module is used to generate a current certificate file containing a subject alternative name using the certificate management object, and save the current certificate file to the cluster; and when it is determined that the subject alternative name has been modified based on the first annotation and the expected value of the subject alternative name, a new certificate file is generated using the certificate management object based on the expected value of the subject alternative name and the current certificate file; and the new certificate file is used to replace the current certificate file.

[0029] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the certificate update method provided in any of the above embodiments.

[0030] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the certificate update method provided in any of the above embodiments.

[0031] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the certificate update method provided in any of the above embodiments.

[0032] The aforementioned certificate update method, apparatus, computer equipment, computer-readable storage medium, and computer program product define and create a certificate management object for the cluster. Using this object, a current certificate file containing a subject alternative name is generated and saved to the cluster. The method retrieves the first annotation and the expected value of the subject alternative name from the certificate management object. If, based on the first annotation and the expected value, the subject alternative name has been modified, a new certificate file is generated using the certificate management object, based on the expected value and the current certificate file. This new certificate file then replaces the current certificate file, enabling real-time updates of the cluster certificate. This allows users to access cluster resources via EIP, improving cluster availability. Furthermore, by defining and creating a certificate management object using a custom resource type, and having this object handle the generation and updating of cluster certificates, users only need to modify the subject alternative name within the certificate management object. The system then automatically generates a new certificate file and replaces the existing one, updating the cluster certificate without rebuilding the cluster control plane, thus improving cluster stability. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a flowchart illustrating a certificate update method in one embodiment;

[0035] Figure 2 This is a flowchart illustrating the process of generating a new certificate file based on the expected value of the subject alternative name and the current certificate file using a certificate management object in one embodiment.

[0036] Figure 3 This is an application architecture diagram of a certificate update method in one embodiment;

[0037] Figure 4 This is a flowchart illustrating a certificate update method in another embodiment;

[0038] Figure 5 This is a flowchart illustrating a certificate update method provided in a more specific embodiment;

[0039] Figure 6 A flowchart illustrating a certificate update method provided in another more specific embodiment;

[0040] Figure 7 This is a structural block diagram of a certificate update device in one embodiment;

[0041] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0043] In Kubernetes (a container orchestration platform) clusters, cluster certificates are used to ensure secure communication and user authentication between different cluster components. Changes in business requirements during cluster usage may necessitate updating the cluster certificate. For example, users might need to access cluster resources via EIPs. Cluster certificates are closely tied to the cluster initialization process; changing a cluster certificate typically requires deleting and rebuilding the entire cluster control plane. This approach renders the cluster temporarily unavailable, impacting its stability.

[0044] Based on this, such as Figure 1 As shown, this application provides a certificate renewal method, including the following steps 102 to 110.

[0045] Step 102: Define and create a certificate management object for the cluster. The certificate management object is the first custom resource type.

[0046] Custom Resource Definitions (CRDs) are a mechanism in Kubernetes that allows users to define new resource types based on their business needs. CRDs can be used to define certificate management objects, specifying configuration information such as version, name, and scope. After defining a certificate management object, an instance of that object can be created, and its status can be monitored through a certificate management object controller.

[0047] Step 104: Use the certificate management object to generate a current certificate file containing the alternative subject name, and save the current certificate file to the cluster.

[0048] Subject Alternative Names (SANs) are an extended field in X.509 format certificates, allowing the specification of multiple identities, such as multiple domain names, IP addresses, and email addresses. The certificate management object contains configuration information for the Subject Alternative Names and configures the PKI (Public Key Infrastructure). The current certificate file contains the CA (Certification Authority) certificate, CA key, API (Application Programming Interface) server certificate, and API server key.

[0049] Specifically, a CA certificate and CA key can be automatically generated using a certificate management object. Based on the alternative subject name, CA certificate, and CA key provided by the certificate management object, an API server certificate and API server key are then generated. Finally, the CA certificate, CA key, API server certificate, and API server key are packaged into a current certificate file. This current certificate file can be stored in the cluster as a PKI secret.

[0050] Step 106: Obtain the first annotation and the expected value of the subject alternative name in the certificate management object.

[0051] Annotations are part of the data in a certificate management object, allowing users to store additional non-identifying metadata. The first annotation can be used to indicate the subject alternate name corresponding to the certificate currently allowed to log in to the cluster. The expected value for the subject alternate name is the user-modified subject alternate name. For example, the `specSANs` field in the certificate management object can be used as the expected value for the subject alternate name; the `specSANs` field is open to both the user and upstream systems and can be modified by either the user or the upstream system. The `oldSANs` field in the certificate management object can be used as the first annotation.

[0052] Step 108: If it is determined that the subject alternative name has been modified based on the first annotation and the expected value of the subject alternative name, a new certificate file is generated using the certificate management object based on the expected value of the subject alternative name and the current certificate file.

[0053] When the alternate subject name needs to be modified, the upstream system (such as the cluster management platform) will modify the expected value of the alternate subject name for the certificate management object. Therefore, the first annotation and the expected value of the alternate subject name can be used to determine whether the alternate subject name has been modified. After confirming that the alternate subject name has been modified, in order to ensure that the new IP can access cluster resources normally, a new certificate file needs to be generated based on the expected value of the alternate subject name and the current certificate file.

[0054] Step 110: Replace the current certificate file with the new certificate file.

[0055] After generating a new certificate file, the current certificate file in the cluster can be replaced with the new certificate file to complete the certificate update for the cluster.

[0056] In this embodiment, a certificate management object (CMA) for the cluster is defined and created. This CMA generates a current certificate file containing alternative subject names and saves it to the cluster. The first annotation and the expected value of the alternative subject name are obtained from the CMA. If the expected value indicates that the alternative subject name has been modified, the CMA generates a new certificate file based on the expected value and the current certificate file. This new certificate file then replaces the current certificate file, enabling real-time updates of the cluster certificate. Users can then utilize EIPs to access cluster resources, improving cluster availability. Furthermore, by defining and creating a CMA using a custom resource type, the CMA is responsible for generating and updating cluster certificates. Users only need to modify the alternative subject name in the CMA, and the system can automatically generate a new certificate file and replace the existing one without rebuilding the cluster control plane, thus improving cluster stability.

[0057] In one embodiment, such as Figure 2As shown, a new certificate file is generated using the certificate management object based on the expected value of the subject alternate name and the current certificate file, including steps 202-206.

[0058] Step 202: Obtain the certificate information and key information from the current certificate file.

[0059] The current certificate file contains information such as the CA certificate, CA key, API server certificate, and API server key. The certificate information we need to obtain here refers to the CA certificate, and the key information we need to obtain refers to the CA key.

[0060] Step 204: Obtain the expected value of the subject alternative name from the certificate management object.

[0061] Users can directly modify the alternate subject name in the certificate management object. Therefore, the expected value of the alternate subject name can be obtained from the certificate management object by calling the API interface.

[0062] Step 206: Generate a new certificate file based on the expected value of the alternative subject name, certificate information, and key information.

[0063] The certificate management object can be used to generate a new API server certificate and a new API server key based on the expected value of the subject alternate name, the CA certificate, and the CA key. The CA certificate, CA key, new API server certificate, and new API server key are then packaged into a new certificate file, updating the PKI secret in the cluster.

[0064] In this embodiment, by obtaining the certificate information and key information in the current certificate file, the expected value of the subject alternative name is obtained from the certificate management object, and a new certificate file is generated based on the expected value of the subject alternative name, the certificate information, and the key information, thus realizing the automatic update of the cluster certificate file using the certificate management object.

[0065] In one embodiment, before defining and creating the certificate management object for the cluster, the certificate update method of this application further includes the step of creating the cluster and at least one elastic container instance using a container orchestration engine.

[0066] The certificate update method in this embodiment can be applied to, for example... Figure 3 In the application architecture shown, the upstream system can be a cluster management platform, a cluster instance created by a serverless container engine, or a cloud service provider. The certificate management object is responsible for generating and updating cluster certificates, while the container management object manages the creation, modification, and deletion of elastic container instances. The upstream system, certificate management object, and container management object can communicate via API interfaces.

[0067] Elastic Container Instance (ECI) is a fully managed, lightweight container instance service. Users do not need to manage the underlying servers or worry about capacity planning during operation; they only need to provide a packaged Docker image to run containers. Common container orchestration tools such as Kubernetes, Docker Swarm, or Apache Mesos can be used to define and create clusters and at least one ECI. Clusters can be managed. Managed clusters are created using a Serverless Container Engine (SCE). The Serverless Container Engine introduces the serverless concept to container engines; users do not need to purchase nodes, maintain cluster nodes, or plan capacity, but only need to upload container images to SCE. The cluster control plane of the managed cluster is created by SCE and hosted in the cloud service provider's environment; users only need to create worker nodes. In a managed cluster, the ECI can act as the master node. Each ECI runs the cluster's basic components, such as the kube-apiserver and kube-scheduler components.

[0068] In one embodiment, such as Figure 4 As shown, the certificate update method of this application also includes steps 402-406.

[0069] Step 402: Define and create an instance management object, which is a second custom resource type.

[0070] The second custom resource type is also a resource type created using custom resources, and it is a different resource type from the first custom resource type. Custom resources can be used to define instance management objects, specifying their version, name, scope, and other related information. Instance management objects are responsible for creating, updating, and deleting elastic container instances. After defining an instance management object, instances of that object can be created, and their status can be monitored through the instance management object controller.

[0071] Step 404: After replacing the current certificate file with the new certificate file, update the second annotation in the instance management object to the first string.

[0072] The first string indicates that the certificate file in the cluster has been updated. After the current certificate file is replaced with the new certificate file, the upstream system can update the second annotation in the instance management object to the first string to trigger the tuning process of the instance management object controller.

[0073] Step 406: Call the instance update interface of the instance management object to save the new certificate file to the elastic container instance.

[0074] The instance update interface is a component within the instance management object used to update instance certificates. After the instance management object controller detects that the second annotation has been updated to the first string, it can obtain the new certificate file through the corresponding API interface and call the instance update interface of the instance management object to save the new certificate file within the elastic container instance, thus updating the instance certificate.

[0075] In this embodiment, by defining and creating an instance management object, replacing the current certificate file with a new one, updating the second annotation in the instance management object to the first string, and calling the instance update interface of the instance management object, the new certificate file is saved to the elastic container instance, ensuring that the certificate in the elastic container instance is consistent with the cluster certificate. By using custom resources to create an instance management object to manage elastic container instances, the maintainability of the system is improved, providing users with more stable and efficient control plane support.

[0076] In one embodiment, after saving the new certificate file to the Elastic Container Instance, the second annotation in the instance management object can also be updated to the second string. The second string indicates that the certificate file in the Elastic Container Instance has been updated. It can be understood that after saving the new certificate file to the Elastic Container Instance, the upstream system can also update the second annotation in the instance management object to the second string to indicate that the instance management object controller ECI certificate has been updated to the latest version and is consistent with the cluster certificate.

[0077] In one embodiment, if the first annotation and the expected value of the alternative topic name are inconsistent, it can be determined that the alternative topic name has been modified; if the first annotation and the expected value of the alternative topic name are consistent, it can be determined that the alternative topic name has not been modified.

[0078] In a more specific embodiment, the flowchart of the certificate update method of this application is as follows: Figure 5 As shown.

[0079] First, define and create a certificate management object SKC (full name serverless Kubernetes cert). The SKC object contains a field corresponding to the topic alternate name, namely the SANs field.

[0080] Then, the tuning process for the SKC object begins:

[0081] First, check if the first annotation exists in the SKC object. If the first annotation does not exist, add the first annotation "serverless.ccse.ctyn.cn / v1.skc.sans.old". If the first annotation exists, check if the PKI secret, i.e., the certificate file, exists.

[0082] If a PKI secret does not exist, generate and configure a PKI secret containing SAN information using the SKC object. If a PKI secret exists, determine whether the certificate file needs to be updated based on the first annotation and the expected value of the topic alternate name.

[0083] If the first annotation and the expected value of the subject alternative name are the same, it means that no certificate file update is needed; if the first annotation and the expected value of the subject alternative name are different, it means that the certificate file needs to be updated. A new PKI secret is regenerated based on the expected value of the subject alternative name in the SKC object and ca.crt and ca.key in the original PKI secret. The new PKI secret is then saved in the cluster, completing the update of the cluster certificate.

[0084] Optionally, in a more specific embodiment, the flowchart of the certificate update method of this application is as follows: Figure 6 As shown.

[0085] First, create a Certificate Management Object (SKC) and an Instance Management Object (CONG, short for Container Group). The SKC object contains a field corresponding to the subject alternate name, namely the SANs field.

[0086] Then, as Figure 5 As shown, the tuning process of the SKC object is completed. After generating the new PKI secret, the second annotation of the Cong object is updated to "congsRestart=true". Then, the tuning process of the Cong object begins:

[0087] First, check if an Elastic Container Instance (ECI) has been created. If no ECI exists, create two ECI instances; if an ECI exists, check if the second annotation is "congsRestart=true".

[0088] If the second annotation is "congsRestart=true", the API interface for communicating with the SKC controller or the API interface for communicating with the upstream system is called to obtain the new PKI secret. Then, the instance update interface is called to save the new PKI secret inside the ECI, and the second annotation is updated to "congsRestart=false". If the second annotation does not exist or is "congsRestart=false", the tuning process of the Cong object ends.

[0089] To better understand, a specific embodiment from a user's perspective is provided to illustrate the beneficial effects of the certificate update method of this application. Users can update the cluster certificate through the following steps:

[0090] (1) Log in to the Container Engine console, enable the ECI service, and create an SCE cluster. The SCE cluster contains two managed ECI instances.

[0091] (2) Connect to the SCE cluster using the kubectl command line tool, manually edit the SKC object, find the SANs field in the editing interface, add a new EIP, save and exit the editing interface.

[0092] (3) Check the SKC custom resource object and PKI Secret to confirm that the cluster certificate has been updated. Use the openssl command-line tool to view the details of the certificate file and confirm whether the SANs field in the certificate file contains the newly added EIP.

[0093] (4) Enter the ECI instance virtual machine, check the certificate of Apiserver, confirm that the certificate is consistent with the latest cluster certificate maintained by SKC object, and confirm that the SANs field in the certificate contains the newly added EIP.

[0094] (5) Use EIP to access the cluster's API server, observe whether the access is normal, and confirm that the cluster node information can be successfully obtained.

[0095] Understandably, users only need to change the SANs field in the SKC object to dynamically update the cluster certificate and ECI instance certificate, avoiding the tedious process of deleting and rebuilding the cluster control plane. Even when business needs change, it will not affect the normal operation of the cluster, thus improving the stability of the system.

[0096] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0097] Based on the same inventive concept, this application also provides a certificate update apparatus for implementing the certificate update method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more certificate update apparatus embodiments provided below can be found in the limitations of the certificate update method described above, and will not be repeated here.

[0098] In one exemplary embodiment, such as Figure 7 As shown, a certificate update device is provided, including: a custom resource module 702, an annotation acquisition module 704, and a certificate management module 706, wherein:

[0099] Custom resource module 702 is used to define and create the certificate management object for the cluster. The certificate management object is the first custom resource type.

[0100] Annotation acquisition module 704 is used to acquire the first annotation and expected value of the subject alternative name in the certificate management object;

[0101] The certificate management module 706 is used to generate a current certificate file containing the subject alternative name using the certificate management object and save the current certificate file to the cluster; and when it is determined that the subject alternative name has been modified based on the first annotation and the expected value of the subject alternative name, it uses the certificate management object to generate a new certificate file based on the expected value of the subject alternative name and the current certificate file; and replaces the current certificate file with the new certificate file.

[0102] In one embodiment, the certificate management module is further configured to obtain certificate information and key information from the current certificate file; obtain the expected value of the subject alternative name from the certificate management object; and generate a new certificate file based on the expected value of the subject alternative name, the certificate information, and the key information.

[0103] In one embodiment, the certificate update apparatus further includes a container orchestration module. The container orchestration module is used to create a cluster and at least one elastic container instance using a container orchestration engine, with the elastic container instance serving as the master node of the cluster.

[0104] In one embodiment, the certificate update apparatus further includes an instance management module. The instance management module defines and creates an instance management object, which is a second custom resource type; after replacing the current certificate file with a new certificate file, it updates the second annotation in the instance management object to a first string; the first string indicates that the certificate file in the cluster has been updated; and it calls the instance update interface of the instance management object to save the new certificate file to the elastic container instance.

[0105] In one embodiment, the instance management module is further configured to update the second annotation in the instance management object to a second string; the second string is used to indicate that the certificate file in the elastic container instance has been updated.

[0106] In one embodiment, the certificate management module is further configured to determine that the subject alternative name has been modified if the first annotation and the expected value of the subject alternative name are inconsistent; and to determine that the subject alternative name has not been modified if the first annotation and the expected value of the subject alternative name are consistent.

[0107] Each module in the aforementioned certificate update device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can invoke and execute the corresponding operations of each module.

[0108] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 8As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When executed by the processor, the computer program implements a certificate renewal method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0109] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0110] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the certificate update method provided in any of the above embodiments.

[0111] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the certificate update method provided in any of the above embodiments.

[0112] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the certificate update method provided in any of the above embodiments.

[0113] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0114] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0115] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A certificate updating method characterized by comprising: The method includes: Define and create a certificate management object for the cluster, wherein the certificate management object is a first custom resource type; The certificate management object is used to generate a current certificate file containing alternative subject names, and the current certificate file is saved to the cluster; the current certificate file includes a CA certificate, a CA key, an API server certificate, and an API server key; Obtain the first annotation and the expected value of the subject alternate name from the certificate management object; the first annotation is used to indicate the subject alternate name corresponding to the certificate currently allowed to log in to the cluster; the expected value of the subject alternate name is the subject alternate name modified by the user. If it is determined that the topic alternative name has been modified based on the first annotation and the expected value of the topic alternative name, obtain the CA certificate and CA key from the current certificate file; obtain the expected value of the topic alternative name from the certificate management object; generate a new API server certificate and a new API server key based on the expected value of the topic alternative name, the CA certificate and the CA key, and package the CA certificate, the CA key, the new API server certificate and the new API server key into a new certificate file; Replace the current certificate file with the new certificate file.

2. The method of claim 1, wherein, Before defining and creating the certificate management object for the cluster, the method further includes: The cluster and at least one elastic container instance are created using a container orchestration engine, with the elastic container instance serving as the master node of the cluster.

3. The method according to claim 2, characterized in that, The method further includes: Define and create an instance management object, wherein the instance management object is a second custom resource type; After replacing the current certificate file with the new certificate file, the second annotation in the instance management object is updated to the first string; the first string is used to indicate that the certificate file in the cluster has been updated. The instance update interface of the instance management object is invoked to save the new certificate file into the elastic container instance.

4. The method according to claim 3, characterized in that, After saving the new certificate file to the elastic container instance, the method further includes: Update the second annotation in the instance management object to a second string; the second string is used to indicate that the certificate file in the elastic container instance has been updated.

5. The method according to claim 1, characterized in that, The method further includes: If the first annotation and the expected value of the alternative topic name are inconsistent, it is determined that the alternative topic name has been modified; If the first annotation and the expected value of the alternative topic name are consistent, it is determined that the alternative topic name has not been modified.

6. A certificate renewal device, characterized in that, The device includes: A custom resource module is used to define and create certificate management objects for the cluster, wherein the certificate management objects are the first custom resource type; The annotation acquisition module is used to acquire the first annotation and the expected value of the subject alternative name in the certificate management object; the first annotation is used to indicate the subject alternative name corresponding to the certificate currently allowed to log in to the cluster; the expected value of the subject alternative name is the subject alternative name modified by the user. The certificate management module is used to generate a current certificate file containing a subject alternative name using the certificate management object, and save the current certificate file to the cluster; the current certificate file includes a CA certificate, a CA key, an API server certificate, and an API server key; and, if it is determined that the subject alternative name has been modified based on the first annotation and the expected value of the subject alternative name, the module retrieves the CA certificate and CA key from the current certificate file; retrieves the expected value of the subject alternative name from the certificate management object; generates a new API server certificate and a new API server key based on the expected value of the subject alternative name, the CA certificate, and the CA key, and packages the CA certificate, CA key, the new API server certificate, and the new API server key into a new certificate file; and replaces the current certificate file with the new certificate file.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images