Operation and maintenance environment configuration method, equipment, medium and product

Abstract

The embodiment of the invention provides an operation and maintenance environment configuration method and device, a medium and a product. The method comprises the following steps: a server obtains a screening condition sent by a client; determining authority information corresponding to the user information according to a first preset table and the user information in the screening condition; according to the permission information and object information in the screening condition, target objects in the k8s cloud platform are determined, the target objects comprise a target cluster and / or a target namespace, and the target objects are objects meeting the permission information in the object information; generating a configuration file according to a target object in the k8s cloud platform; and sending the configuration file to the client, so that the client configures the manipulator environment according to the configuration file. The method is used for achieving the effect of improving the operation and maintenance environment configuration efficiency.

Description

Technical Field

[0001] The present application relates to the field of operation and maintenance, and in particular to an operation and maintenance environment configuration method, equipment, medium and product. Background Art

[0002] In the era of cloud computing, uploading resources to a cloud container platform is an important means. There are multiple clusters in the cloud container platform. Storing application resources in the cluster allows users to use the resources stored in the cluster after being authenticated by the cloud container platform.

[0003] As an open source container scheduling platform, Kubernetes is widely used in various private cloud container cloud platforms. Various resources in Kubernetes are manually configured when used. The kubeconfig file of the cluster is manually obtained and then manually uploaded to the operating machine.

[0004] However, for multiple clusters, the steps for manually obtaining resources in the cluster are very cumbersome, and there is a problem of low efficiency in the configuration of the operation and maintenance environment. Summary of the invention

[0005] The embodiments of the present application provide an operation and maintenance environment configuration method, device, medium and product to achieve the effect of improving the efficiency of operation and maintenance environment configuration.

[0006] In a first aspect, an embodiment of the present application provides an operation and maintenance environment configuration method, which is applied to a server side, wherein a first preset table is provided in the server side, and the first preset table includes users, user permissions, and a correspondence between users and permissions, including:

[0007] Get the filter conditions sent by the client;

[0008] Determine the permission information corresponding to the user information according to the first preset table and the user information in the screening condition;

[0009] According to the permission information and the object information in the screening conditions, determine the target object in the k8s cloud platform, the target object includes the target cluster and / or the target namespace, and the target object is the object that meets the permission information in the object information;

[0010] Generate configuration files based on the target objects in the k8s cloud platform;

[0011] The configuration file is sent to the client so that the client can configure the operating machine environment according to the configuration file.

[0012] In a possible implementation, a second preset table is provided in the server side, and the second preset table includes cluster information of the cluster in the k8s cloud platform and space information of the namespace in the cluster;

[0013] According to the permission information and the object information in the screening conditions, the target object in the k8s cloud platform is determined, including:

[0014] According to the permission information and the object information in the screening conditions, the target object in the k8s cloud platform is determined from the second preset table.

[0015] In a possible implementation, according to the permission information and the object information in the screening condition, determining the target object in the k8s cloud platform from the second preset table includes:

[0016] According to the object information in the screening condition, determine the initial target object in the k8s cloud platform from the second preset table;

[0017] According to the permission information, the target object in the k8s cloud platform is determined from the initial target object, wherein when the permission information corresponding to the user information is the first permission level, the target object includes the target cluster; when the permission information corresponding to the user information is the second permission level, the target object includes the target namespace.

[0018] In a possible implementation, a configuration file is generated according to a target object in a k8s cloud platform, including:

[0019] According to the access rule information in the k8s cloud platform, determine the access authentication information of the target object in the k8s cloud platform;

[0020] Generate a configuration file corresponding to the target object in the k8s cloud platform based on the access authentication information.

[0021] In a second aspect, an embodiment of the present application provides an operation and maintenance environment configuration method, which is applied to a client, and the method includes:

[0022] In response to the user's operation, a screening condition is obtained;

[0023] Send the screening condition to the server, so that the server determines the permission information corresponding to the user information according to the first preset table and the user information in the screening condition; determines the target object in the k8s cloud platform according to the permission information and the object information in the screening condition, the target object includes the target cluster and / or the target namespace, and the target object is the object that satisfies the permission information in the object information; generates a configuration file according to the target object in the k8s cloud platform;

[0024] Get the configuration file sent by the server;

[0025] Configure the operating machine environment according to the configuration file.

[0026] In a possible implementation, after obtaining the configuration file sent by the server, and before configuring the operating machine environment according to the configuration file, the method further includes:

[0027] Get the current process information and the timestamp information corresponding to the current process information;

[0028] According to the current process information and timestamp information, the configuration file is stored in the target file, wherein different configuration files correspond to different stored target files.

[0029] In a third aspect, an embodiment of the present application provides an operation and maintenance environment configuration device, including:

[0030] A first acquisition module is used to acquire the screening conditions sent by the client;

[0031] A first processing module, used to determine the permission information corresponding to the user information according to the first preset table and the user information in the screening condition;

[0032] The second processing module is used to determine the target object in the k8s cloud platform according to the permission information and the object information in the screening condition, the target object includes a target cluster and / or a target namespace, and the target object is an object that satisfies the permission information in the object information;

[0033] The third processing module is also used to generate a configuration file according to the target object in the k8s cloud platform;

[0034] The control module is used to send the configuration file to the client so that the client can configure the operating machine environment according to the configuration file.

[0035] In a fourth aspect, an embodiment of the present application provides an operation and maintenance environment configuration device, including:

[0036] A response module, used to obtain screening conditions in response to user operations;

[0037] The fourth processing module is used to send the screening condition to the server, so that the server determines the permission information corresponding to the user information according to the first preset table and the user information in the screening condition; determines the target object in the k8s cloud platform according to the permission information and the object information in the screening condition, the target object includes a target cluster and / or a target namespace, and the target object is an object that satisfies the permission information in the object information; generates a configuration file according to the target object in the k8s cloud platform;

[0038] The second acquisition module is used to acquire the configuration file sent by the server;

[0039] The configuration module is used to configure the operating machine environment according to the configuration file.

[0040] In a fifth aspect, an embodiment of the present application provides an operation and maintenance environment configuration device, including: a memory, a processor;

[0041] Memory stores computer-executable instructions;

[0042] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0043] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0044] In a seventh aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0045] An operation and maintenance environment configuration method, device, medium and product provided in an embodiment of the present application, wherein a first preset table is provided in a server side, the first preset table including users, user permissions, and a correspondence between users and permissions, and the server side obtains the filtering conditions sent by the client side so that the user's operation and maintenance needs are processed by the server side, and then the permission information corresponding to the user information is determined according to the user information in the first preset table and the filtering conditions, thereby limiting the user's permission scope, and then the target object in the k8s cloud platform is determined according to the permission information and the object information in the filtering conditions, the target object including the target cluster and / or the target namespace, the target object being an object that satisfies the permission information in the object information, so that the server side filters out the resources required by the user according to the user's operation and maintenance needs, and then generates a configuration file according to the target object in the k8s cloud platform and sends it to the client side, so that the client side configures the operating machine environment according to the configuration file, thereby improving the efficiency of the operation and maintenance environment configuration. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0047] Figure 1 A schematic diagram of a scenario of an operation and maintenance environment configuration method provided in this application;

[0048] Figure 2 A schematic diagram of the process of configuring an operation and maintenance environment provided for this application Figure 1 ;

[0049] Figure 3 A schematic diagram of the process of configuring an operation and maintenance environment provided for this application Figure 2 ;

[0050] Figure 4A schematic diagram of the process of configuring an operation and maintenance environment provided for this application Figure 3 ;

[0051] Figure 5 A schematic diagram of the process of configuring an operation and maintenance environment provided for this application Figure 4 ;

[0052] Figure 6a Result diagram of an operation and maintenance environment configuration method provided in this application Figure 1 ;

[0053] Figure 6b Result diagram of an operation and maintenance environment configuration method provided in this application Figure 2 ;

[0054] Figure 6c Result diagram of an operation and maintenance environment configuration method provided in this application Figure 3 ;

[0055] Figure 7 A schematic diagram of the structure of an operation and maintenance environment configuration device provided in this application Figure 1 ;

[0056] Figure 8 A schematic diagram of the structure of an operation and maintenance environment configuration device provided in this application Figure 2 ;

[0057] Fig. 9 A schematic diagram of the structure of an operation and maintenance environment configuration device provided for this application.

[0058] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0059] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0060] First, the terms involved in this application are explained:

[0061] Cloud computing platform: also known as cloud platform, refers to services based on hardware resources and software resources, providing computing, network and storage capabilities, hiding the hardware implementation and management details from users. Users only need to send requests to the cloud platform to get different levels and types of resource services;

[0062] Kubernetes: Also known as k8s, it is an open source project for automatically deploying, scaling, and managing containerized applications. It can be freely deployed within the enterprise, in private clouds, hybrid clouds, or public clouds.

[0063] RBAC: An access control mechanism that mainly includes ClusterRole, Role, ClusterRoleBinding, RoleBinding, ServiceAccount, and Secret components. It controls the access of users and service accounts to Kubernetes resources by binding roles and permissions. RBAC includes the access rule information that appears in the embodiments of this application.

[0064] ClusterRole: A set of permissions that can be used across the entire cluster, allowing access to cluster-wide resources such as nodes and namespaces;

[0065] Role: is a set of permissions that allows access to resources within a namespace, such as workloads and secrets, but is only valid within a specific namespace;

[0066] ClusterRoleBinding: Binds a ClusterRole to a user, group, or service account so that it has the permissions defined by the ClusterRole across the entire cluster. That is, the permissions of the ClusterRole can be granted to users or service accounts within the cluster.

[0067] RoleBinding: Bind a Role to a user, group, or service account so that it has the permissions defined by the Role in a specific namespace. That is, the permissions of the Role can be granted to users or service accounts in a certain namespace.

[0068] ServiceAccount: A special account used by Pods running in a Kubernetes cluster. It is mainly used for authentication and access control within the cluster. It can access cluster-wide resources through appropriate configuration.

[0069] Secret: used to store and manage sensitive information, such as passwords and SSH keys, and pass sensitive data to Pods instead of writing the data directly into the Pod definition;

[0070] Pod: It is the basic unit for encapsulating and running application containers in Kubernetes. It provides a mechanism to manage, schedule, and coordinate the operation of containers.

[0071] Certificate Authority: CA is a trusted entity that issues digital certificates. Certificates issued by CA can be used to prove the identities of both parties in communication. In Kubernetes, CA is used to issue certificates for various components and users to ensure the security of communication, thereby ensuring the security and identity authentication of communication between various components in the cluster.

[0072] Certificate-Authority-Data: is a Base64-encoded CA certificate used to verify the certificate of the Kubernetes API server. In the kubeconfig file, the certificate-authority-data field stores the CA certificate to ensure that the communication is secure and trustworthy.

[0073] Token: A token is a credential used for identity authentication. The token used by Kubernetes can be a static token or a dynamically created Service Account Token. When the client requests the API server, it can use the token as a credential for identity authentication.

[0074] API Server: The core component of the Kubernetes cluster, responsible for processing RESTful API requests and coordinating all operations in the cluster. It is the entry point of the Kubernetes control plane. All management operations are performed through it. It processes requests from clients and forwards them to the corresponding components.

[0075] CMDB (Configuration Management Database): used to store and manage configuration information related to IT infrastructure;

[0076] kubeconfig file: a configuration file used by Kubernetes to store cluster access information. It contains various information required to access the Kubernetes cluster, such as cluster address, authentication information, context, etc. The kubeconfig file includes the configuration files that appear in the embodiments of this application;

[0077] Context: In kubernetes, users can operate and maintain kubernetes clusters through each context in the kubeconfig configuration file. Context, as the operation and maintenance environment context, contains information such as cluster, user, namespace, etc. Multiple contexts can be configured in one kubeconfig file and can be switched freely through the kubectl tool;

[0078] MD5 value: Message-Digest Algorithm 5, Message Digest Algorithm Version 5, a cryptographic hash function used to encrypt information.

[0079] In a multi-container cloud platform and multi-cluster environment, traditional Kubernetes cluster operation and maintenance tools require manual management of kubeconfig files and lack automated permission control, making operation and maintenance work cumbersome and complicated. With the growing trend of cloud migration and the demand for disaster recovery in application systems, the number of Kubernetes clusters continues to increase. Especially in scenarios where it is necessary to frequently switch between different operation and maintenance environments and control different user permissions, it is difficult to control the operation and maintenance scope by manually configuring the operation and maintenance environment. It is also difficult to quickly divide operation permissions for different operation and maintenance requirements, resulting in low efficiency in the configuration of the operation and maintenance environment.

[0080] The present application provides a method for configuring an operation and maintenance environment. Since the configuration file of the cluster in the k8s cloud platform is manually obtained and then manually uploaded to the operating machine, the efficiency of configuring the operation and maintenance environment is too low. Therefore, the client is used to collect the screening conditions formed by the user's operation and maintenance needs and send them to the server. In order for the server to filter out the configuration environment required by the user, a first preset table is provided in the server. The first preset table stores users, user permissions, and the correspondence between users and permissions. After comparing the first preset table with the user information, the server can determine the permission information corresponding to the user information, thereby determining the scope of permissions that different users can operate. Then, according to the permission information and the object information in the screening conditions, the target cluster and / or target namespace in the k8s cloud platform is determined. The target cluster and / or target namespace is the target object that meets the permission information, thereby distinguishing the operation and maintenance needs of each user. The server generates a configuration file based on the target object in the k8s cloud platform and sends it to the client, so that the client configures the operating machine environment according to the configuration file, thereby solving the problem of low efficiency in configuration of the operation and maintenance environment.

[0081] Figure 1 A scenario diagram of an operation and maintenance environment configuration method provided for this application, such as Figure 1As shown, the execution subject of the method can be an operation and maintenance environment configuration system, wherein the operation and maintenance environment configuration system includes a client, a server, and a k8s cloud platform, wherein the server can refer to a computer or program that provides services, which can be used to listen to a specific network port, wait for a connection request from a client, and respond to a request from a client. The client can refer to a computer or program that consumes services, which can be used to actively initiate a connection request to the server and receive a response from the server. The client can be various types of devices and applications, such as a browser, a mobile application, or a desktop application. The client communicates with the server through a secure network connection, and the server interacts directly with the API server of the K8s cloud platform to manage K8s resources. The client establishes a connection with the K8s cloud platform through a configuration file generated by the server.

[0082] In the embodiment of the present application, the client is a command line tool on the user's remote operation and maintenance machine. The object storage provides the client with the latest tools, tool configuration files, and version control tools. The command line tool automatically configures the kubeconfig file that meets the screening conditions locally through the tool server to obtain the operation and maintenance permissions of the k8s cluster. The server is responsible for generating kubeconfig files, user permission management, etc., and sending the generated kubeconfig files to the client.

[0083] This embodiment does not impose any special restrictions on the implementation method of the execution subject, as long as the execution subject can obtain the filtering conditions sent by the client; determine the permission information corresponding to the user information based on the first preset table and the user information in the filtering conditions; determine the target object in the k8s cloud platform based on the permission information and the object information in the filtering conditions, the target object includes the target cluster and / or the target namespace, and the target object is the object that satisfies the permission information in the object information; generate a configuration file based on the target object in the k8s cloud platform; send the configuration file to the client, so that the client can configure the operating machine environment according to the configuration file.

[0084] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0085] Figure 2 A schematic diagram of the process of configuring an operation and maintenance environment provided for this application Figure 1 , applied to the server side, the server side is provided with a first preset table, the first preset table includes users, user permissions, and the corresponding relationship between users and permissions, such as Figure 2 As shown, the method includes:

[0086] S201. Obtain the filtering conditions sent by the client.

[0087] Among them, the first preset table can refer to a pre-set form used to store users, user permissions, and the correspondence between users and permissions. The user's permissions are stored in the permission information. The user information in the screening conditions can be compared with the user information in the first preset table to determine the user's permissions.

[0088] The filtering conditions may refer to conditions for narrowing the scope from a large scope. The degree of narrowing the scope depends on the application situation. In the embodiment of the present application, the filtering conditions are used to limit the scope of the user's operation and maintenance environment, including but not limited to user information, the k8s control plane to which the cluster belongs, the region to which the cluster belongs, the cluster architecture, and object information.

[0089] User information can be used to limit the authority scope of operation and maintenance personnel and divide the operation and maintenance scope into levels, so that the operation and maintenance environment of each user is isolated, and the operation and maintenance authority is isolated, to prevent operation and maintenance errors caused by the cross-operation and maintenance environment.

[0090] The k8s control plane to which the cluster belongs may refer to the control plane components and management tools for managing the Kubernetes cluster. The control plane components include the API server, scheduler, controller manager, etc., which are responsible for managing the status and resources of the cluster. The management tools include monitoring tools, log collection tools, backup and recovery tools, etc. In some embodiments, the target cluster can be screened out by searching the k8s control plane to which the cluster belongs.

[0091] The region to which the cluster belongs may refer to the geographical location or data center where the Kubernetes cluster is located. The region is usually defined by the cloud provider to describe the physical location of the cluster. In an embodiment of the present application, the target cluster can be screened out by searching the region to which the cluster belongs.

[0092] The cluster architecture may refer to the topology and design pattern of a Kubernetes cluster. In an embodiment of the present application, a target cluster may be screened out by searching the cluster architecture.

[0093] Object information can be used to identify various types of applications stored in the cluster. As the number of applications stored in the cloud platform increases, the application number in the object information can be used to facilitate search and management. In the embodiment of the present application, the object information can be used as a screening condition to find the location of the application from the k8s cloud platform, so as to allocate it to the user.

[0094] The screening conditions are generated based on the client's response to the user's operation, which may refer to the client automatically collecting the operation and maintenance requirements required by the user to form the screening conditions, which can be entered from the command window or imported from the requirement document. In an embodiment of the present application, the user enters the operation and maintenance requirements in the client command line, and the client automatically forms a file of screening conditions with the collected operation and maintenance requirements and sends it to the server. There is no limit on the number of conditions in the screening conditions, and the file can be generated according to the different number of conditions of different users. For example, user A queries the cluster whose K8S control plane is k8s-cluster-manager and the cluster belongs to the us-west-1 region. The client stores k8s-cluster-manager and us-west-1 as a file and sends it to the server as a screening condition for query.

[0095] S202: Determine the authority information corresponding to the user information according to the first preset table and the user information in the screening condition.

[0096] Among them, user information can refer to the statistical summary of the level information of user operation and maintenance, which can be stored in a table or in data. This application does not limit the storage method and reading method of user information. User information can be read from the filtering conditions through sequential search or quick search.

[0097] Permission information may refer to the classification of user management permissions, which is used to define and distinguish operation and maintenance permissions. In an embodiment of the present application, operation and maintenance permissions are divided into cluster level or namespace level. Among them, the cluster level can implement add, delete, modify and query operations on all clusters within the scope, and access nodes, storage classes, and cluster roles within the cluster. It can also operate all command spaces within the cluster, and applications in the namespace, and usually has higher permissions. The namespace level can implement query and access operations on applications within the specified namespace scope. Namespace-level resources and permissions are only valid within a specific namespace, providing resource isolation and permission isolation, and usually have lower permissions.

[0098] In an embodiment of the present application, users can be divided into four levels, namely cluster administrators, system administrators, special users, and API users. Among them, cluster administrators and system administrators are both internal ordinary accounts. If an internal ordinary account is used to log in, the login request will be forwarded to the internal authentication system after reaching the server. When the CMDB performs resource screening, the user account information is automatically carried, and the operation and maintenance personnel account conditions are automatically added to the screening conditions. Therefore, the screening results only include clusters or namespaces for which the user has operation and maintenance permissions, thereby preventing users from exceeding their authority for operation and maintenance.

[0099] Special users refer to users with specific permissions and configurations in Kubernetes management and authorization. If a special account is used to log in, the special account already exists as a configuration item in the tool server. Then, the filter conditions entered by the user are modified according to the whitelist and blacklist information in the preset special user configuration items to ensure that the filtered clusters or namespaces meet the permission requirements. In the embodiment of the present application, special users can divide the access rights into cluster level or namespace level in the k8s cloud platform according to the actual user's needs.

[0100] API users refer to users who can directly access the Kubernetes cluster using automated tools, third-party systems, or scripts without having to log in every time.

[0101] S203. Determine the target object in the k8s cloud platform according to the permission information and the object information in the screening conditions. The target object includes a target cluster and / or a target namespace. The target object is an object in the object information that satisfies the permission information.

[0102] The object information in the filter condition may refer to a user-specified cluster, a user-specified application, and a user-specified namespace. Among the resources stored in the k8s cloud platform, when the operation and maintenance personnel determine the resources they want to access, they can filter out the target resources from the k8s cloud platform.

[0103] The target object may refer to an object filtered out according to specified requirements, and the specified requirements may refer to an object that meets the filtering conditions in the k8s cloud platform. In an embodiment of the present application, for users whose management type is cluster-level management, the target object includes filtering out the target cluster in the k8s cloud platform. For users whose management type is namespace-level management, the target object includes filtering out the target namespace in the k8s cloud platform.

[0104] In some embodiments, the target object may include a target cluster and a target namespace. In this case, after the user configures the corresponding operation and maintenance space, the user can manipulate both the target cluster and the namespace. For example, the target object includes cluster A, namespace A in cluster A, and namespace B that does not belong to cluster A. After the operation and maintenance environment is configured, the user can operate cluster A, namespace A in cluster A, and namespace B that does not belong to cluster A.

[0105] Among them, in the embodiment of the present application, a second preset table is provided in the server side, and the second preset table includes cluster information of the cluster in the k8s cloud platform and space information of the namespace in the cluster;

[0106] According to the permission information and the object information in the screening conditions, the target object in the k8s cloud platform is determined, including:

[0107] According to the permission information and the object information in the screening conditions, the target object in the k8s cloud platform is determined from the second preset table.

[0108] The second preset table may refer to a pre-set form for storing cluster information of clusters in the k8s cloud platform and space information of namespaces within the cluster, so that clusters, namespaces, and application resources in the namespaces in the k8s cloud platform are one-to-one corresponded in the second preset table for easy query and modification.

[0109] In an embodiment of the present application, the user's permissions and the object information in the filtering conditions can be compared with the information in the second preset table to filter out the target objects in the k8s cloud platform, thereby determining the k8s resources that the user can access based on the user's permissions and the resources the user wants to access.

[0110] Among them, in the embodiment of the present application, according to the permission information and the object information in the screening condition, the target object in the k8s cloud platform is determined from the second preset table, including:

[0111] According to the object information in the screening condition, determine the initial target object in the k8s cloud platform from the second preset table;

[0112] According to the permission information, the target object in the k8s cloud platform is determined from the initial target object, wherein when the permission information corresponding to the user information is the first permission level, the target object includes the target cluster; when the permission information corresponding to the user information is the second permission level, the target object includes the target namespace.

[0113] The initial target object may refer to an object selected according to the user's access requirements, such as a cluster or a namespace that the user wants to access, which can be located in the second preset table so as to determine whether the user's permissions meet the requirements and then allocate them to the user. The initial target object may include one or more clusters, one or more namespaces, or both clusters and namespaces.

[0114] The first permission level may refer to cluster-level management with higher permissions, which indicates that the user has the ability to operate clusters within the permission scope, such as creating a cluster within the permission scope, or deleting a cluster within the permission scope. The second permission level may refer to namespace-level management with lower permissions, which indicates that the user has the ability to operate namespaces within the permission scope.

[0115] For example, when an operation and maintenance personnel needs to configure a specific environment, he sends the filtering conditions through the client, specifying the name of the cluster he wants to operate as "cluster-01" and the namespace "ns-dev". The server first checks Xiao Zhang's user information and permissions according to the first preset table, and finds that Xiao Zhang has the second permission level (namespace level) permissions. Then, based on the information in the second preset table and the filtering conditions provided by Xiao Zhang, the system determines the initial target objects from the k8s cloud platform as "cluster-01" and "ns-dev". However, since Xiao Zhang only has namespace-level permissions, the final target object is only the specific namespace "ns-dev". Based on this, the server generates a configuration file for the "ns-dev" namespace and sends it to Xiao Zhang's client, so that Xiao Zhang can perform the corresponding environment configuration for the "ns-dev" namespace according to the configuration file. In this way, it is guaranteed that Xiao Zhang can complete the necessary work and that his scope of operation complies with the company's security policy.

[0116] S204. Generate a configuration file based on the target object and client identification information in the k8s cloud platform.

[0117] The identification information of the client may refer to information for distinguishing each user of the client, so that the configuration file of each user corresponds to the operation and maintenance environment of each user, thereby improving the effect of isolating the operation and maintenance environment.

[0118] The configuration file may refer to a file used to configure the operation and maintenance environment. One configuration file corresponds to one target object, so that different operation and maintenance operations have isolated operation and maintenance environments. In an embodiment of the present application, the configuration file may correspond to the kubeconfig file required by the k8s cloud platform.

[0119] In an embodiment of the present application, the kubeconfig file includes apiVersion, which is used to specify the API version of the configuration file, and also includes contexts, which is used to define the available context information. The context is a combination of cluster, user and namespace, and also includes current-context, which is used to specify the currently used context.

[0120] S205: Send the configuration file to the client, so that the client configures the operating machine environment according to the configuration file.

[0121] Among them, the client configures the operating machine environment according to the configuration file, which can mean that the client stores the configuration file in a specific form in the user's local environment and then configures the operating machine environment. The specific form can refer to storage in a specific folder to isolate the configuration files for each operation and maintenance requirement.

[0122] In an embodiment of the present application, the configuration of the operating machine environment can be achieved by utilizing part of the Kubernetes source code and executing the kubectl native command. Before executing the command, the client automatically sets the kubeconfig file in the operating machine's working directory as the KUBECONFIG environment variable inside the process. Subsequent operation and maintenance commands can automatically specify the configured kubeconfig file for operation and maintenance operations.

[0123] In some embodiments, in the kubeconfig file, the operation and maintenance of a specified cluster or namespace can be achieved by switching the context. At the cluster operation and maintenance level, each cluster has one context, and at the namespace operation and maintenance level, each namespace has one context.

[0124] An operation and maintenance environment configuration method provided in an embodiment of the present application collects user screening conditions through a client to limit the scope of the user's operation and maintenance environment. The system determines the corresponding permission information based on the first preset table and user information, and divides the operation and maintenance permissions into cluster level and namespace level to ensure permission isolation. Then, the system determines the target object in the K8S cloud platform based on the permission information and object information, including the target cluster and / or target namespace, to ensure resource isolation. Next, the system generates a configuration file, such as a kubeconfig file, to configure the client's operating machine environment to achieve isolation of the operation and maintenance environment. Finally, the system sends the configuration file to the client, and the client automatically configures the environment and performs operation and maintenance operations according to the configuration file. This process not only improves operation and maintenance efficiency, but also enhances security, ensures that the operation and maintenance environments of different users are isolated from each other, and prevents operation and maintenance errors and abuse of permissions.

[0125] Figure 3 A schematic diagram of the process of configuring an operation and maintenance environment provided for this application Figure 2 ,like Figure 3 As shown, in this embodiment Figure 2 Based on the embodiment, generating a configuration file according to a target object in a k8s cloud platform is described in detail, and the method includes:

[0126] S301. Determine the access authentication information of the target object in the k8s cloud platform according to the access rule information in the k8s cloud platform.

[0127] Among them, the access rule information may refer to the account, certificate and access token required for access, so that the target object obtains the credentials to access the k8s cloud platform. The credentials correspond to each user and the different needs of each user. In the embodiment of the present application, for users with cluster-level and namespace-level permissions, the access rule information specifies the corresponding different accounts, certificates and access tokens, and the access rule information is restricted according to RBAC.

[0128] For cluster-level users, create a clusterrole to define cluster-wide permissions, create a service account serviceaccount that can run on the k8s cloud platform, and create a clusterrolebinding to bind the clusterrole to the serviceaccount.

[0129] For namespace-level users, create a role to define permissions within the namespace, create a service account serviceaccount that can run on the k8s cloud platform, and create a rolebinding to bind the role to the ServiceAccount so that the k8s cloud platform automatically creates a secret for the corresponding serviceaccount.

[0130] Next, obtain the access authentication information in the secret, including the certificate and access token. The certificate is used to verify the security of the Kubernetes API server, and the access token is used to allow verification of the validity of the request.

[0131] S302. Generate a configuration file corresponding to the target object in the k8s cloud platform based on the access authentication information.

[0132] Among them, the configuration file corresponding to the target object in the k8s cloud platform may refer to a file including access authentication information, so that the user running the configuration file can access the allocated resources, and the configuration file also includes the cluster API server address.

[0133] In some embodiments, there may be multiple servers, and when the corresponding server accessed by the client does not respond or the response times out, another server is called. For example, multiple object storage endpoints are preset, and the endpoint list is used as the primary and backup queues to try to obtain the configuration from front to back. When updating the object storage configuration, the endpoint primary and backup queues are updated from back to front in sequence to avoid the command line tool from temporarily failing to pull the configuration when updating the configuration file. In addition, pull the configuration file, read the server endpoint list, and enable multiple threads to call the health check interface of each server instance at the same time, and use the endpoint that passes the health check first as the final calling instance.

[0134] An operation and maintenance environment configuration method provided in an embodiment of the present application determines the access authentication information of the target object for users of different levels through the access rule information in the Kubernetes cloud platform, including account numbers, certificates, and access tokens. For cluster-level users and namespace-level users, RBAC resources are created respectively, and access authentication information is obtained from the automatically created Secret. Then, a configuration file is generated using these authentication information, including access authentication information and the cluster API server address, so that users can access the allocated resources. In addition, in order to improve the availability and robustness of the system, a load balancing and health check mechanism on the server side is implemented to ensure that the client can switch to other servers when the server side is unresponsive or the response times out, and to maintain the stability of the command line tool when updating the configuration. This process not only ensures that users can access Kubernetes resources safely and efficiently, but also improves the reliability and flexibility of the system.

[0135] Figure 4 A schematic diagram of the process of configuring an operation and maintenance environment provided for this application Figure 3 ,like Figure 4 As shown, in the embodiment of the present application, after the client obtains the configuration file sent by the server, before configuring the operating machine environment according to the configuration file, the method further includes:

[0136] S401, obtaining current process information, and obtaining timestamp information corresponding to the current process.

[0137] Among them, the current process information may refer to the current process information read in the command window, and the timestamp information may refer to the specific time when an event occurs, which is used to record the creation time and modification time of the file. In an embodiment of the present application, the current process information may refer to the parent process identifier (PPID, Parent Process ID) of the current command process. The PPID and timestamp information are combined as the name of the configuration folder, because the PID can help the tool determine the survival status of the shell process. The PID in Linux is unique for processes that survive at the same time, and is cyclical for processes at different times. The process PIDs at different times may be repeated. Therefore, in order to avoid working directory conflicts in extreme cases, the timestamp is introduced as an additional identifier, thereby ensuring the isolation of the working directory of the kubeconfig file, and then ensuring the isolation of the operation and maintenance environment of different personnel and at different times.

[0138] S402: Store the configuration file into a target file according to the current process information and timestamp information, wherein different configuration files correspond to different stored target files.

[0139] The target file may refer to a file in the working directory. Storing the configuration file in the working directory can ensure that the configuration file is stored in a corresponding working environment for easy management.

[0140] In some embodiments, the client determines whether the target folder is valid based on the target process information, and if not, deletes the target folder to ensure that the configuration files under the target folder are cleared.

[0141] The target process information may refer to the process information that meets the target conditions. Another thread may be started to obtain all the working directories on the operating machine, extract the PID of the shell process to which it belongs, and verify whether the shell process is alive. If so, it will be skipped. If the process no longer exists in the operating machine process list, it is determined that the shell process has died and the corresponding operation and maintenance window has been closed. The working directory will be determined as an invalid directory and automatically deleted by the tool to ensure that the sensitive operation and maintenance environment information will not be retained on the operating machine for a long time.

[0142] In some embodiments, the target folder stores an authorization file, which contains a user account and a time-limited access token issued by the server. The authorization file is generated after the user logs in to the operating machine, and the authorization file is updated when the operation and maintenance command is executed next time, so as to pass the authority verification of the server. The client checks whether the authorization file is configured in the working directory, and prompts to log in if the authorization file is not included.

[0143] The target folder also contains a signature file. After each command is executed, the configuration files and login authorization files in the working directory are digitally signed. The signature data includes shell process and PID information, MD5 value of the configuration file, MD5 value of the login authorization file, etc. Before each command is executed, the signature file is read for signature verification to verify whether the signature file belongs to the current shell process, and whether the configuration file and the login authorization file MD5 have changed, that is, whether the operation and maintenance environment configuration in the working directory has been tampered with by objects other than the tool.

[0144] In some embodiments, when reading the signature file, if it is found that the kubecnfig file and the login authorization file already exist in the working directory, and there is no signature file, the current operation and maintenance environment is judged to be untrustworthy, the operation and maintenance command is refused to be executed, and the user is prompted to execute the working directory cleanup command and try again. At the same time, the kubectl native kubeconfig command is abandoned, and the kubeconfig file can only be automatically specified by the tool. The two methods are combined to avoid artificial cross-use of the operation and maintenance environment.

[0145] An operation and maintenance environment configuration method provided by an embodiment of the present application names a configuration folder by obtaining the parent process identifier (PPID) and timestamp information of the current process, thereby ensuring that the operation and maintenance environments of different users and at different times are isolated from each other. The system checks the validity of the target folder and automatically deletes it after the process ends to remove sensitive information. The target folder contains authorization files and signature files for permission verification and detection of the integrity of the configuration file. If the environment is found to be untrustworthy, the system will refuse to execute the command and prompt the user to clean up. This method improves the security and isolation of the operation and maintenance environment.

[0146] Figure 5 A schematic diagram of the process of configuring an operation and maintenance environment provided for this application Figure 4 ,like Figure 5 As shown in the figure, after the user enters the filtering conditions, the command line tool in the client collects the filtering conditions and sends them to the server. After the server generates the corresponding kubeconfig file, it returns it to the client. The client can implement the operation and maintenance of the specified cluster or specified namespace by switching the context in the kubeconfig file.

[0147] Figure 6a Result diagram of an operation and maintenance environment configuration method provided in this application Figure 1 ,like Figure 6a As shown, the operation and maintenance operations of different users are isolated by process information, so that the working directory is isolated, thereby ensuring the isolation of the operation and maintenance environment of different people and at different times.

[0148] Figure 6b Result diagram of an operation and maintenance environment configuration method provided in this application Figure 2 ,like Figure 6b As shown, in an embodiment of the present application, the kubeconfig file is also encrypted. The encryption method is not limited in this application. When the server returns the kubeconfig file, it is encrypted. When the client reads the kubeconfig, it first decrypts and reads it in the current process. When writing the kubeconfig, the modified kubeconfig is first encrypted and then configured locally, so as to further prevent the kubeconfig from being cross-used artificially.

[0149] Figure 6c Result diagram of an operation and maintenance environment configuration method provided in this application Figure 3 ,like Figure 6cAs shown, in some embodiments, the configuration file in the client includes version control information, namely, the current latest version number and a list of old version numbers that are forced to be updated, the latest tool download address, and the latest version control tool download address. The version control information is obtained by inputting a version reading command locally from the client to prevent the tool version from being too low and affecting the configuration of the operation and maintenance environment.

[0150] Figure 7 A schematic diagram of the structure of an operation and maintenance environment configuration device provided in this application Figure 1 ,like Figure 7 As shown, an operation and maintenance environment configuration device 70 provided in this embodiment includes:

[0151] The first acquisition module 701 is used to acquire the screening condition sent by the client;

[0152] A first processing module 702 is used to determine the permission information corresponding to the user information according to the first preset table and the user information in the screening condition;

[0153] The second processing module 703 is used to determine the target object in the k8s cloud platform according to the permission information and the object information in the screening condition, where the target object includes a target cluster and / or a target namespace, and the target object is an object that satisfies the permission information in the object information;

[0154] The third processing module 704 is also used to generate a configuration file according to the target object in the k8s cloud platform;

[0155] The control module 705 is used to send the configuration file to the client, so that the client configures the operating machine environment according to the configuration file.

[0156] In a possible implementation, a second preset table is provided in the server side, and the second preset table includes cluster information of the cluster in the k8s cloud platform and space information of the namespace in the cluster; the second processing module 703 is also used to determine the target object in the k8s cloud platform according to the permission information and the object information in the screening condition, including:

[0157] According to the permission information and the object information in the screening conditions, the target object in the k8s cloud platform is determined from the second preset table.

[0158] In a possible implementation, the second processing module 703 is further used to determine the target object in the k8s cloud platform from the second preset table according to the permission information and the object information in the screening condition, including:

[0159] According to the object information in the screening condition, determine the initial target object in the k8s cloud platform from the second preset table;

[0160] According to the permission information, the target object in the k8s cloud platform is determined from the initial target object, wherein when the permission information corresponding to the user information is the first permission level, the target object includes the target cluster; when the permission information corresponding to the user information is the second permission level, the target object includes the target namespace.

[0161] In a possible implementation, the third processing module 704 is further used to generate a configuration file according to the target object in the k8s cloud platform, including:

[0162] According to the access rule information in the k8s cloud platform, determine the access authentication information of the target object in the k8s cloud platform;

[0163] Generate a configuration file corresponding to the target object in the k8s cloud platform based on the access authentication information.

[0164] This embodiment provides an operation and maintenance environment configuration device, which can execute the method provided by the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be described in detail here.

[0165] Figure 8 A schematic diagram of the structure of an operation and maintenance environment configuration device provided in this application Figure 2 ,like Figure 8 As shown, an operation and maintenance environment configuration device 80 provided in this embodiment includes:

[0166] A response module 801 is used to obtain screening conditions in response to user operations;

[0167] The fourth processing module 802 is used to send the screening condition to the server, so that the server determines the permission information corresponding to the user information according to the first preset table and the user information in the screening condition; determines the target object in the k8s cloud platform according to the permission information and the object information in the screening condition, the target object includes the target cluster and / or the target namespace, and the target object is the object that satisfies the permission information in the object information; generates a configuration file according to the target object in the k8s cloud platform;

[0168] The second acquisition module 803 is used to acquire the configuration file sent by the server;

[0169] The configuration module 804 is used to configure the operating machine environment according to the configuration file.

[0170] Fig. 9 This is a schematic diagram of the structure of an operation and maintenance environment configuration device provided by this application. Fig. 9As shown, an operation and maintenance environment configuration device 90 provided in this embodiment includes: at least one processor 901 and a memory 902. Optionally, the device 90 further includes a communication component 903. The processor 901, the memory 902 and the communication component 903 are connected via a bus 904.

[0171] In a specific implementation process, at least one processor 901 executes the computer execution instructions stored in the memory 902, so that at least one processor 901 executes the above method.

[0172] The specific implementation process of the processor 901 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0173] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0174] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0175] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0176] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0177] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0178] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0179] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0180] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0181] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0182] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0183] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0184] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0185] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A method for configuring an operation and maintenance environment, applied to a server side, wherein a first preset table is provided in the server side, wherein the first preset table includes users, user permissions, and a correspondence between the users and the permissions, characterized in that: The method comprises: Get the filter conditions sent by the client; Determining permission information corresponding to the user information according to the first preset table and the user information in the screening condition; According to the permission information and the object information in the screening condition, determine the target object in the k8s cloud platform, the target object includes a target cluster and / or a target namespace, and the target object is an object in the object information that satisfies the permission information; Generate a configuration file according to the target object in the k8s cloud platform; The configuration file is sent to the client, so that the client configures the operating machine environment according to the configuration file.

2. The method according to claim 1, characterized in that The server side is provided with a second preset table, which includes cluster information of the cluster in the k8s cloud platform and space information of the namespace in the cluster; Determining the target object in the k8s cloud platform according to the permission information and the object information in the screening condition includes: According to the permission information and the object information in the screening condition, the target object in the k8s cloud platform is determined from the second preset table.

3. The method according to claim 2, characterized in that Determining the target object in the k8s cloud platform from the second preset table according to the permission information and the object information in the screening condition includes: According to the object information in the screening condition, determine the initial target object in the k8s cloud platform from the second preset table; According to the permission information, the target object in the k8s cloud platform is determined from the initial target object, wherein when the permission information corresponding to the user information is the first permission level, the target object includes the target cluster; when the permission information corresponding to the user information is the second permission level, the target object includes the target namespace.

4. The method according to claim 1, characterized in that: The generating of the configuration file according to the target object in the k8s cloud platform includes: Determine the access authentication information of the target object in the k8s cloud platform according to the access rule information in the k8s cloud platform; Based on the access authentication information, a configuration file corresponding to the target object in the k8s cloud platform is generated.

5. A method for configuring an operation and maintenance environment, applied to a client, characterized in that: The method comprises: In response to the user's operation, a screening condition is obtained; Send the screening condition to the server, so that the server determines the permission information corresponding to the user information according to the first preset table and the user information in the screening condition; determines the target object in the k8s cloud platform according to the permission information and the object information in the screening condition, wherein the target object includes a target cluster and / or a target namespace, and the target object is an object in the object information that satisfies the permission information; generates a configuration file according to the target object in the k8s cloud platform; Obtaining the configuration file sent by the server; The operating machine environment is configured according to the configuration file.

6. The method according to claim 5, characterized in that After acquiring the configuration file sent by the server, and before configuring the operating machine environment according to the configuration file, the method further includes: Obtaining current process information and timestamp information corresponding to the current process information; According to the current process information and the timestamp information, the configuration file is stored in a target file, wherein different configuration files correspond to different stored target files.

7. An operation and maintenance environment configuration device, characterized in that: include: A first acquisition module is used to acquire the screening conditions sent by the client; A first processing module, configured to determine permission information corresponding to the user information according to the first preset table and the user information in the screening condition; The second processing module is used to determine the target object in the k8s cloud platform according to the permission information and the object information in the screening condition, the target object includes a target cluster and / or a target namespace, and the target object is an object that satisfies the permission information in the object information; The third processing module is also used to generate a configuration file according to the target object in the k8s cloud platform; The control module is used to send the configuration file to the client so that the client can configure the operating machine environment according to the configuration file.

8. An operation and maintenance environment configuration device, characterized in that: include: A response module, used to obtain screening conditions in response to user operations; A fourth processing module, used for sending the screening condition to the server, so that the server determines the authority information corresponding to the user information according to the first preset table and the user information in the screening condition; According to the permission information and the object information in the screening condition, determine the target object in the k8s cloud platform, the target object includes a target cluster and / or a target namespace, and the target object is an object in the object information that satisfies the permission information; Generate a configuration file according to the target object in the k8s cloud platform; A second acquisition module, used to acquire the configuration file sent by the server; The configuration module is used to configure the operating machine environment according to the configuration file.

9. An operation and maintenance environment configuration device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

Images