Application deployment authentication method and device, electronic equipment and storage medium
By introducing initial verification containers in containerized deployment applications and verifying the deployment cluster identification information of the application to be certified, the security risks and data leakage problems of containerized deployment applications are solved, and the security and management efficiency of the application are improved.
Patent Information
- Application Number
- CN202411646694.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-18
- Publication Date
- 2025-03-04
AI Technical Summary
Security risks and data breaches caused by the flexibility of containerized deployment applications, especially after code leakage, applications may be run at will, resulting in serious security risks and data breaches.
By adding resource configuration information of the initial verification container to the cabin configuration information, after the application cabin and the initial verification container are started, the information to be authenticated is passed to the initial verification container, and the current cluster identification information and authorized cluster identification information are matched through the initial verification container to decide whether to allow the application to be authenticated to be started.
Ensure that applications to be authenticated can only be deployed in specific deployment container clusters, preventing them from being run at will after being leaked, and significantly improving the security and management efficiency of the application.
Smart Images
Figure CN119557867A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of data security technology, and in particular to an application deployment authentication method, device, electronic device and storage medium. Background Art
[0002] Kubernetes (K8s) is an open source container management platform that is widely used to automatically deploy, scale, and manage containerized applications. Kubernetes provides a standardized method to manage and run containerized applications, allowing applications to run flexibly in different environments. Through containerization technology, applications and their dependencies are packaged together to ensure consistent behavior in different environments, thereby improving the efficiency of development and operation.
[0003] However, this flexibility and convenience also brings some security risks, especially in the case of code leakage, which may cause serious security risks and data leakage problems. Summary of the invention
[0004] The present application provides an application deployment authentication method, device, electronic device and storage medium to solve the technical problems of security risks and data leakage caused by the flexibility of the above-mentioned containerized deployment applications.
[0005] In one embodiment of the present application, the present application provides an application deployment authentication method, including: obtaining cabin configuration information and cluster information to be authenticated of the application to be authenticated, the cluster information to be authenticated including the current cluster identification information and authorized cluster identification information of the application to be authenticated in the deployment container cluster, the cabin configuration information including resource configuration information of various application containers, the application container including a newly added initial verification container; starting the application cabin and the initial verification container based on the cabin configuration information, and passing the cluster information to be authenticated to the initial verification container through the application cabin; matching the current cluster identification information and the authorized cluster identification information through the initial verification container to obtain a matching result, so as to allow or prevent the application to be authenticated from starting.
[0006] In one embodiment of the present application, the current cluster identification information and the authorized cluster identification information are matched through the initial verification container to obtain a matching result, including: calling a preset data encryption service through the initial verification container to decrypt the authorized cluster identification information; matching the current cluster identification information and the decrypted authorized cluster identification information through the initial verification container to obtain a matching result.
[0007] In one embodiment of the present application, the current cluster identification information and the decrypted authorized cluster identification information are matched to obtain a matching result, including: if the check items of the current cluster identification information match the expected values of the decrypted authorized cluster identification information, the matching result is determined to be passed; if there is at least one check item that does not match the expected values of the decrypted authorized cluster identification information, the matching result is determined to be failed.
[0008] In one embodiment of the present application, a preset data encryption service is called to decrypt the authorized cluster identification information, including: the authorized cluster identification information includes a set of encrypted digital storage sequences, which are used to encrypt and store the authorized deployment container cluster identification information; calling a data recovery interface to restore the digital storage sequence to an encrypted digital sequence before segmentation and / or obfuscation; calling a data sequence decryption interface to decrypt the encrypted digital sequence into an original digital sequence; calling a character conversion interface to convert the original digital sequence into an original character string based on a preset mapping relationship, and splicing and assembling the original character string; wherein the preset mapping relationship is used to characterize the conversion relationship between characters and numbers, and the data recovery interface, the data sequence decryption interface, and the character conversion interface are provided by the preset data encryption service.
[0009] In an embodiment of the present application, the inspection item includes at least one of a cluster identity of the deployment container cluster, a cluster name, and a node label or annotation for characterizing the characteristics of the deployment container cluster.
[0010] In one embodiment of the present application, allowing or preventing the application to be authenticated from starting includes: if the matching result is passed, the initial verification container exits, returns a success status code, and allows the main application container of the application to be authenticated to start; if the matching result is passed, the initial verification container exits, returns a failure status code, causes the application compartment to generate an error prompt message, and prevents the main application container of the application to be authenticated from running; wherein, the type of the application container also includes a main application container, which is used to run the main functional logic of the application to be authenticated.
[0011] In one embodiment of the present application, the cluster information to be authenticated is passed to the initial verification container through the application cabin, including: when the application cabin is started, the cluster information to be authenticated in the secret storage module is referenced through the environment variable configuration field or the volume mount field, and passed to the initial verification container; wherein, the environment variable configuration field or the volume mount field is located in the resource configuration information of the initial verification container in the cabin configuration information.
[0012] In one embodiment of the present application, the present application provides an application deployment authentication device, including: an information acquisition module, used to obtain cabin configuration information and cluster information to be authenticated of the application to be authenticated, the cluster information to be authenticated includes the current cluster identification information and authorized cluster identification information of the application to be authenticated in the deployment container cluster, the cabin configuration information includes resource configuration information of various application containers, and the application container includes a newly added initial verification container; an information transmission module, used to start the application cabin and the initial verification container based on the cabin configuration information, and to pass the cluster information to be authenticated to the initial verification container through the application cabin; an information verification module, used to match the current cluster identification information and the authorized cluster identification information through the initial verification container to obtain a matching result, so as to allow or prevent the application to be authenticated from starting.
[0013] In one embodiment of the present application, the present application provides an electronic device, which includes: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the electronic device implements the application deployment authentication method as described in any of the above embodiments.
[0014] In one embodiment of the present application, the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor of a computer, the computer executes the application deployment authentication method described in any one of the above embodiments.
[0015] Beneficial effects of the embodiments of the present application: The present application provides an application deployment authentication method, device, electronic device and storage medium. The embodiments of the present application add resource configuration information of the initial verification container to the cabin configuration information. After starting the application cabin and the initial verification container, the cluster information to be authenticated is passed to the initial verification container through the application cabin, and information matching is performed through the initial verification container to allow or prevent the startup of the application to be authenticated, thereby ensuring that the application to be authenticated can only be deployed in a specific deployment container cluster, preventing the application to be authenticated from being arbitrarily run after the code is leaked, and significantly improving the security and management efficiency of the application to be authenticated.
[0016] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS
[0017] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:
[0018] Figure 1 A schematic diagram showing an exemplary system architecture to which the technical solution of the embodiments of the present application can be applied;
[0019] Figure 2 A schematic diagram of a process flow of an application deployment authentication method according to an embodiment of the present application is shown;
[0020] Figure 3 A block diagram of an application deployment authentication device according to an embodiment of the present application is shown;
[0021] Figure 4 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown. DETAILED DESCRIPTION
[0022] The following describes the embodiments of the present application through specific examples, and those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. The present application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.
[0023] The illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present application. Therefore, the drawings only show components related to the present application rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.
[0024] In the following description, a large number of details are discussed to provide a more thorough explanation of the embodiments of the present application. However, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details. In other embodiments, well-known structures and devices are shown in the form of block diagrams rather than in detail to avoid making the embodiments of the present application difficult to understand.
[0025] See also Figure 1 , Figure 1 A schematic diagram of an exemplary system architecture to which the technical solution of the embodiment of the present application can be applied is shown. Figure 1 As shown, the system architecture may include a first cluster 101, a second cluster 102, a third cluster 103, and an Nth cluster 104. The first cluster 101 is used to represent the deployment container cluster where the application to be verified is currently located, the second cluster 102 is used to represent the deployment container cluster authorized by the application to be verified, the third cluster 103 is used to represent the deployment container cluster not authorized by the application to be verified, and the Nth cluster 104 is used to represent the total number of all deployment container clusters.
[0026] Exemplarily, the first cluster 101 obtains cabin configuration information and cluster information to be authenticated of the application to be authenticated, the cluster information to be authenticated includes the current cluster identification information and authorized cluster identification information of the application to be authenticated in the deployment container cluster, the cabin configuration information includes resource configuration information of various application containers, and the application container includes a newly added initial verification container; based on the cabin configuration information, the application cabin and the initial verification container are started, and the cluster information to be authenticated is passed to the initial verification container through the application cabin; the current cluster identification information and the authorized cluster identification information are matched through the initial verification container to obtain a matching result to allow or prevent the application to be authenticated from starting.
[0027] In related technologies, the flexibility and convenience of containerized application deployment also brings some security risks, especially in the case of code leakage, which may cause serious security risks and data leakage problems.
[0028] In order to solve the above technical problems, the present application provides an application deployment authentication method, device, electronic device and storage medium. The implementation details of the technical solution of the embodiment of the present application are elaborated in detail below.
[0029] See also Figure 2 , Figure 2 FIG. 1 is a flow chart showing an application deployment authentication method according to an embodiment of the present application. Figure 2 As shown, in an exemplary embodiment, the application deployment authentication method includes at least steps S220 to S230, which are described in detail as follows:
[0030] Step S210, obtaining cabin configuration information of the application to be authenticated and cluster information to be authenticated.
[0031] Among them, the cluster information to be authenticated includes the current cluster identification information and authorized cluster identification information of the application to be authenticated in the deployed container cluster, the cabin configuration information includes the resource configuration information of various application containers, and the application container includes the newly added initial verification container.
[0032] In some embodiments of the present application, the application to be authenticated is used to represent an application program that needs to be authenticated in the deployment environment.
[0033] In some embodiments of the present application, a container cluster is deployed for flexibly deploying applications in a containerized manner. This application takes a Kubernetes (K8s) cluster, an open source container management platform, as an example to illustrate the verification logic for deploying a container cluster.
[0034] In some embodiments of the present application, once the code of the application to be authenticated is leaked, it can be run at will on any K8s cluster, which is less secure. In addition, the application cannot be effectively bound to a specific K8s cluster. Each cluster deployment environment needs to be manually managed and verified, which increases the complexity and cost of operation and maintenance.
[0035] In some embodiments of the present application, the cabin configuration information includes a Pod (cabin) configuration file.
[0036] In some embodiments of the present application, resource configuration information is used to define various types of application containers and configure tasks of application containers.
[0037] In some embodiments of the present application, before obtaining the cabin configuration information of the application to be authenticated, an Init (initialization) container is added to the Pod configuration file of the application to be authenticated, that is, the initial verification container of the present application. The Init container runs before the main application container of the application to be authenticated is started, and is responsible for executing the verification logic of the deployment container cluster. The Init container is an independent application container, which is started before the main application container is started to ensure that the running environment of the application to be authenticated is an authorized k8s cluster.
[0038] In some embodiments of the present application, by defining the Init container in the Pod configuration file, the powerful orchestration and management functions provided by k8s can be utilized to automate and seamlessly integrate the verification process. The Init container can use any supported container image and specify the required scripts or commands through the Pod configuration file to execute the required verification logic at startup.
[0039] Step S220: start the application cabin and the initial verification container based on the cabin configuration information, and transfer the cluster information to be authenticated to the initial verification container through the application cabin.
[0040] In some embodiments of the present application, the cluster information to be authenticated is passed to the initial verification container through the application cabin, including: when the application cabin is started, the cluster information to be authenticated in the secret storage module is referenced through the environment variable configuration field or the volume mount field, and passed to the initial verification container; wherein, the environment variable configuration field or the volume mount field is located in the resource configuration information of the initial verification container in the cabin configuration information.
[0041] In some embodiments of the present application, the cluster information to be authenticated may be stored in a secret (secret storage module). When the Pod is started, the value in the secret is referenced through the valueFrom (value source) in the env (environment variable configuration) field; or when the Pod is started, the secret is mounted to the preset container directory through the volumeMounts (volume mount field), so that when the Init container is started, the file content can be read from the mounted preset container directory.
[0042] Step S230: Match the current cluster identification information with the authorized cluster identification information through the initial verification container to obtain a matching result, so as to allow or prevent the startup of the application to be authenticated.
[0043] In some embodiments of the present application, the current cluster identification information and the authorized cluster identification information are matched through an initial verification container to obtain a matching result, including: calling a preset data encryption service through the initial verification container to decrypt the authorized cluster identification information; matching the current cluster identification information and the decrypted authorized cluster identification information through the initial verification container to obtain a matching result.
[0044] In some embodiments of the present application, the current cluster identification information and the decrypted authorized cluster identification information are matched to obtain a matching result, including: if the check items of the current cluster identification information match the expected values of the decrypted authorized cluster identification information, the matching result is determined to be passed; if there is at least one check item that does not match the expected values of the decrypted authorized cluster identification information, the matching result is determined to be failed.
[0045] In some embodiments of the present application, the inspection item includes at least one of a cluster identity of the deployment container cluster, a cluster name, and a node label or annotation used to characterize the deployment container cluster.
[0046] In some embodiments of the present application, the cluster ID is used to uniquely identify the identifier of the deployment container cluster. For example, the Cluster ID is usually a unique value generated when the deployment container cluster is created, which is used to distinguish different k8s clusters. By checking the Cluster ID, it can be ensured that the application is only running in a specific k8s cluster.
[0047] In some embodiments of the present application, the cluster name is used to characterize the naming information of the deployment container cluster. The cluster name is specified by the administrator when creating the deployment container cluster and can be used to confirm the identity of the deployment container cluster. By matching the expected authorized cluster name, the accuracy and security of the verification can be increased.
[0048] In some embodiments of the present application, node labels or annotations are used to identify the characteristics of the deployed container cluster. For example, node labels and annotations are metadata mechanisms provided by the k8s cluster to identify the node properties of the k8s cluster. By checking the node labels or annotations, you can again ensure that the application is running in the correct environment.
[0049] In some embodiments of the present application, a preset data encryption service is called to decrypt the authorized cluster identification information, including: the authorized cluster identification information includes a set of encrypted digital storage sequences, which are used to encrypt and store the authorized deployment container cluster identification information; calling a data recovery interface to restore the digital storage sequence to an encrypted digital sequence before segmentation and / or obfuscation; calling a data sequence decryption interface to decrypt the encrypted digital sequence into an original digital sequence; calling a character conversion interface to convert the original digital sequence into an original character string based on a preset mapping relationship, and splicing and assembling the original character string; wherein the preset mapping relationship is used to characterize the conversion relationship between characters and numbers, and the data recovery interface, the data sequence decryption interface, and the character conversion interface are provided by the preset data encryption service.
[0050] In some embodiments of the present application, in order to ensure the security of the verification logic, the expected value of the authorization parameter required for verification is stored in a preset data encryption service. The expected value of the authorization parameter includes the actual expected value of at least one of the cluster identity, cluster name, and feature identification information of the deployment container cluster authorized by the application to be verified.
[0051] In some embodiments of the present application, the conventional way of storing information is to encrypt the complete authorized cluster identification information with base64 and store it in a secret. This method is very easy to be directly cracked to obtain the original stored plaintext information. The present application predefines a mapping relationship between characters and numbers, and defines a preset data encryption service. The preset data encryption service provides multiple interfaces to request the preset data encryption service to decrypt the authorized cluster identification information, and then splices and assembles the returned data to enhance the information security protection level to achieve the best protection effect.
[0052] In some embodiments of the present application, the authorized cluster identification information stored in the secret is information encrypted by a preset data encryption service.
[0053] In some embodiments of the present application, the encryption process includes: converting the character string in the authorized deployment container cluster identification information into a first digital sequence based on a preset mapping relationship; encrypting the first digital sequence to obtain a second digital sequence; and splitting and / or obfuscating the second digital sequence to obtain authorized cluster identification information.
[0054] In some embodiments of the present application, a preset data encryption service is requested when the Init container is started, and real feature data is obtained through multiple interface requests. These real feature data will be read and used for cluster verification logic to ensure the flexibility and security of the verification process. After the data is fully obtained, it is compared with the current cluster identification information obtained. If all the information matches, it means that the verification is passed.
[0055] In some embodiments of the present application, the startup of the application to be authenticated is allowed or blocked, including: if the matching result is passed, the initial verification container exits, returns a success status code, and allows the main application container of the application to be authenticated to start; if the matching result is passed, the initial verification container exits, returns a failure status code, causes the application compartment to generate an error prompt message, and blocks the operation of the main application container of the application to be authenticated; wherein, the type of application container also includes a main application container, which is used to run the main functional logic of the application to be authenticated.
[0056] In some embodiments of the present application, if the matching result is passed, it means that the deployment container cluster where the application to be authenticated is currently located is an authorized cluster, the Init container will exit, and the main application container will be allowed to start. If the matching result is not passed, it means that the deployment container cluster where the application to be authenticated is currently located is not an authorized cluster, and the Init container will cause the Pod to enter an error state, thereby preventing the main application container from running.
[0057] In some embodiments of the present application, the success status code may be zero, and the failure status code may be non-zero.
[0058] In some embodiments of the present application, the present application provides a solution for flexibly deploying applications through containerization, which can ensure that applications can only be deployed in a specific deployment container cluster, thereby preventing the code from being run arbitrarily after being leaked, and significantly improving the security and management efficiency of the application.
[0059] See also Figure 3 , Figure 3 A block diagram of an application deployment authentication device according to an embodiment of the present application is shown. The device can be applied to Figure 1 The implementation environment shown is specifically configured in the first cluster 101. The device may also be applicable to other exemplary implementation environments and specifically configured in other devices. This embodiment does not limit the implementation environment to which the device is applicable.
[0060] like Figure 3 As shown, an application deployment authentication device 300 according to an embodiment of the present application includes: module 301, module 302 and module 303.
[0061] The information acquisition module 301 is used to acquire the cabin configuration information and the cluster information of the application to be authenticated, the cluster information to be authenticated includes the current cluster identification information and the authorized cluster identification information of the application to be authenticated in the deployment container cluster, the cabin configuration information includes the resource configuration information of various application containers, and the application container includes the newly added initial verification container;
[0062] An information transfer module 302 is used to start the application cabin and the initial verification container based on the cabin configuration information, and transfer the cluster information to be authenticated to the initial verification container through the application cabin;
[0063] The information verification module 303 is used to match the current cluster identification information with the authorized cluster identification information through the initial verification container to obtain a matching result, so as to allow or prevent the startup of the application to be authenticated.
[0064] The application deployment authentication device provided in the above embodiment and the application deployment authentication method provided in the above embodiment belong to the same concept, wherein the specific manner in which each module and unit performs the operation has been described in detail in the method embodiment, and will not be repeated here. In actual applications, the application deployment authentication device provided in the above embodiment can allocate the above functions to different functional modules as needed, that is, divide the internal structure of the device into different functional modules to complete all or part of the functions described above, and this is not limited here.
[0065] An embodiment of the present application also provides an electronic device, including: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by one or more processors, the electronic device implements the application deployment authentication method provided in the above-mentioned embodiments.
[0066] See also Figure 4 , Figure 4 The structure diagram of the computer system suitable for implementing the electronic device of the embodiment of the present application is shown. It should be noted that: Figure 4 The computer system 400 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.
[0067] like Figure 4As shown, the computer system 400 includes a central processing unit (CPU) 401, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 402 or the program loaded from the storage part 408 to the random access memory (RAM) 403, such as executing the method in the above embodiment. In the random access memory 403, various programs and data required for system operation are also stored. The central processing unit 401, the read-only memory 402 and the random access memory 403 are connected to each other through a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.
[0068] The following components are connected to the input / output interface 405: an input section 406 including a keyboard, a mouse, etc.; an output section 407 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 408 including a hard disk, etc.; and a communication section 409 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the input / output interface 405 as needed. A removable medium 411, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 410 as needed so that a computer program read therefrom is installed into the storage section 408 as needed.
[0069] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 409, and / or installed from a removable medium 411. When the computer program is executed by a central processing unit (CPU) 401, various functions defined in the system of the present application are executed.
[0070] It should be noted that the computer-readable medium shown in the embodiment of the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. This propagated data signal can take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. A computer program contained on a computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.
[0071] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.
[0072] The units involved in the embodiments described in the present application can be implemented by software or by hardware, and the units described can also be set in a processor. Among them, the names of these units do not constitute a limitation on the units themselves under certain circumstances. Therefore, the technical solution according to the implementation mode of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including a number of instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation mode of the present application.
[0073] Another aspect of the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor of a computer, the computer executes the application deployment authentication method provided in each of the above embodiments. The computer-readable storage medium may be included in the electronic device described in the above embodiments, or may exist independently without being assembled into the electronic device.
[0074] In the above embodiments, unless otherwise specified, by using serial numbers such as "first" and "second" to describe common objects, it only means that they refer to different instances of the same object, rather than indicating that the objects being described must adopt a given order, whether in time, space, sorting or any other way.
[0075] The above embodiments are merely illustrative of the principles and effects of the present application, and are not intended to limit the present application. Anyone familiar with the technology may modify or change the above embodiments without violating the spirit and scope of the present application. Therefore, all equivalent modifications or changes made by a person of ordinary skill in the art without departing from the spirit and technical ideas disclosed in the present application shall still be covered by the claims of the present application.
Claims
1. An application deployment authentication method, characterized in that: The method comprises: Acquire cabin configuration information and cluster information of the application to be authenticated, wherein the cluster information to be authenticated includes the current cluster identification information and authorized cluster identification information of the application to be authenticated in the deployment container cluster, and the cabin configuration information includes resource configuration information of various application containers, wherein the application container includes a newly added initial verification container; Starting the application cabin and the initial verification container based on the cabin configuration information, and transmitting the cluster information to be authenticated to the initial verification container through the application cabin; The current cluster identification information and the authorized cluster identification information are matched through the initial verification container to obtain a matching result, so as to allow or prevent the to-be-authenticated application from starting.
2. The application deployment authentication method according to claim 1, characterized in that: The current cluster identification information and the authorized cluster identification information are matched by the initial verification container to obtain a matching result, including: Decrypting the authorized cluster identification information by calling a preset data encryption service through the initial verification container; The current cluster identification information and the decrypted authorized cluster identification information are matched through the initial verification container to obtain a matching result.
3. The application deployment authentication method according to claim 2, characterized in that: The current cluster identification information is matched with the decrypted authorized cluster identification information to obtain a matching result, including: If the check items of the current cluster identification information match the expected values of the decrypted authorized cluster identification information, determining the matching result as passed; If at least one of the check items of the current cluster identification information and the expected value of the decrypted authorized cluster identification information does not match, the matching result is determined as failed.
4. The application deployment authentication method according to claim 2, characterized in that: Calling a preset data encryption service to decrypt the authorized cluster identification information includes: The authorized cluster identification information includes a set of encrypted digital storage sequences, which are used to encrypt and store the authorized deployment container cluster identification information; Calling a data recovery interface to restore the digital storage sequence to the encrypted digital sequence before segmentation and / or obfuscation; Calling a data sequence decryption interface to decrypt the encrypted digital sequence into an original digital sequence; Calling a character conversion interface to convert the original digital sequence into an original character string based on a preset mapping relationship, and concatenating and assembling the original character string; The preset mapping relationship is used to characterize the conversion relationship between characters and numbers, and the data recovery interface, the data sequence decryption interface, and the character conversion interface are provided by the preset data encryption service.
5. The application deployment authentication method according to claim 3, characterized in that: The check items include at least one of a cluster identity of the deployment container cluster, a cluster name, and a node label or annotation for characterizing features of the deployment container cluster.
6. The application deployment authentication method according to any one of claims 1 to 5, characterized in that: Allowing or preventing the application to be authenticated from starting, including: If the matching result is passed, the initial verification container exits, returns a success status code, and allows the main application container of the application to be authenticated to start; If the matching result is passed, the initial verification container exits and returns a failure status code, so that the application cabin generates an error prompt message and prevents the main application container of the application to be authenticated from running; The type of the application container also includes a main application container, which is used to run the main function logic of the application to be authenticated.
7. The application deployment authentication method according to any one of claims 1 to 5, characterized in that: The method of transmitting the to-be-authenticated cluster information to the initial verification container through the application cabin includes: When the application cabin is started, the cluster information to be authenticated in the secret storage module is referenced through the environment variable configuration field or the volume mount field, and passed to the initial verification container; Among them, the environment variable configuration field or the volume mount field is located in the resource configuration information of the initial verification container in the cabin configuration information.
8. An application deployment authentication device, characterized in that: The device comprises: An information acquisition module, used to acquire cabin configuration information and cluster information of the application to be authenticated, wherein the cluster information to be authenticated includes the current cluster identification information and authorized cluster identification information of the application to be authenticated in the deployment container cluster, and the cabin configuration information includes resource configuration information of various application containers, wherein the application container includes a newly added initial verification container; An information transfer module, configured to start an application cabin and an initial verification container based on the cabin configuration information, and transfer the to-be-authenticated cluster information to the initial verification container through the application cabin; The information verification module is used to match the current cluster identification information with the authorized cluster identification information through the initial verification container to obtain a matching result so as to allow or prevent the startup of the application to be authenticated.
9. An electronic device, characterized in that: The electronic device comprises: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the electronic device to implement the application deployment authentication method as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor of a computer, the computer is caused to execute the application deployment authentication method according to any one of claims 1 to 7.