Container mirror image pulling method and device, equipment and storage medium

Abstract

The invention relates to a container mirror image pulling method and device, equipment and a storage medium. The method comprises the following steps: adding a password-free pull plug-in in a container cluster, and configuring certificate information in a container mirror image warehouse on the password-free pull plug-in; for the effective namespaces in the password-free pull plug-in, creating a service account for each namespace, and configuring a mirror image pull voucher for each service account according to the voucher information in the container mirror image warehouse; after a container mirror image pulling command is received, creating a working load by using the effective namespace and the service account so as to enable the working load to have a mirror image pulling voucher; and completing pulling of the container mirror image based on the workload. According to the method, the container mirror image pulling mode can be simplified, and the container mirror image pulling efficiency can be improved.

Description

Technical Field

[0001] The present application relates to the field of container technology, and in particular to a method, device, equipment and storage medium for pulling a container image. Background Art

[0002] With the popularity of cloud computing and microservice architecture, container technology (such as Docker) has been widely used in software development, testing and deployment. As the basis of containerized applications, the efficient construction, distribution and deployment of container images have become the core functions of containerized platforms.

[0003] However, the traditional container image pulling method usually relies on username and password verification, and image pulling credentials need to be configured to pull container images in a container cluster. The traditional container image pulling method has the following problems: 1. Image pulling credentials belong to the namespace in the cluster, so if you want to create new workloads under different namespaces in the cluster, you must configure image pulling credentials in the corresponding namespaces. When there are a large number of namespaces, the configuration will be quite cumbersome. 2. Users need to configure image pulling credentials for each workload in the cluster. Once the workload lacks image pulling credentials, it will cause image pulling to fail, thus affecting business deployment. 3. When the user's credential information in the image repository changes, all image pulling credentials in the cluster need to be updated, which requires a large amount of operations and is easy to miss.

[0004] How to simplify the container image pulling method and improve the efficiency of container image pulling is still an urgent problem to be solved. Summary of the invention

[0005] Based on this, it is necessary to provide a container image pulling method, device, equipment and storage medium that can simplify the container image pulling method and improve the container image pulling efficiency in response to the above technical problems.

[0006] In a first aspect, the present application provides a method for pulling a container image, the method comprising:

[0007] Add a password-free pull plug-in to the container cluster and configure the credential information in the container image repository on the password-free pull plug-in;

[0008] For the namespaces that are effective in the password-free pull plug-in, create a service account for each namespace, and configure image pull credentials for each service account based on the credential information in the container image repository;

[0009] After receiving the container image pull command, create a workload using the effective namespace and service account so that the workload has the image pull credential;

[0010] Pulling of container images is completed based on the workload.

[0011] In one embodiment, before adding the password-free pull plug-in in the container cluster, the method further includes:

[0012] Create a custom controller that monitors the creation of service accounts in the container cluster and the change of credential information in the container image repository;

[0013] Compile the custom controller into a binary file, and package the binary file into an image file;

[0014] Based on the image file, create a configuration file for storing credential information in a container image repository, and create a workload for deploying a custom controller to a container cluster and mounting the configuration into a container;

[0015] The credential information in the container image repository is stored in the configuration file.

[0016] In one embodiment, the method further comprises:

[0017] In response to a change operation on credential information in a container image repository, determining new credential information according to the change operation;

[0018] After updating the credential information stored in the configuration file according to the new credential information, the workload is restarted to update the image pulling credentials of the workload.

[0019] In one embodiment, the method further comprises:

[0020] If the creation operation of a service account is detected, determine whether it is necessary to configure image pull credentials for the newly added service account based on the user's instructions;

[0021] If you need to configure image pull credentials for a newly added service account, configure the image pull credentials in the namespace where the newly added service account is located as the image pull credentials for the newly added service account.

[0022] In one of the embodiments, if it is necessary to configure an image pull credential for a newly added service account, the image pull credential in the namespace where the newly added service account is located is configured as the image pull credential of the newly added service account, including:

[0023] If you need to configure image pull credentials for the newly added service account, and the namespace where the newly added service account is located does not have image pull credentials, create an image pull credential for the namespace where the newly added service account is located;

[0024] If the namespace where the newly added service account is located has image pull credentials, the image pull credentials in the namespace where the newly added service account is located are configured as the image pull credentials of the newly added service account.

[0025] In one embodiment, creating a workload using the effective namespace and service account includes:

[0026] Create a workload in the namespace and use the service account of the namespace as the service account of the workload.

[0027] In a second aspect, the present application provides a container image pulling device, the device comprising:

[0028] The configuration module is used to add a password-free pull plug-in to the container cluster and configure the credential information in the container image repository on the password-free pull plug-in;

[0029] The configuration module is further used to create a service account for each namespace that is effective in the password-free pull plug-in, and configure image pull credentials for each service account according to the credential information in the container image repository;

[0030] The configuration module is further configured to, after receiving a container image pull command, create a workload using a valid namespace and service account so that the workload has image pull credentials;

[0031] The pulling module is used to complete the pulling of the container image based on the workload.

[0032] In a third aspect, the present application provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the method described in the first aspect are implemented.

[0033] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method described in the first aspect.

[0034] In a fifth aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0035] The container image pulling method, device, equipment and storage medium provided in the present application monitor the creation operation of the service account in the container cluster through a custom controller, automatically create and bind the image pulling credential to the service account, so that the workload created by the service account can pull the image without password. In this way, the container image pulling method is simplified and the efficiency of container image pulling is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0037] Figure 1 This is an application environment diagram of a method for pulling a container image in one embodiment;

[0038] Figure 2 The figure is a flowchart of a method for pulling a container image in one embodiment;

[0039] Figure 3 A partial flow chart of a method for pulling a container image in one embodiment;

[0040] Figure 4 This is a partial flowchart of a method for pulling a container image in another embodiment;

[0041] Figure 5 It is a partial flowchart of a method for pulling a container image in another embodiment;

[0042] Figure 6 It is a structural block diagram of a container image pulling device in one embodiment;

[0043] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0045] The container image pulling method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The head-mounted device can be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server 104 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0046] In an exemplary embodiment, Figure 2 As shown, a method for pulling a container image is provided, and this method is applied to Figure 1 The server 104 in the example is used as an example to illustrate the method, which includes the following steps 201 to 204. Among them:

[0047] Step 201: add a password-free pull plug-in to the container cluster, and configure the credential information in the container image repository on the password-free pull plug-in.

[0048] Among them, a container image is an unchangeable static file that contains executable code to run isolated processes on an information technology (IT) infrastructure. A container image consists of system libraries, system tools, and other platform settings required for a software program to run on a containerized platform such as Docker. A container image shares the operating system kernel of its host machine.

[0049] When using a container cluster, installing the password-free pull plug-in allows users to pull private images without configuring image pull credentials for workloads, thereby simplifying the workload release process.

[0050] In one embodiment, when preparing a container cluster, a Kubernetes container cluster can be prepared. Specifically, multiple hosts can be built into a container cluster through the Kubeadm tool, or a container cluster can be built on a host using the Minikube tool. Among them, Kubeadm is a subproject of Kubernetes, which is used to quickly build a Kubernetes container cluster. Among them, Minikube is a lightweight tool designed for developing Kubernetes container clusters, which allows developers to quickly create and run a single-node Kubernetes container cluster on a local machine.

[0051] In one embodiment, when preparing a container image repository, a Docker Registry service may be built on a host as a container image repository, and user credential information may be configured.

[0052] Step 202: for the namespaces that are effective in the password-free pull plug-in, create a service account for each namespace, and configure image pull credentials for each service account according to the credential information in the container image repository.

[0053] Among them, the image pulling credential is a Secret type resource in the container cluster, which stores the user's credential information in the container image repository and is used to verify permissions when pulling container images.

[0054] In traditional solutions, image pull credentials belong to the namespace in the cluster. Therefore, if you want to create new workloads in different namespaces in the cluster, you must configure image pull credentials in the corresponding namespaces. When there are many namespaces, the configuration will be quite cumbersome. In addition, users need to configure image pull credentials for each workload in the container cluster. Once the workload lacks image pull credentials, it will cause image pull failure, thus affecting business deployment. When the user's credential information in the container image repository changes, all image pull credentials in the container cluster need to be updated, which requires a lot of operations and is easy to miss.

[0055] Therefore, this step creates a service account for each namespace that is enabled in the password-free pull plug-in. Specifically, when a user creates a workload in a container cluster, they can specify the service account used by the workload. The service account is used to provide the authentication and authorization information required when the workload runs in the container cluster, ensuring that the workload can perform operations with appropriate permissions.

[0056] Configure image pull credentials for each service account. It is understandable that the service account itself can configure image pull credentials, and the workload created by the service account will automatically inherit the image pull credentials of the service account. With this feature, there is no need to specify image pull credentials for each workload, just configure the image pull credentials for the service account corresponding to the workload.

[0057] In one embodiment, by default, the cluster will create a default service account, Default, for each valid namespace. If the user does not specify a service account for the workload, the workload will use the Default service account by default.

[0058] Step 203: After receiving the container image pull command, create a workload using the effective namespace and service account so that the workload has the image pull credential.

[0059] The workload created by the service account will automatically inherit the image pull credentials of the service account. Therefore, after creating a workload corresponding to the service account, the workload inherits the image pull credentials of the service account.

[0060] In one embodiment, a workload is created under the namespace, and the service account of the namespace is used as the service account of the workload. Thus, the workload can integrate the image pull credentials specific to the service account.

[0061] Step 204: Complete the pulling of the container image based on the workload.

[0062] The workload will pull the container image from the image repository to the node, and the container image will also be pulled when the current Pod is restarted or upgraded. It should be noted that in Kubernetes, Pod is the smallest deployable computing unit, which encapsulates one or more containers (usually Docker containers) that share storage, network, and other resources running on the same host (Node). Pod is one of the most basic and core concepts in Kubernetes, which allows you to combine the containerized components of an application and deploy and manage them as a whole.

[0063] The method provided in this embodiment monitors the creation operation of the service account in the container cluster through a custom controller, automatically creates and binds the image pull credential to the service account, so that the workload created by the service account can pull the image without password. In this way, the container image pull method is simplified and the efficiency of container image pull is improved.

[0064] In an exemplary embodiment, Figure 3As shown, before adding the password-free pull plug-in in the container cluster in step 201, the container image pulling method further includes:

[0065] Step 301: Create a custom controller, which is used to monitor the creation operation of service accounts in the container cluster and the change operation of credential information in the container image repository.

[0066] Among them, the container cluster (such as Kubernetes) provides a custom controller, which is a way to extend the functions of the container cluster and is used to automatically manage the resources in the cluster.

[0067] Step 302: compile the custom controller into a binary file, and package the binary file into an image file.

[0068] If the container cluster is Kubernetes, for example, the custom controller is compiled into a binary file and packaged into an image file through Dockerfile. Dockerfile is a text file used to build a Docker image. It contains a series of instructions and parameters that define the image building process and the required environment settings.

[0069] Step 303: Create a configuration file for storing credential information in a container image repository based on the image file, and create a workload for deploying a custom controller to a container cluster and mounting the configuration to a container.

[0070] You can use Helm Charts to make image files into password-free pull plug-ins. Helm Charts is a package manager for Kubernetes applications that allows developers and users to define, install, and upgrade complex Kubernetes applications.

[0071] Specifically, the password-free pull plug-in mainly includes a configuration file for storing credential information in the container image repository, and a workload for deploying a custom controller to a container cluster and mounting the configuration into the container.

[0072] Among them, the configuration file can be a ConfigMap configuration, which is used to store the credential information of the container image repository provided by the user, for the custom controller to use when creating the image pull credential. In addition, the user can also specify which namespaces and service accounts need to automatically bind the image pull credential, and the custom controller will make judgments based on the rules set by the user. It should be noted that ConfigMap is a resource object used to store non-confidential configuration information in Kubernetes. It allows you to decouple configuration information from the container image so that the configuration can be managed and updated independently of the application.

[0073] The workload created is a Deployment type workload, which is used to deploy the custom controller to the cluster and mount the ConfigMap to the configuration file in the container. It should be noted that in Kubernetes, Deployment is a resource object that defines the deployment method and expected state of an application. Kubernetes supports multiple types of Deployment according to different requirements and scenarios.

[0074] Step 304: Store the credential information in the container image repository into the configuration file.

[0075] Fill in the required information of ConfigMap in the Values.yaml file of the password-free pull plug-in, and install the password-free pull plug-in in the container cluster. Subsequently, workloads created with the configured namespace and service account can pull images without passwords. If the user needs to modify the credential information of the image repository, they can modify the ConfigMap of the password-free pull plug-in, which will trigger the automatic update of all created image pull credentials.

[0076] In the above container image pulling method, the custom controller monitors the changes of the configuration file, so that the user can modify the credential information of the image repository and trigger the update of all created image pulling credentials.

[0077] In an exemplary embodiment, the method for pulling the container image further includes:

[0078] Step 1: In response to a change operation on credential information in a container image repository, new credential information is determined according to the change operation.

[0079] The change operation includes, for example, modification and rewriting.

[0080] Step 2: After updating the credential information stored in the configuration file according to the new credential information, restart the workload to update the image pull credential of the workload.

[0081] That is to say, if the user needs to modify the credential information of the image repository, they can modify the ConfigMap configuration file of the password-free pull plug-in, which can trigger the automatic update of all created image pull credentials. Specifically, modify the ConfigMap configuration file of the password-free pull plug-in and replace the credential information stored in the configuration file with the new credential information. Then restart the workload where the password-free pull plug-in is effective. At this time, because the image pull credentials have been updated, the workload pulls the image successfully.

[0082] In this embodiment, a custom controller is used to monitor changes in configuration files, so that users can modify the credential information of the image repository and trigger the update of all created image pull credentials.

[0083] In an exemplary embodiment, see Figure 4 , the container image pulling method also includes:

[0084] Step 401: If a service account creation operation is detected, it is determined whether an image pull credential needs to be configured for the newly added service account according to the user's instruction.

[0085] The custom controller is used to monitor the creation of service accounts in the cluster. For newly created service accounts, it is determined whether image pull credentials need to be bound to them based on the rules set by the user. The rules set by the user are used to specify which namespaces and service accounts need to be automatically bound to image pull credentials.

[0086] The rules set by the user can be changed according to actual needs and are not limited in this embodiment.

[0087] Step 402: If it is necessary to configure an image pull credential for the newly added service account, the image pull credential in the namespace where the newly added service account is located is configured as the image pull credential of the newly added service account.

[0088] If you need to configure image pull credentials for the newly added service account, create an image pull credential in the namespace where the service account is located and bind the created image pull credential to the service account.

[0089] In one embodiment, if an image pull credential needs to be configured for a newly added service account, and the namespace where the newly added service account is located does not have an image pull credential, an image pull credential is created for the namespace where the newly added service account is located. If the namespace where the newly added service account is located has an image pull credential, the image pull credential in the namespace where the newly added service account is located is configured as the image pull credential of the newly added service account.

[0090] The method provided in this embodiment supports the user to specify whether to configure image pull credentials for the service account according to actual needs, thereby improving the flexibility of service account configuration.

[0091] For ease of understanding, the following combination Figure 5 , and then describe the functions of the custom controller, the creation of image pull credentials, and the update process of image pull credentials.

[0092] After the custom controller is started, it continuously monitors new service accounts and configuration file changes of the password-free pull plug-in.

[0093] If a new service account is found, determine whether it is necessary to bind an image pull credential to the service account. If it is determined that it is not necessary to bind an image pull credential to the service account, return to continue listening for new service accounts. After determining that an image pull credential needs to be bound to the service account, determine whether the namespace has an image pull credential. If the namespace does not have an image pull credential, create an image pull credential for the namespace and then bind the image pull credential to the service account. If the namespace has an image pull credential, directly bind the image pull credential to the service account. After binding the image pull credential to the service account, return to continue listening for new service accounts.

[0094] If a configuration file change is found, all image pull credentials are obtained, and the image pull credentials created by the password-free pull plug-in are filtered out and then updated. After updating the image pull credentials, return to continue listening for configuration file changes.

[0095] It should be understood that, although the steps in the flowcharts of the embodiments described above are shown in sequence according to the instructions of the arrows, these steps are not necessarily performed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be performed in other orders. Moreover, at least a portion of the steps in the flowcharts of the embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these steps or stages is not necessarily performed in sequence, but can be performed in turn or alternately with other steps or at least a portion of the steps or stages in other steps.

[0096] Based on the same inventive concept, the embodiment of the present application also provides a container image pulling device for implementing the container image pulling method involved in the above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of the pulling device for one or more container images provided below can refer to the limitations of the container image pulling method above, and will not be repeated here.

[0097] In an exemplary embodiment, Figure 6 As shown, a container image pulling device 60 is provided, including: a configuration module 61 and a pulling module 62, wherein:

[0098] The configuration module 61 is used to add a password-free pull plug-in in the container cluster and configure the credential information in the container image repository on the password-free pull plug-in.

[0099] The configuration module 61 is also used to create a service account for each namespace that is effective in the password-free pull plug-in, and configure image pull credentials for each service account according to the credential information in the container image repository.

[0100] The configuration module 61 is also used to create a workload using the effective namespace and service account after receiving the container image pull command, so that the workload has the image pull credential.

[0101] The pulling module 62 is used to complete the pulling of the container image based on the workload.

[0102] In some embodiments, the configuration module 61 is used to: create a custom controller, which is used to monitor the creation operation of service accounts in the container cluster and the change operation of credential information in the container image repository; compile the custom controller into a binary file, and package the binary file into an image file; based on the image file, create a configuration file for storing credential information in the container image repository, and create a workload for deploying the custom controller to the container cluster and mounting the configuration into the container; store the credential information in the container image repository in the configuration file.

[0103] In some embodiments, the configuration module 61 is used to: respond to a change operation on the credential information in the container image repository, determine new credential information based on the change operation; after updating the credential information stored in the configuration file according to the new credential information, restart the workload to update the image pull credentials of the workload.

[0104] In some embodiments, the configuration module 61 is used to: if a service account creation operation is monitored, determine whether it is necessary to configure image pull credentials for the newly added service account based on user instructions; if it is necessary to configure image pull credentials for the newly added service account, configure the image pull credentials in the namespace where the newly added service account is located as the image pull credentials of the newly added service account.

[0105] In some embodiments, the configuration module 61 is used for: if it is necessary to configure an image pull credential for a newly added service account, and the namespace where the newly added service account is located does not have an image pull credential, then an image pull credential is created for the namespace where the newly added service account is located; if the namespace where the newly added service account is located has an image pull credential, then the image pull credential in the namespace where the newly added service account is located is configured as the image pull credential of the newly added service account.

[0106] In some embodiments, the configuration module 61 is used to: create a workload under the namespace, and use the service account of the namespace as the service account of the workload.

[0107] Each module in the container image pulling device 60 can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0108] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 7 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store information such as image pull credentials. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the method for pulling the container image provided in any of the above embodiments is implemented.

[0109] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0110] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method for pulling the container image provided in any of the above embodiments is implemented.

[0111] In one embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, implements the method for pulling the container image provided in any of the above embodiments.

[0112] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0113] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0114] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for pulling a container image, characterized in that: The method comprises: Add a password-free pull plug-in to the container cluster and configure the credential information in the container image repository on the password-free pull plug-in; For the namespaces that are effective in the password-free pull plug-in, create a service account for each namespace, and configure image pull credentials for each service account based on the credential information in the container image repository; After receiving the container image pull command, create a workload using the effective namespace and service account so that the workload has the image pull credential; Pulling of container images is completed based on the workload.

2. The method according to claim 1, characterized in that Before adding the password-free pull plug-in in the container cluster, the method further includes: Create a custom controller that monitors the creation of service accounts in the container cluster and the change of credential information in the container image repository; Compile the custom controller into a binary file, and package the binary file into an image file; Based on the image file, create a configuration file for storing credential information in a container image repository, and create a workload for deploying a custom controller to a container cluster and mounting the configuration into a container; The credential information in the container image repository is stored in the configuration file.

3. The method according to claim 2, characterized in that The method further comprises: In response to a change operation on credential information in a container image repository, determining new credential information according to the change operation; After updating the credential information stored in the configuration file according to the new credential information, the workload is restarted to update the image pulling credentials of the workload.

4. The method according to claim 1, characterized in that: The method further comprises: If the creation operation of a service account is detected, determine whether it is necessary to configure image pull credentials for the newly added service account based on the user's instructions; If you need to configure image pull credentials for a newly added service account, configure the image pull credentials in the namespace where the newly added service account is located as the image pull credentials for the newly added service account.

5. The method according to claim 4, characterized in that If it is necessary to configure an image pull credential for the newly added service account, the image pull credential in the namespace where the newly added service account is located is configured as the image pull credential of the newly added service account, including: If you need to configure image pull credentials for the newly added service account, and the namespace where the newly added service account is located does not have an image pull credential, create an image pull credential for the namespace where the newly added service account is located; If the namespace where the newly added service account is located has image pull credentials, the image pull credentials in the namespace where the newly added service account is located are configured as the image pull credentials of the newly added service account.

6. The method according to claim 1, characterized in that The following steps are used to create a workload using the valid namespace and service account: Create a workload in the namespace and use the service account of the namespace as the service account of the workload.

7. A container image pulling device, characterized in that: The device comprises: The configuration module is used to add a password-free pull plug-in to the container cluster and configure the credential information in the container image repository on the password-free pull plug-in; The configuration module is further used to create a service account for each namespace that is effective in the password-free pull plug-in, and configure image pull credentials for each service account according to the credential information in the container image repository; The configuration module is further configured to, after receiving a container image pull command, create a workload using a valid namespace and service account so that the workload has image pull credentials; The pulling module is used to complete the pulling of the container image based on the workload.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images