Security authentication processing method and device, equipment and storage medium
By using auxiliary containers in the container cluster to generate and store security authentication files, the problem of traditional methods requiring invasive changes to the application container code is solved, and secure communication between the application container and the client is realized, reducing the complexity of the development and maintenance of the container cluster.
Patent Information
- Application Number
- CN202411671075.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-21
- Publication Date
- 2025-03-18
AI Technical Summary
In modern microservice architectures, traditional methods require invasive changes to the application code of the application container in order to achieve secure authentication within the application container, resulting in increased complexity in the development and maintenance of container clusters.
By assisting the container to generate a security authentication file and write it to the shared storage space, the application container reads the security authentication file from the shared storage space when the startup is completed, and authenticates communication with the client based on it.
There is no need to make invasive changes to the application code of the application container, which reduces the complexity of the development and maintenance of the container cluster and realizes secure communication between the application container and the client.
Smart Images
Figure CN119646795A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of security authentication technology, and in particular to a security authentication processing method, device, equipment and storage medium. Background Art
[0002] In modern microservice architecture, containerization is one of the most common technologies. Containerization makes the deployment and management of applications more convenient and efficient. As a popular container orchestration tool, container cluster can realize the deployment and management of applications through container collections.
[0003] In some scenarios, applications need to communicate securely with clients, and security authentication needs to be implemented in the application container. However, traditional methods often require invasive changes to the application code of the application container to implement security authentication in the application container, which will greatly increase the complexity of container cluster development and maintenance. Summary of the invention
[0004] Based on this, it is necessary to provide a security authentication processing method, device, equipment and storage medium to address the above technical issues.
[0005] In a first aspect, a security authentication processing method is provided, the method being applied to a container cluster, the container cluster including an auxiliary container and an application container, the method comprising:
[0006] Generate a security authentication file through the auxiliary container, and write the security authentication file into the shared storage space;
[0007] When the application container is started, the security authentication file is read from the shared storage space through the application container, and communication authentication between the application container and the client is performed according to the security authentication file.
[0008] Optionally, generating a security authentication file and writing the security authentication file into a shared storage space includes:
[0009] When the auxiliary container is started, the security authentication file is generated and written into the shared storage space.
[0010] Optionally, generating a security authentication file and writing the security authentication file into a shared storage space includes:
[0011] In response to the security authentication file acquisition request sent by the application container, the security authentication file is generated, and the security authentication file is written into the shared storage space.
[0012] Optionally, the method further comprises: detecting, by the auxiliary container, whether the security authentication file stored in the shared storage space is expired if a preset condition is met, wherein the preset condition comprises: a preset time has passed since the last time the security authentication file was checked for expiration;
[0013] If the security authentication file is expired, a new security authentication file is generated, and the security authentication file stored in the shared storage space is updated according to the new security authentication file.
[0014] Optionally, the method further includes: if the security authentication file is updated, reading the updated security authentication file from the shared storage space through the application container, and performing communication authentication between the application container and the client according to the updated security authentication file.
[0015] Optionally, the container cluster further includes a management unit, and the method further includes: creating, by the management unit, in the container cluster, a container set including the shared storage space, and creating the auxiliary container and the application container in the container set;
[0016] The shared storage space is mounted to the auxiliary container and the application container in the container set.
[0017] Optionally, the security authentication file includes an SSH security authentication file.
[0018] In a second aspect, a security authentication processing device is provided, the device is applied to a container cluster, the container cluster includes an auxiliary container and an application container, and the device includes:
[0019] A writing module, used to generate a security authentication file through the auxiliary container, and write the security authentication file into the shared storage space;
[0020] The authentication module is used to read the security authentication file from the shared storage space through the application container when the application container is started, and perform communication authentication between the application container and the client according to the security authentication file.
[0021] According to a third aspect, an electronic device is provided, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; the memory is used to store computer programs; and the processor is used to implement the method described in the first aspect when executing the program stored in the memory.
[0022] According to a fourth aspect, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method described in the first aspect is implemented.
[0023] The present application provides a security authentication processing method, device, equipment and storage medium. The technical solution provided by the embodiments of the present application brings at least the following beneficial effects:
[0024] Through the auxiliary container, a security authentication file is generated and written into the shared storage space; when the application container is started, the security authentication file is read from the shared storage space through the application container, and the communication authentication between the application container and the client is performed based on the security authentication file. In this way, after the auxiliary container generates the security authentication file and writes the security authentication file into the shared storage space, the application container can directly read the security authentication file from the shared storage space and perform communication authentication between the application container and the client based on the security authentication file. In this way, when the application needs to communicate securely with the client, there is no need to make invasive changes to the application code of the application container, thereby reducing the complexity of the development and maintenance of the container cluster.
[0025] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS
[0026] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0027] Figure 1 An architecture diagram of a Kubernetes container cluster provided in an embodiment of the present application;
[0028] Figure 2 A flowchart of a security authentication processing method provided in an embodiment of the present application;
[0029] Figure 3 A flowchart of an example of a security authentication processing method provided in an embodiment of the present application;
[0030] Figure 4 A schematic diagram of the structure of a security authentication processing device provided in an embodiment of the present application;
[0031] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0032] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.
[0033] In modern microservice architecture, containerization is one of the most common technologies. Containerization makes the deployment and management of applications more convenient and efficient. As a popular container orchestration tool, container cluster can realize the deployment and management of applications through container collections.
[0034] In some scenarios, applications need to communicate securely with clients, and security authentication needs to be implemented in the application container. However, traditional methods often require invasive changes to the application code of the application container to implement security authentication in the application container, which will greatly increase the complexity of container cluster development and maintenance.
[0035] The embodiment of the present application is introduced by taking the container cluster as a Kubernetes container cluster as an example. The processing of other types of container clusters (such as Docker Swarm, Apache Mesos, etc.) is similar to it and will not be repeated here. At the same time, the embodiment of the present application is introduced by taking the security authentication file as an SSH (Secure Shell) security authentication file as an example. The processing of other types of security authentication files (TLS (Transport Layer Security)) is similar to it and will not be repeated here.
[0036] Figure 1 An architecture diagram of a Kubernetes container cluster provided in an embodiment of the present application, such as Figure 1As shown. The Kubernetes container cluster includes the Kubernetes API (Application Programming Interface) server, the Kubernetes scheduler, the Kubernetes Pod, persistent storage (PVC (Persistent Volume Claim) / PV (Persistent Volume)), the monitoring system (Prometheus & Grafana) and the log system (ELK Stack). Among them, the Kubernetes API server is used to manage Kubernetes Pods and containers; the Kubernetes scheduler is used to allocate Kubernetes Pods to nodes; the persistent storage is used to provide shared volumes for Kubernetes Pods; the monitoring system is used to collect monitoring data of Kubernetes Pods and containers; the log system is used to record log data of Kubernetes Pods and containers. Furthermore, a namespace (Namespace, an abstract concept used to logically divide container cluster resources into multiple virtual clusters) can be created in the Kubernetes container cluster. Kubernetes Pods (container collections) can be created in the namespace. The main application container (i.e., application container) and the Sidecar container (i.e., auxiliary container) can be created in the Kubernetes Pod, and the shared volume is mounted under the main application container and the Sidecar container. Among them, the Sidecar container is used to generate SSH keys (ssh-keys), etc., and write ssh-keys, etc. to the shared volume; the main application container is used to deploy applications, read ssh-keys from the shared volume, and perform SSH login based on ssh-keys, thereby realizing communication authentication between the main application container and the client.
[0037] A security authentication processing method provided in an embodiment of the present application will be described in detail below in conjunction with a specific implementation method. The method is applied to an auxiliary container in a container cluster. Figure 2 A flowchart of a security authentication processing method provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the specific steps are as follows:
[0038] S210. Generate a security authentication file through the auxiliary container, and write the security authentication file into the shared storage space.
[0039] Specifically, an auxiliary container is an additional container that runs in the same Kubernetes Pod as the application container. This additional container is responsible for providing auxiliary functions or services for the main application container in the Kubernetes Pod.
[0040] Specifically, the security authentication file is a file used by the application container for communication authentication. Exemplarily, the security authentication file may include an SSH security authentication file or a TLS security authentication file, etc., but is not limited thereto.
[0041] Specifically, the shared storage space is a storage space that can be accessed by both the auxiliary container and the application container. It should be noted that the size of the shared storage space can be set by those skilled in the art according to actual conditions and is not limited here.
[0042] In some embodiments, generating a security authentication file and writing the security authentication file into a shared storage space includes: generating a security authentication file when the auxiliary container is started, and writing the security authentication file into the shared storage space. In this way, the auxiliary container can generate a security authentication file in advance, and when the application container needs the security authentication file for communication authentication, the security authentication file can be immediately read from the shared storage space, and then communication authentication is performed based on the security authentication file. In this way, the authentication speed of the application container can be increased, thereby improving the user experience.
[0043] In one example, if the application deployed in the Kubernetes Pod needs to communicate securely with the client, a Sidecar container (i.e., auxiliary container) can be created in the Kubernetes Pod through a Deployment (a resource object used to manage stateless applications. It is mainly responsible for operations such as Pod creation, update, and deletion) or a Pod definition file. The Sidecar container image contains program logic for generating an SSH security authentication file. In this way, after the Sidecar container is started, an SSH security authentication file (such as an SSH key, a list of known hosts, etc.) can be generated, and the generated SSH security authentication file can be written to the shared storage space.
[0044] In other embodiments, generating a security authentication file and writing the security authentication file to a shared storage space includes: generating a security authentication file in response to a security authentication file acquisition request sent by an application container, and writing the security authentication file to a shared storage space. In this way, a security authentication file can be dynamically generated when a security authentication file acquisition request is received, ensuring the freshness and timeliness of the security authentication file, thereby avoiding security risks caused by not being updated for a long time.
[0045] S220: When the application container is started, the security authentication file is read from the shared storage space through the application container, and communication authentication between the application container and the client is performed according to the security authentication file.
[0046] Specifically, an application container is a container that is primarily responsible for running application logic. It contains the application and its dependencies, such as library files, configuration files, and runtime environment. The main purpose of an application container is to provide an independent, portable runtime environment so that applications can run consistently in different environments.
[0047] In an example, the Sidecar container in the Kubernetes Pod generates an SSH security authentication file and writes the generated SSH security authentication file to the shared storage space. After the application container is started, the SSH security authentication file can be read from the shared storage space, and communication authentication (such as SSH login, etc.) between the application container and the client can be performed based on the SSH security authentication file.
[0048] Of course, in another optional implementation, the application container may also read the security authentication file from the shared storage space when there is a need to communicate with the client, and perform communication authentication between the application container and the client based on the security authentication file.
[0049] In an example, the Sidecar container in the Kubernetes Pod generates an SSH security authentication file and writes the generated SSH security authentication file to a shared storage space. When the application container has a communication need with the client (such as receiving a communication invitation request sent by the client), it can read the SSH security authentication file from the shared storage space and perform communication authentication (such as SSH login, etc.) between the application container and the client based on the SSH security authentication file.
[0050] As an optional implementation, the method may further perform the following steps:
[0051] Step 1: Through the auxiliary container, if preset conditions are met, detect whether the security authentication file stored in the shared storage space is expired, wherein the preset conditions include: a preset time has passed since the last check on whether the security authentication file is expired.
[0052] It should be noted that the specific value of the preset duration can be set by those skilled in the art according to actual conditions and is not limited here. For example, the preset duration can be 1 day, 1 week, 1 month, etc., but is not limited thereto.
[0053] In one example, the Sidecar container can detect in real time whether the SSH security authentication file stored in the shared storage space is expired. If the SSH security authentication file is not expired, no processing is required. If the SSH security authentication file is expired, go to step 2.
[0054] Step 2: If the security authentication file is expired, a new security authentication file is generated, and the security authentication file stored in the shared storage space is updated according to the new security authentication file.
[0055] In one example, if the SSH security authentication file expires, the Sidecar container generates a new SSH security authentication file and overwrites the new SSH security authentication file to the shared storage space to update the old SSH security authentication file stored in the shared storage space.
[0056] It is understandable that long-term security authentication files may be leaked or obtained by malicious attackers. Regularly updating security authentication files can reduce this risk, and even if a security authentication file is leaked, the impact is limited.
[0057] As an optional implementation, the method may further perform the following steps:
[0058] If the security authentication file is updated, the updated security authentication file is read from the shared storage space through the application container, and communication authentication between the application container and the client is performed based on the updated security authentication file.
[0059] In some embodiments, after updating the security authentication file in the shared storage space, the auxiliary container may send a security authentication file update notification to the application container. Of course, in other embodiments, the application container may periodically read the security authentication file from the shared storage space and compare the most recently read security authentication file with the currently used security authentication file to detect whether the security authentication file in the shared storage space has been updated.
[0060] In one example, if the SSH security authentication file is updated, the application container reads the updated SSH security authentication file from the shared storage space, and performs communication authentication (such as SSH login, etc.) between the application container and the client based on the updated SSH security authentication file.
[0061] It can be understood that after the SSH security authentication file is updated, the updated SSH security authentication file is read from the shared storage space, and communication authentication is performed based on the updated SSH security authentication file, which can ensure that the application container can successfully complete the communication authentication, thereby reducing the risk of the application container being unable to communicate with the client due to authentication failure.
[0062] As an optional implementation, the container cluster further includes a management unit, and the method may further perform the following steps: creating, by the management unit, a container set including a shared storage space in the container cluster, and creating an auxiliary container and an application container in the container set;
[0063] Mount the shared storage space to auxiliary containers and application containers in the container collection.
[0064] In one example, the management unit can create a namespace, and a Kubernetes Pod containing a shared storage space can be created in the namespace. Then, through the Deployment or Pod definition file, a Sidecar container and an application container are created in the Kubernetes Pod, and the shared storage space is mounted to the Sidecar container and the application container.
[0065] The present application embodiment also provides a container cluster, such as Figure 1 As shown, the container cluster includes at least one container set, and the container set includes an auxiliary container and an application container. The auxiliary container is used to generate a security authentication file and write the security authentication file to a shared storage space. The application container is used to read the security authentication file from the shared storage space and perform security authentication between the application container and the client based on the security authentication file.
[0066] As an optional implementation, the auxiliary container is specifically used to generate a security authentication file and write the security authentication file to a shared storage space when the auxiliary container is started, or to generate a security authentication file in response to a security authentication file acquisition request sent by an application container and write the security authentication file to a shared storage space.
[0067] As an optional implementation, the auxiliary container is also used to: detect whether the security authentication file stored in the shared storage space is expired when preset conditions are met, wherein the preset conditions include: a preset time has passed since the last check on whether the security authentication file is expired; if the security authentication file is expired, generate a new security authentication file, and update the security authentication file stored in the shared storage space according to the new security authentication file.
[0068] As an optional implementation, the application container is also used to: if the security authentication file is updated, read the updated security authentication file from the shared storage space, and perform communication authentication between the application container and the client according to the updated security authentication file.
[0069] As an optional implementation, the container cluster further includes a management unit. The management unit is used to: create a container set including a shared storage space in the container cluster, create an auxiliary container and an application container in the container set, and mount the shared storage space to the auxiliary container and the application container in the container set.
[0070] Figure 3 A flowchart of an example of a security authentication processing method provided in an embodiment of the present application, such as Figure 3As shown, the specific processing process is as follows: Step 1, the Kubernetes container cluster is started. Step 2, a namespace is created in the Kubernetes container cluster. Step 3, a Kubernetes Pod with a shared volume is created in the namespace. Step 4, the Sidecar container is started in the Kubernetes Pod. Step 5, the main application container is started in the Kubernetes Pod. Step 6, the Sidecar container generates an SSH security authentication file. Step 7, the Sidecar container writes the SSH security authentication file to the shared volume. Step 8, the main application container reads the SSH security authentication file in the shared volume. Step 9, the main application container uses the SSH security authentication file to log in via SSH. Step 10, the main application container determines whether the monitoring and logging systems are configured. If the monitoring and logging systems are configured, execute step 11. If the monitoring and logging systems are not configured, execute step 15. Step 11, the main application container collects monitoring data. Step 12, the main application container records log data. Step 13, the main application container sends the monitoring data to the monitoring system (Prometheus). Step 14: The main application container sends log data to the logging system (ELKStack). Step 15: The main application container ignores monitoring and logging.
[0071] The present application provides a method for processing security authentication. A security authentication file is generated through an auxiliary container, and the security authentication file is written to a shared storage space; when the application container is started, the security authentication file is read from the shared storage space through the application container, and communication authentication between the application container and the client is performed based on the security authentication file. In this way, after the auxiliary container generates the security authentication file and writes the security authentication file to the shared storage space, the application container can directly read the security authentication file from the shared storage space, and perform communication authentication between the application container and the client based on the security authentication file. In this way, when the application needs to communicate securely with the client, there is no need to make invasive changes to the application code of the application container, thereby reducing the complexity of the development and maintenance of the container cluster.
[0072] It should be understood that although Figure 2 and Figure 3 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 2 and Figure 3At least part of the steps may include multiple steps or multiple stages. These steps or stages are not necessarily performed at the same time, but can be performed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed in turn or alternately with other steps or at least part of the steps or stages in other steps.
[0073] It can be understood that the same / similar parts between the various embodiments of the above method in this specification can refer to each other, and each embodiment focuses on the differences from other embodiments. For related points, please refer to the description of other method embodiments.
[0074] The embodiment of the present application also provides a security authentication processing device, which is applied to a container cluster, wherein the container cluster includes an auxiliary container and an application container, such as Figure 4 As shown, the device comprises:
[0075] A writing module 410, used to generate a security authentication file through the auxiliary container, and write the security authentication file into the shared storage space;
[0076] The authentication module 420 is used to read the security authentication file from the shared storage space through the application container when the application container is started, and perform communication authentication between the application container and the client according to the security authentication file.
[0077] Optionally, the writing module 410 is specifically configured to generate the security authentication file and write the security authentication file into the shared storage space when the auxiliary container is started.
[0078] Optionally, the writing module 410 is specifically configured to generate the security authentication file in response to a security authentication file acquisition request sent by the application container, and write the security authentication file into the shared storage space.
[0079] Optionally, the device further comprises: a detection module, configured to detect, through the auxiliary container, whether the security authentication file stored in the shared storage space is expired if a preset condition is met, wherein the preset condition comprises: a preset time has passed since the last time the security authentication file is checked for expiration;
[0080] The updating module is used to generate a new security authentication file if the security authentication file expires, and update the security authentication file stored in the shared storage space according to the new security authentication file.
[0081] Optionally, the device also includes: an update authentication module 420, which is used to read the updated security authentication file from the shared storage space through the application container if the security authentication file is updated, and perform communication authentication between the application container and the client based on the updated security authentication file.
[0082] Optionally, the container cluster further includes a management unit, and the device further includes:
[0083] A creation module, configured to create, in the container cluster, a container set including the shared storage space through the management unit, and to create the auxiliary container and the application container in the container set;
[0084] The shared storage space is mounted to the auxiliary container and the application container in the container set.
[0085] Optionally, the security authentication file includes an SSH security authentication file.
[0086] For the specific definition of the processing device for security authentication, please refer to the definition of the processing method for security authentication above, which will not be repeated here. Each module in the above-mentioned processing device for security authentication can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the electronic device in the form of hardware, or can be stored in the memory of the electronic device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.
[0087] In one embodiment, an electronic device is provided, such as Figure 5 As shown, it includes a processor 501, a communication interface 502, a memory 503 and a communication bus 504, wherein the processor 501, the communication interface 502, and the memory 503 communicate with each other through the communication bus 504; the memory 503 is used to store computer programs; the processor 501 is used to implement the above-mentioned video processing method steps when executing the program stored in the memory 503.
[0088] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned security authentication processing method are implemented.
[0089] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).
[0090] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.
[0091] It should also be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data for analysis, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.
[0092] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.
[0093] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0094] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.
Claims
1. A method for processing security authentication, characterized in that: The method is applied to a container cluster, the container cluster includes an auxiliary container and an application container, and the method includes: Generate a security authentication file through the auxiliary container, and write the security authentication file into the shared storage space; When the application container is started, the security authentication file is read from the shared storage space through the application container, and communication authentication between the application container and the client is performed according to the security authentication file.
2. The method according to claim 1, characterized in that The step of generating a security authentication file and writing the security authentication file into a shared storage space includes: When the auxiliary container is started, the security authentication file is generated and written into the shared storage space.
3. The method according to claim 1, characterized in that The step of generating a security authentication file and writing the security authentication file into a shared storage space includes: In response to the security authentication file acquisition request sent by the application container, the security authentication file is generated, and the security authentication file is written into the shared storage space.
4. The method according to claim 1, characterized in that: The method further comprises: By means of the auxiliary container, if a preset condition is met, detecting whether the security authentication file stored in the shared storage space is expired, wherein the preset condition includes: a preset time has passed since the last time the security authentication file is checked for expiration; If the security authentication file is expired, a new security authentication file is generated, and the security authentication file stored in the shared storage space is updated according to the new security authentication file.
5. The method according to claim 4, characterized in that The method further comprises: If the security authentication file is updated, the updated security authentication file is read from the shared storage space through the application container, and communication authentication between the application container and the client is performed according to the updated security authentication file.
6. The method according to claim 1, characterized in that The container cluster further includes a management unit, and the method further includes: By means of the management unit, a container set including the shared storage space is created in the container cluster, and the auxiliary container and the application container are created in the container set; The shared storage space is mounted to the auxiliary container and the application container in the container set.
7. The method according to any one of claims 1 to 6, characterized in that: The security authentication file includes an SSH security authentication file.
8. A security authentication processing device, characterized in that: The device is applied to a container cluster, the container cluster includes an auxiliary container and an application container, and the device includes: A writing module, used to generate a security authentication file through the auxiliary container, and write the security authentication file into the shared storage space; The authentication module is used to read the security authentication file from the shared storage space through the application container when the application container is started, and perform communication authentication between the application container and the client according to the security authentication file.
9. An electronic device, characterized in that: The invention comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; the memory is used to store computer programs; and the processor is used to implement the method described in any one of claims 1 to 7 when executing the program stored in the memory.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.