Method and system for managing files in Kubernetes cluster

Abstract

The invention relates to a management method and system for files in a Kubernetes cluster, and belongs to the technical field of computer cloud computing. The method comprises the steps that a written target eBPF program is acquired; generating a BPF byte code from the target eBPF program based on a target compiler, and running the BPF byte code in a kernel; under the condition that the kernel runs, obtaining starting time, ending time and size information of a file reading / writing event based on a Map mechanism in the target eBPF program; according to the starting time, the ending time and the size information of the file reading / writing event, whether an alarm condition is met or not is judged, under the condition that it is determined that the alarm condition is met, an alarm is given based on prometheus, and file processing operation is executed based on Kubernetes Operator. According to the method, the fine management of the files in the Kubernetes cluster is realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer cloud computing, and in particular relates to a method and system for managing files in a Kubernetes cluster. Background Art

[0002] In the related technologies, thousands of microservices can be run in the K8s environment, and file management of microservices has become the daily work of operation and maintenance engineers. If the files of microservices are not properly managed, it is possible that after the system hard disk usage rate exceeds 80%, K8s may spontaneously evict microservices, or high IO may directly affect machine performance and thus service operation. Therefore, how to better manage files has become an urgent problem to be solved. Summary of the invention

[0003] In view of the above shortcomings of the prior art, the purpose of the invention is to provide a method and system for managing files in a Kubernetes cluster. The method realizes refined management of files in a Kubernetes cluster.

[0004] In a first aspect of the present invention, a method for managing files in a Kubernetes cluster is proposed, including: S1, obtaining a written target eBPF program; S2, generating BPF bytecode from the target eBPF program based on a target compiler and running it in a kernel; S3, when the kernel is running, obtaining the start time, end time, and size information of a file read / write event based on a Map mechanism in the target eBPF program; S4, judging whether an alarm condition is met based on the start time, end time, and size information of the file read / write event, and initiating an alarm based on prometheus if it is determined that the alarm condition is met, and performing a file processing operation based on a Kubernetes Operator.

[0005] Furthermore, the target eBPF program includes a first tracking point probe and a second tracking point probe, the first tracking point probe is used to monitor file read events, and the second tracking point probe is used to monitor file write events.

[0006] Furthermore, the total duration of the file read / write event is determined according to the start time and the end time of the file read / write event, wherein, when it is determined that the total duration of the file read / write event is greater than a first threshold set by the Kubernetes Operator, a first process ID and first file information corresponding to the file read / write event are obtained; when it is determined that the size of the file read / write event is greater than a second threshold set by the Kubernetes Operator, a second process ID and second file information corresponding to the file read / write event are obtained; and the first process ID, the first file information, the second process ID, and the second file information are used as target collection information of the target eBPF program.

[0007] Furthermore, determining whether the alarm condition is satisfied includes: obtaining a process ID of a local machine microservice; determining a first alarm condition based on a matching result between the process ID of the local machine microservice and the target collected information; determining a second alarm condition based on a total duration of the file read / write event being greater than the first threshold, and / or a size of the file read / write event being greater than the second threshold; and determining that the alarm condition is satisfied when both the first alarm condition and the second alarm condition are satisfied.

[0008] Furthermore, based on the matching result between the process ID of the local machine microservice and the target collection information, a first alarm condition is determined, and the process ID of the local machine microservice is matched with the process ID in the target collection information; if the match fails, the first alarm condition is determined; wherein, if the match is successful, the successfully matched process ID in the target collection information and the file read / write event corresponding to the process ID are obtained, and the file read / write event corresponding to the process ID is associated with the process ID of the local machine microservice.

[0009] Furthermore, the file processing operation is performed based on the Kubernetes Operator, including: obtaining files whose total duration of the file read / write event is greater than the first threshold, and / or obtaining files whose size of the file read / write event is greater than the second threshold; using files greater than the first threshold and / or files greater than the second threshold as alarm files; automatically cleaning up content of a preset size in the alarm file to obtain a first target file, and writing the content of the first target file into a second target file.

[0010] Furthermore, it also includes: the Kubernetes Operator limits the file read / write rate through cgroup.

[0011] In a second aspect of the present invention, a management system for files in a Kubernetes cluster is proposed, including: a first acquisition module, used to acquire a written target eBPF program; a running module, used to generate BPF bytecode from the target eBPF program based on a target compiler and run it in the kernel; a second acquisition module, used to acquire the start time, end time, and size information of the file read / write event based on the Map mechanism in the target eBPF program when the kernel is running; an alarm and file execution module, used to determine whether the alarm condition is met based on the start time, end time, and size information of the file read / write event, and when it is determined that the alarm condition is met, initiate an alarm based on prometheus, and execute file processing operations based on Kubernetes Operator.

[0012] According to a third aspect of the present invention, an electronic device is proposed, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any of the methods described in the first aspect of the present invention.

[0013] According to a fourth aspect of the present invention, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute any one of the methods according to the first aspect of the present invention.

[0014] The beneficial effects of the present invention are as follows:

[0015] The method and system for managing files in a Kubernetes cluster of the present invention obtain the written target eBPF program; generate BPF bytecode from the target eBPF program based on the target compiler and run it in the kernel; when the kernel is running, obtain the start time, end time, and size information of the file read / write event based on the Map mechanism in the target eBPF program; determine whether the alarm condition is met according to the start time, end time, and size information of the file read / write event, and when it is determined that the alarm condition is met, initiate an alarm based on prometheus, and perform file processing operations based on Kubernetes Operator. The method realizes the refined management of files in the Kubernetes cluster by combining eBPF technology, Prometheus alarm system, and Kubernetes Operator's automated processing capabilities. It not only improves the accuracy of file monitoring and the alarm response capability, but also optimizes resource utilization and performance, and automatically detects file read / write events, thereby improving detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings are only used to illustrate specific embodiments and are not considered to limit the present invention. In the entire drawings, the same reference symbols represent the same components. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings.

[0017] Figure 1 is a flowchart of a method for managing files in a Kubernetes cluster according to an embodiment of the present invention;

[0018] Figure 2 is a flowchart of a method for managing files in a Kubernetes cluster according to a specific embodiment of the present invention;

[0019] Figure 3 is a schematic diagram of a management system for files in a Kubernetes cluster according to an embodiment of the present invention;

[0020] Figure 4 It is a structural block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in the field without making creative work should fall within the scope of protection of the present invention.

[0022] Furthermore, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessarily obscuring the concepts disclosed in the present invention.

[0023] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the orientation or position relationship indicated by the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inside", "outside", etc. is based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation of the present invention. In addition, the terms "first", "second", and "third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. The terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be a connection between the two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0024] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of methods and systems consistent with some aspects of the present invention as detailed in the appended claims.

[0025] Thousands of microservices can be run in the K8s environment, and file management of microservices has become a daily task for operation and maintenance engineers. If the files of microservices are not managed properly, it is possible that after the system hard disk usage rate exceeds 80%, k8s may spontaneously evict microservices, or high IO may directly affect machine performance and thus service operation. The above two situations are generally caused by: 1. Large files are used by docker, and the files exist in the docker joint file system, which is difficult to find and clean up; 2. High IO processes occupy the machine's CPU usage, the machine load increases, and affects the CPU usage of other processes.

[0026] To this end, the present invention proposes a method, system and related equipment for managing files in a Kubernetes cluster. Specifically, the method, system and related equipment for managing files in a Kubernetes cluster according to an embodiment of the present invention are described below with reference to the accompanying drawings.

[0027] Figure 1It is a flowchart of a method for managing files in a Kubernetes cluster according to an embodiment of the present invention. It should be noted that the method for managing files in a Kubernetes cluster according to an embodiment of the present invention can be applied to the management system for files in a Kubernetes cluster according to an embodiment of the present invention. The management system for files in a Kubernetes cluster can be configured on an electronic device or in a server. This embodiment of the application does not limit this.

[0028] like Figure 1 As shown in the figure, the method for managing files in the Kubernetes cluster includes:

[0029] S110, obtaining the written target eBPF program.

[0030] In an embodiment of the present invention, the target eBPF program includes a first tracking point probe and a second tracking point probe, the first tracking point probe is used to monitor file read events, and the second tracking point probe is used to monitor file write events.

[0031] S120, generating BPF bytecode from the target eBPF program based on the target compiler, and running it in the kernel.

[0032] In an embodiment of the present invention, the target eBPF program may be compiled based on the target compiler clang / llvm to generate BPF bytecode.

[0033] S130, when the kernel is running, obtain the start time, end time, and size information of the file read / write event based on the Map mechanism in the target eBPF program.

[0034] In an embodiment of the present invention, the total duration of the file read / write event is determined according to the start time and end time of the file read / write event, wherein the time period between the start time and the end time of the file read / write event can be used as the total duration of the file read / write event.

[0035] S140, judging whether the alarm condition is met according to the start time, end time, and size information of the file read / write event, and initiating an alarm based on prometheus and performing file processing operations based on KubernetesOperator if the alarm condition is met.

[0036] In an embodiment of the present invention, satisfying the alarm condition includes satisfying the first alarm condition and the second alarm condition. That is, based on the start time, end time, and size information of the file read / write event, it is determined whether the first alarm condition and the second alarm condition are satisfied. When both the first alarm condition and the second alarm condition are satisfied, an alarm is initiated based on prometheus, and a file processing operation is performed based on Kubernetes Operator. For specific implementation methods, please refer to the subsequent embodiments.

[0037] According to the method for managing files in a Kubernetes cluster according to an embodiment of the present invention, the written target eBPF program is obtained; the target eBPF program is generated into BPF bytecode based on the target compiler and runs in the kernel; when the kernel is running, the start time, end time and size information of the file read / write event are obtained based on the Map mechanism in the target eBPF program; according to the start time, end time and size information of the file read / write event, it is judged whether the alarm condition is met, and when it is determined that the alarm condition is met, an alarm is initiated based on prometheus, and a file processing operation is performed based on Kubernetes Operator. The method realizes the refined management of files in the Kubernetes cluster by combining eBPF technology, Prometheus alarm system and Kubernetes Operator automatic processing capabilities. It not only improves the accuracy of file monitoring and the alarm response capability, but also optimizes resource utilization and performance, and automatically detects file read / write events, thereby improving detection efficiency.

[0038] In order to make it easier for those skilled in the art to understand the present invention, Figure 2 A method for managing files in a Kubernetes cluster according to a specific embodiment of the present invention is as follows. Figure 2 As shown, the method for managing files in the Kubernetes cluster includes:

[0039] S210, obtaining the written target eBPF program.

[0040] S220, generating BPF bytecode from the target eBPF program based on the target compiler, and running it in the kernel.

[0041] S230, when the kernel is running, obtaining the start time, end time, and size information of the file read / write event based on the Map mechanism in the target eBPF program.

[0042] S240: Determine whether an alarm condition is met based on the start time, end time, and size information of the file read / write event.

[0043] S250: When it is determined that the alarm condition is met, an alarm is initiated based on Prometheus.

[0044] In an embodiment of the present invention, a process ID of a local machine microservice is obtained; a first alarm condition is determined based on a matching result between the process ID of the local machine microservice and the target collected information; a second alarm condition is determined based on a total duration of a file read / write event being greater than a first threshold, and / or a size of a file read / write event being greater than a second threshold; and when both the first alarm condition and the second alarm condition are met, it is determined that the alarm condition is met.

[0045] In an embodiment of the present invention, the process ID of the local machine microservice is matched with the process ID in the target collection information; in case of a match failure, a first alarm condition is determined.

[0046] Among them, if the match is successful, the successfully matched process ID and the file read / write event corresponding to the process ID in the target collection information are obtained, and the file read / write event corresponding to the process ID is associated with the process ID of the local machine microservice.

[0047] In an embodiment of the present invention, the implementation method for determining the target collection information is as follows: when it is determined that the total duration of the file read / write event is greater than the first threshold set by the Kubernetes Operator, the first process ID and the first file information corresponding to the file read / write event are obtained; when it is determined that the size of the file read / write event is greater than the second threshold set by the Kubernetes Operator, the second process ID and the second file information corresponding to the file read / write event are obtained; and the first process ID, the first file information, the second process ID, and the second file information are used as the target collection information of the target eBPF program.

[0048] S260 performs file processing operations based on Kubernetes Operator.

[0049] In an embodiment of the present invention, files whose total duration of file read / write events is greater than a first threshold are obtained, and / or files whose size of file read / write events is greater than a second threshold are obtained; files greater than the first threshold and / or files greater than the second threshold are used as alarm files; contents of a preset size in the alarm file are automatically cleaned up to obtain a first target file, and the contents of the first target file are written into the second target file.

[0050] For example, the first 30% of the contents in the alarm file are automatically cleaned up, that is, by calculating the size of the first 30% of the alarm file, the first 30% of the contents are skipped: 30% of the alarm file is read to the end of the file as the first target file, and written into a new file (i.e., the second target file).

[0051] In an embodiment of the present invention, the Kubernetes Operator limits the file read / write rate through cgroup. Among them, cgroup is a function of the kernel, which is used to limit, record and isolate the physical resources (such as CPU, memory, disk IO, etc.) used by the process group. In an embodiment of the present invention, when it is detected that the transmission rate of file read / write is higher than the preset rate, the Kubernetes Operator limits the file read / write rate through cgroup.

[0052] According to the method for managing files in a Kubernetes cluster according to an embodiment of the present invention, by running the target eBPF program in the kernel, the read / write events of files in the Kubernetes cluster can be monitored in real time, including the start time, end time and size information; when an event that meets the alarm condition is detected, an alarm can be initiated based on Prometheus, thereby promptly notifying the administrator or the automation system for processing. Through the Map mechanism of the target eBPF program, the read / write event information of the file can be accurately obtained, including the total duration and size, providing accurate data support for subsequent alarms and processing; according to the read / write event information of the file, the content of the preset size in the alarm file can be automatically cleaned up and written into a new file, thereby realizing accurate management of the file. The alarm condition can be set according to the matching result of the process ID of the local machine microservice and the target collection information, as well as the total duration and size of the file read / write event, providing a flexible alarm triggering mechanism; through the first threshold and the second threshold set by the Kubernetes Operator, the sensitivity of the alarm can be further adjusted to adapt to different application scenarios. Kubernetes Operator can limit the file read / write transfer rate through the cgroup function to prevent excessive resource consumption caused by file operations; this resource limitation and isolation mechanism helps maintain the stability and performance of the cluster. Real-time monitoring and alarm functions help to promptly discover and handle potential file management problems, improving the maintainability of the cluster; by limiting the file read / write rate and automatically cleaning up the content in the alarm file, you can reduce the security risks caused by improper file operations.

[0053] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods of each embodiment of the present application.

[0054] According to one aspect of an embodiment of the present invention, a management system for files in a Kubernetes cluster is also proposed. Figure 3 Schematic diagram of a management system for files in a Kubernetes cluster according to an embodiment of the present invention; Figure 3 As shown, including:

[0055] A first acquisition module 310 is used to acquire a written target eBPF program;

[0056] The running module 320 is used to generate BPF bytecode from the target eBPF program based on the target compiler and run it in the kernel;

[0057] A second acquisition module 330 is used to acquire the start time, end time, and size information of the file read / write event based on the Map mechanism in the target eBPF program when the kernel is running;

[0058] The alarm and file execution module 340 is used to determine whether the alarm condition is met according to the start time, end time, and size information of the file read / write event, and if it is determined that the alarm condition is met, initiate an alarm based on prometheus and execute a file processing operation based on Kubernetes Operator.

[0059] According to the management system of files in the Kubernetes cluster of the embodiment of the present invention, the written target eBPF program is obtained; the target eBPF program is generated into BPF bytecode based on the target compiler and runs in the kernel; when the kernel is running, the start time, end time and size information of the file read / write event are obtained based on the Map mechanism in the target eBPF program; according to the start time, end time and size information of the file read / write event, it is judged whether the alarm condition is met, and when it is determined that the alarm condition is met, an alarm is initiated based on prometheus, and a file processing operation is performed based on Kubernetes Operator. Thus, by combining eBPF technology, Prometheus alarm system and Kubernetes Operator automatic processing capabilities, refined management of files in the Kubernetes cluster is realized. Not only the accuracy of file monitoring and alarm response capability are improved, but also resource utilization and performance are optimized, and file read / write events are automatically detected, which improves detection efficiency.

[0060] Optionally, the target eBPF program includes a first tracking point probe and a second tracking point probe, the first tracking point probe is used to monitor file read events, and the second tracking point probe is used to monitor file write events.

[0061] Optionally, the total duration of the file read / write event is determined according to the start time and the end time of the file read / write event, wherein, when it is determined that the total duration of the file read / write event is greater than a first threshold set by the Kubernetes Operator, a first process ID and first file information corresponding to the file read / write event are obtained; when it is determined that the size of the file read / write event is greater than a second threshold set by the Kubernetes Operator, a second process ID and second file information corresponding to the file read / write event are obtained; and the first process ID, the first file information, the second process ID, and the second file information are used as target collection information of the target eBPF program.

[0062] Optionally, the alarm and file execution module 340 is specifically used to obtain the process ID of the local machine microservice; determine the first alarm condition based on the matching result between the process ID of the local machine microservice and the target collected information; determine the second alarm condition based on the total duration of the file read / write event being greater than the first threshold, and / or the size of the file read / write event being greater than the second threshold; and determine that the alarm condition is met when both the first alarm condition and the second alarm condition are met.

[0063] Optionally, the alarm and file execution module 340 is specifically used to match the process ID of the local machine microservice with the process ID in the target collection information; if the match fails, determine the first alarm condition; wherein, if the match is successful, obtain the successfully matched process ID in the target collection information and the file read / write event corresponding to the process ID, and associate the file read / write event corresponding to the process ID with the process ID of the local machine microservice.

[0064] Optionally, the alarm and file execution module 340 is specifically used to obtain files whose total duration of the file read / write event is greater than the first threshold, and / or obtain files whose size of the file read / write event is greater than the second threshold; use files greater than the first threshold and / or files greater than the second threshold as alarm files; automatically clean up contents of a preset size in the alarm file to obtain a first target file, and write the contents of the first target file into a second target file.

[0065] Optionally, a restriction module is also included, which is used for the Kubernetes Operator to limit the file read / write rate through cgroup.

[0066] According to one aspect of an embodiment of the present invention, an electronic device is provided.

[0067] Figure 4 Schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Figure 4 As shown, the electronic device may include one or more ( Figure 4 Only one is shown in the figure) processor 102 (processor 102 may include but is not limited to a microprocessor (Microprocessor Unit, referred to as MPU) or a programmable logic device (Programmable logic device, referred to as PLD)) and a memory 104 for storing data. In an exemplary embodiment, the electronic device may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 4 The structure shown is for illustration only and does not limit the structure of the above terminal device. Figure 4 More or fewer components as shown, or with Figure 4 Equivalent functions or comparisons shown Figure 4 A different configuration with more features is shown.

[0068] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the method for managing files in the Kubernetes cluster in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the terminal device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0069] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the switching device. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0070] The present invention provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable the computer to execute a method for managing files in a Kubernetes cluster.

[0071] The applicant of the present invention has made a detailed explanation and description of the implementation examples of the present invention in conjunction with the drawings in the specification. However, those skilled in the art should understand that the above implementation examples are only preferred implementation schemes of the present invention, and the detailed description is only to help readers better understand the spirit of the present invention, but not to limit the scope of protection of the present invention. On the contrary, any improvements or modifications based on the inventive spirit of the present invention should fall within the scope of protection of the present invention.

[0072] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0073] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present invention. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present invention.

[0074] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, rather than to limit them. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the above embodiments, or replace some of the technical features therein by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. Any changes or replacements that can be easily thought of by those skilled in the art within the technical scope disclosed in the present invention should be covered within the protection scope of the present invention.

Claims

1. A method for managing files in a Kubernetes cluster, characterized in that: include: S1, obtain the written target eBPF program; S2, generating BPF bytecode from the target eBPF program based on the target compiler, and running it in the kernel; S3, when the kernel is running, obtaining the start time, end time, and size information of the file read / write event based on the Map mechanism in the target eBPF program; S4, judging whether the alarm condition is met according to the start time, end time, and size information of the file read / write event, and initiating an alarm based on prometheus and performing file processing operations based on KubernetesOperator if it is determined that the alarm condition is met.

2. The method for managing files in a Kubernetes cluster according to claim 1, characterized in that: The target eBPF program includes a first tracking point probe and a second tracking point probe, the first tracking point probe is used to monitor file read events, and the second tracking point probe is used to monitor file write events.

3. The method for managing files in a Kubernetes cluster according to claim 1, characterized in that: The total duration of the file read / write event is determined according to the start time and end time of the file read / write event, wherein: When it is determined that the total duration of the file read / write event is greater than a first threshold set by the Kubernetes Operator, obtaining a first process ID and first file information corresponding to the file read / write event; When it is determined that the size of the file read / write event is greater than a second threshold set by the Kubernetes Operator, obtaining a second process ID and second file information corresponding to the file read / write event; The first process ID, the first file information, the second process ID, and the second file information are used as target collection information of the target eBPF program.

4. The method for managing files in a Kubernetes cluster according to claim 3, characterized in that: Determining that the alarm condition is met includes: Get the process ID of the local machine microservice; Determine a first alarm condition according to a matching result between the process ID of the local machine microservice and the target collected information; Determining a second alarm condition according to the total duration of the file read / write event being greater than the first threshold, and / or the size of the file read / write event being greater than the second threshold; When both the first alarm condition and the second alarm condition are satisfied, it is determined that the alarm condition is satisfied.

5. The method for managing files in a Kubernetes cluster according to claim 4, characterized in that: Determine a first alarm condition according to a matching result between the process ID of the local machine microservice and the target collected information, Matching the process ID of the local machine microservice with the process ID in the target collection information; In case of a matching failure, determining the first alarm condition; Among them, if the match is successful, the successfully matched process ID in the target collection information and the file read / write event corresponding to the process ID are obtained, and the file read / write event corresponding to the process ID is associated with the process ID of the local machine microservice.

6. The method for managing files in a Kubernetes cluster according to claim 3, characterized in that: Perform file processing operations based on Kubernetes Operator, including: Acquire files whose total duration of the file read / write event is greater than the first threshold, and / or acquire files whose size of the file read / write event is greater than the second threshold; Use files whose size is larger than the first threshold and / or files whose size is larger than the second threshold as warning files; Automatically clear the contents of a preset size in the alarm file to obtain a first target file, and write the contents of the first target file into a second target file.

7. The method for managing files in a Kubernetes cluster according to claim 1, characterized in that: Also includes: The Kubernetes Operator limits the file read / write rate via cgroup.

8. A management system for files in a Kubernetes cluster, characterized in that: include: The first acquisition module is used to acquire the written target eBPF program; A running module, used to generate BPF bytecode from the target eBPF program based on a target compiler and run it in a kernel; A second acquisition module is used to acquire the start time, end time, and size information of the file read / write event based on the Map mechanism in the target eBPF program when the kernel is running; The alarm and file execution module is used to determine whether the alarm condition is met according to the start time, end time, and size information of the file read / write event, and if it is determined that the alarm condition is met, initiate an alarm based on Prometheus and execute file processing operations based on Kubernetes Operator.

9. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 7.

Images