Development and operation method, device, equipment and storage medium based on container orchestration

Abstract

The present invention relates to the field of information processing technology, and in particular to a development and operation method, device, equipment and storage medium based on container orchestration, which uses the GitLab CI tool in the code warehouse to automatically build and test the code to obtain the application, uses the Helm tool to define the Kubernetes configuration of the application, and automatically deploys the Kubernetes configuration to the Kubernetes cluster through the Argo CD tool, uses the Flux tool to monitor the configuration change information in the code warehouse, synchronously updates the Kubernetes cluster according to the configuration change information, realizes the dynamic adjustment of the infrastructure, has a vulnerability scanning mechanism and an intrusion detection mechanism, uses a security scanning tool to perform vulnerability scanning and intrusion detection on containers in the Kubernetes cluster in real time to obtain scanning and detection results, uses the ELK Stack to analyze the log data of the Kubernetes cluster to obtain analysis results, and generates a detection and analysis report according to the analysis results and the scanning and detection results, so that enterprises can detect the analysis report and take countermeasures in time to improve the security of the container environment.

Description

Technical Field

[0001] The present invention relates to the field of information processing technology, and in particular to a development and operation method, device, equipment and storage medium based on container orchestration. Background Art

[0002] At present, in modern software development, the DevOps concept has become an important method to improve development efficiency, shorten release cycles, and improve system stability. The DevOps management process involves the integration and automation of multiple tools and processes. Traditional DevOps platforms often find it difficult to meet such complex requirements. In DevOps practice, container orchestration has become the core tool for deploying, managing, and scaling containerized applications. However, traditional tools and technologies are usually difficult to provide the required infrastructure support for such a highly dynamic, distributed, and automated environment. The infrastructure is dynamically changing. As application requirements change, container instances, services, and network configurations may be adjusted at any time. Traditional tools are usually designed with the assumption that the infrastructure is static and cannot quickly adapt to such frequent changes. There is no automated vulnerability scanning mechanism and intrusion detection mechanism for containers. Vulnerabilities and intrusions in containers cannot be discovered in a timely manner, and enterprises cannot take timely countermeasures, resulting in a series of consequences such as data leakage and service interruption, which brings serious security risks. Summary of the invention

[0003] In order to overcome the shortcomings of the prior art, the purpose of the present invention is to provide a development and operation method, device, equipment and storage medium based on container orchestration that can monitor configuration change information and synchronously update the Kubernetes cluster according to the configuration change information to achieve dynamic adjustment of the infrastructure, and has a vulnerability scanning mechanism and an intrusion detection mechanism, so that enterprises can detect and analyze reports and take countermeasures in time to improve the security of the container environment.

[0004] A first aspect of the present invention provides a development and operation method based on container orchestration, including: submitting code to a code repository, using the GitLab CI tool in the code repository to automatically build and test the code to obtain an application; using the Helm tool to define the Kubernetes configuration of the application, and automatically deploying the Kubernetes configuration to the Kubernetes cluster through the Argo CD tool; using the Flux tool to monitor the configuration change information in the code repository, and synchronously updating the Kubernetes cluster according to the configuration change information; using a security scanning tool to perform vulnerability scanning and intrusion detection on the containers in the Kubernetes cluster in real time to obtain scanning and detection results; using ELK Stack to analyze the log data of the Kubernetes cluster to obtain analysis results, and generating a detection analysis report based on the analysis results and the scanning and detection results.

[0005] Optionally, in a first implementation method of the first aspect of the present invention, submitting the code to a code repository, and using the GitLab CI tool in the code repository to automatically build and test the code to obtain an application, includes: submitting the code to a local repository to obtain submission information; converting the submission information into a standard format to obtain submission information in a standard format; pushing the submission information in the standard format to a designated branch of a remote repository, so that the designated branch performs a code update based on the submission information in the standard format; and using the GitLab CI tool in the local repository to automatically build and test the code to obtain an application.

[0006] Optionally, in a second implementation manner of the first aspect of the present invention, the Helm tool is used to define the Kubernetes configuration of the application, and the Kubernetes configuration is automatically deployed to the Kubernetes cluster through the Argo CD tool, including: using the Helm tool to define the Kubernetes configuration of the application; containerizing the Kubernetes configuration to obtain a container image; using a Pod in a Kubernetes cluster to run the container image to obtain a running container, wherein the Pod contains one or more of the containers; and using a Deployment to manage the life cycle of the Pod, and automatically adjusting the number of the Pods according to the load.

[0007] Optionally, in a third implementation method of the first aspect of the present invention, the use of the Flux tool to monitor the configuration change information in the code repository and synchronously update the Kubernetes cluster according to the configuration change information includes: using the Flux tool to listen to the configuration change information in the code repository; when the Flux tool listens to the generation of the configuration change information, obtaining the current configuration change information; comparing the configuration change information with the running status of the Kubernetes cluster to obtain a comparison result, and determining the changed part according to the comparison result; and synchronously updating the Kubernetes cluster according to the changed part.

[0008] Optionally, in a fourth implementation method of the first aspect of the present invention, the use of a security scanning tool to perform vulnerability scanning and intrusion detection on the containers in the Kubernetes cluster in real time to obtain scanning and detection results includes: using Nessus or OpenVAS to perform vulnerability scanning on the containers in the Kubernetes cluster in real time to obtain scanning results; using Snort or Suricata to perform intrusion detection on the containers in the Kubernetes cluster in real time to obtain detection results; and integrating the scanning results and the detection results into a scanning and detection result.

[0009] Optionally, in a fifth implementation manner of the first aspect of the present invention, the log data of the Kubernetes cluster is analyzed by using ELK Stack to obtain analysis results, and a detection analysis report is generated based on the analysis results and the scan detection results, including: collecting performance indicators of containers and Kubernetes clusters in real time through Prometheus to obtain real-time performance indicator collection data; generating the real-time performance indicator collection data as visualization information through Grafana; analyzing the log data of the Kubernetes cluster by using ELK Stack to obtain analysis results; and generating a detection analysis report based on the visualization information, the analysis results and the scan detection results.

[0010] Optionally, in a sixth implementation method of the first aspect of the present invention, after using ELK Stack to analyze the log data of the Kubernetes cluster to obtain analysis results, and generating a detection analysis report based on the analysis results and the scanning detection results, it also includes: identifying text content information in the detection analysis report; performing word segmentation processing on the text content information to obtain multiple content segments, and extracting keywords from each of the content segments respectively; determining whether the keyword is an abnormal situation keyword; if so, generating abnormal situation alarm information based on the abnormal situation keyword, and sending the abnormal situation alarm information to the management end; merging the abnormal situation alarm information into the detection analysis report to obtain an abnormal situation report; encrypting the abnormal situation report to obtain report encryption information, and uploading the report encryption information to the blockchain.

[0011] The second aspect of the present invention provides a development and operation device based on container orchestration, including: a submission and construction module, which is used to submit the code to the code repository, and use the GitLab CI tool in the code repository to automatically build and test the code to obtain an application; a definition deployment module, which is used to use the Helm tool to define the Kubernetes configuration of the application, and automatically deploy the Kubernetes configuration to the Kubernetes cluster through the Argo CD tool; a monitoring and update module, which is used to use the Flux tool to monitor the configuration change information in the code repository, and synchronously update the Kubernetes cluster according to the configuration change information; a scanning and detection module, which is used to use a security scanning tool to perform vulnerability scanning and intrusion detection on the containers in the Kubernetes cluster in real time to obtain scanning and detection results; an analysis and generation module, which is used to use the ELK Stack to analyze the log data of the Kubernetes cluster to obtain analysis results, and generate a detection and analysis report based on the analysis results and the scanning and detection results.

[0012] Optionally, in a first implementation method of the second aspect of the present invention, the submission construction module includes: a submission unit, used to submit the code to a local repository to obtain submission information; a conversion unit, used to convert the submission information into a standard format to obtain submission information in a standard format; a push unit, used to push the submission information in the standard format to a designated branch of a remote repository, so that the designated branch performs code updates based on the submission information in the standard format; and a construction unit, used to automatically build and test the code using the GitLab CI tool in the local repository to obtain an application.

[0013] Optionally, in a second implementation of the second aspect of the present invention, the deployment definition module includes: a definition unit, used to use the Helm tool to define the Kubernetes configuration of the application; a containerization unit, used to containerize the Kubernetes configuration to obtain a container image; an operation unit, used to run the container image using a Pod in a Kubernetes cluster to obtain a running container, wherein the Pod contains one or more of the containers; and a management and adjustment unit, used to use a Deployment to manage the life cycle of the Pod and automatically adjust the number of the Pod according to the load.

[0014] Optionally, in a third implementation of the second aspect of the present invention, the monitoring and updating module includes: a monitoring unit, used to use a Flux tool to monitor the configuration change information in the code repository; an acquisition unit, used to obtain the current configuration change information when the Flux tool monitors that the configuration change information has been generated; a comparison and determination unit, used to compare the configuration change information with the running status of the Kubernetes cluster to obtain a comparison result, and determine the changed part according to the comparison result; and an update unit, used to synchronously update the Kubernetes cluster according to the changed part.

[0015] Optionally, in a fourth implementation of the second aspect of the present invention, the scanning and detection module includes: a scanning unit, used to use Nessus or OpenVAS to perform vulnerability scans on containers in the Kubernetes cluster in real time to obtain scanning results; a detection unit, used to use Snort or Suricata to perform intrusion detection on containers in the Kubernetes cluster in real time to obtain detection results; and an integration unit, used to integrate the scanning results and the detection results into a scanning and detection result.

[0016] Optionally, in a fifth implementation of the second aspect of the present invention, the analysis generation module includes: a collection unit, used to collect performance indicators of containers and Kubernetes clusters in real time through Prometheus to obtain real-time performance indicator collection data; a first generation unit, used to generate the real-time performance indicator collection data into visualization information through Grafana; an analysis unit, used to use ELK Stack to analyze the log data of the Kubernetes cluster to obtain analysis results; and a second generation unit, used to generate a detection analysis report based on the visualization information, the analysis results and the scanning detection results.

[0017] Optionally, in a sixth implementation manner of the second aspect of the present invention, it also includes: an identification module, which is used to identify text content information in the detection and analysis report; a word segmentation and extraction module, which is used to perform word segmentation processing on the text content information to obtain multiple content segments, and extract keywords from each content segment respectively; a judgment module, which is used to judge whether the keyword is an abnormal situation keyword; a generation and sending module, which is used to generate abnormal situation alarm information according to the abnormal situation keyword, and send the abnormal situation alarm information to the management end; a merging module, which is used to merge the abnormal situation alarm information into the detection and analysis report to obtain an abnormal situation report; an encryption upload module, which is used to encrypt the abnormal situation report to obtain report encryption information, and upload the report encryption information to the blockchain.

[0018] A third aspect of the present invention provides a development and operation device based on container orchestration, comprising: a memory and at least one processor, wherein instructions are stored in the memory; at least one of the processors calls the instructions in the memory so that the development and operation device based on container orchestration executes each step of the development and operation method based on container orchestration described above.

[0019] A fourth aspect of the present invention provides a computer-readable storage medium having instructions stored thereon, which, when executed by a processor, implement the various steps of any of the above-mentioned development and operation methods based on container orchestration.

[0020] In the technical solution of the present invention, the code is submitted to the code repository, the GitLab CI tool in the code repository is used to automatically build and test the code to obtain the application, the Helm tool is used to define the Kubernetes configuration of the application, the Kubernetes configuration is automatically deployed to the Kubernetes cluster through the Argo CD tool, the Flux tool is used to monitor the configuration change information in the code repository, the Kubernetes cluster is synchronously updated according to the configuration change information, and the dynamic adjustment of the infrastructure is realized. The vulnerability scanning mechanism and the intrusion detection mechanism are provided, and the security scanning tool is used to perform vulnerability scanning and intrusion detection on the containers in the Kubernetes cluster in real time to obtain the scanning and detection results, and the ELK Stack is used to analyze the log data of the Kubernetes cluster to obtain the analysis results, and the detection and analysis report is generated according to the analysis results and the scanning and detection results, so that the enterprise can detect the analysis report and take countermeasures in time to improve the security of the container environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1A first flow chart of a development and operation method based on container orchestration provided in an embodiment of the present invention;

[0022] Figure 2 A second flow chart of a development and operation method based on container orchestration provided in an embodiment of the present invention;

[0023] Figure 3 A third flow chart of a development and operation method based on container orchestration provided in an embodiment of the present invention;

[0024] Figure 4 A fourth flow chart of a development and operation method based on container orchestration provided by an embodiment of the present invention;

[0025] Figure 5 A schematic diagram of the structure of a development and operation device based on container orchestration provided by an embodiment of the present invention;

[0026] Figure 6 Another structural schematic diagram of a development and operation device based on container orchestration provided by an embodiment of the present invention;

[0027] Figure 7 A schematic diagram of the structure of a development and operation equipment based on container orchestration provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The present invention provides a development and operation method, device, equipment and storage medium based on container orchestration, which can monitor configuration change information and synchronously update the Kubernetes cluster according to the configuration change information to achieve dynamic adjustment of the infrastructure, and has a vulnerability scanning mechanism and an intrusion detection mechanism, so that enterprises can detect and analyze reports and take countermeasures in time to improve the security of the container environment.

[0029] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1, an embodiment of a development and operation method based on container orchestration in an embodiment of the present invention includes:

[0031] 101. Submit the code to the code repository, use the GitLab CI tool in the code repository to automatically build and test the code to obtain the application;

[0032] In this embodiment, after the developer completes a function or fixes a bug in the local development environment, the developer submits the code to the local repository through the Git client and attaches the corresponding submission information, pushes the local submission to the remote repository, and uses the GitLab CI tool in the code repository to automatically build and test the code. After successful construction and passing the test, the application is obtained.

[0033] 102. Use the Helm tool to define the Kubernetes configuration of the application, and automatically deploy the Kubernetes configuration to the Kubernetes cluster through the Argo CD tool;

[0034] In this embodiment, a Helm Chart is created. The Helm Chart is a package containing multiple Kubernetes resource files. The Chart is configured. After the Chart configuration is completed, the Kubernetes configuration is obtained. The Kubernetes configuration is automatically deployed to the Kubernetes cluster through the Argo CD tool.

[0035] 103. Use the Flux tool to monitor the configuration change information in the code repository and synchronize the Kubernetes cluster based on the configuration change information;

[0036] In this embodiment, the Flux tool is installed in the Kubernetes cluster. After Flux is installed, a namespace named flux-system is created, which contains all the resources required by Flux. Flux is configured to access the code repository. Once Flux has configured access to the code repository, it will start monitoring changes to files in the code repository. Once files in the code repository are changed, the configuration change information is obtained and the Kubernetes cluster is synchronized and updated according to the configuration change information.

[0037] 104. Use security scanning tools to perform vulnerability scanning and intrusion detection on containers in the Kubernetes cluster in real time to obtain scanning and detection results;

[0038] In this embodiment, a suitable security scanning tool is selected to integrate container vulnerability scanning into the CI / CD process to ensure that scanning is performed before each image is built or deployed. For example, Trivy is integrated into CI / CD tool chains such as Jenkins, GitLab CI, and GitHubActions. After the scan is completed, Trivy will return the scan results, which include the vulnerabilities and their severity levels in the image, monitor the container behavior in the cluster, and detect potential attack activities. Once the vulnerability scan and intrusion detection are completed, the scan detection results will be obtained.

[0039] 105. Use ELK Stack to analyze the log data of the Kubernetes cluster, obtain the analysis results, and generate a detection analysis report based on the analysis results and scan detection results;

[0040] In this embodiment, log data is collected from the Kubernetes cluster, and the ELK Stack is used to analyze the log data of the Kubernetes cluster to obtain analysis results to help understand and detect the status of the Kubernetes cluster. Specifically, relevant log data is filtered out by building queries, for example, Pod error logs, exception logs, warnings of excessive resource usage, etc., and Elasticsearch aggregation is used to perform aggregate analysis on the logs to identify possible abnormal patterns, compare log data of different time periods, Pods, Namespaces and other dimensions, analyze whether there are abnormalities, and generate a detection analysis report based on the analysis results and scan detection results.

[0041] In an embodiment of the present invention, the code is submitted to a code repository, the GitLab CI tool in the code repository is used to automatically build and test the code to obtain an application, the Helm tool is used to define the Kubernetes configuration of the application, the Kubernetes configuration is automatically deployed to the Kubernetes cluster through the Argo CD tool, the Flux tool is used to monitor the configuration change information in the code repository, the Kubernetes cluster is synchronously updated according to the configuration change information, and dynamic adjustment of the infrastructure is achieved. A vulnerability scanning mechanism and an intrusion detection mechanism are provided, and a security scanning tool is used to perform vulnerability scanning and intrusion detection on containers in the Kubernetes cluster in real time to obtain scanning and detection results. The ELK Stack is used to analyze the log data of the Kubernetes cluster to obtain analysis results, and a detection and analysis report is generated according to the analysis results and the scanning and detection results, so that the enterprise can detect the analysis report and take countermeasures in time to improve the security of the container environment.

[0042] See also Figure 2 , a second embodiment of the development and operation method based on container orchestration in an embodiment of the present invention includes:

[0043] 201. Submit the code to the local repository and obtain the submission information;

[0044] In this embodiment, the local warehouse is initialized, and operations such as editing, adding, and deleting are performed on the code. The modified code is submitted to the local warehouse to obtain submission information.

[0045] 202. Convert the submitted information into a standard format to obtain the submitted information in the standard format;

[0046] In this embodiment, the submission information is obtained, and the submission information is formatted according to the requirements of the team or project to obtain the submission information in a standard format.

[0047] 203. Push the submission information in the standard format to the designated branch of the remote repository, so that the designated branch can perform code updates based on the submission information in the standard format;

[0048] In this embodiment, the submission information in the standard format is pushed to the designated branch of the remote repository so that the designated branch updates the code based on the submission information in the standard format. After the push is successful, the submission history of the remote branch is checked to ensure that the pushed submission information has been submitted in the standard format and updated correctly.

[0049] 204. Use the GitLab CI tool in the local repository to automatically build and test the code to obtain the application;

[0050] In this embodiment, the GitLab CI tool in the code repository is used to automatically build and test the code, and the application is obtained after successful construction and passing the test.

[0051] 205. Use the Helm tool to define the Kubernetes configuration of the application;

[0052] In this embodiment, a Helm Chart is created. The Helm Chart is a package containing multiple Kubernetes resource files. The Chart is configured. After the configuration of the Chart is completed, the Kubernetes configuration file is obtained.

[0053] 206. Containerize the Kubernetes configuration to obtain a container image;

[0054] In this embodiment, a container image is built, and the Kubernetes configuration includes the deployment, services, Ingress resources, etc. of the application, which are packaged into the container image as configuration files together with the application and all dependencies.

[0055] 207. Use the Pod in the Kubernetes cluster to run the container image to obtain a running container, and the Pod contains one or more containers;

[0056] In this embodiment, a Pod is a collection of one or more containers, and the containers share the same network namespace and storage volume. The containers in the Pod are responsible for executing the actual application logic, and the container images are run using the Pod in the Kubernetes cluster to obtain running containers.

[0057] 208. Use Deployment to manage the life cycle of Pod and automatically adjust the number of Pods according to the load;

[0058] In this embodiment, the expected number of Pod replicas, container images, ports, etc. are defined. Kubernetes automatically creates and manages Pods according to the definition of Deployment, ensures that the specified number of Pods are running, and implements uninterrupted rolling updates by modifying the Deployment configuration file. The number of replicas can be modified, or the HorizontalPod Autoscaler can be combined to automatically adjust the number of Pods according to the load to ensure that the application can cope with traffic fluctuations.

[0059] 209. Use the Flux tool to monitor configuration change information in the code repository;

[0060] In this embodiment, the Flux tool periodically checks for changes in the configuration repository. When there are new submissions or changes, the Flux tool detects these changes, such as modifying the Kubernetes Deployment configuration file, updating the container image version, increasing or decreasing the number of replicas, etc., such as adding new services, Pod configurations, or deleting resources that are no longer needed.

[0061] 210. When the Flux tool detects that configuration change information has been generated, it obtains the current configuration change information;

[0062] In this embodiment, once the Flux tool detects a configuration change, the next task is to obtain the current change information. The Flux tool obtains the latest configuration file based on the submission history or change record in the code repository. At this time, the Flux tool pulls the content of the changed part to obtain the configuration change information.

[0063] 211. Compare the configuration change information with the running status of the Kubernetes cluster to obtain a comparison result, and determine the changed part according to the comparison result;

[0064] In this embodiment, after pulling the latest configuration, the Flux tool compares the differences between the new version and the previous version to determine which changes actually need to be synchronized to the Kubernetes cluster. Specifically, it compares the contents of the new and old versions to extract which configuration items have changed, and determines the changed parts based on the comparison results.

[0065] 212. Synchronize and update the Kubernetes cluster according to the changed parts;

[0066] In this embodiment, when the changed part is determined, the corresponding configuration is automatically applied to the Kubernetes cluster according to the definition in the warehouse, so as to achieve synchronous update of the Kubernetes cluster.

[0067] In the embodiment of the present invention, by integrating GitLab CI, Helm, Kubernetes and Flux tools, an automated process from code submission to the production environment is implemented, which greatly improves development efficiency, reduces the time and errors of manual operations, and can quickly feedback the impact of code changes on the system, thereby improving the stability of the system. By utilizing Kubernetes cluster and containerization technology, the deployment of applications is more flexible and scalable, and the life cycle of Pods is automatically managed and the number of Pods is adjusted on demand, which can effectively cope with traffic fluctuations and improve the elasticity and fault tolerance of the system. The Flux tool is used to monitor configuration changes and automatically synchronize them to the Kubernetes cluster, which can quickly respond to configuration adjustments or updates and ensure that the cluster environment is always in the desired state. This real-time configuration management capability reduces the need for human intervention and ensures the consistency and security of the configuration. Based on the automatic expansion and management of Kubernetes, as well as the monitoring and synchronous update of configuration changes by Flux, it is ensured that the system can dynamically adapt to load changes and configuration updates, and minimize the risk of downtime and system inconsistency.

[0068] See also Figure 3 , a third embodiment of the development and operation method based on container orchestration in an embodiment of the present invention includes:

[0069] 301. Use Nessus or OpenVAS to scan the vulnerabilities of containers in the Kubernetes cluster in real time and obtain the scan results;

[0070] In this embodiment, Nessus or OpenVAS is deployed in a suitable environment. The vulnerability scanning tool can be deployed outside the Kubernetes cluster to directly scan the exposed services in the cluster, or the vulnerability scanning tool can be deployed as a container application in the Kubernetes cluster. In this way, the scanning tool can directly access the internal resources of Kubernetes for scanning, ensuring that the vulnerability scanning tool can obtain sufficient permissions for the Kubernetes cluster. Nessus and OpenVAS will scan the software packages, operating systems, library files, etc. contained in the container image to detect whether there are known vulnerabilities. After the scan is completed, the tool will generate a detailed report on the container image, listing the detailed information of all known vulnerabilities, including the severity of the vulnerability, the components that may be affected, and repair suggestions.

[0071] 302. Use Snort or Suricata to perform intrusion detection on containers in the Kubernetes cluster in real time and obtain the detection results;

[0072] In this embodiment, Snort or Suricata is deployed according to the cluster architecture and network topology, and the IDS tool is deployed outside the cluster. The inlet traffic of the cluster is monitored in real time. At this time, the IDS tool will capture the traffic of external and internal communications of the cluster, which is suitable for detecting external attacks. The IDS tool can be deployed as a container or DaemonSet in the Kubernetes cluster to directly monitor the network traffic between Pods, nodes and containers in the cluster, which is suitable for detecting internal attacks or malicious activities. The IDS tool will monitor the network traffic of containers in the Kubernetes cluster in real time and capture communication data packets from the outside or inside the cluster, including internal communication between containers, traffic from external requests to services, and communication between Pods and Kubernetes API Servers. Snort or Suricata will conduct in-depth analysis of the captured data packets, parse various protocols, and identify whether there are abnormal or malicious behaviors. Through the rule set, the IDS tool will check the content of the data packet to identify whether it matches a known attack pattern or malicious traffic, and obtain the detection result.

[0073] 303. Integrate the scanning result and the detection result into a scanning detection result;

[0074] In this embodiment, the scanning results and the detection results need to be preprocessed first to ensure the uniformity of the data format and to remove duplicate information. During the integration process, the scanning results and the detection results need to be associated based on common identifiers (such as service names, IP addresses, etc.), and the original data from the scanning tool and the detailed analysis results of subsequent detections are combined to provide a comprehensive and structured scanning and detection report or result view to obtain the scanning and detection results.

[0075] 304. Prometheus is used to collect performance indicators of containers and Kubernetes clusters in real time to obtain real-time performance indicator collection data;

[0076] In this embodiment, the performance indicators of the container and the Kubernetes cluster are collected in real time through Prometheus to obtain real-time performance indicator collection data, and the real-time performance indicator collection data is stored in the time series database of Prometheus.

[0077] 305. Use Grafana to collect real-time performance indicators and generate visual information;

[0078] In this embodiment, a visualization dashboard is designed. The visualization dashboard is a container for Grafana to display data. It can contain multiple components such as charts, tables, indicators, and alarms. The real-time performance indicator collection data is generated into visualization information through the visualization dashboard.

[0079] 306. Use ELK Stack to analyze the log data of the Kubernetes cluster and obtain the analysis results;

[0080] In this embodiment, log data is collected from a Kubernetes cluster, and the ELK Stack is used to analyze the log data of the Kubernetes cluster to obtain analysis results, which help understand and detect the status of the Kubernetes cluster. Specifically, relevant log data is filtered out by building queries, for example, querying Pod error logs, exception logs, warnings of excessive resource usage, etc., and Elasticsearch aggregation is used to perform aggregate analysis on the logs to identify possible abnormal patterns, compare log data of different time periods, Pods, Namespaces and other dimensions, analyze whether there are abnormalities, and obtain analysis results.

[0081] 307. Generate a test analysis report based on the visualization information, analysis results and scanning test results;

[0082] In this embodiment, the target and structure of the report are defined, the visualization information, the analysis results and the scanning detection results are summarized to obtain the summary information, and the detection analysis report is generated according to the summary information.

[0083] In the embodiment of the present invention, by combining multiple security means such as vulnerability scanning, intrusion detection and log analysis, comprehensive security monitoring of the Kubernetes cluster is ensured, potential security vulnerabilities and intrusion behaviors are effectively identified, and the security of the system is improved. Real-time data collection and monitoring are performed using tools such as Nessus / OpenVAS, Snort / Suricata, Prometheus, etc., so that the system can quickly respond to any abnormal situation, thereby realizing rapid discovery and processing of problems and reducing the response time of potential threats. By integrating the scan results, performance data and log data and using Grafana for visualization, security and performance issues can be seen at a glance, simplifying the process of data analysis and problem diagnosis, and improving the work efficiency of the operation and maintenance team. Based on the integrated data and analysis results, the detection and analysis report is automatically generated, avoiding the complexity of manual analysis and report generation, ensuring the accuracy and timeliness of the report, facilitating subsequent decision-making and auditing, and helping the team to manage and respond to various problems in the Kubernetes cluster on an integrated platform, thereby improving the overall operation and maintenance efficiency and security level.

[0084] See also Figure 4 The fourth embodiment of the development and operation method based on container orchestration in the embodiment of the present invention includes:

[0085] 401. Identify text content information in the detection and analysis report;

[0086] In this embodiment, the text content information in the detection and analysis report is identified and extracted.

[0087] 402. Perform word segmentation processing on the text content information to obtain multiple content segments, and extract keywords from each content segment respectively;

[0088] In this embodiment, the text content information is split into individual words or phrases to obtain multiple content segments, which are basic information units extracted from the original text. Each content segment represents a specific and understandable concept or information. Words with important information that can reflect the core meaning of the text are identified from the segmented content segments to obtain keywords for each content segment.

[0089] 403. Determine whether the keyword is an abnormal keyword;

[0090] In this embodiment, an abnormal situation keyword is defined, and whether a certain keyword is an abnormal situation keyword is determined based on the semantics of the keyword.

[0091] 404. If yes, generate abnormal situation alarm information according to the abnormal situation keyword, and send the abnormal situation alarm information to the management end;

[0092] In this embodiment, if a keyword is an abnormal situation keyword, an abnormal description is performed based on the abnormal situation keyword, the type and cause of the abnormality are clearly described, abnormal situation alarm information is generated based on the abnormal situation description, and the abnormal situation alarm information is sent to the management end.

[0093] 405. Merge the abnormal situation alarm information into the detection analysis report to obtain an abnormal situation report;

[0094] In this embodiment, all triggered abnormal situation alarm information is collected and the collected alarm information is sorted to ensure that it can be seamlessly connected with other content in the detection and analysis report. The sorting process includes classifying and grouping abnormal alarms according to different types, impact ranges, priorities, etc., sorting the alarm information according to the priority, severity and urgency of the alarm, merging and deduplicating duplicate alarms of the same type to avoid redundant information in the report, and writing the sorted alarm information into the detection and analysis report according to a certain logic and format.

[0095] 406. Encrypt the abnormal situation report to obtain encrypted report information, and upload the encrypted report information to the blockchain;

[0096] In this embodiment, symmetric encryption (such as AES algorithm) or asymmetric encryption (such as RSA, ECC) is selected to encrypt the abnormal situation report to obtain report encryption information, select a suitable blockchain platform, upload the hash value (summary) of the encrypted report to the blockchain, and store the encrypted report in an external decentralized storage (such as IPFS, Filecoin). When uploading the hash value of the encrypted report to the blockchain, the hash value can be stored in the blockchain through a smart contract or a simple transaction operation to ensure the uniqueness and timestamp of the report. Smart contracts can be used to create report records, and smart contracts can set access permissions to ensure that only authorized personnel can access the original data or encrypted files of the report.

[0097] In the embodiment of the present invention, by automatically identifying abnormal keywords in the text and generating alarm information in a timely manner, the efficiency and accuracy of abnormal situation detection are significantly improved, the need for manual intervention is reduced, the abnormal situation alarm is merged into the detection report and sent to the management end, ensuring that key issues can be quickly and accurately communicated to relevant personnel, facilitating timely response and processing, and encrypting the abnormal situation report and uploading it to the blockchain to ensure the security and integrity of the report, prevent data tampering, and improve the reliability and transparency of the data. Through the integrated processing of steps such as text analysis, alarm generation and encrypted uploading, the whole process management from data collection to secure storage is realized, and the work efficiency and data processing quality are improved. The application of blockchain technology provides audit and traceability capabilities for reports, ensuring that the source and processing process of all abnormal information and reports can be accurately tracked and verified.

[0098] The above describes the development and operation method based on container orchestration in the embodiment of the present invention. The following describes the development and operation device based on container orchestration in the embodiment of the present invention. Figure 5 In an embodiment of the present invention, an embodiment of a development and operation device based on container orchestration includes:

[0099] The submission building module 501 is used to submit the code to the code repository, and use the GitLab CI tool in the code repository to automatically build and test the code to obtain an application;

[0100] Defining a deployment module 502, for defining the Kubernetes configuration of the application using the Helm tool, and automatically deploying the Kubernetes configuration to the Kubernetes cluster using the Argo CD tool;

[0101] The monitoring and updating module 503 is used to monitor the configuration change information in the code repository using the Flux tool, and synchronously update the Kubernetes cluster according to the configuration change information;

[0102] Scanning and detection module 504, used to use security scanning tools to perform vulnerability scanning and intrusion detection on containers in the Kubernetes cluster in real time to obtain scanning and detection results;

[0103] The analysis and generation module 505 is used to analyze the log data of the Kubernetes cluster using the ELK Stack to obtain analysis results, and generate a detection analysis report based on the analysis results and the scanning detection results.

[0104] In this embodiment, the code is submitted to the code repository, the GitLab CI tool in the code repository is used to automatically build and test the code to obtain the application, the Helm tool is used to define the Kubernetes configuration of the application, the Kubernetes configuration is automatically deployed to the Kubernetes cluster through the Argo CD tool, the Flux tool is used to monitor the configuration change information in the code repository, the Kubernetes cluster is synchronously updated according to the configuration change information, and dynamic adjustment of the infrastructure is achieved. The vulnerability scanning mechanism and the intrusion detection mechanism are provided, and the security scanning tool is used to perform vulnerability scanning and intrusion detection on the containers in the Kubernetes cluster in real time to obtain the scanning and detection results. The ELK Stack is used to analyze the log data of the Kubernetes cluster to obtain the analysis results, and the detection and analysis report is generated according to the analysis results and the scanning and detection results, so that the enterprise can detect the analysis report and take countermeasures in time to improve the security of the container environment.

[0105] See also Figure 6 Another embodiment of the development and operation device based on container orchestration in the embodiment of the present invention includes:

[0106] The submission building module 501 is used to submit the code to the code repository, and use the GitLab CI tool in the code repository to automatically build and test the code to obtain an application;

[0107] Defining a deployment module 502, for defining the Kubernetes configuration of the application using the Helm tool, and automatically deploying the Kubernetes configuration to the Kubernetes cluster using the Argo CD tool;

[0108] The monitoring and updating module 503 is used to monitor the configuration change information in the code repository using the Flux tool, and synchronously update the Kubernetes cluster according to the configuration change information;

[0109] Scanning and detection module 504, used to use security scanning tools to perform vulnerability scanning and intrusion detection on containers in the Kubernetes cluster in real time to obtain scanning and detection results;

[0110] The analysis and generation module 505 is used to analyze the log data of the Kubernetes cluster using the ELK Stack to obtain analysis results, and generate a detection analysis report according to the analysis results and the scanning detection results;

[0111] In this embodiment, the submission construction module 501 includes: a submission unit 5011, which is used to submit the code to the local warehouse to obtain submission information; a conversion unit 5012, which is used to convert the submission information into a standard format to obtain submission information in a standard format; a push unit 5013, which is used to push the submission information in the standard format to a specified branch of the remote warehouse, so that the specified branch can update the code based on the submission information in the standard format; a construction unit 5014, which is used to automatically build and test the code using the GitLabCI tool in the local warehouse to obtain an application.

[0112] In this embodiment, the definition deployment module 502 includes: a definition unit 5021, which is used to use the Helm tool to define the Kubernetes configuration of the application; a containerization unit 5022, which is used to containerize the Kubernetes configuration to obtain a container image; an operation unit 5023, which is used to use the Pod in the Kubernetes cluster to run the container image to obtain a running container, and the Pod contains one or more containers; a management and adjustment unit 5024, which is used to use the Deployment to manage the life cycle of the Pod and automatically adjust the number of Pods according to the load.

[0113] In this embodiment, the monitoring and updating module 503 includes: a monitoring unit 5031, which is used to use the Flux tool to monitor the configuration change information in the code repository; an obtaining unit 5032, which is used to obtain the current configuration change information when the Flux tool monitors that configuration change information has been generated; a comparison and determination unit 5033, which is used to compare the configuration change information with the running status of the Kubernetes cluster, obtain a comparison result, and determine the changed part according to the comparison result; an updating unit 5034, which is used to synchronously update the Kubernetes cluster according to the changed part.

[0114] In this embodiment, the scanning and detection module 504 includes: a scanning unit 5041, which is used to use Nessus or OpenVAS to perform vulnerability scans on containers in the Kubernetes cluster in real time to obtain scanning results; a detection unit 5042, which is used to use Snort or Suricata to perform intrusion detection on containers in the Kubernetes cluster in real time to obtain detection results; an integration unit 5043, which is used to integrate the scanning results and the detection results into scanning and detection results.

[0115] In this embodiment, the analysis generation module 505 includes: a collection unit 5051, which is used to collect performance indicators of containers and Kubernetes clusters in real time through Prometheus to obtain real-time performance indicator collection data; a first generation unit 5052, which is used to generate real-time performance indicator collection data into visualization information through Grafana; an analysis unit 5053, which is used to use ELK Stack to analyze the log data of the Kubernetes cluster to obtain analysis results; a second generation unit 5054, which is used to generate a detection analysis report based on the visualization information, analysis results and scanning detection results.

[0116] In this embodiment, it also includes: an identification module 506, which is used to identify text content information in the detection and analysis report; a word segmentation and extraction module 507, which is used to perform word segmentation processing on the text content information to obtain multiple content segments and extract keywords from each content segment respectively; a judgment module 508, which is used to judge whether the keyword is an abnormal situation keyword; a generation and sending module 509, which is used to generate abnormal situation alarm information according to the abnormal situation keyword if so, and send the abnormal situation alarm information to the management end; a merging module 510, which is used to merge the abnormal situation alarm information into the detection and analysis report to obtain an abnormal situation report; an encryption upload module 511, which is used to encrypt the abnormal situation report to obtain report encryption information, and upload the report encryption information to the blockchain.

[0117] above Figure 5 and Figure 6 The development and operation device based on container orchestration in the embodiment of the present invention is described in detail from the perspective of modular functional entities. The development and operation device based on container orchestration in the embodiment of the present invention is described in detail from the perspective of hardware processing.

[0118] Figure 76 is a schematic diagram of the structure of a development and operation device based on container orchestration provided by an embodiment of the present invention. The development and operation device 600 based on container orchestration may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 610 (for example, one or more processors) and a memory 620, and one or more storage media 630 (for example, one or more mass storage devices) storing application programs 633 or data 632. Among them, the memory 620 and the storage medium 630 can be short-term storage or persistent storage. The program stored in the storage medium 630 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the development and operation device 600 based on container orchestration. Furthermore, the processor 610 can be configured to communicate with the storage medium 630, and execute a series of instruction operations in the storage medium 630 on the development and operation device 600 based on container orchestration to implement the steps of the development and operation method based on container orchestration provided by the above-mentioned method embodiments.

[0119] The development and operation device 600 based on container orchestration may also include one or more power supplies 640, one or more wired or wireless network interfaces 650, one or more input and output interfaces 660, and / or one or more operating systems 631, such as Windows Serve, Mac OS X, Unix, Linux, FreeBSD, etc. Those skilled in the art will appreciate that Figure 7 The illustrated structure of the development and operation equipment based on container orchestration does not constitute a limitation on the development and operation equipment based on container orchestration, and may include more or fewer components than illustrated, or a combination of certain components, or a different arrangement of components.

[0120] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. Instructions are stored in the computer-readable storage medium. When the instructions are executed on a computer, the computer executes the steps of a development and operation method based on container orchestration.

[0121] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described system, device, or unit can refer to the corresponding process in the aforementioned method embodiment and will not be repeated here.

[0122] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program codes.

[0123] Finally, it should be noted that the above description is only a preferred example of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A development and operation method based on container orchestration, characterized in that: include: Submit the code to a code repository, and use the GitLab CI tool in the code repository to automatically build and test the code to obtain an application; Use the Helm tool to define the Kubernetes configuration of the application, and automatically deploy the Kubernetes configuration to the Kubernetes cluster through the Argo CD tool; Use the Flux tool to monitor the configuration change information in the code repository, and synchronously update the Kubernetes cluster according to the configuration change information; Use a security scanning tool to perform vulnerability scanning and intrusion detection on the containers in the Kubernetes cluster in real time to obtain scanning and detection results; ELK Stack is used to analyze the log data of the Kubernetes cluster to obtain analysis results, and a detection analysis report is generated according to the analysis results and the scan detection results.

2. The development and operation method based on container orchestration according to claim 1 is characterized in that: The code is submitted to the code repository, and the GitLab CI tool in the code repository is used to automatically build and test the code to obtain the application, including: Submit the code to the local repository and get the submission information; Convert the submitted information into a standard format to obtain submitted information in a standard format; Pushing the submission information in the standard format to a designated branch of a remote repository, so that the designated branch performs code updates based on the submission information in the standard format; The code is automatically built and tested using the GitLab CI tool in the local repository to obtain an application.

3. The development and operation method based on container orchestration according to claim 1 is characterized in that: The method of using the Helm tool to define the Kubernetes configuration of the application and automatically deploying the Kubernetes configuration to the Kubernetes cluster through the Argo CD tool includes: The Helm tool is used to define the Kubernetes configuration of the application; Containerize the Kubernetes configuration to obtain a container image; The container image is run using a Pod in a Kubernetes cluster to obtain a running container, wherein the Pod contains one or more containers; Deployment is used to manage the life cycle of the Pod and automatically adjust the number of the Pod according to the load.

4. The development and operation method based on container orchestration according to claim 1 is characterized in that: The using of the Flux tool to monitor the configuration change information in the code repository and synchronously updating the Kubernetes cluster according to the configuration change information includes: Use the Flux tool to monitor the configuration change information in the code repository; When the Flux tool monitors that the configuration change information is generated, the current configuration change information is obtained; Compare the configuration change information with the running status of the Kubernetes cluster to obtain a comparison result, and determine the changed part according to the comparison result; The Kubernetes cluster is synchronously updated according to the changed part.

5. The development and operation method based on container orchestration according to claim 1 is characterized in that: The security scanning tool is used to perform vulnerability scanning and intrusion detection on the containers in the Kubernetes cluster in real time to obtain scanning and detection results, including: Use Nessus or OpenVAS to perform vulnerability scans on containers in the Kubernetes cluster in real time to obtain scan results; Use Snort or Suricata to perform intrusion detection on the containers in the Kubernetes cluster in real time to obtain detection results; The scanning result and the detection result are integrated into a scanning detection result.

6. The development and operation method based on container orchestration according to claim 1 is characterized in that: The method of analyzing the log data of the Kubernetes cluster by using ELKStack to obtain an analysis result, and generating a detection analysis report according to the analysis result and the scanning detection result, includes: Prometheus collects performance indicators of containers and Kubernetes clusters in real time to obtain real-time performance indicator collection data; Generate the real-time performance indicator collection data into visual information through Grafana; Use ELK Stack to analyze the log data of the Kubernetes cluster and obtain analysis results; A detection analysis report is generated according to the visualization information, the analysis results and the scanning detection results.

7. The development and operation method based on container orchestration according to claim 1 is characterized in that: After analyzing the log data of the Kubernetes cluster by using ELKStack to obtain analysis results and generating a detection analysis report according to the analysis results and the scanning detection results, the method further includes: Identify text content information in the detection and analysis report; Performing word segmentation processing on the text content information to obtain multiple content segments, and extracting keywords from each of the content segments; Determining whether the keyword is an abnormal situation keyword; If yes, generating abnormal situation alarm information according to the abnormal situation keyword, and sending the abnormal situation alarm information to the management terminal; Merging the abnormal situation alarm information into the detection analysis report to obtain an abnormal situation report; The abnormal situation report is encrypted to obtain encrypted report information, and the encrypted report information is uploaded to the blockchain.

8. A development and operation device based on container orchestration, characterized in that: include: A submission building module is used to submit the code to the code repository, and use the GitLab CI tool in the code repository to automatically build and test the code to obtain an application; Define a deployment module, which is used to define the Kubernetes configuration of the application using the Helm tool, and automatically deploy the Kubernetes configuration to the Kubernetes cluster using the ArgoCD tool; A monitoring and updating module, used to monitor the configuration change information in the code repository using the Flux tool, and synchronously update the Kubernetes cluster according to the configuration change information; A scanning and detection module is used to use a security scanning tool to perform vulnerability scanning and intrusion detection on the containers in the Kubernetes cluster in real time to obtain scanning and detection results; The analysis and generation module is used to analyze the log data of the Kubernetes cluster by using the ELK Stack to obtain analysis results, and generate a detection analysis report according to the analysis results and the scanning detection results.

9. A development and operation equipment based on container orchestration, characterized in that: The development and operation equipment based on container orchestration includes: a memory and at least one processor, wherein instructions are stored in the memory; At least one of the processors calls the instructions in the memory to enable the container-orchestration-based development and operation device to perform each step of the container-orchestration-based development and operation method as described in any one of claims 1-7.

10. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instructions are executed by the processor, the steps of the development and operation method based on container orchestration as described in any one of claims 1 to 7 are implemented.

Images