Service access method and device, communication equipment and storage medium

Abstract

Embodiments of the invention provide a service access method and apparatus, a communication device and a storage medium. The method comprises the steps of obtaining a target custom resource definition resource; receiving a service access request, wherein the service access request comprises an internet protocol address and time of an access service; according to the Internet protocol address of the access service, the time of the access service and the target custom resource definition resource, verifying the service access request to obtain a verification result of the service access request; and if the verification result of the service access request is passed, determining a target workload from the target custom resource definition resources according to the target resource label, and accessing the service on the target workload through the service access request. According to the method and the device, the resource is defined by acquiring the target self-defined resource, and the target resource label is combined, so that the user can be allowed to access the service running on the target working load in the Kubernetes according to the specific IP address and time, and the service access efficiency, flexibility and safety are further improved.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud computing and container orchestration, and in particular to a service access method, device, communication equipment and storage medium. Background Art

[0002] With the popularity of Kubernetes in cloud-native application deployment, more and more companies are migrating their key businesses to the Kubernetes platform. Kubernetes provides powerful container orchestration capabilities, making application deployment, expansion and management more efficient and flexible. However, with the increasing complexity of applications and the diversification of business needs, fine-grained control of service access rights in Kubernetes clusters has become particularly important.

[0003] However, in modern cloud-native environments, interactions between services are frequent and complex. Access control is not only related to the security and stability of the system, but also directly affects business continuity and user experience. Fine-grained control of service access rights in Kubernetes clusters can ensure that only authorized users and services can access specific resources, preventing unauthorized access and potential security threats. Therefore, how to achieve efficient, flexible, and secure service access control in Kubernetes clusters has become a key issue in cloud-native application deployment. Summary of the invention

[0004] In view of this, the present invention aims to propose a service access method, device, equipment and storage medium to solve the problems of large limitations, low efficiency and low security when dealing with complex and dynamic service access control requirements.

[0005] According to a first aspect of the present invention, a service access method is provided, which is applied to a container orchestration platform, wherein the container orchestration platform includes a plurality of workloads, and a plurality of services are running on the workloads. The method includes:

[0006] Get the target custom resource definition resource;

[0007] receiving a service access request, wherein the service access request includes an Internet Protocol address of an access service and a time to access the service;

[0008] Verifying the service access request according to the Internet Protocol address of the access service, the time of accessing the service, and the target custom resource definition resource to obtain a verification result of the service access request;

[0009] If the verification result of the service access request is passed, a target workload is determined from the target custom resource definition resource according to the target resource tag, and the service on the target workload is accessed through the service access request.

[0010] Optionally, obtaining a target custom resource definition resource includes:

[0011] Pre-create custom resource definition resources;

[0012] The custom resource definition resource is defined to obtain a target custom resource definition resource, wherein the target custom resource definition resource at least includes an Internet Protocol address range allowed for access, a time period allowed for access, and a workload carrying a resource tag;

[0013] Register the target custom resource definition resource in the container orchestration platform.

[0014] Optionally, the container orchestration platform includes an access policy controller and an ingress controller;

[0015] Prior to the step of receiving a service access request, the method comprises:

[0016] Monitoring, by the access policy controller, whether the target custom resource definition resource changes;

[0017] If the target custom resource definition resource changes, determining whether the container orchestration platform enables the network policy function;

[0018] If the container orchestration platform enables the network policy function, determining whether there is a network policy in the container orchestration platform;

[0019] If the network policy exists in the container orchestration platform, updating the network policy according to the target custom resource definition;

[0020] If the network policy does not exist in the container orchestration platform, generating the network policy according to the target custom resource definition resource;

[0021] Determining whether the entry controller serves as an entry point for external access;

[0022] If the ingress controller is used as an entry point for external access, determining whether there is an ingress controller rule in the container orchestration platform;

[0023] If the ingress controller rule exists in the container orchestration platform, the ingress controller rule is updated according to the target custom resource definition resource;

[0024] If the ingress controller rule does not exist in the container orchestration platform, the ingress controller rule is generated according to the target custom resource definition resource.

[0025] Optionally, the verifying the service access request according to the Internet Protocol address of the access service, the time of the access service, and the target custom resource definition resource to obtain the verification result of the service access request includes:

[0026] Determine whether the Internet Protocol address for accessing the service is within the range of Internet Protocol addresses allowed for access and whether the time for accessing the service is within the time period allowed for access;

[0027] If the Internet Protocol address for accessing the service is within the range of Internet Protocol addresses allowed for access and the time for accessing the service is within the time period allowed for access, determining that the verification result of the service access request is passed;

[0028] If the Internet Protocol address for accessing the service is within the range of Internet Protocol addresses allowed for access, or the time for accessing the service is within the time period allowed for access, then it is determined that the verification result of the service access request is failed.

[0029] Optionally, after the step of verifying the service access request according to the Internet Protocol address of the access service, the time of accessing the service, and the target custom resource definition resource to obtain a verification result of the service access request, the method includes:

[0030] If the verification result of the service access request is failure, denying access to the service on the target workload through the service access request;

[0031] Recording a denied access log, wherein the denied access log at least includes an Internet Protocol address of a denied access service and a time when the denied access service is performed.

[0032] Optionally, before the step of defining the custom resource definition resource to obtain a target custom resource definition resource, the method includes:

[0033] Adding resource tags to the workload in the container orchestration platform;

[0034] A corresponding relationship between the resource tag and the workload is established.

[0035] Optionally, determining a target workload from the target custom resource definition resource according to the target resource tag, and accessing the service on the target workload through the service access request includes:

[0036] Determine a target workload according to a target resource tag and a corresponding relationship between the resource tag and the workload;

[0037] sending the service access request to the target workload;

[0038] In a case where the target workload receives the service access request, access to the service on the target workload is allowed.

[0039] According to a second aspect of the present invention, a service access device is provided, the service access device comprising:

[0040] The target custom resource definition acquisition module is used to obtain the target custom resource definition resource;

[0041] A service access request receiving module, used to receive a service access request, wherein the service access request includes an Internet Protocol address of an access service and a time of accessing the service;

[0042] A service access request verification module, used to verify the service access request according to the Internet Protocol address of the access service, the time of the access service and the target custom resource definition resource, and obtain a verification result of the service access request;

[0043] A service access module is used to determine a target workload from the target custom resource definition resource according to a target resource tag if the verification result of the service access request is passed, and access the service on the target workload through the service access request.

[0044] Optionally, the target custom resource definition acquisition module includes:

[0045] The custom resource definition creation submodule is used to pre-create custom resource definition resources;

[0046] A target custom resource definition determination submodule, configured to define the custom resource definition resource to obtain a target custom resource definition resource, wherein the target custom resource definition resource at least includes an Internet Protocol address range allowed for access, a time period allowed for access, and a workload carrying a resource tag;

[0047] The target custom resource definition registration submodule is used to register the target custom resource definition resource in the container orchestration platform.

[0048] Optionally, the container orchestration platform includes an access policy controller and an entry controller, and the device includes:

[0049] A target custom resource definition monitoring module, used to monitor whether the target custom resource definition resource changes through the access policy controller;

[0050] A network policy function detection module, used to determine whether the container orchestration platform enables the network policy function if the target custom resource definition resource changes;

[0051] A network policy detection module, configured to determine whether a network policy exists in the container orchestration platform if the network policy function is enabled on the container orchestration platform;

[0052] A network policy update module, configured to update the network policy according to the target custom resource definition resource if the network policy exists in the container orchestration platform;

[0053] A network policy generation module, configured to generate the network policy according to the target custom resource definition resource if the network policy does not exist in the container orchestration platform;

[0054] An entry controller detection module, used to determine whether the entry controller is used as an entry point for external access;

[0055] An ingress controller rule detection module, used to determine whether an ingress controller rule exists in the container orchestration platform if the ingress controller is used as an entry point for external access;

[0056] An ingress controller rule updating module, configured to update the ingress controller rule according to the target custom resource definition resource if the ingress controller rule exists in the container orchestration platform;

[0057] An ingress controller rule generation module is used to generate the ingress controller rule according to the target custom resource definition resource if the ingress controller rule does not exist in the container orchestration platform.

[0058] Optionally, the service access request verification module includes:

[0059] A data judgment submodule, used to judge whether the Internet Protocol address of the access service is within the range of the Internet Protocol addresses allowed to be accessed, and whether the time of accessing the service is within the time period allowed to be accessed;

[0060] A first verification result determination submodule, configured to determine that the verification result of the service access request is passed if the Internet Protocol address of the access service is within the range of Internet Protocol addresses allowed to be accessed and the time of accessing the service is within the time period allowed to access;

[0061] The second verification result determination submodule is used to determine that the verification result of the service access request is failed if the Internet Protocol address of the access service is within the range of Internet Protocol addresses allowed for access, or the time of accessing the service is within the time period allowed for access.

[0062] Optionally, the device comprises:

[0063] A service access denial module, configured to deny access to the service on the target workload through the service access request if the verification result of the service access request is failure;

[0064] The access denial log recording module is used to record the access denial log, wherein the access denial log at least includes the Internet Protocol address of the access denied service and the time of the access denied service.

[0065] Optionally, the target custom resource definition acquisition module includes:

[0066] A resource tag adding submodule, used to add resource tags to the workload in the container orchestration platform;

[0067] The corresponding relationship establishing submodule is used to establish the corresponding relationship between the resource tag and the workload.

[0068] Optionally, the service access module includes:

[0069] A target workload determination submodule, configured to determine a target workload according to a target resource tag and a corresponding relationship between the resource tag and the workload;

[0070] A service access request sending submodule, used for sending the service access request to the target workload;

[0071] The service access submodule is used to allow access to the service on the target workload when the target workload receives the service access request.

[0072] According to another aspect of the present invention, there is also provided an electronic device, comprising:

[0073] processor;

[0074] a memory for storing instructions executable by the processor;

[0075] The processor is configured to execute the instructions to implement the service access method as described above.

[0076] According to another aspect of the present invention, a readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the service access method described above are implemented.

[0077] The service access method provided by the embodiment of the present invention is applied to a container orchestration platform, wherein the container orchestration platform includes several workloads, and several services are running on the workload, and a target custom resource definition resource is obtained; a service access request is received, wherein the service access request includes an Internet Protocol address of the access service and a time of accessing the service; the service access request is verified according to the Internet Protocol address of the access service, the time of accessing the service, and the target custom resource definition resource, and a verification result of the service access request is obtained; if the verification result of the service access request is passed, the target workload is determined from the target custom resource definition resource according to the target resource label, and the service on the target workload is accessed through the service access request. The present invention can allow a user to access the service running on the target workload in Kubernetes according to a specific IP address and time by obtaining the target custom resource definition resource and combining the target resource label, so as to realize refined service access control, meet complex and dynamic access control requirements, and thus improve the efficiency, flexibility and security of service access, and further solve the problems of large limitations, low efficiency and low security when dealing with complex and dynamic service access control requirements.

[0078] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below.

[0080] Figure 1 One of the step flow charts of a service access method provided by an embodiment of the present invention;

[0081] Figure 2 This is the second step flow chart of a service access method provided by an embodiment of the present invention;

[0082] Figure 3 This is a step flow chart of a service access method provided by an embodiment of the present invention;

[0083] Figure 4 This is a fourth step flow chart of a service access method provided by an embodiment of the present invention;

[0084] Figure 5 This is a step flow chart of a service access method provided by an embodiment of the present invention;

[0085] Figure 6 This is the sixth step flow chart of a service access method provided by an embodiment of the present invention;

[0086] Figure 7 This is the seventh step flow chart of a service access method provided by an embodiment of the present invention;

[0087] Figure 8 is a device block diagram of a service access device provided by an embodiment of the present invention;

[0088] Fig. 9 It is a schematic diagram of a communication device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0089] To make the purpose, technical scheme and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the embodiments of the present invention, many technical details are proposed in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can be implemented. The division of the following embodiments is for the convenience of description, and should not constitute any limitation on the specific implementation of the present invention. The various embodiments can be combined and referenced with each other without contradiction.

[0090] Reference Figure 1 , shows one of the step flow charts of the service access method provided by an embodiment of the present invention, which is applied to a container orchestration platform, wherein the container orchestration platform includes a plurality of workloads, and a plurality of services are running on the workloads. The method may include:

[0091] Step 101: Obtain target custom resource definition resources.

[0092] It should be noted that, in the embodiment of the present invention, the container orchestration platform may be a Kubernetes cluster. The container orchestration platform includes a number of workloads, and each workload runs a number of services.

[0093] In order to avoid the limitations of the container orchestration platform when dealing with complex and dynamic service access, CRD (Custom Resource Definition) resources can be pre-defined. The pre-defined custom resource definition resources are the target custom resource definition resources. When the target custom resource definition resources are obtained, the container orchestration platform can directly obtain the target custom resource definition resources and apply them.

[0094] Step 102: Receive a service access request, wherein the service access request includes an Internet Protocol address for accessing the service and a time for accessing the service.

[0095] Step 103 , verifying the service access request according to the Internet Protocol address of the access service, the time of accessing the service, and the target custom resource definition resource, and obtaining a verification result of the service access request.

[0096] Step 104: If the verification result of the service access request is passed, the target workload is determined from the target custom resource definition resource according to the target resource tag, and the service on the target workload is accessed through the service access request.

[0097] It should be noted that, in the embodiment of the present invention, the container orchestration platform receives a service access request, wherein the service access request includes an Internet Protocol address for accessing the service and a time for accessing the service.

[0098] When the container orchestration platform receives a service access request, the container orchestration platform verifies the service access request and obtains a verification result of the service access request. Specifically, the service access request may be verified according to the Internet Protocol address of the access service carried in the service access request, the time of accessing the service carried in the service access request, and the target custom resource definition resource, thereby obtaining a verification result of the service access request.

[0099] If the verification result of the service access request is passed, the container orchestration platform can determine the target workload from the target custom resource definition resources based on the target resource tag. After determining the target workload, the container orchestration platform allows access to the services running on the target workload through the service access request.

[0100] By obtaining the target custom resource definition resources and combining them with the target resource tags, the present invention can allow users to access the services running on the target workload in Kubernetes according to specific IP addresses and times, and can implement refined service access control to meet complex and dynamic access control requirements, thereby improving the efficiency, flexibility and security of service access. Furthermore, it solves the problems of large limitations, low efficiency and low security when dealing with complex and dynamic service access control requirements.

[0101] Furthermore, if Figure 2 FIG. 2 shows a second flow chart of the service access method provided by an embodiment of the present invention. In the embodiment of the present invention, step 101 may further include the following steps:

[0102] Step 201: Pre-create a custom resource definition resource.

[0103] It should be noted that in the embodiment of the present invention, in the container orchestration platform, custom resource definition resources are a way to extend the container orchestration platform API. By creating custom resource definition resources, users can define their own resource types, which can be managed and operated like the built-in resources of the container orchestration platform (such as Pod, Service, etc.).

[0104] Step 202 : Define the custom resource definition resource to obtain a target custom resource definition resource, wherein the target custom resource definition resource at least includes an Internet Protocol address range allowed for access, a time period allowed for access, and a workload carrying a resource tag.

[0105] It should be noted that, in an embodiment of the present invention, when the creation of a custom resource definition resource is completed, a specific custom resource instance of the custom resource definition resource can be defined through a custom resource definition. When the definition of the specific custom resource instance of the custom resource definition resource is completed, the target custom resource definition resource can be obtained. Among them, the specific custom resource instance is the content included in the target custom resource definition resource, which can at least include the Internet Protocol address range allowed to be accessed, the time period allowed to access, and the workload carrying the resource tag.

[0106] Step 203: register the target custom resource definition resource in the container orchestration platform.

[0107] It should be noted that in the embodiment of the present invention, after obtaining the target custom resource definition resources, the target custom resource definition resources are registered in the container orchestration platform. After registration, the container orchestration platform will be able to identify and manage these target custom resource definition resources, just like managing built-in resources.

[0108] The present invention creates a custom resource definition resource, defines the custom resource definition resource to obtain a target custom resource definition resource, and registers the target custom resource definition resource, thereby enabling refined and flexible access control of services in a container orchestration platform based on the target custom resource definition resource.

[0109] Furthermore, if Figure 3 As shown, a third step flow chart of the service access method provided by an embodiment of the present invention is shown. In the embodiment of the present invention, the following steps may be included before step 102:

[0110] Step 301: monitor whether a target custom resource definition resource changes through an access policy controller.

[0111] It should be noted that in the embodiment of the present invention, an access policy controller is developed in advance in the container orchestration platform. The access policy controller can monitor whether the target custom resource definition resources have changed. Specifically, since the Client-Go library in the container orchestration platform interacts with the API Server, the access policy controller can obtain whether the target custom resource definition resources have been added, deleted, or updated by monitoring the watch interface of the API Server.

[0112] Step 302: If the target custom resource definition resource changes, determine whether the container orchestration platform enables the network policy function.

[0113] It should be noted that in an embodiment of the present invention, when the access policy controller monitors changes in the target custom resource definition resources, the access policy controller first detects whether the network policy function is enabled on the container orchestration platform, where the network policy function allows users to define and implement network access control rules.

[0114] Step 303: If the network policy function is enabled on the container orchestration platform, determine whether there is a network policy in the container orchestration platform.

[0115] It should be noted that in the embodiment of the present invention, when the network policy function is enabled on the container orchestration platform, the access policy controller further detects whether a network policy related to the target custom resource definition resource already exists in the container orchestration platform. Wherein, the network policy means that if the network policy function is enabled on the container orchestration platform, the access policy controller can create or update the network policy object to restrict the network communication between Pods in the container orchestration platform.

[0116] Step 304: If a network policy exists in the container orchestration platform, the network policy is updated according to the target custom resource definition resource.

[0117] It should be noted that, in the embodiment of the present invention, when there is a network policy related to the target custom resource definition resource in the container orchestration platform, the access policy controller will update the existing network policy according to the target custom resource definition resource.

[0118] Step 305: If no network policy exists in the container orchestration platform, a network policy is generated according to the target custom resource definition resource.

[0119] It should be noted that, in the embodiment of the present invention, when there is no network policy related to the target custom resource definition resource in the container orchestration platform, the access policy controller will generate a new network policy according to the target custom resource definition resource.

[0120] Step 306, determine whether the entry controller is used as an entry point for external access.

[0121] It should be noted that, in an embodiment of the present invention, the access policy controller detects whether the ingress controller (such as Ingress) is used as an entry point for external access, wherein the ingress controller (such as Ingress) is typically used to route external traffic to services within the container orchestration platform.

[0122] Step 307: If the ingress controller is used as the entry point for external access, determine whether there is an ingress controller rule in the container orchestration platform.

[0123] It should be noted that in an embodiment of the present invention, when the ingress controller (such as Ingress) is used as the entry point for external access, the access policy controller further detects whether there are already ingress controller rules (such as Ingress rules) related to the target custom resource definition resources in the container orchestration platform. Among them, the Ingress rule means that if the ingress controller (such as Ingress) is used as the entry point for external access, the access policy controller can limit access based on IP addresses and time periods by updating the rules of the Ingress object.

[0124] Step 308: If an ingress controller rule exists in the container orchestration platform, the ingress controller rule is updated according to the target custom resource definition resource.

[0125] It should be noted that, in an embodiment of the present invention, when there are ingress controller rules in the container orchestration platform, the access policy controller will update the existing ingress controller rules (such as Ingress rules) according to the target custom resource definition resources.

[0126] Step 309: If no ingress controller rule exists in the container orchestration platform, an ingress controller rule is generated according to the target custom resource definition resource.

[0127] It should be noted that in the embodiment of the present invention, when there are ingress controller rules in the container orchestration platform,

[0128] It should be noted that, in an embodiment of the present invention, the access policy controller will generate new ingress controller rules (such as Ingress rules) according to the target custom resource definition resources.

[0129] The present invention ensures the real-time and accuracy of the service access control policy by dynamically monitoring and managing the target custom resource definition resources. When the target custom resource definition resources change, the access policy controller can respond in time and generate / update the corresponding network policy / entry controller rules to ensure that the access control policy and the entry controller rules are consistent with the changes of the target custom resource definition resources, thereby improving the security and stability of service access.

[0130] Furthermore, if Figure 4 FIG. 4 shows a flow chart of the steps of the service access method provided by the embodiment of the present invention. In the embodiment of the present invention, step 103 may also include the following steps:

[0131] Step 401, determining whether the Internet Protocol address for accessing the service is within the range of Internet Protocol addresses allowed for access, and whether the time for accessing the service is within the time period allowed for access.

[0132] Step 402: If the Internet Protocol address for accessing the service is within the range of Internet Protocol addresses allowed for access and the time for accessing the service is within the time period allowed for access, then it is determined that the verification result of the service access request is passed.

[0133] Step 403: If the Internet Protocol address for accessing the service is within the range of Internet Protocol addresses allowed for access, or the time for accessing the service is within the time period allowed for access, then the verification result of the service access request is determined to be failed.

[0134] It should be noted that, in the embodiment of the present invention, since the target custom resource definition resource includes at least the Internet Protocol address range allowed for access and the time period allowed for access, the service access request is verified based on the Internet Protocol address of the access service, the time of accessing the service and the target custom resource definition resource, and the specific implementation process of obtaining the verification result of the service access request is: determining whether the Internet Protocol address of the access service is within the Internet Protocol address range allowed for access, and determining whether the time of accessing the service is within the time period allowed for access.

[0135] If the IP (Internet Protocol) address for accessing the service is within the range of IP addresses allowed for access, and the time for accessing the service is within the time period allowed for access, the verification result of the service access request is determined to be passed, that is, access to the service running on the workload in the container orchestration platform is allowed.

[0136] If the IP address accessing the service is within the allowed IP address range and the time of accessing the service is not within the allowed access time period, or if the IP address accessing the service is not within the allowed IP address range and the time of accessing the service is within the allowed access time period, the verification result of the service access request is determined to be failed, that is, access to the service running on the workload in the container orchestration platform is denied.

[0137] The present invention verifies the legitimacy of service access requests by determining whether the Internet Protocol address (IP address) of the access service and the time of accessing the service are within the range of permitted access, thereby ensuring that only service access requests that have passed the verification can access the services running on the workload in the container orchestration platform, preventing unauthorized access and potential security threats, thereby improving the security and stability of service access.

[0138] Furthermore, if Figure 5 FIG. 5 shows a flow chart of the steps of the service access method provided by the embodiment of the present invention. In the embodiment of the present invention, after step 103, the following steps may be further included:

[0139] Step 501: If the verification result of the service access request is failure, access to the service on the target workload through the service access request is denied.

[0140] Step 502: Record a denied access log, wherein the denied access log at least includes an Internet Protocol address of a denied access service and a time when the denied access service is performed.

[0141] It should be noted that, in an embodiment of the present invention, if the verification result of the service access request is failure, the service access request is rejected, and the service access request is prevented from accessing the service running on the workload in the container orchestration platform.

[0142] In addition, if access to the service on the target workload is denied through a service access request, the relevant denied access log will be recorded for subsequent audit and analysis. The denied access log may include the IP address and time of successful access to the service, the IP address and time of denied access to the service, and the IP address and time of attempted access to the service.

[0143] The present invention can improve the security and stability of service access by rejecting the request and preventing it from accessing the service on the target workload when the verification result of the service access request is not passed, ensuring that only qualified requests can access, preventing unauthorized access and potential security threats. In addition, the present invention can record the relevant access denial log when the service access request is rejected, facilitating subsequent security audits and compliance checks, thereby ensuring the security and compliance of service access.

[0144] Furthermore, if Figure 6 As shown, a sixth step flow chart of the service access method provided by an embodiment of the present invention is shown. In the embodiment of the present invention, after step 202, the following steps may also be included:

[0145] Step 601: Add resource tags to workloads in the container orchestration platform.

[0146] Step 602: Establish a corresponding relationship between resource tags and workloads.

[0147] It should be noted that, in the embodiment of the present invention, resource labels are a mechanism for identifying and selecting workloads in the container orchestration platform. By adding resource labels to workloads, workloads can be conveniently classified, selected, and managed.

[0148] In the container orchestration platform, the correspondence between resource labels and workloads is implemented through label selectors, which allow users to select and operate workloads based on resource labels.

[0149] Therefore, when adding resource tags to workloads in the container orchestration platform, a corresponding relationship between resource tags and workloads can be established.

[0150] The present invention adds resource tags to workloads and establishes a correspondence between resource tags and workloads, which not only enables classification, selection and management of workloads, but also enables selection of workloads based on the correspondence between resource tags and workloads.

[0151] Furthermore, if Figure 7 FIG. 7 shows a flow chart of the steps of the service access method provided by the embodiment of the present invention. In the embodiment of the present invention, step 104 may also include the following steps:

[0152] Step 701: determine a target workload according to a target resource tag and a correspondence between a resource tag and a workload.

[0153] Step 702: Send the service access request to the target workload.

[0154] Step 703: When the target workload receives the service access request, access to the service on the target workload is allowed.

[0155] It should be noted that in the embodiment of the present invention, by using a label selector and querying the container orchestration platform according to the correspondence between resource labels and workloads, the workload that matches the target resource label is determined, and the workload that matches the target resource label is the target workload.

[0156] After determining the target workload, a service access request is sent to the target workload. Upon receiving the service access request, the target workload allows access to the service running on the target workload.

[0157] The present invention determines the target workload according to the target resource tag and the corresponding relationship between the resource tag and the workload, and sends the service access request to the target workload, thereby finally allowing access to the service on the target workload, thereby improving the efficiency and security of service access.

[0158] Furthermore, in the embodiment of the present invention, the following steps may be included before step 102:

[0159] Establish communication between the NTP client and the NTP server so that the NTP client can synchronize time with the NTP server regularly;

[0160] Integrate the access policy controller with the NTP client to enable the access policy controller to synchronize time with the NTP server periodically.

[0161] It should be noted that, in the embodiment of the present invention, the NTP server provides accurate time information by synchronizing with a high-precision time source (such as an atomic clock, GPS, etc.).

[0162] Establish communication between the NTP client and the NTP server to ensure that the NTP client synchronizes time with the NTP server regularly. When the communication between the NTP client and the NTP server is established, the access policy controller can be integrated with the NTP client to synchronize time with the NTP server, thereby obtaining accurate time information and ensuring the accuracy of time, thereby correctly determining whether the time for accessing the service included in the service access request is within the time period allowed for access, and ensuring the effectiveness and reliability of the access control policy.

[0163] The present invention integrates the access policy controller with the NTP client to achieve time synchronization between the access policy controller and the NTP server, thereby being able to obtain accurate time information and ensure the accuracy of the time, thereby correctly judging whether the time for accessing the service included in the service access request is within the time period allowed for access, thereby ensuring the effectiveness and reliability of the access control policy.

[0164] According to an embodiment of the present invention, a service access device is also provided. Figure 8 , Figure 8 : is a device block diagram of a service access device provided by an embodiment of the present invention, the service access device comprising:

[0165] The target custom resource definition acquisition module 801 is used to acquire the target custom resource definition resource;

[0166] A service access request receiving module 802, configured to receive a service access request, wherein the service access request includes an Internet Protocol address of the access service and a time of accessing the service;

[0167] The service access request verification module 803 is used to verify the service access request according to the Internet protocol address of the access service, the time of accessing the service and the target custom resource definition resource, and obtain the verification result of the service access request;

[0168] The service access module 804 is used to determine the target workload from the target custom resource definition resources according to the target resource tag if the verification result of the service access request is passed, and access the service on the target workload through the service access request.

[0169] Optionally, the target custom resource definition acquisition module 801 includes:

[0170] The custom resource definition creation submodule is used to pre-create custom resource definition resources;

[0171] A target custom resource definition determination submodule is used to define a custom resource definition resource to obtain a target custom resource definition resource, wherein the target custom resource definition resource at least includes an Internet Protocol address range allowed for access, a time period allowed for access, and a workload carrying a resource tag;

[0172] The target custom resource definition registration submodule is used to register the target custom resource definition resources in the container orchestration platform.

[0173] Optionally, the container orchestration platform includes an access policy controller and an ingress controller, and the device includes:

[0174] The target custom resource definition monitoring module is used to monitor whether the target custom resource definition resource has changed through the access policy controller;

[0175] The network policy function detection module is used to determine whether the network policy function is enabled on the container orchestration platform if the target custom resource definition resource changes;

[0176] A network policy detection module is used to determine whether a network policy exists in the container orchestration platform if the container orchestration platform enables the network policy function;

[0177] A network policy update module, configured to update the network policy according to the target custom resource definition resource if the network policy exists in the container orchestration platform;

[0178] A network policy generation module, used to generate a network policy according to a target custom resource definition resource if no network policy exists in the container orchestration platform;

[0179] An entry controller detection module is used to determine whether the entry controller is used as an entry point for external access;

[0180] An ingress controller rule detection module is used to determine whether an ingress controller rule exists in the container orchestration platform if the ingress controller is used as an entry point for external access;

[0181] An ingress controller rule update module is used to update the ingress controller rule according to the target custom resource definition resource if the ingress controller rule exists in the container orchestration platform;

[0182] The ingress controller rule generation module is used to generate an ingress controller rule according to the target custom resource definition resource if the ingress controller rule does not exist in the container orchestration platform.

[0183] Optionally, the service access request verification module 803 includes:

[0184] A data judgment submodule is used to judge whether the Internet Protocol address for accessing the service is within the range of Internet Protocol addresses allowed for access and whether the time for accessing the service is within the time period allowed for access;

[0185] A first verification result determination submodule, configured to determine that the verification result of the service access request is passed if the Internet Protocol address for accessing the service is within the range of Internet Protocol addresses allowed for access and the time for accessing the service is within the time period allowed for access;

[0186] The second verification result determination submodule is used to determine that the verification result of the service access request is not passed if the Internet Protocol address for accessing the service is within the range of Internet Protocol addresses allowed for access, or the time for accessing the service is within the time period allowed for access.

[0187] Optionally, the device comprises:

[0188] A denial of access to a service module, used to deny access to the service on the target workload through the service access request if the verification result of the service access request is failure;

[0189] The access denial log recording module is used to record the access denial log, wherein the access denial log at least includes the Internet Protocol address of the access denied service and the time of the access denied service.

[0190] Optionally, the target custom resource definition acquisition module 801 includes:

[0191] The resource tag adding submodule is used to add resource tags to workloads in the container orchestration platform;

[0192] The corresponding relationship establishment submodule is used to establish the corresponding relationship between resource tags and workloads.

[0193] Optionally, the service access module 804 includes:

[0194] A target workload determination submodule, used to determine the target workload according to the target resource tag and the corresponding relationship between the resource tag and the workload;

[0195] A service access request sending submodule, used to send the service access request to the target workload;

[0196] The service access submodule is used to allow access to the service on the target workload when the target workload receives a service access request.

[0197] The embodiment of the present invention further provides an electronic device, such as Fig. 9 As shown, it includes a processor 901, a communication interface 902, a memory 903 and a communication bus 904, wherein the processor 901, the communication interface 902, and the memory 903 communicate with each other through the communication bus 904.

[0198] Memory 903, used for storing computer programs;

[0199] The processor 901 is used to execute the program stored in the memory 903, and implements the following steps:

[0200] Get the target custom resource definition resource;

[0201] receiving a service access request, wherein the service access request includes an Internet Protocol address for accessing the service and a time for accessing the service;

[0202] Verify the service access request according to the Internet protocol address of the access service, the time of accessing the service, and the target custom resource definition resource, and obtain a verification result of the service access request;

[0203] If the verification result of the service access request is passed, the target workload is determined from the target custom resource definition resources based on the target resource tag, and the service on the target workload is accessed through the service access request.

[0204] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0205] The communication interface is used for communication between the above terminal and other devices.

[0206] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0207] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0208] In another embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium stores instructions. When the instructions are executed on a computer, the computer executes the service access method described in any one of the above embodiments.

[0209] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Sol logo State Disk (SSD)), etc.

[0210] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0211] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0212] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A service access method, characterized in that: Applied to a container orchestration platform, wherein the container orchestration platform includes a plurality of workloads, and a plurality of services are running on the workloads, and the method includes: Get the target custom resource definition resource; receiving a service access request, wherein the service access request includes an Internet Protocol address of an access service and a time to access the service; Verifying the service access request according to the Internet Protocol address of the access service, the time of accessing the service, and the target custom resource definition resource to obtain a verification result of the service access request; If the verification result of the service access request is passed, a target workload is determined from the target custom resource definition resource according to the target resource tag, and the service on the target workload is accessed through the service access request.

2. The method according to claim 1, characterized in that The acquisition of the target custom resource definition resource includes: Pre-create custom resource definition resources; The custom resource definition resource is defined to obtain a target custom resource definition resource, wherein the target custom resource definition resource at least includes an Internet Protocol address range allowed for access, a time period allowed for access, and a workload carrying a resource tag; Register the target custom resource definition resource in the container orchestration platform.

3. The method according to claim 1, characterized in that The container orchestration platform includes an access policy controller and an entry controller; Prior to the step of receiving a service access request, the method comprises: Monitoring, by the access policy controller, whether the target custom resource definition resource changes; If the target custom resource definition resource changes, determining whether the container orchestration platform enables the network policy function; If the container orchestration platform enables the network policy function, determining whether there is a network policy in the container orchestration platform; If the network policy exists in the container orchestration platform, updating the network policy according to the target custom resource definition resource; If the network policy does not exist in the container orchestration platform, generating the network policy according to the target custom resource definition resource; Determining whether the entry controller serves as an entry point for external access; If the ingress controller is used as an entry point for external access, determining whether there is an ingress controller rule in the container orchestration platform; If the ingress controller rule exists in the container orchestration platform, the ingress controller rule is updated according to the target custom resource definition resource; If the ingress controller rule does not exist in the container orchestration platform, the ingress controller rule is generated according to the target custom resource definition resource.

4. The method according to claim 2, characterized in that: The verifying the service access request according to the Internet Protocol address of the access service, the time of the access service, and the target custom resource definition resource to obtain the verification result of the service access request includes: Determine whether the Internet Protocol address for accessing the service is within the range of Internet Protocol addresses allowed for access and whether the time for accessing the service is within the time period allowed for access; If the Internet Protocol address for accessing the service is within the range of Internet Protocol addresses allowed for access and the time for accessing the service is within the time period allowed for access, determining that the verification result of the service access request is passed; If the Internet Protocol address for accessing the service is within the range of Internet Protocol addresses allowed for access, or the time for accessing the service is within the time period allowed for access, then it is determined that the verification result of the service access request is failed.

5. The method according to claim 1, characterized in that After the step of verifying the service access request according to the Internet Protocol address of the access service, the time of accessing the service, and the target custom resource definition resource to obtain the verification result of the service access request, the method includes: If the verification result of the service access request is failure, denying access to the service on the target workload through the service access request; Recording a denied access log, wherein the denied access log at least includes an Internet Protocol address of a denied access service and a time when the denied access service is performed.

6. The method according to claim 2, characterized in that Before the step of defining the custom resource definition resource to obtain the target custom resource definition resource, the method includes: Adding resource tags to the workload in the container orchestration platform; A corresponding relationship between the resource tag and the workload is established.

7. The method according to claim 6, characterized in that The step of determining a target workload from the target custom resource definition resource according to the target resource tag, and accessing the service on the target workload through the service access request includes: Determine a target workload according to a target resource tag and a corresponding relationship between the resource tag and the workload; sending the service access request to the target workload; In a case where the target workload receives the service access request, access to the service on the target workload is allowed.

8. A service access device, characterized in that: The service access device comprises: The target custom resource definition acquisition module is used to obtain the target custom resource definition resource; A service access request receiving module, used to receive a service access request, wherein the service access request includes an Internet Protocol address of an access service and a time of accessing the service; A service access request verification module, used to verify the service access request according to the Internet Protocol address of the access service, the time of the access service and the target custom resource definition resource, and obtain a verification result of the service access request; A service access module is used to determine a target workload from the target custom resource definition resource according to a target resource tag if the verification result of the service access request is passed, and access the service on the target workload through the service access request.

9. An electronic device, characterized in that: include: a memory for storing processor-executable instructions; The processor is configured to execute the instructions to implement the service access method according to any one of claims 1 to 7.

10. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by a processor, the service access method according to any one of claims 1 to 7 is implemented.

Images