Service access method and apparatus, communication device, and storage medium

Abstract

Embodiments of the present application provide a service access method and device, communication equipment and a storage medium. The method comprises: obtaining a target custom resource definition resource; receiving a service access request, the service access request comprising an internet protocol address and a time of accessing a service; verifying the service access request according to the internet protocol address of accessing the service, the time of accessing the service and the target custom resource definition resource to obtain a verification result of the service access request; and if the verification result of the service access request is passed, determining a target workload from the target custom resource definition resource according to a target resource label, and accessing the service on the target workload through the service access request. The present application can allow a user to access a service running on a target workload in Kubernetes according to a specific IP address and time by obtaining a target custom resource definition resource and combining a target resource label, thereby improving the efficiency, flexibility and security of service access.

Description

Technical Field

[0001] This invention relates to the fields of cloud computing and container orchestration technology, and in particular to a service access method, apparatus, communication device, and storage medium. Background Technology

[0002] With the increasing adoption of Kubernetes in cloud-native application deployments, more and more enterprises are migrating their mission-critical applications to the Kubernetes platform. Kubernetes provides powerful container orchestration capabilities, making application deployment, scaling, and management more efficient and flexible. However, as application complexity increases and business needs diversify, fine-grained control over service access permissions within the Kubernetes cluster becomes particularly important.

[0003] However, in modern cloud-native environments, interactions between services are frequent and complex. Access control not only affects system security and stability but also directly impacts business continuity and user experience. Fine-grained control over service access permissions in a Kubernetes cluster ensures that only authorized users and services can access specific resources, preventing unauthorized access and potential security threats. Therefore, implementing efficient, flexible, and secure service access control in a Kubernetes cluster has become a critical issue in cloud-native application deployment. Summary of the Invention

[0004] In view of this, the present invention aims to provide a service access method, apparatus, device and storage medium to solve the problems of large limitations, low efficiency and low security in dealing with complex and dynamic service access control requirements.

[0005] According to a first aspect of the present invention, a service access method is provided, applied to a container orchestration platform, wherein the container orchestration platform includes a plurality of workloads, and a plurality of services run on the workloads, the method comprising:

[0006] Obtain the target custom resource definition;

[0007] Receive a service access request, wherein the service access request includes the Internet Protocol address of the service to be accessed and the time of access to the service;

[0008] The service access request is verified based on the Internet Protocol address of the access service, the time of the access service, and the target custom resource definition resource to obtain the verification result of the service access request;

[0009] If the service access request passes the verification, the target workload is determined from the target custom resource definition resource based on the target resource tag, and the service on the target workload is accessed through the service access request.

[0010] Optionally, the acquisition of the target custom resource definition resource includes:

[0011] Pre-create custom resource definitions;

[0012] The custom resource definition is defined to obtain the target custom resource definition resource, wherein the target custom resource definition resource includes at least the range of Internet Protocol addresses allowed to be accessed, the time period allowed to be accessed, and the workload carrying resource tags;

[0013] Register the target custom resource definition resource to the container orchestration platform.

[0014] Optionally, the container orchestration platform includes an access policy controller and an ingress controller;

[0015] Prior to the step of receiving a service access request, the method includes:

[0016] The access policy controller monitors whether the target custom resource definition has changed.

[0017] If the target custom resource definition changes, then determine whether the container orchestration platform enables the network policy function;

[0018] If the container orchestration platform enables the network policy function, then determine whether a network policy exists in the container orchestration platform;

[0019] If the network policy exists in the container orchestration platform, then the network policy is updated according to the target custom resource definition;

[0020] If the network policy does not exist in the container orchestration platform, the network policy is generated based on the target custom resource definition resource.

[0021] Determine whether the entry controller serves as an entry point for external access;

[0022] If the ingress controller serves as the entry point for external access, then determine whether an ingress controller rule exists in the container orchestration platform;

[0023] If the ingress controller rule exists in the container orchestration platform, then the ingress controller rule is updated according to the target custom resource definition resource;

[0024] If the ingress controller rule does not exist in the container orchestration platform, the ingress controller rule is generated based on the target custom resource definition resource.

[0025] Optionally, the step of verifying the service access request based on the Internet Protocol address of the access service, the time of the access service, and the target custom resource definition to obtain the verification result of the service access request includes:

[0026] Determine whether the Internet Protocol address of the access service is within the range of allowed Internet Protocol addresses and whether the time of access is within the allowed time period.

[0027] If the Internet Protocol address of the access service is within the range of allowed Internet Protocol addresses and the time of access is within the allowed time period, then the verification result of the service access request is determined to be passed.

[0028] If the Internet Protocol address of the access service is within the range of allowed Internet Protocol addresses, or if the time of accessing the service is within the allowed time period, then the verification result of the service access request is determined to be unsuccessful.

[0029] Optionally, after the step of verifying the service access request based on the Internet Protocol address of the access service, the time of the access service, and the target custom resource definition resource to obtain the verification result of the service access request, the method includes:

[0030] If the service access request fails the verification, then access to the service on the target workload is denied through the service access request.

[0031] Record an access denial log, wherein the access denial log includes at least the Internet Protocol address of the service that was denied access and the time when the service was denied access.

[0032] Optionally, before the step of defining the custom resource definition to obtain the target custom resource definition, the method includes:

[0033] Add resource tags to the workloads in the container orchestration platform;

[0034] Establish the correspondence between the resource tags and the workloads.

[0035] Optionally, determining the target workload from the target custom resource definition resource based on the target resource tag, and accessing the service on the target workload through the service access request includes:

[0036] The target workload is determined based on the target resource tags and the correspondence between the resource tags and the workload;

[0037] Send the service access request to the target workload;

[0038] If the target workload receives the service access request, access to the service on the target workload is permitted.

[0039] According to a second aspect of the present invention, a service access device is provided, the service access device comprising:

[0040] The target custom resource definition acquisition module is used to acquire target custom resource definition resources;

[0041] A service access request receiving module is used to receive service access requests, wherein the service access request includes the Internet Protocol address of the service to be accessed and the time of access to the service;

[0042] The service access request verification module is used to verify the service access request based on the Internet Protocol address of the access service, the time of the access service, and the target custom resource definition resource, and obtain the verification result of the service access request.

[0043] The service access module is used to determine the target workload from the target custom resource definition resource according to the target resource tag if the verification result of the service access request is successful, and access the service on the target workload through the service access request.

[0044] Optionally, the target custom resource definition acquisition module includes:

[0045] The custom resource definition creation submodule is used to pre-create custom resource definition resources;

[0046] The target custom resource definition determination submodule is used to define the custom resource definition resource to obtain the target custom resource definition resource, wherein the target custom resource definition resource includes at least the range of Internet protocol addresses allowed to be accessed, the time period allowed to be accessed, and the workload carrying resource tags;

[0047] The target custom resource definition registration submodule is used to register the target custom resource definition resource to the container orchestration platform.

[0048] Optionally, the container orchestration platform includes an access policy controller and an ingress controller, and the device includes:

[0049] The target custom resource definition monitoring module is used to monitor whether the target custom resource definition resource has changed through the access policy controller.

[0050] The network policy function detection module is used to determine whether the container orchestration platform has enabled the network policy function if the target custom resource definition changes.

[0051] The network policy detection module is used to determine whether a network policy exists in the container orchestration platform if the network policy function is enabled in the container orchestration platform.

[0052] The network policy update module is used to update the network policy according to the target custom resource definition if the network policy exists in the container orchestration platform.

[0053] The network policy generation module is used to generate the network policy based on the target custom resource definition if the network policy does not exist in the container orchestration platform.

[0054] An entry controller detection module is used to determine whether the entry controller serves as an entry point for external access.

[0055] An entry controller rule detection module is used to determine whether there are entry controller rules in the container orchestration platform if the entry controller is used as an entry point for external access.

[0056] An ingress controller rule update module is used to update the ingress controller rule according to the target custom resource definition if the ingress controller rule exists in the container orchestration platform.

[0057] The ingress controller rule generation module is used to generate the ingress controller rule based on the target custom resource definition if the ingress controller rule does not exist in the container orchestration platform.

[0058] Optionally, the service access request verification module includes:

[0059] The data judgment submodule is used to determine whether the Internet Protocol address of the access service is within the range of allowed Internet Protocol addresses and whether the time of accessing the service is within the allowed time period.

[0060] The first verification result determination submodule is used to determine that the verification result of the service access request is passed if the Internet Protocol address of the access service is within the range of allowed Internet Protocol addresses and the time of accessing the service is within the allowed time period.

[0061] The second verification result determination submodule is used to determine that the verification result of the service access request is unsuccessful if the Internet Protocol address of the accessed service is within the range of allowed Internet Protocol addresses, or if the time of the accessed service is within the allowed time period.

[0062] Optionally, the device includes:

[0063] The access denial module is used to refuse access to the service on the target workload if the verification result of the service access request fails.

[0064] The access denial logging module is used to record access denial logs, wherein the access denial logs include at least the Internet Protocol address of the service that was denied access and the time when the service was denied access.

[0065] Optionally, the target custom resource definition acquisition module includes:

[0066] The resource tag adding submodule is used to add resource tags to the workloads in the container orchestration platform.

[0067] The mapping relationship establishment submodule is used to establish the mapping relationship between the resource tags and the workloads.

[0068] Optionally, the service access module includes:

[0069] The target workload determination submodule is used to determine the target workload based on the target resource tags and the correspondence between the resource tags and the workload;

[0070] The service access request sending submodule is used to send the service access request to the target workload;

[0071] The service access submodule is configured to allow access to the service on the target workload when the target workload receives the service access request.

[0072] According to another aspect of the present invention, an electronic device is also provided, comprising:

[0073] processor;

[0074] Memory used to store the processor's executable instructions;

[0075] The processor is configured to execute the instructions to implement the service access method described above.

[0076] According to another aspect of the present invention, a readable storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the service access method as described above.

[0077] The service access method provided in this invention is applied to a container orchestration platform. The container orchestration platform includes several workloads, each running several services. The method involves: acquiring a target custom resource definition; receiving a service access request, which includes the Internet Protocol address (IP address) and time of access; verifying the service access request based on the IIP address, time, and the target custom resource definition to obtain a verification result; if the verification result is successful, determining the target workload from the target custom resource definition based on the target resource tag, and accessing the service on the target workload via the service access request. This invention, by acquiring the target custom resource definition and combining it with the target resource tag, allows users to access services running on a target workload in Kubernetes based on a specific IP address and time. This enables fine-grained service access control, meeting complex and dynamic access control needs, thereby improving the efficiency, flexibility, and security of service access. Furthermore, it solves the problems of significant limitations, low efficiency, and low security in dealing with complex and dynamic service access control needs.

[0078] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0079] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below.

[0080] Figure 1 This is one of the flowcharts of a service access method provided in an embodiment of the present invention;

[0081] Figure 2 This is the second step flowchart of a service access method provided in an embodiment of the present invention;

[0082] Figure 3 This is the third step in a flowchart of a service access method provided in an embodiment of the present invention;

[0083] Figure 4 This is the fourth step in a flowchart of a service access method provided in an embodiment of the present invention;

[0084] Figure 5 This is the fifth step in a flowchart of a service access method provided in an embodiment of the present invention;

[0085] Figure 6 This is the sixth step in a flowchart of a service access method provided in an embodiment of the present invention;

[0086] Figure 7 This is the seventh step in a flowchart of a service access method provided in an embodiment of the present invention;

[0087] Figure 8 This is a device block diagram of a service access device provided in an embodiment of the present invention;

[0088] Figure 9 This is a schematic diagram of a communication device provided in an embodiment of the present invention. Detailed Implementation

[0089] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the various embodiments of the present invention will be described in detail below with reference to the accompanying drawings. However, those skilled in the art will understand that many technical details are presented in the various embodiments of the present invention to facilitate a better understanding of this application. However, the technical solutions claimed in this application can be implemented even without these technical details and various changes and modifications based on the following embodiments. The division of the various embodiments below is for ease of description and should not constitute any limitation on the specific implementation of the present invention. The various embodiments can be combined with and referenced by each other without contradiction.

[0090] Reference Figure 1 This diagram illustrates one of the steps of a service access method provided in an embodiment of the present invention, applied to a container orchestration platform. The container orchestration platform includes several workloads, and several services run on each workload. The method may include:

[0091] Step 101: Obtain the target custom resource definition resource.

[0092] It should be noted that, in this embodiment of the invention, the container orchestration platform can be a Kubernetes cluster. The container orchestration platform includes several workloads, and each workload runs several services.

[0093] To avoid the limitations of container orchestration platforms in handling complex and dynamic service access, predefined CRD (Custom Resource Definition) resources can be used. These predefined CRD resources serve as the target CRD resources. Once the target CRD resources are available, the container orchestration platform can directly access and apply them.

[0094] Step 102: Receive a service access request, wherein the service access request includes the Internet Protocol address of the service to be accessed and the time of access.

[0095] Step 103: Verify the service access request based on the Internet Protocol address of the accessed service, the time of access, and the target custom resource definition, and obtain the verification result of the service access request.

[0096] Step 104: If the service access request verification result is successful, then determine the target workload from the target custom resource definition resource according to the target resource tag, and access the service on the target workload through the service access request.

[0097] It should be noted that, in this embodiment of the invention, the container orchestration platform receives a service access request, wherein the service access request includes the Internet Protocol address of the service to be accessed and the time of access to the service.

[0098] When the container orchestration platform receives a service access request, it verifies the service access request and obtains the verification result. Specifically, it can verify the service access request based on the Internet Protocol address of the service to be accessed, the time of access to the service carried in the service access request, and the target custom resource definition, and thus obtain the verification result of the service access request.

[0099] If the service access request passes verification, the container orchestration platform can determine the target workload from the target custom resource definition resources based on the target resource tag. After determining the target workload, the container orchestration platform allows access to the service running on the target workload via the service access request.

[0100] This invention, by acquiring target custom resource definitions and combining them with target resource tags, enables users to access services running on target workloads in Kubernetes based on specific IP addresses and times. This allows for fine-grained service access control, meeting complex and dynamic access control needs, thereby improving the efficiency, flexibility, and security of service access. Furthermore, it solves the problems of significant limitations, low efficiency, and low security in dealing with complex and dynamic service access control needs.

[0101] Furthermore, such as Figure 2 The diagram illustrates a second flowchart of the service access method provided in an embodiment of the present invention. In this embodiment, step 101 may further include the following steps:

[0102] Step 201: Pre-create custom resource definitions.

[0103] It should be noted that, in this embodiment of the invention, defining custom resources is a way to extend the API of the container orchestration platform. By creating custom resource definitions, users can define their own resource types, which can be managed and operated just like the built-in resources of the container orchestration platform (such as Pods, Services, etc.).

[0104] Step 202: Define the custom resource definition to obtain the target custom resource definition resource. The target custom resource definition resource includes at least the range of Internet Protocol addresses allowed to be accessed, the time period allowed to be accessed, and the workload carrying resource tags.

[0105] It should be noted that, in this embodiment of the invention, after creating a custom resource definition, a specific custom resource instance of the custom resource definition can be defined through the custom resource definition. Once the specific custom resource instance of the custom resource definition is defined, the target custom resource definition resource is obtained. The specific custom resource instance is the content contained in the target custom resource definition resource, and may include at least the allowed range of Internet Protocol addresses, the allowed time period, and the workload carrying resource tags.

[0106] Step 203: Register the target custom resource definition resource into the container orchestration platform.

[0107] It should be noted that, in this embodiment of the invention, after obtaining the target custom resource definition, the target custom resource definition is registered with the container orchestration platform. After registration, the container orchestration platform will be able to identify and manage these target custom resource definitions, just like managing built-in resources.

[0108] This invention enables fine-grained and flexible access control of services in a container orchestration platform based on the target custom resource definition resource by creating a custom resource definition resource, defining the custom resource definition resource to obtain the target custom resource definition resource, and registering the target custom resource definition resource.

[0109] Furthermore, such as Figure 3 The diagram illustrates a third step of the service access method provided in this embodiment of the invention. In this embodiment, the following steps may be included before step 102:

[0110] Step 301: Monitor whether the target custom resource definition has changed by accessing the policy controller.

[0111] It should be noted that, in this embodiment of the invention, an access policy controller is pre-developed on the container orchestration platform. This access policy controller can monitor whether the target custom resource definition has changed. Specifically, since the Client-Go library in the container orchestration platform interacts with the API Server, the access policy controller can listen to the API Server's watch interface to obtain information on whether the target custom resource definition has been added, deleted, or updated.

[0112] Step 302: If the target custom resource definition changes, determine whether the container orchestration platform has enabled the network policy function.

[0113] It should be noted that, in this embodiment of the invention, when the access policy controller detects that the target custom resource definition has changed, the access policy controller first checks whether the container orchestration platform has enabled the network policy function, wherein the network policy function allows users to define and enforce network access control rules.

[0114] Step 303: If the container orchestration platform enables the network policy function, determine whether there is a network policy in the container orchestration platform.

[0115] It should be noted that, in this embodiment of the invention, when the container orchestration platform has network policy functionality enabled, the access policy controller further detects whether a network policy related to the target custom resource definition already exists in the container orchestration platform. Here, network policy refers to the ability of the access policy controller to create or update network policy objects to restrict network communication between Pods in the container orchestration platform if the container orchestration platform has network policy functionality enabled.

[0116] Step 304: If a network policy exists in the container orchestration platform, update the network policy according to the target custom resource definition.

[0117] It should be noted that, in this embodiment of the invention, if there is a network policy related to the target custom resource definition resource in the container orchestration platform, the access policy controller will update the existing network policy according to the target custom resource definition resource.

[0118] Step 305: If there is no network policy in the container orchestration platform, generate a network policy based on the target custom resource definition.

[0119] It should be noted that, in this embodiment of the invention, if there is no network policy related to the target custom resource definition resource in the container orchestration platform, the access policy controller will generate a new network policy based on the target custom resource definition resource.

[0120] Step 306: Determine whether the entry controller is used as an entry point for external access.

[0121] It should be noted that, in this embodiment of the invention, the access policy controller will detect whether the ingress controller (such as Ingress) is used as the entry point for external access. The ingress controller (such as Ingress) is typically used to route external traffic to services within the container orchestration platform.

[0122] Step 307: If the ingress controller is used as the entry point for external access, then determine whether there is an ingress controller rule in the container orchestration platform.

[0123] It should be noted that, in this embodiment of the invention, when the ingress controller (such as Ingress) serves as the entry point for external access, the access policy controller further detects whether ingress controller rules (such as Ingress rules) related to the target custom resource definition already exist in the container orchestration platform. Here, Ingress rules refer to the ability of the access policy controller to restrict access based on IP address and time period by updating the rules of the Ingress object if the ingress controller (such as Ingress) serves as the entry point for external access.

[0124] Step 308: If an ingress controller rule exists in the container orchestration platform, update the ingress controller rule according to the target custom resource definition.

[0125] It should be noted that, in this embodiment of the invention, when there are ingress controller rules in the container orchestration platform, the access policy controller will update the existing ingress controller rules (such as Ingress rules) according to the target custom resource definition.

[0126] Step 309: If there is no ingress controller rule in the container orchestration platform, then generate an ingress controller rule based on the target custom resource definition resource.

[0127] It should be noted that, in this embodiment of the invention, when an ingress controller rule exists in the container orchestration platform,

[0128] It should be noted that, in this embodiment of the invention, the access policy controller will generate new ingress controller rules (such as Ingress rules) based on the target custom resource definition resource.

[0129] This invention ensures the real-time performance and accuracy of service access control policies by dynamically monitoring and managing target custom resource definitions. When target custom resource definitions change, the access policy controller can respond promptly and generate / update corresponding network policies / ingress controller rules, ensuring that access control policies, ingress controller rules, and changes to target custom resource definitions remain consistent, thereby improving the security and stability of service access.

[0130] Furthermore, such as Figure 4 The diagram illustrates a fourth step of the service access method provided in this embodiment of the invention. In this embodiment, step 103 may further include the following steps:

[0131] Step 401: Determine whether the Internet Protocol address of the accessed service is within the range of allowed Internet Protocol addresses and whether the access time is within the allowed time period.

[0132] Step 402: If the Internet Protocol address for accessing the service is within the range of allowed Internet Protocol addresses and the time for accessing the service is within the allowed time period, then the verification result of the service access request is determined to be successful.

[0133] Step 403: If the Internet Protocol address for accessing the service is within the range of allowed Internet Protocol addresses, or if the time for accessing the service is within the allowed time period, then the verification result of the service access request is determined to be unsuccessful.

[0134] It should be noted that, in this embodiment of the invention, since the target custom resource definition resource includes at least the range of allowed Internet Protocol addresses and the allowed time period, the specific implementation process for verifying the service access request based on the Internet Protocol address of the access service, the time of accessing the service, and the target custom resource definition resource to obtain the verification result of the service access request is as follows: determining whether the Internet Protocol address of the access service is within the range of allowed Internet Protocol addresses, and determining whether the time of accessing the service is within the allowed time period.

[0135] If the IP (Internet Protocol) address accessing the service is within the allowed IP address range, and the access time is within the allowed time period, then the service access request is deemed to have passed the verification, meaning access to the service running on the workload in the container orchestration platform is permitted.

[0136] If the IP address accessing the service is within the allowed IP address range but the access time is outside the allowed time period, or if the IP address accessing the service is outside the allowed IP address range but the access time is within the allowed time period, then the service access request is deemed to have failed the verification, i.e., access to the service running on the workload in the container orchestration platform is denied.

[0137] This invention verifies the legitimacy of service access requests by determining whether the Internet Protocol address (IP address) and the time of access are within the allowed access range. This ensures that only verified service access requests can access services running on workloads in the container orchestration platform, preventing unauthorized access and potential security threats, thereby improving the security and stability of service access.

[0138] Furthermore, such as Figure 5 The diagram illustrates the fifth step of a service access method provided in an embodiment of the present invention. In this embodiment, the following steps may be included after step 103:

[0139] Step 501: If the service access request fails the verification, then the service access request is denied access to the service on the target workload.

[0140] Step 502: Record an access denial log, wherein the access denial log includes at least the Internet Protocol address of the service that was denied access and the time when the service was denied access.

[0141] It should be noted that, in this embodiment of the invention, if the verification result of the service access request fails, the service access request is rejected, preventing it from accessing the service running on the workload in the container orchestration platform.

[0142] Furthermore, if access to the target workload's service is denied via a service access request, a relevant access denial log will be recorded for subsequent auditing and analysis. This access denial log may include the IP address and time of successful service access, the IP address and time of denied service access, and the IP address and time of attempted service access.

[0143] This invention improves service access security and stability by rejecting service access requests when the verification result fails, thus preventing access to services on the target workload. This ensures that only qualified requests can access the service, preventing unauthorized access and potential security threats. Furthermore, by logging access denial requests, this invention facilitates subsequent security audits and compliance checks, ensuring the security and compliance of service access.

[0144] Furthermore, such as Figure 6 The diagram illustrates a sixth step of the service access method provided in this embodiment of the invention. In this embodiment, the following steps may be included after step 202:

[0145] Step 601: Add resource tags to the workloads in the container orchestration platform.

[0146] Step 602: Establish the correspondence between resource tags and workloads.

[0147] It should be noted that, in this embodiment of the invention, resource labels are a mechanism used in container orchestration platforms to identify and select workloads. By adding resource labels to workloads, workloads can be easily classified, selected, and managed.

[0148] In container orchestration platforms, the mapping between resource tags and workloads is achieved through label selectors. Label selectors allow users to select and manipulate workloads based on resource tags.

[0149] Therefore, once resource tags are added to workloads in the container orchestration platform, a mapping between resource tags and workloads can be established.

[0150] This invention establishes a correspondence between resource tags and workloads by adding resource tags to workloads. This not only enables the classification, selection, and management of workloads, but also allows the selection of workloads based on the correspondence between resource tags and workloads.

[0151] Furthermore, such as Figure 7 The diagram illustrates the seventh step of a service access method provided in an embodiment of the present invention. In this embodiment, step 104 may further include the following steps:

[0152] Step 701: Determine the target workload based on the target resource tags and the correspondence between resource tags and workloads.

[0153] Step 702: Send the service access request to the target workload.

[0154] Step 703: If the target workload receives a service access request, allow access to the service on the target workload.

[0155] It should be noted that, in this embodiment of the invention, by using a tag selector and querying the container orchestration platform according to the correspondence between resource tags and workloads, the workload matching the target resource tag is determined, and the workload matching the target resource tag is the target workload.

[0156] After identifying the target workload, a service access request is sent to that target workload. Upon receiving the service access request, the target workload is granted access to the service running on it.

[0157] This invention determines the target workload based on the target resource tag and the correspondence between the resource tag and the workload, and sends the service access request to the target workload, ultimately allowing access to the service on the target workload, thereby improving the efficiency and security of service access.

[0158] Furthermore, in this embodiment of the invention, the following steps may be included before step 102:

[0159] Establish communication between the NTP client and the NTP server so that the NTP client can periodically synchronize its time with the NTP server;

[0160] Integrate the access policy controller with the NTP client so that the access policy controller can periodically synchronize its time with the NTP server.

[0161] It should be noted that, in this embodiment of the invention, the NTP server provides accurate time information by synchronizing with a high-precision time source (such as an atomic clock, GPS, etc.).

[0162] Establish communication between the NTP client and the NTP server to ensure that the NTP client periodically synchronizes its time with the NTP server. Once communication between the NTP client and the NTP server is established, integrating the access policy controller with the NTP client enables the access policy controller to synchronize its time with the NTP server. This allows for the acquisition of accurate time information, ensuring time accuracy and enabling the correct determination of whether the time of the service access request falls within the allowed access period, thus ensuring the effectiveness and reliability of the access control policy.

[0163] This invention integrates the access policy controller with the NTP client, enabling time synchronization between the access policy controller and the NTP server. This allows for the acquisition of accurate time information, ensuring time accuracy and enabling the correct determination of whether the access time included in the service access request is within the allowed access period, thus ensuring the effectiveness and reliability of the access control policy.

[0164] According to embodiments of the present invention, a service access device is also provided, referring to... Figure 8 , Figure 8 This is a device block diagram of a service access apparatus provided in an embodiment of the present invention. The service access apparatus includes:

[0165] The target custom resource definition acquisition module 801 is used to acquire the target custom resource definition resource;

[0166] The service access request receiving module 802 is used to receive service access requests, wherein the service access request includes the Internet Protocol address of the service to be accessed and the time of access to the service;

[0167] The service access request verification module 803 is used to verify the service access request based on the Internet Protocol address of the access service, the time of accessing the service, and the target custom resource definition, and obtain the verification result of the service access request.

[0168] The service access module 804 is used to determine the target workload from the target custom resource definition resource according to the target resource tag if the service access request verification result is successful, and access the service on the target workload through the service access request.

[0169] Optionally, the target custom resource definition acquisition module 801 includes:

[0170] The custom resource definition creation submodule is used to pre-create custom resource definition resources;

[0171] The target custom resource definition determination submodule is used to define custom resource definitions to obtain target custom resource definitions. The target custom resource definition includes at least the range of allowed Internet Protocol addresses, the allowed time period, and the workload carrying resource tags.

[0172] The target custom resource definition registration submodule is used to register target custom resource definitions with the container orchestration platform.

[0173] Optionally, the container orchestration platform includes an access policy controller and an ingress controller, the device comprising:

[0174] The target custom resource definition monitoring module is used to monitor whether the target custom resource definition resource has changed through the access policy controller.

[0175] The network policy function detection module is used to determine whether the container orchestration platform has enabled the network policy function if the target custom resource definition changes.

[0176] The network policy detection module is used to determine whether a network policy exists in the container orchestration platform if the network policy function is enabled.

[0177] The network policy update module is used to update the network policy according to the target custom resource definition if the network policy exists in the container orchestration platform.

[0178] The network policy generation module is used to generate a network policy based on the target custom resource definition if no network policy exists in the container orchestration platform.

[0179] The entry controller detection module is used to determine whether the entry controller serves as an entry point for external access.

[0180] The ingress controller rule detection module is used to determine whether there are ingress controller rules in the container orchestration platform if the ingress controller is used as an entry point for external access.

[0181] The ingress controller rule update module is used to update the ingress controller rules according to the target custom resource definition if ingress controller rules exist in the container orchestration platform.

[0182] The ingress controller rule generation module is used to generate ingress controller rules based on the target custom resource definition if ingress controller rules do not exist in the container orchestration platform.

[0183] Optionally, the service access request verification module 803 includes:

[0184] The data judgment submodule is used to determine whether the Internet Protocol address of the accessed service is within the range of allowed Internet Protocol addresses and whether the time of access to the service is within the allowed time period.

[0185] The first verification result determination submodule is used to determine that the verification result of the service access request is passed if the Internet Protocol address of the accessed service is within the range of allowed Internet Protocol addresses and the time of access to the service is within the allowed time period.

[0186] The second verification result determination submodule is used to determine that the verification result of the service access request is unsuccessful if the Internet Protocol address of the accessed service is within the range of allowed Internet Protocol addresses, or if the time of accessing the service is within the allowed time period.

[0187] Optionally, the device includes:

[0188] The Deny Service module is used to deny access to services on the target workload if the service access request fails the verification.

[0189] The access denial logging module is used to record access denial logs, which include at least the Internet Protocol address of the service that was denied access and the time when the service was denied access.

[0190] Optionally, the target custom resource definition acquisition module 801 includes:

[0191] The resource tag adding submodule is used to add resource tags to workloads in the container orchestration platform;

[0192] The mapping establishment submodule is used to establish the mapping relationship between resource tags and workloads.

[0193] Optionally, service access module 804 includes:

[0194] The target workload determination submodule is used to determine the target workload based on the target resource tags and the correspondence between resource tags and workloads;

[0195] The service access request sending submodule is used to send service access requests to the target workload;

[0196] The service access submodule is used to allow access to services on the target workload when the target workload receives a service access request.

[0197] This invention also provides an electronic device, such as... Figure 9 As shown, it includes a processor 901, a communication interface 902, a memory 903, and a communication bus 904, wherein the processor 901, the communication interface 902, and the memory 903 communicate with each other through the communication bus 904.

[0198] Memory 903 is used to store computer programs;

[0199] When processor 901 executes a program stored in memory 903, it performs the following steps:

[0200] Obtain the target custom resource definition;

[0201] Receive service access requests, wherein the service access request includes the Internet Protocol address of the service to be accessed and the time of access;

[0202] The service access request is verified based on the Internet Protocol address of the accessed service, the time of access, and the target custom resource definition, and the verification result of the service access request is obtained.

[0203] If the service access request passes the verification, the target workload is determined from the target custom resource definition resource based on the target resource tag, and the service on the target workload is accessed through the service access request.

[0204] The communication bus mentioned above can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0205] The communication interface is used for communication between the aforementioned terminal and other devices.

[0206] The memory may include random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0207] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0208] In another embodiment of the present invention, a computer-readable storage medium is also provided, which stores instructions that, when executed on a computer, cause the computer to perform any of the service access methods described in the above embodiments.

[0209] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., a solid-state drive, or SSD).

[0210] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0211] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0212] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. A service access method characterized by, The method is applied to a container orchestration platform, wherein the container orchestration platform comprises a plurality of workloads and an access policy controller, the workloads run a plurality of services, and the method comprises the following steps: obtaining a target custom resource definition resource, wherein the target custom resource definition resource at least comprises an allowed Internet Protocol address range, an allowed time period, and a workload carrying a resource label; monitoring whether the target custom resource definition resource changes through the access policy controller; if the target custom resource definition resource changes, determining whether the container orchestration platform enables a network policy function; if the container orchestration platform enables the network policy function, determining whether a network policy exists in the container orchestration platform; if the network policy exists in the container orchestration platform, updating the network policy according to the target custom resource definition resource; receiving a service access request, wherein the service access request comprises an Internet Protocol address of an accessed service and a time of accessing the service; verifying the service access request according to the Internet Protocol address of the accessed service, the time of accessing the service, and the target custom resource definition resource to obtain a verification result of the service access request; if the verification result of the service access request is passed, determining a target workload from the target custom resource definition resource according to a target resource label, and accessing the service on the target workload through the service access request; wherein the verification of the service access request according to the Internet Protocol address of the accessed service, the time of accessing the service, and the target custom resource definition resource to obtain the verification result of the service access request comprises: determining whether the Internet Protocol address of the accessed service is within the allowed Internet Protocol address range and whether the time of accessing the service is within the allowed time period; if the Internet Protocol address of the accessed service is within the allowed Internet Protocol address range and the time of accessing the service is within the allowed time period, determining that the verification result of the service access request is passed.

2. The method of claim 1, wherein, The obtaining of the target custom resource definition resource comprises: precreating a custom resource definition resource; defining the custom resource definition resource to obtain a target custom resource definition resource; registering the target custom resource definition resource in the container orchestration platform.

3. The method of claim 1, wherein, The container orchestration platform further comprises an ingress controller; before the step of receiving the service access request, the method comprises: if the network policy does not exist in the container orchestration platform, generating the network policy according to the target custom resource definition resource; determining whether the ingress controller serves as an entry point of external access; if the ingress controller serves as the entry point of external access, determining whether an ingress controller rule exists in the container orchestration platform; if the ingress controller rule exists in the container orchestration platform, updating the ingress controller rule according to the target custom resource definition resource; If the ingress controller rule does not exist in the container orchestration platform, the ingress controller rule is generated according to the target custom resource definition resource.

4. The method of claim 2, wherein, The service access request is verified according to the internet protocol address of the access service, the time of the access service and the target custom resource definition resource, and a verification result of the service access request is obtained. If the internet protocol address of the access service is within the range of the allowed internet protocol addresses, or the time of the access service is within the time period of the allowed access, it is determined that the verification result of the service access request is not passed.

5. The method of claim 1, wherein, After the step of verifying the service access request according to the internet protocol address of the access service, the time of the access service and the target custom resource definition resource, and obtaining the verification result of the service access request, the method comprises: If the verification result of the service access request is not passed, the service access request is rejected to access the service on the target workload; A rejection access log is recorded, wherein the rejection access log at least includes the internet protocol address of the access service and the time of the access service.

6. The method of claim 2, wherein, Before the step of defining the custom resource definition resource to obtain the target custom resource definition resource, the method comprises: Adding a resource label to the workload in the container orchestration platform; Establishing a corresponding relationship between the resource label and the workload.

7. The method of claim 6, wherein, The target workload is determined from the target custom resource definition resource according to the target resource label, and the service on the target workload is accessed through the service access request, comprising: Determining the target workload according to the target resource label and the corresponding relationship between the resource label and the workload; Sending the service access request to the target workload; If the target workload receives the service access request, the service on the target workload is allowed to be accessed.

8. A service access device, characterized by The application is applied to a container orchestration platform, wherein the container orchestration platform comprises a plurality of workloads and an access policy controller, and a plurality of services are run on the workloads, and the service access device comprises: A target custom resource definition acquisition module is configured to acquire a target custom resource definition resource, wherein the target custom resource definition resource at least includes a range of allowed internet protocol addresses, a time period of allowed access and a workload carrying a resource label; A target custom resource definition monitoring module is configured to monitor whether the target custom resource definition resource changes through the access policy controller; A network policy function detection module is configured to determine whether the container orchestration platform enables a network policy function if the target custom resource definition resource changes; A network policy detection module is configured to determine whether a network policy exists in the container orchestration platform if the container orchestration platform enables the network policy function. a network policy updating module, configured to update the network policy according to the target custom resource definition resource if the network policy exists in the container orchestration platform; a service access request receiving module, configured to receive a service access request, wherein the service access request comprises an internet protocol address for accessing a service and a time for accessing the service; a service access request verifying module, configured to verify the service access request according to the internet protocol address for accessing the service, the time for accessing the service and the target custom resource definition resource, to obtain a verification result of the service access request; a service accessing module, configured to determine a target workload from the target custom resource definition resource according to a target resource label if the verification result of the service access request is passed, and access the service on the target workload through the service access request; wherein the service access request verifying module comprises: a data judging sub-module, configured to judge whether the internet protocol address for accessing the service is within the range of the allowed internet protocol addresses and whether the time for accessing the service is within the time period for allowed access; a first verification result determining sub-module, configured to determine that the verification result of the service access request is passed if the internet protocol address for accessing the service is within the range of the allowed internet protocol addresses and the time for accessing the service is within the time period for allowed access.

9. An electronic device, comprising: comprise: a memory for storing processor-executable instructions; wherein the processor is configured to execute the instructions to implement the service access method according to any one of claims 1 to 7.

10. A readable storage medium, characterized by, a computer program is stored on the readable storage medium, and the computer program is executed by the processor to implement the service access method according to any one of claims 1 to 7.

Images