Container operation auditing method, device and equipment and storage medium

Abstract

The invention provides a container operation auditing method and device, equipment and a storage medium, and the method comprises the steps: generating a cluster operation record based on a container operation request, generating a container operation record based on a container operation event, and generating an auditing log based on a container operation fingerprint, the cluster operation fingerprint, the cluster operation record and the container operation record. By adopting the scheme of the embodiment of the invention, an agent system does not need to be introduced, a client does not need to migrate and use an authentication mode of another agent system, the method can be realized by multiplexing the existing access mode of the Kubernetes cluster, and the use habit of the client is not intruded.

Description

Technical Field

[0001] The present application belongs to the field of artificial intelligence technology, and specifically relates to a container operation audit method, device, equipment and storage medium. Background Art

[0002] With the booming development of cloud-native technologies, more and more companies are choosing to apply container technologies to their production environments. Kubernetes, a container orchestration system, is a type of cloud-native technology that is used to automatically deploy, scale, and manage containers. As technology rapidly develops, new security requirements are also emerging, such as how to audit container operations in the Kubernetes system and how to track the operator information of container operations.

[0003] In the related art, a kube-apiserver proxy system is developed to forward all requests to access Kubernetes to the kube-apiserver proxy system, which then performs security audits on container operations in Kubernetes. However, the use of the kube-apiserver proxy system requires changing the customer's habit of accessing Kubernetes and requires the customer to restrict members within the organization to access the cluster only through the proxy system, making it difficult to achieve non-intrusive operation audit requirements. Summary of the invention

[0004] The present application proposes a container operation audit method, device, equipment and storage medium to achieve non-invasive container operation audit.

[0005] The first embodiment of the present application provides a container operation audit method, including:

[0006] Generate a cluster operation record and a cluster operation fingerprint corresponding to the cluster operation record based on the detected container operation request;

[0007] Detecting kernel data corresponding to the container operation request from a node that responds to the container operation request;

[0008] Based on the kernel data, generate a container operation record and a container operation fingerprint corresponding to the container operation record;

[0009] An audit log is generated based on the cluster operation record, the cluster operation fingerprint, the container operation record, and the container operation fingerprint.

[0010] In some embodiments, generating a cluster operation record and a cluster operation fingerprint corresponding to the cluster operation record based on the detected container operation request includes:

[0011] Sending the container operation request to the service component included in the admission component through the uniform resource locator registered by the admission component; the admission component is deployed in the node that responds to the container operation request;

[0012] Obtain the container information and user information in the container operation request extracted by the service component;

[0013] The cluster operation record and the cluster operation fingerprint are generated based on the container information and the user information.

[0014] In some embodiments, generating a container operation record and a container operation fingerprint corresponding to the container operation record based on the kernel data includes:

[0015] Acquire session data corresponding to the process data included in the kernel data from the virtual file directory of the node; and acquire target container data corresponding to the process data from the container main process data in the container engine;

[0016] The container operation record and the container operation fingerprint are generated based on the process data, the session data and the target container data.

[0017] In some embodiments, generating an audit log based on the cluster operation record, the cluster operation fingerprint, the container operation record, and the container operation fingerprint includes:

[0018] Determine at least one container pointed to by the cluster operation fingerprint, and determine a target container pointed to by the container operation fingerprint;

[0019] Based on the at least one container and the target container, determining a target cluster operation fingerprint and a target container operation fingerprint having a first association relationship from the cluster operation fingerprint and the container operation fingerprint; wherein the target container pointed to by the target container operation fingerprint is a container in the at least one container pointed to by the target cluster operation fingerprint;

[0020] Establishing a second association relationship between a target cluster operation record and a target container operation record; the target cluster operation record corresponds to the target cluster operation fingerprint, and the target container operation record corresponds to the target container operation fingerprint;

[0021] The audit log is generated based on the first association relationship and the second association relationship.

[0022] In some embodiments, before generating the audit log based on the first association relationship and the second association relationship, the method further includes:

[0023] Based on the fingerprint parameters in the target container operation fingerprint, searching for an event fingerprint matching the target container operation fingerprint;

[0024] Based on the fingerprint parameters included in the event fingerprint, determining a target event record corresponding to the event fingerprint;

[0025] Establishing a third association relationship between the target container operation fingerprint and the event fingerprint, and establishing a fourth association relationship between the event fingerprint and the target event record;

[0026] Accordingly, generating the audit log based on the first association relationship and the second association relationship includes:

[0027] The audit log is generated based on the first association relationship, the second association relationship, the third association relationship, and the fourth association relationship.

[0028] In some embodiments, after searching for multiple event fingerprints matching the target container operation fingerprint based on the fingerprint parameters in the target container operation fingerprint, the method further includes:

[0029] Based on the time parameter included in the fingerprint parameter of the event fingerprint, an association relationship between the event fingerprints is established, and the association relationship between the event fingerprints represents the sequence of occurrence of the container operation events corresponding to the multiple event fingerprints.

[0030] In some embodiments, generating the audit log based on the first association relationship and the second association relationship includes:

[0031] generating a tracking session parameter for characterizing the first association relationship and the second association relationship;

[0032] Based on the tracing session parameters, the audit log is generated.

[0033] In some embodiments, after generating the audit log based on the first association relationship and the second association relationship, the method further includes:

[0034] Obtaining the container operation record to be queried from the audit log;

[0035] Based on the first association relationship, a cluster operation record associated with the container operation record to be queried is obtained from the audit log; and based on the second association relationship, an event record associated with the container operation record to be queried is obtained from the audit log.

[0036] The second aspect of the present application provides a container operation audit device, including:

[0037] A first generating module, configured to generate a cluster operation record and a cluster operation fingerprint corresponding to the cluster operation record based on the detected container operation request;

[0038] A detection module, configured to detect kernel data corresponding to the container operation request from a node that responds to the container operation request;

[0039] A second generating module, configured to generate a container operation record and a container operation fingerprint corresponding to the container operation record based on the kernel data;

[0040] The third generating module is used to generate an audit log based on the cluster operation record, the cluster operation fingerprint, the container operation record and the container operation fingerprint.

[0041] The third aspect of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the container operation audit method as described in the first aspect.

[0042] The fourth aspect of the present application provides a computer-readable storage medium on which a computer program is stored, and the program is executed by a processor to implement the container operation audit method as described in the first aspect.

[0043] The technical solution provided in the embodiments of the present application has at least the following technical effects or advantages:

[0044] In the embodiment of the present application, cluster operation records are generated based on container operation requests and container operation records are generated based on container operation events, and audit logs are generated based on container operation fingerprints, cluster operation fingerprints, cluster operation records, and container operation records. The solution of the embodiment of the present application does not require the introduction of a proxy system, and does not require customers to migrate to another proxy system authentication method. It can be achieved by reusing the existing access method of the Kubernetes cluster, without intrusion into the customer's usage habits.

[0045] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] By reading the detailed description of the preferred embodiment below, various other advantages and benefits will become clear to those of ordinary skill in the art. The accompanying drawings are only used for the purpose of illustrating the preferred embodiment and are not considered to be limitations of the present application. In addition, the same reference symbols are used to represent the same components throughout the accompanying drawings.

[0047] In the attached picture:

[0048] Figure 1 The general architecture diagram of the container orchestration system Kubernetes is schematically shown;

[0049] Figure 2 A flow chart of a container operation audit method provided by an embodiment of the present application is shown;

[0050] Figure 3 A schematic diagram of the structure of a container operation audit device provided by an embodiment of the present application is shown;

[0051] Figure 4 Another structural schematic diagram of a container operation audit device provided by an embodiment of the present application is shown;

[0052] Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present application is shown;

[0053] Figure 6 A schematic diagram of a storage medium provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0054] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0055] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by technicians in the field to which this application belongs.

[0056] With the booming development of cloud-native technology, more and more companies are choosing to apply container technology to their production environments. Kubernetes is a cloud-native technology that is used to automatically deploy, scale, and manage containers. As technology develops rapidly, new security requirements have also emerged, such as how to audit container operations in the Kubernetes system and how to track the operator information of container operations.

[0057] In the related art, a kube-apiserver proxy system is developed to forward all requests to access Kubernetes to the kube-apiserver proxy system, which then performs security audits on container operations in Kubernetes. However, the use of the kube-apiserver proxy system requires changing the customer's habit of accessing Kubernetes, restricting users to only use the kube-apiserver proxy system to access containers in Kubernetes, which is intrusive to the customer's current use of the Kubernetes cluster and makes it difficult to achieve non-intrusive operation audit requirements.

[0058] The technical solution provided by the embodiments of the present invention can be applied to container management systems, such as Kubernetes, to audit container operations and implement non-invasive container operation audits. In the following one or more embodiments, the technical solution of the present invention is mainly introduced by taking Kubernetes as an example.

[0059] Figure 1 The general architecture diagram of the container orchestration system Kubernetes is schematically shown. Figure 1 As shown in Figure 1, Kubernetes divides the nodes in the cluster into a master node (Master) and at least one worker node (Node). The Master and Node can be physical machines or virtual machines in the cloud environment. The cloud environment is specifically a computing cluster including at least one cloud computing device (such as a central server). In some implementations, the Master and Node can also be

[0060] The edge environment is a computing cluster including at least one edge computing device (e.g., an edge server). In other implementations, the Master and Node may also be end devices or virtual machines on end devices. It should be noted that the Master and Node may be physical machines or virtual machines in the same environment or in different environments. For example, the Master may be a physical machine in a cloud environment, and the Node may be a physical machine in an edge environment.

[0061] Among them, the Master runs a group of processes related to cluster management, such as the interface service component (kube-apiserver), kube controller manager (kube-controller-manager), scheduler (kube-scheduler) and storage (etcd) processes. The kube-apiserver relies on etcd to store data. Through these processes, the Master can achieve resource management, pod scheduling, elastic scaling, security control and error correction for the entire cluster.

[0062] The Node runs the application process to provide the application process with the resources it needs to run. The application process runs in the pod container. The Node also runs service processes, such as the proxy (kubelet) and network proxy (kube-proxy). The Node uses these service processes to create, start, restart, destroy, and load balance Pods.

[0063] Figure 1 The example below shows that a kubernetes cluster includes a master and a node. In some implementations, a kubernetes cluster can include multiple nodes, so that applications can be deployed in multiple nodes in a distributed manner. Furthermore, a kubernetes cluster can also include multiple masters. When a master fails, another master can be enabled, so that high availability can be guaranteed.

[0064] Figure 2 A flowchart of a container operation audit method provided by an embodiment of the present application, which can be executed by both the master node and the working node, such as Figure 2 As shown, the method may include the following steps:

[0065] Step 201: Generate a cluster operation record and a cluster operation fingerprint corresponding to the cluster operation record based on the detected container operation request. The cluster operation fingerprint can uniquely identify the cluster operation record.

[0066] In this embodiment, the cluster operation fingerprint is data obtained by refining the cluster operation record. Usually, the cluster operation fingerprint includes some key information related to link tracking in the cluster operation record, and the key information can distinguish the cluster operation record from other cluster operation records.

[0067] In this embodiment, the cluster operation fingerprint includes but is not limited to the user information of the user, the container identifier, the identifier of the cluster where the container is located, and / or the first command passed to the container through the interface service component, etc. Among them, the user information of the user is the information used by the user who initiates the container operation request in the authentication process of the interface service component. The container identifier is the identifier of the container of the container call request. In the application, the container identifier is not limited to the container name. The first command passed to the container through the interface service component is the first command executed by the container when executing the container call request. For example, taking the container call request to delete files in the container as an example, the first command passed to the container through the interface service component is the "enter" command. In the application, the first command passed to the container through the interface service component can be obtained based on the command parameters in the container operation request.

[0068] In some embodiments, generating a cluster operation record and a cluster operation fingerprint corresponding to the cluster operation record based on the detected container operation request may include:

[0069] Sending a container operation request to a service component included in the admission component through a uniform resource locator registered by the admission component; the admission component is deployed in a node that responds to the container operation request;

[0070] Obtain container information and user information in the service component extraction container operation request;

[0071] Based on the container information and user information, cluster operation records and cluster operation fingerprints are generated.

[0072] In this embodiment, when the apiserver detects a container operation request, it will call a remote URL (Uniform Resource Locator). This URL is the service address registered by the admission component through the ValidatingWebhookConfiguration configuration of kubernetes. The backend of the service address is the service component included in the admission component. After receiving the container operation request sent by the apiserver, the service component extracts the container information and user information in the container operation request, and generates a cluster operation record and cluster operation fingerprint based on the container information and user information. The service components included in the admission component include but are not limited to web services (http server).

[0073] In this embodiment, the container information is used to indicate the container that responds to the container operation request and the command executed by the container when responding to the container operation request. User information is used to indicate the information of the user who issued the container operation request. Among them, the container information includes but is not limited to the namespace (kube-test), Pod name (pod-name), container name (container-name), command name (bash) and command parameters. The command name and command parameters indicate the command to be executed by the container. User information includes but is not limited to the information of the kubernetes user contained in the credentials for executing the kubectl command, and the cloud account information request time cluster information that can be obtained based on this kubernetes user information.

[0074] Step 202: Detect kernel data corresponding to the container operation request from the node that responds to the container operation request.

[0075] Step 203: Generate a container operation record and a container operation fingerprint corresponding to the container operation record based on the kernel data. The container operation fingerprint can uniquely identify the container operation record.

[0076] In this embodiment, the container operation fingerprint is data obtained by refining the container operation record. Generally, the container operation fingerprint includes some key information related to link tracking in the container operation record, and the key information can distinguish the container operation record from other container operation records.

[0077] In this embodiment, the container operation fingerprint includes but is not limited to the container identifier, the operation command executed by the container, the process information of the process generated when the container executes the operation command, and / or the session information of the session to which the process belongs.

[0078] In some embodiments, generating a container operation record and a container operation fingerprint corresponding to the container operation record based on kernel data may include the following steps:

[0079] Obtaining session data corresponding to the process data included in the kernel data from the virtual file directory of the node; and obtaining target container data corresponding to the process data from the container main process data in the container engine;

[0080] Generate container operation records and container operation fingerprints based on process data, session data, and target container data.

[0081] In this embodiment, the process data included in the kernel data includes but is not limited to the process ID (ID, Identification), process name (rm), process parameters (such as / tmp / a.txt), parent process ID (ID, Identification), parent process name (bash), operation directory, etc. The session data includes but is not limited to the session ID (ID, Identification), shell ID (ID, Identification), and terminal ID.

[0082] It should be understood that the container engine has container main process data, and there is a one-to-one correspondence between the container main process data and the container. At the same time, there is a correspondence between the container main process data and the process data included in the kernel data. Therefore, the container data corresponding to each process in the process data included in the kernel data can be found through the container main process data (i.e., the target container data). Among them, the container main process data includes but is not limited to the container main process identification (ID, Identification) and the namespace information of the container main process. The target container data includes but is not limited to the namespace (kube-test), Pod name (pod-name), and container name (container-name). The namespace information of the container main process includes but is not limited to Cgroup (control groups, Linux control groups), the process identification (ID, Identification) of the container main process, Network (network), Mount (mount) and other information.

[0083] In this embodiment, an agent component (Agent component) is deployed in the node that responds to the container operation request. The Agent component includes a kernel-state eBPF (Extended Berkeley Packet Filter) program and a user-state program. The eBPF program is used to capture kernel data in the kernel and send the captured kernel data to the kernel ring buffer. The user-state program reads the kernel data from the kernel ring buffer and analyzes the read kernel data to obtain process data.

[0084] In this embodiment, in order to enrich the container operation record, the kernel data may also include network connection data and file descriptor data. Thus, when generating the container operation record, the network connection data and file descriptor data corresponding to the process data may be searched from the kernel data, and the container operation record may be generated together with reference to the found network connection data and file descriptor data.

[0085] The process data includes at least one of the following:

[0086] Context information when process creation and destruction events are triggered;

[0087] Process ID (Identification), process name, process parameters;

[0088] Parent process identification (ID, Identification);

[0089] Namespace information of the process;

[0090] Operation directory.

[0091] The network connection data includes at least one of the following:

[0092] Network connection creation and destruction events;

[0093] Contextual information when the event is triggered;

[0094] Source IP address, source port;

[0095] Destination IP address, destination port;

[0096] The process ID (Identification) or Network namespace information that creates the network connection.

[0097] The file descriptor data includes at least one of the following:

[0098] File descriptor creation and destruction events;

[0099] Contextual information when the event is triggered;

[0100] File information associated with the file descriptor;

[0101] The process ID (Identification) that created the file descriptor.

[0102] The user-mode program in the Agent component includes the part that interacts with the kernel-mode eBPF, the part that analyzes and aggregates, and the part that records container operations and generates container operation fingerprints.

[0103] The part that interacts with kernel-state eBPF is used to load the eBPF program into the kernel and attach it to multiple kernel observation points; and to observe and process kernel data written by the eBPF program from the kernel ring buffer.

[0104] Among them, the analysis and aggregation part is used to combine kernel data to determine the association relationship between process data, network connection data and file descriptor data. Specifically, the relationship between the parent and child processes and the relationship between the descendant processes of all processes in the process data can be expressed in a tree structure. Based on the network FD (file handle, filedescription) information of all processes, the process identification (ID, Identification) that creates the network connection or the Network namespace information, the network connection data is associated with the process in the process data. Based on the network FD (file handle, filedescription) information of all processes or the process identification (ID, Identification) that creates the file descriptor in the event, the file descriptor data is associated with the process in the process data.

[0105] In this embodiment, the session information corresponding to the process in the process data may be determined based on the process-related information in the / proc file system (virtual file directory).

[0106] In this embodiment, the target container data can be obtained by interacting with the container engine and the interface service component. Based on the container main process ID (Identification) and the namespace information of the container main process, the target container data is added to the information of each process in the previous process tree, and each process, network connection, and file descriptor are associated with the container.

[0107] It should be understood that in the process of responding to a container operation request, a node usually generates multiple container operation events, and the event records of these container operation events constitute a container operation record.

[0108] Take kubectl-n kube-test exec-it pod-name-c container-name bash to enter the container, and then execute the rm / tmp / a.txt command in the container as an example. At least the following container operation event records will be generated:

[0109] When entering the container, a process creation event is generated by executing the bash command through the runc program. Based on the above aggregated process tree information, the corresponding command execution event is enriched, and the event record of the container operation event contains the following information:

[0110] Operation time;

[0111] Process information: process ID (Identification), process name (runc), process parameters (xxxbash), parent process ID (ID), parent process name, operation directory;

[0112] Container information: namespace (kube-test), Pod name (pod-name), container name (container-name);

[0113] Session information: session ID (Identification), shell ID (ID), terminal ID.

[0114] After runc executes the bash program, an event of executing the bash command is generated. The event record of the corresponding container operation event contains the following information:

[0115] Operation time;

[0116] Process information: process ID (Identification), process name (bash), process parameters, parent process ID (Identification), parent process name (runc), operation directory;

[0117] Container information: namespace (kube-test), Pod name (pod-name), container name (container-name).

[0118] Session information: session ID (Identification), shell ID (ID), terminal ID.

[0119] When the rm / tmp / a.txt command is executed in the bash shell, the event record of the corresponding container operation event is generated, which contains the following information:

[0120] Operation time;

[0121] Process information: process ID (Identification), process name (rm), process parameters ( / tmp / a.txt), parent process ID (ID, Identification), parent process name (bash), operation directory;

[0122] Container information: namespace (kube-test), Pod name (pod-name), container name (container-name);

[0123] Session information: session ID (Identification), shell ID (ID), terminal ID.

[0124] Step 204: Generate an audit log based on the cluster operation record, the cluster operation fingerprint, the container operation record, and the container operation fingerprint.

[0125] In this embodiment, an audit log may be generated based on cluster operation records, cluster operation fingerprints, container operation records, and container operation fingerprints in response to a command from an external user. For example, in response to a command from an external user, an association relationship between cluster operation fingerprints and container operation fingerprints is established, an association relationship between cluster operation fingerprints and cluster operation records is established, and an association relationship between container operation fingerprints and container operation records is established.

[0126] In some embodiments, an intelligent analysis component may be deployed in a node that responds to a container operation request, and the intelligent analysis component may automatically generate an audit log based on cluster operation records, cluster operation fingerprints, container operation records, and container operation fingerprints.

[0127] In an optional embodiment, generating an audit log based on the cluster operation record, the cluster operation fingerprint, the container operation record, and the container operation fingerprint may include the following steps:

[0128] Determine at least one container pointed to by the cluster operation fingerprint, and determine a target container pointed to by the container operation fingerprint;

[0129] Based on at least one container and a target container, determining a target cluster operation fingerprint and a target container operation fingerprint having a first association relationship from the cluster operation fingerprint and the container operation fingerprint; wherein the target container pointed to by the target container operation fingerprint is a container in the at least one container pointed to by the target cluster operation fingerprint;

[0130] Establishing a second association relationship between the target cluster operation record and the target container operation record; the target cluster operation record corresponds to the target cluster operation fingerprint, and the target container operation record corresponds to the target container operation fingerprint;

[0131] An audit log is generated based on the first association relationship and the second association relationship.

[0132] The at least one container pointed to by the cluster operation fingerprint is all containers in the cluster that respond to the container operation request.

[0133] The target cluster operation fingerprint is a fingerprint obtained by refining the target cluster operation record, and the target container operation fingerprint is a fingerprint obtained by refining the target container operation record.

[0134] It should be understood that the audit log includes the first association relationship and the second association relationship.

[0135] In order to facilitate the subsequent tracking of the container operation record of a container, an association relationship between the container operation fingerprint and the event fingerprint may be established, and an association relationship between the event fingerprint and the event record may be established.

[0136] In a specific implementation, in an optional embodiment, before generating the audit log based on the first association relationship and the second association relationship, the following steps may also be included:

[0137] Based on the fingerprint parameters in the target container operation fingerprint, search for an event fingerprint that matches the target container operation fingerprint;

[0138] Based on the fingerprint parameters included in the event fingerprint, determine the target event record corresponding to the event fingerprint;

[0139] Establishing a third association relationship between the target container operation fingerprint and the event fingerprint, and establishing a fourth association relationship between the event fingerprint and the target event record;

[0140] Accordingly, based on the first association relationship and the second association relationship, an audit log is generated, including:

[0141] An audit log is generated based on the first association relationship, the second association relationship, the third association relationship, and the fourth association relationship.

[0142] The fingerprint parameters in the container operation fingerprint include but are not limited to the container identifier, the operation command executed by the container, the process information of the process generated when the container executes the operation command, and / or the session information of the session to which the process belongs. The fingerprint parameters included in each event fingerprint include but are not limited to process information, container information and / or session information.

[0143] In some embodiments, in order to clarify the chronological order of occurrence of different event records in the audit log, after searching for multiple event fingerprints that match the target container operation fingerprint based on the fingerprint parameters in the target container operation fingerprint, an association relationship between the event fingerprints can be established based on the time parameters included in the fingerprint parameters of the event fingerprint. The association relationship between the event fingerprints represents the chronological order of occurrence of the container operation events corresponding to the multiple event fingerprints.

[0144] This embodiment can realize reverse tracing and forward tracing of links based on audit logs by establishing associations between fingerprints of various events, thereby improving the link tracing capability. For example, there are four container operation events a, b, c, and d, and an association relationship between the event fingerprints of these four container operation events is established. When viewing the event record of a single event b in the audit log, based on the association relationship between the event fingerprints established in advance, it is possible to reversely trace event a that occurred before event b, and forwardly trace event c and event d that occurred after event b.

[0145] In some embodiments, in order to facilitate the query of audit logs, track all container operations generated by a single cluster operation, perform link tracking, and generate audit logs based on the first association relationship and the second association relationship, the following steps may be included:

[0146] generating a tracking session parameter for characterizing the first association relationship and the second association relationship;

[0147] Generates audit logs based on the tracking session parameters.

[0148] In this embodiment, the tracking session parameter may be a randomly generated parameter. The tracking session parameter is associated with the first association relationship and the second association relationship. Therefore, the cluster operation record and the container operation record may be tracked through the tracking session parameter.

[0149] In some embodiments, the audit log generated by the embodiments of the present application can quickly locate the organizational personnel information of the user who issued the container operation request within the preset organizational structure, which helps to quickly query the user who performs illegal operations on the container. In specific implementation, the user information of the user in the audit log is obtained, and based on the user information, the organizational personnel information of the user within the preset organizational structure is determined. It should be understood that the user information here is the information used by the interface service component to authenticate the identity of the user when the user requests to operate the container. The organizational personnel information is the unique identifier of the user within the preset organizational structure, and usually the organizational personnel information includes but is not limited to the employee number, etc.

[0150] In some embodiments, after the audit log is generated based on the first association relationship and the second association relationship, the following steps may also be included:

[0151] Obtain the operation records of the container to be queried from the audit log;

[0152] Based on the first association relationship, a cluster operation record associated with the container operation record to be queried is obtained from the audit log; and based on the second association relationship, an event record associated with the container operation record to be queried is obtained from the audit log.

[0153] Since the cluster operation records and all event records belonging to a session can be located, the problem that a single cluster operation link cannot be tracked in the related technology is solved.

[0154] In the solution provided by the embodiment of the present application, cluster operation records are generated based on container operation requests and container operation records are generated based on container operation events, and audit logs are generated based on container operation fingerprints, cluster operation fingerprint generation, cluster operation records, and container operation records. The solution of the embodiment of the present application does not require the introduction of a proxy system, and does not require customers to migrate to another proxy system authentication method. It can be achieved by reusing the existing access method of the Kubernetes cluster, and does not intrude on the customer's usage habits.

[0155] Based on the same inventive concept, the present application embodiment provides a container operation audit device, such as Figure 3 As shown, the device may include:

[0156] A first generating module 31, configured to generate a cluster operation record and a cluster operation fingerprint corresponding to the cluster operation record based on the detected container operation request;

[0157] A detection module 32, configured to detect kernel data corresponding to the container operation request from the node that responds to the container operation request;

[0158] A second generating module 33, used to generate a container operation record and a container operation fingerprint corresponding to the container operation record based on the kernel data;

[0159] The third generating module 34 is used to generate an audit log based on the cluster operation record, the cluster operation fingerprint, the container operation record and the container operation fingerprint.

[0160] Optionally, the first generating module 31 is used for:

[0161] Sending a container operation request to a service component included in the admission component through a uniform resource locator registered by the admission component; the admission component is deployed in a node that responds to the container operation request;

[0162] Obtain container information and user information in the service component extraction container operation request;

[0163] Based on the container information and user information, cluster operation records and cluster operation fingerprints are generated.

[0164] Optionally, the second generating module 32 is used for:

[0165] Obtaining session data corresponding to the process data included in the kernel data from the virtual file directory of the node; and obtaining target container data corresponding to the process data from the container main process data in the container engine;

[0166] Generate container operation records and container operation fingerprints based on process data, session data, and target container data.

[0167] Optionally, the third generating module 33 is used for:

[0168] Determine at least one container pointed to by the cluster operation fingerprint, and determine a target container pointed to by the container operation fingerprint;

[0169] Based on at least one container and a target container, determining a target cluster operation fingerprint and a target container operation fingerprint having a first association relationship from the cluster operation fingerprint and the container operation fingerprint; wherein the target container pointed to by the target container operation fingerprint is a container in the at least one container pointed to by the target cluster operation fingerprint;

[0170] Establishing a second association relationship between the target cluster operation record and the target container operation record; the target cluster operation record corresponds to the target cluster operation fingerprint, and the target container operation record corresponds to the target container operation fingerprint;

[0171] An audit log is generated based on the first association relationship and the second association relationship.

[0172] Optionally, the device is also used for:

[0173] Based on the first association relationship and the second association relationship, before generating the audit log, searching for an event fingerprint matching the target container operation fingerprint based on a fingerprint parameter in the target container operation fingerprint;

[0174] Based on the fingerprint parameters included in the event fingerprint, determine the target event record corresponding to the event fingerprint;

[0175] Establishing a third association relationship between the target container operation fingerprint and the event fingerprint, and establishing a fourth association relationship between the event fingerprint and the target event record

[0176] The third generating module 33 is used for:

[0177] An audit log is generated based on the first association relationship, the second association relationship, the third association relationship, and the fourth association relationship.

[0178] Optionally, the device is also used for:

[0179] Based on the fingerprint parameters in the target container operation fingerprint, after searching for multiple event fingerprints matching the target container operation fingerprint, an association relationship between the event fingerprints is established based on the time parameters included in the fingerprint parameters of the event fingerprint. The association relationship between the event fingerprints represents the sequence of occurrence of the container operation events corresponding to the multiple event fingerprints.

[0180] Optionally, the third generating module 33 is used for:

[0181] generating a tracking session parameter for characterizing the first association relationship and the second association relationship;

[0182] Generates audit logs based on the tracking session parameters.

[0183] Optionally, the device is also used for:

[0184] After the audit log is generated based on the first association relationship and the second association relationship, an operation record of the container to be queried is obtained from the audit log;

[0185] Based on the first association relationship, a cluster operation record associated with the container operation record to be queried is obtained from the audit log; and based on the second association relationship, an event record associated with the container operation record to be queried is obtained from the audit log.

[0186] The container operation audit device provided in the embodiment of the present application and the container operation audit method provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, operated or implemented therein.

[0187] The following takes Kubernetes as an example to introduce the container operation audit device in the embodiment of the present application. Figure 4 As shown, the device may include:

[0188] Interface service component 41, admission component 42, agent (kubelet) 43, container 44, kernel 45, agent component 46 and intelligent analysis component 47;

[0189] in:

[0190] The interface service component 41 is used to detect the user's container operation request, and send the container operation request to the http server provided by the access component 42 based on the URL registered by the access component 42, so that the http server can extract the container information and user information in the container operation request, and generate a cluster operation record and a cluster operation fingerprint based on the container information and the user information.

[0191] It should be noted that, in actual applications, when the interface service component 41 detects a container operation request, it can actively call the URL registered by the access component 42 to send the container operation request to the http server provided by the access component 42, or the access component 42 can actively request the interface service component 41 for the container operation request by polling, so that the interface service component 41 calls the URL registered by the access component 42 to send the container operation request to the http server provided by the access component 42.

[0192] In actual applications, the user attempts to establish a persistent connection channel for the operation container 44 by accessing the interface service component 41 . After the user obtains the persistent connection channel for the operation container 44 , a series of operation and maintenance operations will be performed in the container 44 through this channel.

[0193] The agent 43 is used to manage the container 44 in the node that responds to the container operation request based on the container operation request.

[0194] The proxy component 46 includes a user-state program and a kernel-state eBPF program deployed in the kernel. The kernel-state eBPF program is used to capture kernel data in the kernel 45 and send the captured kernel data to the kernel ring buffer; the user-state program reads the kernel data from the kernel ring buffer, analyzes the read kernel data to obtain process data, obtains session data corresponding to the process data from the virtual file directory of the node, and, based on the container main process data in the container engine, obtains target container data corresponding to the process data from the container data, and generates container operation records and container operation fingerprints based on the process data, session data and target container data.

[0195] The intelligent analysis component 47 is used to generate an audit log based on the cluster operation record, the cluster operation fingerprint, the container operation record and the container operation fingerprint.

[0196] The container operation audit device provided in the embodiment of the present application and the container operation audit method provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, operated or implemented therein.

[0197] The present application also provides an electronic device to perform the above container operation audit method. Figure 5 It shows a schematic diagram of an electronic device provided by some embodiments of the present application. Figure 5 As shown, the electronic device 5 includes: a processor 500, a memory 501, a bus 502 and a communication interface 503, and the processor 500, the communication interface 503 and the memory 501 are connected via the bus 502; the memory 501 stores a computer program that can be run on the processor 500, and when the processor 500 runs the computer program, the container operation audit method provided in any of the aforementioned embodiments of the present application is executed.

[0198] The memory 501 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk storage. The communication connection between the device network element and at least one other network element is realized through at least one communication interface 503 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.

[0199] The bus 502 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. Among them, the memory 501 is used to store programs, and the processor 500 executes the program after receiving the execution instruction. The container operation audit method disclosed in any implementation of the embodiment of the present application may be applied to the processor 500, or implemented by the processor 500.

[0200] The processor 500 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 500. The above processor 500 can be a general-purpose processor, including a processor (Central Processing Unit, referred to as CPU), a network processor (Network Processor, referred to as NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a readily available programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor to be executed, or the hardware and software modules in the decoding processor can be executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 501, and the processor 500 reads the information in the memory 501 and completes the steps of the above method in combination with its hardware.

[0201] The electronic device provided in the embodiment of the present application and the container operation audit method provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, operated or implemented therein.

[0202] The present application also provides a computer-readable storage medium corresponding to the container operation audit method provided in the above embodiment. Figure 6 The computer-readable storage medium shown is a CD 30 on which a computer program (ie, a program product) is stored. When the computer program is run by a processor, the container operation audit method provided by any of the aforementioned embodiments will be executed.

[0203] It should be noted that examples of computer-readable storage media may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0204] The computer-readable storage medium provided in the above-mentioned embodiments of the present application and the container operation audit method provided in the embodiments of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0205] It should be noted that:

[0206] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known structures and technologies are not shown in detail so as not to obscure the understanding of this description.

[0207] Similarly, it should be understood that in order to streamline the present application and help understand one or more of the various inventive aspects, in the above description of the exemplary embodiments of the present application, the various features of the present application are sometimes grouped together into a single embodiment, figure, or description thereof. However, the disclosed method should not be interpreted as reflecting the following schematic diagram: the claimed application requires more features than the features clearly stated in each claim. More specifically, as reflected in the claims below, the inventive aspects are less than all the features of the single embodiment disclosed above. Therefore, the claims following the specific embodiment are hereby expressly incorporated into the specific embodiment, wherein each claim itself serves as a separate embodiment of the present application.

[0208] In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present application and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0209] The above is only a preferred specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A container operation audit method, characterized in that: include: Generate a cluster operation record and a cluster operation fingerprint corresponding to the cluster operation record based on the detected container operation request; Detecting kernel data corresponding to the container operation request from a node that responds to the container operation request; Based on the kernel data, generate a container operation record and a container operation fingerprint corresponding to the container operation record; An audit log is generated based on the cluster operation record, the cluster operation fingerprint, the container operation record, and the container operation fingerprint.

2. The method according to claim 1, characterized in that Generating a cluster operation record and a cluster operation fingerprint corresponding to the cluster operation record based on the detected container operation request includes: Sending the container operation request to the service component included in the admission component through the uniform resource locator registered by the admission component; the admission component is deployed in the node that responds to the container operation request; Obtain the container information and user information in the container operation request extracted by the service component; The cluster operation record and the cluster operation fingerprint are generated based on the container information and the user information.

3. The method according to claim 2, characterized in that Generating a container operation record and a container operation fingerprint corresponding to the container operation record based on the kernel data includes: Acquire session data corresponding to the process data included in the kernel data from the virtual file directory of the node; and acquire target container data corresponding to the process data from the container main process data in the container engine; The container operation record and the container operation fingerprint are generated based on the process data, the session data and the target container data.

4. The method according to claim 1, characterized in that: Generating an audit log based on the cluster operation record, the cluster operation fingerprint, the container operation record, and the container operation fingerprint includes: Determine at least one container pointed to by the cluster operation fingerprint, and determine a target container pointed to by the container operation fingerprint; Based on the at least one container and the target container, determining a target cluster operation fingerprint and a target container operation fingerprint having a first association relationship from the cluster operation fingerprint and the container operation fingerprint; wherein the target container pointed to by the target container operation fingerprint is a container in the at least one container pointed to by the target cluster operation fingerprint; Establishing a second association relationship between a target cluster operation record and a target container operation record; the target cluster operation record corresponds to the target cluster operation fingerprint, and the target container operation record corresponds to the target container operation fingerprint; The audit log is generated based on the first association relationship and the second association relationship.

5. The method according to claim 4, characterized in that Before generating the audit log based on the first association relationship and the second association relationship, the method further includes: Based on the fingerprint parameters in the target container operation fingerprint, searching for an event fingerprint matching the target container operation fingerprint; Based on the fingerprint parameters included in the event fingerprint, determining a target event record corresponding to the event fingerprint; Establishing a third association relationship between the target container operation fingerprint and the event fingerprint, and establishing a fourth association relationship between the event fingerprint and the target event record; Accordingly, generating the audit log based on the first association relationship and the second association relationship includes: The audit log is generated based on the first association relationship, the second association relationship, the third association relationship, and the fourth association relationship.

6. The method according to claim 5, characterized in that After searching for multiple event fingerprints matching the target container operation fingerprint based on the fingerprint parameters in the target container operation fingerprint, the method further includes: Based on the time parameter included in the fingerprint parameter of the event fingerprint, an association relationship between the event fingerprints is established, and the association relationship between the event fingerprints represents the sequence of occurrence of the container operation events corresponding to the multiple event fingerprints.

7. The method according to any one of claims 4 to 6, characterized in that: Generating the audit log based on the first association relationship and the second association relationship includes: generating a tracking session parameter for characterizing the first association relationship and the second association relationship; Based on the tracing session parameters, the audit log is generated.

8. The method according to claim 4, characterized in that After generating the audit log based on the first association relationship and the second association relationship, the method further includes: Obtaining the container operation record to be queried from the audit log; Based on the first association relationship, a cluster operation record associated with the container operation record to be queried is obtained from the audit log; and based on the second association relationship, an event record associated with the container operation record to be queried is obtained from the audit log.

9. A container operation audit device, characterized in that: include: A first generating module, configured to generate a cluster operation record and a cluster operation fingerprint corresponding to the cluster operation record based on the detected container operation request; A detection module, configured to detect kernel data corresponding to the container operation request from a node that responds to the container operation request; A second generating module, configured to generate a container operation record and a container operation fingerprint corresponding to the container operation record based on the kernel data; The third generating module is used to generate an audit log based on the cluster operation record, the cluster operation fingerprint, the container operation record and the container operation fingerprint.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: The processor runs the computer program to implement the container operation audit method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the container operation audit method according to any one of claims 1 to 8.

Images