Container data encryption method and related equipment

Abstract

The invention provides a container data encryption method and related equipment, and relates to the technical field of K8s clusters. The method comprises the steps that in response to a monitored event of creating a persistent storage volume statement, a control component creates a persistent storage volume, and the persistent storage volume statement specifies a target storage class; if the value of the target field in the target storage class is the preset value, the control component extracts the encrypted information in the target storage class; generating a volume encryption request according to a preset value and the encryption information, and sending the volume encryption request to a node server; the node server creates the logical volume according to the volume encryption request, and performs parameter configuration on the encryption device based on the encryption information in the volume encryption request so as to enable the encryption device to encrypt the container data, the logical volume is used for managing and storing the container data, the logical volume serves as a K8s storage plug-in to provide a data encryption function, and therefore the security of data storage is improved; the method is especially suitable for application scenes with high sensitivity.

Description

Background Art

[0002] The rapid development of container technology has led to the widespread application of data storage. As an industry standard interface specification, the Container Storage Interface (CSI) allows third-party storage vendors to develop standard plug-ins to provide persistent storage services for containers. Kubernetes (K8s for short, an open source application software) can manage containerized applications on multiple hosts in a cloud platform.

[0003] However, the method of calling CSI for persistent storage in K8s has the problem of low data security.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The present disclosure provides a container data encryption method and related devices, which at least to a certain extent overcome the problem of low data security in calling CSI for persistent storage in K8s in the related art.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of the present disclosure, there is provided a container data encryption method, which is applied to a container storage interface, wherein the container storage interface includes a control component and a node server, and the method includes: in response to monitoring an event of creating a persistent storage volume declaration, the control component creates a persistent storage volume, wherein the persistent storage volume declaration specifies a target storage class; if the value of a target field in the target storage class is a preset value, the control component extracts encryption information in the target storage class; a volume encryption request is generated according to the preset value and the encryption information, and the volume encryption request is sent to the node server; the node server creates a logical volume according to the volume encryption request, and configures parameters of an encryption device based on the encryption information in the volume encryption request, so that the encryption device encrypts the container data.

[0008] In one embodiment of the present disclosure, in response to monitoring an event of creating a persistent storage volume declaration, before the control component creates a storage volume, the method further includes: creating the target storage class, configuring the target field of the target storage class and the encryption information; creating a persistent storage volume declaration, specifying the target storage class in the persistent storage volume declaration.

[0009] In one embodiment of the present disclosure, the parameter configuration of the encryption device based on the preset value and encryption information in the volume encryption request includes: the node server formats the logical volume as an encryption type to obtain encryption configuration information corresponding to the encryption information from a database through an encryption tool; the node server uses the encryption configuration information to configure the parameters of the encryption device.

[0010] In one embodiment of the present disclosure, after the node server creates a logical volume according to the volume encryption request and configures parameters of the encryption device based on the preset value and encryption information in the volume encryption request, the method further includes: in response to a user creating an instance and mounting the persistent storage volume, the node server mounts the encryption device corresponding to the logical volume to the storage volume directory of the instance in the node agent root directory, so that the node agent creates a container under the instance, binds and loads the storage volume directory into the container, the encryption device encrypts the data written to the storage volume directory in the container, and stores the encrypted data in the local disk.

[0011] In one embodiment of the present disclosure, the encryption information includes at least one of a key name and a key namespace.

[0012] In one embodiment of the present disclosure, the method also includes: in response to monitoring an event of deleting the persistent storage volume declaration, the control component deletes the persistent storage volume corresponding to the persistent storage volume declaration, the node server deletes the logical volume, and uninstalls the encryption device corresponding to the logical volume in the storage volume directory.

[0013] According to another aspect of the present disclosure, a container data encryption device is also provided, which is applied to a container storage interface, and the container storage interface includes a control component and a node server, wherein: the control component is used to create a persistent storage volume in response to an event of monitoring a declaration for creating a persistent storage volume, wherein the persistent storage volume declaration specifies a target storage class; if the value of a target field in the target storage class is a preset value, the encryption information in the target storage class is extracted; a volume encryption request is generated according to the preset value and the encryption information, and the volume encryption request is sent to the node server; the node server is used to create a logical volume according to the volume encryption request, and configure parameters of an encryption device based on the encryption information in the volume encryption request so that the encryption device encrypts the container data.

[0014] According to another aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the above-mentioned container data encryption method by executing the executable instructions.

[0015] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned container data encryption method is implemented.

[0016] According to another aspect of the present disclosure, a computer program product is provided, wherein the computer program product includes a computer program or computer instructions, and the computer program or the computer instructions are loaded and executed by a processor to enable a computer to implement the above-mentioned container data encryption method.

[0017] In an embodiment of the present disclosure, in response to monitoring an event of creating a persistent storage volume declaration, a control component creates a persistent storage volume, and the persistent storage volume declaration specifies a target storage class; if the value of a target field in the target storage class is a preset value, the control component extracts encryption information in the target storage class; a volume encryption request is generated based on the preset value and the encryption information, and the volume encryption request is sent to a node server; the node server creates a logical volume based on the volume encryption request, and configures parameters of an encryption device based on the encryption information in the volume encryption request so that the encryption device encrypts container data. The present disclosure uses logical volumes to manage storage container data, and provides data encryption functions as a K8s storage plug-in, thereby improving the security of data storage, which is particularly suitable for application scenarios with higher sensitivity.

[0018] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0020] Figure 1 A system architecture diagram for a container data encryption method provided by an embodiment of the present disclosure is shown;

[0021] Figure 2 A flow chart of a container data encryption method provided by an embodiment of the present disclosure is shown;

[0022] Figure 3 A flow chart of another container data encryption method provided by an embodiment of the present disclosure is shown;

[0023] Figure 4 A flow chart of another container data encryption method provided by an embodiment of the present disclosure is shown;

[0024] Figure 5 A flow chart of another container data encryption method provided by an embodiment of the present disclosure is shown;

[0025] Figure 6 A schematic diagram showing the structure of a container data encryption device provided by an embodiment of the present disclosure is shown;

[0026] Figure 7 A structural block diagram of an electronic device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0027] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0028] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0029] In order to enable those skilled in the art to better understand the technical solution of the present disclosure, the present disclosure is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present disclosure.

[0030] Kubernetes, or K8s for short, is an open source containerized application management framework for multiple hosts in a cloud platform. It makes the deployment of containerized applications simple and efficient.

[0031] Figure 1 A system architecture diagram for a container data encryption method provided by an embodiment of the present disclosure is shown. Figure 1 As shown, the system architecture includes a control node 120 and multiple working nodes 110, and the number of working nodes 110 can be determined according to actual needs.

[0032] The control node 120 is also called the Master Node. After the developer submits the application description file to the control node 120, K8s can deploy the application to the working node 110.

[0033] The control node 120 is the control node of the K8s cluster, responsible for the management and control of the entire cluster, such as receiving and executing all control commands to ensure the normal operation of the cluster. The control node 120 can be deployed on an independent server. The control node 120 may include a control manager (Kube Controller Manager), an application server (APIServer), and a database (such as etcd).

[0034] The API Server can provide an HTTP REST interface and is the only entry point for all resource addition, deletion, modification, and query operations. It is also the entry process for cluster control and is responsible for authentication and authorization, data verification, and cluster status changes. It is the entry point for resource quota control.

[0035] Kube Controller Manager is responsible for the automated control of all resource objects and handles the lifecycle management of various resource objects.

[0036] The database can store data of all resource objects. The database can be etcd, which is a key-value database, thereby ensuring data consistency and reliability.

[0037] In K8s, multiple control nodes 120 can be deployed, and the operations running on each control node 120 can work together. If one of the control nodes 120 goes down, other control nodes 120 can take over the down control node 120, thereby ensuring the reliability of the cluster.

[0038] In the K8s cluster, the worker node 110 is managed by the control node 120, which is responsible for executing containerized applications, creating and running containers, monitoring and reporting the status of containers, and managing the life cycle of containers according to the requirements of the control node 120. The worker node 110 can be a physical server or a virtual machine. Each worker node 110 needs to run at least the container runtime (such as Docker), the node agent Kubelet, and the Kube-proxy service.

[0039] Instance Pod is the basic deployment unit in K8s and can be scheduled between worker nodes 110. Each Pod can run one or more containers, and the containers share the same resources. All containers in a Pod run in the same worker node 110.

[0040] The system architecture also includes the Container Storage Interface (CSI), an industry standard that enables storage vendors to develop a CSI-compliant plug-in and have it work in multiple container orchestration systems.

[0041] like Figure 1 As shown, CSI includes a node server (Node Server) 130, a control component (ControllerServer) 140, a Provisioner, an elastic scaling plug-in Resizer, etc., wherein the control component 140 runs in the control plane of each K8s and is responsible for managing the life cycle of the storage volume, including creation, deletion, mounting, unmounting, and expansion functions. It can be deployed in the form of Statement or Deployment, for example, Figure 1 The control component 140 in the application management instance (Deloy Pod) is deployed. The node server 130 runs on each worker node 110 of K8s and is responsible for mounting and unmounting storage volumes on the node and processing node-level storage operations. It can be deployed on each worker node 110 in the form of DaemonSet, for example, Figure 1 The node server 130 in is deployed on the running control instance (DaemonSet Pod). Provisioner is a sidecar container that monitors the Persistent Volume Claim object in the API server and calls CreateVolume for the specified CSI endpoint to configure a new storage volume. Resizer is a sidecar container that monitors the PVC object edits on the API server and triggers the ControllerExpandVolume operation for the CSI endpoint when the user requests more storage on the PVC object.

[0042] In K8s, the system architecture also includes a storage server 150, which can persist the data in the storage container.

[0043] In related technologies, the implementation of CSI in the K8s cluster does not use encryption logic, resulting in low data security. Especially in scenarios with high data sensitivity such as banks and government systems, data security cannot be effectively guaranteed.

[0044] In order to at least partially solve the above technical problems, the present disclosure responds to the event of monitoring the creation of a persistent storage volume declaration, and the control component creates a persistent storage volume, and the persistent storage volume declaration specifies the target storage class; if the value of the target field in the target storage class is a preset value, the control component extracts the encryption information in the target storage class; generates a volume encryption request according to the preset value and the encryption information, and sends the volume encryption request to the node server; the node server creates a logical volume according to the volume encryption request, and configures the encryption device parameters based on the encryption information in the volume encryption request so that the encryption device encrypts the container data. The present disclosure uses logical volumes to manage the storage of container data, and provides data encryption function as a K8s storage plug-in, thereby improving the security of data storage, which is particularly suitable for application scenarios with higher sensitivity.

[0045] It should be pointed out that the embodiments of the present invention and the technical features therein may be combined with each other without conflict.

[0046] The present exemplary implementation is described in detail below with reference to the accompanying drawings and embodiments.

[0047] First, a container data encryption method is provided in an embodiment of the present disclosure, and the method can be executed by any electronic device with computing and processing capabilities. The container data encryption method provided in an embodiment of the present disclosure is applied to a container storage interface and can be executed by a control component in the container storage interface or by a node server in the container storage interface.

[0048] Figure 2 A flow chart of a container data encryption method provided in an embodiment of the present disclosure is shown as follows: Figure 2 As shown, the container data encryption method provided in the embodiment of the present disclosure is applied to a container storage interface, the container storage interface includes a control component and a node server, and the method includes the following steps:

[0049] S202: In response to monitoring an event of creating a persistent storage volume declaration, the control component creates a persistent storage volume, wherein the persistent storage volume declaration specifies a target storage class.

[0050] In K8s, a Persistent Volume Claim (PVC) is a way to apply for storage space from a storage server. It is a storage-related resource object that can define information such as application capacity and access mode.

[0051] Persistent Volume (PV) can provide a way for applications in a K8s cluster to use persistent data. PV is a resource in the cluster, and PVC is a user's request for PV.

[0052] When Provisioner listens to the event that a user creates a PVC, it can call the CreateVolume method of the CSI control component to create a persistent storage volume PV.

[0053] When a PVC specifies a target storage class, if the name in the target storage class configuration field matches the name returned by the CSI power-off specified in the GetPluginInfo call, volume provisioning is triggered by creating a new PVC object.

[0054] The target storage class is obtained by configuring the values ​​of each field in the parameters according to actual needs. When the container data needs to be encrypted, it can be configured in the specified field of the target storage class parameters. For example, configuring the field fde to on indicates that encryption is required. When the value of the fde field is not on, it indicates that encryption is not required.

[0055] In addition, you can also configure encryption information in the target storage class parameters. The encryption information may include but is not limited to the secret key name Secret-name, secret key namespace Secret-namespace, etc. Secret-name and Secret-namespace enable CSI to obtain the encryption key when creating storage.

[0056] S204: If the value of the target field in the target storage class is a preset value, the control component extracts the encryption information in the target storage class.

[0057] It should be noted that the encryption information includes at least one of the key name and the key namespace.

[0058] In one embodiment, the method further includes: if the value of the target field in the target storage class is not a preset value, determining that the local storage created by the persistent storage volume does not need to be encrypted.

[0059] The target field may be a specific field specified in the target storage class parameters, such as the fde field. The preset value may be "on" in the above embodiment, or may be other values, which are not specifically limited in the present disclosure.

[0060] When the value of the target field in the target storage class is a preset value, it means that the container data needs to be encrypted. The control component extracts encryption information such as the key name and key namespace in the target storage class, and obtains the encryption key based on the encryption information.

[0061] S206: Generate a volume encryption request according to the preset value and the encryption information, and send the volume encryption request to the node server.

[0062] The volume encryption request is used to indicate to the node server that the container data storage needs to be encrypted, so that the node server performs corresponding processing according to the volume encryption request.

[0063] The encryption value representing the encryption requirement and the encryption information used to obtain the secret key may be written into the preset fields of the volume encryption request.

[0064] S208. The node server creates a logical volume according to the volume encryption request, and configures parameters of the encryption device based on the encryption information in the volume encryption request, so that the encryption device encrypts the container data.

[0065] The node server determines whether the value of the fde field in the volume encryption request is on according to the volume encryption request. If so, it creates a logical volume, extracts the encryption information in the volume encryption request, and determines the corresponding encryption configuration information according to the encryption information, so as to configure the parameters of the encryption device according to the encryption configuration information.

[0066] Logical Volume (LV) is an abstraction layer built on top of Physical Volume, which allows multiple logical volumes to allocate space on the physical volume and provides dynamic management of space. Logical volumes are managed through persistent storage volumes and persistent storage volume declarations. After the persistent storage volume declaration is associated with the persistent storage volume, users can use network storage just like local storage.

[0067] In an embodiment of the present disclosure, in response to monitoring an event of creating a persistent storage volume declaration, a control component creates a persistent storage volume, and the persistent storage volume declaration specifies a target storage class; if the value of a target field in the target storage class is a preset value, the control component extracts encryption information in the target storage class; a volume encryption request is generated based on the preset value and the encryption information, and the volume encryption request is sent to a node server; the node server creates a logical volume based on the volume encryption request, and configures parameters of an encryption device based on the encryption information in the volume encryption request so that the encryption device encrypts container data. The present disclosure uses logical volumes to manage storage container data, and provides data encryption functions as a K8s storage plug-in, thereby improving the security of data storage, which is particularly suitable for application scenarios with higher sensitivity.

[0068] Figure 3 FIG. 2 shows another flow chart of a container data encryption method provided by an embodiment of the present disclosure. Figure 3 As shown, in one embodiment, in response to monitoring an event of creating a persistent storage volume declaration, before the control component creates a storage volume at S202, the method further includes:

[0069] S302, create a target storage class, configure the target field and encryption information of the target storage class;

[0070] S304: Create a persistent storage volume declaration, in which a target storage class is specified.

[0071] In one embodiment, the parameters field is part of a storage class resource and can define how to configure and manage parameters of the storage class, which are specific to the storage vendor and storage type.

[0072] In S302, when the container data needs to be encrypted, the target field of the target storage class may be configured as a preset value, for example, the fde field of the target storage class may be configured as "on", where fde indicates enabling full disk encryption.

[0073] When there is no need to encrypt the container data, the fde field of the target storage class can be configured to "OFF" or empty, and the present disclosure does not make any specific limitations on this.

[0074] In S304, a persistent storage volume declaration is created through Kubernetes. The persistent storage volume declaration specifies the above target storage class. The YAML sample is as follows:

[0075] apiVersion: V1

[0076] kind: PersistentVolumeClaim

[0077] metadata:

[0078] name: test-fde-pvc

[0079] spec:

[0080] accessModes:

[0081] -ReadWriteOnce

[0082] resources:

[0083] requests:

[0084] storage: 10Gi

[0085] storageClassName: test-fde-sc

[0086] In the above YAML sample, resource request resources describes the request for storage resources, and the required storage space size is set through the resources, requests, and storage fields. Access mode accessModes is used to describe the user application's access rights to storage resources. Storage class Class, when defining PVC, you can set the required backend storage class. By specifying it through the storageClassName field in the sample, you can reduce the dependence on detailed information of the backend storage characteristics. For example, in the above sample, test-fde-sc is specified as the target storage class.

[0087] In the embodiments of the present disclosure, by configuring information related to encryption requirements in a specific field of a target storage class and specifying the target storage class when creating a persistent storage volume, dependence on detailed information of backend storage characteristics is reduced.

[0088] Figure 4 FIG. 2 shows another flow chart of a container data encryption method provided by an embodiment of the present disclosure. Figure 4 As shown, in one embodiment, the above S208 configures parameters of the encryption device based on the preset value and encryption information in the volume encryption request, including:

[0089] S402, the node server formats the logical volume into an encryption type, so as to obtain encryption configuration information corresponding to the encryption information from the database through an encryption tool;

[0090] S404: The node server uses the encryption configuration information to perform parameter configuration on the encryption device.

[0091] In one embodiment, the above encryption type can be a crypt type, and the encryption tool is Crypt. Crypt can store and obtain encryption configuration information from a database (such as etcd or consul) according to the encryption information. The encryption configuration information can be the value of a parameter in the encryption device. The encryption device is a hardware or software device used for data encryption and decryption.

[0092] In the disclosed embodiment, the node server formats the logical volume as crypt type, obtains encryption configuration information, and configures parameters of the encryption device, so that the encryption device encrypts the data written to the corresponding storage device, thereby improving the security of the data.

[0093] Figure 5 A flow chart of another container data encryption method provided by an embodiment of the present disclosure is shown. Figure 2 Based on the embodiment, S210 is added after S208 to limit the situation where the encryption device encrypts the container data. Figure 5In one embodiment, after the node server creates a logical volume according to the volume encryption request at S208 and configures parameters of the encryption device based on the preset value and encryption information in the volume encryption request, the method further includes:

[0094] S210. In response to the user creating an instance and mounting a persistent storage volume, the node server mounts the encryption device corresponding to the logical volume to the storage volume directory of the instance in the node agent root directory, so that the node agent creates a container under the instance, binds and loads the storage volume directory into the container, and the encryption device encrypts the data written to the storage volume directory in the container, and the encrypted data is stored in the local disk.

[0095] When a user creates a Pod and mounts it to the persistent storage volume PV, the node server mounts the encrypted device of the logical volume corresponding to the PV to the storage volume directory of the Pod in the Kubeletes root directory. In K8s, storage volumes are shared within containers, and multiple containers in a Pod share a storage volume directory.

[0096] When the node agent calls Docker to create a container for the Pod, it will bind and load the storage volume directory into the container. When the user writes data to the local disk under the mounted directory in the container, the encryption device will encrypt the written data and store the encrypted data on the local disk, thereby realizing container data encryption and improving data security.

[0097] In one embodiment, the method further includes: in response to monitoring an event of deleting a persistent storage volume declaration, the control component deletes the persistent storage volume corresponding to the persistent storage volume declaration, the node server deletes the logical volume, and uninstalls the encryption device corresponding to the logical volume in the storage volume directory.

[0098] When Provisioner detects the event that a user deletes a PVC, it can call the DeleteVolume method of the CSI control component to delete the persistent storage volume PV.

[0099] The node server can use the umount command to unmount the logical volume, use the lvremove command to close the logical volume, and use the vgremove command to delete the volume group.

[0100] In the disclosed embodiments, by monitoring the persistent storage volume declaration time, it is possible to manage the encryption of container data throughout the storage volume life cycle, thereby improving the reliability of container data.

[0101] Based on the same inventive concept, the present disclosure also provides a container data encryption device 600, such as the following embodiment. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0102] Figure 6 FIG. 6 is a schematic diagram showing a structure of a container data encryption device 600 provided in an embodiment of the present disclosure. Figure 6 As shown, the container data encryption device 600 of this embodiment is applied to a container storage interface, and the container storage interface includes a control component 140 and a node server 130, wherein:

[0103] The control component 140 is configured to create a persistent storage volume in response to monitoring an event of creating a persistent storage volume declaration, wherein the persistent storage volume declaration specifies a target storage class; if the value of a target field in the target storage class is a preset value, extract encryption information in the target storage class; generate a volume encryption request according to the preset value and the encryption information, and send the volume encryption request to the node server 130;

[0104] The node server 130 is used to create a logical volume according to the volume encryption request, and configure parameters of the encryption device based on the encryption information in the volume encryption request, so that the encryption device encrypts the container data.

[0105] In one embodiment, the device also includes a configuration module not shown in the accompanying drawings, which is used to create a target storage class and configure the target field and encryption information of the target storage class before the control component 140 creates the storage volume in response to monitoring an event of creating a persistent storage volume declaration; and create a persistent storage volume declaration, in which the target storage class is specified.

[0106] In one embodiment, the node server 130 is used to format the logical volume into an encryption type, so as to obtain encryption configuration information corresponding to the encryption information from the database through an encryption tool; and configure parameters of the encryption device using the encryption configuration information.

[0107] In one embodiment, the node server 130 is used to create a logical volume according to a volume encryption request, configure the encryption device parameters based on the preset value and encryption information in the volume encryption request, and then, in response to a user creating an instance to mount a persistent storage volume, mount the encryption device corresponding to the logical volume to the storage volume directory of the instance in the node agent root directory, so that the node agent creates a container under the instance, binds and loads the storage volume directory into the container, and the encryption device encrypts the data written to the storage volume directory in the container, and the encrypted data is stored in the local disk.

[0108] It should be noted that the encryption information includes at least one of the key name and the key namespace.

[0109] In one embodiment, in response to monitoring an event of deleting a persistent storage volume declaration, the control component 140 is used to delete the persistent storage volume corresponding to the persistent storage volume declaration, and the node server 130 is used to delete the logical volume and uninstall the encryption device corresponding to the logical volume in the storage volume directory.

[0110] In an embodiment of the present disclosure, in response to monitoring an event of creating a persistent storage volume declaration, the control component 140 creates a persistent storage volume, and the persistent storage volume declaration specifies a target storage class; if the value of the target field in the target storage class is a preset value, the control component 140 extracts the encryption information in the target storage class; a volume encryption request is generated based on the preset value and the encryption information, and the volume encryption request is sent to the node server 130; the node server 130 creates a logical volume based on the volume encryption request, and configures parameters of the encryption device based on the encryption information in the volume encryption request so that the encryption device encrypts the container data. The present disclosure uses logical volumes to manage storage container data, and provides data encryption functions as a K8s storage plug-in, thereby improving the security of data storage, which is particularly suitable for application scenarios with higher sensitivity.

[0111] It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as a "circuit", "module" or "system".

[0112] Refer to the following Figure 7 An electronic device 700 according to this embodiment of the present invention will be described. Figure 7 The electronic device 700 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0113] like Figure 7 As shown, the electronic device 700 is in the form of a general computing device. The components of the electronic device 700 may include but are not limited to: at least one processing unit 710, at least one storage unit 720, and a bus 730 connecting different system components (including the storage unit 720 and the processing unit 710).

[0114] The storage unit stores program codes, which can be executed by the processing unit 710, so that the processing unit 710 performs the steps of various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification. For example, the processing unit 710 can perform the following steps: Figure 2 As shown in the embodiment of the present disclosure, in response to monitoring an event of creating a persistent storage volume declaration, the control component creates a persistent storage volume, and the persistent storage volume declaration specifies a target storage class; if the value of the target field in the target storage class is a preset value, the control component extracts the encryption information in the target storage class; a volume encryption request is generated according to the preset value and the encryption information, and the volume encryption request is sent to the node server; the node server creates a logical volume according to the volume encryption request, and configures parameters of the encryption device based on the encryption information in the volume encryption request, so that the encryption device encrypts the container data.

[0115] The storage unit 720 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 7201 and / or a cache storage unit 7202 , and may further include a read-only storage unit (ROM) 7203 .

[0116] The storage unit 720 may also include a program / utility 7204 having a set (at least one) of program modules 7205, such program modules 7205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each of which or some combination may include the implementation of a network environment.

[0117] Bus 730 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0118] The electronic device 700 may also communicate with one or more external devices 740 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the system, and / or any device that enables the electronic device 700 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 760. Furthermore, the system may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 760. Figure 7 As shown, the network adapter 760 communicates with other modules of the electronic device 700 via the bus 730. It should be understood that although Figure 7 Not shown, other hardware and / or software modules may be used in conjunction with electronic device 700, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0119] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0120] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to execute the steps according to various exemplary implementations of the present disclosure described in the above "Exemplary Method" section of this specification.

[0121] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0122] In the present disclosure, a computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0123] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0124] In a specific implementation, the program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0125] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0126] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0127] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0128] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A container data encryption method, characterized in that: Applied to a container storage interface, the container storage interface includes a control component and a node server, the method includes: In response to monitoring an event of creating a persistent storage volume declaration, the control component creates a persistent storage volume, wherein the persistent storage volume declaration specifies a target storage class; If the value of the target field in the target storage class is a preset value, the control component extracts the encryption information in the target storage class; Generate a volume encryption request according to the preset value and the encryption information, and send the volume encryption request to the node server; The node server creates a logical volume according to the volume encryption request, and configures parameters of an encryption device based on encryption information in the volume encryption request, so that the encryption device encrypts container data.

2. The container data encryption method according to claim 1, characterized in that: Before the control component creates a storage volume in response to monitoring an event of creating a persistent storage volume declaration, the method further includes: Creating the target storage class, configuring the target field of the target storage class and the encryption information; A persistent storage volume declaration is created, wherein the persistent storage volume declaration specifies the target storage class.

3. The container data encryption method according to claim 1, characterized in that: The configuring parameters of the encryption device based on the preset value and encryption information in the volume encryption request includes: The node server formats the logical volume into an encryption type, so as to obtain encryption configuration information corresponding to the encryption information from a database through an encryption tool; The node server uses the encryption configuration information to perform parameter configuration on the encryption device.

4. The container data encryption method according to claim 1, characterized in that: After the node server creates a logical volume according to the volume encryption request and performs parameter configuration on the encryption device based on the preset value and encryption information in the volume encryption request, the method further includes: In response to a user creating an instance and mounting the persistent storage volume, the node server mounts the encryption device corresponding to the logical volume to the storage volume directory of the instance in the node agent root directory, so that the node agent creates a container under the instance, binds and loads the storage volume directory into the container, and the encryption device encrypts the data written to the storage volume directory in the container, and the encrypted data is stored in the local disk.

5. The container data encryption method according to claim 4, characterized in that: The method also includes: in response to monitoring an event of deleting the persistent storage volume declaration, the control component deletes the persistent storage volume corresponding to the persistent storage volume declaration, the node server deletes the logical volume, and uninstalls the encryption device corresponding to the logical volume in the storage volume directory.

6. The container data encryption method according to any one of claims 1 to 5, characterized in that: The encryption information includes at least one of a key name and a key namespace.

7. A container data encryption device, characterized in that: Applied to a container storage interface, the container storage interface includes a control component and a node server, wherein: The control component is configured to create a persistent storage volume in response to monitoring an event of creating a persistent storage volume declaration, wherein the persistent storage volume declaration specifies a target storage class; if the value of a target field in the target storage class is a preset value, extract encryption information in the target storage class; generate a volume encryption request according to the preset value and the encryption information, and send the volume encryption request to the node server; The node server is used to create a logical volume according to the volume encryption request, and configure parameters of an encryption device based on encryption information in the volume encryption request, so that the encryption device encrypts container data.

8. An electronic device, characterized in that: include: processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the container data encryption method according to any one of claims 1 to 6 by executing the executable instructions.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the container data encryption method according to any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that The computer program product includes a computer program or computer instructions, and the computer program or the computer instructions are loaded and executed by a processor to enable a computer to implement the container data encryption method according to any one of claims 1 to 6.

Images