Authentication certificate configuration method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an authentication voucher configuration method and device, and the method comprises the steps: a component console receives a corresponding authentication voucher issued by a cloud platform when a component instance is opened, and the component console updates voucher configuration information stored in a cluster according to the identification information of the component instance and the authentication voucher, after a side vehicle container of the collector monitors a change event of voucher configuration information stored in the cluster, an authentication voucher file corresponding to a newly-added component instance is generated according to the voucher configuration information, and after a service container of the collector monitors the authentication voucher file, a corresponding authentication voucher is obtained, and the authentication voucher file is sent to the newly-added component instance according to the authentication voucher file. According to the method, the authentication voucher of the newly added component instance is smoothly captured in real time by taking the opening of the component instance as a triggering opportunity and using an event notification monitoring mechanism, and then the information is utilized to dynamically configure the collector, so that the authentication voucher of each component instance is dynamically configured; therefore, the problem that data acquisition and reporting are not real-time and unsmooth is avoided.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an authentication credential configuration method, an authentication credential configuration device, an electronic device, and a readable storage medium. Background Art

[0002] Cloud native is a method of building and running applications. There are concepts of tenants, private clusters, and managed clusters. For example, a private cluster means that the kubernetes (a standard for deploying and managing software in cloud computing, k8s) cluster is exclusive to a tenant, while a managed cluster means that n tenants share a k8s cluster.

[0003] For security reasons, cloud platform components need to authenticate tenants' requests, and their permission credentials are uniformly allocated by the cloud platform in a manner similar to authentication credentials (license) when component instances are activated. Considering a business scenario, it is necessary to collect observable data of all component instances of all tenants under the managed cluster and report them to the observability platform. In order to achieve data collection, a set of collectors are usually deployed in the cluster in the form of plug-ins. In this case, since the collector is unique to the cluster rather than to the tenant, and there is a one-to-one relationship between tenants and authentication credentials, for existing tenants, it is necessary to manually configure the existing authentication credentials corresponding to each existing tenant in the collector; for incremental tenants, there is no guarantee that the smooth transition of data collection will be met as tenant instances are activated.

[0004] The existing method cannot dynamically configure authentication credentials for incremental tenants, and lacks an automated configuration method for the entire process, resulting in data collection and reporting not being real-time and smooth in business scenarios where observable data collection is possible. Summary of the invention

[0005] The technical problem to be solved by the embodiments of the present invention is to provide an authentication credential configuration method, device, electronic device and readable storage medium, so as to solve the problem that authentication credentials cannot be dynamically configured for incremental tenants, resulting in data collection and reporting that is not real-time and smooth.

[0006] In order to solve the above problems, the present invention provides an authentication credential configuration method, which is applied to a component console, comprising:

[0007] Receive the corresponding authentication certificate issued by the cloud platform when activating the component instance;

[0008] According to the identification information of the component instance and the authentication credential, the credential configuration information stored in the cluster is updated so that after the sidecar container of the collector on the cluster detects the change event of the credential configuration information, an authentication credential file corresponding to the newly added component instance is generated according to the credential configuration information, and after the business container of the collector detects the authentication credential file, the corresponding authentication credential is obtained; wherein, the collector is a deployable unit deployed on the cluster, and the business container is used to collect data of the component instances on the cluster.

[0009] Optionally, the method further comprises:

[0010] The identification information of the component instance and the corresponding authentication credential are stored in a database.

[0011] Optionally, the method further comprises:

[0012] After the component console is restarted, reading the identification information of the component instance and the corresponding authentication credential in the database;

[0013] Update the credential configuration information stored in the cluster according to the read identification information of the component instance and the corresponding authentication credential.

[0014] The present invention also provides an authentication credential configuration method, which is applied to a collector, wherein the collector is a deployable unit deployed on a cluster, and the collector includes at least one business container and a sidecar container, and the business container is used to collect data of component instances on the cluster, including:

[0015] After the sidecar container detects a change event of the credential configuration information stored in the cluster, it generates an authentication credential file corresponding to the newly added component instance according to the credential configuration information;

[0016] After the business container detects the authentication credential file, it obtains the corresponding authentication credential.

[0017] Optionally, the method further comprises:

[0018] When the business container reports the data collected from the newly added component instance to the gateway, the authentication certificate is sent to the gateway so that the gateway can verify whether the authentication certificate is legal. If the authentication certificate is legal, the collected data is released to the observable platform; if the authentication certificate is illegal, the collected data is intercepted.

[0019] Optionally, the method further comprises:

[0020] The sidecar container stores the authentication credential file in a preset directory in the collector;

[0021] The business container monitors the authentication credential file, including:

[0022] The business container monitors new files in the preset directory to obtain the authentication credential file.

[0023] The present invention also provides an authentication credential configuration device, which is applied to a component console, comprising:

[0024] The credential receiving module is used to receive the corresponding authentication credential issued by the cloud platform when the component instance is activated;

[0025] An information update module is used to update the credential configuration information stored in the cluster according to the identification information of the component instance and the authentication credential, so that after the sidecar container of the collector on the cluster detects the change event of the credential configuration information, it generates an authentication credential file corresponding to the newly added component instance according to the credential configuration information, and after the business container of the collector detects the authentication credential file, it obtains the corresponding authentication credential; wherein, the collector is a deployable unit deployed on the cluster, and the business container is used to collect data of the component instances on the cluster.

[0026] Optionally, the device further comprises:

[0027] The storage module is used to store the identification information of the component instance and the corresponding authentication certificate in a database.

[0028] Optionally, the device further comprises:

[0029] A credential reading module, used to read the identification information of the component instance and the corresponding authentication credential in the database after the component console is restarted;

[0030] The information update module is used to update the credential configuration information stored in the cluster according to the read identification information of the component instance and the corresponding authentication credential.

[0031] The present invention also provides an authentication credential configuration device, which is applied to a collector, wherein the collector is a deployable unit deployed on a cluster, and the collector includes at least one business container and a sidecar container, and the business container is used to collect data of component instances on the cluster, including:

[0032] A file generation module, which is used for the sidecar container to generate an authentication credential file corresponding to a newly added component instance according to the credential configuration information after detecting a change event of the credential configuration information stored in the cluster;

[0033] The credential acquisition module is used to acquire the corresponding authentication credential after the business container monitors the authentication credential file.

[0034] Optionally, the device further comprises:

[0035] The credential sending module is used for the business container to send the authentication credential to the gateway when reporting the data collected from the newly added component instance to the gateway, so that the gateway can verify whether the authentication credential is legal. If the authentication credential is legal, the collected data is released to the observable platform; if the authentication credential is illegal, the collected data is intercepted.

[0036] Optionally, the device further comprises:

[0037] A file storage module, used for the sidecar container to store the authentication credential file in a preset directory in the collector;

[0038] The file generation module comprises:

[0039] The monitoring submodule is used for the business container to monitor new files in the preset directory to obtain the authentication credential file.

[0040] The embodiment of the present invention further discloses an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0041] Memory, used to store computer programs;

[0042] The processor is used to implement the authentication credential configuration method steps as described above when executing the computer program stored in the memory.

[0043] An embodiment of the present invention further discloses a readable storage medium. When instructions in the readable storage medium are executed by a processor of an electronic device, the electronic device can execute one or more authentication credential configuration method steps described in the embodiment of the present invention.

[0044] The embodiment of the present invention further discloses a computer program product. When the computer program product is run on an electronic device, the processor is enabled to implement the steps in one or more of the methods described in the embodiment of the present invention.

[0045] According to an embodiment of the present invention, the component console receives the corresponding authentication credential issued by the cloud platform when the component instance is activated. The component console updates the credential configuration information stored in the cluster according to the identification information of the component instance and the authentication credential. After the sidecar container of the collector detects the change event of the credential configuration information stored in the cluster, it generates an authentication credential file corresponding to the newly added component instance according to the credential configuration information. After the business container of the collector detects the authentication credential file, it obtains the corresponding authentication credential, so that the activation of the component instance is used as the triggering opportunity, and the authentication credential of the newly added component instance is captured in real time and smoothly by the mechanism of event notification monitoring, and then the collector is dynamically configured using the above information, so as to dynamically configure the authentication credential of each component instance, thereby avoiding the problem of non-real-time and non-smooth data collection and reporting. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A flowchart of a method for configuring an authentication credential provided by an embodiment of the present invention is shown;

[0047] Figure 2 A flowchart showing a method for configuring an authentication credential provided by another embodiment of the present invention is shown;

[0048] Figure 3 A flowchart showing a method for configuring an authentication credential provided by another embodiment of the present invention is shown;

[0049] Figure 4 An architectural block diagram showing an authentication credential configuration;

[0050] Figure 5 A structural block diagram of an authentication credential configuration device embodiment provided by an embodiment of the present invention is shown;

[0051] Figure 6 A structural block diagram of an authentication credential configuration device embodiment provided by another embodiment of the present invention is shown;

[0052] Figure 7 A structural block diagram of an electronic device according to an exemplary embodiment is shown. DETAILED DESCRIPTION

[0053] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0054] Reference Figure 1 , shows a flowchart of a method for configuring an authentication credential provided by an embodiment of the present invention, which may specifically include the following steps:

[0055] Step 101: The component console receives the corresponding authentication certificate issued by the cloud platform when the component instance is activated.

[0056] In the embodiment of the present invention, the component instance refers to the instantiation program of the functional module. The cloud platform can open the component instance to the cluster. When opening the component instance through the cloud platform page, the cloud platform will call the opening interface of the component console to open the component instance.

[0057] In the embodiment of the present invention, the authentication credential is a credential representing authority, which is uniformly allocated by the cloud platform. The cloud platform generates an authentication credential for each component instance, and then passes the authentication credential corresponding to the component instance to the component console when calling the activation interface of the component console.

[0058] In an embodiment of the present invention, the component console receives the authentication credential corresponding to the component instance.

[0059] For example, n tenants share a k8s cluster. When the cloud platform activates the component instance of tenant A in the k8s cluster, it calls the activation interface of the component console and passes the authentication credentials of tenant A to the component console.

[0060] Step 102: The component console updates the credential configuration information stored in the cluster according to the identification information of the component instance and the authentication credential.

[0061] In the embodiment of the present invention, the identification information of the component instance refers to information used to identify the component instance, for example, a tenant ID (identity document).

[0062] In the embodiment of the present invention, the cluster stores the credential configuration information, which stores the identification information of all enabled component instances and the corresponding authentication credentials. For example, when the cluster and the collector are initialized, the collector maintains a set of configmaps (i.e., credential configuration information), which is used to save the authentication credentials of the tenants in the cluster, and the mapping method of the key-value pair is that the key is the tenant id, and the value is the authentication credential of the tenant.

[0063] In an embodiment of the present invention, the component console can save the identification information and authentication credentials of the component instance to the credential configuration information stored in the cluster. For example, after receiving the authentication credentials transmitted by the cloud platform, the component console updates the set of configs of the collector by calling k8s apiserver (an interface that can be used for storage operations), and saves the tenant id and the tenant's authentication credentials as a key-value pair.

[0064] Step 103: After the collector's sidecar container detects a change event of the credential configuration information stored in the cluster, it generates an authentication credential file corresponding to the newly added component instance according to the credential configuration information.

[0065] In an embodiment of the present invention, the collector is a deployable unit deployed on a cluster, and the collector includes at least one business container and a sidecar container. The business container is used to collect data of component instances on the cluster.

[0066] For example, the collector is deployed on the k8s cluster in the form of a pod (deployable unit). In addition to the business container responsible for collecting data, another container is started in the pod as a sidecar (sidecar container).

[0067] In an embodiment of the present invention, the sidecar container can monitor the changes of the credential configuration information stored in the cluster in real time. After capturing the modified event, the sidecar container reads the entire credential configuration information.

[0068] For example, the sidecar container monitors the changes of the above configmap in real time by watching k8s apiserver (an interface that can be used for monitoring). When the change event is captured, all the key-value pairs of tenant ID and tenant authentication credentials in the configmap are read out.

[0069] In an embodiment of the present invention, the sidecar container determines the authentication credential corresponding to the newly added component instance according to the credential configuration information, and then generates an authentication credential file, the content of which is the authentication credential corresponding to the newly added component instance.

[0070] For example, the sidecar container traverses and parses all the key-value pair information it reads, and checks whether there are files named after each tenant ID in the preset directory in the pod. If a file named after a tenant ID in the key-value pair information does not exist, a new file is generated and the authentication credential is saved as the file content in the file, that is, the authentication credential file.

[0071] Step 104: After the business container of the collector detects the authentication credential file, it obtains the corresponding authentication credential.

[0072] In the embodiment of the present invention, the business container monitors all authentication credential files, and when a new authentication credential file is found, the new authentication credential file is read and parsed to obtain the authentication credential therein.

[0073] In an embodiment of the present invention, the business logic of monitoring and reloading the credential configuration information is placed in the sidecar container of the collector, thereby decoupling the configuration generation from the collection business of the collector. Then, because the business container of the collector only pays attention to the authentication credential files under the preset directory, the collector can run successfully regardless of whether it is deployed in a pod manner within the cluster or deployed on a physical machine as a single application.

[0074] According to an embodiment of the present invention, the component console receives the corresponding authentication credential issued by the cloud platform when the component instance is activated. The component console updates the credential configuration information stored in the cluster according to the identification information of the component instance and the authentication credential. After the sidecar container of the collector detects the change event of the credential configuration information stored in the cluster, it generates an authentication credential file corresponding to the newly added component instance according to the credential configuration information. After the business container of the collector detects the authentication credential file, it obtains the corresponding authentication credential, so that the activation of the component instance is used as the triggering opportunity, and the authentication credential of the newly added component instance is captured in real time and smoothly by the mechanism of event notification monitoring, and then the collector is dynamically configured using the above information, so as to dynamically configure the authentication credential of each component instance, thereby avoiding the problem of non-real-time and non-smooth data collection and reporting.

[0075] Reference Figure 2 , shows a flowchart of a method for configuring an authentication credential provided by an embodiment of the present invention, which is applied to a component console and may specifically include the following steps:

[0076] Step 201, receiving the corresponding authentication certificate issued by the cloud platform when activating the component instance.

[0077] In the embodiment of the present invention, the specific implementation method of this step can refer to the description in the above embodiment and will not be repeated here.

[0078] In an optional embodiment of the present invention, the method may further include: storing the identification information of the component instance and the corresponding authentication credential in a database.

[0079] After receiving the authentication credential transmitted by the cloud platform, the component console stores the identification information of the component instance and the corresponding authentication credential in the database.

[0080] For example, the component console stores the tenant ID and the tenant's authentication credentials in a database of the component console.

[0081] Step 202, based on the identification information of the component instance and the authentication credential, updates the credential configuration information stored in the cluster, so that after the sidecar container of the collector on the cluster detects the change event of the credential configuration information, it generates an authentication credential file corresponding to the newly added component instance according to the credential configuration information, and after the business container of the collector detects the authentication credential file, it obtains the corresponding authentication credential; wherein, the collector is a deployable unit deployed on the cluster, and the business container is used to collect data of the component instances on the cluster.

[0082] In the embodiment of the present invention, the specific implementation method of this step can refer to the description in the above embodiment and will not be repeated here.

[0083] In an optional embodiment of the present invention, it may also include: after the component console is restarted, reading the identification information of the component instance and the corresponding authentication credentials in the database; and updating the credential configuration information stored in the cluster according to the read identification information of the component instance and the corresponding authentication credentials.

[0084] The component console may be restarted, for example, the component console encounters an error and restarts, or restarts due to any other reason, which is not limited in the embodiment of the present invention.

[0085] After the component console is restarted, it first reads the identification information and corresponding authentication credentials of all component instances from the database. It then stores the read identification information and corresponding authentication credentials of the component instances into the credential configuration information stored in the cluster. Specifically, the credential configuration information can be updated in an overwriting manner. In this way, data replay and cold start of data can be guaranteed in different process links.

[0086] For example, when the component console encounters an error and restarts, it will first find all the tenant IDs and their corresponding tenant authentication credentials in the database, and then call the k8s apiserver to update the configmap to replay the data.

[0087] According to an embodiment of the present invention, by receiving the corresponding authentication credential issued by the cloud platform when activating a component instance, the credential configuration information stored in the cluster is updated according to the identification information of the component instance and the authentication credential, so that after the sidecar container of the collector on the cluster monitors the change event of the credential configuration information, an authentication credential file corresponding to the newly added component instance is generated according to the credential configuration information, and after the business container of the collector monitors the authentication credential file, the corresponding authentication credential is obtained; wherein the collector is a deployable unit deployed on the cluster, and the business container is used to collect data of the component instances on the cluster, so that the activation of the component instance is used as a trigger, and the authentication credential of the newly added component instance is captured in real time and smoothly by the mechanism of event notification monitoring, and then the collector is dynamically configured using the above information, so as to dynamically configure the authentication credential of each component instance, thereby avoiding the problem of non-real-time and non-smooth data collection and reporting.

[0088] Reference Figure 3 , shows a flowchart of the steps of an authentication credential configuration method provided by an embodiment of the present invention, which is applied to a collector, and the collector is a deployable unit deployed on a cluster. The collector includes at least one business container and a sidecar container. The business container is used to collect data of component instances on the cluster, and specifically may include the following steps:

[0089] Step 301: After the sidecar container detects a change event of the credential configuration information stored in the cluster, it generates an authentication credential file corresponding to the newly added component instance according to the credential configuration information.

[0090] In the embodiment of the present invention, the specific implementation method of this step can refer to the description in the above embodiment and will not be repeated here.

[0091] Step 302: After the business container detects the authentication credential file, it obtains the corresponding authentication credential.

[0092] In the embodiment of the present invention, the specific implementation method of this step can refer to the description in the above embodiment and will not be repeated here.

[0093] In an optional embodiment of the present invention, it may also include: when the business container reports the data collected from the newly added component instance to the gateway, the authentication certificate is sent to the gateway, so that the gateway can verify whether the authentication certificate is legal. If the authentication certificate is legal, the collected data is released to the observable platform; if the authentication certificate is illegal, the collected data is intercepted.

[0094] The business container can collect observable data of all component instances. The business container collects data of newly added component instances and then reports the collected data to the observability platform.

[0095] There is a gateway between the business container and the observability platform. The business container first reports the collected data to the gateway, and when reporting the data, it also needs to send the authentication credentials of the component instance to the gateway.

[0096] The gateway verifies the authentication credentials. If the authentication credentials are verified to be legitimate, the reported data is released to the observability platform. If the authentication credentials are verified to be invalid, the reported data is intercepted.

[0097] For example, for example, Figure 4 As shown in the architecture diagram of the authentication credential configuration, the cloud platform generates an authentication credential licence for each component instance, and then passes the authentication credential licence corresponding to the component instance to the component console when calling the activation interface of the component console. After receiving the authentication credential passed by the cloud platform, the component console stores the identification information (tenant id) of the component instance and the corresponding authentication credential licence in the database db. The component console can save the identification information (tenant id) of the component instance and the authentication credential licence to the credential configuration information configmap stored in the cluster. The sidecar container sidecar can monitor the changes of the credential configuration information configmap stored in the cluster in real time. After capturing the change (Modified) event, the sidecar container reads the entire credential configuration information configmap. The sidecar container determines the authentication credential corresponding to the newly added component instance based on the credential configuration information configmap, and then generates an authentication credential file, the content of which is the authentication credential corresponding to the newly added component instance. The business container monitors all authentication credential files. When a new authentication credential file is found, it reads and parses the new authentication credential file to obtain the authentication credential therein. The business container reports the collected data to the gateway of the observable platform. The business container establishes a long link with the gateway based on the tenant dimension. The gateway verifies whether the authentication credential is a legitimate tenant. If it is determined to be a legitimate tenant, the reported data is released to the observable platform. If it is determined to be illegal, the reported data is intercepted.

[0098] In an optional embodiment of the present invention, it may also include: the sidecar container stores the authentication credential file in a preset directory in the collector; and the business container monitors a specific implementation method of the authentication credential file, which may include: the business container monitors new files in the preset directory to obtain the authentication credential file.

[0099] The sidecar container stores the generated authentication credential file in the preset directory in the collector. Since the sidecar container and the business container are both in the collector, that is, a deployable unit of the cluster, the business container can also monitor the preset directory. When a new file is detected in the preset directory, the new file, that is, the newly generated authentication credential file, is obtained.

[0100] In an optional embodiment of the present invention, after the collector is restarted, the sidecar container generates authentication credential files corresponding to all component instances according to the credential configuration information.

[0101] After the collector is restarted, the sidecar container obtains all configurations in the credential configuration information, and then generates authentication credential files corresponding to each component instance based on the identification information of the component instance and the corresponding authentication credential recorded in the credential configuration information.

[0102] For example, when the collector encounters an error and restarts, the sidecar container will obtain all the configurations of the above configmap, and then generate a full authentication credential file in the preset directory that records each tenant ID and the tenant's authentication credential. In this way, data replay and cold start of data can be guaranteed in different process links.

[0103] According to an embodiment of the present invention, after the sidecar container monitors the change event of the credential configuration information stored in the cluster, an authentication credential file corresponding to the newly added component instance is generated according to the credential configuration information; after the business container monitors the authentication credential file, the corresponding authentication credential is obtained, so that the component instance activation is used as the triggering opportunity, and the authentication credential of the newly added component instance is captured in real time and smoothly through the event notification monitoring mechanism, and then the collector is dynamically configured using the above information, thereby dynamically configuring the authentication credential of each component instance, thereby avoiding the problem of non-real-time and non-smooth data collection and reporting.

[0104] The following is a verification of the solution of the present invention. Prepare 5 virtual machines with 4-core CPU (Central Processing Unit) and 8G memory, and deploy a highly available (3 Master nodes) Kubernetes cluster. Upload the helm (package manager) template to any master node of the cluster, and download helm v3 to the node. The helm template implements the configuration related to the deployment of the collector, including the business container and sidecar container in the pod, and the configmap that the sidecar container needs to listen to. Create a table in the database of the component console for saving the tenant id and the tenant's authentication credentials. Initiate the activation of the component instance through the cloud platform, call the activation interface of the component console for construction, and the component console inserts the tenant id and the tenant's authentication credentials into the database, and then initiates the insertion operation of the collector's configmap. When it is found that the configmap is updated, observe whether the sidecar container has received the event notification of the configmap update. If the sidecar container receives the event notification of the configmap, observe whether the corresponding authentication credential file that records the tenant id and the tenant's authentication credentials is created in the preset directory in the pod. After the authentication credential file in the preset directory is created, observe whether the business container of the collector can detect the change of the authentication credential file and load the new configuration to establish the long link for authentication. After the above incremental authentication credential dynamic configuration is run through, manually trigger the restart of the component console and the collector to observe whether the data in the database can be fully loaded for data playback and the configmap data can be loaded to regenerate the authentication credential file. After the implementation is completed, clear the data in the database of the component console, use the helm uninstall (package manager uninstall) command to uninstall, and then observe that all installed components have been uninstalled.

[0105] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0106] Reference Figure 5 , shows a structural block diagram of an authentication credential configuration device embodiment provided by another embodiment of the present invention, which is applied to a component console and may specifically include the following modules:

[0107] The credential receiving module 401 is used to receive the corresponding authentication credential issued by the cloud platform when the component instance is activated;

[0108] The information update module 402 is used to update the credential configuration information stored in the cluster according to the identification information of the component instance and the authentication credential, so that after the sidecar container of the collector on the cluster detects the change event of the credential configuration information, it generates an authentication credential file corresponding to the newly added component instance according to the credential configuration information, and after the business container of the collector detects the authentication credential file, it obtains the corresponding authentication credential; wherein, the collector is a deployable unit deployed on the cluster, and the business container is used to collect data of the component instances on the cluster.

[0109] Optionally, the device further comprises:

[0110] The storage module is used to store the identification information of the component instance and the corresponding authentication certificate in a database.

[0111] Optionally, the device further comprises:

[0112] A credential reading module, used to read the identification information of the component instance and the corresponding authentication credential in the database after the component console is restarted;

[0113] The information update module is used to update the credential configuration information stored in the cluster according to the read identification information of the component instance and the corresponding authentication credential.

[0114] According to an embodiment of the present invention, by receiving the corresponding authentication credential issued by the cloud platform when activating a component instance, the credential configuration information stored in the cluster is updated according to the identification information of the component instance and the authentication credential, so that after the sidecar container of the collector on the cluster monitors the change event of the credential configuration information, an authentication credential file corresponding to the newly added component instance is generated according to the credential configuration information, and after the business container of the collector monitors the authentication credential file, the corresponding authentication credential is obtained; wherein the collector is a deployable unit deployed on the cluster, and the business container is used to collect data of the component instances on the cluster, so that the activation of the component instance is used as a trigger, and the authentication credential of the newly added component instance is captured in real time and smoothly by the mechanism of event notification monitoring, and then the collector is dynamically configured using the above information, so as to dynamically configure the authentication credential of each component instance, thereby avoiding the problem of non-real-time and non-smooth data collection and reporting.

[0115] Reference Figure 6 , shows a structural block diagram of an authentication credential configuration device embodiment provided by another embodiment of the present invention, which is applied to a collector. The collector is a deployable unit deployed on a cluster. The collector includes at least one business container and a sidecar container. The business container is used to collect data of component instances on the cluster, and may specifically include the following modules:

[0116] A file generation module 501 is used for the sidecar container to generate an authentication credential file corresponding to a newly added component instance according to the credential configuration information after detecting a change event of the credential configuration information stored in the cluster;

[0117] The certificate acquisition module 502 is used for the business container to acquire the corresponding authentication certificate after monitoring the authentication certificate file.

[0118] Optionally, the device further comprises:

[0119] The credential sending module is used for the business container to send the authentication credential to the gateway when reporting the data collected from the newly added component instance to the gateway, so that the gateway can verify whether the authentication credential is legal. If the authentication credential is legal, the collected data is released to the observable platform; if the authentication credential is illegal, the collected data is intercepted.

[0120] Optionally, the device further comprises:

[0121] A file storage module, used for the sidecar container to store the authentication credential file in a preset directory in the collector;

[0122] The file generation module comprises:

[0123] The monitoring submodule is used for the business container to monitor new files in the preset directory to obtain the authentication credential file.

[0124] According to an embodiment of the present invention, after the sidecar container monitors the change event of the credential configuration information stored in the cluster, an authentication credential file corresponding to the newly added component instance is generated according to the credential configuration information; after the business container monitors the authentication credential file, the corresponding authentication credential is obtained, so that the component instance activation is used as the triggering opportunity, and the authentication credential of the newly added component instance is captured in real time and smoothly through the event notification monitoring mechanism, and then the collector is dynamically configured using the above information, thereby dynamically configuring the authentication credential of each component instance, thereby avoiding the problem of non-real-time and non-smooth data collection and reporting.

[0125] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0126] Figure 7 is a block diagram of an electronic device 700 according to an exemplary embodiment. For example, the electronic device 700 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0127] Reference Figure 7 , the electronic device 700 may include one or more of the following components: a processing component 702 , a memory 704 , a power component 706 , a multimedia component 708 , an audio component 710 , an input / output (I / O) interface 712 , a sensor component 714 , and a communication component 716 .

[0128] The processing component 702 generally controls the overall operation of the electronic device 700, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 702 may include one or more processors 720 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 702 may include one or more modules to facilitate the interaction between the processing component 702 and other components. For example, the processing component 702 may include a multimedia module to facilitate the interaction between the multimedia component 708 and the processing component 702.

[0129] The memory 704 is configured to store various types of data to support operations on the electronic device 700. Examples of such data include instructions for any application or method operating on the electronic device 700, contact data, phone book data, messages, pictures, videos, etc. The memory 704 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0130] The power supply component 706 provides power to the various components of the electronic device 700. The power supply component 706 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 700.

[0131] The multimedia component 708 includes a screen that provides an output interface between the electronic device 700 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 708 includes a front camera and / or a rear camera. When the electronic device 700 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0132] The audio component 710 is configured to output and / or input audio signals. For example, the audio component 710 includes a microphone (MIC), and when the electronic device 700 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 704 or sent via the communication component 716. In some embodiments, the audio component 710 also includes a speaker for outputting audio signals.

[0133] I / O interface 712 provides an interface between processing component 702 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: home button, volume button, start button, and lock button.

[0134] The sensor assembly 714 includes one or more sensors for providing various aspects of status assessment for the electronic device 700. For example, the sensor assembly 714 can detect the open / closed state of the electronic device 700, the relative positioning of components, such as the display and keypad of the electronic device 700, and the sensor assembly 714 can also detect the position change of the electronic device 700 or a component of the electronic device 700, the presence or absence of user contact with the electronic device 700, the orientation or acceleration / deceleration of the electronic device 700, and the temperature change of the electronic device 700. The sensor assembly 714 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 714 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 714 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0135] The communication component 716 is configured to facilitate wired or wireless communication between the electronic device 700 and other devices. The electronic device 700 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 716 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 716 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0136] In an exemplary embodiment, the electronic device 700 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0137] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 704 including instructions, and the instructions can be executed by a processor 720 of an electronic device 700 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0138] A non-transitory computer-readable storage medium, when the instructions in the readable storage medium are executed by a processor of a terminal, enables the terminal to execute one or more authentication credential configuration methods described in the embodiments of the present invention.

[0139] A computer program product, when running on an electronic device, enables a processor to implement the steps in one or more authentication credential configuration methods described in an embodiment of the present invention.

[0140] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0141] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0142] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0143] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0144] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0145] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0146] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0147] The above is a detailed introduction to an authentication credential configuration method and an authentication credential configuration device provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for configuring an authentication credential, characterized in that: Applied to a component console, the method comprises: Receive the corresponding authentication certificate issued by the cloud platform when activating the component instance; According to the identification information of the component instance and the authentication credential, the credential configuration information stored in the cluster is updated so that after the sidecar container of the collector on the cluster detects the change event of the credential configuration information, an authentication credential file corresponding to the newly added component instance is generated according to the credential configuration information, and after the business container of the collector detects the authentication credential file, the corresponding authentication credential is obtained; wherein, the collector is a deployable unit deployed on the cluster, and the business container is used to collect data of the component instances on the cluster.

2. The method according to claim 1, characterized in that The method further comprises: The identification information of the component instance and the corresponding authentication credential are stored in a database.

3. The method according to claim 2, characterized in that The method further comprises: After the component console is restarted, reading the identification information of the component instance and the corresponding authentication credential in the database; Update the credential configuration information stored in the cluster according to the read identification information of the component instance and the corresponding authentication credential.

4. A method for configuring an authentication credential, characterized in that: Applied to a collector, the collector is a deployable unit deployed on a cluster, the collector includes at least one business container and a sidecar container, the business container is used to collect data of component instances on the cluster, the method includes: After the sidecar container detects a change event of the credential configuration information stored in the cluster, it generates an authentication credential file corresponding to the newly added component instance according to the credential configuration information; After the business container detects the authentication credential file, it obtains the corresponding authentication credential.

5. The method according to claim 4, characterized in that The method further comprises: When the business container reports the data collected from the newly added component instance to the gateway, the authentication certificate is sent to the gateway so that the gateway can verify whether the authentication certificate is legal. If the authentication certificate is legal, the collected data is released to the observable platform; if the authentication certificate is illegal, the collected data is intercepted.

6. The method according to claim 4, characterized in that The method further comprises: The sidecar container stores the authentication credential file in a preset directory in the collector; The business container monitors the authentication credential file, including: The business container monitors new files in the preset directory to obtain the authentication credential file.

7. An authentication credential configuration device, characterized in that: Applied to a component console, the device comprises: The credential receiving module is used to receive the corresponding authentication credential issued by the cloud platform when the component instance is activated; An information update module is used to update the credential configuration information stored in the cluster according to the identification information of the component instance and the authentication credential, so that after the sidecar container of the collector on the cluster detects the change event of the credential configuration information, it generates an authentication credential file corresponding to the newly added component instance according to the credential configuration information, and after the business container of the collector detects the authentication credential file, it obtains the corresponding authentication credential; wherein, the collector is a deployable unit deployed on the cluster, and the business container is used to collect data of the component instances on the cluster.

8. An authentication credential configuration device, characterized in that: Applied to a collector, the collector is a deployable unit deployed on a cluster, the collector includes at least one business container and a sidecar container, the business container is used to collect data of component instances on the cluster, and the device includes: A file generation module, which is used for the sidecar container to generate an authentication credential file corresponding to a newly added component instance according to the credential configuration information after detecting a change event of the credential configuration information stored in the cluster; The credential acquisition module is used to acquire the corresponding authentication credential after the business container monitors the authentication credential file.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor is used to implement the authentication credential configuration method steps described in any one of claims 1-6 when executing a computer program stored in a memory.

10. A readable storage medium, characterized in that: When the instructions in the readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the authentication credential configuration method steps as described in one or more of method claims 1-6.

Images