Authentication credential configuration methods, devices, electronic equipment and storage media

Abstract

This invention provides a method and apparatus for configuring authentication credentials. The method includes: a component console receiving the corresponding authentication credential issued by a cloud platform when a component instance is activated; the component console updating the credential configuration information stored in the cluster based on the component instance's identifier information and the authentication credential; the collector's sidecar container detecting a change event in the credential configuration information stored in the cluster generating an authentication credential file corresponding to the newly added component instance based on the credential configuration information; and the collector's business container detecting the authentication credential file and obtaining the corresponding authentication credential. This allows for the real-time and smooth capture of the authentication credential of the newly added component instance, triggered by component instance activation and using an event notification listening mechanism. The collector is then dynamically configured using the aforementioned information, thereby dynamically configuring the authentication credential for each component instance and avoiding the problem of unreal-time and unsmooth data collection and reporting.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to an authentication credential configuration method, an authentication credential configuration device, an electronic device, and a readable storage medium. Background Technology

[0002] Cloud-native is a methodology for building and running applications that involves the concepts of tenants, private clusters, and managed clusters. For example, a private cluster means that the Kubernetes (k8s) cluster is exclusively used by a single tenant, while a managed cluster represents a k8s cluster shared by n tenants.

[0003] For security reasons, cloud platform components require authentication of tenant requests. These authentication credentials are uniformly allocated by the cloud platform when the component instance is activated, similar to an authentication license. Consider a business scenario where observable data from all component instances of all tenants within a managed cluster needs to be collected and reported to an observability platform. To achieve this data collection, a collector is typically deployed as a plugin within the cluster. In this case, because the collector is unique to the cluster, not just the tenant, and the relationship between tenant and authentication credential is one-to-one, for existing tenants, it's necessary to manually configure the existing authentication credential for each existing tenant within the collector; for new tenants, a smooth transition in data collection cannot be guaranteed as tenant instances are activated.

[0004] The existing method cannot dynamically configure authentication credentials for incremental tenants and lacks a fully automated configuration method, resulting in unreal-time and uneven data collection and reporting in business scenarios where observable data collection is possible. Summary of the Invention

[0005] The technical problem to be solved by the embodiments of the present invention is to provide an authentication credential configuration method, apparatus, electronic device and readable storage medium, so as to solve the problem that the authentication credential cannot be dynamically configured for incremental tenants, resulting in unreal-time and unsmooth data collection and reporting.

[0006] To address the aforementioned problems, this invention provides an authentication credential configuration method, applied to a component console, comprising:

[0007] Receive the corresponding authentication credentials issued by the cloud platform when activating a component instance;

[0008] Based on the identification information of the component instance and the authentication credential, the credential configuration information stored in the cluster is updated so that after the sidecar container of the collector on the cluster detects the change event of the credential configuration information, it generates the authentication credential file corresponding to the newly added component instance according to the credential configuration information. After the business container of the collector detects the authentication credential file, it obtains the corresponding authentication credential. Herein, the collector is a deployable unit deployed on the cluster, and the business container is used to collect data of the component instances on the cluster.

[0009] Optionally, the method further includes:

[0010] The identification information of the component instance and the corresponding authentication credential are stored in the database.

[0011] Optionally, the method further includes:

[0012] After the component console restarts, it reads the component instance's identification information and corresponding authentication credentials from the database;

[0013] Update the credential configuration information stored in the cluster based on the identifier information of the read component instance and the corresponding authentication credentials.

[0014] This invention also provides an authentication credential configuration method applied to a data collector, wherein the data collector is a deployable unit deployed on a cluster, the data collector including at least one business container and one sidecar container, the business container being used to collect data from component instances on the cluster, including:

[0015] After the sidecar container detects a change event in the credential configuration information stored in the cluster, it generates an authentication credential file corresponding to the newly added component instance based on the credential configuration information.

[0016] After the business container detects the authentication credential file, it obtains the corresponding authentication credential.

[0017] Optionally, the method further includes:

[0018] When the business container reports the data collected from the newly added component instance to the gateway, it sends the authentication credential to the gateway so that the gateway can verify whether the authentication credential is valid. If the authentication credential is valid, the collected data is allowed to be sent to the observable platform. If the authentication credential is invalid, the collected data is intercepted.

[0019] Optionally, the method further includes:

[0020] The sidecar container stores the authentication certificate file in a preset directory in the collector;

[0021] The business container detects the authentication credential file, including:

[0022] The business container monitors new files in the preset directory and obtains the authentication credential file.

[0023] The present invention also provides an authentication credential configuration device, applied to a component console, comprising:

[0024] The credential receiving module is used to receive the corresponding authentication credentials issued by the cloud platform when activating a component instance;

[0025] The information update module is used to update the credential configuration information stored in the cluster based on the identification information of the component instance and the authentication credential. This allows the sidecar container of the collector on the cluster to detect the change event of the credential configuration information and generate an authentication credential file corresponding to the newly added component instance based on the credential configuration information. The business container of the collector then detects the authentication credential file and obtains the corresponding authentication credential. The collector is a deployable unit deployed on the cluster, and the business container is used to collect data from the component instances on the cluster.

[0026] Optionally, the device further includes:

[0027] The storage module is used to store the identification information of the component instance and the corresponding authentication credential in the database.

[0028] Optionally, the device further includes:

[0029] The credential reading module is used to read the identification information of the component instance and the corresponding authentication credentials in the database after the component console is restarted.

[0030] The information update module is used to update the credential configuration information stored in the cluster based on the identification information of the read component instance and the corresponding authentication credentials.

[0031] This invention also provides an authentication credential configuration device applied to a data collector, wherein the data collector is a deployable unit deployed on a cluster, the data collector including at least one business container and one sidecar container, the business container being used to collect data from component instances on the cluster, including:

[0032] The file generation module is used to generate an authentication credential file corresponding to the newly added component instance based on the credential configuration information after the sidecar container detects a change event in the credential configuration information stored in the cluster.

[0033] The credential acquisition module is used to acquire the corresponding authentication credential after the business container detects the authentication credential file.

[0034] Optionally, the device further includes:

[0035] The credential sending module is used to send the authentication credential to the gateway when the business container reports the data collected from the newly added component instance to the gateway, so that the gateway can verify whether the authentication credential is valid. If the authentication credential is valid, the collected data is allowed to be sent to the observable platform. If the authentication credential is invalid, the collected data is intercepted.

[0036] Optionally, the device further includes:

[0037] The file storage module is used by the sidecar container to store the authentication certificate file in a preset directory in the collector;

[0038] The file generation module includes:

[0039] The monitoring submodule is used by the business container to monitor new files in the preset directory and obtain the authentication credential file.

[0040] This invention also discloses an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0041] Memory, used to store computer programs;

[0042] When a processor executes a computer program stored in memory, it implements the authentication credential configuration method steps described above.

[0043] This invention also discloses a readable storage medium, which, when the instructions in the readable storage medium are executed by the processor of an electronic device, enables the electronic device to perform one or more of the authentication credential configuration method steps described in this invention.

[0044] This invention also discloses a computer program product that, when run on an electronic device, causes a processor to execute one or more of the steps described in this invention.

[0045] According to an embodiment of the present invention, the component console receives the corresponding authentication credentials issued by the cloud platform when a component instance is activated. The component console updates the credential configuration information stored in the cluster based on the identifier information of the component instance and the authentication credentials. After the sidecar container of the collector detects the change event of the credential configuration information stored in the cluster, it generates the authentication credential file corresponding to the newly added component instance based on the credential configuration information. After the business container of the collector detects the authentication credential file, it obtains the corresponding authentication credentials. This enables the authentication credentials of the newly added component instance to be captured in real time and smoothly through an event notification listening mechanism, triggered by the activation of the component instance. Then, the collector is dynamically configured using the above information, thereby dynamically configuring the authentication credentials of each component instance and avoiding the problem of non-real-time and non-smooth data collection and reporting. Attached Figure Description

[0046] Figure 1 This invention provides a flowchart of the steps of an authentication credential configuration method according to an embodiment of the present invention.

[0047] Figure 2 This diagram illustrates a flowchart of the steps in an authentication credential configuration method according to another embodiment of the present invention.

[0048] Figure 3 This diagram illustrates a flowchart of the steps involved in configuring authentication credentials according to another embodiment of the present invention.

[0049] Figure 4 The diagram illustrates the architecture of the authentication credential configuration.

[0050] Figure 5 This diagram illustrates a structural block diagram of an embodiment of an authentication credential configuration device provided by the present invention.

[0051] Figure 6 This diagram illustrates a structural block diagram of an embodiment of an authentication credential configuration device provided by another embodiment of the present invention;

[0052] Figure 7 A structural block diagram of an electronic device according to an exemplary embodiment is shown. Detailed Implementation

[0053] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0054] Reference Figure 1 The diagram illustrates a flowchart of an authentication credential configuration method provided by an embodiment of the present invention, which may specifically include the following steps:

[0055] Step 101: The component console receives the corresponding authentication credentials issued by the cloud platform when the component instance is activated.

[0056] In this embodiment of the invention, a component instance refers to an instantiated program of a functional module. The cloud platform can activate component instances in the cluster. When activating a component instance through a page on the cloud platform, the cloud platform will call the activation interface of the component console to activate the component instance.

[0057] In this embodiment of the invention, the authentication credential is a credential representing permissions, uniformly allocated by the cloud platform. The cloud platform generates an authentication credential for each component instance, and then passes the authentication credential corresponding to the component instance to the component console when calling the activation interface of the component console.

[0058] In this embodiment of the invention, the component console receives the authentication credentials corresponding to the component instance.

[0059] For example, when n tenants share a certain Kubernetes cluster, the cloud platform enables a component instance for tenant A in the Kubernetes cluster by calling the enable interface in the component console and passing tenant A's authentication credentials to the component console.

[0060] Step 102: The component console updates the credential configuration information stored in the cluster based on the identifier information of the component instance and the authentication credential.

[0061] In this embodiment of the invention, the identification information of a component instance refers to information used to identify the component instance, such as tenant ID (identity document).

[0062] In this embodiment of the invention, the cluster stores credential configuration information, which contains the identification information of all activated component instances and their corresponding authentication credentials. For example, during cluster and collector initialization, the collector maintains a configmap (i.e., credential configuration information). The purpose of this configmap is to store the authentication credentials of tenants in the cluster. The key-value pair mapping is such that the key is the tenant ID and the value is the authentication credential of that tenant.

[0063] In this embodiment of the invention, the component console can save the component instance's identification information and authentication credentials to the credential configuration information stored in the cluster. For example, after receiving the authentication credentials from the cloud platform, the component console updates the collector's configuration by calling the k8s apiserver (an interface that can be used for storage operations), saving the tenant ID and the tenant's authentication credentials as key-value pairs.

[0064] Step 103: After the sidecar container of the collector detects the change event of the credential configuration information stored in the cluster, it generates the authentication credential file corresponding to the newly added component instance according to the credential configuration information.

[0065] In this embodiment of the invention, the collector is a deployable unit deployed on a cluster, and the collector includes at least one service container and one sidecar container. The service container is used to collect data from component instances on the cluster.

[0066] For example, the collector is deployed on the Kubernetes cluster in the form of a pod (deployable unit). In addition to the business container responsible for collecting data, another container is started in the pod as a sidecar.

[0067] In this embodiment of the invention, the sidecar container can monitor changes in the credential configuration information stored in the cluster in real time. After capturing a Modified event, the sidecar container reads the entire credential configuration information.

[0068] For example, the sidecar container monitors changes to the configmap in real time by watching the k8s apiserver (an interface that can be used for listening). When a change event is captured, it reads out all the key-value pairs of tenant ID and tenant authentication credentials from the configmap.

[0069] In this embodiment of the invention, the sidecar container determines the authentication credential corresponding to the newly added component instance based on the credential configuration information, and then generates an authentication credential file, the content of which is the authentication credential corresponding to the newly added component instance.

[0070] For example, the sidecar container traverses and parses all the key-value pairs it reads. In the preset directory in the pod, it checks whether there are files named after each tenant ID. If a file named after a certain tenant ID in the key-value pair information does not exist, a new file is generated and the authentication credentials are saved as the file content in the file, i.e., the authentication credential file.

[0071] Step 104: After the business container of the collector detects the authentication credential file, it obtains the corresponding authentication credential.

[0072] In this embodiment of the invention, the business container monitors all authentication credential files. When a new authentication credential file is detected, it reads and parses the new authentication credential file to obtain the authentication credentials therein.

[0073] In this embodiment of the invention, the business logic of listening to and reloading credential configuration information is placed in the sidecar container of the collector, thereby decoupling configuration generation from the collector's collection business. Since the collector's business container only focuses on the authentication credential files in the preset directory, the collector can run successfully whether it is deployed in the cluster as a pod or on a physical machine as a monolithic application.

[0074] According to an embodiment of the present invention, the component console receives the corresponding authentication credentials issued by the cloud platform when a component instance is activated. The component console updates the credential configuration information stored in the cluster based on the identifier information of the component instance and the authentication credentials. After the sidecar container of the collector detects the change event of the credential configuration information stored in the cluster, it generates the authentication credential file corresponding to the newly added component instance based on the credential configuration information. After the business container of the collector detects the authentication credential file, it obtains the corresponding authentication credentials. This enables the authentication credentials of the newly added component instance to be captured in real time and smoothly through an event notification listening mechanism, triggered by the activation of the component instance. Then, the collector is dynamically configured using the above information, thereby dynamically configuring the authentication credentials of each component instance and avoiding the problem of non-real-time and non-smooth data collection and reporting.

[0075] Reference Figure 2 The diagram illustrates a flowchart of an authentication credential configuration method provided by an embodiment of the present invention, applied to a component console, and specifically includes the following steps:

[0076] Step 201: Receive the corresponding authentication credentials issued by the cloud platform when activating the component instance.

[0077] In this embodiment of the invention, the specific implementation of this step can be found in the description of the foregoing embodiments, and will not be repeated here.

[0078] In an optional embodiment of the present invention, it may further include: storing the identification information of the component instance and the corresponding authentication credential in a database.

[0079] After receiving the authentication credentials from the cloud platform, the component console stores the component instance's identification information and the corresponding authentication credentials in the database.

[0080] For example, the component console stores the tenant ID and the tenant's authentication credentials in the component console's database.

[0081] Step 202: Update the credential configuration information stored in the cluster according to the identification information of the component instance and the authentication credential, so that after the sidecar container of the collector on the cluster detects the change event of the credential configuration information, it generates the authentication credential file corresponding to the newly added component instance according to the credential configuration information. After the business container of the collector detects the authentication credential file, it obtains the corresponding authentication credential. Here, the collector is a deployable unit deployed on the cluster, and the business container is used to collect data of the component instances on the cluster.

[0082] In this embodiment of the invention, the specific implementation of this step can be found in the description of the foregoing embodiments, and will not be repeated here.

[0083] In an optional embodiment of the present invention, the method may further include: after the component console restarts, reading the identification information of the component instance and the corresponding authentication credentials in the database; and updating the credential configuration information stored in the cluster based on the read identification information of the component instance and the corresponding authentication credentials.

[0084] The component console may restart, for example, due to an error or any other reason. This embodiment of the invention does not limit this.

[0085] After the component console restarts, it first reads the identification information and corresponding authentication credentials of all component instances from the database. Then, it stores the read component instance identification information and corresponding authentication credentials into the credential configuration information stored in the cluster, specifically updating the credential configuration information in an overwrite manner. This ensures data replayability and cold start capabilities at different stages of the process.

[0086] For example, when the component console encounters an error and restarts, it will first retrieve all tenant IDs and their corresponding authentication credentials from the database, and then call the k8s apiserver to update the configmap, thereby replaying the data.

[0087] According to an embodiment of the present invention, by receiving the corresponding authentication credentials issued by the cloud platform when activating a component instance, and updating the credential configuration information stored in the cluster based on the component instance's identification information and the authentication credentials, the sidecar container of the collector on the cluster detects the change event of the credential configuration information and generates an authentication credential file corresponding to the newly added component instance based on the credential configuration information. The business container of the collector detects the authentication credential file and obtains the corresponding authentication credentials. The collector is a deployable unit deployed on the cluster, and the business container is used to collect data from component instances on the cluster. This allows for real-time and smooth capture of the authentication credentials of newly added component instances, triggered by component instance activation, through an event notification listening mechanism. The collector is then dynamically configured using the aforementioned information, thereby dynamically configuring the authentication credentials for each component instance and avoiding the problem of non-real-time and non-smooth data collection and reporting.

[0088] Reference Figure 3 This diagram illustrates a flowchart of an authentication credential configuration method provided by an embodiment of the present invention. The method is applied to a data collector, which is a deployable unit deployed on a cluster. The data collector includes at least one business container and one sidecar container. The business container is used to collect data from component instances on the cluster, and specifically includes the following steps:

[0089] Step 301: After the sidecar container detects a change event in the credential configuration information stored in the cluster, it generates an authentication credential file corresponding to the newly added component instance based on the credential configuration information.

[0090] In this embodiment of the invention, the specific implementation of this step can be found in the description of the foregoing embodiments, and will not be repeated here.

[0091] Step 302: After the business container detects the authentication credential file, it obtains the corresponding authentication credential.

[0092] In this embodiment of the invention, the specific implementation of this step can be found in the description of the foregoing embodiments, and will not be repeated here.

[0093] In an optional embodiment of the present invention, it may further include: when the service container reports the data collected from the newly added component instance to the gateway, it sends the authentication certificate to the gateway so that the gateway can verify whether the authentication certificate is valid. If the authentication certificate is valid, the collected data is allowed to be sent to the observable platform; if the authentication certificate is invalid, the collected data is intercepted.

[0094] The business container can collect observable data from all component instances. It collects data from newly added component instances and then reports the collected data to the observability platform.

[0095] There is a gateway between the business container and the observability platform. The business container first reports the collected data to this gateway, and when reporting the data, it also needs to send the authentication credentials of the component instance to the gateway.

[0096] The gateway verifies the authentication credentials. If the authentication credentials are valid, the reported data is allowed to be sent to the observable platform. If the authentication credentials are invalid, the reported data is blocked.

[0097] For example, such as Figure 4 The diagram illustrates the architecture of the authentication credential configuration. The cloud platform generates an authentication credential (licence) for each component instance. When calling the activation interface of the component console, the authentication credential corresponding to the component instance is passed to the component console. Upon receiving the authentication credential from the cloud platform, the component console stores the component instance's identification information (tenant ID) and the corresponding authentication credential (licence) in the database (db). The component console can also save the component instance's identification information (tenant ID) and authentication credential (licence) to the credential configuration information (configmap) stored in the cluster. The sidecar container can monitor changes to the credential configuration information (configmap) stored in the cluster in real time. After capturing a Modified event, the sidecar container reads the entire credential configuration information (configmap). Based on the credential configuration information (configmap), the sidecar container determines the authentication credential corresponding to the newly added component instance and then generates an authentication credential file containing the authentication credential for the newly added component instance. The business container monitors all authentication credential files. When a new authentication credential file is detected, it reads and parses the new authentication credential file to obtain the authentication credential within it. The business container reports the collected data to the gateway of the observable platform. The business container establishes a long connection with the gateway at the tenant level. The gateway verifies whether the authentication credentials are valid for the tenant. If the tenant is found to be valid, the reported data is allowed to be sent to the observable platform. If the tenant is found to be invalid, the reported data is blocked.

[0098] In one optional embodiment of the present invention, it may further include: the sidecar container storing the authentication credential file in a preset directory in the collector; in a specific implementation of the business container detecting the authentication credential file, it may include: the business container detecting new files in the preset directory to obtain the authentication credential file.

[0099] The sidecar container stores the generated authentication credential file in a preset directory within the collector. Since both the sidecar container and the business container are located within the collector—that is, within a deployable unit of the cluster—the business container can also monitor this preset directory. When a new file is detected in the preset directory, it retrieves the new file, i.e., the newly generated authentication credential file.

[0100] In an optional embodiment of the present invention, after the collector restarts, the sidecar container generates authentication credential files corresponding to all component instances based on the credential configuration information.

[0101] After the collector restarts, the sidecar container retrieves all configurations from the credential configuration information, and then generates authentication credential files for each component instance based on the component instance identifier information and the corresponding authentication credentials recorded in the credential configuration information.

[0102] For example, if the collector encounters an error and restarts, the sidecar container will retrieve all configurations from the aforementioned configmap and then generate a full set of authentication credential files in the preset directory, recording each tenant's ID and authentication credentials. This ensures data replayability and cold start capability at different stages of the process.

[0103] According to an embodiment of the present invention, after the sidecar container detects a change event in the credential configuration information stored in the cluster, it generates an authentication credential file corresponding to the newly added component instance based on the credential configuration information. After the business container detects the authentication credential file, it obtains the corresponding authentication credential, so that the authentication credential of the newly added component instance is captured in real time and smoothly through an event notification listening mechanism triggered by the activation of the component instance. Then, the above information is used to dynamically configure the collector, thereby dynamically configuring the authentication credential of each component instance, thus avoiding the problem of non-real-time and non-smooth data collection and reporting.

[0104] The following is a verification of the present invention. Five virtual machines configured with 4-core CPUs (Central Processing Units) and 8GB of memory are prepared to deploy a highly available Kubernetes cluster (3 Master nodes). The Helm (package manager) template is uploaded to any master node of the cluster, and Helm v3 is downloaded to that node. This Helm template implements the configuration related to deploying the collector, including the business containers and sidecar containers in the pod, as well as the configmap that the sidecar containers need to listen to. A table is created in the database of the component console to store the tenant ID and the tenant's authentication credentials. The component instance is activated through the cloud platform, calling the activation interface of the component console for construction. The component console inserts the tenant ID and the tenant's authentication credentials into the database, and then initiates the insertion operation of the collector's configmap. When the configmap is found to be updated, observe whether the sidecar container receives a configmap update event notification. If the sidecar container receives the configmap event notification, observe whether a corresponding authentication credential file recording the tenant ID and the tenant's authentication credentials has been created in the preset directory of the pod. After the authentication credential file in the preset directory is created, observe whether the collector's business container can detect the change in the authentication credential file and load the new configuration to establish a long-lived authentication connection. After the entire incremental dynamic configuration of authentication credentials is successfully completed, manually trigger a restart of the component console and the collector, and observe whether the data in the database can be fully loaded for data replay and whether the configmap data can be loaded to regenerate the authentication credential file. After implementation, clear the data in the database of the component console, uninstall using the `helm uninstall` command (uninstall via the package manager), and then observe to find that all installed components have been uninstalled.

[0105] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0106] Reference Figure 5 The diagram illustrates a structural block diagram of an authentication credential configuration device according to another embodiment of the present invention, which is applied to a component console and may specifically include the following modules:

[0107] The credential receiving module 401 is used to receive the corresponding authentication credentials issued by the cloud platform when activating a component instance;

[0108] The information update module 402 is used to update the credential configuration information stored in the cluster according to the identification information of the component instance and the authentication credential, so that after the sidecar container of the collector on the cluster detects the change event of the credential configuration information, it generates the authentication credential file corresponding to the newly added component instance according to the credential configuration information, and after the business container of the collector detects the authentication credential file, it obtains the corresponding authentication credential; wherein, the collector is a deployable unit deployed on the cluster, and the business container is used to collect data of the component instances on the cluster.

[0109] Optionally, the device further includes:

[0110] The storage module is used to store the identification information of the component instance and the corresponding authentication credential in the database.

[0111] Optionally, the device further includes:

[0112] The credential reading module is used to read the identification information of the component instance and the corresponding authentication credentials in the database after the component console is restarted.

[0113] The information update module is used to update the credential configuration information stored in the cluster based on the identification information of the read component instance and the corresponding authentication credentials.

[0114] According to an embodiment of the present invention, by receiving the corresponding authentication credentials issued by the cloud platform when activating a component instance, and updating the credential configuration information stored in the cluster based on the component instance's identification information and the authentication credentials, the sidecar container of the collector on the cluster detects the change event of the credential configuration information and generates an authentication credential file corresponding to the newly added component instance based on the credential configuration information. The business container of the collector detects the authentication credential file and obtains the corresponding authentication credentials. The collector is a deployable unit deployed on the cluster, and the business container is used to collect data from component instances on the cluster. This allows for real-time and smooth capture of the authentication credentials of newly added component instances, triggered by component instance activation, through an event notification listening mechanism. The collector is then dynamically configured using the aforementioned information, thereby dynamically configuring the authentication credentials for each component instance and avoiding the problem of non-real-time and non-smooth data collection and reporting.

[0115] Reference Figure 6 The diagram illustrates a structural block diagram of an authentication credential configuration device according to another embodiment of the present invention. This device is applied to a data collector, which is a deployable unit deployed on a cluster. The data collector includes at least one service container and one sidecar container. The service container is used to collect data from component instances on the cluster and may specifically include the following modules:

[0116] The file generation module 501 is used to generate an authentication credential file corresponding to the newly added component instance based on the credential configuration information after the sidecar container detects a change event in the credential configuration information stored in the cluster.

[0117] The credential acquisition module 502 is used to acquire the corresponding authentication credential after the business container detects the authentication credential file.

[0118] Optionally, the device further includes:

[0119] The credential sending module is used to send the authentication credential to the gateway when the business container reports the data collected from the newly added component instance to the gateway, so that the gateway can verify whether the authentication credential is valid. If the authentication credential is valid, the collected data is allowed to be sent to the observable platform. If the authentication credential is invalid, the collected data is intercepted.

[0120] Optionally, the device further includes:

[0121] The file storage module is used by the sidecar container to store the authentication certificate file in a preset directory in the collector;

[0122] The file generation module includes:

[0123] The monitoring submodule is used by the business container to monitor new files in the preset directory and obtain the authentication credential file.

[0124] According to an embodiment of the present invention, after the sidecar container detects a change event in the credential configuration information stored in the cluster, it generates an authentication credential file corresponding to the newly added component instance based on the credential configuration information. After the business container detects the authentication credential file, it obtains the corresponding authentication credential, so that the authentication credential of the newly added component instance is captured in real time and smoothly through an event notification listening mechanism triggered by the activation of the component instance. Then, the above information is used to dynamically configure the collector, thereby dynamically configuring the authentication credential of each component instance, thus avoiding the problem of non-real-time and non-smooth data collection and reporting.

[0125] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0126] Figure 7 This is a structural block diagram illustrating an electronic device 700 according to an exemplary embodiment. For example, the electronic device 700 may be a mobile phone, computer, digital broadcasting terminal, messaging device, game console, tablet device, medical device, fitness equipment, personal digital assistant, etc.

[0127] Reference Figure 7 The electronic device 700 may include one or more of the following components: a processing component 702, a memory 704, a power supply component 706, a multimedia component 708, an audio component 710, an input / output (I / O) interface 712, a sensor component 714, and a communication component 716.

[0128] Processing component 702 typically controls the overall operation of electronic device 700, such as operations associated with display, telephone calls, data communication, camera operation, and recording operations. Processing component 702 may include one or more processors 720 to execute instructions to complete all or part of the steps of the methods described above. Furthermore, processing component 702 may include one or more modules to facilitate interaction between processing component 702 and other components. For example, processing component 702 may include a multimedia module to facilitate interaction between multimedia component 708 and processing component 702.

[0129] Memory 704 is configured to store various types of data to support the operation of electronic device 700. Examples of this data include instructions for any application or method operating on electronic device 700, contact data, phonebook data, messages, pictures, videos, etc. Memory 704 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0130] Power supply component 706 provides power to various components of electronic device 700. Power supply component 706 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to electronic device 700.

[0131] Multimedia component 708 includes a screen that provides an output interface between the electronic device 700 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touchscreen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors may sense not only the boundaries of the touch or swipe action but also the duration and pressure associated with the touch or swipe operation. In some embodiments, multimedia component 708 includes a front-facing camera and / or a rear-facing camera. When the electronic device 700 is in an operating mode, such as a shooting mode or a video mode, the front-facing camera and / or the rear-facing camera may receive external multimedia data. Each front-facing camera and rear-facing camera may be a fixed optical lens system or have focal length and optical zoom capabilities.

[0132] Audio component 710 is configured to output and / or input audio signals. For example, audio component 710 includes a microphone (MIC) configured to receive external audio signals when electronic device 700 is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals may be further stored in memory 704 or transmitted via communication component 716. In some embodiments, audio component 710 also includes a speaker for outputting audio signals.

[0133] I / O interface 712 provides an interface between processing component 702 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, home buttons, volume buttons, power buttons, and lock buttons.

[0134] Sensor assembly 714 includes one or more sensors for providing state assessments of various aspects of electronic device 700. For example, sensor assembly 714 can detect the on / off state of electronic device 700, the relative positioning of components such as the display and keypad of electronic device 700, changes in position of electronic device 700 or a component of electronic device 700, the presence or absence of user contact with electronic device 700, orientation or acceleration / deceleration of electronic device 700, and temperature changes of electronic device 700. Sensor assembly 714 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. Sensor assembly 714 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, sensor assembly 714 may also include an accelerometer, gyroscope, magnetometer, pressure sensor, or temperature sensor.

[0135] Communication component 716 is configured to facilitate wired or wireless communication between electronic device 700 and other devices. Electronic device 700 can access wireless networks based on communication standards, such as WiFi, 2G, or 3G, or combinations thereof. In one exemplary embodiment, communication component 716 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, communication component 716 also includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0136] In an exemplary embodiment, the electronic device 700 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the methods described above.

[0137] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 704 including instructions, which can be executed by a processor 720 of an electronic device 700 to perform the above-described method. For example, the non-transitory computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0138] A non-transitory computer-readable storage medium, when the instructions in the readable storage medium are executed by the processor of a terminal, enables the terminal to execute one or more of the authentication credential configuration methods described in the embodiments of the present invention.

[0139] A computer program product, when run on an electronic device, causes a processor to execute one or more of the authentication credential configuration methods described in the embodiments of the present invention.

[0140] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0141] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0142] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0143] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0144] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0145] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present invention.

[0146] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0147] The present invention has provided a detailed description of an authentication credential configuration method and an authentication credential configuration device. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for configuring authentication credentials, characterized in that, Applied to the component console, the method includes: Receive the corresponding authentication credentials issued by the cloud platform when activating a component instance; Based on the identification information of the component instance and the authentication credential, the credential configuration information stored in the cluster is updated so that after the sidecar container of the collector on the cluster detects the change event of the credential configuration information, it generates the authentication credential file corresponding to the newly added component instance according to the credential configuration information. After the business container of the collector detects the authentication credential file, it obtains the corresponding authentication credential. Herein, the collector is a deployable unit deployed on the cluster, and the business container is used to collect data of the component instances on the cluster.

2. The method according to claim 1, characterized in that, The method further includes: The identification information of the component instance and the corresponding authentication credential are stored in the database.

3. The method according to claim 2, characterized in that, The method further includes: After the component console restarts, it reads the component instance's identification information and corresponding authentication credentials from the database; Update the credential configuration information stored in the cluster based on the identifier information of the read component instance and the corresponding authentication credentials.

4. A method for configuring authentication credentials, characterized in that, The method, applied to a data collector, is a deployable unit deployed on a cluster. The data collector includes at least one business container and one sidecar container. The business container is used to collect data from component instances on the cluster. After the sidecar container detects a change event in the credential configuration information stored in the cluster, it generates an authentication credential file corresponding to the newly added component instance based on the credential configuration information. After the business container detects the authentication credential file, it obtains the corresponding authentication credential.

5. The method according to claim 4, characterized in that, The method further includes: When the business container reports the data collected from the newly added component instance to the gateway, it sends the authentication credential to the gateway so that the gateway can verify whether the authentication credential is valid. If the authentication credential is valid, the collected data is allowed to be sent to the observable platform. If the authentication credential is invalid, the collected data is intercepted.

6. The method according to claim 4, characterized in that, The method further includes: The sidecar container stores the authentication certificate file in a preset directory in the collector; The business container detects the authentication credential file, including: The business container monitors new files in the preset directory and obtains the authentication credential file.

7. An authentication credential configuration device, characterized in that, Applied to a component console, the device includes: The credential receiving module is used to receive the corresponding authentication credentials issued by the cloud platform when activating a component instance; The information update module is used to update the credential configuration information stored in the cluster based on the identification information of the component instance and the authentication credential. This allows the sidecar container of the collector on the cluster to detect the change event of the credential configuration information and generate an authentication credential file corresponding to the newly added component instance based on the credential configuration information. The business container of the collector then detects the authentication credential file and obtains the corresponding authentication credential. The collector is a deployable unit deployed on the cluster, and the business container is used to collect data from the component instances on the cluster.

8. An authentication credential configuration device, characterized in that, An apparatus applied to a data collector, which is a deployable unit deployed on a cluster, comprising at least one service container and one sidecar container, wherein the service container is used to collect data from component instances on the cluster, the apparatus comprising: The file generation module is used to generate an authentication credential file corresponding to the newly added component instance based on the credential configuration information after the sidecar container detects a change event in the credential configuration information stored in the cluster. The credential acquisition module is used to acquire the corresponding authentication credential after the business container detects the authentication credential file.

9. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; When a processor executes a computer program stored in memory, it implements the authentication credential configuration method steps as described in any one of claims 1-6.

10. A readable storage medium, characterized in that, When the instructions in the readable storage medium are executed by the processor of the electronic device, the electronic device is able to perform the authentication credential configuration method steps as described in one or more of the method claims 1-6.

Images