Container image scanning method and system based on elastically scalable distributed load balancing

Abstract

The application provides a container image scanning method and system based on an elastically scalable distributed load balancing, and belongs to the field of container image security, and comprises the following steps: S1, a Server end acquires a container group template based on Kubernetes admission control; S2, the Server executes different scanning strategies according to the template; S3, an Agent acquires an image layer from an image warehouse according to an image layer distributed by the Server, scans the image layer, and returns the scanning result to the Server; S4, a Job performs a scanning task on a node according to an image name, and reports a scanning result; after the task is executed, the Job container is automatically destroyed; S5, the Server distributes a scanning task according to a resource condition of the Agent, and dynamically adjusts the number of Agents according to a load; and S6, the system checks the uniqueness of an image layer ID, and avoids repeated scanning. The method realizes efficient container image scanning and resource management.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of container image security scanning, and particularly relates to a container image scanning method and system based on elastic scalable distributed load balancing. BACKGROUND

[0002] With the wide application of container technology, the security of container images, as the basis for application program and service deployment, is particularly important. Traditional image scanning methods mostly adopt single-machine or centralized scanning mode, which has performance bottlenecks and poor scalability, and cannot meet the efficient and secure image scanning requirements in large-scale container cluster environments. SUMMARY

[0003] To solve the above technical problems, the application provides a container image scanning method based on elastic scalable distributed load balancing, comprising the following steps:

[0004] Step S1: The Server end obtains the number of containers contained in the container group, the image name of each container and the pulling image mode from the container group template based on the admission control mechanism of Kubernetes, and configures an image scanning strategy; wherein the image scanning strategy includes strict scanning and tolerant scanning; and the pulling image mode includes Always, IfNotPresent and Never;

[0005] Step S2: When the pulling image mode is Always, the Server end obtains image metadata including image architecture, image system, image layer size and image layer ID list from the image repository according to the image name, and distributes the image scanning task to each Agent end in units of image layers through a load balancing algorithm;

[0006] When the pulling image mode is IfNotpresent, the Server end creates a Job end task, the Job end task detects whether the image exists on the Kubernetes node, if the image exists, the image is directly scanned, if the image does not exist, the Server end returns the information, and the Server end scans the remote repository according to the Always condition;

[0007] When the pulling image mode is Never, the Server end creates a Job end service, the Job end task detects whether the image exists on the Kubernetes node, if the image exists, the image is directly scanned, if the image does not exist, the Server end returns the information, and the Server end directly allows the creation of a container group;

[0008] Step S3: The agent end acquires the specified image layer from the remote image warehouse according to the image layer ID distributed by the server end, performs vulnerability scanning, and finally returns the result to the server end for summarization and real-time updating of the scanning progress;

[0009] Step S4: The job end performs a scanning task on the specified Kubernetes node according to the image name extracted by the server end, reports the scanning result to the server end, and determines whether the image exists on the Kubernetes node, and the job task is automatically destroyed and recycled after the task is executed;

[0010] Step S5: The server end distributes image scanning tasks and performs elastic scaling according to the resource conditions reported by each agent end, and dynamically increases or reduces the number of agents according to the load;

[0011] Step S6: The server end checks the uniqueness of the image layer ID through the database to avoid repeated scanning.

[0012] Beneficial effects:

[0013] The application provides a container image scanning method based on elastic scalable distributed load balancing, which can dynamically adjust the scanning task allocation according to the system load, improve the scanning efficiency, and ensure the safety of the container image. The method introduces image layer database verification, task distribution algorithm, load balancing algorithm and elastic scaling mechanism, and realizes efficient container image scanning and resource management. BRIEF DESCRIPTION OF DRAWINGS

[0014] Figure 1 It is a flowchart of the container image scanning method based on elastic scalable distributed load balancing.

[0015] Figure 2 It is a data flow diagram of the container image scanning method based on elastic scalable distributed load balancing.

[0016] Figure 3 It is a structure block diagram of the container image scanning system based on elastic scalable distributed load balancing. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical scheme and advantages of the application clearer, the application will be further described in detail below in combination with the drawings and examples. It should be understood that the specific examples described herein are only used to explain the application and do not limit the application. In addition, the technical features involved in each embodiment of the application described below can be combined with each other as long as they do not conflict with each other.

[0018] Example one

[0019] The container image scanning method based on the elastically scalable distributed load balancing provided by the embodiment of the application comprises the following steps:

[0020] Step S1: The Server end obtains the number of containers contained by a container group, the image name of each container and the pulling image mode from the container group template based on the admission control mechanism of Kubernetes, and configures an image scanning strategy; wherein the image scanning strategy comprises strict scanning and tolerant scanning; and the pulling image mode comprises Always, IfNotPresent and Never;

[0021] Step S2: When the pulling image mode is Always, the Server end obtains image metadata from an image warehouse according to the image name, including image architecture, image system, image layer size and image layer ID list, and distributes image scanning tasks to each Agent end in units of image layers through a load balancing algorithm;

[0022] When the pulling image mode is IfNotpresent, the Server end creates a Job end task, the Job end task detects whether the image exists on a Kubernetes node, directly scans if the image exists, returns Server information if the image does not exist, and the Server end scans the remote warehouse according to the Always condition;

[0023] When the pulling image mode is Never, the Server end creates a Job end service, the Job end task detects whether the image exists on a Kubernetes node, directly scans if the image exists, returns Server information if the image does not exist, and the Server end directly allows the creation of a container group;

[0024] Step S3: The Agent end obtains a specified image layer from a remote image warehouse according to the image layer ID distributed by the Server end, performs vulnerability scanning, and finally returns the result to the Server end for aggregation and real-time updating of the scanning progress;

[0025] Step S4: The Job end performs a scanning task on a specified Kubernetes node according to the image name extracted by the Server end, reports the scanning result and whether the image exists on the Kubernetes node to the Server end, and the Job task is automatically destroyed and recycled after the task execution is completed;

[0026] Step S5: The Server end dynamically distributes image scanning tasks and elastically scales according to the resource condition reported by each Agent end, and dynamically increases or reduces the number of Agents according to the load;

[0027] Step S6: The Server checks the uniqueness of the mirror layer ID through the database to avoid repeated scanning.

[0028] In one embodiment, the above step S1:

[0029] The Server obtains the number of containers contained in the container group and the image name and pulling image mode of each container from the container group template, and configures the image scanning strategy, which specifically includes:

[0030] Step S11: In the Kubernetes environment, the Server obtains the container group template configuration through the admission control mechanism, and configures the image scanning strategy in the container group template in the form of an annotation, including:

[0031] Strict scanning: the image is scanned before the creation of the Kubernetes container group, and during the scanning process, the vulnerabilities are classified according to the severity level, including: high risk, medium risk, and low risk. If a vulnerability is found, it will be decided whether to allow the container group to be created according to the set severity level;

[0032] Tolerant scanning: image scanning is performed after the creation of the container group. At this time, the container group can be normally scheduled and run. During the scanning process, the execution mode of the scanning task is determined according to the image pulling mode;

[0033] Step S12: Obtain the image pulling mode from the container group template, including:

[0034] Always: always obtain the image from the remote image repository;

[0035] IfNotPresent: prefer to use the image on the Kubernetes node, and if it does not exist, obtain it from the remote image repository;

[0036] Never: only find the image on the Kubernetes node;

[0037] Step S13: The Server decides whether to immediately release, create the container group by Kubernetes, or wait for the scanning result to decide whether to release, create the container group by Kubernetes according to the image scanning strategy; and pulls the image in different forms according to the image pulling mode.

[0038] In one embodiment, the above step S2: when the pulling image mode is Always, the Server obtains the image metadata from the image repository according to the image name, including: image architecture, image system, image layer size, image layer ID list, and distributes the image scanning task to each Agent in units of image layers through a load balancing algorithm, specifically including:

[0039] Step S21: Server obtains metadata of the image from the image warehouse according to the image tag, including: image architecture, image system, image layer size, image layer ID list, and stores them in the database;

[0040] Step S12: According to the load of the image scanning task and the resource condition of the Agent, the image scanning task is distributed to different Agent ends according to the load balancing algorithm;

[0041] When the pull image mode is IfNotpresent, the Server end creates a Job end task, and the Job end task detects whether the image exists on the Kubernetes node. If it exists, it is directly scanned, and if it does not exist, the Server information is returned, and the Server end scans the remote warehouse according to the Always condition;

[0042] When the pull image mode is Never, the Server end creates a Job end service, and the Job end task detects whether the image exists on the Kubernetes node. If it exists, it is directly scanned, and if it does not exist, the Server information is returned, and the Server end directly allows the creation of a container group.

[0043] In one embodiment, the above step S3: Agent end acquires the specified image layer from the remote image warehouse according to the image layer ID distributed by the Server end, and performs vulnerability scanning, and finally returns the result to the Server end for summarization and real-time update of the scanning progress, which specifically includes:

[0044] Step S31: According to the image layer ID obtained from the Server end, the corresponding image layer content is pulled from the image warehouse;

[0045] Step S32: The image scanning program is used to perform security scanning on the image layer content, detect whether there is a vulnerability in the image, and generate a scanning result according to the vulnerability level and feed back to the Server end;

[0046] Step S33: Real-time monitoring of the resource usage of the Agent end itself, and reporting relevant indicators to the Server end.

[0047] In one embodiment, the above step S4: Job end according to the image name extracted by the Server end, and performs scanning tasks on the specified Kubernetes node, reports the scanning result to the Server end and whether the image exists on the Kubernetes node, and the Job task is automatically destroyed and recycled after the task execution is completed to save server resources, which specifically includes:

[0048] Step S41: According to the scheduling instruction of the Server end, create a scanning task on the specified container node; the Job end will determine the scanning path according to the pulling mode of the container group image, and the Server end will determine whether to distribute to the Agent end or create a Job end service to execute scanning on the Kubernetes node;

[0049] Step S42: The Job end checks whether the image exists on the Kubernetes node, if it exists, directly scans; if it does not exist, returns the information of the non-existent image to the Server end, and the Server end determines according to the corresponding image pulling mode and scanning strategy;

[0050] Step S43: Upload the scanning result to the Server end for summarization, and recycle the resources of the Job end after the task is completed, so as to save server resources.

[0051] In one embodiment, the above step S5: the Server end distributes image scanning tasks and performs elastic scaling according to the resource conditions reported by each Agent end, dynamically increases or reduces the number of Agents according to the load, which specifically includes:

[0052] Step S51: Real-time monitoring of the usage of resources of each Agent end, including: waiting scanning task queue length, scanning task size, CPU and memory usage, and distributing image scanning tasks to each Agent end according to the load balancing algorithm;

[0053] Among them, the load balancing algorithm includes: image layer ID hash algorithm, current CPU core number weighted average minimum algorithm, current memory occupation weighted average minimum algorithm, waiting task queue occupation memory percentage minimum algorithm and current waiting task queue length minimum algorithm, wherein the weight of CPU and memory of a certain Agent end is based on the percentage of the total CPU and memory of all Agent ends;

[0054] Step S52: When the load is too high, automatically expand the number of Agent ends; when the load is low, automatically shrink the number of Agent ends; the scaling operation is based on the predetermined maximum Agent number upper limit;

[0055] Among them, the elastic scaling algorithm is based on the configuration range of the maximum and minimum number of Agent ends to perform elastic scaling, and the triggering mechanism of shrinkage and expansion is to trigger the threshold value according to the weighted average of the CPU utilization and memory usage reported by each Agent end and the current task queue length, and when the weighted average is greater than the expansion threshold value, the number of Agents is expanded to improve scanning efficiency, and when the weighted average is less than the shrinkage threshold value, the Agent is destroyed to reduce resource waste.

[0056] In one embodiment, the step S6: Server checks the uniqueness of the image layer ID through the database to avoid repeated scanning, specifically comprising:

[0057] The database of the Server is mainly used for storing the metadata information of the image, the image layer ID and the scanning result thereof, and the functions thereof include:

[0058] 1. Image layer unique identifier management: store the unique identifier LayerID of each image layer and record the scanning result of the image layer.

[0059] 2. Duplicate image checking: when receiving a new scanning task, the Server will first query the database to check whether the image layer has been scanned, if it has been scanned and the result is the same, the task is skipped to avoid repeated work.

[0060] 3. Scanning result storage and management: store the result of each scanning to facilitate the judgment of whether to allow the container group to be created or scheduled according to the vulnerability level during the subsequent container group creation.

[0061] Figure 1 The flowchart of the container image scanning method based on the elastic scalable distributed load balancing is shown.

[0062] Figure 2 The data flow diagram of the container image scanning method based on the elastic scalable distributed load balancing is shown.

[0063] Embodiment two

[0064] As shown in Figure 3 , the embodiment of the application provides a container image scanning system based on elastic scalable distributed load balancing, comprising the following program endpoint modules:

[0065] Server module: used for monitoring the creation request of the container group in the Kubernetes, obtaining the container group template information, judging the scanning strategy, creating the Job end scanning service, summarizing the scanning result, scanning the image layer ID, and the elastic scaling and task load balancing of the Agent end service;

[0066] Among them, the Server module is the management and scheduling center of the whole image scanning system, including the following function modules:

[0067] Admission control module: used for monitoring the container group creation event in the Kubernetes, and responding to the container group creation event by passing or rejecting according to the scanning result;

[0068] Configuration module: used for the Server to obtain the number of containers contained in the container group from the container group template, as well as the image name of each container and the pulling image mode, and to configure the image scanning strategy, and responsible for the configuration of the balancing algorithm and the elastic scaling configuration;

[0069] Task load balancing module: used for counting the task load degree reported by the Agent end, and distributing and scheduling the scanning task to the suitable Agent end according to the load balancing algorithm;

[0070] Elastic scaling module: used for counting the load data reported by the Agent end, and dynamically reducing or increasing the number of Agents according to the expansion and contraction threshold of the configuration module;

[0071] Data management module: used for the verification, storage and display of the image scanning result, the management of the image scanning result and the maintenance of the CVE vulnerability library.

[0072] Agent end module: used for the image scanning task, the reporting of scanning information and the reporting of the load condition of the local end point;

[0073] Among them, the Agent end module is a node actually executing the image scanning task, responsible for obtaining the image content from the remote warehouse and executing scanning, including the following functional modules:

[0074] Image scanning module: used for downloading the image layer compression package, decompressing the image layer compression package, scanning the vulnerability information in the image layer and reporting the scanning result;

[0075] Load data collection and reporting module: used for periodically reporting the task queue length of the Agent end, the running state of the Agent end, the CPU usage and the memory usage in real time.

[0076] Job end module: used for the image server scanning task, the detection of whether the node image exists, the scanning of the image layer ID and the reporting of scanning information;

[0077] Among them, the Job end module executes and checks the Kubernetes node image scanning, including the following functional modules:

[0078] Image scanning module: used for downloading the image layer compression package, decompressing the image layer compression package, scanning the vulnerability information in the image layer and reporting the scanning result.

[0079] The application provides a container image scanning method based on an elastic and scalable distributed load balancing, which introduces an adaptive scanning strategy, repeated image verification, load balancing and elastic scaling mechanism, optimizes the performance and resource management of the container image scanning. The method is suitable for large-scale container cluster image security scanning, can efficiently detect and manage the vulnerabilities in the container image, and improves the security and scalability of the container environment.

Claims

1. A container image scanning method based on an elastically scalable distributed load balancing, characterized in that, Comprise: Step S1: Server end based on Kubernetes admission control mechanism from container group template get container group contains the number of containers and each container image name and pull image mode, and configure image scanning strategy; wherein, the image scanning strategy includes: strict scanning and tolerant scanning; the pull image mode includes: Always, IfNotPresent and Never; Step S2: when the pull image mode is Always, Server end according to image name from image warehouse gets image metadata, including: image architecture, image system, image layer size, image layer ID list, and image scanning task is distributed to each Agent end by load balancing algorithm in image layer unit; When the pull image mode is IfNotpresent, then Server end creates Job end task, Job end task in Kubernetes node detects whether the image exists, if exists then directly scans, if not exists then returns Server information, Server end carries out scanning according to Always condition to remote warehouse; When the pull image mode is Never, Server end creates Job end task, Job end task in Kubernetes node detects whether the image exists, if exists then directly scans, if not exists then returns Server information, Server end directly allows to create container group; Step S3: Agent end according to Server end distribution specified image layer from remote image warehouse gets, and carries out vulnerability scanning, finally puts the result back to Server end and carries out summary and real-time update scanning progress; Step S4: Job end according to Server end extraction image name, and carries out scanning task on specified Kubernetes node, reports scanning result to Server end and whether the image exists on Kubernetes node, after task execution, the Job end task is automatically destroyed and recycled; Step S5: Server end according to each Agent end reported resource condition carries out dynamic load balancing distribution image scanning task and elastic scaling, according to load dynamically increases or reduces the number of Agent; Step S6: Server end checks image layer ID uniqueness through database, avoids repeated scanning.

2. The container image scanning method based on the elastically scalable distributed load balancing according to claim 1, characterized in that, The step S1: Server end gets the number of containers contained in the container group and the image name and pull image mode of each container from the container group template, and configures the image scanning strategy, specifically comprising: Step S11: in the Kubernetes environment, Server end obtains container group template configuration through admission control mechanism, configures image scanning strategy in the form of annotation in the container group template, including: Strict scanning: the image is scanned before the Kubernetes container group is created, and the scanning process is divided into levels according to the severity of the vulnerability, including: high risk, medium risk, low risk, if a vulnerability is found, it is decided whether to allow the container group to be created according to the severity level set; Tolerant scanning: scanning the image after the container group is created, at this time the container group can be normally scheduled and run, and during the scanning process, the execution mode of the scanning task is determined according to the image pulling mode; Step S12: obtain the image pulling mode from the container group template, including: Always: always get the image from the remote image repository; IfNotPresent: prefer to use the image on the Kubernetes node, and get it from the remote image repository if it does not exist; Never: only find the image on the Kubernetes node; Step S13: the Server determines whether to immediately release according to the image scanning strategy, whether to create a container group by Kubernetes, or to decide to release to create a container group by Kubernetes after scanning the result, and pulls the image in different forms according to the image pulling mode.

3. The container image scanning method based on the elastically scalable distributed load balancing according to claim 2, characterized in that, In step S2, the Server obtains the image metadata from the image repository according to the image name, and distributes the image scanning task to each Agent in units of image layers through a load balancing algorithm, specifically including: Step S21: the Server obtains the metadata of the image from the image repository according to the image tag, including: image architecture, image system, image layer size, image layer ID list, and stores it in the database; Step S12: according to the load of the image scanning task and the resource situation of the Agent, the image scanning task is distributed to different Agent ends according to the load balancing algorithm.

4. The container image scanning method based on the elastically scalable distributed load balancing according to claim 3, characterized in that, In step S3, the Agent obtains the specified image layer from the remote image repository according to the image layer ID distributed by the Server, and performs vulnerability scanning, and finally returns the result to the Server for aggregation and real-time update of the scanning progress, specifically including: Step S31: according to the image layer ID obtained from the Server, pull the corresponding image layer content from the image repository; Step S32: the image scanning program is used to scan the image layer content, detect whether there is a vulnerability in the image, and generate a scanning result according to the level of the vulnerability and feed it back to the Server; Step S33: real-time monitoring of the resource usage of the Agent itself, and reporting relevant indicators to the Server.

5. The container image scanning method based on the elastically scalable distributed load balancing according to claim 4, characterized in that, In step S4, the Job extracts the image name according to the Server, and performs a scanning task on the specified Kubernetes node, reports the scanning result to the Server, and reports whether the image exists on the Kubernetes node, and the Job task is automatically destroyed and recycled to save server resources after the task is executed, specifically including: Step S41: According to the scheduling instruction of the Server end, create a scanning task on the specified container node; the Job end will determine the scanning path according to the pulling mode of the container group image, and the Server end will determine whether to distribute to the Agent end or create a Job end task to execute scanning on the Kubernetes node; Step S42: The Job end checks whether the image exists on the Kubernetes node, and if it exists, it directly scans; if it does not exist, it returns the information of the non-existent image to the Server end, which then determines according to the corresponding image pulling mode and scanning strategy; Step S43: Upload the scanning results to the Server end for aggregation, and recycle the resources of the Job end after the task is completed, in order to save server resources.

6. The container image scanning method based on the elastically scalable distributed load balancing according to claim 5, characterized in that, The step S5: The Server end distributes image scanning tasks and performs elastic scaling according to the dynamic load balancing of the resource conditions reported by each Agent end, dynamically increases or reduces the number of Agents according to the load, specifically including: Step S51: Real-time monitoring of the resource usage of each Agent end, including: waiting for the scanning task queue length, scanning task size, CPU and memory usage, and distributing image scanning tasks to each Agent end according to the load balancing algorithm; Step S52: When the load is too high, automatically expand the number of Agent ends; when the load is low, automatically shrink the number of Agent ends; the scaling operation is based on the predetermined maximum Agent number limit.

7. A container image scanning system based on elastically scalable distributed load balancing, configured to implement any of the methods of claims 1-6. The following program endpoint modules are included: Server end module: used for monitoring the creation request of container groups in Kubernetes, obtaining container group template information, determining scanning strategy, creating Job end scanning service, aggregating scanning results, scanning image layer ID deduplication, Agent end service elastic scaling and task load balancing; Agent end module: used for image scanning tasks, reporting scanning information, and reporting the load of the local endpoint; Job end module: used for image server scanning tasks, node image existence detection, scanning image layer ID deduplication, and reporting scanning information.

8. The container image scanning system based on the elastically scalable distributed load balancing according to claim 7, characterized in that, The Server end module includes the following modules: Admission control module: used for monitoring container group creation events in Kubernetes, and responding to the release or rejection of the container group creation event according to the scanning results; Configuration module: used for the Server end to obtain the number of containers contained in the container group and the image name and pulling image mode of each container from the container group template, and configure the image scanning strategy, as well as the load balancing algorithm configuration and elastic scaling configuration; Task load balancing module: used for statistics of the task load degree reported by the Agent end, and distribution of scanning tasks to suitable Agent ends according to the load balancing algorithm; Elastic scaling module: used for statistics of the load data reported by the Agent end, and dynamic reduction or increase of the number of Agents according to the scaling threshold of the configuration module; Data management module: used for image scanning result verification, storage and display, management of image scanning results and maintenance of CVE vulnerability library.

9. The container image scanning system based on the elastically scalable distributed load balancing according to claim 7, characterized in that, The Agent-side module comprises the following modules: The mirror image scanning module is used for downloading the mirror image layer compression package, decompressing the mirror image layer compression package, scanning the vulnerability information in the mirror image layer, and reporting the scanning result. The load data collection and reporting module is used for periodically reporting the Agent-side task queue length, the Agent-side running state, the CPU usage, and the memory usage in real time.

10. The container image scanning system based on the elastically scalable distributed load balancing according to claim 7, characterized in that, The Job-side module comprises the following modules: The mirror image scanning module is used for downloading the mirror image layer compression package, decompressing the mirror image layer compression package, scanning the vulnerability information in the mirror image layer, and reporting the scanning result.

Images