An operation and maintenance method and system

Abstract

The application discloses an operation and maintenance method and system, wherein the operation and maintenance system comprises a first platform, a first service and one or more second services; each of the one or more second services is arranged in a K8S cluster; the method comprises the following steps: the first platform parses a first instruction input by a user into a first request, and sends the first request to the first service; the first instruction is used for instructing to perform an operation and maintenance operation on a first K8S cluster selected by the user in the first platform; the first request is used for requesting the first service to perform the operation and maintenance operation on the first K8S cluster; the first service forwards the first request to a second service in the first K8S cluster; and the second service in the first K8S cluster communicates with an interface service component of the first K8S cluster based on the first request, so as to perform the operation and maintenance operation on the first K8S cluster.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to an operation and maintenance method and an operation and maintenance system. BACKGROUND

[0002] In the related art, a client in an operation and maintenance system directly connects a Kubernetes (K8S) cluster based on a WebSocket protocol, thereby realizing operation and maintenance management of the K8S cluster. However, the operation of the operation and maintenance system is relatively cumbersome, and the supported cluster resources are limited. In a large-scale cluster scenario, the operation and maintenance efficiency is relatively low. SUMMARY

[0003] To solve the problems in the related art, an operation and maintenance method and an operation and maintenance system are provided in the embodiments of the present application.

[0004] The technical scheme of the embodiments of the present application is implemented as follows:

[0005] An operation and maintenance method is provided in the embodiments of the present application, which is applied to an operation and maintenance system. The operation and maintenance system includes a first platform, a first service, and one or more second services. Each second service in the one or more second services is arranged in a K8S cluster. The method includes the following steps.

[0006] The first platform parses a first instruction input by a user into a first request, and sends the first request to the first service. The first instruction is used to instruct an operation and maintenance operation on a first K8S cluster selected by the user in the first platform. The first request is used to request the first service to perform the operation and maintenance operation on the first K8S cluster.

[0007] The first service forwards the first request to a second service in the first K8S cluster.

[0008] The second service in the first K8S cluster communicates with an interface service component of the first K8S cluster based on the first request, to perform the operation and maintenance operation on the first K8S cluster.

[0009] In the above scheme, the method further includes the following steps.

[0010] The second service sends a second request to the first service. The second request is used to request the first service to register a cluster where the second service is located.

[0011] In the above scheme, the operation and maintenance system further includes one or more proxy nodes. Each proxy node in the one or more proxy nodes corresponds to one network region.

[0012] Correspondingly, in a case where the first service and the first K8S cluster are deployed in different network regions, the first service forwards the first request to a second service in the first K8S cluster, comprising:

[0013] The first service forwards the first request to a proxy node corresponding to a network region where the first K8S cluster is located;

[0014] The proxy node corresponding to the network region where the first K8S cluster is located forwards the first request to a second service in the first K8S cluster.

[0015] In the above scheme, the first service forwards the first request to a second service in the first K8S cluster, comprising:

[0016] The first service determines whether the user has execution authority of the operation and maintenance operation corresponding to the first instruction based on a set service and the first request; the set service is used for authority verification of the user;

[0017] In a case where the user has execution authority of the operation and maintenance operation corresponding to the first instruction, the first service forwards the first request to a second service in the first K8S cluster.

[0018] In the above scheme, the first service determines whether the user has execution authority of the operation and maintenance operation corresponding to the first instruction based on a set service and the first request, comprising:

[0019] The first service parses a target object of the operation and maintenance operation corresponding to the first instruction based on the first request;

[0020] The first service sends a third request to the set service, and determines whether the user has execution authority of the operation and maintenance operation on the target object of the first instruction based on a response returned by the set service according to the third request.

[0021] In the above scheme, the category of the target object of the operation and maintenance operation comprises one of the following: project, cluster, business, and namespace.

[0022] In the above scheme, the visual interface of the first platform displays one or more K8S clusters, and the method further comprises:

[0023] The first platform determines the first K8S cluster from the one or more K8S clusters based on a selection operation of the user in the visual interface.

[0024] The embodiment of the application further provides an operation and maintenance system, comprising: a first platform, a first service and one or more second services; each of the one or more second services is arranged in a K8S cluster; wherein,

[0025] The first platform is configured to parse a first instruction input by a user into a first request, and send the first request to the first service; the first instruction is used to instruct an operation and maintenance operation on a first K8S cluster selected by the user in the first platform; the first request is used to request the first service to perform the operation and maintenance operation on the first K8S cluster.

[0026] The first service is configured to forward the first request to a second service in the first K8S cluster.

[0027] The second service in the first K8S cluster is configured to communicate with an interface service component of the first K8S cluster based on the first request, so as to perform the operation and maintenance operation on the first K8S cluster.

[0028] In the above scheme, the second service is further configured to:

[0029] The second service sends a second request to the first service; the second request is used to request the first service to register a cluster where the second service is located.

[0030] The operation and maintenance system further comprises one or more proxy nodes; each of the one or more proxy nodes corresponds to a network area.

[0031] Correspondingly, in the case that the first service and the first K8S cluster are deployed in different network areas, the first service forwards the first request to the second service in the first K8S cluster, comprising:

[0032] The first service forwards the first request to a proxy node corresponding to a network area where the first K8S cluster is located.

[0033] The proxy node corresponding to the network area where the first K8S cluster is located forwards the first request to the second service in the first K8S cluster.

[0034] In the above scheme, the first service forwards the first request to the second service in the first K8S cluster, comprising:

[0035] The first service determines whether the user has an execution authority of an operation and maintenance operation corresponding to the first instruction based on a set service and the first request; the set service is used to perform authority verification on the user.

[0036] In a case where the user has an execution right of the operation and maintenance operation corresponding to the first instruction, the first service forwards the first request to a second service in the first K8S cluster.

[0037] In the scheme, the first service determines whether the user has the execution right of the operation and maintenance operation corresponding to the first instruction based on the setting service and the first request, including:

[0038] The first service analyzes a target object of the operation and maintenance operation corresponding to the first instruction based on the first request.

[0039] The first service sends a third request to the setting service, and determines whether the user has the execution right of the operation and maintenance operation on the target object of the operation and maintenance operation corresponding to the first instruction based on a response returned by the setting service according to the third request.

[0040] In the scheme, the category of the target object of the operation and maintenance operation includes one of the following: a project, a cluster, a business, and a namespace.

[0041] In the scheme, the visual interface of the first platform displays one or more K8S clusters, and the first platform is further configured to:

[0042] The first K8S cluster is determined from the one or more K8S clusters based on a selection operation of the user in the visual interface.

[0043] In the embodiment of the present application, the operation and maintenance system includes a first platform, a first service, and one or more second services. Each of the one or more second services is arranged in a K8S cluster. The operation and maintenance method performed by the operation and maintenance system includes: a user inputs a first instruction to indicate an operation and maintenance operation on a first K8S cluster selected by the user in the first platform. The first platform parses the first instruction into a first request and sends the first request to the first service to request the first service to perform the operation and maintenance operation on the first K8S cluster. Then, the first service forwards the first request to the second service in the first K8S cluster. After that, the second service in the first K8S cluster communicates with an interface service component of the first K8S cluster based on the first request to perform the operation and maintenance operation on the first K8S cluster. In this way, the user can conveniently indicate the K8S cluster to be managed by the operation and maintenance system based on the selection operation. The operation and maintenance system can request the first service from the first platform based on the first instruction, and then request the second service arranged in the K8S cluster to perform the operation and maintenance operation from the first service, which is equivalent to realizing the transmission of the instruction. Therefore, the cluster resources can be diversifiedly managed. Compared with the related art, the user-side operation and maintenance system operation is simple, the operation and maintenance system supports a rich type of cluster resources, and the K8S cluster can still be efficiently managed in a large-scale cluster scenario, thereby improving the operation and maintenance efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1 An architecture schematic diagram of an operation and maintenance system provided by an embodiment of the present application;

[0045] Figure 2 An implementation flowchart of an operation and maintenance method provided by an embodiment of the present application;

[0046] Figure 3 An architecture schematic diagram of an operation and maintenance system provided by an embodiment of the present application;

[0047] Figure 4 An interaction flowchart of an operation and maintenance method provided by an embodiment of the present application. DETAILED DESCRIPTION

[0048] Based on the command line management tool kubectl provided by the K8S system, the user can perform operation and maintenance management on the K8S cluster. For example, the user can be an operation and maintenance personnel and a research and development personnel, and the operation and maintenance management can be deployment, deletion, scaling, and state checking of a conventional application, or interaction with a running container. However, these operation and maintenance management needs the user to manually log in to a bastion server and then perform operations in a command line interface, which is relatively cumbersome.

[0049] With the development of cloud native technology, an operation and maintenance system is designed. A client in the operation and maintenance system is directly connected to a K8S cluster based on a WebSocket protocol, so as to realize operation and maintenance management of the K8S cluster. Specifically, the operation and maintenance system includes multiple client pages, each of which is used to manage a cluster, and a kubectl command line tool is integrated in the page. Common query statements are provided in the form of fixed rules, so that a user can select a query statement, and then instruct the operation and maintenance system to perform operation and maintenance management on the K8S cluster. However, based on the operation and maintenance system in the related art, the user needs to open a client page for each K8S cluster to be managed, which is relatively cumbersome and slow to schedule. Moreover, the operation and maintenance system only provides a query function, and the supported cluster resources are limited. For an interactive session scenario, such as managing Pod-level container resources, the user still needs to manually log in to a bastion server. Therefore, in a large-scale cluster scenario, for example, in a cluster scenario with a cluster scale expanded to a number of nodes reaching thousands and across multiple network regions, the operation and maintenance efficiency is low.

[0050] Based on this, in the embodiments of the present application, the operation and maintenance system includes a first platform, a first service, and one or more second services. Each of the one or more second services is arranged in a K8S cluster. An operation and maintenance method performed by the operation and maintenance system includes: a user inputs a first instruction to instruct an operation and maintenance operation on a first K8S cluster selected by the user in the first platform. The first platform parses the first instruction into a first request and sends the first request to the first service to request the first service to perform the operation and maintenance operation on the first K8S cluster. Then, the first service forwards the first request to the second service in the first K8S cluster. After that, the second service in the first K8S cluster communicates with an interface service component of the first K8S cluster based on the first request to perform the operation and maintenance operation on the first K8S cluster. In this way, the user can conveniently instruct the operation and maintenance system to manage the K8S cluster based on a selection operation. The operation and maintenance system can request the first service from the first platform based on the first instruction, and then request the second service arranged in the K8S cluster from the first service to perform the operation and maintenance operation, which is equivalent to realizing the transmission of the instruction. Therefore, the cluster resources can be diversifiedly managed. Compared with the related art, the operation and maintenance system on the user side is convenient to operate, the types of the cluster resources to be managed are rich, and is not limited to the query function. In a large-scale cluster scenario, the K8S cluster can still be efficiently managed, thereby improving the operation and maintenance efficiency.

[0051] The present application will be further described in detail below with reference to the accompanying drawings and embodiments.

[0052] The embodiments of the present application provide an operation and maintenance method applied to an operation and maintenance system. Here, Figure 1 A system architecture diagram of the operation and maintenance system is shown, see Figure 1The operation and maintenance system includes a first platform, a first service, and one or more second services. Each of the one or more second services is arranged in a K8S cluster.

[0053] In actual application, the operation and maintenance system can be used for operation and maintenance management of the K8S cluster, and the K8S cluster can be understood as a cluster service.

[0054] Referring to Figure 2 The operation and maintenance method provided in the embodiments of the present application includes:

[0055] Step 201: The first platform parses a first instruction input by a user into a first request, and sends the first request to the first service.

[0056] The first instruction is used to instruct an operation and maintenance operation on a first K8S cluster selected by the user in the first platform, and the first request is used to request the first service to perform the operation and maintenance operation on the first K8S cluster.

[0057] In actual application, the user can be a person who needs to perform the operation and maintenance operation on the K8S cluster, for example, a research and development personnel, a test personnel, an operation and maintenance personnel, or the like. The user can perform the operation and maintenance operation on the K8S cluster through the operation and maintenance system.

[0058] In actual application, the first platform can provide an operation interface for the user, and the operation interface can also be referred to as a front-end window. One or more K8S clusters can be displayed in the operation interface of the first platform. The one or more K8S clusters can be one or more K8S clusters supported by the first platform for management, or one or more K8S clusters on which the user has a permission to perform the operation and maintenance operation.

[0059] The first platform can determine the K8S cluster selected by the user, that is, the first K8S cluster, based on a selection operation of the user in the operation interface. The first K8S cluster can be understood as the K8S cluster on which the user needs to perform the operation and maintenance operation.

[0060] In actual application, the first platform can be regarded as a client platform of the operation and maintenance system. The first platform can be constructed based on a set specification and a set style, so as to support concurrent operations of multiple users and have a relatively fast loading speed.

[0061] In an embodiment, the visual interface of the first platform displays one or more K8S clusters, and the operation and maintenance method provided in the embodiments of the present application further includes:

[0062] The first platform determines the first K8S cluster from the one or more K8S clusters based on a selection operation of the user in the visual interface.

[0063] In actual applications, the operation interface provided by the first platform for the user can be a visual interface. The visual interface can display content through visual elements such as graphics, and the user can operate the content displayed in the visual interface through various types of inputs such as a mouse or a keyboard.

[0064] In actual applications, after the visual interface of the first platform is opened, one or more K8S clusters can be displayed, for example, one or more K8S clusters can be represented by one or more icons for identifying K8S clusters in the visual interface, then the user can perform a selection operation in the visual interface, for example, by clicking the icon corresponding to a K8S cluster with a mouse to select the K8S cluster, and then the first platform can determine the K8S cluster selected by the user as the first K8S cluster based on the selection operation of the user.

[0065] It should be noted that the visual interface is different from the command line interface in the related art. The command line interface can only display characters and can only operate based on the input provided by the keyboard. In actual applications, the command line interface does not display information after being opened, so the user cannot directly select a K8S cluster through the command line interface. After the user manually inputs a command statement through the keyboard after the command line interface, the command line interface can list one or more K8S clusters in the form of characters, and the user also needs to input the corresponding command statement through the keyboard when indicating a K8S cluster. Obviously, compared with the command line interface, the visual interface simplifies the operation steps and improves the operation efficiency. In actual applications, the command line interface can be referred to as a black screen interface, and the visual interface can be referred to as a white screen interface.

[0066] In actual applications, the user can also input an operation instruction to the first platform, and the operation instruction is used to instruct the operation and maintenance system to perform an operation and maintenance operation on the K8S cluster. For example, the operation instruction can be a linux instruction.

[0067] Here, the first instruction can be understood as an operation instruction input by the user to the first platform for performing an operation and maintenance operation on the first K8S cluster.

[0068] In actual applications, after receiving the first instruction, the first platform can analyze the first instruction, thereby converting the first instruction into a first request, and sending the first request to the first service.

[0069] In actual application, the first service can expose one or more application programming interfaces (APIs) for operating the first K8S cluster. For example, the APIs can be encapsulated based on native APIs provided by the K8S system. The first request sent by the first platform can be an interface call request for calling the APIs provided by the first service.

[0070] Step 202: The first service forwards the first request to a second service in the first K8S cluster.

[0071] In actual application, the second service is arranged in the K8S cluster and can communicate with an interface service component of the K8S cluster to implement operation and maintenance of the K8S cluster.

[0072] In actual application, after receiving the first request, the first service can forward the first request to the second service to request the second service to perform operation and maintenance on the first K8S cluster.

[0073] The second service can expose one or more APIs for operating the first K8S cluster. Based on the received first request, the first service can send an interface call request to the second service, and the interface call request can be used to call the APIs provided by the second service.

[0074] In actual application, the interface call request sent by the first service to the second service based on the first request is used to request the same operation and maintenance on the same K8S cluster as the first request received by the first service. Therefore, the first service sending the interface call request to the second service based on the first request can also be understood as the first service forwarding the first request to the second service.

[0075] It should be noted that although the first service and the second service can expose one or more APIs for operating the first K8S cluster, the APIs exposed by the first service are different from the APIs exposed by the second service. After the APIs exposed by the first service are called, the first service can perform pre-processing, for example, the pre-processing can include permission verification of a user and the like. Then, the first service can call the corresponding APIs exposed by the second service based on the APIs called by the first service. After the APIs exposed by the second service are called, the second service can communicate with the interface service component of the cluster based on the APIs called by the second service.

[0076] Step 203: The second service in the first K8S cluster communicates with an interface service component of the first K8S cluster based on the first request to perform operation and maintenance on the first K8S cluster.

[0077] In actual application, the interface service component can be an API Server component of the K8S cluster.

[0078] In actual application, after receiving the first request forwarded by the first service, the second service can communicate with the interface service component of the K8S cluster where the second service is located based on the first request, so as to control the interface service component of the cluster to perform actual operation and maintenance operation, for example, querying resources in the cluster by the interface service component or performing interactive session in the Pod container.

[0079] It can be seen that in the embodiment of the present application, the operation and maintenance system can parse the first instruction input by the user into the first request, and control the interface service component of the first K8S cluster to perform the operation and maintenance operation corresponding to the first instruction based on the processing of the first request by the first service and the second service, which is equivalent to realizing that the first instruction is delivered to the K8S cluster and executed in the K8S cluster. It can be understood that the instruction can support multiple types of operation and maintenance operations, and the instruction can actually operate multiple types of resources in the K8S cluster after being delivered to the K8S cluster, for example, managing Pod-level container resources and performing interactive sessions, so as to diversify the management of rich cluster resources. In the embodiment of the present application, the user can conveniently instruct the operation and maintenance system to manage the K8S cluster based on the selection operation, which simplifies the operation of the operation and maintenance system. Compared with related art, the operation and maintenance method provided in the embodiment of the present application is relatively simple, and the type of cluster resource supported by the operation and maintenance method is rich, and the K8S cluster can still be efficiently managed in a large-scale cluster scenario, thereby improving the operation and maintenance efficiency.

[0080] In actual application, before the user selects the first K8S cluster on the first platform, the first platform needs to determine the K8S clusters available for the user to select. Based on this, the first service needs to pre-establish an association with the K8S cluster.

[0081] In an embodiment, the operation and maintenance method provided in the embodiment of the present application further includes: the second service sends a second request to the first service; the second request is used to request to register the cluster where the second service is located to the first service.

[0082] In actual application, the second service can be bound with a K8S service account and a cluster rule, and the cluster rule can enable the second service to have full permission to operate the K8S cluster where the second service is located. After being deployed in the cluster, the second service can log in to the K8S cluster based on the bound K8S service account and cluster rule, so that the second service supports communication with the interface service component of the K8S cluster, which is equivalent to establishing a continuous communication channel between the second service and the K8S cluster.

[0083] In actual application, the second service after login can be understood as a user with full permissions to operate the K8S cluster, and therefore, the second service can also be referred to as a cluster management client.

[0084] In actual application, the second service can be compatible with multiple versions of K8S clusters, for example, the second service can be compatible with K8S clusters of versions 1.14, 1.16, 1.18, 1.20, 1.22, and 1.24. In the case that the K8S cluster where the second service is located is a K8S cluster compatible with the second service, the second service can support logging into the K8S cluster and communicating with the interface service component in the K8S cluster.

[0085] In actual application, after logging into the K8S cluster, the second service can actively send a first request to the first service, and after receiving the first request, the first service can complete the registration of the K8S cluster based on the first request. The first request can be regarded as a registration request. The first request can carry registration information of the corresponding K8S cluster, for example, the registration information can include one or more of the following: identification, access credentials, and deployed network area of the corresponding K8S cluster. The first service can obtain the registration information based on the first request and store the registration information locally to complete the registration of the K8S cluster.

[0086] In actual application, after registering the K8S cluster, the first service can actively initiate a request to the second service set in the K8S cluster, which is equivalent to establishing a long connection channel between the first service and the second service corresponding to the K8S cluster, or can be regarded as establishing an association between the first service and the K8S cluster. In this way, the first service can perform maintenance operations on the K8S cluster where the second service is located by actively sending a request to the second service.

[0087] In actual application, the first platform can determine the registered K8S cluster as a K8S cluster available for user selection. For example, the first platform can actively call the relevant interface of the first service to obtain the registered K8S cluster, and then display the obtained K8S cluster in the interface.

[0088] In related technologies, the K8S service account and the K8S cluster are stored separately, for example, in a service end deployed in a different network area from the K8S cluster. In this way, the configuration information corresponding to the K8S service account, such as the kube-config file, needs to be stored in the service end in plaintext, which reduces the security of maintenance. Moreover, the user needs to actively execute instructions related to logging into the K8S cluster to control the service end to send a login request to the K8S cluster to establish an association between the service end and the K8S cluster, which is relatively cumbersome and reduces the efficiency of maintenance.

[0089] In the embodiment, the second service is arranged in the K8S cluster, so that the K8S service account can be stored in the K8S cluster and is not easy to be stolen, thereby improving the security of operation and maintenance. In addition, the second service actively logs in the K8S cluster after being arranged in the K8S cluster, and then actively sends a registration request to the first service, without the need of a user to control the second service to send a login request to the K8S cluster, thereby simplifying the operation and improving the operation and maintenance efficiency.

[0090] In actual application, the first service and the K8S cluster can be deployed in different network regions, and there is network isolation between services deployed in different network regions for security consideration, that is, direct communication is not allowed. Based on this,

[0091] In an embodiment, the operation and maintenance system further includes one or more proxy nodes, and each proxy node in the one or more proxy nodes corresponds to a network region.

[0092] Correspondingly, in the case that the first service and the first K8S cluster are deployed in different network regions, the first service forwards the first request to the second service in the first K8S cluster, including:

[0093] The first service forwards the first request to the proxy node corresponding to the network region where the first K8S cluster is located.

[0094] The proxy node corresponding to the network region where the first K8S cluster is located forwards the first request to the second service in the first K8S cluster.

[0095] In actual application, after receiving the first request sent by the first platform, the first service can determine the network region where the first K8S cluster is located based on the registration information of the first K8S cluster stored locally, and then determine whether the first service and the first K8S cluster are deployed in different network regions.

[0096] In actual application, each K8S cluster deployed in a different network region from the first service can have a proxy node, which can be used to forward a request from an external network region to the corresponding K8S cluster, and forward a request of the corresponding K8S cluster to a service deployed in the external network region, thereby realizing communication between services across network regions. Here, the external network region can be understood as a network region different from the network region where the corresponding K8S cluster is located. In this way, based on the forwarding of the proxy node, the first service can uniformly manage multiple K8S clusters.

[0097] In actual application, in the forwarding process of the proxy node, the proxy node can perform encrypted forwarding based on a secure sockets layer (SSL) protocol or a transport layer security (TLS) protocol, so as to protect data transmission and further improve the security of operation and maintenance.

[0098] In actual application, in the case that the first service and the first K8S cluster are deployed in different network regions, the first service and the first K8S cluster have a cross-network relationship, that is, there is network isolation. Based on the forwarding of the proxy node corresponding to the first K8S cluster, communication between the first service and the first K8S cluster can be realized, so that the second service in the first K8S cluster can receive the first request forwarded by the first service.

[0099] In actual application, in the case that the first service and the first K8S cluster are deployed in the same network region, the first service and the first K8S cluster have a direct connection relationship, that is, there is no network isolation, and the second service in the first K8S cluster can directly receive the first request forwarded by the first service, and does not need to be forwarded based on the proxy node.

[0100] In actual application, in order to further improve the security of operation and maintenance, the first service can perform permission verification, that is, authentication, when forwarding the first request to the second service. Specifically,

[0101] In an embodiment, the first service forwards the first request to the second service in the first K8S cluster, comprising:

[0102] The first service determines whether the user has the execution permission of the operation and maintenance operation corresponding to the first instruction based on the set service and the first request; the set service is used for permission verification of the user;

[0103] In the case that the user has the execution permission of the operation and maintenance operation corresponding to the first instruction, the first service forwards the first request to the second service in the first K8S cluster.

[0104] In actual application, the set service can also be called a permission center, which can be used for permission verification of the user.

[0105] In actual application, after receiving the first request sent by the first platform, the first service can parse the target verification information based on the first request. For example, the target verification information can include one or more of the following: the operation and maintenance operation corresponding to the first instruction, the user identifier, and the cluster information of the first K8S cluster. Then, the first service can send an authentication request to the setting service, that is, call the setting service, and determine whether the user has the execution authority of the operation and maintenance operation corresponding to the first instruction based on the response returned by the setting service based on the authentication request. The target verification information can be carried in the authentication request. In the case where the user has the execution authority of the operation and maintenance operation corresponding to the first instruction, it can be considered that the authentication of the user is passed, and the first service is allowed to forward the first request to the second service in the first K8S cluster. In the case where the user does not have the execution authority of the operation and maintenance operation corresponding to the first instruction, it can be considered that the authentication of the user is not passed, and the first service is not allowed to forward the first request to the second service in the first K8S cluster.

[0106] In actual application, the first request forwarded by the first service to the second service in the first K8S cluster can carry the access credential of the first K8S cluster.

[0107] In an embodiment, the first service determines whether the user has the execution authority of the operation and maintenance operation corresponding to the first instruction based on the setting service and the first request, including:

[0108] The first service parses the target object of the operation and maintenance operation corresponding to the first instruction based on the first request.

[0109] The first service sends a third request to the setting service, and determines whether the user has the execution authority of the operation and maintenance operation corresponding to the first instruction based on the response returned by the setting service according to the third request.

[0110] In actual application, the third request can be understood as an authentication request, and the target object of the operation and maintenance operation corresponding to the first instruction can be carried in the third request.

[0111] In actual application, after receiving the third request, the setting service can determine the execution authority required by the user for the operation and maintenance operation on the target object of the operation and maintenance operation corresponding to the first instruction based on the third request, compare the authority already possessed by the user with the determined required execution authority, determine whether the user has the execution authority of the operation and maintenance operation on the target object of the operation and maintenance operation corresponding to the first instruction, and obtain a judgment result. Then, the setting server carries the judgment result in the returned response.

[0112] In actual application, the first service can first determine, based on the target object of the operation and maintenance operation corresponding to the first instruction, that the user needs to have an execution permission for performing the operation and maintenance operation on the target object. Then, it is set that the service can determine whether the user has the determined execution permission for performing the operation and maintenance operation on the target object after receiving the third request, obtain a determination result, and carry the determination result in the returned response.

[0113] In actual application, the first service can forward the first request to the second service in the first K8S cluster in a case where the user has an execution permission for performing the operation and maintenance operation on the target object of the operation and maintenance operation corresponding to the first instruction.

[0114] In an embodiment, the category of the target object of the operation and maintenance operation includes one of the following: a project, a cluster, a business, and a namespace.

[0115] In actual application, the type of the target object of the operation and maintenance operation can also be expressed as a dimension of the operation and maintenance operation.

[0116] In actual application, one project can correspond to one or more clusters. For example, project 1 can correspond to two clusters, i.e., cluster 1 and cluster 2. In a case where the category of the target object of the operation and maintenance operation is a project, a single operation and maintenance operation can perform batch processing on all clusters corresponding to the project, i.e., perform batch processing on cluster resources in all clusters corresponding to the project. For example, in a case where the target object of the operation and maintenance operation is project 1 in the above example, a single operation and maintenance operation can perform batch processing on cluster 1 and cluster 2.

[0117] One cluster can correspond to one or more businesses, and each business corresponds to corresponding cluster resources. For example, cluster 1 can correspond to two businesses, i.e., business 1 and business 2, where business 1 can correspond to containers 1 to 5 in cluster 1, and business 2 can correspond to containers 6 to 9 in cluster 1. In a case where the category of the target object of the operation and maintenance operation is a cluster, a single operation and maintenance operation can perform batch processing on cluster resources corresponding to all businesses corresponding to the cluster. For example, in a case where the target object of the operation and maintenance operation is cluster 1 in the above example, a single operation and maintenance operation can perform batch processing on cluster resources corresponding to business 1 and business 2, i.e., containers 1 to 9.

[0118] One service can correspond to one or more namespaces, and each namespace corresponds to corresponding cluster resources. For example, service 1 in cluster 1 can correspond to two namespaces, namely namespace 1 and namespace 2, where namespace 1 can correspond to container 1 in cluster 1, and namespace 2 can correspond to containers 2-5 in cluster 1. In the case where the category of the target object of the operation and maintenance operation is a service, a single operation and maintenance operation can perform batch processing on the cluster resources corresponding to all namespaces corresponding to the service. For example, in the case where the target object of the operation and maintenance operation is service 1 in the above example, a single operation and maintenance operation can perform batch processing on all cluster resources corresponding to service 1, i.e., containers 1-5.

[0119] In the case where the category of the target object of the operation and maintenance operation is a namespace, a single operation and maintenance operation can perform batch processing on all cluster resources corresponding to the namespace. For example, namespace 2 can correspond to containers 2-5 in cluster 1. In the case where the target object of the operation and maintenance operation is namespace 2, a single operation and maintenance operation can perform batch processing on all cluster resources corresponding to namespace 2, i.e., containers 2-5.

[0120] In actual applications, the type of the target object of the operation and maintenance operation can also be expressed as the dimension of the operation and maintenance operation.

[0121] In related technologies, only a single cluster can be subjected to operation and maintenance operations, i.e., only operation and maintenance operations can be performed in the cluster dimension, and complex permission control scenarios cannot be implemented. For example, one permission control scenario that related technologies cannot implement can be that the operation object of a single operation and maintenance operation of a development personnel can only be a single cluster, and the operation object of a single operation and maintenance operation of an operation and maintenance personnel can include multiple clusters corresponding to the same project.

[0122] In the embodiments of the present application, the first service forwards or does not forward the first request to the second service based on the authentication result of the execution permission of the user on the target object of the operation and maintenance operation corresponding to the first instruction, i.e., the user is authenticated based on the dimension of the operation and maintenance operation corresponding to the first instruction, so that complex permission control scenarios can be implemented, the security of operation and maintenance is increased, and the efficiency of operation and maintenance is also improved.

[0123] Based on the operation and maintenance method in the above embodiments, the embodiments of the present application also provide an operation and maintenance system. In combination with Figure 1 The system architecture schematic diagram of the operation and maintenance system shown in the figure is as follows:

[0124] The first platform is configured to parse a first instruction input by a user into a first request and send the first request to a first service; the first instruction is used to instruct to perform an operation and maintenance operation on a first K8S cluster selected by the user in the first platform; and the first request is used to request the first service to perform the operation and maintenance operation on the first K8S cluster.

[0125] The first service is configured to forward the first request to a second service in the first K8S cluster.

[0126] The second service in the first K8S cluster is configured to communicate with an interface service component of the first K8S cluster based on the first request to perform an operation on the first K8S cluster.

[0127] In practice, the user can be a person who needs to perform an operation on the K8S cluster, for example, a developer, a tester, and an operator, etc. The user can perform an operation on the K8S cluster through the operation system.

[0128] In practice, the first platform can provide an operation interface for the user, which can also be referred to as a front-end window. The operation interface of the first platform can display one or more K8S clusters, which can be one or more K8S clusters supported by the first platform for management, or one or more K8S clusters on which the user has the right to perform an operation.

[0129] The first platform can determine the K8S cluster selected by the user, i.e., the first K8S cluster, based on the selection operation of the user in the operation interface. The first K8S cluster can be understood as the K8S cluster on which the user needs to perform an operation.

[0130] In practice, the first platform can be regarded as a client platform of the operation system. The first platform can be constructed based on a set specification and a set style, so as to support concurrent operations of multiple users and have a fast loading speed.

[0131] In an embodiment, the operation interface provided by the first platform for the user can be a visual interface. The visual interface can display content through visual elements such as graphics, and the user can operate the content displayed in the visual interface through various types of inputs such as a mouse or a keyboard.

[0132] The first platform is further configured to determine the first K8S cluster from the one or more K8S clusters based on the selection operation of the user in the visual interface.

[0133] In practice, the operation interface provided by the first platform for the user can be a visual interface. The visual interface can display content through visual elements such as graphics, and the user can operate the content displayed in the visual interface through various types of inputs such as a mouse or a keyboard.

[0134] In actual applications, after the visual interface of the first platform is opened, one or more K8S clusters can be displayed, for example, one or more K8S clusters can be represented by one or more icons for identifying K8S clusters in the visual interface, then a user can perform a selection operation in the visual interface, for example, by clicking the icon corresponding to a K8S cluster by using a mouse to select the K8S cluster, and then the first platform can determine the K8S cluster selected by the user as the first K8S cluster based on the selection operation of the user.

[0135] It should be noted that the visual interface is different from the command line interface in the related art. The command line interface can only display characters and can only operate based on the input provided by a keyboard. In actual applications, the command line interface does not display information after being opened, and therefore, a user cannot directly select a K8S cluster through the command line interface. After the user manually inputs a command statement through a keyboard after the command line interface, the command line interface can list one or more K8S clusters in the form of characters, and the user also needs to input a corresponding command statement through the keyboard when indicating a K8S cluster. Obviously, compared with the command line interface, the visual interface simplifies the operation steps and improves the operation efficiency. In actual applications, the command line interface can be referred to as a black screen interface, and the visual interface can be referred to as a white screen interface.

[0136] In actual applications, the user can also input an operation instruction to the first platform, and the operation instruction is used to instruct the operation and maintenance system to perform an operation and maintenance operation on the K8S cluster. For example, the operation instruction can be a linux instruction.

[0137] Here, the first instruction can be understood as an operation instruction input by the user to the first platform and used to perform an operation and maintenance operation on the first K8S cluster.

[0138] In actual applications, after receiving the first instruction, the first platform can analyze the first instruction, thereby converting the first instruction into a first request, and sending the first request to the first service.

[0139] In actual applications, the first service can expose one or more APIs for performing operations on the first K8S cluster, for example, the APIs can be obtained by encapsulating the native APIs provided by the K8S system. The first request sent by the first platform can be an interface calling request, which is used to call the API provided by the first service.

[0140] In actual applications, the second service is arranged in the K8S cluster and can communicate with the interface service component of the K8S cluster, thereby implementing the operation and maintenance operation on the K8S cluster.

[0141] In actual application, after receiving the first request, the first service can forward the first request to the second service to request the second service to perform the operation and maintenance on the first K8S cluster.

[0142] The second service can expose one or more APIs for performing operations on the first K8S cluster. The first service can send an interface call request to the second service based on the received first request, and the interface call request can be used to call the API provided by the second service.

[0143] In actual application, the interface call request sent by the first service to the second service based on the first request is used to request the same operation and maintenance on the same K8S cluster as the first request received by the first service, so that the first service sending the interface call request to the second service based on the first request can also be understood as the first service forwarding the first request to the second service.

[0144] It should be noted that although the first service and the second service can expose one or more APIs for performing operations on the first K8S cluster, the APIs exposed by the first service are different from the APIs exposed by the second service. After the API exposed by the first service is called, the first service can perform pre-processing, for example, the pre-processing can include permission verification of the user and the like, and then the first service can call the corresponding API exposed by the second service based on the API called by itself. After the API exposed by the second service is called, the second service can communicate with the interface service component of the cluster based on the API called by itself.

[0145] In actual application, the interface service component can be an API Server component of the K8S cluster.

[0146] In actual application, after receiving the first request forwarded by the first service, the second service can communicate with the interface service component of the K8S cluster based on the first request, so as to control the interface service component of the cluster to perform actual operation and maintenance, for example, querying resources in the cluster by the interface service component or interactive session in the Pod container.

[0147] It can be seen that in the embodiment scheme of the application, the operation and maintenance system can parse the first instruction input by the user into a first request, and control the interface service component of the first K8S cluster to perform the operation and maintenance operation corresponding to the first instruction based on the processing of the first request by the first service and the second service, which is equivalent to realizing that the first instruction is delivered to the K8S cluster and executed in the K8S cluster. It can be understood that the instruction can support multiple types of operation and maintenance operations, and the instruction can actually operate multiple types of resources in the K8S cluster after being delivered to the K8S cluster, for example, managing Pod-level container resources and interactive sessions, etc., so as to diversify the management of rich cluster resources. In the embodiment of the application, the user can conveniently instruct the operation and maintenance system to manage the K8S cluster based on the selection operation, which simplifies the operation of the operation and maintenance system. Compared with the related art, the operation of the operation and maintenance system provided in the embodiment of the application is relatively simple, and the type of cluster resource supported by the operation and maintenance system is rich, and the operation and maintenance system can still efficiently manage the K8S cluster in a large-scale cluster scenario, thereby improving the operation and maintenance efficiency.

[0148] In actual application, before the user selects the first K8S cluster on the first platform, the first platform needs to determine the K8S cluster available for the user to select. Based on this, the first service needs to pre-establish an association with the K8S cluster.

[0149] In an embodiment, the second service is further configured to:

[0150] The second service sends a second request to the first service; the second request is used to request to register the cluster where the second service is located to the first service.

[0151] In actual application, the second service can be bound with a K8S service account and a cluster rule, and the cluster rule can enable the second service to have full permissions to operate the K8S cluster where the second service is located. After the second service is set in the cluster, the second service can log in to the K8S cluster based on the bound K8S service account and cluster rule, so that the second service supports communication with the interface service component of the K8S cluster, which is equivalent to establishing a persistent communication channel between the second service and the K8S cluster.

[0152] In actual application, the logged-in second service can be understood as a user who has full permissions to operate the K8S cluster where the second service is located, and therefore, the second service can also be described as a cluster management client.

[0153] In actual applications, the second service can be compatible with multiple different versions of K8S clusters. For example, the second service can be compatible with K8S clusters of versions 1.14, 1.16, 1.18, 1.20, 1.22, and 1.24. When the K8S cluster where the second service is located is a K8S cluster compatible with the second service, the second service can support logging into the K8S cluster and communicating with the interface service component in the K8S cluster.

[0154] In actual applications, after logging into the K8S cluster, the second service can actively send a first request to the first service. After receiving the first request, the first service can complete the registration of the K8S cluster based on the first request. The first request can be regarded as a registration request. The first request can carry registration information of the corresponding K8S cluster. For example, the registration information can include one or more of the following: identification, access credentials, and deployed network area of the corresponding K8S cluster. The first service can obtain the registration information based on the first request and store the registration information locally to complete the registration of the K8S cluster.

[0155] In actual applications, after registering the K8S cluster, the first service can actively initiate a request to the second service deployed in the K8S cluster, which is equivalent to establishing a long connection channel between the first service and the second service corresponding to the K8S cluster, or can be regarded as establishing an association between the first service and the K8S cluster. In this way, the first service can perform maintenance operations on the K8S cluster where the second service is located by actively sending a request to the second service.

[0156] In actual applications, the first platform can determine the registered K8S cluster as a K8S cluster available for user selection. For example, the first platform can actively call the related interface of the first service to obtain the registered K8S cluster, and then display the obtained K8S cluster in the interface.

[0157] In related technologies, the K8S service account and the K8S cluster are stored separately, for example, in a service end deployed in a different network area from the K8S cluster. In this way, the configuration information corresponding to the K8S service account, such as the kube-config file, needs to be stored in the service end in plaintext, which reduces the security of maintenance. Moreover, the user needs to actively execute instructions related to logging into the K8S cluster to control the service end to send a login request to the K8S cluster to establish an association between the service end and the K8S cluster, which is relatively cumbersome and reduces the efficiency of maintenance.

[0158] In the embodiment, the second service is arranged in the K8S cluster, so that the K8S service account can be stored in the K8S cluster and is not easy to be stolen, thereby improving the security of operation and maintenance. In addition, the second service actively logs in the K8S cluster after being arranged in the K8S cluster, and then actively sends a registration request to the first service, without the need of a user to control the second service to send a login request to the K8S cluster, thereby simplifying the operation and improving the operation and maintenance efficiency.

[0159] In actual application, the first service and the K8S cluster can be deployed in different network regions, and there is network isolation between services deployed in different network regions for security consideration, that is, direct communication is not allowed. Based on this,

[0160] In an embodiment, the operation and maintenance system further includes one or more proxy nodes, and each of the one or more proxy nodes corresponds to a network region;

[0161] Correspondingly, in the case that the first service and the first K8S cluster are deployed in different network regions, the first service forwards the first request to the second service in the first K8S cluster, including:

[0162] The first service forwards the first request to the proxy node corresponding to the network region where the first K8S cluster is located;

[0163] The proxy node corresponding to the network region where the first K8S cluster is located forwards the first request to the second service in the first K8S cluster.

[0164] In actual application, after receiving the first request sent by the first platform, the first service can determine the network region where the first K8S cluster is located based on the registration information of the first K8S cluster stored locally, and then determine whether the first service and the first K8S cluster are deployed in different network regions.

[0165] In actual application, each K8S cluster deployed in a different network region from the first service can have a proxy node, which can be used to forward a request from an external network region to the corresponding K8S cluster, and forward a request of the corresponding K8S cluster to a service deployed in the external network region, thereby realizing communication between services across network regions. Here, the external network region can be understood as a network region different from the network region where the corresponding K8S cluster is located. In this way, based on the forwarding of the proxy node, the first service can uniformly manage multiple K8S clusters.

[0166] In actual application, the proxy node can perform encrypted forwarding based on the SSL protocol or the TLS protocol in the process of forwarding, thereby protecting data transmission and further improving the security of operation and maintenance.

[0167] In actual application, in the case that the first service and the first K8S cluster are deployed in different network areas, the first service and the first K8S cluster are in cross-network relationship, that is, there is network isolation. Based on the forwarding of the proxy node corresponding to the first K8S cluster, communication between the first service and the first K8S cluster can be realized, so that the second service in the first K8S cluster can receive the first request forwarded by the first service.

[0168] In actual application, in the case that the first service and the first K8S cluster are deployed in the same network area, the first service and the first K8S cluster are in direct connection relationship, that is, there is no network isolation, and the second service in the first K8S cluster can directly receive the first request forwarded by the first service, and does not need to be forwarded based on the proxy node.

[0169] In actual application, in order to further improve the security of operation and maintenance, the first service can perform permission verification, that is, authentication, when forwarding the first request to the second service. Specifically,

[0170] In an embodiment, the first service forwards the first request to the second service in the first K8S cluster, comprising:

[0171] The first service determines whether the user has the execution permission of the operation and maintenance operation corresponding to the first instruction based on the set service and the first request; the set service is used for permission verification of the user;

[0172] In the case that the user has the execution permission of the operation and maintenance operation corresponding to the first instruction, the first service forwards the first request to the second service in the first K8S cluster.

[0173] In actual application, the set service can also be called a permission center, which can be used for permission verification of the user.

[0174] In actual application, after receiving the first request sent by the first platform, the first service can parse the target verification information based on the first request. Exemplarily, the target verification information can include one or more of the following: the operation and maintenance operation corresponding to the first instruction, the user identifier, and the cluster information of the first K8S cluster. Then the first service can send an authentication request to the set service, that is, call the set service, and determine whether the user has the execution permission of the operation and maintenance operation corresponding to the first instruction based on the response returned by the set service based on the authentication request. The target verification information can be carried in the authentication request. In the case that the user has the execution permission of the operation and maintenance operation corresponding to the first instruction, it can be considered that the authentication of the user is passed, and the first service is allowed to forward the first request to the second service in the first K8S cluster. In the case that the user does not have the execution permission of the operation and maintenance operation corresponding to the first instruction, it can be considered that the authentication of the user is not passed, and the first service is not allowed to forward the first request to the second service in the first K8S cluster.

[0175] In actual application, the first request forwarded by the first service to the second service in the first K8S cluster can carry the access credential of the first K8S cluster.

[0176] In an embodiment, the first service determines whether the user has the execution authority of the operation and maintenance operation corresponding to the first instruction based on the set service and the first request, including:

[0177] The first service analyzes the target object of the operation and maintenance operation corresponding to the first instruction based on the first request.

[0178] The first service sends a third request to the set service, and determines whether the user has the execution authority of the operation and maintenance operation on the target object of the operation and maintenance operation corresponding to the first instruction based on the response returned by the set service according to the third request.

[0179] In actual application, the third request can be understood as an authentication request, and the target object of the operation and maintenance operation corresponding to the first instruction can be carried in the third request.

[0180] In actual application, after receiving the third request, the set service can determine the execution authority required by the user for the operation and maintenance operation on the target object of the operation and maintenance operation corresponding to the first instruction based on the third request, and then compare the authority already possessed by the user with the determined execution authority required to be possessed to determine whether the user has the execution authority of the operation and maintenance operation on the target object of the operation and maintenance operation corresponding to the first instruction, and obtain a judgment result. Then, the set server carries the judgment result in the returned response.

[0181] In actual application, the first service can first determine the execution authority required by the user for the operation and maintenance operation on the target object based on the target object of the operation and maintenance operation corresponding to the first instruction. Then, after receiving the third request, the set service can determine whether the user has the determined execution authority required to be possessed, obtain a judgment result, and carry the judgment result in the returned response.

[0182] In actual application, the first service can forward the first request to the second service in the first K8S cluster in the case that the user has the execution authority of the operation and maintenance operation on the target object corresponding to the first instruction.

[0183] In an embodiment, the category of the target object of the operation and maintenance operation includes one of the following: project, cluster, business, and namespace.

[0184] In actual application, the type of the target object of the operation and maintenance operation can also be expressed as the dimension of the operation and maintenance operation.

[0185] In actual application, one project can correspond to one or more clusters. Exemplarily, project 1 can correspond to two clusters, i.e., cluster 1 and cluster 2. In the case where the category of the target object of the operation and maintenance operation is a project, a single operation and maintenance operation can perform batch processing on all the clusters corresponding to the project, i.e., perform batch processing on the cluster resources in all the clusters corresponding to the project. Exemplarily, in the case where the target object of the operation and maintenance operation is project 1 in the above example, a single operation and maintenance operation can perform batch processing on cluster 1 and cluster 2.

[0186] One cluster can correspond to one or more businesses, and each business corresponds to corresponding cluster resources. Exemplarily, cluster 1 can correspond to two businesses, i.e., business 1 and business 2, where business 1 can correspond to containers 1 to 5 in cluster 1, and business 2 can correspond to containers 6 to 9 in cluster 1. In the case where the category of the target object of the operation and maintenance operation is a cluster, a single operation and maintenance operation can perform batch processing on the cluster resources corresponding to all the businesses of the cluster. Exemplarily, in the case where the target object of the operation and maintenance operation is cluster 1 in the above example, a single operation and maintenance operation can perform batch processing on the cluster resources corresponding to business 1 and business 2, i.e., containers 1 to 9.

[0187] One business can correspond to one or more namespaces, and each namespace corresponds to corresponding cluster resources. Exemplarily, business 1 in cluster 1 can correspond to two namespaces, i.e., namespace 1 and namespace 2, where namespace 1 can correspond to container 1 in cluster 1, and namespace 2 can correspond to containers 2 to 5 in cluster 1. In the case where the category of the target object of the operation and maintenance operation is a business, a single operation and maintenance operation can perform batch processing on the cluster resources corresponding to all the namespaces of the business. Exemplarily, in the case where the target object of the operation and maintenance operation is business 1 in the above example, a single operation and maintenance operation can perform batch processing on the cluster resources corresponding to all the namespaces of business 1, i.e., containers 1 to 5.

[0188] In the case where the category of the target object of the operation and maintenance operation is a namespace, a single operation and maintenance operation can perform batch processing on all the cluster resources corresponding to the namespace. Exemplarily, namespace 2 can correspond to containers 2 to 5 in cluster 1. In the case where the target object of the operation and maintenance operation is namespace 2, a single operation and maintenance operation can perform batch processing on all the cluster resources corresponding to namespace 2, i.e., containers 2 to 5.

[0189] In actual application, the type of the target object of the operation and maintenance operation can also be expressed as the dimension of the operation and maintenance operation.

[0190] In the related art, only a single cluster can be operated and maintained, that is, only operation and maintenance can be performed in the cluster dimension, and complex permission control scenarios cannot be implemented. For example, a permission control scenario that cannot be implemented in the related art can be that the operation object of a single operation and maintenance operation of a research and development personnel can only be a single cluster, and the operation object of a single operation and maintenance operation of an operation and maintenance personnel can include multiple clusters corresponding to the same project.

[0191] In the embodiments of the present application, the first service forwards or does not forward the first request to the second service based on the authentication result of the execution permission of the user on the target object of the operation and maintenance operation corresponding to the first instruction, that is, the user is authenticated based on the dimension of the operation and maintenance operation corresponding to the first instruction, so that complex permission control scenarios can be implemented, the security of operation and maintenance is increased, and the operation and maintenance efficiency is also improved.

[0192] The present application will be further described in detail below in combination with application embodiments.

[0193] The application embodiments of the present application provide an operation and maintenance system, which is shown in Figure 3 The operation and maintenance system includes a BCS-SaaS, a BCS-Service, a BCS-Proxy, and a BCS-Agent. The BCS-SaaS corresponds to the first platform in the embodiments of the present application, and the webconsole corresponds to the operation interface of the first platform. The BCS-Service corresponds to the first service in the embodiments of the present application, and the bcs-api corresponds to the module for receiving and sending requests in the first service. The BCS-Proxy corresponds to the proxy node in the embodiments of the present application. The BCS-Agent corresponds to the second service in the embodiments of the present application. The API Server corresponds to the interface service component in the embodiments of the present application.

[0194] The operation and maintenance system based on the operation and maintenance method provided by the embodiments of the present application is shown in Figure 4 The interaction process when the operation and maintenance system is operated and maintained based on the operation and maintenance method provided by the embodiments of the present application mainly includes the following steps:

[0195] Step 1: The BCS-SaaS parses the first instruction input by the user into a first request and sends the first request to the BCS-Service.

[0196] The first instruction is used to indicate that the operation and maintenance operation is performed on the first K8S cluster selected by the user in the BCS-SaaS.

[0197] Step 2: The BCS-Service sends a third request to the platform permission center based on the received first request to authenticate the user.

[0198] In actual application, the platform permission center corresponds to the setting service in the embodiments of the present application.

[0199] In the case that the authentication of the user is passed, step 3 is performed;

[0200] In the case that the authentication of the user is not passed, an error indication can be returned to the BCS-SaaS.

[0201] Step 3: The BCS-Service forwards the first request to the BCS-Agent.

[0202] In actual application, in the case that the BCS-Service and the first K8S cluster are deployed in different network regions, the BCS-Service forwards the first request to the BCS-Proxy, and the BCS-Proxy forwards the first request to the BCS-Agent in the first K8S cluster; in the case that the BCS-Service and the first K8S cluster are deployed in the same network region, the BCS-Service directly forwards the first request to the BCS-Agent in the first K8S cluster.

[0203] Step 4: The BCS-Agent communicates with the API Server of the first K8S cluster based on the received first request, to perform the operation and maintenance operation on the first K8S cluster.

[0204] In the application application embodiment, the user can indicate the K8S cluster to be operated and maintained by the operation and maintenance system based on the selection operation, and the operation and maintenance system can request the BCS-Service by the BCS-SaaS based on the first instruction, and then request the BCS-Agent arranged in the K8S cluster by the BCS-Service to perform the operation and maintenance operation, which is equivalent to realizing the transmission of the instruction, so as to diversify the management of rich cluster resources. Compared with the related art, the operation and maintenance system is simple to operate, supports rich types of managed cluster resources, and can still efficiently manage the K8S cluster in a large-scale cluster scenario, thereby improving the operation and maintenance efficiency.

[0205] It should be noted that "first", "second", and the like are used to distinguish similar objects, and do not necessarily have to describe a specific order or sequence.

[0206] The term "and / or" herein is only a description of the association relationship between the associated objects, which means that there can be three relationships, for example, A and / or B can represent the existence of A alone, the existence of A and B together, and the existence of B alone. In addition, the term "at least one" herein means any combination of any one or more of the plurality, for example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0207] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0208] The above merely describes preferred embodiments of the present application, but should not be used to limit the protection scope of the present application.

Claims

1. An operation and maintenance method, characterized in that, The method is applied to an operations and maintenance system, which includes: a first platform, a first service, and one or more second services; each of the one or more second services is configured in a Kubernetes cluster; the method includes: The first platform parses the first instruction input by the user into a first request and sends the first request to the first service; the first instruction is used to instruct the operation and maintenance of the first K8S cluster selected by the user in the first platform; the first request is used to request the first service to perform operation and maintenance on the first K8S cluster. The first service forwards the first request to the second service in the first K8S cluster; The second service in the first Kubernetes cluster communicates with the interface service component of the first Kubernetes cluster based on the first request in order to perform operation and maintenance operations on the first Kubernetes cluster.

2. The method according to claim 1, characterized in that, The method further includes: The second service sends a second request to the first service; the second request is used to request the first service to register the cluster in which the second service resides.

3. The method according to claim 1, characterized in that, The operation and maintenance system further includes: one or more agent nodes; each of the one or more agent nodes corresponds to a network area; Correspondingly, when the first service and the first Kubernetes cluster are deployed in different network regions, the first service forwards the first request to the second service in the first Kubernetes cluster, including: The first service forwards the first request to the proxy node corresponding to the network area where the first K8S cluster is located. The proxy node corresponding to the network area where the first K8S cluster is located forwards the first request to the second service in the first K8S cluster.

4. The method according to claim 1, characterized in that, The first service forwards the first request to the second service in the first Kubernetes cluster, including: The first service determines whether the user has the permission to execute the operation and maintenance operation corresponding to the first instruction based on the setting service and the first request; the setting service is used to verify the user's permissions. If the user has the permission to execute the operation and maintenance operation corresponding to the first instruction, the first service forwards the first request to the second service in the first K8S cluster.

5. The method according to claim 4, characterized in that, The first service, based on the configured service and the first request, determines whether the user has the permission to execute the maintenance operation corresponding to the first instruction, including: Based on the first request, the first service parses out the target object of the operation and maintenance corresponding to the first instruction; The first service sends a third request to the setting service, and determines, based on the response returned by the setting service according to the third request, whether the user has the permission to perform maintenance operations on the target object of the maintenance operation corresponding to the first instruction.

6. The method according to claim 5, characterized in that, The target objects of the operation and maintenance operations include one of the following categories: projects, clusters, services, and namespaces.

7. The method according to claim 1, characterized in that, The first platform's visual interface displays one or more Kubernetes clusters, and the method further includes: The first platform determines the first K8S cluster from the one or more K8S clusters based on the user's selection operation in the visualization interface.

8. An operation and maintenance system, characterized in that, include: A first platform, a first service, and one or more second services; each of the one or more second services is configured in a Kubernetes cluster; wherein... The first platform is used to parse the first instruction input by the user into a first request and send the first request to the first service; the first instruction is used to instruct the user to perform operation and maintenance operations on the first K8S cluster selected by the user in the first platform; the first request is used to request the first service to perform operation and maintenance operations on the first K8S cluster. The first service is used to forward the first request to the second service in the first K8S cluster; The second service in the first K8S cluster is used to communicate with the interface service component of the first K8S cluster based on the first request in order to perform operation and maintenance operations on the first K8S cluster.

9. The system according to claim 8, characterized in that, The second service is also used for: The second service sends a second request to the first service; the second request is used to request the first service to register the cluster in which the second service resides.

10. The system according to claim 8, characterized in that, The operation and maintenance system further includes: one or more agent nodes; each of the one or more agent nodes corresponds to a network area; Correspondingly, when the first service and the first Kubernetes cluster are deployed in different network regions, the first service forwards the first request to the second service in the first Kubernetes cluster, including: The first service forwards the first request to the proxy node corresponding to the network area where the first K8S cluster is located. The proxy node corresponding to the network area where the first K8S cluster is located forwards the first request to the second service in the first K8S cluster.

11. The system according to claim 8, characterized in that, The first service forwards the first request to the second service in the first Kubernetes cluster, including: The first service determines whether the user has the permission to execute the operation and maintenance operation corresponding to the first instruction based on the setting service and the first request; the setting service is used to verify the user's permissions. If the user has the permission to execute the operation and maintenance operation corresponding to the first instruction, the first service forwards the first request to the second service in the first K8S cluster.

12. The system according to claim 11, characterized in that, The first service, based on the configured service and the first request, determines whether the user has the permission to execute the maintenance operation corresponding to the first instruction, including: Based on the first request, the first service parses out the target object of the operation and maintenance corresponding to the first instruction; The first service sends a third request to the setting service, and determines, based on the response returned by the setting service according to the third request, whether the user has the permission to perform maintenance operations on the target object of the maintenance operation corresponding to the first instruction.

13. The system according to claim 12, characterized in that, The target objects of the operation and maintenance operations include one of the following categories: projects, clusters, services, and namespaces.

14. The system according to claim 8, characterized in that, The first platform's visual interface displays one or more Kubernetes clusters. The first platform is also used for: Based on the user's selection operation in the visualization interface, the first K8S cluster is determined from the one or more K8S clusters.

Images