Kubernetes-based application starting method, device and system

Abstract

The embodiment of the present specification provides a Kubernetes-based application starting method, which involves a first party and a second party. The first party is deployed with a task scheduling service, and the second party is deployed with a load management service, a configuration rendering plug-in and a configuration management service. The method comprises the following steps: the task scheduling service creates a first resource under the namespace of the second party in the Kubernetes cluster to which the task scheduling service belongs according to the starting instruction of the privacy computing application, and the first resource is used to store the input parameters and the starting configuration template of the privacy computing application. The load management service sends a calling instruction to the configuration rendering plug-in after listening to the creation of the first resource under the namespace of the second party. The configuration rendering plug-in reads the target information pre-registered for the privacy computing application from the configuration management service, fills the input parameters and the target information into the starting configuration template, and obtains the configuration information of the privacy computing application. The load management service starts the privacy computing application based on the configuration information received from the configuration rendering plug-in.

Description

Technical Field

[0001] This specification relates to the field of computer technology in one or more embodiments, and in particular to an application startup method, apparatus and system based on Kubernetes. Background Technology

[0002] Currently, the emergence of Kubernetes has driven the popularization and implementation of popular technologies such as microservice architecture, making development, operation, and delivery increasingly simple. Therefore, more and more enterprises are using Kubernetes as their internal container orchestration platform to improve productivity.

[0003] In privacy computing scenarios, the startup of privacy computing applications typically depends on different types of configuration information, such as dynamic and static configuration information. For different types of configuration information, privacy computing applications need to read them in different ways, which affects the startup efficiency of privacy computing applications. Summary of the Invention

[0004] This specification describes one or more embodiments of a Kubernetes-based application startup method, apparatus, and system that can easily and quickly start privacy computing applications.

[0005] In a first aspect, a Kubernetes-based application startup method is provided, involving a first party and a second party. The first party deploys a task orchestration service, and the second party deploys a load management service, a configuration rendering plugin, and a configuration management service. The method includes:

[0006] According to the startup command of the privacy computing application, the task orchestration service creates a first resource in the namespace of the second party in the Kubernetes cluster to which it belongs. The first resource is used to store the input parameters and startup configuration template of the privacy computing application.

[0007] The load management service detects the creation of a first resource in the second party's namespace and sends a call instruction to the configuration rendering plugin;

[0008] The configuration rendering plugin reads the target information pre-registered for the privacy computing application from the configuration management service, and fills the input parameters and target information into the startup configuration template to obtain the configuration information of the privacy computing application.

[0009] The load management service launches the privacy computing application based on the configuration information received from the configuration rendering plugin.

[0010] Secondly, a Kubernetes-based application startup method is provided, involving a first party and a second party, wherein the second party deploys a load management service, a configuration rendering plugin, and a configuration management service; the method includes:

[0011] The load management service detects that the first party creates a first resource in the namespace of the second party in its Kubernetes cluster and sends a call instruction to the configuration rendering plugin; the first resource is used to store the input parameters and startup configuration template of the privacy computing application;

[0012] The invocation instruction is used to instruct the configuration rendering plugin to read the target information pre-registered for the privacy computing application from the configuration management service, and to fill the input parameters and target information into the startup configuration template to obtain the configuration information of the privacy computing application;

[0013] The load management service launches the privacy computing application based on the configuration information received from the configuration rendering plugin.

[0014] Thirdly, a Kubernetes-based application startup system is provided, including both first-party and second-party systems;

[0015] The first party is configured to create a first resource in the Kubernetes cluster, under the namespace of the second party, according to the startup instruction of the privacy computing application. The first resource is used to store the input parameters and startup configuration template of the privacy computing application.

[0016] The second party is used to listen for the creation of a first resource in the namespace of the second party, read the target information pre-registered for the privacy computing application from the local machine, and fill the input parameters and target information into the startup configuration template to obtain the configuration information of the privacy computing application;

[0017] The second party is used to launch the privacy computing application based on the configuration information.

[0018] Fourthly, a Kubernetes-based application launcher is provided, configured in a second party; the device includes:

[0019] The reading unit is used to listen for the creation of a first resource in the namespace of the second party within the Kubernetes cluster of the first party, and to read the target information pre-registered for the privacy computing application; the first resource is used to store the input parameters and startup configuration template of the privacy computing application;

[0020] A generation unit is used to fill the input parameters and target information into the startup configuration template to obtain the configuration information of the privacy computing application;

[0021] The startup unit is used to start the privacy computing application based on the configuration information.

[0022] Fifthly, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of the first or second aspect.

[0023] In a sixth aspect, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of the first or second aspect.

[0024] The Kubernetes-based application startup method provided in one or more embodiments of this specification involves dynamically changing configuration information (hereinafter referred to as dynamic configuration information) upon which the startup of the privacy computing application depends. This dynamic configuration information is provided by the first party initiating the privacy computing application startup command to the second party that needs to start the privacy computing application, while the fixed configuration information (hereinafter referred to as static configuration information) of the privacy computing application is maintained locally by the second party. Specifically, when the second party starts the privacy computing application, the final configuration information of the privacy computing application is determined by combining the dynamic configuration information received from the first party and the locally maintained static configuration information, and the privacy computing application is started based on this final configuration information. This allows for a simple and fast startup of the privacy computing application. Attached Figure Description

[0025] To more clearly illustrate the technical solutions of the embodiments in this specification, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a schematic diagram illustrating an implementation scenario of one embodiment disclosed in this specification;

[0027] Figure 2 This diagram illustrates a Kubernetes-based application startup method according to an embodiment of this specification.

[0028] Figure 3 This diagram illustrates a Kubernetes-based application startup system according to an embodiment of this specification.

[0029] Figure 4A schematic diagram of a Kubernetes-based application launcher according to an embodiment of this specification is shown. Detailed Implementation

[0030] The solution provided in this specification will now be described with reference to the accompanying drawings.

[0031] As mentioned earlier, launching a privacy-preserving computing application typically relies on different types of configuration information, such as static and dynamic configuration information. To enable quick and efficient launch of this application, the inventors of this solution propose that the dynamic configuration information required for launching the privacy-preserving computing application be provided by the first party initiating the launch command to the second party needing to launch the application. Meanwhile, the application's fixed configuration information (referred to as static configuration information) is maintained locally by the second party. Thus, when the second party launches the privacy-preserving computing application, the final configuration information is determined by combining the dynamic configuration information received from the first party and the locally maintained static configuration information, and the application is launched based on this final configuration. This allows for a simple and rapid launch of the privacy-preserving computing application.

[0032] It should be noted that sensitive information that the launch of privacy computing applications depends on can be maintained locally on a second party as part of the aforementioned static configuration information. This ensures the security of sensitive information. In other words, this solution can ensure that privacy computing applications can be launched simply and quickly while ensuring the security of privacy data.

[0033] The above is the inventive concept provided in this specification. Based on this inventive concept, this solution can be realized. The following is a detailed description of this solution.

[0034] Figure 1 This is a schematic diagram illustrating an implementation scenario of one embodiment disclosed in this specification. Figure 1 In this context, before launching a privacy-preserving computing application, a second-party administrator can register the target information (also known as static configuration information) that the privacy-preserving computing application depends on in the configuration management service. If this target information includes sensitive information, the sensitive information can be entrusted to a key escrow service (an information security service).

[0035] Next, the task submitter (e.g., a user) can call the task orchestration service's task creation interface to initiate a startup command for the privacy computing application. This startup command can include the input parameters for the privacy computing application. Afterward, the task orchestration service can create an application configuration management (ConfigMap) resource and / or Pod resource (hereinafter also referred to as Pod) in its Kubernetes cluster, under a second-party namespace, to store the input parameters and startup configuration template for the privacy computing application.

[0036] The load management service in the second-party endpoint detects the creation of ConfigMap resources and / or Pod resources in the second-party namespace and sends a call instruction to the configuration rendering plugin. The configuration rendering plugin reads the pre-registered target information for the privacy-preserving computing application from the configuration management service, and fills the startup configuration template with the input parameters and target information as dynamic and static configuration information, respectively, to obtain the final configuration information of the privacy-preserving computing application. Based on the final configuration information received from the configuration rendering plugin, the load management service starts the application container corresponding to the privacy-preserving computing application.

[0037] It should be noted that in scenarios where multiple organizations jointly perform privacy-preserving computation tasks, the first party mentioned above can be deployed at any of the organizations, while the second party can be deployed at various organizations. In the following description in this specification, the organization that deploys the first party may be referred to as the initiator, and the other organizations that deploy the second party may be referred to as the participants.

[0038] Figure 2 This diagram illustrates a Kubernetes-based application startup method according to an embodiment of this specification. The method involves a first party and a second party, wherein the first party deploys a task orchestration service, and the second party deploys a load management service, a configuration rendering plugin, and a configuration management service.

[0039] like Figure 2 As shown, the method may include the following steps:

[0040] In step S202, the task orchestration service receives the startup command from the privacy computing application.

[0041] The aforementioned privacy-preserving computation applications can be used to perform privacy-preserving intersections, random segmentation, model training, and prediction.

[0042] Furthermore, the aforementioned startup command can be initiated by the task submitter (e.g., a user) by calling the task creation interface of the task orchestration service, which indicates the input parameters of the privacy computing application.

[0043] For example, the input parameters mentioned above may include dynamically changing information such as task identifiers and data sources. This dynamically changing information is the configuration information that the privacy computing application depends on for startup, so the input parameters can also be referred to as the dynamic configuration information of the privacy computing application.

[0044] In practice, the aforementioned startup command may also indicate descriptive information from a second party, which may include the second party's namespace identifier and resource configuration information.

[0045] In step S204, the task orchestration service creates a first resource in the second-party namespace of its Kubernetes cluster according to the startup command. This first resource is used to store the input parameters and startup configuration template of the privacy computing application.

[0046] In one embodiment, the aforementioned startup configuration template includes field A corresponding to dynamic configuration information and field B corresponding to static configuration information (described later). It should be understood that since the dynamic configuration information is the input parameter for the privacy-preserving computation application, field A can also be understood as the field corresponding to the input parameter for the privacy-preserving computation application.

[0047] In practice, there can be multiple fields A and B.

[0048] In addition, the above startup configuration template may also include placeholders X for the field value of field A and Y for the field value of field B. More specifically, placeholder X indicates the field name of field A, and placeholder Y indicates the field name of field B.

[0049] Specifically, the namespace of the second party can be located based on the namespace identifier in the description information of the second party, and the first resource mentioned above can be created under that namespace based on the resource configuration information in the description information of the second party.

[0050] In one embodiment, the number of the first resources is two, and the two first resources are respectively used to store the input parameters and the startup configuration template of the privacy computing application.

[0051] The two first resources mentioned above can both be ConfigMap resources or Pod resources, or one can be a ConfigMap resource and the other a Pod resource.

[0052] Taking the two primary resources mentioned above, both of which are ConfigMap resources, as an example, the content of the ConfigMap resource used to store the input parameters of the privacy computing application can be seen in the following code snippet:

[0053]

[0054]

[0055] In the code segment above, the values ​​of the two fields "TASK_CONF IG" and "TASK_ID" in lines 3-4 are the input parameters or dynamic configuration information of the privacy computing application.

[0056] In addition, the contents of the ConfigMap resource used to store the startup configuration template for privacy computing applications can be seen in the following code snippet:

[0057]

[0058] In the code segment mentioned above, lines 5-8 constitute the startup configuration template for the privacy computing application. This includes fields corresponding to dynamic configuration information: "task_id" and "task_config," and fields corresponding to static configuration information: "user_name" and "db_password." Furthermore, "{.TASK_ID}" and "{.TASK_CONFIG}" are placeholders for the values ​​of the "task_id" and "task_config" fields, respectively, while "{.TASK_USERNAME}" and "{.TASK_DB_PASSWORD}" are placeholders for the values ​​of the "user_name" and "db_password" fields, respectively.

[0059] Taking the two instances where the primary resource is a Pod resource as examples, the input parameters and startup configuration template of the privacy computing application can be included in the "Env" or "Annotation" fields of the Pod resource.

[0060] It should be noted that, when both of the above primary resources are ConfigMap resources, the task orchestration service can also create Pod resources and Service resources in the namespace of a second party.

[0061] In step S206, the load management service detects the creation of the first resource in the second-party namespace and sends a call command to the configuration rendering plugin.

[0062] As mentioned earlier, the first resource here can be a ConfigMap resource or a Pod resource.

[0063] In the embodiments described in this specification, the load management service can request in advance from the Kubernetes cluster's control plane (APIServer) to monitor changes (including resource creation, modification, and deletion) of resources such as ConfigMap, Pod, and Service discovery.

[0064] In one specific implementation, monitoring changes to resources such as ConfigMap, Pod, and Service can be achieved based on Kubernetes' last-watch mechanism.

[0065] Taking the creation of a ConfigMap resource as an example, when a ConfigMap resource is created in a third-party namespace in the Kubernetes cluster, the control plane sends an event change notification to the load management service. This event change notification includes the created ConfigMap resource.

[0066] It should be understood that since the first resource contains the startup configuration template and input parameters for the privacy computing application, the load management service can obtain the startup configuration template and input parameters after listening to the aforementioned first resource. Then, the load management service can send a call command to the configuration rendering plugin, which can include the startup configuration template and input parameters.

[0067] In addition, while the task orchestration service creates Pod resources in the namespace of a second party, the load management service creates Pods in the second party for use in launching the application container corresponding to the privacy computing application.

[0068] Step S208: The configuration rendering plugin reads the target information pre-registered for the privacy computing application from the configuration management service, and fills the input parameters and target information into the startup configuration template to obtain the configuration information of the privacy computing application.

[0069] In this solution, before launching the privacy computing application, the second-party administrator can pre-register the target information that the privacy computing application depends on for launching with the configuration management service.

[0070] This target information can include two parts: the first part contains sensitive information such as the user account and password for logging into the database and file storage services used by the privacy-preserving computing application; the second part contains non-sensitive information such as the log levels and types of output parameters used by the privacy-preserving computing application. Log levels can be, for example, ERROR, WARNING, INFO, DEBUG, TRACE, etc. Output parameter types can be, for example, model parameters. Typically, this target information is fixed and unchanging, and therefore can also be referred to as the static configuration information of the privacy-preserving computing application.

[0071] To ensure the security of the aforementioned sensitive information, the configuration management service further manages it through a key escrow service.

[0072] The specific steps for the configuration rendering plugin to read target information can include: the configuration rendering plugin can parse the startup configuration template to obtain the field name of field B corresponding to the target information (i.e., static configuration information), and then read the target information from the configuration management service based on the field name of field B.

[0073] In the above-mentioned startup configuration template, there is also a placeholder Y corresponding to the field value of field B (i.e., the field corresponding to the static configuration information), and the placeholder Y indicates the field name of field B. The field name of field B can be determined based on the placeholder Y.

[0074] In addition, as mentioned above, the target information may include sensitive information. If the target information is included, the configuration management service can read the sensitive information from the key escrow service based on the target field name corresponding to the sensitive information after receiving the target field name.

[0075] Taking the code segment corresponding to the aforementioned startup configuration template as an example, the target field names obtained after parsing that correspond to sensitive information can include "USE_RNAME" and "DB_PASSWORD". Subsequently, the configuration management service can read the corresponding field values ​​from the key hosting service as sensitive information based on "USE_RNAME" and "DB_PASSWORD", and return them to the configuration rendering plugin.

[0076] After receiving the target information, the configuration rendering plugin can add the input parameters and target information of the privacy computing application to the corresponding fields in the startup configuration template. Specifically, it replaces the placeholder X corresponding to the field value of field A (the field corresponding to the dynamic configuration information) in the startup configuration template with the input parameters, and replaces the placeholder Y corresponding to the field value of field B (the field corresponding to the static configuration information) in the startup configuration template with the target information, thus obtaining the final configuration information.

[0077] In the example above, the final configuration information can be as follows:

[0078] "task_id":"{'xxxxxxx'}",

[0079] "task_conf ig":"{task-examp le}",

[0080] "user_name":{zhangsan}

[0081] "db_password":{123456}

[0082] The values ​​of the last two fields are read from the configuration management service.

[0083] In step S210, the load management service starts the privacy computing application based on the configuration information received from the configuration rendering plugin.

[0084] In this scenario, if the second party has already created a Pod, the load management service can mount the received final configuration information into the created Pod and, based on the final configuration information, start the application container for the privacy computing application within that Pod. This completes the startup of the privacy computing application.

[0085] Of course, in practice, the above privacy computing application can also be launched via Docker or directly on bare metal; this manual does not limit this to either method.

[0086] This completes the process of launching the privacy computing application on the second party, that is, launching the privacy computing application on the organization that deployed the second party. It should be understood that after launching the privacy computing application on each organization that deployed the second party, multiple organizations can jointly perform privacy computing.

[0087] In summary, this solution has the following innovative features:

[0088] 1. Separate the dynamic and static configuration information of the privacy computing application. The dynamic configuration information is distributed by the task initiator, while the static configuration information of the privacy computing application is maintained and configured locally by the participants. Sensitive information is managed by a key escrow service, thereby preventing the leakage of sensitive information of the participants.

[0089] 2. The configuration management service of the participating parties divides the static configuration information of privacy computing applications into non-sensitive information and sensitive information, which can realize the effective management of the static configuration information of privacy computing applications.

[0090] 3. The startup configuration template and dynamic configuration information of the privacy-preserving computing application are indirectly passed to the load management service of the participating party through ConfigMap resources or Pod resources. The load management service calls the configuration rendering plugin to parse the startup configuration template, obtain the placeholders in the startup configuration template, and retrieve the corresponding static configuration information from the configuration management service. Finally, it renders the dynamic and static configuration information into the startup configuration template. Using this method, the privacy-preserving computing application does not need to actively obtain dependent static and dynamic configuration information through different methods, nor does it need to be aware of the differences between static and dynamic configuration information. It only needs to load the final configuration information after mounting and start normally, thereby reducing the understanding cost.

[0091] Corresponding to the above-described Kubernetes-based application startup method, one embodiment of this specification also provides a Kubernetes-based application startup system, such as... Figure 3 As shown, the system may include: a first party 302 and a second party 304, wherein,

[0092] The first party 302 is used to create a first resource in the namespace of the second party 304 in the Kubernetes cluster according to the startup instructions of the privacy computing application. The first resource is used to store the input parameters and startup configuration template of the privacy computing application.

[0093] The second-party 304 is used to listen for the creation of the first resource under the namespace of the second-party 304, read the target information pre-registered for the privacy computing application from the local machine, and fill the input parameters and target information into the startup configuration template to obtain the configuration information of the privacy computing application.

[0094] The second-party 304 is also used to launch privacy computing applications based on configuration information.

[0095] The functions of each participant in the system of the above embodiments of this specification can be implemented through the steps of the above method embodiments. Therefore, the specific working process of the system provided in one embodiment of this specification will not be repeated here.

[0096] This specification provides an embodiment of a Kubernetes-based application startup system that can easily and quickly launch privacy computing applications.

[0097] Corresponding to the above-described Kubernetes-based application startup method, one embodiment of this specification also provides a Kubernetes-based application startup device, which is configured in a second party. For example... Figure 4 As shown, the device includes:

[0098] The reading unit 402 is used to listen to the first party creating a first resource in the namespace of the second party in its Kubernetes cluster, and to read the target information pre-registered for the privacy computing application. The first resource is used to store the input parameters and startup configuration template of the privacy computing application.

[0099] The generation unit 404 is used to fill the input parameters and target information into the startup configuration template to obtain the configuration information of the privacy computing application.

[0100] The startup unit 406 is used to start the privacy computing application based on the above configuration information.

[0101] In one embodiment, the above-mentioned startup configuration template includes a first field corresponding to the target information;

[0102] The reading unit 402 includes:

[0103] Parsing submodule 4022 is used to parse the startup configuration template and obtain the field name of the first field;

[0104] The read submodule 4024 is used to read target information based on the field name of the first field.

[0105] In one embodiment, the target information includes sensitive information, and the reading submodule 4024 is specifically used for:

[0106] Based on the target field name corresponding to the sensitive information, the sensitive information is read from the key escrow service.

[0107] In one embodiment, the above-mentioned startup configuration template includes a first field corresponding to the target information and a second field corresponding to the input parameters;

[0108] Generating unit 404 is specifically used for:

[0109] Add the input parameters and target information to the first and second fields of the startup configuration template, respectively.

[0110] In one embodiment, the starting unit 406 is specifically used for:

[0111] The configuration information is mounted into the target pod, and the application container corresponding to the privacy computing application is launched in the target pod based on the configuration information.

[0112] In one embodiment, the number of the first resources is two, and the two first resources are used to store input parameters and startup configuration templates, respectively.

[0113] In a more specific embodiment,

[0114] Both of the above first resources are ConfigMap resources; or,

[0115] Both of the above primary resources are Pod resources; or,

[0116] One of the two primary resources mentioned above is a ConfigMap resource, and the other is a Pod resource.

[0117] The functions of each functional unit of the apparatus in the above embodiments of this specification can be implemented through the steps of the above method embodiments. Therefore, the specific working process of the apparatus provided in one embodiment of this specification will not be repeated here.

[0118] This specification provides an embodiment of a Kubernetes-based application launcher that can easily and quickly launch privacy computing applications.

[0119] According to another embodiment, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed in a computer, causes the computer to perform a combination Figure 2 The method described.

[0120] According to another embodiment, a computing device is also provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements a combination... Figure 2 The method described.

[0121] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the medium or device embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0122] The steps of the methods or algorithms described in conjunction with the disclosure in this specification can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in RAM, flash memory, ROM, EPROM, EEPROM, registers, hard disk, external hard disk, CD-ROM, or any other form of storage medium well known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and storage medium can reside in an ASIC. Alternatively, the ASIC can reside in a server. Of course, the processor and storage medium can also exist as discrete components in the server.

[0123] Those skilled in the art will recognize that, in one or more of the examples above, the functions described in this invention can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transfer of a computer program from one place to another. Storage media can be any available medium accessible to a general-purpose or special-purpose computer.

[0124] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0125] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of this specification. It should be understood that the above description is only a specific embodiment of this specification and is not intended to limit the scope of protection of this specification. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of this specification should be included within the scope of protection of this specification.

Claims

1. A Kubernetes-based application starting method involving a first party and a second party, wherein a task orchestration service is deployed in the first party, and a load management service, a configuration rendering plug-in and a configuration management service are deployed in the second party; the method comprising: the task orchestration service creating, according to a starting instruction of a privacy computing application, a first resource for storing input parameters and a starting configuration template of the privacy computing application in a namespace of the second party in a Kubernetes cluster belonging to the task orchestration service; the load management service sending a calling instruction to the configuration rendering plug-in upon listening to the creation of the first resource in the namespace of the second party; the configuration rendering plug-in reading target information pre-registered for the privacy computing application from the configuration management service, and filling the input parameters and the target information into the starting configuration template as dynamic configuration information and static configuration information respectively to obtain configuration information of the privacy computing application; the load management service starting the privacy computing application based on the configuration information received from the configuration rendering plug-in.

2. The method of claim 1, wherein, the starting configuration template comprises a first field corresponding to the target information; and the calling instruction comprises the input parameters and the starting configuration template; the configuration rendering plug-in reading target information pre-registered for the privacy computing application from the configuration management service comprises: the configuration rendering plug-in parsing the starting configuration template to obtain a field name of the first field; the configuration rendering plug-in reading the target information from the configuration management service according to the field name of the first field.

3. The method of claim 2, wherein, the target information comprises sensitive information; and the reading of the target information from the configuration management service comprises: the configuration rendering plug-in sending a reading instruction to the configuration management service, wherein the reading instruction comprises a target field name corresponding to the sensitive information; the configuration management service reading the sensitive information from a key escrow service according to the target field name; the configuration management service sending the sensitive information to the configuration rendering plug-in.

4. The method of claim 1, wherein, the starting configuration template comprises a first field corresponding to the target information and a second field corresponding to the input parameters; the filling of the input parameters and the target information into the starting configuration template comprises: adding the input parameters and the target information into the first field and the second field in the starting configuration template respectively.

5. The method of claim 1, wherein, the starting of the privacy computing application comprises: the load management service mounting the configuration information into a target pod, and based on the configuration information, pulling up an application container corresponding to the privacy computing application in the target pod.

6. The method of claim 1, wherein, the number of the first resources is two, and the two first resources are respectively used for storing the input parameters and the starting configuration template.

7. The method of claim 6, wherein: the two first resources are both ConfigMap resources; or the two first resources are both Pod resources; or one of the two first resources is a ConfigMap resource and the other is a Pod resource.

8. A Kubernetes-based application starting method, involving a first party and a second party, wherein a load management service, a configuration rendering plug-in and a configuration management service are deployed in the second party; the method comprises: the load management service listens to that the first party creates a first resource under a namespace of the second party in a Kubernetes cluster belonging to the first party, and sends a calling instruction to the configuration rendering plug-in; the first resource is used to store input parameters and a starting configuration template of a privacy computing application; the calling instruction is used to instruct the configuration rendering plug-in to read target information pre-registered for the privacy computing application from the configuration management service, and fill the input parameters and the target information into the starting configuration template as dynamic configuration information and static configuration information respectively, to obtain configuration information of the privacy computing application; the load management service starts the privacy computing application based on the configuration information received from the configuration rendering plug-in.

9. A Kubernetes-based application starting system, comprising a first party and a second party; the first party is configured to create a first resource under a namespace of the second party in a Kubernetes cluster belonging to the first party according to a starting instruction of a privacy computing application, and the first resource is used to store input parameters and a starting configuration template of the privacy computing application; the second party is configured to listen to that the first resource is created under the namespace of the second party, read target information pre-registered for the privacy computing application from a local, and fill the input parameters and the target information into the starting configuration template as dynamic configuration information and static configuration information respectively, to obtain configuration information of the privacy computing application; the second party is further configured to start the privacy computing application based on the configuration information.

10. A Kubernetes-based application starting apparatus, arranged in a second party; the apparatus comprises: a reading unit configured to listen to that a first party creates a first resource under a namespace of the second party in a Kubernetes cluster belonging to the first party, and read target information pre-registered for a privacy computing application; the first resource is used to store input parameters and a starting configuration template of the privacy computing application; a generating unit configured to fill the input parameters and the target information into the starting configuration template as dynamic configuration information and static configuration information respectively, to obtain configuration information of the privacy computing application; a starting unit configured to start the privacy computing application based on the configuration information.

11. The apparatus of claim 10, wherein, the starting configuration template comprises a first field corresponding to the target information; the reading unit comprises: a parsing sub-module configured to parse the starting configuration template to obtain a field name of the first field; a reading sub-module configured to read the target information according to the field name of the first field.

12. The apparatus of claim 11, wherein, the target information comprises sensitive information; and the reading sub-module is specifically configured to: read the sensitive information from a key escrow service according to a target field name corresponding to the sensitive information.

13. The apparatus of claim 10, wherein, The start configuration template includes a first field corresponding to the target information and a second field corresponding to the input parameter; The generating unit is specifically configured to: respectively add the input parameter and the target information to the first field and the second field in the start configuration template.

14. The apparatus of claim 10, wherein, The starting unit is specifically configured to: mount the configuration information into a target pod, and based on the configuration information, start an application container corresponding to the privacy computing application in the target pod.

15. The apparatus of claim 10, wherein, The number of the first resources is two, and the two first resources are respectively used for storing the input parameter and the start configuration template.

16. The apparatus of claim 15, wherein, The two first resources are both ConfigMap resources; or, The two first resources are both Pod resources; or, One of the two first resources is a ConfigMap resource, and the other is a Pod resource.

17. A computer readable storage medium having stored thereon a computer program, wherein, When the computer program is executed in the computer, the computer executes the method in any one of claims 1-8.

18. A computing device comprising a memory and a processor, wherein, The memory stores executable code, and the processor executes the executable code to implement the method in any one of claims 1-8.

Images