Kubernetes resource dynamic scaling method, device and equipment

Abstract

The invention relates to the field of information security, in particular to a Kubernetes resource dynamic scaling method, device and equipment. When the collected target resource index data of the K8s cluster meets a preset threshold condition, performing digital signature on the obtained target service feature data to obtain corresponding signature data, and sending the target service feature data and the signature data to the K8s cluster, so that the K8s cluster verifies the signature data; and after the K8s cluster passes verification of the signature data, encrypting the target service feature data, and storing the obtained encrypted feature data in a database, so that the K8s cluster obtains the encrypted feature data for decryption processing when executing resource dynamic scaling, and determines a resource dynamic scaling mode based on the decrypted target service feature data. According to the method, the security and the integrity of the target service feature data of the K8s cluster can be ensured, so that the smooth execution of resource dynamic scaling is ensured.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular, to a method, device, and equipment for dynamically scaling Kubernetes resources. Background Art

[0002] Kubernetes (abbreviated as K8s or "kube") is an open-source container cluster management platform that can realize functions such as automatic deployment, automatic scaling, and automated operation and maintenance of container applications. Kubernetes provides a powerful set of tools to manage and coordinate container clusters running across multiple hosts.

[0003] A Pod is the smallest and simplest deployment unit in Kubernetes, which is set on the nodes in the Kubernetes cluster. It can be used as a replica of an application and contains one or more containers that share storage, network, etc. Kubernetes also provides a powerful mechanism to achieve dynamic resource scaling. For example, it can automatically adjust the number of Pods, the resource occupancy of Pods, and the number of nodes according to the running data of the Kubernetes cluster.

[0004] However, currently, when collecting the running data of the Kubernetes cluster for dynamic resource scaling, the security and integrity of the running data cannot be guaranteed, so the smooth execution of dynamic resource scaling cannot be guaranteed. Summary of the Invention

[0005] This application provides a method, device, and equipment for dynamically scaling Kubernetes resources to ensure the security and integrity of the running data of the Kubernetes cluster, thereby ensuring the smooth execution of dynamic resource scaling.

[0006] In a first aspect, an embodiment of this application provides a method for dynamically scaling Kubernetes resources, which is applied to a data collection device and includes:

[0007] Collect target resource metric data of the Kubernetes cluster. When the target resource metric data meets the preset threshold condition, obtain corresponding target business characteristic data; the target business characteristic data is used to characterize the business operation situation of the Kubernetes cluster;

[0008] Perform digital signature on the target business characteristic data to obtain corresponding signature data, and send the target business characteristic data and the signature data to the Kubernetes cluster so that the Kubernetes cluster verifies the signature data;

[0009] After the Kubernetes cluster successfully validates the signature data, encrypt the target business feature data to obtain encrypted feature data, and save the encrypted feature data to the database, so that when the Kubernetes cluster performs resource dynamic scaling, it can obtain the encrypted feature data, decrypt it, and determine the resource dynamic scaling method based on the decrypted target business feature data.

[0010] In a possible implementation, collecting the target resource metric data of the Kubernetes cluster and obtaining the corresponding target business feature data when the target resource metric data meets the preset threshold conditions includes:

[0011] Obtain the target resource metric data based on the real-time resource metric data of the Kubernetes cluster collected by multiple metric collection tools;

[0012] When the target resource metric data meets the preset threshold conditions, obtain the target business feature data based on the real-time business feature data collected by multiple metric collection tools.

[0013] In a possible implementation, after obtaining the corresponding target business feature data and before performing digital signature on the target business feature data, it further includes:

[0014] Match the target business feature data with other business feature data already recorded in the feature library, determine that there is no other business feature data in the feature library that is the same as the target business feature data, and save the target business feature data to the feature library.

[0015] In a possible implementation, the process of matching the target business feature data with other business feature data already recorded in the feature library, determining that there is no other business feature data in the feature library that is the same as the target business feature data, and saving the target business feature data to the feature library includes:

[0016] Use a Bloom filter to perform marking processing on the target business feature data to obtain the corresponding target marking result; among them, the Bloom filter has already performed marking processing on other business feature data in the feature library;

[0017] If the target marking result meets the set conditions, determine that there is no other business feature data in the feature library that is the same as the target business feature data.

[0018] In a possible implementation, performing digital signature on the target business feature data to obtain the corresponding signature data includes:

[0019] Perform a hashing operation on the target service feature data using a set hashing algorithm to obtain a corresponding hash value;

[0020] Perform an encryption process on the hash value using the private key of a set encryption algorithm to obtain corresponding signature data.

[0021] In a second aspect, an embodiment of the present application provides a Kubernetes resource dynamic scaling method, which is applied to a Kubernetes cluster and includes:

[0022] Obtain target service feature data and corresponding signature data; wherein, the target service feature data is obtained after a data collection device collects target resource metric data of the Kubernetes cluster and determines that the target resource metric data meets a preset threshold condition, and the signature data is obtained after digitally signing the target service feature data;

[0023] Verify the signature data based on the target service feature data. After the verification passes, send a verification passed message to the data collection device so that the data collection device encrypts the target service feature data and saves the obtained encrypted feature data to a database;

[0024] When performing resource dynamic scaling, obtain the encrypted feature data from the database, decrypt the encrypted feature data, and determine a resource dynamic scaling method based on the decrypted target service feature data.

[0025] In a possible implementation manner, the signature verification of the signature data includes:

[0026] Decrypt the signature data using the public key of the set encryption algorithm to obtain a first hash value, and perform a hashing operation on the metric feature data using the set hashing algorithm to obtain a second hash value;

[0027] If the first hash value and the second hash value are the same, it is determined that the signature data verification passes.

[0028] In a third aspect, an embodiment of the present application provides a Kubernetes resource dynamic scaling device, which is set in a data collection device and includes:

[0029] A collection module, configured to collect target resource metric data of a Kubernetes cluster, and when the target resource metric data meets a preset threshold condition, obtain target service feature data associated with the target resource metric data;

[0030] A signature module, which is used to digitally sign the target business feature data to obtain corresponding signature data, and send the target business feature data and the signature data to the Kubernetes cluster, so that the Kubernetes cluster can verify the signature data;

[0031] An encryption module, which is used to encrypt the target business feature data to obtain encrypted feature data after the Kubernetes cluster passes the verification of the signature data, and save the encrypted feature data to a database, so that the Kubernetes cluster can obtain the encrypted feature data and perform decryption processing when performing resource dynamic scaling, and determine the resource dynamic scaling method based on the decrypted target business feature data.

[0032] In a possible implementation manner, the acquisition module is specifically used for:

[0033] Based on the real-time resource metric data of the Kubernetes cluster collected by various metric collection tools, obtain the target resource metric data;

[0034] When the target resource metric data meets the preset threshold condition, based on the real-time business feature data collected by various metric collection tools, obtain the target business feature data.

[0035] In a possible implementation manner, the device further includes a matching module, which is used for:

[0036] Match the target business feature data with other business feature data recorded in the feature library, determine that there is no other business feature data in the feature library that is the same as the target business feature data, and save the target business feature data to the feature library.

[0037] In a possible implementation manner, the matching module is specifically used for:

[0038] Use a Bloom filter to perform marking processing on the target business feature data to obtain a corresponding target marking result; wherein, the Bloom filter has performed marking processing on other business feature data in the feature library;

[0039] If the target marking result meets the set condition, it is determined that there is no other business feature data in the feature library that is the same as the target business feature data.

[0040] In a possible implementation manner, the signature module is specifically used for:

[0041] Use a set hash algorithm to perform a hash operation on the target business feature data to obtain a corresponding hash value;

[0042] Encrypt the hash value with the private key of the set encryption algorithm to obtain corresponding signature data.

[0043] Fourthly, an embodiment of the present application provides a Kubernetes resource dynamic scaling device, which is set in a Kubernetes cluster and includes:

[0044] An acquisition module, configured to acquire target service feature data and corresponding signature data; wherein, the target service feature data is used to characterize the service operation condition of the Kubernetes cluster, and is acquired by a data acquisition device when determining that the target resource metric data of the Kubernetes cluster meets a preset threshold condition, and the signature data is obtained after digitally signing the target service feature data;

[0045] A verification module, configured to verify the signature data based on the target service feature data. After the verification passes, send a verification passed message to the data acquisition device, so that the data acquisition device encrypts the target service feature data and saves the obtained encrypted feature data to a database;

[0046] A decryption module, configured to, when performing resource dynamic scaling, acquire the encrypted feature data from the database, decrypt the encrypted feature data, and determine a resource dynamic scaling method based on the decrypted target service feature data.

[0047] In a possible implementation manner, the verification module is specifically configured to:

[0048] Decrypt the signature data with the public key of the set encryption algorithm to obtain a first hash value, and perform a hash operation on the metric feature data with the set hash algorithm to obtain a second hash value;

[0049] If the first hash value is the same as the second hash value, it is determined that the signature data verification passes.

[0050] Fifthly, an embodiment of the present application provides an electronic device, which includes a processor and a memory. Among them, the memory stores a computer program. When the computer program is executed by the processor, the processor is enabled to execute the steps of any one of the methods in the first aspect or any one of the methods in the second aspect.

[0051] Sixthly, an embodiment of the present application provides a computer-readable storage medium, which includes a computer program. When the computer program runs on a communication device, the computer program is used to enable the communication device to execute the steps of any one of the methods in the first aspect or any one of the methods in the second aspect.

[0052] In a seventh aspect, an embodiment of the present application provides a computer program product, including a computer program stored in a computer-readable storage medium; when a processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, so that the electronic device executes the steps of any of the methods in the first aspect or any of the methods in the second aspect.

[0053] The present application has at least the following beneficial effects:

[0054] In an embodiment of the present application, a data collection device collects target resource metric data of a Kubernetes cluster. When the target resource metric data meets a preset threshold condition, corresponding target service feature data is obtained to enable the Kubernetes cluster to perform dynamic resource scaling. To ensure the integrity of the target service feature data, digital signature is performed on the target service feature data to obtain corresponding signature data, and the target service feature data and the signature data are sent to the Kubernetes cluster so that the Kubernetes cluster verifies the signature data; after the Kubernetes cluster verifies the signature data successfully, encryption processing is performed on the target service feature data to obtain encrypted feature data, and the encrypted feature data is saved to a database to ensure the security of the target service feature data. Subsequently, when the Kubernetes cluster performs dynamic resource scaling, it can obtain the encrypted feature data and perform decryption processing, and determine the dynamic resource scaling method based on the decrypted target service feature data. Therefore, the embodiment of the present application can ensure the security and integrity of the target service feature data (i.e., operation data) of the Kubernetes cluster, thus ensuring the smooth execution of dynamic resource scaling.

[0055] Other features and advantages of the present application will be described in the following specification, and, in part, will be obvious from the specification, or will be understood by implementing the present application. The objectives and other advantages of the present application can be achieved and obtained by the structures specifically pointed out in the written specification, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The drawings described herein are used to provide a further understanding of the present application, and constitute a part of the present application. The illustrative embodiments and descriptions thereof of the present application are used to explain the present application, and do not constitute an improper limitation of the present application. In the drawings:

[0057] Figure 1 It is a schematic diagram of an application scenario of a Kubernetes resource dynamic scaling method provided by an embodiment of the present application;

[0058] Figure 2Flowchart of a method for dynamically scaling Kubernetes resources provided by an embodiment of the present application;

[0059] Figure 3 Schematic diagram of the principle of a Bloom filter provided by an embodiment of the present application;

[0060] Figure 4 Flowchart of another method for dynamically scaling Kubernetes resources provided by an embodiment of the present application;

[0061] Figure 5 Schematic diagram of the overall logic of a method for dynamically scaling Kubernetes resources provided by an embodiment of the present application;

[0062] Figure 6 Schematic diagram of Pod expansion in a Kubernetes cluster provided by an embodiment of the present application;

[0063] Figure 7 Schematic diagram of the composition structure of a device for dynamically scaling Kubernetes resources provided by an embodiment of the present application;

[0064] Figure 8 Schematic diagram of the composition structure of another device for dynamically scaling Kubernetes resources provided by an embodiment of the present application;

[0065] Figure 9 Schematic diagram of the composition structure of an electronic device provided by an embodiment of the present application. Detailed implementation manners

[0066] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application. Apparently, the described embodiments are some, but not all, of the embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments recorded in this application document without creative efforts shall fall within the scope of protection of the technical solutions of the present application.

[0067] Some concepts involved in the embodiments of the present application are introduced below.

[0068] Horizontal Pod Autoscaler (abbreviation: HPA): A built-in Kubernetes controller that can automatically scale the number of replicas of Pods in replication controller, deployment, and replicaset based on CPU usage rate, memory occupancy rate, etc.

[0069] Cluster Autoscaler (abbreviated as CA): A built-in Kubernetes controller that can automatically scale up and down at the Node level and automatically add or remove nodes according to the scheduling requirements of Pods in the cluster.

[0070] SM2: A public-key encryption algorithm used to achieve confidential communication and digital signatures. SM2 adopts elliptic curve cryptography. Its private key length is 256 bits and its public key length is 512 bits, providing security comparable to that of the 1024-bit RSA algorithm.

[0071] SM3: A hash algorithm that can be used in fields such as digital signatures and message digests. SM3 adopts the Merkle– structure. The message length can reach 2^64 - 1 bits, and the security can reach 256 bits.

[0072] SM4: A symmetric encryption block cipher algorithm used to encrypt large amounts of data. Its key length is 128 bits and the block length is 128 bits, featuring high efficiency and security.

[0073] The terms "first" and "second" in the description and claims of this application are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally further include unlisted steps or units, or may optionally further include other steps or units inherent to these processes, methods, products, or devices. "Multiple" in this application may mean at least two, for example, it may be two, three, or more, and the embodiments of this application do not make limitations.

[0074] Currently, when collecting the running data of a Kubernetes cluster for resource dynamic scaling, the security and integrity of the running data cannot be guaranteed, thus the smooth execution of resource dynamic scaling cannot be ensured. In view of this, the embodiments of the present application provide a Kubernetes resource dynamic scaling method, apparatus and device. In order to ensure the integrity of the target business characteristic data (i.e., the running data), digital signature is performed on the target business characteristic data to obtain corresponding signature data, and the target business characteristic data and the signature data are sent to the Kubernetes cluster so that the Kubernetes cluster verifies the signature data; after the Kubernetes cluster passes the verification of the signature data, the target business characteristic data is encrypted to obtain encrypted characteristic data, and the encrypted characteristic data is saved to the database to ensure the security of the target business characteristic data. Subsequently, when the Kubernetes cluster performs resource dynamic scaling, the encrypted characteristic data can be obtained and decrypted, and the resource dynamic scaling method is determined based on the decrypted target business characteristic data.

[0075] As Figure 1 shown, it is a schematic diagram of an application scenario of the embodiments of the present application. The application scenario diagram includes a Kubernetes cluster 110 and a data collection device 120. The Kubernetes cluster 110 may include a master node and one or more worker nodes. One or more Pods may be deployed in the worker nodes, and the master node may schedule the Pods in the worker nodes and the resource occupancy of the Pods, etc. The master node and the worker nodes may be physical devices (such as servers) or virtual devices. Different nodes may be respectively deployed in different devices or in the same device. Communication may be carried out between the Kubernetes cluster 110 and the data collection device 120 through a communication network.

[0076] In an alternative embodiment, the communication network may be a wired network or a wireless network. Therefore, the Kubernetes cluster 110 and the data collection device 120 may be directly or indirectly connected through wired or wireless communication methods, and the embodiments of the present application do not make specific limitations here.

[0077] In the embodiments of the present application, the data collection device 120 may be a server, specifically an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms.

[0078] The Kubernetes resource dynamic scaling method according to the embodiments of the present application can be executed in cooperation by the data collection device 120 and the Kubernetes cluster 110.

[0079] The preferred embodiments of the present application will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are only for the purpose of illustrating and explaining the present application, and are not intended to limit the present application. And without conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

[0080] Refer to Figure 2 As shown, a Kubernetes resource dynamic scaling method provided by an embodiment of the present application is executed by a data collection device, such as the above-mentioned data collection device 120. The specific implementation process of this method includes the following S21-S23:

[0081] S21. Collect the target resource metric data of the Kubernetes cluster. When the target resource metric data meets the preset threshold condition, obtain the corresponding target business characteristic data; the target business characteristic data is used to characterize the business operation status of the Kubernetes cluster.

[0082] Among them, the data collection device can collect the resource usage metrics of each Pod in the Kubernetes cluster, including but not limited to one or more of the Central Processing Unit (CPU) usage rate, memory occupancy rate, and disk occupancy rate.

[0083] When the Kubernetes cluster includes multiple Pods, the multiple Pods can be deployed in one or more worker nodes, and the number of Pods deployed in each worker node can be set as needed; if the master node of the Kubernetes cluster adopts a load balancing method to schedule traffic requests to multiple Pods, at this time, the average value of the resource usage metrics of the multiple Pods can be used as the target resource metric. In addition, the resource usage metric of a single Pod can also be used as the target resource metric, and this is not limited.

[0084] The target resource metric data meeting the preset threshold condition can mean that the target resource metric data reaches the preset metric threshold. For example, when the target resource metric data includes the CPU usage rate, the preset metric threshold can be the CPU usage rate threshold; when the target resource metric data includes the CPU usage rate and the memory occupancy rate, the preset metric threshold can include the CPU usage threshold and the memory occupancy threshold. The target business characteristic data includes but not limited to one or more of the number of running threads, the number of database connections, the number of thread schedulings of the stack, etc.

[0085] Specifically, a metric collection tool deployed inside the Kubernetes cluster can be used to collect the target resource metric data and the corresponding target business characteristic data of the Kubernetes cluster. The data collection device can obtain the target resource metric data and the corresponding target business characteristic data from the Kubernetes cluster.

[0086] In some embodiments, to avoid misjudgment caused by the failure of a single metric collection tool, which may prevent the dynamic scaling of resources in the Kubernetes cluster, the embodiments of the present application adopt multiple metric collection tools to respectively collect the real-time resource metric data of the Kubernetes cluster. Based on the real-time resource metric data respectively collected by the multiple metric collection tools, the target resource metric data is obtained. For example, if the real-time resource metric data collected by more than half of the multiple metric collection tools is the same, then the same real-time resource metric data is used as the target resource metric data. Specifically, the multiple metric collection tools include, but are not limited to, the Metrics Server tool, the Rancher tool, etc.

[0087] Further, when the target resource metric data meets the preset threshold condition, based on the real-time business characteristic data respectively collected by the multiple metric collection tools, the target business characteristic data is obtained. For example, if the real-time business characteristic data collected by more than half of the multiple metric collection tools is the same, then the same real-time business characteristic data is used as the target business characteristic data.

[0088] In practical applications, the Metrics Server component is downloaded and installed in the master node or worker node of the Kubernetes cluster. After the corresponding application configuration file is deployed, the kubectl top pods and kubectl top nodes commands are periodically executed to view the cluster resource usage and obtain the analysis results (including real-time resource metric data and real-time business characteristic data). At the same time, the Rancher monitoring system is downloaded and installed in the master node or worker node of the Kubernetes cluster, and the cluster resource usage is periodically obtained to obtain the analysis results.

[0089] In the embodiments of the present application, using multiple metric collection tools to collect the target resource metric data and the target business characteristic data can avoid misjudgment caused by the failure of a single tool and ensure the smooth execution of the dynamic scaling of resources in the Kubernetes cluster.

[0090] It should be noted that the data collection device can collect the target resource metric data of the Kubernetes cluster every set period. The set period can be set as needed, such as 1 hour, several hours, one day, etc., and there is no limitation on this.

[0091] S22. Digitally sign the target service feature data to obtain corresponding signature data, and send the target service feature data and the signature data to the Kubernetes cluster so that the Kubernetes cluster can verify the signature data.

[0092] Among them, the data acquisition device can call a signature verification device (such as a signature verification server) to digitally sign the target service feature data. Specifically, the signature verification device can perform chained signing on the target service feature data to further ensure the security of the digital signature.

[0093] Optionally, a set signature algorithm can be used to digitally sign the target service feature data, and the Kubernetes cluster can use a verification algorithm corresponding to the set signature algorithm to verify the signature data. There is no limitation on the set signature algorithm and the corresponding verification algorithm.

[0094] In a possible implementation manner, when digitally signing the target service feature data in S22 above to obtain corresponding signature data, a set hash algorithm can be used to perform a hash operation on the target service feature data to obtain a corresponding hash value; then, the private key of the set encryption algorithm is used to encrypt the hash value to obtain the corresponding signature data. For example, the set hash algorithm includes but is not limited to the SM2 algorithm, and the set encryption algorithm includes but is not limited to the SM3 algorithm.

[0095] Correspondingly, when the Kubernetes cluster performs signature verification on the signature data, it can call the signature verification device, use the public key of the set encryption algorithm to decrypt the signature data to obtain a first hash value, and perform a hash operation on the metric feature data using the set hash algorithm to obtain a second hash value; if the first hash value and the second hash value are the same, it is determined that the signature data verification passes.

[0096] Specifically, a signature verification component can be deployed in the Kubernetes cluster. This signature verification component can be deployed in the master node or in the worker node, and the signature verification component calls the signature verification device to perform signature verification on the signature data.

[0097] It should be noted that the signature verification device called by the Kubernetes cluster can be the same as or different from the signature verification device called by the data acquisition device, and there is no limitation on this.

[0098] In the embodiments of this application, by performing signature verification on the target service feature data, the integrity, authenticity, and non-repudiation of the data can be ensured.

[0099] S23. After the Kubernetes cluster successfully validates the signed data, encrypt the target business feature data to obtain encrypted feature data, and save the encrypted feature data to the database, so that when the Kubernetes cluster performs resource dynamic scaling, it can obtain the encrypted feature data, decrypt it, and determine the resource dynamic scaling method based on the decrypted target business feature data.

[0100] Among them, the data collection device can call a cryptographic device (such as a cipher machine) to encrypt the target business feature data using a set encryption algorithm. For example, the set encryption algorithm includes, but is not limited to, the national cryptographic SM4 algorithm. Specifically, the data collection device calls the management interface of the cryptographic device to create a session key. The cryptographic device generates a session key and encrypts the session key using the session encryption key under a certain index (index) of the cryptographic device. Finally, what the data collection device obtains is the ciphertext of the session key (the key cannot be in plaintext form outside the cryptographic device). Subsequently, the data collection device can pass the ciphertext of the session key and the feature encryption key under a certain index (index) of the cryptographic device through the application interface exposed by the cryptographic device provider to encrypt the target business feature data and obtain the encrypted feature data.

[0101] Correspondingly, when the above set encryption algorithm is a symmetric encryption algorithm, the Kubernetes cluster can use the decryption algorithm corresponding to the above set encryption algorithm to decrypt the encrypted feature data to obtain the target business feature data.

[0102] Specifically, adjustment components (such as the HPA controller and CA controller) can be deployed in the Kubernetes cluster. These adjustment components can be deployed in the master node. The adjustment components can detect data changes in the database. For example, they can detect changes in the binlog of the database through the open-source framework canal, and then detect newly added encrypted feature data. Call the cryptographic device to decrypt the encrypted feature data, and select an appropriate resource dynamic scaling method based on the decrypted target business feature data. The resource dynamic scaling method can specifically include one or more of the following operations: automatically scaling the number of replicas of the Pod, automatically scaling the CPU resource occupancy of the Pod, automatically scaling the memory occupancy of the Pod, automatically scaling the disk occupancy of the Pod, and automatically scaling the number of worker nodes in the Kubernetes cluster.

[0103] Specifically, the HPA controller horizontally adjusts one or more of the replica count, CPU resource occupancy, memory occupancy, and disk occupancy of the pods managed by the deployment, and, the CA controller vertically adjusts the number of worker nodes in the Kubernetes cluster, etc.; among them, the deployment can be deployed in the master node.

[0104] It should be noted that the matching rules between the target business characteristic data and the resource dynamic scaling method can be set according to actual needs and are not limited thereto. For example, according to the target business characteristic data, that is, one or more of the number of running threads, the number of database connections, the number of thread scheduling in the stack, etc., the target index data (such as CPU usage rate, memory occupancy rate, disk occupancy rate, etc.) for automatic scaling is dynamically adjusted, and then, according to the set matching rules, the appropriate resource dynamic scaling method is matched based on the collected real-time index data.

[0105] Exemplarily, taking the HPA controller horizontally adjusting the replica count of the pods managed by the deployment as an example, first, a basic hpa application is created, and the corresponding hpa.yml template is as follows:

[0106]

[0107] Among them, my-hpa is the name of the HPA controller.

[0108] my-deployment is the name of the Deployment that needs to be automatically scaled.

[0109] minReplicas sets the minimum replica count of the Pod, which is 1 here.

[0110] maxReplicas sets the maximum replica count of the Pod, which is 10 here.

[0111] The metrics section defines the metric data used for automatic scaling, which is the CPU usage rate here.

[0112] averageUtilization sets the preset value of the target CPU usage rate, that is, when the average CPU usage rate reaches 50%, if the HPA controller deems it safe to scale out, it may increase the replica count of the Pod.

[0113] Furthermore, after obtaining the target business characteristic data, the HPA controller can dynamically adjust the above hpa.yml template in combination with the target business characteristic data, and execute kubectl apply -f hpa.yml to refresh the metric data for automatic scaling of the HPA controller.

[0114] In practical applications, refer to Figure 6 As shown, through a metrics collection tool (such as Metrics Server) deployed in the Kubernetes cluster, continuously collect the metrics data (such as CPU usage rate) of all Pod replicas in the Kubernetes cluster. The HPA controller obtains this metrics data through the API of the metrics collection tool, and combines with the scaling rules defined in the above hpa.yml to calculate the target number of Pod replicas. When the target number of Pod replicas is inconsistent with the current number of Pod replicas, the HPA controller accesses the Pod replica controller (Deployment, RC, or ReplicaSet) to initiate a Scale operation to adjust the number of Pod replicas and complete the scaling operation. The operation of the CA controller is the same as that of the above HPA controller.

[0115] In the embodiments of the present application, in order to ensure the integrity of the target business feature data, digital signature is performed on the target business feature data to obtain corresponding signature data, and the target business feature data and the signature data are sent to the Kubernetes cluster so that the Kubernetes cluster verifies the signature data; after the Kubernetes cluster verifies the signature data, the target business feature data is encrypted to obtain encrypted feature data, and the encrypted feature data is saved to the database to ensure the security of the target business feature data. Subsequently, when the Kubernetes cluster performs resource dynamic scaling, it can obtain the encrypted feature data and perform decryption processing, and determine the resource dynamic scaling method based on the decrypted target business feature data. Therefore, the embodiments of the present application can ensure the security, integrity, authenticity, and non-repudiation of the target business feature data (i.e., running data) of the Kubernetes cluster, thereby ensuring the smooth execution of resource dynamic scaling.

[0116] In some embodiments, considering that the data collection device can periodically obtain business feature data, in order to prevent duplicate processing of the same business feature data, after the data collection device obtains the corresponding target business feature data and before performing digital signature on the target business feature data, it can also match the target business feature data with other business feature data already recorded in the feature library, determine that there is no other business feature data in the feature library that is the same as the target business feature data, and save the target business feature data to the feature library.

[0117] In a possible implementation, when the data acquisition device matches the target business feature data with the business feature data already recorded in the feature library, a Bloom filter can be used to mark the target business feature data to obtain the corresponding target marking result; wherein, the Bloom filter has already marked other business feature data in the feature library; if the target marking result meets the set conditions, it is determined that there is no other business feature data in the feature library that is the same as the target business feature data.

[0118] Exemplarily, the process of using a Bloom filter to mark the target business feature data is as follows: First, take the target business feature data as an element x, and use N hash functions to calculate the hash values of the element x respectively to obtain N hash values. Then, take the modulo of these N hash values with the length of the bit array respectively to obtain the corresponding positions (i.e., index positions) of each hash value in the array. Finally, set the bit positions of multiple index positions in the bit array to 1, which completes the operation of marking the element x in the Bloom filter. Figure 3 Illustrates the process of marking the element x using 4 hash functions and a bit array with a length of 10. The obtained target marking result is 4 bit positions in the bit array that need to be set to 1, as Figure 3 In, the 4 bit positions that need to be set to 1 are respectively: the bit positions corresponding to No. 1, No. 3, No. 5, and No. 8.

[0119] The target marking result meeting the set conditions means that the values of multiple bit positions in the target marking result are all 1. That is to say, before marking the element x, when the Bloom filter marked other elements, these bit positions had already been set to 1.

[0120] It can be understood that by increasing the number of hashes and the length of the bit array, the false positive rate of the Bloom filter can be reduced. The specific analysis is as follows:

[0121] Suppose that each element is hashed to any one of m slots with equal probability, regardless of which slot other elements are hashed to.

[0122] If m is the length of the bit array, when an element sets the corresponding position of the bit array to 1 based on a certain hash function, for each bit position in the bit array, the probability that this bit position is not set to 1 is: The probability that none of the k hash functions sets this bit position is: If n data (x) are inserted, but none of them sets this bit position, the probability is: Then the probability that this bit is set is:

[0123] Now consider the query phase. For a certain element to be queried, if all the bit positions corresponding to the k index positions calculated based on k hash functions are set to 1, then it can be determined that the element is in the element set.

[0124] It can be understood that the probability of misjudging a certain element is:

[0125] Since when x→0, And when m is very large, tends to 0. Therefore,

[0126] Therefore, increasing the number of hash functions or the length of the bit array will reduce the false positive rate of the Bloom filter.

[0127] In the embodiments of the present application, during the process of the data acquisition device periodically obtaining service feature data, for the currently obtained target service feature data, the target service feature data is matched with other service feature data already recorded in the feature library. When it is determined that there is no other service feature data in the feature library that is the same as the target service feature data, then the target service feature data is digitally signed, which can prevent duplicate processing of the same service feature data and save processing resources.

[0128] Next, in combination with Figure 5 the sorting process of the Kubernetes resource dynamic scaling method in the embodiments of the present application will be introduced.

[0129] As Figure 5 shown, the sorting process of the Kubernetes resource dynamic scaling method includes several sub-processes such as Kubernetes metric analysis, feature library, national cryptography production safety, and Kubernetes resource dynamic scaling; among them, the data acquisition device can execute Kubernetes metric analysis, feature library, and national cryptography production safety, and the Kubernetes cluster can execute Kubernetes resource dynamic scaling. In the Kubernetes metric analysis sub-process, the Kubernetes cluster is monitored for metrics through a variety of metric collection tools, and the collected target resource metric data is analyzed. When the target resource metric data meets the preset threshold conditions, feature data (i.e., the target service feature data in the above embodiments) is obtained, and the Bloom filter is used for hash collision and Bloom filtering of the feature data. If the feature data is matched, the process ends. If the feature data is not matched, the signature verification device is called to digitally sign the plaintext of the feature data, and after the obtained signature data is verified and passed, the cryptographic device is called to encrypt the plaintext of the feature data into ciphertext of the feature data, and the ciphertext of the feature data is saved to the database.

[0130] After that, the Kubernetes cluster obtains the ciphertext of the feature data from the database, calls the cryptographic device to decrypt the ciphertext of the feature data into the plaintext of the feature data, and then analyzes the plaintext of the feature data to perform dynamic scaling of Kubernetes resources.

[0131] In the embodiment of the present application, while the Kubernetes cluster performs dynamic scaling of resources, the security of the target service feature data is ensured, preventing it from being intercepted and illegally tampered with by a man-in-the-middle. Moreover, multiple metric collection tools can be combined to converge the target resource metric data and the target service feature data, preventing the failure of a single metric collection tool from affecting the dynamic scaling of resources in the Kubernetes cluster.

[0132] In addition, all access traffic of the Kubernetes cluster and the behavior of calling the cryptographic device can be recorded as logs, and the MAC (Media Access Control Address) value generated from the logs is recorded in the database. By periodically detecting the logs in the database and comparing the MAC values, it is possible to detect whether the logs have been tampered with manually, and it is also convenient for later auditors to audit and understand the operation of the project at different time periods.

[0133] Based on the same inventive concept, the embodiment of the present application provides a method for dynamically scaling Kubernetes resources, which is executed by the Kubernetes cluster. As Figure 4 shown, the specific implementation process of this method includes the following S41 - S43:

[0134] S41. Obtain the target service feature data and the corresponding signature data; among them, the target service feature data is obtained after the data collection device collects the target resource metric data of the Kubernetes cluster and determines that the target resource metric data meets the preset threshold condition, and the signature data is obtained after digitally signing the target service feature data.

[0135] Among them, a signature verification component is deployed in the Kubernetes cluster, and this signature verification component can be deployed in the master node or in the worker node. The signature verification component calls the signature verification device to verify the signature data.

[0136] S42. Verify the signature data based on the target service feature data. After the verification passes, send a verification passed message to the data collection device, so that the data collection device encrypts the target service feature data and saves the obtained encrypted feature data to the database.

[0137] Specifically, a signature verification device can be called to verify the signature data based on the target service characteristic data. When the data acquisition device digitally signs the target service characteristic data using a set signature algorithm, the Kubernetes cluster can use a verification algorithm corresponding to the set signature algorithm to verify the signature data. There are no restrictions on the set signature algorithm and the corresponding verification algorithm.

[0138] In a possible implementation, when the data acquisition device digitally signs the target service characteristic data, it performs a hashing operation on the target service characteristic data using a set hashing algorithm to obtain a corresponding hash value; then, it encrypts the hash value using the private key of a set encryption algorithm to obtain corresponding signature data. When the Kubernetes cluster performs signature verification on the signature data, it can decrypt the signature data using the public key of the set encryption algorithm to obtain a first hash value, and perform a hashing operation on the metric characteristic data using the set hashing algorithm to obtain a second hash value; if the first hash value and the second hash value are the same, it is determined that the signature data verification is passed. For example, the set hashing algorithm includes but is not limited to the SM2 algorithm, and the set encryption algorithm includes but is not limited to the SM3 algorithm.

[0139] S43. When performing resource dynamic scaling, obtain encrypted characteristic data from the database, decrypt the encrypted characteristic data, and determine the resource dynamic scaling method based on the decrypted target service characteristic data.

[0140] Specifically, adjustment components (such as the HPA controller and the CA controller) can be deployed in the Kubernetes cluster. These adjustment components can be deployed in the master node. The adjustment components can detect changes in the data in the database. For example, they can detect changes in the binlog of the database through the open-source framework canal, and then detect newly added encrypted characteristic data, call the cryptographic device to decrypt the encrypted characteristic data, and match a suitable resource dynamic scaling method according to the decrypted target service characteristic data.

[0141] For the specific implementation processes of the above S41 - S43, reference can be made to the relevant content involved in the above embodiments of this application, which will not be elaborated here.

[0142] Based on the same inventive concept, the embodiments of this application also provide a Kubernetes resource dynamic scaling device. The principle of this device for solving problems is similar to that of the method in the above embodiments. Therefore, the implementation of this device can refer to the implementation of the above method, and the repeated parts will not be elaborated.

[0143] As Figure 7 shown, the embodiments of this application provide a Kubernetes resource dynamic scaling device 700, which is set in the data acquisition device and includes:

[0144] The acquisition module 701 is used to acquire the target resource metric data of the Kubernetes cluster. When the target resource metric data meets the preset threshold condition, it obtains the target business feature data associated with the target resource metric data.

[0145] The signature module 702 is used to digitally sign the target business feature data, obtain the corresponding signature data, and send the target business feature data and the signature data to the Kubernetes cluster so that the Kubernetes cluster can verify the signature data.

[0146] The encryption module 703 is used to, after the Kubernetes cluster successfully verifies the signature data, encrypt the target business feature data to obtain encrypted feature data, and save the encrypted feature data to the database so that when the Kubernetes cluster performs resource dynamic scaling, it can obtain the encrypted feature data, decrypt it, and determine the resource dynamic scaling method based on the decrypted target business feature data.

[0147] In a possible implementation manner, the acquisition module 701 is specifically used for:

[0148] Based on the real-time resource metric data of the Kubernetes cluster collected by various metric collection tools, obtain the target resource metric data;

[0149] When the target resource metric data meets the preset threshold condition, based on the real-time business feature data collected by various metric collection tools, obtain the target business feature data.

[0150] In a possible implementation manner, the device further includes a matching module, which is used for:

[0151] Match the target business feature data with other business feature data already recorded in the feature library, determine that there is no other business feature data in the feature library that is the same as the target business feature data, and save the target business feature data to the feature library.

[0152] In a possible implementation manner, the matching module is specifically used for:

[0153] Use a Bloom filter to mark the target business feature data to obtain the corresponding target marking result; wherein, the Bloom filter has already marked other business feature data in the feature library;

[0154] If the target marking result meets the set condition, it is determined that there is no other business feature data in the feature library that is the same as the target business feature data.

[0155] In a possible implementation manner, the signature module 702 is specifically used for:

[0156] Perform a hashing operation on the target service feature data using a set hashing algorithm to obtain a corresponding hash value;

[0157] Perform an encryption process on the hash value using the private key of a set encryption algorithm to obtain corresponding signature data.

[0158] Based on the same inventive concept, an embodiment of the present application further provides a Kubernetes resource dynamic scaling device. The principle of the device for solving problems is similar to that of the method in the above embodiment. Therefore, the implementation of the device can refer to the implementation of the above method, and the repeated parts will not be elaborated.

[0159] As Figure 8 shown, an embodiment of the present application provides a Kubernetes resource dynamic scaling device 800, which is set in a Kubernetes cluster and includes:

[0160] An acquisition module 801, configured to acquire target service feature data and corresponding signature data; wherein, the target service feature data is used to characterize the service operation condition of the Kubernetes cluster, and is acquired by a data acquisition device when determining that the target resource metric data of the Kubernetes cluster meets a preset threshold condition, and the signature data is obtained after performing a digital signature on the target service feature data;

[0161] A verification module 802, configured to verify the signature data based on the target service feature data. After the verification passes, send a verification passed message to the data acquisition device, so that the data acquisition device performs an encryption process on the target service feature data and saves the obtained encrypted feature data to a database;

[0162] A decryption module 803, configured to, when performing resource dynamic scaling, acquire the encrypted feature data from the database, perform a decryption process on the encrypted feature data, and determine a resource dynamic scaling method based on the decrypted target service feature data.

[0163] In a possible implementation manner, the verification module 802 is specifically configured to:

[0164] Decrypt the signature data using the public key of a set encryption algorithm to obtain a first hash value, and perform a hashing operation on the metric feature data using a set hashing algorithm to obtain a second hash value;

[0165] If the first hash value and the second hash value are consistent, it is determined that the signature data verification passes.

[0166] After introducing the Kubernetes resource dynamic scaling method and device of the exemplary embodiment of the present application, next, an electronic device according to another exemplary embodiment of the present application is introduced.

[0167] Based on the same inventive concept as the above method embodiments, an embodiment of the present application further provides an electronic device. In this embodiment, the structure of the electronic device may be as Figure 9 shown, including a memory 901, a communication module 903, and one or more processors 902.

[0168] The memory 901 is used to store the computer program executed by the processor 902. The memory 901 may mainly include a program storage area and a data storage area. Among them, the program storage area may store an operating system and programs required to run the instant messaging function, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0169] The memory 901 may be a volatile memory, such as a random-access memory (RAM); the memory 901 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD); or the memory 901 is any other medium that can be used to carry or store a desired computer program in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 901 may be a combination of the above memories.

[0170] The processor 902 may include one or more central processing units (CPUs) or be a digital processing unit, etc. The processor 902 is used to implement the above Kubernetes resource dynamic scaling method when calling the computer program stored in the memory 901.

[0171] The communication module 903 is used to communicate with other electronic devices.

[0172] In the embodiment of the present application, the specific connection medium between the above memory 901, communication module 903, and processor 902 is not limited. In the embodiment of the present application Figure 9 it is described that the memory 901 and the processor 902 are connected through a bus 904. The bus 904 is described in thick lines in Figure 9 The connection manners of other components are only for illustrative purposes and are not to be taken as limiting. The bus 904 may be divided into an address bus, a data bus, a control bus, etc. For the sake of convenience of description, Figure 9 it is only described by a thick line in

[0173] An embodiment of the present application provides a computer-readable storage medium storing a computer program. When the computer program runs on an electronic device, the computer program is used to cause the electronic device to execute the Kubernetes resource dynamic scaling method in the above embodiment, as Figure 2 shown.

[0174] The computer-readable storage medium in the above embodiment can be any available medium or data storage device accessible by a processor in the device, including but not limited to magnetic memories such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc., optical memories such as CDs, DVDs, BDs, HVDs, etc., and semiconductor memories such as ROMs, EPROMs, EEPROMs, non-volatile memories (NAND FLASH), solid-state drives (SSD), etc.

[0175] In some possible implementation manners, each aspect of the Kubernetes resource dynamic scaling method provided by the embodiment of the present application can also be implemented in the form of a computer program product, which includes a computer program. When the program product runs on a communication device, the computer program is used to cause the communication device to execute the steps in the Kubernetes resource dynamic scaling method according to various exemplary embodiments of the present application described above in this specification. For example, the communication device can execute as Figure 2 shown in the steps.

[0176] The computer program product can adopt any combination of one or more readable media. The readable media can be a readable signal medium or a readable storage medium. The readable storage medium can, for example, be but is not limited to an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples (non-exhaustive list) of the readable storage medium include: an electrical connection having one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0177] The program product of the embodiment of the present application can adopt a portable compact disk read-only memory (CD-ROM) and include a computer program, and can run on a communication device. However, the program product of the present application is not limited thereto. In this document, the readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with a command execution system, apparatus, or device.

[0178] A readable signal medium can include a data signal propagated in a baseband or as part of a carrier wave, which carries a readable computer program. Such a propagated data signal can take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable signal medium can also be any readable medium other than a readable storage medium, which can send, propagate, or transmit a program for use by or in conjunction with a command execution system, apparatus, or device.

[0179] The computer program contained on the readable medium can be transmitted by any appropriate medium, including but not limited to wireless, wired, optical fiber cable, RF, etc., or any suitable combination of the above.

[0180] The computer program for performing the operations of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages such as Java, C++, etc., and also including conventional procedural programming languages such as the "C" language or similar programming languages. The computer program can be executed entirely on the user communication device, partially on the user communication device, executed as a stand-alone software package, partially on the user communication device and partially on a remote communication device, or entirely on the remote communication device or server. In the case of a remote communication device, the remote communication device can be connected to the user communication device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external communication device (for example, by using an Internet service provider to connect through the Internet).

[0181] It should be noted that although several units or subunits of the apparatus are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of the two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0182] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, some steps can be omitted, multiple steps can be combined into one step for execution, and / or one step can be decomposed into multiple steps for execution.

[0183] Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk memory, CD-ROM, optical memory, etc.) that contain computer-usable computer programs.

[0184] Although the preferred embodiments of the present application have been described, those skilled in the art can make additional changes and modifications to these embodiments once they learn the basic creative concepts. Therefore, the appended claims are intended to be construed as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0185] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these changes and modifications.

Claims

1. A Kubernetes resource dynamic scaling method, characterized in that: Applied to data acquisition equipment, including: Collect target resource indicator data of the Kubernetes cluster, and when the target resource indicator data meets a preset threshold condition, obtain corresponding target business feature data; the target business feature data is used to characterize the business operation status of the Kubernetes cluster; Digitally sign the target service feature data to obtain corresponding signature data, and send the target service feature data and the signature data to the Kubernetes cluster so that the Kubernetes cluster verifies the signature data; After the Kubernetes cluster verifies the signature data, it encrypts the target business feature data to obtain encrypted feature data, and saves the encrypted feature data to a database, so that when the Kubernetes cluster performs dynamic resource scaling, it obtains the encrypted feature data and decrypts it, and determines the dynamic resource scaling method based on the decrypted target business feature data.

2. The method according to claim 1, characterized in that The collecting of target resource indicator data of the Kubernetes cluster and obtaining corresponding target business feature data when the target resource indicator data meets a preset threshold condition include: Based on the real-time resource indicator data of the Kubernetes cluster collected by multiple indicator collection tools, the target resource indicator data is obtained; When the target resource indicator data meets a preset threshold condition, the target service characteristic data is obtained based on the real-time service characteristic data respectively collected by the multiple indicator collection tools.

3. The method according to claim 1 or 2, characterized in that: After obtaining the corresponding target service characteristic data and before digitally signing the target service characteristic data, the method further includes: The target service feature data is matched with other service feature data recorded in a feature library, it is determined that other service feature data identical to the target service feature data does not exist in the feature library, and the target service feature data is saved in the feature library.

4. The method according to claim 3, characterized in that The matching of the target service feature data with other service feature data recorded in a feature library, determining that no other service feature data identical to the target service feature data exists in the feature library, and saving the target service feature data to the feature library includes: Using a Bloom filter to mark the target service feature data to obtain a corresponding target marking result; wherein the Bloom filter has marked other service feature data in the feature library; If the target marking result meets the set condition, it is determined that there is no other service feature data identical to the target service feature data in the feature library.

5. The method according to claim 1 or 2, characterized in that: The step of digitally signing the target service characteristic data to obtain corresponding signature data includes: Performing a hash operation on the target service characteristic data using a set hash algorithm to obtain a corresponding hash value; The hash value is encrypted using a private key of a set encryption algorithm to obtain corresponding signature data.

6. A Kubernetes resource dynamic scaling method, characterized in that: Applied to Kubernetes cluster, including: Obtain target business characteristic data and corresponding signature data; wherein the target business characteristic data is obtained after the data acquisition device collects the target resource indicator data of the Kubernetes cluster and determines that the target resource indicator data meets the preset threshold condition, and the signature data is obtained by digitally signing the target business characteristic data; Verifying the signature data based on the target service feature data, and when the verification is successful, sending verification success information to the data acquisition device, so that the data acquisition device encrypts the target service feature data and saves the obtained encrypted feature data to the database; When dynamic resource scaling is performed, the encrypted feature data is obtained from the database, and the encrypted feature data is decrypted, and the dynamic resource scaling mode is determined based on the decrypted target service feature data.

7. The method according to claim 6, characterized in that The performing signature verification on the signature data includes: Decrypting the signature data using the public key of the set encryption algorithm to obtain a first hash value, and performing a hash operation on the indicator feature data using the set hash algorithm to obtain a second hash value; If the first hash value and the second hash value are consistent, it is determined that the signature data verification is successful.

8. A Kubernetes resource dynamic scaling device, characterized in that: Set in data acquisition equipment, including: A collection module is used to collect target resource indicator data of the Kubernetes cluster, and when the target resource indicator data meets a preset threshold condition, obtain target business feature data associated with the target resource indicator data; A signature module, used to digitally sign the target service feature data, obtain corresponding signature data, and send the target service feature data and the signature data to the Kubernetes cluster, so that the Kubernetes cluster verifies the signature data; The encryption module is used to encrypt the target business feature data after the Kubernetes cluster verifies the signature data, obtain the encrypted feature data, and save the encrypted feature data to a database, so that when the Kubernetes cluster performs dynamic resource scaling, it can obtain the encrypted feature data and decrypt it, and determine the dynamic resource scaling mode based on the decrypted target business feature data.

9. A Kubernetes resource dynamic scaling device, characterized in that: Set up in a Kubernetes cluster, including: An acquisition module is used to acquire target business characteristic data and corresponding signature data; wherein the target business characteristic data is used to characterize the business operation status of the Kubernetes cluster, and is acquired by the data acquisition device when determining that the target resource indicator data of the Kubernetes cluster meets a preset threshold condition, and the signature data is obtained by digitally signing the target business characteristic data; A verification module, used to verify the signature data based on the target service feature data, and when the verification is passed, send verification pass information to the data acquisition device, so that the data acquisition device encrypts the target service feature data and saves the obtained encrypted feature data to the database; The decryption module is used to obtain the encrypted characteristic data from the database and decrypt the encrypted characteristic data when performing dynamic resource scaling, and determine the dynamic resource scaling mode based on the decrypted target service characteristic data.

10. An electronic device, characterized in that: It comprises a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of any one of the methods of claims 1 to 7.

11. A computer-readable storage medium, characterized in that: It comprises a computer program. When the computer program is run on a communication device, the computer program is used to make the communication device execute the steps of any one of the methods of claims 1 to 7.

Images