Container scheduling method and device, equipment, storage medium and program product

Abstract

The invention relates to a container scheduling method and device, equipment, a storage medium and a program product, in particular to the technical field of cloud native. Comprising the following steps: firstly, acquiring security states of a plurality of servers, and dynamically setting corresponding security levels for the servers according to the states, so that the real-time security situation of each server can be deeply known, the security levels of the servers can be timely responded and adjusted, key services are prevented from being scheduled to attacked or attacked server nodes, and the security of the servers is improved. Therefore, the safety risk is effectively reduced; in addition, according to the expected security level of the container, the matched target server is selected from the multiple servers as the deployable node, it is ensured that the container can be deployed to the server matched with the security requirement of the container, and the security of the system is further enhanced.

Description

Technical Field

[0001] This application relates to the field of cloud native technologies, and in particular, to a container scheduling method, apparatus, device, storage medium, and program product. Background Art

[0002] With the rapid development of the Internet, cloud native technologies based on the container orchestration system (Kubernetes, K8S) engine have been widely used. K8S can automatically allocate the smallest scheduling unit, the container (Pod), to a suitable node for running according to the real-time state of the cluster (such as node resource usage, application load changes, etc.). It can adaptively adjust the distribution of containers to optimize resource utilization, improve application performance and reliability.

[0003] However, the K8S scheduling technology has the following significant technical problems in practical applications: First, there is a serious lack in the aspect of security awareness. K8S scheduling performs balanced scheduling with resource usage as the core, but it cannot understand the security situation of server nodes. This leads to the situation that once a server node is attacked or even has been hacked and controlled by hackers, K8S may still schedule critical services to this node, thus triggering new security risks. Second, the scheduling flexibility is limited. K8S scheduling relies on static labels specified in the container startup configuration to deploy containers to corresponding server nodes. However, these server labels are mostly static parameters and are difficult to flexibly adjust during operation, greatly limiting the dynamic adaptability of scheduling policies. Third, the dynamic response ability is insufficient. When the label settings of server nodes change due to various factors, K8S only deploys and manages newly started containers according to the new labels, but does not make any redeployment adjustments to the already started containers, and cannot respond in a timely manner to the changes in scheduling requirements brought about by label changes. Summary of the Invention

[0004] In order to solve the above technical problems or at least partially solve the above technical problems, this application provides a container scheduling method, apparatus, device, storage medium, and program product, which can solve the problems of lack of security awareness, limited scheduling flexibility, and insufficient dynamic response ability in related technologies.

[0005] To achieve the above object, the technical solutions provided by the embodiments of this application are as follows:

[0006] In a first aspect, this application provides a container scheduling method, including: obtaining the security statuses of multiple servers; setting corresponding security levels for the multiple servers according to the security statuses; and selecting a matching target server from the multiple servers as a deployable node according to the expected security level of the container.

[0007] As an alternative implementation provided by the embodiments of the present application, obtaining the security status of multiple servers includes: monitoring security status adjustment events of at least one server, and determining the current security status corresponding to the security status adjustment event.

[0008] As an alternative implementation provided by the embodiments of the present application, the method further includes: when the security status adjustment event indicates a decrease in the security level, evicting the containers on the server whose expected security level is higher than the current security level, and rescheduling them to other matching servers.

[0009] As an alternative implementation provided by the embodiments of the present application, setting corresponding security levels for multiple servers according to the security status includes: when the security status indicates that the server has no high-risk vulnerabilities and has not been attacked, determining that the security level of the server is high security; when the security status indicates that the server has no high-risk vulnerabilities, has been attacked but has not been compromised, determining that the security level of the server is medium security; when the security status indicates that the server has no high-risk vulnerabilities, has been attacked and has been compromised, determining that the security level of the server is low security; when the security status indicates that the server has high-risk vulnerabilities but has not been attacked, determining that the security level of the server is medium security; when the security status indicates that the server has high-risk vulnerabilities, has been attacked but has not been compromised, determining that the security level of the server is low security; when the security status indicates that the server has high-risk vulnerabilities, has been attacked and has been compromised, determining that the security level of the server is low security.

[0010] As an alternative implementation provided by the embodiments of the present application, selecting a matching target server as a deployable node for a container according to the expected security level of the container includes: obtaining the configuration parameters of the container, where the configuration parameters indicate the expected security level of the container; adding a corresponding tolerance label to the container according to the configuration parameters; and selecting the target server corresponding to the tolerance label as the deployable node for the container according to the tolerance label.

[0011] In a second aspect, the present application provides a container scheduling device, which includes:

[0012] A security status acquisition module, configured to obtain the security status of multiple servers;

[0013] A security level setting module, configured to set corresponding security levels for the multiple servers according to the security status;

[0014] A selection module, configured to select a matching target server as a deployable node from the multiple servers according to the expected security level of the container.

[0015] As an alternative implementation provided by an embodiment of the present application, the security status acquisition module is specifically configured to: monitor security status adjustment events of at least one server and determine the current security status corresponding to the security status adjustment event.

[0016] As an alternative implementation provided by an embodiment of the present application, the container scheduling device further includes a dynamic scheduling module, configured to: when the security status adjustment event indicates a decrease in the security level, evict containers on the server whose expected security level is higher than the current security level and reschedule them to other matching servers.

[0017] As an alternative implementation provided by an embodiment of the present application, the security level setting module is specifically configured to: when the security status indicates that the server has no high-risk vulnerabilities and has not been attacked, determine that the security level of the server is high security; when the security status indicates that the server has no high-risk vulnerabilities, has been attacked but not compromised, determine that the security level of the server is medium security; when the security status indicates that the server has no high-risk vulnerabilities, has been attacked and compromised, determine that the security level of the server is low security; when the security status indicates that the server has high-risk vulnerabilities but has not been attacked, determine that the security level of the server is medium security; when the security status indicates that the server has high-risk vulnerabilities and has been attacked but not compromised, determine that the security level of the server is low security; when the security status indicates that the server has high-risk vulnerabilities, has been attacked and compromised, determine that the security level of the server is low security.

[0018] As an alternative implementation provided by an embodiment of the present application, the selection module 203 is specifically configured to: obtain configuration parameters of the container, where the configuration parameters indicate the expected security level of the container; add corresponding tolerance tags to the container according to the configuration parameters; and select a target server corresponding to the tolerance tag as a deployable node for the container according to the tolerance tag.

[0019] In a third aspect, the present application provides an electronic device, including: a processor, a memory, and a computer program stored on the memory and executable on the processor, where when the computer program is executed by the processor, it implements the container scheduling method as described in the first aspect or any of its alternative implementations.

[0020] In a fourth aspect, the present application provides a computer-readable storage medium, including: a computer program stored on the computer-readable storage medium, where when the computer program is executed by a processor, it implements the container scheduling method as described in the first aspect or any of its alternative implementations.

[0021] In a fifth aspect, the present application provides a computer program product, including: the computer program product includes a computer program, which, when running on a computer, enables the computer to implement the container scheduling method as described in the first aspect or any one of its alternative embodiments.

[0022] The technical solutions provided in the embodiments of the present application have the following advantages compared with the prior art:

[0023] The embodiments of the present disclosure provide a container scheduling method, device, equipment, storage medium and program product. The method first obtains the security status of multiple servers, and then dynamically sets corresponding security levels for the servers according to these statuses, which can deeply understand the real-time security situation of each server, timely respond and adjust the security level of the server, and avoid scheduling key services to server nodes that have been attacked or compromised, thereby effectively reducing security risks; according to the expected security level of the container, a matching target server is selected from multiple servers as the deployable node, ensuring that the container can be deployed to a server that matches its security requirements, further enhancing the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and are used together with the specification to explain the principles of the present application.

[0025] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without creative efforts.

[0026] Figure 1 It is a schematic flowchart of a container scheduling method provided by an embodiment of the present application;

[0027] Figure 2A It is a schematic diagram of a container scheduling method provided by an embodiment of the present application;

[0028] Figure 2B It is a schematic diagram of another container scheduling method provided by an embodiment of the present application;

[0029] Figure 3 It is a schematic structural diagram of a container scheduling device provided by an embodiment of the present application;

[0030] Figure 4 It is a schematic structural diagram of an electronic device described in an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0031] To more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the technical terms used in the description of the embodiments or the prior art.

[0032] The YAML (Yet Another Markup Language) configuration file of a container is a file used to configure containerized applications or container orchestration systems and is written in the YAML format. YAML is a human-readable data serialization format that presents data in a concise text form, using indentation and specific symbols (such as colons, hyphens, etc.) to represent data structures. In the YAML configuration file of a container, data is organized in the form of key-value pairs, lists, etc., with a clear structure, making it easy to write and read. When using container orchestration tools (such as Kubernetes), the YAML configuration file can be used to describe an application composed of multiple containers and their relationships, including the deployment method of services, the number of replicas, load balancing rules, etc.

[0033] In order to be able to more clearly understand the above-mentioned objects, features, and advantages of the present application, the following will further describe the solutions of the present application. It should be noted that, without conflict, the embodiments of the present application and the features in the embodiments can be combined with each other.

[0034] Many specific details are set forth in the following description in order to provide a thorough understanding of the present application, but the present application may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only a part of the embodiments of the present application, rather than all of the embodiments.

[0035] To solve some or all of the technical problems existing in the related art, an embodiment of the present application provides a container scheduling method, device, equipment, storage medium, and program product, where the method...

[0036] A container scheduling method provided in an embodiment of the present application can be implemented by a container scheduling device or an electronic device. The electronic device includes but is not limited to a personal computer, a laptop computer, a tablet computer, a smart phone, etc. The operating system of the electronic device can include Android, iOS developed by Apple Inc., Windows developed by Microsoft Corporation in the United States, etc., and the embodiments of the present application do not limit this. The electronic device can run alone to implement the present application, or can be connected to the network and implement the present application through interaction with other computer devices in the network. Among them, the network where the electronic device is located includes but is not limited to the Internet, wide area network, metropolitan area network, local area network, virtual private (Virtual Private Network, VPN) network, etc.

[0037] It should be noted that the protection scope of the container scheduling method described in the embodiments of the present application is not limited to the execution order of the steps listed in this embodiment. Any solution achieved by adding or reducing steps of the prior art and replacing steps according to the principle of the present application is included in the protection scope of the present application.

[0038] As Figure 1 shown, Figure 1 is a schematic flowchart of a container scheduling method according to an embodiment of the present application. This method can be executed by a container scheduling device, where the device can be implemented by software and / or hardware and is generally integrated in an electronic device. The method mainly includes the following steps S101 to S103:

[0039] S101. Obtain the security status of multiple servers.

[0040] In the present application, the container scheduling management center obtains the server security detection results provided by a third-party security module, and determines the security status of multiple servers based on the server security detection results. The third-party security module performs real-time scanning on the servers to discover server vulnerabilities for security detection.

[0041] Among them, the security status is related to the presence or absence of high-risk vulnerabilities, whether it has been attacked, and whether it has been compromised. The security status includes no high-risk vulnerabilities and not attacked, no high-risk vulnerabilities but attacked and not compromised, no high-risk vulnerabilities but attacked and compromised, having high-risk vulnerabilities but not attacked, having high-risk vulnerabilities and attacked but not compromised, and having high-risk vulnerabilities and attacked and compromised.

[0042] In some embodiments, monitor at least one server's security status adjustment event, and determine the current security status corresponding to the security status adjustment event.

[0043] After the container scheduling management center adjusts the security status of at least one server, it triggers a security status adjustment event. When this event is monitored, it determines the current security status of the server, which is the adjusted security status.

[0044] S102. Set corresponding security levels for the multiple servers according to the security status.

[0045] The container scheduling management center sets corresponding security levels for each server according to its security status.

[0046] When the security status indicates that the server has no high-risk vulnerabilities and has not been attacked, determine that the security level of the server is high security; when the security status indicates that the server has no high-risk vulnerabilities, has been attacked but not compromised, determine that the security level of the server is medium security; when the security status indicates that the server has no high-risk vulnerabilities, has been attacked and compromised, determine that the security level of the server is low security; when the security status indicates that the server has high-risk vulnerabilities and has not been attacked, determine that the security level of the server is medium security; when the security status indicates that the server has high-risk vulnerabilities, has been attacked but not compromised, determine that the security level of the server is low security; when the security status indicates that the server has high-risk vulnerabilities, has been attacked and compromised, determine that the security level of the server is low security. As shown in Table 1.

[0047] Table 1

[0048]

[0049] Exemplarily, when the security status indicates that the server has no high-risk vulnerabilities, has been attacked but not compromised, set the security level of the server to medium security, securitylevel = middle. When the security status indicates that the server has high-risk vulnerabilities, has been attacked and compromised, set the security level of the server to low security, securitylevel = low.

[0050] In some embodiments, after performing step S102 (setting corresponding security levels for multiple servers according to the security status), set taint labels (taints) for the servers. Specifically, for a server with a security level of high security, set the taint label to be empty, which can be understood as no taint setting for the high-security server; for a server with a security level of medium security, set the taint label to medium security, setting a medium-security taint for the medium-security server; for a server with a security level of low security, set the taint label to low security, setting a low-security node for the low-security server.

[0051] For a high-security server, since its taint label is empty, it means there are no special restrictions and it may be preferentially scheduled to deploy containers with high security requirements and no special taint tolerance requirements. After setting the corresponding taint labels for medium-security and low-security servers, containers configured with corresponding taint tolerances can be scheduled to these servers.

[0052] In the above embodiments, by setting different taint labels, the container orchestration system (such as Kubernetes) can better control the scheduling of container groups on servers. Thus, resource isolation at different security levels is achieved, preventing workloads with low security levels from affecting servers with high security levels, and improving the rationality and security of resource scheduling. By setting taint labels for servers with different security levels, workloads can be reasonably allocated to corresponding servers according to their security and resource requirements. This can avoid deploying workloads with low security requirements on high-security servers, resulting in resource waste, thereby improving the overall resource utilization rate and reducing operating costs.

[0053] S103. Select a matching target server from multiple servers as a deployable node according to the expected security level of the container.

[0054] Among them, the expected security level of the container indicates the level of the security environment in which the container is expected to run, and is set through configuration parameters in the container's YAML configuration file. The expected security levels include high, medium, and low. For example, expectlevel = high / middle / low. If the configuration parameter is not set, it means the expected security level is low. The configuration parameter supports extension, and more security levels can be introduced to meet different security requirements. For containers in different business scenarios, different expected security levels can be set, and the scheduling system will perform reasonable scheduling according to these settings, improving the flexibility and pertinence of scheduling.

[0055] Exemplarily, some applications that process sensitive data (such as financial transactions, personal privacy information) may require a high level of security guarantee, and the configuration parameter expectlevel = high is set. Through the setting of the configuration parameter, the POD can clearly express its expected security environment, enabling the container orchestration system to schedule it to a server that matches its security level, avoiding deploying applications with high security requirements in a low-security environment, thereby reducing security risks.

[0056] When performing container deployment and management in step S103, the operation and maintenance personnel do not need to manually judge the security requirements of each POD and perform scheduling. The POD automatically indicates the expected security level through the expectlevel parameter, and the container orchestration system can automatically complete the scheduling based on this information, reducing manual intervention, lowering the possibility of human errors, and simplifying the operation and maintenance decision-making process.

[0057] In some embodiments, when executing step S103, first obtain the configuration parameters of the container, then add corresponding tolerance labels to the container according to the configuration parameters, and then select a corresponding target server as the deployable node for the container according to the tolerance labels of the container.

[0058] Specifically, the container scheduling management center adds corresponding toleration labels toleration to the container according to the configuration parameter expectlevel. The configuration parameter expectlevel = low indicates that the container is expected to run on a low-security server, and the toleration label toleration = middle / low is added, indicating that the container can run on a low-security or medium-security server. The configuration parameter expectlevel = middle indicates that the container is expected to run on a medium-security server, and the toleration label toleration = high / middle is added, indicating that the container can run on a medium-security or high-security server. The configuration parameter expectlevel = high indicates that the container is expected to run on a high-security server. According to the toleration label of the container, a corresponding target server is selected as the deployable node for the container. For example, if the toleration label of the container is toleration = high / middle, a medium-security server is selected as the deployable node for the container, or a high-security server is selected as the deployable node for the container. This avoids potential security risks caused by scheduling to a low-security-level server, realizes the precise matching of security requirements and server security levels, and enhances the security of the entire system.

[0059] Exemplarily, as Figure 2A shown, assume there are three servers: Server-1, Server-2, and Server-3. The security level of Server-1 is high, and there is no taint label; the security level of Server-2 is high, and there is no taint label; the security level of Server-3 is medium, and the taint label taints is medium middle. The expected security level of Container A is high, and there is no toleration label. Accordingly, the matching Server-1 can be selected as the deployable node. The expected security level of Container B is high, and there is no toleration label. Accordingly, the matching Server-2 can be selected as the deployable node. The expected security level of Container C is medium, and the toleration label toleration = middle. Accordingly, the matching Server-1 can be selected as the deployable node. The expected security level of Container D is medium, and the toleration label toleration = middle. Accordingly, the matching Server-3 can be selected as the deployable node. The expected security level of Container E is low, and the toleration label toleration = middle / low. Accordingly, the matching Server-2 can be selected as the deployable node. The expected security level of Container F is low, and the toleration label toleration = middle / low. Accordingly, the matching Server-3 can be selected as the deployable node.

[0060] In the above embodiments, the container scheduling center automatically adds the corresponding tolerance according to the expected security level of the container, which can ensure that the container is scheduled to a server node that meets its security requirements. Through the setting of tolerance, PODs with different security levels will be isolated on server nodes with corresponding security levels, forming an effective security isolation zone and reducing the possibility of security incidents spreading between different security regions.

[0061] The above step S103 performs reasonable scheduling according to the security requirements of the POD, which can make full use of servers with different security levels. Low-security servers can host those PODs with low security requirements, avoiding resource idleness and improving the resource utilization rate of the entire cluster.

[0062] In some embodiments, when the security status adjustment event indicates a decrease in the security level, containers on the server with an expected security level higher than the current security level are evicted and rescheduled to other matching servers. After determining the current security status corresponding to the security status adjustment event, it is judged whether the current security level corresponding to the current security status is lower than the security level before the adjustment. If so, it means that there may be mismatched containers on the server, and then containers on the server with an expected security level higher than the current security level are evicted and rescheduled to other matching servers.

[0063] Exemplarily, as Figure 2B shown, if Server-2 was originally at a high-security level and its security level was reduced to low-security due to an attack or configuration change, at this time, container B that expects a high-security environment is migrated to Server-1 at a high-security level in a timely manner, which can prevent security incidents such as leakage of sensitive data.

[0064] In the above embodiments, when a security status adjustment event occurs on the server, especially when the security level decreases, containers with an expected security level higher than the adjusted level are evicted, which can quickly isolate containers with high security requirements from the environment with security risks, avoid these containers from being threatened by possible security threats, and ensure the security and stability of high-security requirement services. Rescheduling the containers according to the latest security situation and timely adjusting the deployment location of the containers can make full use of the performance of servers with different security levels, avoid resource idleness and waste, and improve the resource utilization rate of the entire cluster. The scheduling center automatically executes container eviction and rescheduling operations, reducing manual intervention and improving the efficiency and accuracy of handling security level decrease events. When the system faces abnormal situations such as a decrease in the security level, it can quickly respond and self-adjust, and recover to a safe and stable operating state faster, enhancing the system's anti-risk ability and recovery ability.

[0065] In addition, when the server fixes a security vulnerability, its security level can be correspondingly increased, and the scheduling system can schedule more containers with high security requirements to this server, improving the flexibility and dynamic adaptability of scheduling.

[0066] In summary, a container scheduling method provided by an embodiment of the present application has the following beneficial effects:

[0067] (1) This scheduling method first obtains the security status of multiple servers, and then sets corresponding security levels for the servers based on these statuses. In this way, the scheduling system can deeply understand the security situation of each server, avoid scheduling critical services to server nodes that have been attacked or compromised, thereby effectively reducing security risks and making up for the serious lack of the K8S in terms of security awareness.

[0068] (2) According to the expected security level of the container, a matching target server is selected from multiple servers as the deployable node. This ensures that the container can be deployed to a server that matches its security requirements, further enhancing the security of the system.

[0069] (3) This method dynamically sets the security level based on the security status of the server. The security status is a dynamic indicator that changes continuously with the actual situation of the server. Therefore, the scheduling system can flexibly adjust the security level of the server according to the real-time security status, thereby implementing a more flexible scheduling strategy.

[0070] (4) The expected security level of the container can be flexibly set according to the actual situation, and the scheduling system will perform matching scheduling based on these expected security levels. This enables the scheduling strategy to better adapt to the security requirements of different containers without being restricted by static labels.

[0071] (5) Since this method schedules based on the real-time security status of the server, when the security status of the server node changes, the scheduling system can respond in a timely manner. The ability to adjust the scheduling decision in real time makes up for the deficiency of the K8S in dynamic response and can better adapt to the changes in the server status.

[0072] (6) This method can continuously monitor the security status of the server and the running situation of the container, and continuously adjust the scheduling strategy according to the actual situation. This enables the system to maintain an efficient and secure running state in the face of various changes.

[0073] As Figure 3 shown, Figure 3 is a schematic structural diagram of a container scheduling device provided by an embodiment of the present application. The device includes:

[0074] A security status acquisition module 301, configured to acquire the security status of multiple servers;

[0075] A security level setting module 302 for setting corresponding security levels for multiple servers according to the security status;

[0076] A selection module 303 for selecting a matching target server from multiple servers as a deployable node according to the expected security level of the container.

[0077] As an optional implementation manner provided by an embodiment of the present application, the security status acquisition module 301 is specifically configured to monitor security status adjustment events of at least one server and determine the current security status corresponding to the security status adjustment event.

[0078] As an optional implementation manner provided by an embodiment of the present application, the container scheduling device further includes a dynamic scheduling module for: when the security status adjustment event indicates a decrease in the security level, evicting containers on the server whose expected security level is higher than the current security level and rescheduling them to other matching servers.

[0079] As an optional implementation manner provided by an embodiment of the present application, the security level setting module 302 is specifically configured to: determine that the security level of the server is high security when the security status indicates that the server has no high-risk vulnerabilities and has not been attacked; determine that the security level of the server is medium security when the security status indicates that the server has no high-risk vulnerabilities, has been attacked but not compromised; determine that the security level of the server is low security when the security status indicates that the server has no high-risk vulnerabilities, has been attacked and compromised; determine that the security level of the server is medium security when the security status indicates that the server has high-risk vulnerabilities but has not been attacked; determine that the security level of the server is low security when the security status indicates that the server has high-risk vulnerabilities, has been attacked but not compromised; determine that the security level of the server is low security when the security status indicates that the server has high-risk vulnerabilities, has been attacked and compromised.

[0080] As an optional implementation manner provided by an embodiment of the present application, the selection module 303 is specifically configured to: obtain configuration parameters of the container, where the configuration parameters indicate the expected security level of the container; add corresponding tolerance labels to the container according to the configuration parameters; and select a target server corresponding to the tolerance label of the container as a deployable node according to the tolerance label.

[0081] For specific limitations on the container scheduling device, reference may be made to the limitations on the container scheduling method in the foregoing text, which will not be elaborated herein. Each module in the foregoing container scheduling device may be implemented in whole or in part by software, hardware, and their combination. The foregoing modules may be embedded in the processor of the computer device in hardware form or independent of it, or stored in the memory of the computer device in software form to facilitate the processor to call and execute the operations corresponding to the foregoing modules.

[0082] In one embodiment, the present application provides an electronic device, which may be a terminal, and its internal structure diagram may be as shown in Figure 4 . The electronic device includes a processor, a memory, a communication interface, a display screen, and an input device connected through a system bus. Among them, the processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the electronic device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, a carrier network, near field communication (NFC), or other technologies. When the computer program is executed by the processor, it implements a method for detecting lags. The display screen of the electronic device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the electronic device may be a touch layer covering the display screen, or a button, a trackball, or a touchpad provided on the housing of the electronic device, or an external keyboard, touchpad, or mouse, etc.

[0083] Those skilled in the art can understand that Figure 4 the structure shown in is only a block diagram of some structures related to the solution of the present application, and does not constitute a limitation on the electronic device to which the solution of the present application is applied. The specific electronic device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0084] In one embodiment, the container scheduling device provided by the present application may be implemented in the form of a computer program, and the computer program can run on an electronic device as shown in Figure 4 . Each program module constituting the container scheduling device can be stored in the memory of the electronic device. The computer program constituted by each program module enables the processor to execute the steps in the container scheduling methods of various embodiments of the present application described in this specification.

[0085] For example, Figure 4 the electronic device shown in can execute obtaining the security status of multiple servers through the security status acquisition module 301 in the container scheduling device shown in Figure 3 ; the electronic device can execute setting corresponding security levels for multiple servers according to the security status through the security level setting module 302; the electronic device can execute selecting a matching target server from multiple servers as a deployable node according to the desired security level of the container through the selection module 303.

[0086] In one embodiment, the present application provides an electronic device, including a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0087] Obtain the security status of multiple servers; set corresponding security levels for the multiple servers according to the security status; select a matching target server from the multiple servers as a deployable node according to the desired security level of the container.

[0088] In one embodiment, when the processor executes the computer program, the following steps are further implemented: obtaining the security status of multiple servers, including: listening for security status adjustment events of at least one server, and determining the current security status corresponding to the security status adjustment event.

[0089] In one embodiment, when the processor executes the computer program, the following steps are further implemented: when the security status adjustment event indicates a decrease in the security level, evict the containers on the server whose desired security level is higher than the current security level, and reschedule them to other matching servers.

[0090] In one embodiment, when the processor executes the computer program, the following steps are further implemented: setting corresponding security levels for the multiple servers according to the security status, including: when the security status indicates that the server has no high-risk vulnerabilities and has not been attacked, determining the security level of the server as high security; when the security status indicates that the server has no high-risk vulnerabilities, has been attacked but has not been compromised, determining the security level of the server as medium security; when the security status indicates that the server has no high-risk vulnerabilities, has been attacked and has been compromised, determining the security level of the server as low security; when the security status indicates that the server has high-risk vulnerabilities but has not been attacked, determining the security level of the server as medium security; when the security status indicates that the server has high-risk vulnerabilities, has been attacked but has not been compromised, determining the security level of the server as low security; when the security status indicates that the server has high-risk vulnerabilities, has been attacked and has been compromised, determining the security level of the server as low security.

[0091] In one embodiment, when the processor executes the computer program, the following steps are further implemented: selecting a matching target server for the container as a deployable node according to the desired security level of the container, including: obtaining the configuration parameters of the container, where the configuration parameters indicate the desired security level of the container; adding corresponding tolerance tags for the container according to the configuration parameters; selecting the target server corresponding to the tolerance tag for the container as the deployable node according to the tolerance tag.

[0092] When the processor in the electronic device provided by this application executes a computer program, it first obtains the security status of multiple servers, and then dynamically sets corresponding security levels for the servers based on these statuses, enabling in-depth understanding of the real-time security situation of each server, promptly responding to adjust the security levels of the servers, and avoiding scheduling critical services to server nodes that have been attacked or compromised, thereby effectively reducing security risks; according to the expected security level of the container, a matching target server is selected from multiple servers as a deployable node, ensuring that the container can be deployed to a server that matches its security requirements and further enhancing the security of the system.

[0093] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a computer, the following steps are implemented:

[0094] Obtain the security status of multiple servers; set corresponding security levels for the multiple servers according to the security status; select a matching target server from the multiple servers as a deployable node according to the expected security level of the container.

[0095] In one embodiment, when the computer program is executed by a computer, the following steps are also implemented: Obtain the security status of multiple servers, including: listening for security status adjustment events of at least one server, and determining the current security status corresponding to the security status adjustment event.

[0096] In one embodiment, when the computer program is executed by a computer, the following steps are also implemented: When the security status adjustment event indicates a decrease in the security level, evict the containers on the server whose expected security level is higher than the current security level, and reschedule them to other matching servers.

[0097] In one embodiment, when the computer program is executed by a computer, the following steps are also implemented: Setting corresponding security levels for multiple servers according to the security status, including: when the security status indicates that the server has no high-risk vulnerabilities and has not been attacked, determining the security level of the server as high security; when the security status indicates that the server has no high-risk vulnerabilities and has been attacked but not compromised, determining the security level of the server as medium security; when the security status indicates that the server has no high-risk vulnerabilities, has been attacked and compromised, determining the security level of the server as low security; when the security status indicates that the server has high-risk vulnerabilities but has not been attacked, determining the security level of the server as medium security; when the security status indicates that the server has high-risk vulnerabilities and has been attacked but not compromised, determining the security level of the server as low security; when the security status indicates that the server has high-risk vulnerabilities, has been attacked and compromised, determining the security level of the server as low security.

[0098] In one embodiment, when the computer program is executed by a computer, the following steps are further implemented: according to the desired security level of the container, select a matching target server as a deployable node for the container, including: obtaining the configuration parameters of the container, where the configuration parameters indicate the desired security level of the container; adding corresponding tolerance tags to the container according to the configuration parameters; and selecting, according to the tolerance tags, the target server corresponding to the tolerance tags as the deployable node for the container.

[0099] When the computer program in the computer-readable storage medium provided by this application is executed by a computer, it first obtains the security status of multiple servers, and then dynamically sets corresponding security levels for the servers based on these statuses, enabling in-depth understanding of the real-time security situation of each server, promptly responding to adjust the security levels of the servers, and avoiding scheduling critical services to server nodes that have been attacked or compromised, thereby effectively reducing security risks; selecting a matching target server from multiple servers as a deployable node according to the desired security level of the container ensures that the container can be deployed to a server that matches its security requirements, further enhancing the security of the system.

[0100] Those skilled in the art should understand that the embodiments of this application can be provided as a method, a system, or a computer program product. Therefore, this application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, this application can take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code.

[0101] In several embodiments provided by this application, it should be understood that the disclosed device and method can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions, and operations of the device, method, and computer program product according to multiple embodiments of this application. In this regard, each block in the flowchart or block diagram can represent a module, a program segment, or a part of code, and the module, program segment, or part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks can occur in a different order from that marked in the accompanying drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and they can sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system for performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0102] In this application, the processor may be a Central Processing Unit (CPU), or may also be other general-purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field-Programmable Gate Arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0103] In this application, the memory may include non-permanent memory in the form of computer-readable media, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. The memory is an example of computer-readable media.

[0104] In this application, computer-readable media includes permanent and non-permanent, removable and non-removable storage media. The storage media can implement information storage by any method or technology, and the information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, Phase Change Memory (PRAM), Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read-Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), flash memory or other memory technologies, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc (DVD), or other optical storage, magnetic cassette tapes, disk storage, or other magnetic storage devices, or any other non-transmission media that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0105] It should be noted that in this document, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, such that a process, method, article or device comprising a series of elements not only includes those elements but also includes other elements not expressly listed, or further includes elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the presence of additional identical elements in the process, method, article or device comprising the element.

[0106] The above are only specific embodiments of the present application, enabling those skilled in the art to understand or implement the present application. Various modifications to these embodiments will be obvious to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to these embodiments herein, but rather will conform to the broadest scope consistent with the principles and novel features disclosed herein.

Claims

1. A container scheduling method, characterized in that, including: obtaining the security states of multiple servers; setting corresponding security levels for the multiple servers according to the security states; selecting a matching target server from the multiple servers as a deployable node according to the desired security level of the container.

2. The method according to claim 1, wherein The obtaining the security states of multiple servers includes: listening for security state adjustment events of at least one server and determining the current security state corresponding to the security state adjustment event.

3. The method according to claim 2, wherein The method further includes: when the security state adjustment event indicates a decrease in the security level, evicting the containers on the server whose desired security level is higher than the current security level and rescheduling them to other matching servers.

4. The method according to claim 1, wherein The setting corresponding security levels for multiple servers according to the security states includes: when the security state indicates that the server has no high-risk vulnerabilities and has not been attacked, determining the security level of the server as high security; when the security state indicates that the server has no high-risk vulnerabilities, has been attacked but not compromised, determining the security level of the server as medium security; when the security state indicates that the server has no high-risk vulnerabilities, has been attacked and compromised, determining the security level of the server as low security; when the security state indicates that the server has high-risk vulnerabilities but has not been attacked, determining the security level of the server as medium security; when the security state indicates that the server has high-risk vulnerabilities, has been attacked but not compromised, determining the security level of the server as low security; when the security state indicates that the server has high-risk vulnerabilities, has been attacked and compromised, determining the security level of the server as low security.

5. The method according to claim 1, wherein The selecting a matching target server for the container as a deployable node according to the desired security level of the container includes: obtaining the configuration parameters of the container, where the configuration parameters indicate the desired security level of the container; adding a corresponding tolerance label for the container according to the configuration parameters; selecting the target server corresponding to the tolerance label for the container as a deployable node according to the tolerance label.

6. A container scheduling device, characterized in that, including: a security state obtaining module for obtaining the security states of multiple servers; a security level setting module for setting corresponding security levels for the multiple servers according to the security states; a selection module for selecting a matching target server from the multiple servers as a deployable node according to the desired security level of the container.

7. The device according to claim 6, characterized in that, The security state obtaining module is specifically configured to: listen for security state adjustment events of at least one server and determine the current security state corresponding to the security state adjustment event.

8. An electronic device, characterized in that, including: a processor, a memory, and a computer program stored on the memory and executable on the processor, where when the computer program is executed by the processor, it implements the container scheduling method according to any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that, including: a computer program stored on the computer-readable storage medium, where when the computer program is executed by the processor, it implements the container scheduling method according to any one of claims 1 to 5.

10. A computer program product, characterized in that, including: The computer program product includes a computer program which, when run on a computer, causes the computer to implement the container scheduling method according to any one of claims 1 to 5.

Images