Application deployment method and device, medium and program product

Abstract

The invention discloses an application deployment method and device, a medium and a program product. The method is suitable for the field of cloud computing, and comprises the following steps: when a first application is newly added in a cloud platform, newly adding a project and a pulling user in a mirror image warehouse, and adding the pulling user into the project so as to manage a mirror image of the first application through the newly added project; newly adding a namespace in the cluster, and creating a user information memory bank in the namespace according to the pulled user information; when the mirror image of the first application is pulled, a user name and a password are obtained from the information memory bank according to the application deployment file, and the user name and the password are sent to a mirror image warehouse so as to initiate an authentication request to the mirror image warehouse; and the mirror image warehouse verifies the authentication request according to the user information of the pulled user in the project, and downloads the mirror image to the local storage of the host machine after the authentication request passes the verification. By adopting the technical scheme, identity verification can be carried out when the mirror image is pulled, and the risk of mirror image leakage is avoided.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to an application deployment method, device, medium and program product. Background Art

[0002] Application migration to the cloud refers to migrating traditional local applications to cloud computing platforms. Currently, applications are generally deployed in a containerized manner after being moved to the cloud. Specifically, the application is made into an image, and then the image is pushed to the image repository. When the application is deployed, the image is pulled from the image repository to the host machine and the image is run.

[0003] In the prior art, when deploying applications in a private cloud environment, username and password verification is not set during the image pulling process, resulting in images in the image repository being pulled at will, posing the risk of image leakage. Summary of the Invention

[0004] The present invention provides an application deployment method, device, medium and program product, which can perform identity verification when pulling images to avoid the risk of image leakage.

[0005] According to one aspect of the present invention, there is provided an application deployment method, comprising:

[0006] When a first application is newly added to the cloud platform, a new project is added to the image repository and a user is pulled in, and the pulled user is added to the project, so that the image of the first application can be managed through the newly added project;

[0007] Add a new namespace to the cluster and create a user information storage volume in the namespace based on the pulled user information;

[0008] When pulling the image of the first application, obtaining the user name and password from the information storage body according to the application deployment file, and sending the user name and password to the image repository to initiate an authentication request to the image repository; wherein the user information storage body is pre-associated in the application deployment file;

[0009] The image repository verifies the authentication request based on the user information of the user pulled in the project, and downloads the image to the local storage of the host machine after the authentication request is verified.

[0010] Optionally, add a new project and pull user to the image repository, and add the pull user to the project, including:

[0011] Add a new project and pull a user in the image repository, set the project permissions to require authentication, and set a username and password for the pull user;

[0012] Add a pull user to the project and set the pull user's permissions to pull only.

[0013] The advantage of this setting is that by configuring the projects and pull users in the image repository, access to all images in the project must be authenticated, and the pull user's processing permissions on the image are limited. Pull users cannot perform high-risk operations such as pushing and deleting. Even if user credentials are accidentally leaked, attackers cannot use them to implant malicious images into the repository or tamper with existing images, effectively preventing supply chain attacks and internal authority abuse. In addition, the project isolation mechanism enables images of different applications to be divided into independent spaces, avoiding cross-project image tampering due to confusion in permissions.

[0014] Optionally, create a user information storage volume in the namespace based on the pulled user information, including:

[0015] The user name of the pulled user is determined as the name of the user information storage body, and the password of the pulled user is stored in the user information storage body; wherein the user name of the pulled user is the application name of the first application.

[0016] The advantage of this setting is that the application name of the first application is used as the storage body name, forming a standardized naming rule to avoid management errors caused by naming confusion. The user information storage body uses the namespace isolation strategy to achieve secure storage of sensitive information, ensuring that passwords are not exposed in plain text in configuration files or code.

[0017] Optionally, the application deployment method further includes:

[0018] Through the password management tool, whenever the password update time point is reached, the password of the pulled user is updated, and the password of the pulled user added to the project and the user information storage body are synchronously updated.

[0019] The benefits of this setting are: regularly updating passwords can prevent password leaks due to image repository vulnerabilities, administrator misoperation, etc., which can lead to malicious image pulling and other problems, shorten the password validity window, and synchronously update the passwords of users pulled in the project and in the user information storage body, which can avoid the problem of old passwords still being usable due to inconsistent credentials, and ensure that the authentication information of all related components is synchronized in real time to form a complete security closed loop.

[0020] Optionally, the image repository verifies the authentication request based on the user information pulled from the project, and downloads the image to the host's local storage after the authentication request passes verification, including:

[0021] The image repository compares the username and password of the user pulled from the project with the username and password sent in the authentication request. If the username and password are the same, the authentication request is considered to be verified.

[0022] The image repository returns the image layer data of the first application and the hash value of each image layer to the container runtime;

[0023] When the container is running, it downloads and verifies the hash value of each image layer, so that after each image layer is verified, the image is downloaded to the local storage of the host machine.

[0024] The advantage of this setting is that by storing images in layers in the image repository, the images are more reusable, and only the changed layers need to be updated during downloading, which improves efficiency. Through two-way comparison and verification of usernames and passwords, it is ensured that only authorized pull users can pull images. The image repository returns a hash value, and the container verifies each image layer when it is running to ensure that the downloaded image is consistent with the original image stored in the warehouse.

[0025] Optionally, the application deployment method further includes:

[0026] In response to the user's permission adjustment request for the second application, a new pull user is added for the second application in the image repository, and a username and password are set for the pull user of the second application;

[0027] Add the pull user of the second application to the project of the second application, set the project permission of the second application to require authentication, and set the pull user permission of the second application to pull only;

[0028] According to the user name and password of the pulled user of the second application, a user information storage body is created in the namespace of the second application in the cluster.

[0029] The advantage of this setting is that it can adjust the permissions of pre-created existing applications, so that for pre-created second applications, identity authentication can also be added to their image pulls, thereby ensuring the information security of each application image in the cloud platform when pulling, and effectively avoiding the image leakage problem.

[0030] Optionally, the application deployment method further includes:

[0031] Every time an image is pulled, a log is generated in the cloud platform based on the user's operation records during the image pulling process.

[0032] The advantage of this setting is that the log records the user's operation information when pulling the image in detail, which can be used to track abnormal behavior and provide strong evidence for auditing. In addition, when a security incident occurs, the log can be used to quickly locate the specific operator and operation content and clarify responsibilities.

[0033] According to another aspect of the present invention, an electronic device is provided, comprising:

[0034] at least one processor; and

[0035] a memory communicatively connected to the at least one processor; wherein,

[0036] The memory stores a computer program that can be executed by the at least one processor. The computer program is executed by the at least one processor so that the at least one processor can execute the application deployment method described in any embodiment of the present invention.

[0037] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the application deployment method described in any embodiment of the present invention when executed.

[0038] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the application deployment method according to any embodiment of the present invention is implemented.

[0039] The technical solution of the embodiment of the present invention is to add a new project and pull a user in the image warehouse when a first application is added to the cloud platform, and add the pulled user to the project, so as to manage the image of the first application through the newly added project, add a new namespace in the cluster, and create a user information storage body in the namespace based on the pulled user information, so that access to all images in the project requires identity authentication, limits the pull user permissions, and effectively prevents supply chain attacks and internal authority abuse. In addition, the project isolation mechanism is adopted to divide the images of different applications into independent spaces, and the user information storage body is isolated through the namespace strategy to achieve The invention ensures the secure storage of sensitive information. When pulling the image of the first application, the user name and password are obtained from the information storage body according to the application deployment file, and the user name and password are sent to the image warehouse to initiate an authentication request to the image warehouse. The image warehouse verifies the authentication request according to the user information of the user pulling the image in the project, and downloads the image to the local storage of the host machine after the authentication request is verified. This method can increase user identity authentication in the process of image pulling, and ensure that only users with pulling permissions can pull the image, which solves the security problem caused by the private cloud environment not performing user verification in the existing technology and avoids the risk of image leakage.

[0040] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0042] Figure 1 This is a flowchart of an application deployment method provided according to the first embodiment of the present invention;

[0043] Figure 2 This is an overall architecture diagram of a cloud platform system provided according to an embodiment of the present invention;

[0044] Figure 3 is a flowchart of another application deployment method provided according to the second embodiment of the present invention;

[0045] Figure 4 This is a structural diagram of an application deployment device provided according to a third embodiment of the present invention;

[0046] Figure 5 It is a structural diagram of an electronic device for implementing the application deployment method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0047] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0048] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0049] Example 1

[0050] Figure 1This is a flow chart of an application deployment method provided in the first embodiment of the present invention. This embodiment is applicable to the case where username and password verification is added to the process of deploying applications on a cloud platform. This method can be executed by an application deployment device, which can be implemented in the form of hardware and / or software and can generally be configured in a computer or processor with data processing capabilities. Figure 1 As shown, the method includes:

[0051] S110: When a first application is newly added to the cloud platform, a new project is added to the image repository and a user is pulled, and the pulled user is added to the project, so as to manage the image of the first application through the newly added project.

[0052] Optionally, the cloud platform may refer to a private cloud or public cloud platform deployed by an enterprise or organization, which is used to host containerized deployment and operation of applications, and the first application may refer to a newly added application in the cloud platform.

[0053] Optionally, an image repository can refer to a centralized service for storing container images. A project in an image repository is the basic unit for managing image versions, tags, and permissions in the image repository. A project can be used to store images. An image is generally in the form of a binary file containing the code, dependencies, and configuration required to run a container. An image can be used as a template for starting a container and for deploying applications.

[0054] Optionally, a user in the image repository can refer to an entity that has image operation and access permissions. Multiple different roles can be assigned to users in the image repository, and each user role corresponds to different operation permissions.

[0055] Optionally, when a first application is added to the cloud platform, a new project in the image repository can be used to store and manage the image of the first application. After building the image of the first application, the image of the first application can be directly pushed to the new project in the image repository for storage. The new pull user in the image repository has the permission to pull the image of the first application.

[0056] Adding new projects and pulling users into the image repository, and adding the pulled users to the project, can include:

[0057] Add a new project and pull a user in the image repository, set the project permissions to require authentication, and set a username and password for the pull user;

[0058] Add a pull user to the project and set the pull user's permissions to pull only.

[0059] Optionally, the user name of the pulled user can be set to the application name of the first application, and the password can be generated using a preset encryption method.

[0060] An optional password generation method may include: generating a password based on the user name and time, specifically including: extracting the user name length, first letter, last letter and current timestamp, and generating a random number of the first length and special characters of the second length; combining the user name length, first letter, last letter, current timestamp, random number and special characters, and determining the combination result as the current password of the pulled user.

[0061] Optionally, after setting the pull user's permissions to pull only, the user only has the permission to pull images and does not have other permissions such as uploading and modifying images. You can also add users with other roles in the image repository and set corresponding user permissions for users with other roles. User permissions include but are not limited to any one of uploading, modifying, and deleting, or any combination of them.

[0062] Optionally, you can add pull users to the project. You can associate pull users with the project. Only pull users added to the project have the permission to pull images in the project.

[0063] Optionally, if the project permissions are set to require authentication, you will need to authenticate with your username and password when pulling images from the project. Only after passing the authentication will you have permission to pull images from the project.

[0064] The advantage of this setting is that by configuring the projects and pull users in the image repository, access to all images in the project must be authenticated, and the pull user's processing permissions on the image are limited. Pull users cannot perform high-risk operations such as pushing and deleting. Even if user credentials are accidentally leaked, attackers cannot use them to implant malicious images into the repository or tamper with existing images, effectively preventing supply chain attacks and internal authority abuse. In addition, the project isolation mechanism enables images of different applications to be divided into independent spaces, avoiding cross-project image tampering due to confusion in permissions.

[0065] S120: Add a new namespace in the cluster, and create a user information storage body in the namespace based on the pulled user information.

[0066] Optionally, the cluster can provide a running environment for containerized applications. The host can pull the image to the host for execution. The host can refer to the physical server or virtual machine that actually runs the container. It is the infrastructure that carries the container operation. The cluster can include multiple hosts. The namespace is a logical isolation mechanism in the cluster, which is used to divide the cluster resources into multiple independent virtual environments.

[0067] The process of creating a user information storage body in a namespace based on the pulled user information may include:

[0068] The user name of the pulled user is determined as the name of the user information storage body, and the password of the pulled user is stored in the user information storage body; wherein the user name of the pulled user is the application name of the first application.

[0069] Optionally, the pulled user information may include a user name and a password of the pulled user, and the user name and password of the user information storage body are the same as the user name and password of the corresponding pulled user in the image repository.

[0070] The advantage of this setting is that the application name of the first application is used as the storage body name, forming a standardized naming rule to avoid management errors caused by naming confusion. The user information storage body uses the namespace isolation strategy to achieve secure storage of sensitive information, ensuring that passwords are not exposed in plain text in configuration files or code.

[0071] Figure 2 This is an optional overall architecture diagram of the cloud platform system. Figure 2 As shown, the cloud platform system mainly includes an image repository, a deployment cluster and a control console. Multiple image repositories can form an image repository cluster. The clusters mentioned in the present invention refer to deployment clusters. The deployment cluster includes multiple host machines. The host machine is used to pull application images from the image repository and provide a running environment for the application. The control console can be used to manually or automatically add new applications, modify project properties, modify passwords, add new image repository users and cluster user information storage bodies, and adjust the processing permissions of existing applications, but is not limited to the above functions.

[0072] The application deployment method may further include:

[0073] Through the password management tool, whenever the password update time point is reached, the password of the pulled user is updated, and the password of the pulled user added to the project and the user information storage body are synchronously updated.

[0074] Optionally, the password update time point may be a time point when the application version is updated, or a time point determined according to a preset time period, which is not specifically limited here.

[0075] Optionally, the password update method can be: extract the username length, first letter, last letter and timestamp of the password update time point, and update the random number of the first length and the special characters of the second length; combine the username length, first letter, last letter, timestamp of the password update time point, the updated random number and special characters, and determine the combination result as the updated password of the user.

[0076] The benefits of this setting are: regularly updating passwords can prevent password leaks due to image repository vulnerabilities, administrator misoperation, etc., which can lead to malicious image pulling and other problems, shorten the password validity window, and synchronously update the passwords of users pulled in the project and in the user information storage body, which can avoid the problem of old passwords still being usable due to inconsistent credentials, and ensure that the authentication information of all related components is synchronized in real time to form a complete security closed loop.

[0077] S130: When pulling the image of the first application, obtain the user name and password in the information storage according to the application deployment file, and send the user name and password to the image repository to initiate an authentication request to the image repository.

[0078] The user information storage body is pre-associated in the application deployment file.

[0079] Optionally, when deploying a container, the name of the user information storage body is associated with the application deployment file. It can be understood that the container is the smallest execution unit of application deployment. The process of deploying an application is essentially to start the packaged image as a container instance in the target environment.

[0080] Optionally, the image of the first application can be pulled through the container runtime of the host machine. Specifically, according to the application deployment file, the name of the user information storage body corresponding to the currently pulled first application is determined, and then the user name and password are obtained from the corresponding user information storage body according to the name of the user information storage body. The user name is generally the same as the name of the user information storage body, and the user name and password are sent together to the image repository.

[0081] S140: The image repository verifies the authentication request based on the user information of the user pulled from the project, and downloads the image to the local storage of the host machine after the authentication request passes the verification.

[0082] The image repository verifies the authentication request based on the user information of the user pulled from the project, and downloads the image to the local storage of the host machine after the authentication request passes the verification. This may include:

[0083] The image repository compares the username and password of the user pulled from the project with the username and password sent in the authentication request. If the username and password are the same, the authentication request is considered to be verified.

[0084] The image repository returns the image layer data of the first application and the hash value of each image layer to the container runtime;

[0085] When the container is running, it downloads and verifies the hash value of each image layer, so that after each image layer is verified, the image is downloaded to the local storage of the host machine.

[0086] Optionally, based on the authentication request, the application name of the first application to be pulled can be determined, and then the image repository can determine the project corresponding to the first application, and compare the username and password of the user pulled in the project with the username and password sent in the authentication request.

[0087] Container Runtime is the basic component responsible for running and managing containers. It is the core execution layer of container technology. Its core function is to convert images into running containers and manage the container lifecycle.

[0088] Optionally, application images can be stored in layers in the image repository, and the hash value of the image layer can refer to a unique identifier obtained by hashing the image layer data, which is used to verify data integrity.

[0089] The advantage of this setting is that by storing images in layers in the image repository, the images are more reusable, and only the changed layers need to be updated during downloading, which improves efficiency. Through two-way comparison and verification of usernames and passwords, it is ensured that only authorized pull users can pull images. The image repository returns a hash value, and the container verifies each image layer when it is running to ensure that the downloaded image is consistent with the original image stored in the warehouse.

[0090] The technical solution of the embodiment of the present invention is to add a new project and pull a user in the image warehouse when a first application is added to the cloud platform, and add the pulled user to the project, so as to manage the image of the first application through the newly added project, add a new namespace in the cluster, and create a user information storage body in the namespace based on the pulled user information, so that access to all images in the project requires identity authentication, limits the pull user permissions, and effectively prevents supply chain attacks and internal authority abuse. In addition, the project isolation mechanism is adopted to divide the images of different applications into independent spaces, and the user information storage body is isolated through the namespace strategy to achieve The invention ensures the secure storage of sensitive information. When pulling the image of the first application, the user name and password are obtained from the information storage body according to the application deployment file, and the user name and password are sent to the image warehouse to initiate an authentication request to the image warehouse. The image warehouse verifies the authentication request according to the user information of the user pulling the image in the project, and downloads the image to the local storage of the host machine after the authentication request is verified. This method can increase user identity authentication in the process of image pulling, and ensure that only users with pulling permissions can pull the image, which solves the security problem caused by the private cloud environment not performing user verification in the existing technology and avoids the risk of image leakage.

[0091] Example 2

[0092] Figure 3This is a flow chart of an application deployment method provided by the second embodiment of the present invention. This embodiment specifically defines the application deployment method based on the above embodiment. Figure 3 As shown, the method includes:

[0093] S210: When a first application is added to the cloud platform, a new project is added to the image repository and a user is pulled in. The project permission is set to require authentication, and a username and password are set for the pulled user.

[0094] S220: Add the pull user to the project, and set the pull user's permission to pull only.

[0095] S230: Add a new namespace in the cluster, determine the username of the pulled user as the name of the user information storage body, and store the password of the pulled user in the user information storage body.

[0096] The user name of the pulled user is the application name of the first application.

[0097] S240: When pulling the image of the first application, obtain the user name and password in the information storage according to the application deployment file, and send the user name and password to the image repository to initiate an authentication request to the image repository.

[0098] S250: The image repository compares the username and password of the user pulled from the project with the username and password sent in the authentication request. When the username and password are the same, it is determined that the authentication request has passed the verification.

[0099] S260: The image repository returns the image layering data of the first application and the hash value of each image layer to the container runtime.

[0100] S270: When the container is running, the image layer is downloaded and the hash value is verified one by one, so that after each image layer is verified, the image is downloaded to the local storage of the host machine.

[0101] S280. Whenever an image pull is completed, a log is generated in the cloud platform based on the user's operation record during the image pull process.

[0102] Optionally, the operation record can record detailed information for each key step in the image pull process. The operation record includes but is not limited to the identity information of the user who initiated the pull operation, the timestamps of the start and end of the pull operation, image information (image name, tag, hash value, etc.), image pull results, the source IP address of the image pull request, and other information.

[0103] The advantage of this setting is that the log records the user's operation information when pulling the image in detail, which can be used to track abnormal behavior and provide strong evidence for auditing. In addition, when a security incident occurs, the log can be used to quickly locate the specific operator and operation content and clarify responsibilities.

[0104] Furthermore, the application deployment method may further include:

[0105] In response to the user's permission adjustment request for the second application, a new pull user is added for the second application in the image repository, and a username and password are set for the pull user of the second application;

[0106] Add the pull user of the second application to the project of the second application, set the project permission of the second application to require authentication, and set the pull user permission of the second application to pull only;

[0107] According to the user name and password of the pulled user of the second application, a user information storage body is created in the namespace of the second application in the cluster.

[0108] Optionally, the second application may refer to an application pre-established in the cloud platform. When the second application was established, the user verification function may not be set for image pulling. However, through the technical solution proposed in the present invention, not only can user verification be added when creating a new application, but user verification can also be added to pre-established existing applications, thereby ensuring the security of images in the entire cloud platform.

[0109] It is understandable that the project of the second application has been pre-established when the second application was created historically. Therefore, when updating the permissions of the existing second application, there is no need to rebuild the project. You only need to establish a pull user for the second application in the image repository, add the pull user to the project of the second application, and change the project permissions of the second application.

[0110] The advantage of this setting is that it can adjust the permissions of pre-created existing applications, so that for pre-created second applications, identity authentication can also be added to their image pulls, thereby ensuring the information security of each application image in the cloud platform when pulling, and effectively avoiding the image leakage problem.

[0111] The technical solution of the embodiment of the present invention is to add a new project and pull a user in the image warehouse when a first application is added to the cloud platform, and add the pulled user to the project, so as to manage the image of the first application through the newly added project, add a new namespace in the cluster, and create a user information storage body in the namespace based on the pulled user information, so that access to all images in the project requires identity authentication, limits the pull user permissions, and effectively prevents supply chain attacks and internal authority abuse. In addition, the project isolation mechanism is adopted to divide the images of different applications into independent spaces, and the user information storage body is isolated through the namespace strategy to achieve The invention ensures the secure storage of sensitive information. When pulling the image of the first application, the user name and password are obtained from the information storage body according to the application deployment file, and the user name and password are sent to the image warehouse to initiate an authentication request to the image warehouse. The image warehouse verifies the authentication request according to the user information of the user pulling the image in the project, and downloads the image to the local storage of the host machine after the authentication request is verified. This method can increase user identity authentication in the process of image pulling, and ensure that only users with pulling permissions can pull the image, which solves the security problem caused by the private cloud environment not performing user verification in the existing technology and avoids the risk of image leakage.

[0112] Example 3

[0113] Figure 4 This is a schematic diagram of the structure of an application deployment device provided by the third embodiment of the present invention. Figure 4 As shown, the apparatus includes: a project configuration module 310 , a user information storage body creation module 320 , a user authentication module 330 and an image pulling module 340 .

[0114] The project configuration module 310 is used to add a new project and pull users to the image repository when a first application is added to the cloud platform, and add the pulled users to the project to manage the image of the first application through the newly added project.

[0115] The user information storage body creation module 320 is used to create a new namespace in the cluster and create a user information storage body in the namespace according to the pulled user information.

[0116] The user authentication module 330 is used to obtain the user name and password in the information storage body according to the application deployment file when pulling the image of the first application, and send the user name and password to the image warehouse to initiate an authentication request to the image warehouse; wherein the user information storage body is pre-associated in the application deployment file.

[0117] The image pulling module 340 is used for the image warehouse to verify the authentication request according to the user information of the user pulling in the project, and download the image to the local storage of the host machine after the authentication request passes the verification.

[0118] The technical solution of the embodiment of the present invention is to add a new project and pull a user in the image warehouse when a first application is added to the cloud platform, and add the pulled user to the project, so as to manage the image of the first application through the newly added project, add a new namespace in the cluster, and create a user information storage body in the namespace based on the pulled user information, so that access to all images in the project requires identity authentication, limits the pull user permissions, and effectively prevents supply chain attacks and internal authority abuse. In addition, the project isolation mechanism is adopted to divide the images of different applications into independent spaces, and the user information storage body is isolated through the namespace strategy to achieve The invention ensures the secure storage of sensitive information. When pulling the image of the first application, the user name and password are obtained from the information storage body according to the application deployment file, and the user name and password are sent to the image warehouse to initiate an authentication request to the image warehouse. The image warehouse verifies the authentication request according to the user information of the user pulling the image in the project, and downloads the image to the local storage of the host machine after the authentication request is verified. This method can increase user identity authentication in the process of image pulling, and ensure that only users with pulling permissions can pull the image, which solves the security problem caused by the private cloud environment not performing user verification in the existing technology and avoids the risk of image leakage.

[0119] Based on the above embodiments, the project configuration module 310 can be specifically used to:

[0120] Add a new project and pull a user in the image repository, set the project permissions to require authentication, and set a username and password for the pull user;

[0121] Add a pull user to the project and set the pull user's permissions to pull only.

[0122] Based on the above embodiments, the user information storage body creation module 320 can be specifically used to:

[0123] The user name of the pulled user is determined as the name of the user information storage body, and the password of the pulled user is stored in the user information storage body; wherein the user name of the pulled user is the application name of the first application.

[0124] Based on the above embodiments, a password update module may be further included, specifically configured to:

[0125] Through the password management tool, whenever the password update time point is reached, the password of the pulled user is updated, and the password of the pulled user added to the project and the user information storage body are synchronously updated.

[0126] Based on the above embodiments, the image pulling module 340 can be specifically used to:

[0127] The image repository compares the username and password of the user pulled from the project with the username and password sent in the authentication request. If the username and password are the same, the authentication request is considered to be verified.

[0128] The image repository returns the image layer data of the first application and the hash value of each image layer to the container runtime;

[0129] When the container is running, it downloads and verifies the hash value of each image layer, so that after each image layer is verified, the image is downloaded to the local storage of the host machine.

[0130] On the basis of the above embodiments, an existing application permission configuration module may also be included, specifically for:

[0131] In response to the user's permission adjustment request for the second application, a new pull user is added for the second application in the image repository, and a username and password are set for the pull user of the second application;

[0132] Add the pull user of the second application to the project of the second application, set the project permission of the second application to require authentication, and set the pull user permission of the second application to pull only;

[0133] According to the user name and password of the pulled user of the second application, a user information storage body is created in the namespace of the second application in the cluster.

[0134] Based on the above embodiments, a log generation module may be further included to:

[0135] Every time an image is pulled, a log is generated in the cloud platform based on the user's operation records during the image pulling process.

[0136] The application deployment device provided in the embodiment of the present invention can execute the application deployment method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0137] Example 4

[0138] Figure 5A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0139] like Figure 5 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., which is communicatively connected to the at least one processor 11. The memory stores a computer program that can be executed by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 into the random access memory (RAM) 13. Various programs and data required for the operation of the electronic device 10 can also be stored in the RAM 13. The processor 11, ROM 12, and RAM 13 are connected to each other via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0140] Multiple components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0141] The processor 11 may be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as the application deployment method described in any embodiment of the present invention. That is:

[0142] When a first application is newly added to the cloud platform, a new project is added to the image repository and a user is pulled in, and the pulled user is added to the project, so that the image of the first application can be managed through the newly added project;

[0143] Add a new namespace to the cluster and create a user information storage volume in the namespace based on the pulled user information;

[0144] When pulling the image of the first application, obtaining the user name and password from the information storage body according to the application deployment file, and sending the user name and password to the image repository to initiate an authentication request to the image repository; wherein the user information storage body is pre-associated in the application deployment file;

[0145] The image repository verifies the authentication request based on the user information of the user pulled in the project, and downloads the image to the local storage of the host machine after the authentication request is verified.

[0146] In some embodiments, the application deployment method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the application deployment method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the application deployment method in any other appropriate manner (e.g., by means of firmware).

[0147] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0148] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0149] In the context of the present invention, computer-readable storage media can be tangible media that can contain or store a computer program for use with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Computer-readable storage media can include but are not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, computer-readable storage media can be machine-readable signal media. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0150] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0151] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0152] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0153] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0154] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. An application deployment method, characterized in that: include: When a first application is newly added to the cloud platform, a new project is added to the image repository and a user is pulled in, and the pulled user is added to the project, so that the image of the first application can be managed through the newly added project; Add a new namespace to the cluster and create a user information storage volume in the namespace based on the pulled user information; When pulling the image of the first application, obtaining the user name and password from the information storage body according to the application deployment file, and sending the user name and password to the image repository to initiate an authentication request to the image repository; wherein the user information storage body is pre-associated in the application deployment file; The image repository verifies the authentication request based on the user information of the user pulled in the project, and downloads the image to the local storage of the host machine after the authentication request is verified.

2. The method according to claim 1, characterized in that Add a new project and pull a user to the image repository, and add the pull user to the project, including: Add a new project and pull a user in the image repository, set the project permissions to require authentication, and set a username and password for the pull user; Add a pull user to the project and set the pull user's permissions to pull only.

3. The method according to claim 1, characterized in that Based on the pulled user information, a user information storage body is created in the namespace, including: The user name of the pulled user is determined as the name of the user information storage body, and the password of the pulled user is stored in the user information storage body; wherein the user name of the pulled user is the application name of the first application.

4. The method according to claim 1, wherein Also includes: Through the password management tool, whenever the password update time point is reached, the password of the pulled user is updated, and the password of the pulled user added to the project and the user information storage body are synchronously updated.

5. The method according to claim 1, wherein The image repository verifies the authentication request based on the user information pulled from the project, and downloads the image to the local storage of the host machine after the authentication request passes the verification, including: The image repository compares the username and password of the user pulled from the project with the username and password sent in the authentication request. If the username and password are the same, the authentication request is considered to be verified. The image repository returns the image layer data of the first application and the hash value of each image layer to the container runtime; When the container is running, it downloads and verifies the hash value of each image layer, so that after each image layer is verified, the image is downloaded to the local storage of the host machine.

6. The method according to claim 1, wherein Also includes: In response to the user's permission adjustment request for the second application, a new pull user is added for the second application in the image repository, and a username and password are set for the pull user of the second application; Add the pull user of the second application to the project of the second application, set the project permission of the second application to require authentication, and set the pull user permission of the second application to pull only; According to the user name and password of the pulled user of the second application, a user information storage body is created in the namespace of the second application in the cluster.

7. The method according to claim 1, characterized in that Also includes: Every time an image is pulled, a log is generated in the cloud platform based on the user's operation records during the image pulling process.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor. The computer program is executed by the at least one processor to enable the at least one processor to execute the application deployment method according to any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the application deployment method according to any one of claims 1 to 7 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, which, when executed by a processor, implements the application deployment method according to any one of claims 1 to 7.

Images