Mirror image management method and computing device

Abstract

The embodiment of the invention provides a mirror image management method and computing equipment. The method comprises the steps that a mirror image pulling request is acquired; determining a target mirror image warehouse domain name, a target cluster identifier and a target user identifier according to the mirror image pulling request; acquiring a preset first mapping relationship in a corresponding cluster based on the target cluster identifier; on the basis of the first mapping relationship, verifying whether the target user and the target cluster have the pulling authority for the mirror image data in the target mirror image warehouse; and under the condition that the verification is passed, determining a target mirror image warehouse IP address according to the target mirror image warehouse domain name, and sending a mirror image pulling instruction to the target mirror image warehouse IP address. According to the mirror image management method provided by the invention, only the target user and the target cluster conforming to the first mapping relationship can pull the data in the corresponding mirror image warehouse, so that illegal access of an unauthorized user and / or an unauthorized cluster is effectively avoided, the security of the mirror image data is guaranteed, and the problem of wrong mirror image pulling is also avoided.

Description

Technical Field

[0001] This application relates to the field of computing device technology, and in particular to a mirror management method and a computing device. Background Technology

[0002] Currently, with the widespread adoption of cloud computing and container technologies, container images, as the packaging carriers of applications and their runtime environments, are frequently pulled and used in different cluster environments. In enterprise environments, multiple image repositories typically serve different business clusters and user groups. The image management methods employed in related technologies are prone to issues such as image data leakage and image pull errors. Summary of the Invention

[0003] This application provides an image management method and computing device to solve the problems of image data leakage and image retrieval errors that are prone to occur in the image management methods of related technologies.

[0004] In a first aspect, embodiments of this application provide a mirror management method, including:

[0005] Get the image pull request;

[0006] The target image repository domain name, target cluster identifier, and target user identifier are determined based on the image pull request.

[0007] Based on the target cluster identifier, a preset first mapping relationship is obtained in the corresponding cluster. The first mapping relationship is the mapping relationship between the image repository domain name, the cluster identifier and the user identifier.

[0008] Based on the first mapping relationship, it is verified whether the target user and the target cluster have the permission to pull image data in the target image repository;

[0009] If the verification is successful, the target image repository Internet Protocol (IP) address is determined based on the target image repository domain name, and an image pull command is sent to the target image repository IP address.

[0010] In the above scheme, by establishing a primary mapping relationship between the image repository domain name, cluster identifier, and user identifier, precise control over image pull permissions can be achieved. Only target users and target clusters that meet the primary mapping relationship can pull data from the corresponding image repository, thereby effectively preventing unauthorized access by unauthorized users and / or unauthorized clusters, ensuring the security of image data, and preventing the leakage of sensitive data. Furthermore, through a unified mapping relationship, effective coordination between different clusters and image repositories is achieved, ensuring that users in different clusters can correctly pull images according to preset permission rules, reducing image pull errors caused by management chaos.

[0011] In one possible implementation, the first mapping relationship is stored in an access control list;

[0012] The step of verifying whether the target user and the target cluster have pull permissions for image data in the target image repository based on the first mapping relationship includes:

[0013] The target image repository domain name is matched against the access control list.

[0014] If the target image repository domain name is successfully matched, the target cluster identifier is matched in the mapping relationship where the target image repository domain name is successfully matched;

[0015] If the target cluster identifier is successfully matched, the target user identifier is matched in the mapping relationship where the target cluster identifier is successfully matched;

[0016] If the target user identifier is successfully matched, the request verification is deemed successful.

[0017] In the above scheme, by storing the initial mapping relationship between the image repository domain name, cluster identifier, and user identifier in an access control list, and then matching the target image repository domain name, target cluster identifier, and target user identifier sequentially in the access control list and mapping relationship, the verification logic for permission management in multi-cluster, multi-repository scenarios is consistent. This approach refines permission verification from the image repository level down to the user level, avoiding oversights and achieving precise control over image pull permissions. Only when the image repository domain name, cluster identifier, and user identifier all match can a user pull data from the corresponding image repository, effectively preventing unauthorized access by unauthorized users and clusters, ensuring the security of image data, and preventing data leakage.

[0018] In one possible implementation, the method further includes:

[0019] If any one of the target image repository domain name, the target cluster identifier, or the target user identifier fails to match, the verification is deemed unsuccessful.

[0020] In the above scheme, a user can only pull data from the corresponding image repository if the image repository domain name, cluster identifier, and user identifier all match simultaneously. This effectively prevents unauthorized access by unauthorized users and clusters, ensuring the security of image data and preventing the leakage of sensitive data. The mechanism for handling any matching failure avoids subsequent invalid matching operations, ensuring matching efficiency.

[0021] In one possible implementation, the method further includes:

[0022] If verification fails, send a verification error message.

[0023] In the above solution, sending verification error messages makes it easy for users to quickly know the reason for the verification failure so that they can make corrections.

[0024] In one possible implementation, determining the target image repository IP address based on the target image repository domain name includes:

[0025] A query request is sent to a Domain Name System (DNS) server; wherein the DNS server includes a second mapping relationship, which is a mapping relationship between the mirror repository domain name and the mirror repository IP address; the query request includes the target mirror repository domain name;

[0026] Receive the target image repository IP address sent by the DNS server after the query is completed.

[0027] In the above scheme, the query is performed through the preset second mapping relationship in the DNS server, which ensures the accuracy and efficiency of domain name query. It can quickly determine the corresponding target image repository IP address based on the target image repository domain name, ensuring the efficiency of image retrieval. In addition, the unified management of the second mapping relationship in the DNS server allows the mapping relationship between all image repository domain names and image repository IP addresses to be centrally maintained.

[0028] In one possible implementation, before determining the target image repository IP address based on the target image repository domain name, the method further includes:

[0029] Based on the received first user configuration request, determine the second mapping relationship in the DNS server.

[0030] In the above scheme, during the configuration phase, the second mapping relationship is determined through the first user configuration request, which facilitates the setting of the correspondence between the image repository domain name and the image repository IP address, ensuring the efficiency of image management. Through centralized management of the DNS server, the second mapping relationship is stored in the DNS server, and the change of the second mapping relationship can be completed simply by updating the DNS server through the first user configuration request. Dynamically updating the second mapping relationship in the DNS server through the first user configuration request also reduces manual operation steps and avoids situations where domain name query failure or image repository IP address error occurs due to errors in manually adding or modifying configuration files.

[0031] In one possible implementation, the first user configuration request includes mirror address information;

[0032] The step of determining the second mapping relationship in the DNS server based on the received first user configuration request includes:

[0033] Obtain multiple second mapping relationships from the image address information;

[0034] Send multiple second mappings to the DNS server.

[0035] In the above solution, by making a single configuration request for multiple second mapping relationships, the number of configuration operations is reduced when managing the network addresses of image repositories on a large scale, thus improving the efficiency of setting the mapping relationship between image repository domain names and image repository IP addresses. In addition, it can also avoid omissions and errors caused by manually configuring the second mapping relationships one by one, ensuring the accuracy and consistency of the second mapping relationship configuration.

[0036] In one possible implementation, prior to obtaining the image pull request, the method further includes:

[0037] Based on the received second user configuration request, determine the first mapping relationship corresponding to each cluster.

[0038] In the above solution, the initial mapping relationship of each cluster is uniformly determined through a second user configuration request. This ensures that users can correctly pull images according to preset permissions in different clusters, reducing image pull errors caused by management chaos and ensuring the stability and reliability of image management. The second user configuration request method allows for flexible handling of changes to image repositories, clusters, and users, guaranteeing the efficiency of image management.

[0039] In one possible implementation, the second user configuration request includes a user identifier, a cluster identifier, and mirror address information;

[0040] The step of determining the first mapping relationship corresponding to each cluster based on the received second user configuration request includes:

[0041] Multiple first mapping relationships are generated based on the user identifier, the cluster identifier, and the image repository domain name in the image address information;

[0042] The clusters corresponding to each of the first mapping relationships are determined based on the cluster identifier;

[0043] Multiple first mapping relationships are sent to the corresponding clusters for storage.

[0044] In the above scheme, the first mapping relationship corresponding to each cluster is determined by the user identifier, cluster identifier, and image address information in the second user configuration request. This accurately establishes the correspondence between users, clusters, and image repository domain names, ensuring the efficiency of image management. Furthermore, the second user configuration request method allows for flexible handling of changes to image repositories, clusters, and users, adapting to dynamic business needs.

[0045] Secondly, embodiments of this application provide an image management device, including: an acquisition module, a determination module, a verification module, and a sending module, wherein...

[0046] The acquisition module is used to acquire image pull requests;

[0047] The determination module is used to determine the target image repository domain name, target cluster identifier, and target user identifier based on the image pull request;

[0048] The acquisition module is also used to obtain a preset first mapping relationship in the corresponding cluster based on the target cluster identifier. The first mapping relationship is the mapping relationship between the image repository domain name, the cluster identifier and the user identifier.

[0049] The verification module is used to verify, based on the first mapping relationship, whether the target user and the target cluster have the permission to pull image data in the target image repository.

[0050] The sending module is used to determine the Internet Protocol IP address of the target image repository based on the target image repository domain name when the verification is successful, and to send an image pull command to the target image repository IP address.

[0051] In the above scheme, by establishing a primary mapping relationship between the image repository domain name, cluster identifier, and user identifier, precise control over image pull permissions can be achieved. Only target users and target clusters that meet the primary mapping relationship can pull data from the corresponding image repository, thereby effectively preventing unauthorized access by unauthorized users and / or unauthorized clusters, ensuring the security of image data, and preventing the leakage of sensitive data. Furthermore, through a unified mapping relationship, effective coordination between different clusters and image repositories is achieved, ensuring that users in different clusters can correctly pull images according to preset permission rules, reducing image pull errors caused by management chaos.

[0052] In one possible implementation, the first mapping is stored in an access control list;

[0053] The verification module is specifically used for:

[0054] Matching based on the target image repository domain name in the access control list;

[0055] If the target image repository domain name is successfully matched, the target cluster identifier is matched in the mapping relationship where the target image repository domain name is successfully matched.

[0056] If the target cluster identifier is successfully matched, the target user identifier is matched in the mapping relationship where the target cluster identifier is successfully matched.

[0057] If the target user identifier is successfully matched, the request verification is deemed successful.

[0058] In the above scheme, by storing the initial mapping relationship between the image repository domain name, cluster identifier, and user identifier in an access control list, and then matching the target image repository domain name, target cluster identifier, and target user identifier sequentially in the access control list and mapping relationship, the verification logic for permission management in multi-cluster, multi-repository scenarios is consistent. This approach refines permission verification from the image repository level down to the user level, avoiding oversights and achieving precise control over image pull permissions. Only when the image repository domain name, cluster identifier, and user identifier all match can a user pull data from the corresponding image repository, effectively preventing unauthorized access by unauthorized users and clusters, ensuring the security of image data, and preventing data leakage.

[0059] In one possible implementation, the verification module is also used for:

[0060] If any of the target image repository domain name, target cluster identifier, or target user identifier fails to match, the verification is deemed unsuccessful.

[0061] In the above scheme, a user can only pull data from the corresponding image repository if the image repository domain name, cluster identifier, and user identifier all match simultaneously. This effectively prevents unauthorized access by unauthorized users and clusters, ensuring the security of image data and preventing the leakage of sensitive data. The mechanism for handling any matching failure avoids subsequent invalid matching operations, ensuring matching efficiency.

[0062] In one possible implementation, the sending module is also used for:

[0063] If verification fails, send a verification error message.

[0064] In the above solution, sending verification error messages makes it easy for users to quickly know the reason for the verification failure so that they can make corrections.

[0065] In one possible implementation, a module is defined, specifically for:

[0066] Send a query request to the Domain Name System (DNS) server; wherein the DNS server includes a second mapping relationship, which is a mapping relationship between the mirror repository domain name and the mirror repository IP address; the query request includes the target mirror repository domain name;

[0067] Receive the target image repository IP address sent by the DNS server after the query is completed.

[0068] In the above scheme, the query is performed through the preset second mapping relationship in the DNS server, which ensures the accuracy and efficiency of domain name query. It can quickly determine the corresponding target image repository IP address based on the target image repository domain name, ensuring the efficiency of image retrieval. In addition, the unified management of the second mapping relationship in the DNS server allows the mapping relationship between all image repository domain names and image repository IP addresses to be centrally maintained.

[0069] This application provides a mirror management device, which also includes a configuration module.

[0070] In one possible implementation, the configuration module is used for:

[0071] Based on the received first user configuration request, determine the second mapping relationship in the DNS server.

[0072] In the above scheme, during the configuration phase, the second mapping relationship is determined through the first user configuration request, which facilitates the setting of the correspondence between the image repository domain name and the image repository IP address, ensuring the efficiency of image management. Through centralized management of the DNS server, the second mapping relationship is stored in the DNS server, and the change of the second mapping relationship can be completed simply by updating the DNS server through the first user configuration request. Dynamically updating the second mapping relationship in the DNS server through the first user configuration request also reduces manual operation steps and avoids situations where domain name query failure or image repository IP address error occurs due to errors in manually adding or modifying configuration files.

[0073] In one possible implementation, the first user configuration request includes mirror address information;

[0074] The configuration module is specifically used for:

[0075] Retrieve multiple second mapping relationships from the image address information;

[0076] Send multiple second mappings to the DNS server.

[0077] In the above solution, by making a single configuration request for multiple second mapping relationships, the number of configuration operations is reduced when managing the network addresses of image repositories on a large scale, thus improving the efficiency of setting the mapping relationship between image repository domain names and image repository IP addresses. In addition, it can also avoid omissions and errors caused by manually configuring the second mapping relationships one by one, ensuring the accuracy and consistency of the second mapping relationship configuration.

[0078] In one possible implementation, the configuration module is also used for:

[0079] Based on the received second user configuration request, determine the first mapping relationship corresponding to each cluster.

[0080] In the above solution, the initial mapping relationship of each cluster is uniformly determined through a second user configuration request. This ensures that users can correctly pull images according to preset permissions in different clusters, reducing image pull errors caused by management chaos and ensuring the stability and reliability of image management. The second user configuration request method allows for flexible handling of changes to image repositories, clusters, and users, guaranteeing the efficiency of image management.

[0081] In one possible implementation, the second user configuration request includes a user identifier, a cluster identifier, and mirror address information;

[0082] The configuration module is specifically used for:

[0083] Multiple first mapping relationships are generated based on the user identifier, cluster identifier, and the image repository domain name in the image address information;

[0084] The clusters corresponding to each first mapping relationship are determined based on the cluster identifier;

[0085] Multiple first mapping relationships are sent to the corresponding clusters for storage.

[0086] In the above scheme, the first mapping relationship corresponding to each cluster is determined by the user identifier, cluster identifier, and image address information in the second user configuration request. This accurately establishes the correspondence between users, clusters, and image repository domain names, ensuring the efficiency of image management. Furthermore, the second user configuration request method allows for flexible handling of changes to image repositories, clusters, and users, adapting to dynamic business needs.

[0087] Thirdly, embodiments of this application also provide a computing device, including: a memory and a processor;

[0088] The memory and the processor are coupled;

[0089] The memory is used to store program instructions;

[0090] The processor is configured to invoke the program instructions to cause the computing device to perform the method as described in any of the first aspects.

[0091] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a computer, implements the method as described in any of the first aspects.

[0092] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a computer, implements the method as described in any of the first aspects. Attached Figure Description

[0093] Figure 1 This is a schematic diagram of an application scenario corresponding to the image management method provided in the embodiments of this application;

[0094] Figure 2 This is a flowchart illustrating the image management method provided in the embodiments of this application. Figure 1 ;

[0095] Figure 3 This is a flowchart illustrating the image management method provided in the embodiments of this application. Figure 2 ;

[0096] Figure 4 This is a schematic diagram of the structure of the mirror management device provided in the embodiments of this application. Figure 1 ;

[0097] Figure 5 This is a schematic diagram of the structure of the mirror management device provided in the embodiments of this application. Figure 2 ;

[0098] Figure 6 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0099] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this application as detailed in the appended claims.

[0100] The following is a brief introduction to the relevant terms used in the embodiments of this application.

[0101] Container image: An image is a lightweight, executable, standalone software package that contains a complete file system, runtime environment, code, and configuration information for running an application or service.

[0102] Container runtime: The container runtime is a key component responsible for managing the lifecycle of containers.

[0103] Container Runtime Interface (CLI): The CLI is a set of standard interface specifications defined by the Kubernetes project. Its main function is to decouple Kubernetes from the underlying container runtime, enabling Kubernetes to interact with different container runtimes in a unified way, facilitating switching and adaptation to various container runtime environments.

[0104] Image repository: An image repository is a centralized repository used to store, manage, and distribute container images; it's like an app store. The pull operation can be considered a download operation.

[0105] k8s: an abbreviation for Kubernetes. Kubernetes is an open-source container orchestration platform that uses a series of automated mechanisms to deploy, schedule, scale, monitor, and manage containerized applications. Based on a declarative configuration model, it ensures that numerous containers work together efficiently in a cluster environment.

[0106] Kubelet is the core proxy component on Kubernetes cluster nodes. It is responsible for interacting with the container runtime on the node, executing instructions issued by the master node, monitoring and reporting the container status, ensuring that the container runs in accordance with the cluster requirements, and sending a request to the image management component when the container has image-related needs.

[0107] Kubernetes job: A Kubernetes job is a resource object provided by Kubernetes for creating one-off, non-persistent tasks. It can be viewed as a one-time task scheduled by Kubernetes.

[0108] DNS (Domain Name System) is one of the fundamental services of the Internet, which translates human-readable domain names into IP addresses that network devices can recognize.

[0109] DNS lookup: A DNS lookup is a request initiated by a client to a DNS server in order to obtain the IP address information corresponding to a specific domain name in order to establish a network connection.

[0110] With the widespread adoption of cloud computing and container technologies, container images, as the packaging carriers of applications and their runtime environments, are frequently pulled and used in different cluster environments. In enterprise environments, multiple image repositories typically serve different business clusters and user groups. In related technologies, permission management for image pulls is relatively rudimentary, lacking effective permission verification mechanisms. This allows unauthorized users to potentially pull sensitive image data, posing a data leakage risk. Furthermore, the lack of unified management and coordination between different clusters and image repositories also easily leads to image pull errors.

[0111] Given this, the existing technologies lack precise permission management for image pulls and unified management and coordination among different clusters and image repositories. Therefore, to address these issues, a mapping relationship should be pre-established between image repository domains, cluster identifiers, and user identifiers. Upon receiving an image pull request, permission verification should be performed based on this pre-established mapping relationship. This would achieve precise permission control for image pull operations, ensuring the security of image data. It would also ensure that different clusters can accurately pull image data from their respective image repositories, guaranteeing the accuracy of image data retrieval.

[0112] To facilitate understanding of the image management method provided in the embodiments of this application, the following will be combined with... Figure 1 The application scenarios involved in the embodiments of this application will be described.

[0113] Figure 1 This is a schematic diagram of an application scenario corresponding to the image management method provided in this application embodiment. The application scenario includes a user, an image management device 10, and an image repository 11. Specifically, when a user sends an image pull request, the image management device 10 receives the request and determines the image repository domain name, cluster identifier, and user identifier based on the request. Then, it retrieves a mapping relationship from the corresponding cluster based on the cluster identifier; this mapping relationship is between the image repository domain name, the cluster identifier, and the user identifier. Based on the mapping relationship, it verifies whether the user and the cluster have the permission to pull image data from the image repository. After successful verification, it sends an image data pull instruction to the corresponding image repository 11 based on the determined image repository domain name. Upon receiving the image data pull instruction, the image repository 11 sends the corresponding image data to the image management device 10, which then sends the image data to the user.

[0114] The technical solutions of the embodiments of this application will be described in detail below with specific examples. These specific examples can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0115] Figure 2 Flowchart of the image management method provided in the embodiments of this application Figure 1 Please see. Figure 2 The method may include:

[0116] The execution entity of this method can be Figure 1 The mirror management device in the system.

[0117] S201, Obtain image pull request.

[0118] Optionally, image pull requests initiated by users can be received via a network interface.

[0119] Optionally, the image pull request may include basic information related to the image pull, such as the identifier of the image that the user wants to pull.

[0120] It should be noted that in real-world applications, users may initiate image pull requests from clients in development, testing, or production environments, and then send these requests to the image management device via network transmission protocols.

[0121] S202. Determine the target image repository domain name, target cluster identifier, and target user identifier based on the image pull request.

[0122] Upon receiving an image pull request, the request is first parsed. Based on the image-related information carried in the request, and using pre-defined parsing rules, the target image repository domain name, target cluster identifier, and target user identifier are determined. For example, the image pull request may contain the complete path to the image; by analyzing the path, the repository domain name where the image resides can be extracted. Simultaneously, based on the identifier assigned to the user upon login and information related to the request source, the target user identifier is determined. The target cluster identifier can be determined based on the user's business configuration, the network address from which the request originated, and other information. For instance, in a multi-cluster architecture within an enterprise, users from different departments may work in different clusters; the target cluster identifier can be accurately determined based on the user's department information, network access point, and other information.

[0123] Among them, the target user identifier refers to the identification information used to identify the user who initiated the image pull request; the target cluster identifier refers to the identification information of the cluster to which the user who sent the image pull request belongs; and the target image repository domain name refers to the network address identifier of the image repository where the image data that the user wants to pull is stored.

[0124] S203. Based on the target cluster identifier, obtain the preset first mapping relationship in the corresponding cluster. The first mapping relationship is the mapping relationship between the image repository domain name, the cluster identifier and the user identifier.

[0125] Specifically, after obtaining the target cluster identifier, the pre-set first mapping relationship is obtained from the corresponding cluster through the target cluster identifier.

[0126] The first mapping relationship is pre-defined by the administrator based on the enterprise's organizational structure, business needs, and access control policies. This first mapping relationship clarifies the correspondence between the image repository domain name, cluster identifier, and user identifier. The first mapping relationship is stored in the cluster's management node in the form of a data table or database record.

[0127] For example, user A in a certain department, located in cluster B, only has pull permissions for the image in the repository domain "sales-repo.example.com". This mapping is stored in the first mapping relationship. When the image management device obtains the target cluster identifier, it can retrieve the first mapping relationship corresponding to that cluster by querying the relevant data storage in the cluster management node.

[0128] S204. Based on the first mapping relationship, verify whether the target user and the target cluster have the permission to pull image data in the target image repository.

[0129] Specifically, after obtaining the first mapping relationship, the system verifies whether the target user and target cluster have pull permissions for image data in the target image repository, based on this relationship. This is to avoid the risk of information leakage caused by unauthorized users or clusters pulling image data.

[0130] Among them, the target user identifier refers to the user who initiates the image pull request; the target cluster refers to the cluster to which the user who sends the image pull request belongs; and the target image repository refers to the image repository where the image data that the user wants to pull is stored.

[0131] Optionally, the mapping relationship between the target image repository domain name, the target cluster identifier, and the target user identifier and the records in the first mapping relationship can be compared.

[0132] For example, if there is a record in the first mapping relationship in which the image repository domain name, cluster identifier, and user identifier completely match the target image repository domain name, target cluster identifier, and target user identifier, respectively, then it is determined that the target user and / or target cluster have pull permissions for the image data in the target image repository; otherwise, it is determined that the target user and / or target cluster do not have pull permissions.

[0133] Optionally, if the target user and / or target cluster meet pre-defined rules such as permission inheritance and permission extension, then it can be determined that the target user and / or target cluster have pull permissions for image data in the target image repository; otherwise, it is determined that the target user and / or target cluster do not have pull permissions. For example, in some cases, a sub-department user may inherit some permissions of a parent department user for a specific image repository, and the image management device will make a judgment based on the corresponding inheritance rules.

[0134] Optionally, when comparing the target image repository domain name, target cluster identifier, and target user identifier with the mapping relationship recorded in the first mapping relationship, the target image repository domain name, target cluster identifier, and target user identifier can be compared with the first mapping relationship simultaneously; alternatively, the target image repository domain name, target cluster identifier, and target user identifier can be compared sequentially, for example, first comparing the target image repository domain name, then comparing the target cluster identifier, and finally comparing the target user identifier. Specifically, in this embodiment, no specific limitation is made on how to compare with the first mapping relationship.

[0135] It should also be noted that the introduction of target cluster identifiers enables more granular permission management, allowing for the management of pull permissions for the same user across different clusters. For example, the same user may have different permissions for the same image repository in different clusters.

[0136] S205. If the verification is successful, determine the Internet Protocol IP address of the target image repository based on the target image repository domain name, and send an image pull command to the target image repository IP address.

[0137] Specifically, once it is confirmed that the user's pull permission has been verified, the target image repository IP address is determined based on the determined target image repository domain name, and then the image pull command is sent based on the target image repository IP address.

[0138] Specifically, after obtaining the target image repository's IP address, the image management device sends an image pull command to the target image repository's IP address via a network communication protocol, such as Transmission Control Protocol (TCP) or User Datagram Protocol (UDP). The network communication protocol specifies the format, order, and error control rules for data transmission, ensuring that the command is accurately transmitted to the server where the target image repository resides. Upon receiving the pull command, the target image repository transmits the corresponding image data to the cluster where the target user resides, according to the requirements of the image pull command.

[0139] Optionally, after determining the target image repository domain name, the domain name can be resolved to the corresponding target image repository IP address using the Domain Name System (DNS). Specifically, after obtaining the target image repository domain name, the image management device sends a query request to the DNS server. The DNS server finds the corresponding target image repository IP address in its cache and sends it to the image management device. Then, the image management device can establish a connection with the image repository based on the target image repository IP address and send an image retrieval command.

[0140] Optionally, after determining the target image repository domain name, the target image repository IP address can also be determined through the mapping between domain names and IP addresses in the local cache or configuration file. Specifically, after obtaining the target image repository domain name, the image management device first checks whether the target image repository IP address corresponding to the target image repository domain name exists in the local cache or configuration file. If it exists, the target image repository IP address is used directly to establish a connection with the image repository; if it does not exist, the target image repository IP address is obtained through other methods (such as DNS resolution), and the resolution result is stored in the local cache or configuration file for later use.

[0141] It should be noted that this embodiment does not specifically limit how to determine the IP address of the target image repository based on the target image repository domain name.

[0142] Optionally, during the sending of instructions, the image pull instructions can be optimized based on factors such as network conditions and the load of the image repository, for example, by adjusting the data transmission rate to improve the efficiency of image pull.

[0143] The image management method provided in this embodiment establishes a primary mapping relationship between image repository domain names, cluster identifiers, and user identifiers. This enables precise control over image pull permissions, ensuring that only target users and target clusters matching the primary mapping relationship can pull data from the corresponding image repository. This effectively prevents unauthorized access by unauthorized users and / or unauthorized clusters, safeguarding image data security and preventing sensitive data leakage. Furthermore, the unified mapping relationship facilitates effective coordination between different clusters and image repositories, ensuring that users in different clusters can correctly pull images according to preset permission rules, reducing image pull errors caused by management chaos.

[0144] The image management method provided in this embodiment can be applied to scenarios with multiple clusters and multiple users. Each cluster can independently manage its own permission mapping relationship while maintaining global consistency.

[0145] Based on the above embodiments, the image management method provided in this application stores the first mapping relationship in an access control list.

[0146] In this embodiment, the first mapping relationship is stored in an Access Control List (ACL). An ACL is a data structure used to store permission control information, recording permission allocation under different conditions in list form. The first mapping relationship is stored as entries within the ACL, each entry containing a corresponding combination of the image repository domain name, cluster identifier, and user identifier, arranged in a logical order to facilitate subsequent querying and matching operations. The first mapping relationship corresponding to a cluster can be obtained by querying the ACL stored in the cluster management node.

[0147] Optionally, the first mapping in the access control list can be flexibly configured and modified according to business development, organizational structure adjustments, and changes in permission policies. Whether adding a new image repository or cluster, or adjusting user permissions, this can be achieved simply by adding, deleting, or modifying the corresponding entries in the access control list.

[0148] Specifically, based on the first mapping relationship, the verification of whether the target user and the target cluster have pull permissions for image data in the target image repository includes the following steps:

[0149] First, the target mirror repository domain name is matched against the access control list.

[0150] Specifically, when matching the target mirror repository domain name, starting from the beginning of the access control list, the mirror repository domain names stored in the access control list are compared with the target mirror repository domain name in turn. If there is a mirror repository domain name stored in the access control list that is exactly the same as the target mirror repository domain name, the target mirror repository domain name is determined to be a successful match; if no matching mirror repository domain name is found after traversing the entire access control list, the target mirror repository domain name is determined to be a failed match.

[0151] Optionally, if the target image repository domain name fails to match, the request verification can be determined directly and no further matching operations will be performed.

[0152] Secondly, if the target image repository domain name is successfully matched, the target cluster identifier is matched in the mapping relationship where the target image repository domain name is successfully matched.

[0153] Specifically, if the target image repository domain name is successfully matched, the target cluster identifier is then matched within the mapping relationship where the target image repository domain name was successfully matched. That is, for the access control list entries that were successfully matched in the previous step, the cluster identifier stored in them is compared with the target cluster identifier. If there is an entry whose stored cluster identifier is exactly the same as the target cluster identifier, the target cluster identifier is considered to have matched successfully; if no matching cluster identifier is found after traversing all entries where the target image repository domain name was successfully matched, the target cluster identifier is considered to have failed to match.

[0154] Optionally, if the target cluster fails to match, it can be assumed that the target cluster does not have the permission to pull image data from the target image repository. Therefore, it can be directly determined that the request verification failed.

[0155] Next, if the target cluster identifier is successfully matched, the target user identifier is matched in the mapping relationship where the target cluster identifier is successfully matched.

[0156] Specifically, if the target cluster identifier matches successfully, the target user identifier is matched against the mapping relationship where the target cluster identifier matched successfully. Similarly, for the access control list entries that matched successfully in the previous step, the user identifiers stored in them are compared with the target user identifier. If there is an entry where the stored user identifier is exactly the same as the target user identifier, the target user identifier is considered to have matched successfully. At this time, it means that the target image repository domain name, the target cluster identifier, and the target user identifier have all matched successfully, and the request verification can be confirmed as passed. If no matching user identifier is found after traversing all entries where the target cluster identifier matched successfully, the target user identifier is considered to have failed to match. At this time, it can be assumed that the target user does not have the permission to pull image data from the target image repository, and the request verification is confirmed as failed.

[0157] Finally, if the target user identifier is successfully matched, the request verification is confirmed to be successful.

[0158] The image management method provided in this embodiment stores the first mapping relationship between the image repository domain name, cluster identifier, and user identifier in an access control list. It then matches the target image repository domain name, target cluster identifier, and target user identifier sequentially within the access control list and mapping relationship. This aligns with the verification logic of permission management in multi-cluster, multi-repository scenarios, progressively refining permissions from the image repository level to the user level. This avoids oversights in permission verification and achieves precise control over image pull permissions. Only when the image repository domain name, cluster identifier, and user identifier all match can a user pull data from the corresponding image repository. This effectively prevents unauthorized access by unauthorized users and unauthorized clusters, ensuring the security of image data and preventing data leakage.

[0159] Based on the above embodiments, the image management method provided in this application further includes:

[0160] If any of the target image repository domain name, target cluster identifier, or target user identifier fails to match, the verification is deemed unsuccessful.

[0161] Specifically, if any one of the target image repository domain name, target cluster identifier, or target user identifier fails to match, the verification is deemed unsuccessful. This verification process ensures that image pull operations are only permitted when all user verification information completely matches the permission configuration in the access control list, avoiding misjudgments of permissions due to incomplete information matching and thus ensuring the accuracy and security of permission verification.

[0162] The image management method provided in this embodiment allows users to pull data from the corresponding image repository only when the image repository domain name, cluster identifier, and user identifier all match simultaneously. This effectively prevents unauthorized access by unauthorized users and clusters, ensuring the security of image data and preventing the leakage of sensitive data. A mechanism for handling any matching failure avoids subsequent invalid matching operations, guaranteeing matching efficiency.

[0163] Based on the above embodiments, the image management method provided in this application further includes:

[0164] If verification fails, send a verification error message.

[0165] Specifically, if the verification fails, the image management device will send a verification error message to the user who initiated the pull request.

[0166] Optionally, the verification error message can be a prompt word indicating that the verification failed. Optionally, the verification error message may also include a specific reason for the error, such as "target image repository domain name failed to match", "target cluster identifier failed to match", or "target user identifier failed to match", so that the user can clearly understand the specific reason for the permission verification failure.

[0167] Optionally, verification error information can be fed back to the user via network communication protocols, such as message prompts, email notifications, or system log records.

[0168] The image management method provided in this embodiment sends verification error information, making it convenient for users to quickly know the reason for verification failure so that they can make corrections.

[0169] Based on the above embodiments, the image management method provided in this application, when determining the IP address of the target image repository according to the target image repository domain name, specifically includes the following steps:

[0170] First, a query request is sent to the DNS server.

[0171] The DNS server includes a second mapping relationship, which is a mapping relationship between the image repository domain name and the image repository IP address; the query request includes the target image repository domain name.

[0172] Specifically, the image management device sends a query request to the DNS server based on the determined target image repository domain name. Upon receiving the query request, the DNS server performs a search and matching based on its stored second mapping relationship. If the DNS server's cache contains the image repository IP address corresponding to the target image repository domain name, the DNS server will quickly retrieve the corresponding image repository IP address directly from the cache. If the corresponding image repository IP address is not found in the cache, it may be due to an incorrect image repository domain name causing the query failure. In this case, the DNS server can send a query failure message to the image management device.

[0173] Then, receive the target image repository IP address sent by the DNS server after the query is completed.

[0174] Specifically, after the DNS completes the query task, the DNS server sends the target image repository IP address to the image management device. The image management device receives the target image repository IP address, thus completing the process of determining the target image repository IP address.

[0175] It should be noted that when adding or replacing a mirror repository, only the relevant secondary mapping relationship needs to be updated in the DNS server, and the mirror management device can automatically obtain the new mirror repository IP address, thereby enabling it to quickly adapt to changes in network architecture and business needs.

[0176] The image management method provided in this embodiment uses a preset second mapping relationship in the DNS server to query, ensuring the accuracy and efficiency of domain name lookup. It can quickly determine the corresponding target image repository IP address based on the target image repository domain name, ensuring the efficiency of image retrieval. In addition, the unified management of the second mapping relationship in the DNS server enables the centralized maintenance of the correspondence between all image repository domain names and image repository IP addresses.

[0177] Based on the above embodiments, the image management method provided in this application, in addition to the management method during the image retrieval process mentioned in the above embodiments, also provides a management method during the user or administrator configuration phase. Furthermore, this embodiment mainly involves the configuration process of the second mapping relationship in the DNS server.

[0178] Specifically, before determining the target image repository IP address based on the target image repository domain name, the following steps are also included:

[0179] Based on the received first user configuration request, determine the second mapping relationship in the DNS server.

[0180] Optionally, the mirror management device is equipped with a configuration interface or configuration screen to receive the first user configuration request sent by the user or administrator.

[0181] Optionally, the first user configuration request refers to a request sent by an administrator through a management interface or configuration interface. The first user configuration request may include the correspondence information between the image repository domain name and the image repository IP address.

[0182] Optionally, after receiving the configuration request, the image management device parses and verifies the information in the first user configuration request to ensure the accuracy and format compliance of the information. If the verification passes, the image management device stores the mapping information between the image repository domain name and the image repository IP address in the DNS server, thereby forming a second mapping relationship.

[0183] Optionally, the second mapping relationship is stored in the DNS server in the form of a database table, configuration file, etc., to facilitate quick queries and matching later. Different clusters or different users can flexibly configure the image repository domain name according to their own needs, thereby achieving the correct mapping between the image repository domain name and the image repository IP address. For example, when an enterprise adds a new image repository, the administrator can use this configuration process to add the domain name of the new image repository and its corresponding image repository IP address to the second mapping relationship of the DNS server, thereby realizing network address management of the new image repository.

[0184] The image management method provided in this embodiment determines the second mapping relationship through a first user configuration request during the configuration phase. This allows for convenient setting of the correspondence between the image repository domain name and the image repository IP address, ensuring the efficiency of image management. Through centralized management of the DNS server, the second mapping relationship is stored in the DNS server. The change of the second mapping relationship can be completed simply by updating the DNS server through a first user configuration request. Dynamically updating the second mapping relationship in the DNS server through the first user configuration request also reduces manual operation steps and avoids situations where domain name queries fail or image repository IP addresses are incorrect due to errors in manually adding or modifying configuration files.

[0185] Based on the above embodiments, the image management method provided in this application specifically includes image address information in the first user configuration request.

[0186] Specifically, the mirror address information is presented in the form of structured data, which includes the correspondence between multiple mirror repository domain names and mirror repository IP addresses. Each pair of correspondences constitutes a second mapping relationship.

[0187] Specifically, when determining the second mapping relationship in the DNS server based on the received first user configuration request, the following steps are included:

[0188] First, obtain multiple second mapping relationships from the mirror address information.

[0189] When the image management device receives the first user configuration request, it first parses the image address information. Through preset data parsing rules, it extracts multiple second mapping relationships from the image address information. During the parsing process, the image management device performs format verification and accuracy verification on the extracted second mapping relationships to ensure that the image repository domain name and image repository IP address in each second mapping relationship meet the requirements and that there are no duplicate or conflicting mapping relationships.

[0190] Then, multiple second mapping relationships are sent to the DNS server.

[0191] After acquiring and verifying multiple second-level mapping relationships, the image management device sends these relationships to the DNS server via network communication protocols. Upon receiving the mapping relationships, the DNS server stores them in its internal data storage structure, such as a database table or configuration file, for subsequent rapid querying and matching. By configuring these second-level mapping relationships, administrators can easily and uniformly configure the relationship between multiple image repository domain names and image repository IP addresses. For example, when an enterprise expands its image repository cluster on a large scale, the mapping settings for the domain names and IP addresses of multiple newly added image repositories can be completed at once, achieving efficient management of image repository network addresses.

[0192] It should be noted that the first user configuration request method can adapt to the need for frequent configuration and adjustment of image repository IP addresses. Whether it is a small-scale addition of image repositories or a large-scale change of cluster network addresses, it can be completed through the first user configuration request method, ensuring the adaptability of the image management method in different scenarios.

[0193] The image management method provided in this embodiment reduces the number of configuration operations and improves the efficiency of setting the mapping relationship between image repository domain names and image repository IP addresses when managing image repository network addresses on a large scale by requesting multiple second mapping relationships in a single configuration request. In addition, it can also avoid omissions and errors caused by manually configuring second mapping relationships one by one, thus ensuring the accuracy and consistency of the second mapping relationship configuration.

[0194] Based on the above embodiments, the image management method provided in this application, in addition to the management method during the image pulling process mentioned in the above embodiments, also provides a management method during the user or administrator configuration phase. Furthermore, this embodiment mainly involves the configuration process of the first mapping relationship in each cluster.

[0195] Specifically, before obtaining the image pull request, the following steps are also included:

[0196] Based on the received second user configuration request, determine the first mapping relationship corresponding to each cluster.

[0197] Optionally, the mirror management device is equipped with a configuration interface or configuration screen to receive second user configuration requests sent by users or administrators.

[0198] Optionally, the second user configuration request refers to a request sent by an administrator through a management interface or configuration interface. The second user configuration request may include the correspondence information between various clusters, image repository domains, and user identifiers. This information is presented in structured data format, such as JSON or XML, to facilitate parsing and processing by the image management device. Optionally, the second user configuration request and the first user configuration request in the above embodiments may be user configuration requests issued simultaneously during the configuration phase.

[0199] Specifically, when the image management device receives a second user configuration request, it first performs syntax checks and format verification on the information in the request to ensure the accuracy and standardization of the data. If the verification passes, the image management device will generate corresponding first mapping relationships for each cluster based on the information in the second user configuration request.

[0200] Optionally, the first mapping relationship is stored in the access control list of each cluster in the form of entries, each entry containing a corresponding combination of image repository domain name, cluster identifier and user identifier.

[0201] Optionally, during the generation of the first mapping relationship, the image management device will also check the logical relationships between different entries to avoid permission conflicts or duplicate configurations. After the first mapping relationship is determined, the image management device will store it in the management nodes of each cluster for subsequent quick querying and permission verification.

[0202] The image management method provided in this embodiment uniformly determines the first mapping relationship of each cluster through a second user configuration request. This ensures that users can correctly pull images according to preset permissions in different clusters, reducing image pull errors caused by management chaos and ensuring the stability and reliability of image management. The second user configuration request method can flexibly handle changes in image repositories, clusters, and users, guaranteeing the efficiency of image management.

[0203] Based on the above embodiments, the image management method provided in this application specifically includes a second user configuration request containing a user identifier, a cluster identifier, and image address information.

[0204] The mirror address information is presented in the form of structured data, which includes key information such as the mirror repository domain name. The mirror repository domain name, along with the user identifier and cluster identifier, constitutes an important reference indicator for permission verification.

[0205] Specifically, when determining the first mapping relationship corresponding to each cluster based on the received second user configuration request, the following steps are included:

[0206] First, multiple first mapping relationships are generated based on the user identifier, cluster identifier, and the image repository domain name in the image address information.

[0207] Specifically, the image management device transforms each combination of user identifier, cluster identifier, and image repository domain name into an entry with a first mapping relationship. Each entry clarifies the access permissions of a specific user to a specific image repository in a specific cluster.

[0208] Secondly, the clusters corresponding to each first mapping relationship are determined based on the cluster identifier.

[0209] By identifying the cluster identifier in each first mapping entry, the image management device can accurately classify different mapping relationships into the corresponding clusters. For example, for a first mapping entry containing the identifier of cluster D, the image management device determines that it belongs to cluster D.

[0210] Finally, the multiple first mapping relationships are sent to the corresponding clusters for storage.

[0211] The mirror management device transmits the generated first mapping relationship to the management nodes of each cluster through a network communication protocol. Each cluster stores the received first mapping relationship in its own access control list.

[0212] Optionally, during the storage process, the cluster will also perform logical verification between the newly received first mapping relationship and the already stored mapping relationship to avoid permission conflicts or duplicate configurations, and ensure the accuracy and consistency of permission management.

[0213] The image management method provided in this embodiment determines the first mapping relationship corresponding to each cluster by using the user identifier, cluster identifier, and image address information in the second user configuration request. This accurately establishes the correspondence between users, clusters, and image repository domain names, ensuring the efficiency of image management. Furthermore, the second user configuration request method allows for flexible handling of changes in image repositories, clusters, and users, adapting to dynamic business needs.

[0214] To facilitate understanding of the image management method provided in the above embodiments, this embodiment, exemplarily using Kubernetes as a container management platform, introduces a complete process of an image management method. Figure 3 Flowchart of the image management method provided in this application Figure 2 ,refer to Figure 3 As shown, specifically, the image management method includes the following steps:

[0215] S301, Receive configuration requests sent by users.

[0216] The configuration request includes the first user configuration request and the second user configuration request mentioned in the above embodiments.

[0217] S302. Based on the configuration request, generate multiple first mapping relationships and multiple second mapping relationships.

[0218] S303, The first mapping relationship is sent to the corresponding cluster for storage via a Kubernetes job; and the second mapping relationship is sent to the DNS server for storage.

[0219] Specifically, the cluster corresponding to the first mapping relationship is selected based on the cluster identifier in the second user configuration request, and a declarative configuration of the Kubernetes job is generated. The Kubernetes job will write the generated first mapping relationship to the nodes of the corresponding Kubernetes cluster.

[0220] It should be noted that by using a Kubernetes Job as the carrier of the first mapping relationship, and mounting the file paths of the host machines where the cluster nodes reside, the generated first mapping relationship is accurately pushed to the corresponding working clusters. Therefore, this task-based automated deployment mechanism, compared to the traditional method of manually configuring clusters one by one, not only significantly improves configuration efficiency but also effectively reduces the risk of human error through built-in verification and retry logic, ensuring the consistency of image configurations across multiple clusters.

[0221] S304. Receive image pull requests sent by Kubelet based on image-service.

[0222] Among them, image-service is a service that provides full lifecycle management capabilities for container images, covering image storage, security scanning, version control, permission management and distribution.

[0223] It should be noted that image-service has the ability to listen for configuration changes. After the Kubernetes job completes the first mapping relationship and sends it, image-service can immediately detect and synchronize the latest configuration information to ensure that it runs according to the latest rules.

[0224] S305, image-service determines the target image repository domain name, target cluster identifier, and target user identifier based on the image pull request.

[0225] S306, image-service obtains the preset first mapping relationship in the corresponding cluster based on the target cluster identifier.

[0226] S307 and image-service, based on the first mapping relationship, verify whether the target user and the target cluster have the permission to pull image data in the target image repository.

[0227] If the verification fails, S308 and image-service send verification error messages to Kubelet.

[0228] If the verification fails, it is determined that pulling image data is prohibited. At this time, an error message is immediately sent to Kubelet to prevent illegal pulling.

[0229] S309 and image-service send a query request to the DNS server after successful verification.

[0230] S310, image-service receives the target image repository IP address sent by the DNS server after the query is completed.

[0231] S311, image-service sends an image pull command to the target image repository IP address.

[0232] Once the accurate target image repository IP address is determined, interaction is performed with the corresponding image repository. Then, the required image data is retrieved completely according to the specifications, and the image data transfer process is completed.

[0233] It should be noted that the image management method provided in this application embodiment can implement the image management method described in the above method embodiment, and its implementation principle and technical effect are similar, so it will not be repeated here.

[0234] Figure 4Schematic diagram of the image management device provided in the embodiments of this application Figure 1 This image management device is applied to computing devices; specifically, refer to... Figure 4 As shown, the mirror management device 40 includes: an acquisition module 41, a determination module 42, a verification module 43, and a sending module 44.

[0235] Module 41 is used to obtain image pull requests;

[0236] Module 42 is used to determine the target image repository domain name, target cluster identifier, and target user identifier based on the image pull request;

[0237] The acquisition module 41 is also used to obtain a preset first mapping relationship in the corresponding cluster based on the target cluster identifier. The first mapping relationship is the mapping relationship between the image repository domain name, the cluster identifier and the user identifier.

[0238] Verification module 443 is used to verify, based on the first mapping relationship, whether the target user and the target cluster have the permission to pull image data in the target image repository.

[0239] The sending module 44 is used to determine the Internet Protocol IP address of the target image repository based on the target image repository domain name and send an image pull command to the target image repository IP address if the verification is successful.

[0240] In one possible implementation, the first mapping is stored in an access control list;

[0241] Verification module 43 is specifically used for:

[0242] Matching based on the target image repository domain name in the access control list;

[0243] If the target image repository domain name is successfully matched, the target cluster identifier is matched in the mapping relationship where the target image repository domain name is successfully matched.

[0244] If the target cluster identifier is successfully matched, the target user identifier is matched in the mapping relationship where the target cluster identifier is successfully matched.

[0245] If the target user identifier is successfully matched, the request verification is deemed successful.

[0246] In one possible implementation, the verification module 43 is also used for:

[0247] If any of the target image repository domain name, target cluster identifier, or target user identifier fails to match, the verification is deemed unsuccessful.

[0248] In one possible implementation, the sending module 44 is further configured to:

[0249] If verification fails, send a verification error message.

[0250] In one possible implementation, module 42 is specifically used for:

[0251] Send a query request to the DNS server; the DNS server includes a second mapping relationship, which is a mapping relationship between the mirror repository domain name and the mirror repository IP address; the query request includes the target mirror repository domain name;

[0252] Receive the target image repository IP address sent by the DNS server after the query is completed.

[0253] Figure 5 Schematic diagram of the image management device provided in the embodiments of this application Figure 2 . refer to Figure 5 ,exist Figure 4 Based on the structure of the image management device shown, the image management device 40 also includes a configuration module 45.

[0254] In one possible implementation, configuration module 45 is used for:

[0255] Based on the received first user configuration request, determine the second mapping relationship in the DNS server.

[0256] In one possible implementation, the first user configuration request includes mirror address information;

[0257] Configuration module 45 is specifically used for:

[0258] Retrieve multiple second mapping relationships from the image address information;

[0259] Send multiple second mappings to the DNS server.

[0260] In one possible implementation, configuration module 45 is also used for:

[0261] Based on the received second user configuration request, determine the first mapping relationship corresponding to each cluster.

[0262] In one possible implementation, the second user configuration request includes a user identifier, a cluster identifier, and mirror address information;

[0263] Configuration module 45 is specifically used for:

[0264] Multiple first mapping relationships are generated based on the user identifier, cluster identifier, and the image repository domain name in the image address information;

[0265] The clusters corresponding to each first mapping relationship are determined based on the cluster identifier;

[0266] Multiple first mapping relationships are sent to the corresponding clusters for storage.

[0267] Figure 6 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application, with reference to... Figure 6 As shown, the computing device 50 may include a memory 51 and a processor 52; the memory 51 and the processor 52 are coupled. The memory 51 and the processor 52 are communicatively connected via a communication bus; the memory 51 is used to store program instructions; the processor 52 is used to invoke the program instructions to cause the computing device to execute the technical solution shown in the above-described image management method embodiment.

[0268] Optionally, the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of this application can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0269] This application provides a computer-readable storage medium storing a computer program, which, when executed by a computer, implements the image management method described in the above embodiments.

[0270] This application provides a computer program product, including a computer program, which, when executed by a computer, implements the image management method as described in the above embodiments.

[0271] All or part of the steps in the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a readable memory. When the program is executed, it performs the steps of the above-described method embodiments; and the aforementioned memory (storage medium) includes: read-only memory (ROM), RAM, flash memory, hard disk, solid-state drive, magnetic tape, floppy disk, optical disk, and any combination thereof.

[0272] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processing unit of a general-purpose computer, special-purpose computer, embedded processor, or other programmable terminal device to produce a machine, such that the instructions, which execute via the processing unit of the computer or other programmable terminal device, generate instructions for implementing the flowchart. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0273] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable terminal device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0274] In the description of the embodiments of this application, it should be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, an indirect connection through an intermediate medium, or the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in the embodiments of this application according to the specific circumstances.

[0275] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of this application, and are not intended to limit them. Although the embodiments of this application have been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A mirror management method, characterized in that, include: Get the image pull request; The target image repository domain name, target cluster identifier, and target user identifier are determined based on the image pull request. Based on the target cluster identifier, a preset first mapping relationship is obtained in the corresponding cluster. The first mapping relationship is the mapping relationship between the image repository domain name, the cluster identifier and the user identifier. Based on the first mapping relationship, it is verified whether the target user and the target cluster have the permission to pull image data in the target image repository; If the verification is successful, the target image repository Internet Protocol (IP) address is determined based on the target image repository domain name, and an image pull command is sent to the target image repository IP address.

2. The method according to claim 1, characterized in that, The first mapping relationship is stored in an access control list; The step of verifying whether the target user and the target cluster have pull permissions for image data in the target image repository based on the first mapping relationship includes: The target image repository domain name is matched against the access control list. If the target image repository domain name is successfully matched, the target cluster identifier is matched in the mapping relationship where the target image repository domain name is successfully matched; If the target cluster identifier is successfully matched, the target user identifier is matched in the mapping relationship where the target cluster identifier is successfully matched; If the target user identifier is successfully matched, the request verification is deemed successful.

3. The method according to claim 2, characterized in that, Also includes: If any one of the target image repository domain name, the target cluster identifier, or the target user identifier fails to match, the verification is deemed unsuccessful.

4. The method according to claim 1, characterized in that, Also includes: If verification fails, send a verification error message.

5. The method according to claim 1, characterized in that, Determining the target image repository IP address based on the target image repository domain name includes: A query request is sent to a Domain Name System (DNS) server; wherein the DNS server includes a second mapping relationship, which is a mapping relationship between the mirror repository domain name and the mirror repository IP address; the query request includes the target mirror repository domain name; Receive the target image repository IP address sent by the DNS server after the query is completed.

6. The method according to claim 5, characterized in that, Before determining the target image repository IP address based on the target image repository domain name, the method further includes: Based on the received first user configuration request, determine the second mapping relationship in the DNS server.

7. The method according to claim 6, characterized in that, The first user configuration request includes mirror address information; The step of determining the second mapping relationship in the DNS server based on the received first user configuration request includes: Obtain multiple second mapping relationships from the image address information; Send multiple second mappings to the DNS server.

8. The method according to any one of claims 1-7, characterized in that, Before obtaining the image pull request, the process also includes: Based on the received second user configuration request, determine the first mapping relationship corresponding to each cluster.

9. The method according to claim 8, characterized in that, The second user configuration request includes user identifier, cluster identifier, and image address information; The step of determining the first mapping relationship corresponding to each cluster based on the received second user configuration request includes: Multiple first mapping relationships are generated based on the user identifier, the cluster identifier, and the image repository domain name in the image address information; The clusters corresponding to each of the first mapping relationships are determined based on the cluster identifier; Multiple first mapping relationships are sent to the corresponding clusters for storage.

10. A computing device, characterized in that, include: Memory and processor; The memory and the processor are coupled; The memory is used to store program instructions; The processor is used to invoke the program instructions to cause the computing device to perform the method as described in any one of claims 1-9.

Images