Method, device, equipment, storage medium and program product for operating cloud resources

Abstract

The application discloses a kind of methods for operating cloud resources, device, equipment, storage medium and program product, it is related to cloud resource technical field, including: first, after receiving the operation instruction sent by target device, operation instruction can be parsed first, obtain operation type information, resource type information, and initial parameter information.Then, according to operation type information and resource type information, match to target operation interface configuration information.Further, initial parameter information can be completed based on target operation interface configuration information, obtain target parameter information.Finally, according to operation type information, resource type information, target parameter information, generate task execution plan, after operator is operated based on task execution set, obtain target operation result, and send feedback information to target device.In this way, the operation efficiency is higher, even if operation instruction lacks relevant information, it can also be automatically completed, avoids configuration error.

Description

Methods, apparatus, equipment, storage media, and software products for operating cloud resources. Technical Field

[0001] This application relates to the field of cloud resource technology, and in particular to methods, apparatus, devices, storage media and program products for operating cloud resources. Background Technology

[0002] In the field of cloud resource technology, cloud resources are generally operated through graphical cloud management platforms. However, for a workload task that requires multiple functional modules, operations and maintenance personnel need to frequently switch between multiple interfaces, manually configure and associate various resources, which is inefficient, prone to configuration errors due to negligence, and has low security. Summary of the Invention

[0003] This application provides methods, apparatus, electronic devices, storage media, and program products for operating cloud resources, addressing the problems of low efficiency and low security in operating cloud resources in related technologies.

[0004] This application provides a method for operating cloud resources, including:

[0005] Receive operation instructions for cloud resources sent by the target device;

[0006] The operation instructions are parsed to obtain operation type information, resource type information, and initial parameter information;

[0007] Based on the operation type information and resource type information, obtain the target operation interface configuration information that matches both the operation type information and resource type information;

[0008] Based on the target operation interface configuration information and initial parameter information, determine the target parameter information;

[0009] Based on the operation type information, resource type information, and target parameter information, a task execution plan is generated;

[0010] According to the task execution plan, the cloud resources are subjected to the operations corresponding to the task execution plan to obtain the target operation result;

[0011] Based on the target operation results, send feedback information to the target device.

[0012] This application also provides an apparatus for operating cloud resources, comprising:

[0013] The receiving module is used to receive operation instructions for cloud resources sent by the target device;

[0014] The parsing module is used to parse operation instructions to obtain operation type information, resource type information, and initial parameter information;

[0015] The acquisition module is used to acquire the target operation interface configuration information that matches both the operation type information and the resource type information, based on the operation type information and the resource type information.

[0016] The determination module is used to determine the target parameter information based on the target operation interface configuration information and initial parameter information;

[0017] The generation module is used to generate a task execution plan based on operation type information, resource type information, and target parameter information; and to execute the corresponding operation on the cloud resources according to the task execution plan to obtain the target operation result.

[0018] The sending module is used to send feedback information to the target device based on the result of the target operation.

[0019] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for executing the computer program to implement the steps of any of the above-described methods for operating cloud resources.

[0020] This application also provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of any of the above-described methods for operating cloud resources.

[0021] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described methods for operating cloud resources.

[0022] This application allows for several steps. First, upon receiving an operation command from the target device, the command is parsed to obtain operation type information, resource type information, and initial parameter information. Then, the target operation interface configuration information is matched against the operation type and resource type information. Next, the initial parameter information is completed based on the target operation interface configuration information to obtain the target parameter information. Finally, a task execution plan is generated based on the operation type, resource type, and target parameter information. After the operator performs the operation based on the task execution set, the target operation result is obtained, and feedback information is sent to the target device. In this solution, the target object only needs to input an operation command containing operation type, resource type, and initial parameter information. Furthermore, since the task may be complex, involving numerous setting parameters, this solution can also use the target operation interface configuration information matched with the operation type and resource type information to complete the initial parameter information, obtaining the complete target parameter information. Thus, with the complete target parameter information, operation type information, and resource type information, a complete task execution plan can be automatically generated, and the relevant operations on the cloud resources can be performed according to the task execution plan. In other words, when operating cloud resources, the target does not need to frequently switch between multiple interfaces, but can directly input simple operation commands, which is highly efficient. Even if the operation command lacks relevant information, it can be automatically completed, avoiding configuration errors and improving the security of operating cloud resources. Attached Figure Description

[0023] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 is a schematic diagram of the architecture of a target system provided in an embodiment of this application;

[0025] Figure 2 is a flowchart illustrating a method for operating cloud resources according to an embodiment of this application;

[0026] Figure 3 is a schematic diagram of the software architecture of a target system provided in an embodiment of this application;

[0027] Figure 4 is a flowchart illustrating an apparatus for operating cloud resources according to an embodiment of this application;

[0028] Figure 5 is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0029] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0030] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0031] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0032] In the field of cloud technology, cloud resource management typically involves the following methods:

[0033] First, there's the graphical cloud management platform (CMP). While intuitive, this approach often involves fixed and cumbersome procedures. For complex tasks spanning multiple functional modules (e.g., creating a complete environment for a new application, including virtual machines, load balancers, security groups, and monitoring and alerting), operations personnel need to frequently switch between multiple interfaces, manually configure and associate various resources, resulting in low efficiency and a high risk of configuration errors due to oversight.

[0034] Second, command-line interface (CLI) tools. This method of automation requires users to accurately memorize the syntax, parameters, and flags of a large number of commands. Users must manually break down a high-level task objective into a series of specific, sequentially executed low-level commands.

[0035] Third, Infrastructure as Code (IaC): IaC tools, such as Terraform and Ansible, define and manage cloud resources through declarative configuration files. However, these IaC tools are primarily geared towards predefined, complete environment deployment and change scenarios. They become too cumbersome for ad-hoc, exploratory queries, such as checking the resource usage of a Virtual Data Center (VDC), or urgent, command-line operations (such as immediately restarting a failed host). Furthermore, writing and maintaining IaC tools requires specialized programming skills.

[0036] Fourth, while some attempts have emerged in recent years to combine chat tools with operation and maintenance systems, most remain at a relatively rudimentary stage, only able to execute preset, fixed scripts or commands, such as querying server status or restarting a service. They generally lack an understanding of complex, multi-step tasks and the ability to autonomously plan, fail to truly understand the deep dependencies between cloud resources, and lack a comprehensive permission and security verification mechanism that dynamically integrates with operational intent, posing significant security risks in high-risk operational scenarios.

[0037] In summary, the current cloud resource management field lacks a cloud resource operation solution that can effectively lower the operational threshold, understand complex operational intentions, autonomously plan execution paths, and provide strong security guarantees.

[0038] The method for operating cloud resources provided in this application can be implemented by a target system, as shown in Figure 1. The target system may include a client device and a cloud platform. The client device may be a user's terminal device, through which the user can access the cloud platform to operate cloud resources. The cloud platform may be a server or server cluster, etc., used to provide various cloud resources.

[0039] The embodiments of this application provide a method for operating cloud resources, which can be executed by a cloud platform. As shown in Figure 2, the specific processing steps of the method for operating cloud resources may include:

[0040] Step S201: Receive the operation instructions for cloud resources sent by the target device.

[0041] The target device can be the aforementioned client device, such as a computer. Cloud resources can be different types of resources, such as virtual machines, containers, virtual private clouds, security groups, load balancers, cloud disks, object storage, etc.

[0042] Specifically, a cloud platform can provide an interactive interface that supports multimodal and multi-channel access, such as a graphical chat interface, command-line tools, and an application programming interface (API) for Hypertext Transfer Protocol (HTTP).

[0043] The graphical chat interface can be embedded into the web console of a cloud management platform or virtualized cloud operating system, providing controls such as text, tables, and buttons. This allows the target audience (who may be a user or tenant of the cloud platform) to log in to the web console of the cloud management platform or virtualized cloud operating system through a browser on the target device. They can then find the interactive entry point for the intelligent chat on the main interface and click it to enter the chat input box. There, they can input operation commands, such as "query virtual machine list." Alternatively, the target audience can use command-line tools to input operation commands on the target device. Or, the HTTP API allows third-party applications, automation scripts, and continuous integration (CI) / continuous deployment pipelines to programmatically call the HTTP API. Accordingly, the target audience can construct operation commands on the HTTP client.

[0044] In this way, the cloud platform can obtain the operation instructions for cloud resources sent by the target device.

[0045] Step S202: Parse the operation instructions to obtain operation type information, resource type information, and initial parameter information.

[0046] The operation type information can include one or more operation types. Operation types can be query (Query / Describe / List), create (Create / Run), modify (Update / Modify), delete (Delete / Remove), perform an action (Start / Stop / Reboot), etc.

[0047] Resource type information may include one or more resource types, or it may include the technical field to which each resource type belongs. For example, virtual machine resource types and container resource types belong to the computing field, virtual private clouds, security groups, and load balancing belong to the networking field, and cloud disks and object storage belong to the storage field. Additionally, the technical field may include databases, user management, etc.

[0048] Initial parameter information can include input parameters, output parameters, and the values ​​of the input parameters. For example, parameters (the aforementioned input or output parameters) can be resource name, region, specifications, filtering conditions, etc. The parameter value for resource name can be "My test host", the parameter value for region can be "North China Region 1", the parameter value for specifications can be "4 cores 8G", and the parameter value for filtering conditions can be "Central Processing Unit utilization is higher than 80%".

[0049] Specifically, after receiving the operation instruction, the cloud platform can parse the operation instruction and extract the operation type information and initial parameter information.

[0050] For example, a cloud platform can analyze operation commands using a pre-built intent recognition model to obtain operation type information, resource type information, etc. Then, using a pre-built sequence labeling model, it can extract one or more parameters and their corresponding values ​​from the operation commands. The extracted parameters and their values ​​constitute the initial parameter information. The intent recognition model can be a hybrid model combining a Large Language Model (LLM) and a specialized dictionary for the cloud resource domain. The sequence labeling model can be a pre-trained language model based on the "Transformer" architecture.

[0051] Alternatively, the cloud platform can be equipped with a lightweight deterministic parser. This parser can pre-store technical keywords, regular expressions, and templates for at least one structured instruction. For example, the template could be "Query / Create / Delete [Resource Type][Resource Name]". The cloud platform can compare the operation instruction with the template of the structured instruction. If the operation instruction matches any template of the structured instruction, the first resource type and initial parameter information can be extracted from the operation instruction using regular expressions and the templates that match the operation instruction. If the operation instruction does not match any template of the structured instruction, the aforementioned intent recognition model and sequence labeling model are then used to extract operation type information, resource type information, and initial parameter information from the operation instruction.

[0052] Step S203: Based on the operation type information and resource type information, obtain the target operation interface configuration information that matches both the operation type information and resource type information.

[0053] Specifically, the cloud platform can pre-store multiple operation interface configuration information. Each operation interface configuration information corresponds to an operation type and a resource type. Therefore, the cloud platform can determine the target operation interface configuration information that matches both the operation type information and the resource type information from at least one interface configuration information based on the operation type information and the resource type information.

[0054] Step S204: Determine the target parameter information based on the target operation interface configuration information and initial parameter information.

[0055] The operation interface configuration information specifies the input parameters required for the operation interface. The operation interface can be an API.

[0056] Specifically, since the initial parameter information may lack some input parameters necessary for operating cloud resources, in order to ensure that the operation of cloud resources can be completed accurately and safely in the future, the initial parameter information can be supplemented in advance according to the operation type information and target interface configuration information to obtain the target parameter information.

[0057] Step S205: Generate a task execution plan based on the operation type information, resource type information, and target parameter information.

[0058] Specifically, the cloud platform can input operation type information, resource type information, and target parameter information into a pre-built plan generation model to obtain the task execution plan output by the plan generation model. The plan generation model can be an LLM (Limited Linear Model).

[0059] Step S206: According to the task execution plan, perform the operation corresponding to the task execution plan on the cloud resources to obtain the target operation result.

[0060] Specifically, the cloud platform can operate on cloud resources according to the task execution plan and obtain the target operation result.

[0061] Step S207: Send feedback information to the target device based on the target operation result.

[0062] Specifically, the cloud platform can generate different feedback information based on the different results of the target operation and send it to the target device so that the target object can view the results of the target operation.

[0063] For example, when an operation command is used to instruct the deletion of cloud resources, the target operation result can be either successful or unsuccessful. Accordingly, the cloud platform can generate corresponding feedback information based on the target operation result and send it to the target device.

[0064] For example, when an operation instruction is used to query cloud resources, the target operation result may include returned data or empty data. If the target operation result includes returned data, the returned data format is converted to the target format, feedback information is obtained, and sent to the target device. The target format can be a table, image, or text. Specifically, the cloud platform can have a built-in rendering template (created using a template engine such as Jinja2) to format the returned data into a clear and easy-to-understand form such as a Markdown table or description list. Alternatively, if the target operation result is empty, target indication information can be directly generated and sent to the target device as feedback information. This target indication information indicates that no data was found, specifically "No matching cloud resources found."

[0065] Thus, the returned data obtained by the cloud platform is generally in JavaScript Object Notation (JSON) format. To facilitate understanding by the target object, the returned data can be converted to the target format. In the case where the target operation result is empty, there is no need to return an empty data structure, which is convenient and easy for the target object to understand.

[0066] The method for operating cloud resources according to embodiments of this application firstly involves parsing the operation command sent by the target device after receiving it, obtaining operation type information, resource type information, and initial parameter information. Then, based on the operation type information and resource type information, target operation interface configuration information is matched. Furthermore, based on the target operation interface configuration information, the initial parameter information is completed to obtain target parameter information. Finally, based on the operation type information, resource type information, and target parameter information, a task execution plan is generated. Based on the task execution set, the operator performs the operation to obtain the target operation result, and feedback information is sent to the target device. In this scheme, the target object only needs to input an operation command containing operation type information, resource type information, and initial parameter information. Moreover, since the task may be complex, including many setting parameters, this scheme can also use target operation interface configuration information that matches the operation type information and resource type information to complete the initial parameter information, obtaining complete target parameter information. Thus, with complete target parameter information, operation type information, and resource type information, a complete task execution plan can be automatically generated, and the relevant operations on the cloud resources can be performed according to the task execution plan. In other words, when operating cloud resources, the target does not need to frequently switch between multiple interfaces, but can directly input simple operation commands, which is highly efficient. Even if the operation command lacks relevant information, it can be automatically completed, avoiding configuration errors and improving the security of operating cloud resources.

[0067] In some optional implementations, in step S204 above, the cloud platform may use the following specific steps to determine the target parameter information based on the target operation interface configuration information and initial parameter information:

[0068] Step 1: Compare the input parameters included in the target operation interface configuration information with the parameters included in the initial parameter information to determine whether there are any missing input parameters in the initial parameter information.

[0069] Step two: If it is determined that there are missing input parameters in the initial parameter information, the initial parameter information is completed according to the target operation interface configuration information to obtain the target parameter information.

[0070] Alternatively, in step three, if it is determined that there are no missing input parameters in the initial parameter information, the initial parameter information can be directly determined as the target parameter information.

[0071] Specifically, the target operation interface configuration information includes all the input parameters required to call the target operation interface. Therefore, the cloud platform can compare the input parameters included in the target operation interface configuration information with the parameters included in the initial parameter information to determine whether the initial parameter information is missing any input parameters required to call the target operation interface. Specifically, for any input parameter included in the target operation interface configuration information, the cloud platform can determine whether the initial parameter information includes that input parameter; if not, it can identify that input parameter as a missing input parameter.

[0072] If the initial parameter information contains missing input parameters, the cloud platform can complete the missing input parameters based on the target operation interface configuration information to obtain the target parameter information. Alternatively, if the initial parameter information does not contain any missing input parameters, it can be directly used as the target parameter information.

[0073] In this way, users only need to input simple operation commands, and the cloud platform can automatically identify and complete any missing input parameters. With this approach, the target user does not need specialized knowledge, and can accurately and securely complete operations on cloud resources even with incomplete input information, avoiding operational errors.

[0074] In some optional implementations, in step three above, the cloud platform can use the following specific steps to complete the initial parameter information based on the target operation interface configuration information to obtain the target parameter information:

[0075] Step 1: Determine whether the target operation interface configuration information contains parameter values ​​or completion methods corresponding to the missing input parameters.

[0076] Step 2: If it is determined that there is a parameter value in the target operation interface configuration information that corresponds to the missing input parameter, extract the parameter value corresponding to the missing input parameter from the target operation interface configuration information.

[0077] Alternatively, in step 3, if it is determined that there is a completion method in the target operation interface configuration information corresponding to the missing input parameter, the parameter value corresponding to the missing input parameter is determined based on the completion method and the initial parameter information.

[0078] Alternatively, in step 4, if it is determined that the target operation interface configuration information does not contain a parameter value and completion method corresponding to the missing input parameter, determine whether the operation instruction is the first operation instruction in the current session.

[0079] Step 5: If it is determined that the operation instruction is not the first operation instruction, infer the context in the current session to obtain the inference result.

[0080] Alternatively, in step 6, if it is determined that the inference result includes parameter values ​​corresponding to the missing input parameters, the parameter values ​​corresponding to the missing input parameters are extracted from the inference result.

[0081] Alternatively, in step 7, if it is determined that the operation instruction is not the first operation instruction in the current session, or if the inference result indicates that the parameter value corresponding to the missing input parameter cannot be inferred, a first query instruction is generated based on the missing input parameter and sent to the target device.

[0082] Step 8: Receive the parameter values ​​sent by the target device that correspond to the missing input parameters.

[0083] Step 9: Generate target parameter information based on the missing input parameters, the parameter values ​​corresponding to the missing input parameters, and the initial parameter information.

[0084] The first query instruction can be used to instruct the target object to input the parameter value corresponding to the missing input parameter.

[0085] Specifically, the target operation interface configuration information may also include default values ​​or completion methods for some of the input parameters required by the target operation interface. The default values ​​are values ​​that conform to the operation rules and are pre-set by the technical personnel. For any missing input parameter, the cloud platform can first determine whether there is a corresponding default value or completion method in the target operation interface configuration information.

[0086] If the target operation interface configuration information contains a default value corresponding to the missing input parameter, the default value can be extracted directly from it and determined as the parameter value of the missing input parameter. Then, the missing input parameter and its corresponding parameter value can be added to the initial parameter information to generate the target parameter information.

[0087] If the target operation interface configuration information contains a completion method corresponding to the missing input parameter, the parameter value corresponding to the missing input parameter can be determined using the completion method and the parameters included in the initial parameter information. Then, the missing input parameter and its corresponding parameter value can be added to the initial parameter information to generate the target parameter information. For example, the initial parameter information includes the name of the virtual data center; however, querying virtual machine resources under the virtual data center requires the virtual data center's identifier (ID). Therefore, the completion method involves calling an API specifically used to convert name and identifier information, resolving the virtual data center name into a unique identifier. The missing input parameter is the virtual data center's identifier, and its corresponding parameter value is the resolved unique identifier.

[0088] If the target operation interface configuration information does not contain a parameter value and completion method corresponding to the missing input parameter, it can be determined whether the operation instruction is the first operation instruction in the current session. If not, it indicates that there is context in the current session, which can be used as reference information to infer the parameter value of the missing input parameter. Accordingly, the cloud platform can use a pre-built inference model to perform inference operations on the pre-acquired context and obtain the inference result. The inference model can be an LLM (Limited Module Model). The context records historical interaction information between the target device and the cloud platform, including one or more operation instructions sent by the target device, feedback information from the cloud platform, resource type information, initial parameter information, target parameter information, task execution plan, etc.

[0089] The context of the current session may be rich enough to infer the value of the missing input parameter. Alternatively, the context of the current session may be limited, or the current session may not contain any context (i.e., the operation instruction is the first operation instruction in the current session), making it impossible to infer the value of the missing input parameter. Therefore, if the cloud platform determines that the operation instruction is not the first operation instruction in the current session, or if the inference result indicates that it cannot be inferred, it can add the missing input parameter to a preset query instruction template to obtain a first query instruction, which is then sent to the target device. After receiving the first query instruction from the cloud platform, the target device can display it, and the target object can input the value of the missing input parameter according to the displayed first query instruction. The target device can then send the parameter value input by the target object to the cloud platform. The cloud platform can receive the value of the missing input parameter and then add the missing input parameter and its corresponding value to the initial parameter information to generate target parameter information. For example, if the missing input parameter is a region, the first query instruction could be "In which region do you want to create the virtual machine?", and the target object could input "North China Region 1".

[0090] In this way, if there is content to be completed in the target operation interface configuration information, completion can be performed directly based on the target operation interface configuration information. If the target operation interface configuration information cannot be completed, completion can continue to be performed by context or target object intervention. Through various completion methods, the integrity of parameter information can be guaranteed, thereby ensuring the accuracy and security of subsequent operations.

[0091] In some optional implementations, for missing input parameters, the cloud platform can obtain the target object's historical configuration information corresponding to the missing input parameters and add the historical configuration information to the first query instruction. This facilitates selection among target objects, transforming a simple question-and-answer process into a more efficient choice, reducing the burden on the target object, simplifying operation, and improving operational efficiency. For example, when a target object says "create a virtual machine" but does not specify specifications, the cloud platform will not only ask "What specifications are needed?", but may also provide a recommended list containing options such as "2 cores 4GB", "4 cores 8GB", and "8 cores 16GB" (i.e., the aforementioned historical configuration information) based on the target object's historical behavior or commonly used configurations.

[0092] In some optional implementations, in step S205 above, the cloud platform may use the following specific steps to generate a task execution plan based on operation type information, association information, and target parameter information:

[0093] Step 1: Based on the target parameter information and the pre-built knowledge graph, determine whether to perform the association operation. If it is determined to perform the association operation, extract the association information corresponding to the target parameter information from the knowledge graph.

[0094] Step two: Generate a task execution plan based on the first resource type, operation type information, target parameter information, and related information.

[0095] The operation type information may include the first resource type.

[0096] Specifically, a knowledge graph can include multiple nodes and edges. Each node corresponds to a resource type, and the node can include attribute information of the resource type. Edges are used to represent the dependency relationship (which can be a subordinate relationship or a connection relationship) between two resource types. For example, a knowledge graph can be built and stored using an attribute graph database (such as Neo4j).

[0097] Since the task indicated in the operation instruction may involve other resource types, a retrieval operation (which can be implemented using the Cypher query language) can be performed in the knowledge graph based on the target parameter information to determine whether the target parameter information contains parameters related to other resource types. If so, it is considered that a correlation operation needs to be performed; otherwise, the task does not need to perform a correlation operation. If a correlation operation is determined to be performed, the correlation information can be extracted from the knowledge graph. Furthermore, the cloud platform can generate a task execution plan based on the first resource type, operation type information, target parameter information, and correlation information.

[0098] In some alternative implementations, in step one above, the cloud platform can use the following specific steps to determine whether to perform an association operation based on the target parameter information and the pre-built knowledge graph:

[0099] Step 1: Based on the target parameter information and the knowledge graph, determine whether the target parameter information includes a second resource type, or whether it includes attribute information corresponding to the second resource type.

[0100] Step 2: If the target parameter information includes a second resource type, or includes attribute information corresponding to the second resource type, determine to perform the association operation.

[0101] Alternatively, in step 3, if the target parameter information does not include the second resource type and does not include the attribute information corresponding to the second resource type, then it is determined that no association operation will be performed.

[0102] The second resource type is a node in the knowledge graph, and the second resource type is different from the first resource type. The attribute information corresponding to the second resource type is the association information.

[0103] Specifically, the target parameter information can include input parameters and output parameters. For each output parameter, the cloud platform can perform a search operation in the knowledge graph. If a node corresponding to the output parameter is retrieved, it can be determined that the output parameter is a second resource type in the knowledge graph. If the output parameter is found to be the attribute information of a node in the knowledge graph, it can be determined that the output parameter is the attribute information of a second resource type, and thus, it can be determined that an association operation is needed. If the output parameter is not found in the knowledge graph, and no attribute information of a node corresponding to the output parameter as a first resource type is retrieved, then it is determined that no association operation is needed.

[0104] Example 1: Resource type information can include the "virtual machine" resource type, and target parameter information can include output parameters such as "name" and "security group". Based on the "virtual machine" resource type in the knowledge graph, it can be determined that "name" and "security group" are both attribute information of the "virtual machine" resource type. Among them, "security group" is another node in the knowledge graph, that is, another resource type (i.e., the second resource type). At this time, it can be determined to perform the association operation, that is, the operation on "security group".

[0105] Example 2: Resource type information can include the "virtual machine" resource type, and target parameter information can include output parameters such as "virtual machine identification information" and "public network communication address". Based on the "virtual machine" resource type in the knowledge graph, the "virtual machine identification information" can be determined as the attribute information of the "virtual machine" resource type, and the "public network communication address" is the attribute information of the "network interface" resource type (i.e., the second resource type). Among them, the "network interface" resource type is another node in the knowledge graph. At this time, it can be determined to perform the association operation, that is, the operation on the "network interface".

[0106] In some optional implementations, in step two above, the cloud platform may use the following specific steps to generate a task execution plan based on the first resource type, operation type information, target parameter information, and associated information:

[0107] Step 1: Determine the first task node based on the first resource type, operation type information, and target parameter information.

[0108] Step 2: Determine the second task node based on the second resource type, operation type information, and associated information.

[0109] Step 3: Determine the dependency relationship between the first task node and the second task node based on the first task node and the second task node.

[0110] Step 4: Generate a task execution plan based on the first task node, the second task node, and the dependencies.

[0111] Specifically, in step 1, the cloud platform can determine the first task name based on the first resource type and operation type information (for example, by directly combining the operation type and the first resource type in the operation type information to obtain the first task name). Then, based on the first task name and the input and output parameters included in the target parameter information, the first task node is constructed.

[0112] Similarly, in step 2, the cloud platform can determine the second task name based on the second resource type and operation type information. Then, based on the second task name and the associated input and output parameters, a second task node is constructed.

[0113] In step 3, the cloud platform can determine the input parameters and output parameters of the first task node and the second task node, and determine the dependency relationship between the first task node and the second task node. The dependency relationship can be one of the following: the first task node depends on the second task node, the second task node depends on the first task node, or there is no dependency relationship between the first task node and the second task node.

[0114] In step 4, the cloud platform can generate multiple operation steps based on the first task node, the second task node, and the dependencies, and then construct the multiple operation steps into a task execution plan.

[0115] Example 1: The operation instruction is "Query virtual machines with CPU utilization greater than 80%, and provide the security group to which the virtual machine belongs". The first task node can be represented as:

[0116] Query virtual machines (first task name). Input parameters include "virtual data center identification information", "region identification information", and "CPU utilization greater than 80%". Output parameters include the identification information and name of each virtual machine.

[0117] The second task node can be represented as:

[0118] Query the security group (second task name). The input parameters include the identification information of virtual machines with a CPU utilization greater than 80% (i.e., the output parameters of the first task node). The output parameters include the identification information and name of the security group.

[0119] The input parameters of the second task node are dependent on the output parameters of the first task node; therefore, the second task node depends on the first task node.

[0120] Example 2: The command is "Query the communication address of the running virtual machine". The communication address can be an Internet Protocol (IP) address.

[0121] The first task node can be represented as:

[0122] Query virtual machine (first task name). Input parameters include "identification information in virtual data", "region identification information", and "running". Output parameters include the identification information and name of the virtual machine.

[0123] The second task node can be represented as:

[0124] Query the network interface (first task name). Input parameters include the virtual machine's identification information, and output parameters include the communication address.

[0125] The input parameters of the second task node are dependent on the output parameters of the first task node; therefore, the second task node depends on the first task node.

[0126] In some alternative implementations, in step 4 above, the cloud platform may use the following specific steps to generate a task execution plan based on the first task node, the second task node, and dependencies:

[0127] Step a: Determine the first operation interface corresponding to the first task node based on the first task node.

[0128] Step b: Determine the second operation interface corresponding to the second task node based on the second task node.

[0129] Step c: Determine the task execution plan based on the first task node, the second task node, the dependency relationship, the first operation interface, and the second operation interface.

[0130] Specifically, for any task node, the cloud platform can determine the operation interface that matches both the resource type and operation type in the pre-built tool directory based on the resource type and operation type included in the task node (where the resource type and operation type can be indicated by the task name). For example, for the first task node, the first operation interface can be determined, and for the second task node, the second operation interface can be determined.

[0131] Finally, the cloud platform can generate a Directed Acyclic Graph (DAG) based on the first task node, the second task node, and dependencies. Each node represents an atomic operation, and edges represent dependencies between two atomic operations. Then, based on the DAG, the first operation interface, and the second operation interface, multiple operation steps are generated, and a task execution plan is generated based on these operation steps. Specifically, based on the task nodes in the DAG and the connections between them, the task nodes are sorted. The sorted task nodes are then combined with their required operation interfaces to generate operation steps corresponding to each task node. Finally, a task execution plan is generated based on the operation steps corresponding to each task node.

[0132] For example, the operation instruction to query the communication address of the running virtual machine in VDC1 can be broken down into two atomic operations. The final task execution plan can be: call the virtual machine query operation interface to query the identification information of the virtual machines in VDC1 that are in a running state, and call the communication address query operation interface to query the communication address of each virtual machine according to the identification information of the queried virtual machine.

[0133] In some optional implementations, in steps a and b above, the cloud platform can also utilize an intent recognition model to identify the technical field to which the resource type belongs. Taking the target technical field as an example, the cloud platform can also obtain a set of operation interfaces for the target technical field, and then select the corresponding operation interface from the set of operation interfaces based on the resource type and operation type. In this way, by classifying the domain, the scope can be narrowed during the selection of operation interfaces, thereby improving parsing efficiency.

[0134] In some optional implementations, in step S202 above, the cloud platform can utilize a knowledge graph to perform entity disambiguation on the parsed information. For example, it can uniformly map "virtual machine," "VM," and "cloud host" to the standard resource type "virtual machine." Furthermore, it can verify the validity of operation instructions using the knowledge graph. Specifically, for resource types included in the resource type information, it can determine whether a node corresponding to that resource type exists in the knowledge graph. If so, the resource type is considered valid; otherwise, it is considered invalid. If the resource type information includes only one resource type, the operation instruction is directly determined to be valid if the resource type is deemed valid, and invalid if the resource type is deemed invalid. If the resource type information includes two resource types, and both resource types are determined to be valid, it can further determine whether an edge exists between the nodes corresponding to the two resource types. If so, it indicates an accurate dependency relationship between the two resource types in the operation instruction; otherwise, it indicates a violation of the dependency relationship defined by the knowledge graph. For example, if the command is "mount the cloud disk to the virtual machine," a knowledge graph can determine that there is an edge between the two nodes corresponding to the cloud disk and the virtual machine, indicating that the command is valid. This pre-judgment ensures the security of subsequent cloud resource operations.

[0135] In some optional implementations, if it is determined that no associated operation will be performed, the first task node is determined directly based on the first resource type, operation type information, and target parameter information. A task execution plan is then generated based on the first task node.

[0136] Specifically, the cloud platform can determine the first task name based on the first resource type and operation type information. Then, based on the first task name and the target parameter information, including the input and output parameters, it can construct a first task node. Finally, it can determine the first operation interface corresponding to the first task node, combine the first task node and the first operation interface to obtain an operation step, and generate a task execution plan based on the operation step.

[0137] In some optional implementations, errors may occur during task execution on the cloud platform, causing task interruption. To improve task execution efficiency and success rate, the cloud platform may also perform the following specific steps during the task execution plan generation process:

[0138] Step 1: Obtain the error handling strategy.

[0139] Step 2: Add the error handling strategy to the task execution plan.

[0140] Specifically, the cloud platform can obtain the error handling policy corresponding to the task name included in the task node, and then add the error handling policy to the task execution plan.

[0141] For example, error handling strategies can include retry and backoff strategies (such as exponential backoff strategies). This means that when network jitter or temporary cloud platform overload is detected (i.e., HTTP status code 429), automatic retries are initiated according to the error handling strategy to improve the success rate of API calls. Additionally, client-side rate limiting can prevent impact on backend services. For non-idempotent operations such as creation, generating unique request identifiers ensures that duplicate resources are not generated even during retries. During execution, the status of each operation step can be monitored in real time. If a hard error that cannot be resolved by retries (such as incorrect parameters or denied permissions) or an execution timeout is detected, subsequent operations can be immediately aborted. Furthermore, for multi-step write operations, a rollback mechanism can be supported. This involves performing compensating operations in reverse order of the task execution plan to restore the task to its pre-task state as much as possible, ensuring data consistency.

[0142] In some optional implementations, the task execution plan may include at least one operation step. To ensure the security of the cloud platform, before step S206 above, the cloud platform may also perform the following verification operation:

[0143] Step 1: Obtain the target object's operation permission information based on the target object's identity information.

[0144] Step 2: Determine the first verification result based on the operation permission information and at least one operation step.

[0145] Step 3: Determine the second verification result based on the target parameter information and the preset parameter restriction rules.

[0146] Step four: After confirming that both the first and second verification results are successful, perform the corresponding operations on the cloud resources according to the task execution plan to obtain the target operation result.

[0147] Specifically, the cloud platform can obtain the target object's operation permission information based on the target object's identity information obtained in advance. This operation permission information specifies the operations that the target object can perform and the operations that cannot be performed.

[0148] For any given operation step, the cloud platform can compare that step with the operation permission information to determine whether the step can be executed, thus obtaining the sub-verification result corresponding to that step. If all sub-verification results for each operation step pass, the passed verification is designated as the first verification result. Alternatively, if all sub-verification results for each operation step fail, the failed verification is designated as the first verification result. For example, a read-only user attempting to delete a cloud resource will be directly rejected.

[0149] For any input parameter in the target parameter information, the cloud platform can determine whether the parameter value is within the range specified by the parameter restriction rules, and obtain the sub-verification result corresponding to that input parameter. If all sub-verification results for each input parameter pass the verification, the passed verification is determined as the second verification result. Alternatively, if all sub-verification results for each input parameter fail the verification, the failed verification is determined as the second verification result. For example, checking whether the number of virtual machines created exceeds the tenant quota.

[0150] If the cloud platform determines that both the first and second verification results are successful, it will then execute step S206. Alternatively, if either the first or second verification result is unsuccessful, the platform will stop executing the task and send the verification result back to the target device so that the target device can re-enter the operation command.

[0151] In some optional implementations, each operation step includes an operation type. Before executing each operation step in step S207, it can be determined whether the operation type included in that operation step is a high-risk operation. Accordingly, the cloud platform can execute the following specific steps:

[0152] Step 1: Before executing the target operation steps, determine the risk level of the first operation type included in the target operation steps.

[0153] Step two: If it is determined that the risk level of the first operation type is not the target risk level, directly execute the target operation steps.

[0154] Step 3: If the risk level of the first operation type is determined to be the target risk level, the second inquiry instruction is generated directly.

[0155] Step four: Send the second query command to the target device.

[0156] Alternatively, in step five, if the risk level of the first operation type is determined to be the target risk level, the first operation type in the target operation step is replaced with the second operation type, and then a third inquiry instruction is generated.

[0157] Step six: Send the third query command to the target device.

[0158] Step 7: After receiving the response information from the target device, execute the target operation steps according to the response information.

[0159] The target operation step can be any one of the operation steps in at least one operation step.

[0160] The target risk level is the highest among a set of preset risk levels. For example, if the risk levels are high, medium, and low, query operations are low-risk, creation and modification operations are medium-risk, deletion and permission change operations are high-risk, and the target risk level can be high-risk.

[0161] The second query instruction can be used to instruct the target object to determine whether to execute the target operation steps according to the first operation type. The third query instruction can be used to instruct the target object to determine whether to execute the target operation steps according to the second operation type.

[0162] The risk level of the second type of operation is lower than that of the first type of operation.

[0163] Specifically, before executing each operation step, the cloud platform can determine the risk level of that operation step. Taking the target operation step as an example, if the cloud platform determines that the risk level of the target operation step is not the target risk level, it means that the risk of executing the target operation step is low, and the target operation step can be executed directly.

[0164] If the risk level of the target operation step is determined to be the target risk level, it means that performing the target operation step carries an extremely high risk. The cloud platform can directly generate a second inquiry instruction and send it to the target device. Alternatively, the cloud platform can replace the first operation type in the target operation step with the second operation type, generate a third inquiry instruction, and send it to the target device. For example, the third inquiry instruction may include the target operation step and the target risk level.

[0165] Upon receiving any query command, the target device can display a message indicating whether to execute the target operation steps according to the operation type specified in the query command. The target device can then obtain a response and send it to the cloud platform. The cloud platform can then execute the target operation steps based on the response. For example, the response could be: "Execute the target operation steps according to the first operation type."

[0166] In some optional implementations, if the risk level of the target operation step is determined to be the target risk level, the target operation step can be simulated (dry run). If the simulation is successful, a fourth query command is sent to the target device so that the target object can confirm whether to perform the actual operation corresponding to the target operation step. After receiving the response information from the target device, the cloud platform executes the target operation step only if the response information indicates that the target operation step should be executed, thereby ensuring the security of the operation. In addition, on the target device side, a confirmation button with a serious warning (e.g., red) can be displayed, or the target object can be forced to input specific content (e.g., the name of the deleted cloud resource) before the response information indicating the execution of the target operation step can be generated, to prevent accidental operation.

[0167] In some alternative implementations, the cloud platform can maintain an independent session for each object (e.g., the target object) or each independent task flow. The session records historical interaction information (i.e., context), such as the target object's questions (i.e., the aforementioned operation instructions), the cloud platform's responses, extracted parameters (such as the initial parameter information mentioned above), the generated task execution plan, and the final template operation result. This allows the cloud platform to understand cross-round referential relationships (e.g., after querying the list of virtual machines, the target object can directly say "close the first one") and supports smooth switching and retention of intents in multi-tasking scenarios. Thus, secondary processing based on the current result context is performed without re-executing the entire query chain, thereby achieving an efficient and coherent dialogue experience.

[0168] In some optional implementations, for any given operation instruction, the cloud platform can generate a full-link audit log. Each log entry in the audit log can have a unique tracking identifier, recording in detail everything from the target object's original input (i.e., the operation instruction), the parsing result (the content parsed in step S202), the generated task execution plan, the calling parameters for each operation step, the original return value (i.e., the target operation result mentioned above), the execution status (whether an error occurred), to the final feedback information presented to the target object. This facilitates subsequent troubleshooting.

[0169] In some alternative implementations, to ensure traceability and non-repudiation of all operational steps, the audit log can be in append-only mode. Each log entry is digitally signed using an asymmetric encryption key pair upon generation, and the signature is stored along with the log content. Simultaneously, each new log entry may also include the hash value of the previous log entry, forming an encrypted blockchain-like structure. This ensures that modifications to historical log entries will break the integrity of the chain, improving the security of the audit log and providing valid evidence for subsequent security audits and troubleshooting.

[0170] In some optional implementations, the knowledge graph can also record the lifecycle state of each resource type and the operational constraints between the two states (this information can be attribute information of the resource type). For example, the knowledge graph defines the states of a virtual machine, such as running, stopped, and creating, and defines the operational constraints between these states (running can be changed to stopped through a stop operation). The operation instruction is "unload a cloud disk from a running virtual machine." The knowledge graph can indicate that the prerequisite for this operation is that the virtual machine must be in a stopped state. Therefore, during the generation of the task execution plan, the cloud platform can automatically insert a task node for stopping the virtual machine into the directed acyclic graph, or indicate the operation constraints to the target object, which can then manually add them. This avoids a large number of invalid operation interface calls.

[0171] In some optional implementations, in step S206, the cloud platform can also adjust the task execution plan based on the real-time task execution status. For example, if the first step of the task execution plan, "query all virtual machines in VDC1", returns an empty result, then all subsequent steps that depend on the identification information of virtual machines (such as querying the disks and monitoring data of these virtual machines) will be dynamically removed from the execution plan, thereby avoiding meaningless operation interface calls, saving cloud platform resources, and shortening task execution time.

[0172] In some optional implementations, where there is no dependency between the first and second task nodes, the operation steps corresponding to the first and second task nodes can be executed in parallel. This reduces the total execution time from the sum of the call times of the two operation interfaces to the longer of the two, significantly improving efficiency in complex query scenarios. For example, in the task of querying the list of virtual machines and the list of networks for VDC1, querying virtual machines and querying networks are two independent operations that can be executed in parallel.

[0173] In some optional implementations, the cloud platform can perform session management, which can include the following three modes: First, Turn Context, with the shortest lifespan, contains only information from the current round of questions and answers, used to handle the most direct referential relationships. Second, Task Context, created when the cloud platform identifies a clear task intent (such as "troubleshooting a performance issue with an application"), used to store all information related to that task (resource types involved, query results, operation history, etc.). This context remains active as long as the target object continues to ask questions related to the task. Third, Session Context, with the longest lifespan, spans the entire single complete interaction between the target object and the system, used to record long-term information such as the target object's preferences and frequently used resources.

[0174] In some optional implementations, if another operation instruction (hereinafter referred to as the second operation instruction) is received from the target device before an operation instruction (hereinafter referred to as the first operation instruction) is completed, the priority of the two operation instructions can be identified through LLM. If the priority of the first operation instruction is greater than or equal to the priority of the second operation instruction, the operation related to the first operation instruction can be executed. If the priority of the first operation instruction is less than the priority of the second operation instruction, the operation corresponding to the first operation instruction can be suspended, and the second operation instruction can be processed first. After the operation corresponding to the second operation instruction is completed, a fifth query instruction can be sent to the target device. The fifth query instruction can be used to instruct the target device to determine whether to continue executing the operation corresponding to the first operation instruction. After receiving the instruction from the target device indicating to execute the operation corresponding to the first operation instruction, the cloud platform continues to execute the operation corresponding to the first operation instruction, thereby achieving smooth task switching and recovery.

[0175] In some optional implementations, the aforementioned first inquiry instruction, second inquiry instruction, third inquiry instruction, fourth inquiry instruction, and fifth inquiry instruction can all be approval forms created by the cloud platform in the IT Service Management (ITSM) system, and the response information can be the approval result of the approval form.

[0176] In some alternative implementations, the cloud platform may be configured with the software system shown in Figure 3, which may include a user interaction layer, a semantic parsing and knowledge retrieval layer, a planning and orchestration layer, an execution and monitoring layer, and a result synthesis and feedback layer.

[0177] The user interaction layer can include multiple functional modules such as multi-channel access, session context management, and user authentication and permissions. Specifically, the multi-channel access module can provide various access methods, including a graphical chat interface, command-line tools, and HTTP API interfaces, for receiving operation commands sent by the target device. The session context management module can be used to implement functions such as recording historical interaction information, understanding cross-round referential relationships, and retaining multi-task intent switching. The user authentication and permissions module can be used to implement functions such as identity verification and authorization, user preference configuration, and multi-tenant isolation management.

[0178] The semantic parsing and knowledge retrieval layer can include multiple functional modules such as intent recognition and domain classification, slot extraction and completion, and knowledge graph matching. Specifically, the intent recognition and domain classification module can be used to implement various functions such as technology field identification and operation type identification. The slot extraction and completion module can be used to implement various functions such as parameter extraction, parameter default value completion and inference, and clarifying dialogue generation, which is essentially the process of completing input parameters and their values. The knowledge graph matching module can be used to implement various functions such as cloud resource relationship storage, entity disambiguation and mapping, and parameter rationality verification.

[0179] The planning and orchestration layer can include multiple functional modules such as an intent decomposer, a tool selector, and a plan generator. Specifically, the intent decomposer can be used to implement various functions such as atomized decomposition of complex tasks, construction of directed acyclic graphs (DAGs), and data dependency analysis. The tool selector can be used to implement various functions such as managing tool catalogs and Model Context Protocol (MCP) service programs (including MCP clients and servers), encapsulating operation interfaces and database tools. The plan generator can be used for task execution plan generation, serial-parallel hybrid orchestration, and error handling strategy configuration.

[0180] The execution and monitoring layer can include multiple functional modules such as a permission and policy engine, an execution engine, and a monitoring and rollback module. Specifically, the permission and policy engine can be used to implement various functions such as strict user permission verification, compliance policies and quota checks, and degradation handling for high-risk operations. The execution engine can be used to implement unified MCP client calls (i.e., communication between the MCP client and the MCP server located in the tool directory, with the latter routing requests to the final cloud platform API or database), retry and exponential backoff mechanisms, rate limiting, and idempotency guarantees, among other functions. The monitoring and rollback module can be used to implement various functions such as real-time status monitoring, error detection and abort, and transaction rollback mechanisms.

[0181] The results synthesis and feedback layer can include multiple functional modules such as results aggregation and interpretation, auditing and logging, and multi-turn dialogue management. Specifically, the results aggregation and interpretation module can be used to implement various functions such as results aggregation and interpretation, multi-step data aggregation, JSON formatting processing, and natural language summarization generation. The auditing and logging module can be used to implement various functions such as generating end-to-end audit logs, tracking and identifying log entries, and encrypted signing and chained storage. The multi-turn dialogue management module can be used to implement various functions such as session state machine updates, follow-up context processing, and intent stack management (e.g., the aforementioned processing of the first and second operation instructions).

[0182] The following example illustrates the process of operating cloud resources.

[0183] First, the user interaction layer receives operation instructions through the multi-channel access module provided above. Then, it creates a new session instance through the session context management module, or records the operation instruction in the current session. The operation instruction is: "Find cloud hosts in the production environment VDC with CPU utilization exceeding 80%, list their names and communication addresses, and tell me which security group they belong to."

[0184] Second, after the semantic parsing and knowledge retrieval layer performs the identification operation through the intent recognition and domain classification module, it can determine that the operation type of the operation instruction is a query, the resource type is a virtual machine resource type, and the technical field to which the virtual machine resource type belongs is the computing field.

[0185] After extraction through the slot extraction and completion module, the following information can be extracted:

[0186] `vdc_name`: "Production Environment VDC";

[0187] `resource_type`:"cloud host" (mapped to virtual machine resource type via knowledge graph);

[0188] `filter_condition`:"CPU utilization > 80%";

[0189] `display_fields`:["name", "communication address", "security group"];

[0190] After performing knowledge graph matching, it can be determined that virtual machine resource types contain attributes such as CPU utilization, name, communication address, and security group. The security group is the associated resource type of the virtual machine in the knowledge graph; directly obtaining the security group name may require additional API calls.

[0191] In addition, the cloud platform can determine that querying cloud resources under a virtual data center usually requires the identification information of the virtual data center rather than its name. Accordingly, it can automatically call an operation interface to resolve the name "Production Environment VDC" to its unique identifier "vdc-xxxxxxxx". Furthermore, if the region is not specified in the operation command, it can automatically complete "Region=City A" based on user configuration or default settings.

[0192] Third, in the planning and orchestration layer, the intent decomposer, based on the information supplemented in the above steps, determines that this task is a complex query that needs to be executed step by step, and can construct the following directed acyclic graph:

[0193] Task A: Query cloud hosts. Input parameters include `vdc_id`, `region_id`, and `cpu_usage_filter`. Output parameters include the identification information, name, communication address, and associated security group identification information for each virtual machine.

[0194] Task B: Query security groups. Input parameters include security group identification information (extracted from the output parameters of Task A), and output parameters include the identification information and name of each security group.

[0195] Dependency: Task B depends on the execution result of Task A.

[0196] The tool selector matches a corresponding operation interface for each of the above tasks. Specifically, for task A, the tool selector matches the "DescribeInstances" operation interface. For task B, the tool selector matches the "DescribeSecurityGroups" operation interface.

[0197] The plan generator performs a topological sort on the directed acyclic graph to generate a sequential execution plan:

[0198] Step 1: Call Describe Instances. The input parameters can be as follows: {region_id:'cn-A city', vdc_id:'vdc-xxxxxxxx', filter:{cpu_usage:'>80%'}}.

[0199] Step 2: Extract the names, addresses, security group identification information, etc. of all virtual machines from the data returned in Step 1.

[0200] Step 3: Collect the identification information of all unique security groups.

[0201] Step 4: Call Describe Security Groups, passing in the parameter {security_group_id:[...]}, which is the security group identification information obtained in step 3 above.

[0202] Step 5: Combine the data returned from Step 1 and Step 4, and associate the virtual machine information with the security group name.

[0203] Fourth, in the execution and monitoring layer, the permissions and policy engine can check whether the current user has read-only permissions for virtual machine information and security group information. It can also check whether the range of parameters in this query is within the allowed range.

[0204] The execution engine initiates a call to Describe Instances to the MCP server via the MCP client. If the MCP server returns a large amount of data, triggering the pagination mechanism, the execution engine can automatically handle the pagination, looping through the calls until all data is retrieved. After the Describe Instances call succeeds, the execution engine can extract and collect the identification information of security groups from the returned data, and then initiate a call to Describe Security Groups.

[0205] Throughout the process, the monitoring and rollback module continuously monitors the return status codes and latency of each operation interface. If a "429 Too Many Requests" error occurs (i.e., HTTP status code 429), an exponential backoff strategy can be initiated, waiting for a period of time before retrying. If consecutive failures occur, the task execution plan is aborted and the error is reported to the next higher level.

[0206] Fifth, in the result synthesis and feedback layer, the result aggregation and interpretation module receives the raw JSON data returned from the two operation interfaces. Based on the final merging steps in the task execution plan, it matches the virtual machine information and security group names to construct a structured data list containing the virtual machine's name, communication address, and security group name. This structured data list is then rendered into a clear table and displayed to the user through a chat window. If the query result is empty, a message will be displayed: "No virtual machines with CPU utilization exceeding 80% were found in the production VDC."

[0207] During the aforementioned task execution, the auditing and logging module can create and store a complete audit log, recording the entire process from the user's original operation command to the final table presentation. Additionally, the multi-turn dialogue management module can save query results within the context of the current session. If the user then says "restart the first one," the information of the virtual machine corresponding to "the first one" can be directly parsed from the context, and a new restart task process can be initiated.

[0208] The method for operating cloud resources in embodiments of this application, firstly, can significantly improve operational efficiency and reduce operational complexity. Specifically, this solution simplifies complex tasks in traditional operations and maintenance that require multiple clicks, execution of multiple commands, or even script writing into a single natural language dialogue. Thus, during operations and maintenance, this solution can effectively shorten troubleshooting time and improve response speed and work efficiency.

[0209] Secondly, this solution can significantly lower the technical threshold and expand the coverage of cloud resource management capabilities. Specifically, users do not need to memorize complicated API or CLI commands, nor do they need to be proficient in the internal architecture of the cloud platform. Developers, testers, and even technical support personnel can safely complete daily operations such as resource querying, creation, and start-up / stopping through natural language, so that cloud resource management capabilities are no longer limited to a few senior operation and maintenance experts.

[0210] Furthermore, this solution boasts high security and effectively mitigates operational risks. Specifically, it incorporates verification procedures at every stage, from intent understanding to final execution. For instance, pre-emptive permission and policy checks effectively prevent unauthorized and unauthorized operations; in-process risk awareness and operational degradation mechanisms effectively prevent production accidents caused by human error; and post-event, tamper-proof audit logs provide clear and reliable traceability evidence for different operations, resulting in a high level of security.

[0211] Finally, this solution goes beyond simple command execution, possessing the ability to understand complex intentions, autonomously decompose and plan tasks, and dynamically adapt to environmental changes. Specifically, it can handle multi-step, cross-domain operation and maintenance scenarios, and can perform coherent, stateful interactions through context management, enabling advanced intelligent operation and maintenance operations.

[0212] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0213] Embodiments of this application also provide an apparatus for operating cloud resources, as shown in FIG4, including:

[0214] The receiving module 410 is used to receive operation instructions for cloud resources sent by the target device;

[0215] The parsing module 420 is used to parse the operation instructions to obtain operation type information, resource type information, and initial parameter information;

[0216] The acquisition module 430 is used to acquire the target operation interface configuration information that matches both the operation type information and the resource type information, based on the operation type information and the resource type information.

[0217] The determination module 440 is used to determine the target parameter information based on the target operation interface configuration information and the initial parameter information;

[0218] The generation module 450 is used to generate a task execution plan based on operation type information, resource type information, and target parameter information; and to perform the corresponding operation on the cloud resources according to the task execution plan to obtain the target operation result.

[0219] The sending module 460 is used to send feedback information to the target device based on the target operation result.

[0220] In some alternative implementations, the determining module 440 is specifically used for:

[0221] The input parameters included in the target operation interface configuration information are compared with the parameters included in the initial parameter information to determine whether there are any missing input parameters in the initial parameter information.

[0222] If it is determined that there are missing input parameters in the initial parameter information, the initial parameter information is completed according to the target operation interface configuration information to obtain the target parameter information;

[0223] Alternatively, if it is determined that there are no missing input parameters in the initial parameter information, the initial parameter information can be directly determined as the target parameter information.

[0224] In some alternative implementations, the determining module 440 is specifically used for:

[0225] Determine whether the target operation interface configuration information contains parameter values ​​or completion methods corresponding to the missing input parameters;

[0226] If it is determined that there is a parameter value in the target operation interface configuration information that corresponds to the missing input parameter, the parameter value corresponding to the missing input parameter is extracted from the target operation interface configuration information.

[0227] Alternatively, if it is determined that there is a completion method in the target operation interface configuration information corresponding to the missing input parameter, the parameter value corresponding to the missing input parameter is determined according to the completion method and the initial parameter information;

[0228] The target parameter information is generated based on the missing input parameters, the parameter values ​​corresponding to the missing input parameters, and the initial parameter information.

[0229] In some alternative implementations, the determining module 440 is specifically used for:

[0230] If it is determined that the target operation interface configuration information does not contain a parameter value and completion method corresponding to the missing input parameter, determine whether the operation instruction is the first operation instruction in the current session;

[0231] If it is determined that the operation instruction is not the first operation instruction, the context in the current session to be acquired is inferred to obtain the inference result;

[0232] If the inference result is determined to include parameter values ​​corresponding to the missing input parameters, the parameter values ​​corresponding to the missing input parameters are extracted from the inference result.

[0233] In some alternative implementations, the determining module 440 is specifically used for:

[0234] If it is determined that the operation instruction is not the first operation instruction in the current session, or if the inference result indicates that the parameter value corresponding to the missing input parameter cannot be inferred, a first query instruction is generated based on the missing input parameter and sent to the target device, wherein the first query instruction is used to instruct the target object to input the parameter value corresponding to the missing input parameter;

[0235] Receive the parameter values ​​sent by the target device that correspond to the missing input parameters.

[0236] In some optional implementations, the operation type information includes a first resource type; the generation module 450 is specifically used for:

[0237] Based on the target parameter information and the pre-built knowledge graph, determine whether to perform the association operation, and if it is determined to perform the association operation, extract the association information corresponding to the target parameter information from the knowledge graph;

[0238] Based on the first resource type, operation type information, target parameter information, and related information, a task execution plan is generated.

[0239] In some alternative implementations, the generation module 450 is specifically used for:

[0240] Based on the target parameter information and the knowledge graph, determine whether the target parameter information includes a second resource type, or whether it includes attribute information corresponding to the second resource type. The second resource type is a node in the knowledge graph, and the second resource type is different from the first resource type. The attribute information corresponding to the second resource type is the association information.

[0241] If the target parameter information includes a second resource type, or includes attribute information corresponding to the second resource type, then determine to perform the association operation.

[0242] or,

[0243] If the target parameter information does not include the second resource type, and does not include the attribute information corresponding to the second resource type, then it is determined that no association operation will be performed.

[0244] In some alternative implementations, the generation module 450 is specifically used for:

[0245] The first task node is determined based on the first resource type, operation type information, and target parameter information;

[0246] The second task node is determined based on the second resource type, operation type information, and associated information;

[0247] Based on the first task node and the second task node, determine the dependency relationship between the first task node and the second task node;

[0248] Based on the first task node, the second task node, and the dependencies, a task execution plan is generated.

[0249] In some alternative implementations, the generation module 450 is specifically used for:

[0250] Based on the first task node, determine the first operation interface corresponding to the first task node;

[0251] Based on the second task node, determine the second operation interface corresponding to the second task node;

[0252] The task execution plan is determined based on the first task node, the second task node, the dependencies, the first operation interface, and the second operation interface.

[0253] In some alternative implementations, the generation module 450 is specifically used for:

[0254] If it is determined that no associated operation will be performed, the first task node is determined directly based on the first resource type, operation type information, and target parameter information;

[0255] Generate a task execution plan based on the first task node.

[0256] In some alternative implementations, the task execution plan includes at least one operational step; the device also includes a verification module 470 for:

[0257] Based on the identity information of the target object to be acquired, obtain the operation permission information of the target object;

[0258] The first verification result is determined based on the operation permission information and at least one operation step.

[0259] Based on the target parameter information and the preset parameter restriction rules, determine the second verification result;

[0260] If both the first and second verification results are confirmed to be successful, then the cloud resources are subjected to the operations corresponding to the task execution plan according to the task execution plan to obtain the target operation result.

[0261] In some optional implementations, each operation step includes an operation type; the generation module 450 is specifically used for:

[0262] Before executing the target operation step, determine the risk level of the first operation type included in the target operation step, wherein the target operation step is any one of at least one operation step;

[0263] If it is determined that the risk level of the first operation type is not the target risk level, the target operation steps are executed directly, wherein the target risk level is the highest risk level among a variety of preset risk levels.

[0264] In some alternative implementations, the generation module 450 is specifically used for:

[0265] If the risk level of the first operation type is determined to be the target risk level, the second inquiry instruction is generated directly.

[0266] A second query instruction is sent to the target device, wherein the second query instruction is used to instruct the target object to determine whether to perform the target operation steps according to the first operation type;

[0267] After receiving the response from the target device, the target operation steps are executed based on the response.

[0268] In some alternative implementations, the generation module 450 is specifically used for:

[0269] If the risk level of the first operation type is determined to be the target risk level, the first operation type in the target operation step is replaced with the second operation type, and then a third query instruction is generated.

[0270] A third inquiry instruction is sent to the target device, wherein the third inquiry instruction is used to instruct the target object to determine whether to perform the target operation steps according to the second operation type, and the risk level of the second operation type is lower than that of the first operation type;

[0271] After receiving the response from the target device, the target operation steps are executed based on the response.

[0272] For a description of the features in the embodiment of the apparatus for operating cloud resources, please refer to the relevant description in the embodiment of the method for operating cloud resources, which will not be repeated here.

[0273] An embodiment of this application also provides an electronic device, as shown in FIG5, including a memory 10 and a processor 20. The memory 10 stores a computer program, and the processor 20 is configured to run the computer program to perform the steps in any of the above-described embodiments of the method for operating cloud resources.

[0274] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described method embodiments for operating cloud resources.

[0275] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0276] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described methods for operating cloud resources.

[0277] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described methods for operating cloud resources.

[0278] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0279] The foregoing has provided a detailed description of the method, apparatus, electronic device, storage medium, and program product for operating cloud resources provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and core ideas of this application. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A method for operating cloud resources, characterized in that, include: Receive operation instructions for cloud resources sent by the target device; The operation instructions are parsed to obtain operation type information, resource type information, and initial parameter information; Based on the operation type information and the resource type information, obtain target operation interface configuration information that matches both the operation type information and the resource type information; compare the input parameters included in the target operation interface configuration information with the parameters included in the initial parameter information to determine whether there are any missing input parameters in the initial parameter information; if it is determined that there are any missing input parameters in the initial parameter information, determine whether there is any parameter value or completion method in the target operation interface configuration information that corresponds to the missing input parameter; If it is determined that a parameter value corresponding to the missing input parameter exists in the target operation interface configuration information, the parameter value corresponding to the missing input parameter is extracted from the target operation interface configuration information; or, if it is determined that a completion method corresponding to the missing input parameter exists in the target operation interface configuration information, the parameter value corresponding to the missing input parameter is determined based on the completion method and the initial parameter information; or, if it is determined that neither a parameter value nor a completion method corresponding to the missing input parameter exists in the target operation interface configuration information, it is determined whether the operation instruction is the first operation instruction in the current session. If it is determined that the operation instruction is not the first operation instruction, the context in the pre-acquired current session is inferred to obtain an inference result; if it is determined that the inference result includes a parameter value corresponding to the missing input parameter, the parameter value corresponding to the missing input parameter is extracted from the inference result; or, if it is determined that the operation instruction is not the first operation instruction in the current session, or if the inference result indicates that the parameter value corresponding to the missing input parameter cannot be inferred, a first query instruction is generated based on the missing input parameter to obtain historical configuration information corresponding to the missing input parameter, and the... Historical configuration information is added to the first query instruction and sent to the target device, wherein the first query instruction is used to instruct the target object to input a parameter value corresponding to the missing input parameter; receive the parameter value corresponding to the missing input parameter sent by the target device; generate target parameter information based on the missing input parameter, the parameter value corresponding to the missing input parameter, and the initial parameter information; generate a task execution plan based on the operation type information, the resource type information, and the target parameter information, wherein the task execution plan includes at least one operation step, and each operation step includes an operation type; based on the... The task execution plan, after performing operations corresponding to the task execution plan on cloud resources, obtains the target operation result, including: before executing the target operation step, determining the risk level of a first operation type included in the target operation step, wherein the target operation step is any one of at least one of the operation steps, and the first operation type is any one of query operations, creation and modification operations, and deletion and permission change operations; if it is determined that the risk level of the first operation type is not the target risk level, the target operation step is executed directly, wherein the target risk level is the highest risk level among a number of preset risk levels; or If the risk level of the first operation type is determined to be the target risk level, the first operation type in the target operation step is replaced with the second operation type, and a third inquiry instruction is generated; the third inquiry instruction is sent to the target device, wherein the third inquiry instruction is used to instruct the target object to determine whether to perform the target operation step according to the second operation type, the risk level of the second operation type being lower than the risk level of the first operation type; after receiving the response information from the target device, the target operation step is performed according to the response information; and feedback information is sent to the target device according to the target operation result.

2. The method for operating cloud resources according to claim 1, characterized in that, The method further includes: if it is determined that the initial parameter information does not contain the missing input parameter, directly determining the initial parameter information as the target parameter information.

3. The method for operating cloud resources according to claim 1 or 2, characterized in that, The operation type information includes a first resource type; generating a task execution plan based on the operation type information, the resource type information, and the target parameter information includes: determining whether to execute an associated operation based on the target parameter information and a pre-built knowledge graph, and if it is determined that an associated operation should be executed, extracting associated information corresponding to the target parameter information from the knowledge graph; and generating the task execution plan based on the first resource type, the operation type information, the target parameter information, and the associated information.

4. The method for operating cloud resources according to claim 3, characterized in that, Based on the target parameter information and the pre-constructed knowledge graph, determining whether to perform an association operation includes: determining whether the target parameter information includes a second resource type, or includes attribute information corresponding to the second resource type, wherein the second resource type is a node in the knowledge graph, and the second resource type is different from the first resource type, and the attribute information corresponding to the second resource type is the association information; if the target parameter information includes the second resource type, or includes attribute information corresponding to the second resource type, determining to perform the association operation; or if the target parameter information does not include the second resource type, and does not include attribute information corresponding to the second resource type, determining not to perform the association operation.

5. The method for operating cloud resources according to claim 4, characterized in that, The step of generating the task execution plan based on the first resource type, the operation type information, the target parameter information, and the association information includes: determining a first task node based on the first resource type, the operation type information, and the target parameter information; determining a second task node based on the second resource type, the operation type information, and the association information; determining the dependency relationship between the first task node and the second task node based on the first task node and the second task node; and generating the task execution plan based on the first task node, the second task node, and the dependency relationship.

6. The method for operating cloud resources according to claim 5, characterized in that, The step of generating the task execution plan based on the first task node, the second task node, and the dependency relationship includes: determining a first operation interface corresponding to the first task node based on the first task node; determining a second operation interface corresponding to the second task node based on the second task node; and determining the task execution plan based on the first task node, the second task node, the dependency relationship, the first operation interface, and the second operation interface.

7. The method for operating cloud resources according to claim 5, characterized in that, The method further includes: if it is determined that no associated operation will be performed, directly determining the first task node based on the first resource type, the operation type information, and the target parameter information; and generating the task execution plan based on the first task node.

8. The method for operating cloud resources according to claim 1 or 2, characterized in that, Before obtaining the target operation result after performing the operation corresponding to the task execution plan on the cloud resources according to the task execution plan, the method further includes: obtaining the operation permission information of the target object based on the pre-acquired identity information of the target object; determining a first verification result based on the operation permission information and at least one of the operation steps; determining a second verification result based on the target parameter information and preset parameter restriction rules; and, if both the first verification result and the second verification result are determined to be successful, then performing the operation corresponding to the task execution plan on the cloud resources according to the task execution plan to obtain the target operation result.

9. An apparatus for operating cloud resources, characterized in that, include: The receiving module is used to receive operation instructions for cloud resources sent by the target device; The parsing module is used to parse the operation instructions to obtain operation type information, resource type information, and initial parameter information; The acquisition module is used to acquire target operation interface configuration information that matches both the operation type information and the resource type information based on the operation type information and the resource type information; the determination module is used to compare the input parameters included in the target operation interface configuration information with the parameters included in the initial parameter information to determine whether there are any missing input parameters in the initial parameter information; if it is determined that there are any missing input parameters in the initial parameter information, the module determines whether there is any parameter value or completion method in the target operation interface configuration information that corresponds to the missing input parameter. If it is determined that a parameter value corresponding to the missing input parameter exists in the target operation interface configuration information, the parameter value corresponding to the missing input parameter is extracted from the target operation interface configuration information; or, if it is determined that a completion method corresponding to the missing input parameter exists in the target operation interface configuration information, the parameter value corresponding to the missing input parameter is determined based on the completion method and the initial parameter information; or, if it is determined that neither a parameter value nor a completion method corresponding to the missing input parameter exists in the target operation interface configuration information, it is determined whether the operation instruction is the first operation instruction in the current session. If it is determined that the operation instruction is not the first operation instruction, the context in the pre-acquired current session is inferred to obtain an inference result; if it is determined that the inference result includes a parameter value corresponding to the missing input parameter, the parameter value corresponding to the missing input parameter is extracted from the inference result; or, if it is determined that the operation instruction is not the first operation instruction in the current session, or if the inference result indicates that the parameter value corresponding to the missing input parameter cannot be inferred, a first query instruction is generated based on the missing input parameter to obtain historical configuration information corresponding to the missing input parameter, and the historical configuration is... Information is added to the first query instruction and sent to the target device, wherein the first query instruction is used to instruct the target object to input a parameter value corresponding to the missing input parameter; receive the parameter value corresponding to the missing input parameter sent by the target device; generate target parameter information based on the missing input parameter, the parameter value corresponding to the missing input parameter, and the initial parameter information; the generation module is used to generate a task execution plan based on the operation type information, the resource type information, and the target parameter information, wherein the task execution plan includes at least one operation step, and each operation step includes an operation type; based on the... The task execution plan, after performing operations corresponding to the task execution plan on cloud resources, obtains the target operation result, including: before executing the target operation step, determining the risk level of a first operation type included in the target operation step, wherein the target operation step is any one of at least one of the operation steps, and the first operation type is any one of query operations, creation and modification operations, and deletion and permission change operations; if it is determined that the risk level of the first operation type is not the target risk level, directly executing the target operation step, wherein the target risk level is the highest risk level among a number of preset risk levels; or, if it is determined that the risk level of the first operation type is not the target risk level, directly executing the target operation step. When the risk level of the first operation type is set as the target risk level, after replacing the first operation type with the second operation type in the target operation step, a third inquiry instruction is generated; the third inquiry instruction is sent to the target device, wherein the third inquiry instruction is used to instruct the target object to determine whether to perform the target operation step according to the second operation type, and the risk level of the second operation type is lower than the risk level of the first operation type; after receiving the reply information from the target device, the target operation step is performed according to the reply information; the sending module is used to send feedback information to the target device according to the target operation result.

10. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the method for operating cloud resources as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the method for operating cloud resources as described in any one of claims 1 to 8.

12. A computer program product, characterized in that, The computer program product includes a computer program, wherein when the computer program is executed by a processor, it implements the steps of the method for operating cloud resources as described in any one of claims 1 to 8.

Images