Data processing method and application deployment system

Abstract

The embodiment of the invention provides a data processing method and an application deployment system.The data processing method is applied to the application deployment system and comprises the steps that variable encryption data determined by an arrangement user for a to-be-deployed application and an arrangement template containing sensitive fields are obtained; and encrypting the sensitive field based on the variable encryption data, and arranging an encryption result and arrangement data contained in the arrangement template to obtain application plaintext data and application encryption data. The data encryption process does not need to use cloud resources of a user, and the operation and maintenance cost is reduced. The application plaintext data can be used for subsequent deployment of the to-be-deployed application. And under the condition that a data acquisition request submitted by the resource user for the deployed application is received, determining target data corresponding to the data acquisition request based on the application encryption data. Therefore, the user without the access authority can only read the target data in the ciphertext form, the leakage of important data is avoided, and the data security is improved.

Description

Technical Field

[0001] The embodiments in this specification relate to the field of computer technology, and in particular to data processing methods and application deployment systems. Background Technology

[0002] During application deployment, users typically need to bind variables to placeholder fields in orchestration templates. These variables may contain confidential data (such as database connection strings), which usually needs to be encrypted. This confidential data is generally only accessible to the user who submitted the orchestration template and a few high-privilege administrators in plaintext, to prevent leakage.

[0003] In existing technologies, static encryption is commonly used to encrypt confidential data. Users encrypt confidential data before it is written to disk by specifying parameters and using the corresponding encryption configuration file. However, this encryption method is limited to encrypting the data itself and cannot encrypt other user-specified fields, thus still presenting data security issues. Another approach is to use static encryption with an external key management system. However, this method requires complex configuration files or relies on external systems, resulting in additional operational overhead and increased maintenance difficulty. Therefore, there is an urgent need for a more effective data processing method to address these problems. Summary of the Invention

[0004] In view of the above, embodiments of this specification provide a data processing method. One or more embodiments of this specification also relate to an application deployment system, a data processing apparatus, a computing device, a computer-readable storage medium, and a computer program product, to address the technical deficiencies existing in the prior art.

[0005] According to a first aspect of the embodiments of this specification, a data processing method is provided, applied to an application deployment system, comprising: Obtain encrypted variable data and orchestration templates containing sensitive fields as determined by the orchestration user for the application to be deployed; The sensitive fields are encrypted based on the encrypted data of the variables; The encryption result and the orchestration data contained in the orchestration template are orchestrated to obtain application plaintext data and application encrypted data, and the application to be deployed is deployed based on the application plaintext data; Upon receiving a data retrieval request from a resource user for a deployed application, the target data corresponding to the data retrieval request is determined based on the application's encrypted data.

[0006] According to a second aspect of the embodiments of this specification, an application deployment system is provided, including a server, an orchestration client, and a resource client; The orchestration client is used to determine the encrypted variable data and the orchestration template containing sensitive fields for the application to be deployed, and to send the encrypted variable data and the orchestration template to the server. The server is used to encrypt the sensitive field based on the variable encryption data; to arrange the encryption result and the arrangement data contained in the arrangement template to obtain application plaintext data and application encrypted data; and to deploy the application to be deployed based on the application plaintext data. The resource client is used to submit data retrieval requests to the server for the deployed application; The server is used to determine the target data corresponding to the data acquisition request based on the application encrypted data, and send the target data to the resource client.

[0007] According to a third aspect of the embodiments of this specification, a data processing apparatus is provided, applied to an application deployment system, comprising: The acquisition module is configured to acquire encrypted variable data and an orchestration template containing sensitive fields, as determined by the orchestration user for the application to be deployed. The encryption module is configured to encrypt the sensitive field based on the variable encryption data; The orchestration module is configured to orchestrate the encryption result and the orchestration data contained in the orchestration template to obtain application plaintext data and application encrypted data, and to deploy the application to be deployed based on the application plaintext data. The determination module is configured to, upon receiving a data acquisition request submitted by a resource user for a deployed application, determine the target data corresponding to the data acquisition request based on the application's encrypted data.

[0008] According to a fourth aspect of the embodiments of this specification, a computing device is provided, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions, which, when executed by the processor, implement the steps of the above-described data processing method.

[0009] According to a fifth aspect of the embodiments of this specification, a computer-readable storage medium is provided that stores computer-executable instructions, which, when executed by a processor, implement the steps of the data processing method described above.

[0010] According to a sixth aspect of the embodiments of this specification, a computer program product is provided, including a computer program or instructions that, when executed by a processor, implement the steps of the data processing method described above.

[0011] One embodiment of this specification involves obtaining encrypted variable data determined by the orchestration user for the application to be deployed, along with an orchestration template containing sensitive fields. The sensitive fields are then encrypted based on the encrypted variable data, and the encrypted result and the orchestration data contained in the orchestration template are orchestrated to obtain plaintext application data and encrypted application data. This data encryption process does not require the use of the user's cloud resources, reducing operational costs. The plaintext application data can be used for subsequent deployment of the application, while the encrypted application data is used to provide the requester with the data corresponding to the data acquisition request upon receiving a data acquisition request. Upon receiving a data acquisition request from a resource user for the deployed application, the target data corresponding to the data acquisition request is determined based on the encrypted application data. This ensures that users without access permissions can only read the target data in encrypted form, preventing the leakage of important data and improving data security. Attached Figure Description

[0012] Figure 1 This is a schematic diagram of the processing procedure of a data processing method provided in one embodiment of this specification; Figure 2 This is a flowchart illustrating a data processing method provided in one embodiment of this specification; Figure 3 This is a flowchart illustrating the processing procedure of a data processing method provided in one embodiment of this specification. Figure 4 This is a data processing flowchart of a data processing method provided in one embodiment of this specification; Figure 5 This is a schematic diagram illustrating the arrangement and encryption of a data processing method provided in one embodiment of this specification; Figure 6 This is a schematic diagram of the structure of an application deployment system provided in one embodiment of this specification; Figure 7 This is a schematic diagram of the structure of a data processing apparatus provided in one embodiment of this specification; Figure 8 This is a structural block diagram of a computing device provided in one embodiment of this specification. Detailed Implementation

[0013] Many specific details are set forth in the following description to provide a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this specification. Therefore, this specification is not limited to the specific implementations disclosed below.

[0014] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of the one or more embodiments of this specification. The singular forms “a,” “described,” and “the” as used in one or more embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0015] It should be understood that although the terms first, second, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second without departing from the scope of one or more embodiments of this specification, and similarly, second may also be referred to as first. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0016] Furthermore, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties. Moreover, the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0017] First, the terms and concepts used in one or more embodiments of this specification will be explained.

[0018] Kubernetes, also known as K8s, is an open-source system for automatically deploying, scaling, and managing containerized applications. It groups the containers that make up an application into logical units to facilitate management and service discovery.

[0019] Kubernetes orchestration: the automated configuration, management, and coordination of applications and services within the Kubernetes system.

[0020] Kubernetes resource objects: These are the actual objects generated after Kubernetes orchestration and deployment to Kubernetes.

[0021] Kubernetes resource definition: refers to a Kubernetes orchestration that includes the basic attributes of a single Kubernetes resource object, usually written in YAML or JSON format.

[0022] Application deployment: "Deployment" can refer to software deployment, which includes all activities carried out to put a software system into use, such as software installation and startup, environment variable settings, etc.

[0023] Arrangement templates: These are text files created using a template technology (such as Go Template) that require placeholder replacements to generate the actual arrangement.

[0024] Go Template: An implementation of template technology provided by the Go language standard library.

[0025] Python: A popular programming language. It features a simple syntax similar to English, allowing developers to write fewer lines of code than some other programming languages. Python can be used in many fields, including web development (server-side), software development, mathematics, system scripting, and more.

[0026] Kubernetes libraries: These typically refer to Python libraries (such as the Python wrapper for Kubernetes-py) used to interact with Kubernetes clusters. They allow developers to manage Kubernetes resources programmatically. Through Kubernetes libraries, developers can automate the deployment, scaling, and management of containerized applications.

[0027] The yaml library is a Python library for parsing and generating YAML (YAML Ain't Markup Language) files. YAML is a human-readable data serialization format widely used for configuration files, API documentation, and data exchange. The yaml library provides functionality to convert Python objects into YAML strings and to parse YAML strings into Python objects. This allows developers to easily work with YAML-formatted configuration files and data.

[0028] JSON Object: A Java class used to represent JSON (JavaScript Object Notation) objects. JSON is a lightweight data-interchange format composed of key-value pairs, easy for humans to read and write, and also easy for machines to parse and generate. The JSONObject class provides methods for creating, manipulating, and parsing JSON objects, making it convenient for Java developers to work with JSON data.

[0029] JsonPath is a query language for locating and extracting specific elements in JSON data. It allows developers to use path expressions to access specific parts of a JSON data structure. JsonPath supports filters, allowing data to be selected based on criteria. By using JsonPath, developers can process and parse JSON data more efficiently, reducing redundant code and manual traversal. JsonPath has wide applications in web development, API integration, and data transformation.

[0030] Figure 1 This is a schematic diagram illustrating the processing procedure of a data processing method provided in one embodiment of this specification; as shown below. Figure 1 As shown, before deploying the application, the orchestration template needs to be encrypted, allowing the template creator and a few high-privilege administrators to view and edit it. The process involves obtaining encrypted variable data determined by the orchestration user for the application to be deployed, along with the orchestration template containing sensitive fields. These sensitive fields are those that need to be encrypted. The sensitive fields are then encrypted based on the encrypted variable data, and the encrypted result and the orchestration data contained in the orchestration template are orchestrated to obtain the application's plaintext data and encrypted application data. This data encryption process does not require the user's cloud resources, reducing operational costs.

[0031] Plaintext application data can be used for subsequent deployment of the application, while encrypted application data is used to provide the requester with the data corresponding to the data retrieval request upon receiving a data retrieval request. When a resource user submits a data retrieval request for a deployed application, the target data corresponding to the request is determined based on the encrypted application data. This ensures that users without access permissions can only read the target data in encrypted form, preventing the leakage of important data and improving data security.

[0032] This specification provides a data processing method, and also relates to an application deployment system, a data processing device, a computing device, a computer-readable storage medium, and a computer program product, which will be described in detail in the following embodiments.

[0033] See Figure 2 , Figure 2 A flowchart of a data processing method according to an embodiment of this specification is shown. The data processing method is applied to an application deployment system and specifically includes the following steps.

[0034] Step 202: Obtain the encrypted variable data and orchestration template containing sensitive fields determined by the orchestration user for the application to be deployed.

[0035] Specifically, the application to be deployed is the application that the orchestration user needs to deploy. The orchestration user can be any user with data encryption requirements. In application deployment scenarios, the orchestration user can be the application deployer or the user providing the orchestration template. The orchestration template can be a Kubernetes orchestration template. Variable encryption data refers to adjustable data that needs to be added to the orchestration template. Variable encryption data is used to replace the field values ​​of sensitive fields in the orchestration template. Sensitive fields are used to record variables; the values ​​of sensitive fields in the orchestration template are fields whose values ​​can be flexibly adjusted by the orchestration user, and the values ​​of sensitive fields can be updated according to the orchestration user's needs. When applying the orchestration template, the field values ​​of sensitive fields can be replaced by variable encryption data that requires encryption, or by variable encryption data that does not require encryption.

[0036] Based on this, the system obtains the encrypted variable data and the orchestration template containing sensitive fields determined by the orchestration user for the application to be deployed. The encrypted variable data is used to replace the field values ​​of the sensitive fields. When the orchestration template is used subsequently, the field values ​​of the sensitive fields are replaced with the encrypted variable data.

[0037] In practical applications, the field value of a sensitive field can be a placeholder. The placeholder is bound to a variable, and the orchestration template can use the encrypted data of the variable as the variable bound to the placeholder when used later. The placeholder format conforms to the identifier of the regular expression / [A-Za-z][A-Za-z0-9_]*(\.[A-Za-z][A-Za-z0-9_]*)* / . When the placeholder is used to apply the orchestration template, it can be replaced with the actual value used for orchestration.

[0038] Furthermore, considering that sensitive fields are used to record variables, and not all variables recorded in sensitive fields need to be encrypted, the encrypted variable data includes both encrypted variables that need to be encrypted and unencrypted variables that do not need to be encrypted. The specific implementation is as follows: Identify the orchestration user and the application to be deployed associated with the orchestration user; receive the orchestration template containing the sensitive fields generated by the orchestration user for the application to be deployed, and the encrypted and unencrypted variables submitted by the orchestration user for the orchestration template; encrypt the encrypted and unencrypted variables as the variable data.

[0039] Specifically, encrypted variables refer to variable values ​​that need to be recorded in encrypted form during the deployment process of the application to be deployed; unencrypted variables are variable values ​​that do not need to be recorded in encrypted form during the deployment process of the application to be deployed.

[0040] Based on this, the orchestration user and the applications associated with that user that need to be deployed are identified. The system receives an orchestration template containing sensitive fields generated by the orchestration user for the applications to be deployed, as well as encrypted and unencrypted variables submitted by the orchestration user for the sensitive fields in the orchestration template. The encrypted and unencrypted variables are then used as encrypted variable data. Subsequent use of the orchestration template allows for orchestration encryption of both encrypted and unencrypted variables.

[0041] For example, in an application deployment scenario, the user deploying the application (the orchestration user) will bind variables to placeholder fields in the Kubernetes orchestration template. These placeholder fields are the sensitive fields. The user provides an encrypted variable "value2" and an unencrypted variable "value1". In the Kubernetes orchestration template, the sensitive fields are represented as cpu:{{.Values.cpuLimit}}; memory:{{.Values.memoryLimit}}. The encrypted variable "value2" and the unencrypted variable "value1" are the encrypted data provided by the user, used to replace .Values.cpuLimit and .Values.memoryLimit in the sensitive fields.

[0042] In summary, before encrypting the layout template, the layout user provides encrypted and unencrypted variables. The layout user can flexibly determine which data needs to be arranged and encrypted in ciphertext or plaintext form, thus expanding the scope of application of layout encryption.

[0043] Step 204: Encrypt the sensitive field based on the variable encryption data.

[0044] Specifically, after obtaining the encrypted variable data and the orchestration template containing sensitive fields determined by the orchestration user for the application to be deployed, the sensitive fields can be encrypted based on the encrypted variable data. Encryption of sensitive fields can involve converting the field values ​​of sensitive field pairs into ciphertext representations. Encryption algorithms can be used to encrypt sensitive fields.

[0045] Based on this, after obtaining the encrypted variable data and the orchestration template containing sensitive fields determined by the orchestration user for the application to be deployed, the field values ​​of the sensitive fields are replaced based on the encrypted variable data, and then the replaced field values ​​are encrypted.

[0046] Furthermore, considering that a sensitive field contains at least two fields, including an encrypted field that needs to be encrypted and an unencrypted field that does not need to be encrypted, when updating the field value of a sensitive field based on encrypted data from a variable, it is necessary to update the field values ​​of both the encrypted and unencrypted fields simultaneously. The specific implementation is as follows: The process involves determining whether the sensitive field contains encrypted or unencrypted fields; updating the encrypted fields to encrypted variable data based on the encrypted variables, and updating the unencrypted fields to unencrypted variable data based on the unencrypted variables; and using the encrypted variable data and the unencrypted variable data as the encryption result.

[0047] Specifically, encrypted fields are fields whose values ​​need to be encrypted. Unencrypted fields are fields whose values ​​do not need to be encrypted. Encrypted variable data refers to data that needs to be displayed in ciphertext form to users who do not have plaintext read permissions. Unencrypted variable data refers to data that can be displayed in plaintext form.

[0048] Based on this, the encrypted and unencrypted fields included in the sensitive field are identified. The field values ​​of the encrypted fields are updated to the encrypted variable data based on the encrypted variables. The field values ​​of the unencrypted fields are updated to the unencrypted variable data based on the unencrypted variables. The encrypted variable data and the unencrypted variable data are then used as the encryption result for encrypting the sensitive field.

[0049] Continuing with the previous example, the sensitive fields include the encrypted field `memory:{{.Values.memoryLimit}}` and the unencrypted field `cpu:{{.Values.cpuLimit}}`. Based on the encrypted variable "value2", the encrypted field is updated to the encrypted variable data `memory:value2` (plaintext). Based on the unencrypted variable "value1", the unencrypted field is updated to the unencrypted variable data `cpu:value1` (plaintext). The ciphertext form of the encrypted variable data `memory:value2` can be `memory:******` (ciphertext).

[0050] In summary, when updating the field values ​​of sensitive fields based on variable-encrypted data, the field values ​​of both encrypted and unencrypted fields are updated simultaneously to ensure data consistency and integrity.

[0051] Step 206: Arrange the encryption result and the arrangement data contained in the arrangement template to obtain application plaintext data and application encrypted data, and deploy the application to be deployed based on the application plaintext data.

[0052] Specifically, after encrypting sensitive fields based on variable-encrypted data as described above, the encrypted result and the orchestration data contained in the orchestration template can be orchestrated to obtain application plaintext data and application encrypted data. The application to be deployed is then deployed based on the application plaintext data. Here, the encryption result refers to the result of replacing the field value of the sensitive field with the variable-encrypted data to obtain the target field, and then encrypting the target field value. Orchestration data refers to the data contained in the orchestration template, which can be a code segment containing sensitive fields. Application plaintext data refers to orchestration data displayed in text form, while application encrypted data includes orchestration data displayed in ciphertext form and encrypted records generated during the encryption process of the orchestration data.

[0053] Based on this, after encrypting sensitive fields using variable-based encryption data, the encryption results and the orchestration data contained in the orchestration template are orchestrated to obtain application plaintext data and application encrypted data containing application ciphertext data and field encryption records. The application plaintext data is then stored in a resource cluster, and the application to be deployed is deployed based on the application plaintext data stored in the resource cluster.

[0054] Furthermore, when arranging the encryption results and arrangement templates, plaintext and ciphertext data can be generated through syntax arrangement. Field encryption records can then be generated based on the plaintext and ciphertext data, as specifically implemented below: The encryption result and the arrangement data contained in the arrangement template are grammatically arranged to obtain application plaintext data and application ciphertext data; based on the application plaintext data and the application ciphertext data, a field encryption record is generated, and the application ciphertext data and the field encryption record are used as the application encrypted data.

[0055] Specifically, syntax orchestration can involve replacing field values ​​in orchestrated data. When the orchestration target is based on GoTemplate, the orchestrated data can be rendered using a Go Template, and the values ​​of sensitive fields in the orchestration template can be updated to the data provided in the encrypted variable data. By comparing the plaintext and ciphertext data, encrypted field records are generated based on the comparison result.

[0056] Based on this, the encryption result and the arrangement data contained in the arrangement template are syntactically arranged to obtain application plaintext data and application ciphertext data. Syntactically arranged data can be implemented using a programming language or syntax rules based on the arrangement data. The application plaintext data and application ciphertext data are compared, and field-encrypted records are generated based on the comparison result. The application ciphertext data and field-encrypted records are then used as the application encrypted data.

[0057] Continuing with the previous example, when the orchestration template is written based on Go Template, performing syntactic orchestration on the encrypted result and the orchestration data contained in the orchestration template is equivalent to rendering the encrypted result and the orchestration template using Go Template. The encrypted result is cpu:value1 (plaintext). The encrypted variable data is memory:****** (ciphertext), and the orchestration data can be "......spec:containers:-name:main image:nginx imagePullPolicy:IfNotPresentports:-containerPort:8080......". Therefore, by arranging the encrypted results and the arranged data, we can obtain the application plaintext data "......spec:containers:-name:main image:nginximagePullPolicy:IfNotPresentports:-containerPort:8080......cpu":"value1", memory":"value2"" and the application ciphertext data "......spec:containers:-name:main image:nginximagePullPolicy:IfNotPresentports:-containerPort:8080......cpu":"value1", memory":"******"". By comparing the application plaintext data and the application ciphertext data, the field encrypted record can be generated.

[0058] In summary, by performing syntactic orchestration on the encrypted results and the orchestration data contained in the orchestration template, we can obtain application plaintext data and application ciphertext data. Based on the application plaintext data and application ciphertext data, we can determine the encrypted records of fields for subsequent data reading by orchestration users and deployment of applications to be deployed.

[0059] Furthermore, the encryption result and the orchestration data contained in the orchestration template are syntactically orchestrated to obtain the application plaintext data and application ciphertext data. Then, by comparing the application plaintext data and application ciphertext data, field-encrypted records can be generated. The specific implementation is as follows: The plaintext application data is key-value processed to obtain plaintext key-value data, and the ciphertext application data is key-value processed to obtain ciphertext key-value data; by comparing the plaintext key-value data and the ciphertext key-value data, difference key-value data is obtained, and the difference key-value data is used as the encrypted record of the field.

[0060] Specifically, key-value processing of application plaintext and ciphertext data can be achieved through a flattenmap transformation, converting the data into key-value format to obtain application plaintext and ciphertext data in key-value form. Plaintext key-value data is the application plaintext data represented in key-value format; ciphertext key-value data is the application ciphertext data represented in key-value format. Discrimination key-value data refers to the key differences between the ciphertext and plaintext key-value data that are determined through comparison.

[0061] Based on this, the plaintext data of the application is key-value processed to obtain plaintext key-value data. The encrypted data of the application is also key-value processed to obtain encrypted key-value data. By comparing the plaintext and encrypted key-value data, the key data that differs between the two can be identified and designated as the differential key-value data. This differential key-value data can then be used as a field to encrypt records, or encrypted field records can be generated based on the differential key-value data.

[0062] Following the previous example, after obtaining the application plaintext data "......spec:containers:-name:main image:nginx imagePullPolicy:IfNotPresentports:-containerPort:8080......cpu":"value1", memory":"value2"" and the application ciphertext data "......spec:containers:-name:mainimage:nginx imagePullPolicy:IfNotPresentports:-containerPort:8080......cpu":"value1", memory":"******"", the application plaintext data and application ciphertext data are respectively processed into key-value pairs to obtain the plaintext key-value data ""$.spec.template.spec.containers[0].ports[0].containerPort":8080, "$.spec.template.spec.containers[0].resources.limits.cpu":"value1", ...containers[0].resources.limits.cpu":"value1", "$.spec.template.containers[0].resources.limits.cpu":"value1", "$.spec.template.containers[0].resources.limits.cpu":"value1", "$.spec.template.containers[0].resources.limits.cpu":"value1", "$ The plaintext key-value pairs "plate.spec.containers[0].resources.limits.memory":"value2"" and the ciphertext key-value pairs """$.spec.template.spec.containers[0].ports[0].containerPort":8080, "$.spec.template.spec.containers[0].resources.limits.cpu":"value1", $.spec.template.spec.containers[0].resources.limits.memory":"******"" can be compared with the plaintext key-value pairs to determine the difference key-value pair "$.spec.template.spec.containers[0].resources.limits.memory". Based on the difference key-value pair, the encrypted record of the field can be determined.

[0063] In summary, by comparing the plaintext and ciphertext key-value data, we can identify the key data that differs between them. Using these differing key data as the differential key-value data yields the encrypted field record. This describes the differences between the plaintext and ciphertext data used in the application.

[0064] Furthermore, after obtaining the application's plaintext data and encrypted application data, the plaintext data and encrypted application data can be processed separately to meet the application deployment needs of orchestration users, as well as the data reading needs of orchestration users and other users. The specific implementation is as follows: The initial resource definition page is updated to the target resource definition page based on the application encrypted data; the application plaintext data is stored in the resource cluster to be deployed.

[0065] Specifically, the initial resource definition page can be the page corresponding to the orchestration and resource definition display module, used to display the resource definitions to be deployed. The resource cluster to be deployed is used to store the resource definitions to be deployed.

[0066] Based on this, the resource definition display module updates the initial resource definition page to the target resource definition page using encrypted application data, providing a data reading interface for other users with data reading needs. Plaintext application data is then distributed to the resource cluster to be deployed via a trusted channel to facilitate subsequent resource and application deployment.

[0067] Step 208: Upon receiving a data acquisition request submitted by a resource user for a deployed application, determine the target data corresponding to the data acquisition request based on the application's encrypted data.

[0068] Specifically, after arranging the encrypted results and the orchestration data contained in the orchestration template to obtain application plaintext data and application encrypted data, and deploying the application to be deployed based on the application plaintext data, the target data corresponding to the data acquisition request can be determined based on the application encrypted data when a data acquisition request is received from a resource user for the deployed application. Here, a resource user refers to a data reading user who does not have permission to read plaintext data. The data acquisition request can be a computer instruction to read application data or deployment data associated with the deployed application or application during the deployment process. The target data is the application deployment-related data displayed to the resource user, determined according to the data acquisition request and the resource user's read permissions.

[0069] Based on this, after orchestrating the encrypted results and orchestration data contained in the orchestration template to obtain application plaintext data and application encrypted data, and deploying the application to be deployed based on the application plaintext data, upon receiving a data retrieval request from a resource user for the deployed application, it is necessary to provide the resource user with data that meets the resource user's data read permissions. The resource user's data read permissions are determined, and based on the data read permissions and the application encrypted data, the target data corresponding to the data retrieval request is determined and fed back to the resource user.

[0070] Furthermore, considering that during or after application deployment, there may be resource users who need to read data, and these users typically do not have permission to read plaintext data when responding to their data access requests, it is necessary to provide them with encrypted application data. The specific implementation is as follows: When the data acquisition request is associated with the target resource definition page, the application encrypted data corresponding to the application encrypted data is used as the target data corresponding to the data acquisition request.

[0071] Based on this, when a data acquisition request is associated with a target resource definition page, since the resource user submitting the data acquisition request does not have permission to read plaintext data, the application encrypted data corresponding to the application encrypted data is used as the target data corresponding to the data acquisition request, and the target data in encrypted form is displayed to the resource user.

[0072] Continuing with the previous example, when a resource user without plaintext data reading permissions submits a data retrieval request, the resource user is fed back encrypted application data: "......spec:containers:-name:main image:nginximagePullPolicy:IfNotPresentports:-containerPort:8080......cpu":"value1",memory":"******"". This encrypted application data is used as the target data fed back to the resource user.

[0073] In summary, when a data acquisition request is associated with a target resource definition page, the application encrypted data is used as the target data corresponding to the data acquisition request, and the application encrypted data is displayed to the resource user to avoid unnecessary data leakage.

[0074] Furthermore, data retrieval requests from resource users can be submitted to the resource cluster to be deployed. Since resource users do not have permission to read plaintext data, it is necessary to generate target data corresponding to the data retrieval request based on field-encrypted records. The specific implementation is as follows: When the data acquisition request is associated with the resource cluster to be deployed, the encrypted record of the field corresponding to the application encrypted data is determined; the application plaintext object corresponding to the application plaintext data is read from the resource cluster to be deployed; and the target data corresponding to the data acquisition request is generated based on the application plaintext object and the encrypted record of the field.

[0075] Specifically, plaintext objects refer to the actual resource objects generated after the orchestration template is orchestrated, encrypted, and distributed to the resource cluster to be deployed.

[0076] Therefore, when a data acquisition request is associated with a resource cluster to be deployed, it means that the data the resource user wants to obtain needs to be generated by reading resource objects from the resource cluster to be deployed. The process involves identifying the encrypted records corresponding to the application's encrypted data, and then reading the application plaintext object corresponding to the application plaintext data from the resource cluster to be deployed. The application plaintext object is then encrypted based on the encrypted records to generate an encrypted resource object, which is used as the target data for the data acquisition request.

[0077] In summary, when a data acquisition request is associated with a cluster of resources to be deployed, the target data corresponding to the data acquisition request is generated based on the field encryption record. This allows the resource user to view encrypted data that matches their data reading permissions, thus preventing data leakage.

[0078] Furthermore, when generating target data based on the application plaintext object and the field encryption record, it is necessary to encrypt the application plaintext object based on the field encryption record. The specific implementation is as follows: The application plaintext object is converted into plaintext object data; the plaintext object data is encrypted based on the field encryption record to obtain ciphertext object data; the ciphertext object data is converted into an application ciphertext object, and the application ciphertext object is used as the target data.

[0079] Specifically, the plaintext application object is the resource object, specifically the Kubernetes resource object. Plaintext object data can be a JSON object obtained by converting the plaintext application object using Python and Kubernetes libraries or YAML libraries. Ciphertext object data is data obtained by encrypting fields based on the JsonPath in the field encryption record. The application ciphertext object refers to the encrypted form of the Kubernetes resource object obtained by converting the ciphertext object data back into a resource object.

[0080] Based on this, the application plaintext object is converted into plaintext object data in JSON format. The plaintext object data is then encrypted according to the JsonPath in the encrypted field record to obtain ciphertext object data. This ciphertext object data is then converted into an application ciphertext object in object form, and this application ciphertext object is used as the target data to provide the ciphertext target data to resource users.

[0081] Continuing with the previous example, the Kubernetes resource object read from the cluster to be deployed is converted into a JSON object. The JSON object fields are matched against the JsonPath in the encrypted field record. If a match is found, the field value is encrypted. The encrypted JSON object is then converted back into a Kubernetes resource object, which is the target data.

[0082] In summary, plaintext object data is encrypted based on field encryption records to obtain application ciphertext objects, which are then used as target data. The encrypted data is then displayed to resource users, preventing data leakage.

[0083] One embodiment of this specification involves obtaining encrypted variable data determined by the orchestration user for the application to be deployed, along with an orchestration template containing sensitive fields. The sensitive fields are then encrypted based on the encrypted variable data, and the encrypted result and the orchestration data contained in the orchestration template are orchestrated to obtain plaintext application data and encrypted application data. This data encryption process does not require the use of the user's cloud resources, reducing operational costs. The plaintext application data can be used for subsequent deployment of the application, while the encrypted application data is used to provide the requester with the data corresponding to the data acquisition request upon receiving a data acquisition request. Upon receiving a data acquisition request from a resource user for the deployed application, the target data corresponding to the data acquisition request is determined based on the encrypted application data. This ensures that users without access permissions can only read the target data in encrypted form, preventing the leakage of important data and improving data security.

[0084] The following is in conjunction with the appendix Figure 3 Taking the application of the data processing method provided in this specification in application deployment as an example, the data processing method will be further explained. Among other things, Figure 3 A flowchart illustrating the processing procedure of a data processing method according to an embodiment of this specification is shown, specifically including the following steps.

[0085] Step 302: Receive the orchestration template containing placeholders submitted by the orchestration user, as well as the encrypted and unencrypted variables associated with the placeholders.

[0086] During application deployment, users bind variables to placeholder fields in Kubernetes orchestration templates. These variables may contain confidential data (such as database connection strings). Users need to encrypt these variables, allowing only the creator and a few high-privilege administrators to view and edit them in plaintext, and only display the encrypted data to prevent the leakage of confidential information.

[0087] In this embodiment, the orchestrator is the user. For example... Figure 4 As shown, before deploying the application, the user provides an orchestration template containing placeholders, as well as private and regular variables. Private variables are encrypted variables that need to be encrypted, while regular variables are unencrypted variables that do not need to be encrypted.

[0088] Step 304: Arrange and encrypt the orchestration template based on encrypted and unencrypted variables to obtain encrypted resource definitions, plaintext resource definitions, and field encryption records.

[0089] Upon receiving private variables, ordinary variables, and an orchestration template containing placeholders, the orchestration rendering module performs orchestration encryption to obtain encrypted resource definitions, plaintext resource definitions, and encrypted field records. The encrypted resource definition can be a Kubernetes resource definition (ciphertext), and the plaintext resource definition can also be a Kubernetes resource definition (plaintext). The orchestration encryption process is as follows: Figure 5 As shown. The orchestration template containing placeholders, private variables, and ordinary variables are used as orchestration inputs for Go Template rendering. Rendering yields Kubernetes resource definitions (plaintext) and Kubernetes resource definitions (encrypted). The plaintext and encrypted Kubernetes resource definitions are then converted to a FlattenMap intermediate format, resulting in plaintext and encrypted FlattenMaps. The plaintext and encrypted FlattenMaps are compared along their key-value dimensions, and the keys of the differences are recorded. These recorded keys are then archived to generate encrypted field records.

[0090] Step 306: Generate a resource definition page based on the encrypted resource definition.

[0091] The orchestration and resource definition display module generates a resource definition page to display Kubernetes resource definitions (encrypted).

[0092] Step 308: Receive data retrieval requests submitted by resource users for the resource definition page.

[0093] Resource users refer to other users who do not have plaintext read permissions.

[0094] Step 310: Show the encrypted resource definition to the resource user.

[0095] When other users without plaintext access attempt to read Kubernetes resource definitions in the deployment task details interface or other orchestration rendering result interfaces, the Kubernetes resource definitions are displayed (encrypted).

[0096] Step 312: Store the plaintext resource definition in the resource cluster of the resource to be deployed.

[0097] Store the Kubernetes resource definition (in plaintext) in the Kubernetes instance of the resource to be deployed, and generate a Kubernetes resource object.

[0098] Step 314: Receive data retrieval requests submitted by resource users for the resource cluster.

[0099] When other users without plaintext access attempt to read Kubernetes resource objects in the Kubernetes resource object display interface, the system determines whether the object involves encryption. If it does, the corresponding fields are used to encrypt the record, generating a Kubernetes resource object (encrypted) and displaying it through the Kubernetes resource display module. Fields involving private variables are encrypted.

[0100] Step 316: Read the plaintext resource object corresponding to the encrypted resource definition in the resource cluster.

[0101] Step 318: Generate an encrypted resource object based on the plaintext resource object and the field encryption record.

[0102] In practical applications, to meet the reading needs of other users who do not have plaintext reading permissions, the Kubernetes resource object corresponding to the data retrieval request can be read from the resource cluster. This Kubernetes resource object is then converted into a JSON object, and the resulting JSON object is obtained. Fields are then encrypted according to the JsonPath in the encrypted field record to obtain the encrypted Kubernetes resource object. This encrypted Kubernetes resource object is then used as the feedback for the data retrieval request.

[0103] In summary, using a general application orchestration template for encryption covers various Kubernetes resources, broadening its applicability. It eliminates the need for complex encryption configuration files or user-defined keys, resulting in lower comprehension costs. Employing an independent algorithm, it analyzes and traces encrypted field content during Kubernetes resource generation within a system independent of Kubernetes. Plaintext objects are then distributed to the Kubernetes system over the network, without impacting Kubernetes operations and reducing maintenance costs. By binding private variables to designated placeholders in the orchestration template, these fields are presented in encrypted form to users without access, but decrypted plaintext is used when generating Kubernetes objects and distributing them to the Kubernetes system. When reading Kubernetes objects generated using private variables from the Kubernetes system, users without access to the private variable content will only see encrypted fields presented in encrypted form, along with other unencrypted fields displayed in plaintext, preventing data leakage.

[0104] Corresponding to the above method embodiments, this specification also provides application deployment system embodiments. Figure 6 A schematic diagram of the structure of an application deployment system provided in one embodiment of this specification is shown. Figure 6 As shown, the application deployment system 600 includes a server 620, an orchestration client 610, and a resource client 630. The orchestration client 610 is used to determine encrypted variable data and an orchestration template containing sensitive fields for the application to be deployed, and sends the encrypted variable data and the orchestration template to the server 620. The server 620 is used to encrypt the sensitive fields based on the encrypted variable data; orchestrate the encryption result and the orchestration data contained in the orchestration template to obtain plaintext application data and encrypted application data, and deploy the application to be deployed based on the plaintext application data. The resource client 630 is used to submit a data acquisition request to the server 620 for the deployed application; the server 620 is used to determine the target data corresponding to the data acquisition request based on the encrypted application data, and sends the target data to the resource client 630.

[0105] In practical applications, before deploying the application, orchestration users can encrypt the orchestration template through the orchestration client, allowing the template creator and a few high-privilege administrators to view and edit it. The orchestration user determines the encrypted variable data and the orchestration template containing sensitive fields for the application to be deployed. The user sends the encrypted variable data and the orchestration template containing sensitive fields to the server, where the user encrypts and orchestrates the template. The server encrypts the sensitive fields based on the encrypted variable data and orchestrates the encrypted result and the orchestration data contained in the orchestration template to obtain the application's plaintext data and encrypted application data. The data encryption process does not require the use of the user's cloud resources, reducing operational costs. The application's plaintext data can be used for subsequent deployment of the application. If a resource user without data access rights submits a data retrieval request for the deployed application through the resource client, the server determines the target data corresponding to the data retrieval request based on the application's encrypted data and sends the target data to the resource client. Users without access rights can only read the encrypted target data, preventing the leakage of important data and improving data security.

[0106] The above is an illustrative scheme of an application deployment system according to this embodiment. It should be noted that the technical solution of this application deployment system and the technical solution of the data processing method described above belong to the same concept. For details not described in detail in the technical solution of the application deployment system, please refer to the description of the technical solution of the data processing method described above.

[0107] Corresponding to the above method embodiments, this specification also provides data processing apparatus embodiments. Figure 7 A schematic diagram of the structure of a data processing apparatus according to one embodiment of this specification is shown. Figure 7 As shown, this device is used in an application deployment system and includes: The acquisition module 702 is configured to acquire encrypted variable data and an orchestration template containing sensitive fields, determined by the orchestration user for the application to be deployed. Encryption module 704 is configured to encrypt the sensitive field based on the variable encryption data; The orchestration module 706 is configured to orchestrate the encryption result and the orchestration data contained in the orchestration template to obtain application plaintext data and application encrypted data, and to deploy the application to be deployed based on the application plaintext data. The determination module 708 is configured to determine the target data corresponding to the data acquisition request based on the encrypted data of the application when it receives a data acquisition request submitted by a resource user for a deployed application.

[0108] In an optional embodiment, the acquisition module 702 is further configured to: Identify the orchestration user and the application to be deployed associated with the orchestration user; Receive the orchestration template containing the sensitive fields generated by the orchestration user for the application to be deployed, as well as the encrypted and unencrypted variables submitted by the orchestration user for the orchestration template; The encrypted variable and the unencrypted variable are used as the variables to encrypt the data.

[0109] In an optional embodiment, the encryption module 704 is further configured to: Determine whether the sensitive field includes encrypted and unencrypted fields; The encrypted field is updated to encrypted variable data based on the encrypted variable, and the unencrypted field is updated to unencrypted variable data based on the unencrypted variable; The encrypted variable data and the unencrypted variable data are used as the encryption result.

[0110] In an optional embodiment, the orchestration module 706 is further configured to: The encryption result and the arrangement data contained in the arrangement template are grammatically arranged to obtain application plaintext data and application ciphertext data; Based on the application plaintext data and the application ciphertext data, a field encryption record is generated, and the application ciphertext data and the field encryption record are used as the application encryption data.

[0111] In an optional embodiment, the orchestration module 706 is further configured to: The application plaintext data is key-value processed to obtain plaintext key-value data, and the application ciphertext data is key-value processed to obtain ciphertext key-value data. By comparing the plaintext key-value data and the ciphertext key-value data, the difference key-value data is obtained, and the difference key-value data is used as the field to encrypt the record.

[0112] In an optional embodiment, the orchestration module 706 is further configured to: The initial resource definition page is updated to the target resource definition page based on the application encrypted data. The application's plaintext data is stored in the resource cluster to be deployed.

[0113] In an optional embodiment, the determining module 708 is further configured to: When the data acquisition request is associated with the target resource definition page, the application encrypted data corresponding to the application encrypted data is used as the target data corresponding to the data acquisition request.

[0114] In an optional embodiment, the determining module 708 is further configured to: When the data acquisition request is associated with the resource cluster to be deployed, the encrypted record of the field corresponding to the application encrypted data is determined; Read the application plaintext object corresponding to the application plaintext data from the resource cluster to be deployed; The target data corresponding to the data acquisition request is generated based on the application plaintext object and the field encrypted record.

[0115] In an optional embodiment, the determining module 708 is further configured to: Convert the application plaintext object into plaintext object data; The plaintext object data is encrypted based on the field encryption record to obtain ciphertext object data; The encrypted object data is converted into an application encrypted object, and the application encrypted object is used as the target data.

[0116] This specification provides a data processing apparatus in one embodiment that acquires encrypted variable data determined by an orchestration user for an application to be deployed, and an orchestration template containing sensitive fields. Based on the encrypted variable data, the sensitive fields are encrypted, and the encrypted result and the orchestration data contained in the orchestration template are orchestrated to obtain plaintext application data and encrypted application data. The data encryption process does not require the use of the user's cloud resources, reducing operational costs. The plaintext application data can be used for subsequent deployment of the application, while the encrypted application data is used to provide the requester with the data corresponding to the data acquisition request when a data acquisition request is received. Upon receiving a data acquisition request from a resource user for a deployed application, the target data corresponding to the data acquisition request is determined based on the encrypted application data. This ensures that users without access permissions can only read the target data in encrypted form, preventing the leakage of important data and improving data security.

[0117] The above is an illustrative scheme of a data processing apparatus according to this embodiment. It should be noted that the technical solution of this data processing apparatus and the technical solution of the data processing method described above belong to the same concept. For details not described in detail in the technical solution of the data processing apparatus, please refer to the description of the technical solution of the data processing method described above.

[0118] Figure 8 A structural block diagram of a computing device 800 according to one embodiment of this specification is shown. The components of the computing device 800 include, but are not limited to, a memory 810 and a processor 820. The processor 820 is connected to the memory 810 via a bus 830, and a database 850 is used to store data.

[0119] The computing device 800 also includes an access device 840, which enables the computing device 800 to communicate via one or more networks 860. Examples of these networks include Public Switched Telephone Network (PSTN), Local Area Network (LAN), Wide Area Network (WAN), Personal Area Network (PAN), or combinations of communication networks such as the Internet. The access device 840 may include one or more of any type of wired or wireless network interface (e.g., a network interface card (NIC)), such as an IEEE 802.11 Wireless Local Area Network (WLAN) wireless interface, a Wi-MAX (Worldwide Interoperability for Microwave Access) interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, or a Near Field Communication (NFC) interface.

[0120] In one embodiment of this specification, the above-described components of the computing device 800 and Figure 8 Other components, not shown, can also be connected to each other, for example, via a bus. It should be understood that... Figure 8 The block diagram of the computing device shown is for illustrative purposes only and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0121] The computing device 800 can be any type of stationary or mobile computing device, including mobile computers or mobile computing devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile phones (e.g., smartphones), wearable computing devices (e.g., smartwatches, smart glasses, etc.) or other types of mobile devices, or stationary computing devices such as desktop computers or personal computers (PCs). The computing device 800 can also be a mobile or stationary server.

[0122] The processor 820 is configured to execute the following computer-executable instructions, which, when executed by the processor, implement the steps of the above-described data processing method.

[0123] The above is an illustrative scheme of a computing device according to this embodiment. It should be noted that the technical solution of this computing device and the technical solution of the data processing method described above belong to the same concept. For details not described in detail in the technical solution of the computing device, please refer to the description of the technical solution of the data processing method described above.

[0124] An embodiment of this specification also provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the above-described data processing method.

[0125] The above is an illustrative embodiment of a computer-readable storage medium. It should be noted that the technical solution of this storage medium and the technical solution of the data processing method described above belong to the same concept. Details not described in detail in the technical solution of the storage medium can be found in the description of the technical solution of the data processing method described above.

[0126] An embodiment of this specification also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described data processing method.

[0127] The above is an illustrative scheme of a computer program product according to this embodiment. It should be noted that the technical solution of this computer program product and the technical solution of the data processing method described above belong to the same concept. For details not described in detail in the technical solution of the computer program product, please refer to the description of the technical solution of the data processing method described above.

[0128] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0129] The computer instructions include computer program code, which may be in the form of source code, object code, executable file, or certain intermediate forms. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium may be appropriately added or removed according to the requirements of patent practice. For example, in some regions, according to patent practice, computer-readable media may not include electrical carrier signals and telecommunication signals.

[0130] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments in this specification are not limited to the described order of actions, because according to the embodiments in this specification, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the embodiments in this specification.

[0131] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0132] The preferred embodiments disclosed above are merely illustrative of this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the embodiments described herein. These embodiments are selected and specifically described in this specification to better explain the principles and practical applications of the embodiments, thereby enabling those skilled in the art to better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. A data processing method, applied to an application deployment system, comprising: Obtain encrypted variable data and orchestration templates containing sensitive fields as determined by the orchestration user for the application to be deployed; The sensitive fields are encrypted based on the encrypted data of the variables; The encryption result and the orchestration data contained in the orchestration template are orchestrated to obtain application plaintext data and application encrypted data, and the application to be deployed is deployed based on the application plaintext data; Upon receiving a data retrieval request from a resource user for a deployed application, the target data corresponding to the data retrieval request is determined based on the application's encrypted data.

2. The data processing method according to claim 1, wherein obtaining the encrypted variable data determined by the orchestration user for the application to be deployed and the orchestration template containing sensitive fields includes: Identify the orchestration user and the application to be deployed associated with the orchestration user; Receive the orchestration template containing the sensitive fields generated by the orchestration user for the application to be deployed, as well as the encrypted and unencrypted variables submitted by the orchestration user for the orchestration template; The encrypted variable and the unencrypted variable are used as the variables to encrypt the data.

3. The data processing method according to claim 2, wherein encrypting the sensitive field based on the variable-encrypted data includes: Determine whether the sensitive field includes encrypted and unencrypted fields; The encrypted field is updated to encrypted variable data based on the encrypted variable, and the unencrypted field is updated to unencrypted variable data based on the unencrypted variable; The encrypted variable data and the unencrypted variable data are used as the encryption result.

4. The data processing method according to claim 1, wherein arranging the encryption result and the arrangement data contained in the arrangement template to obtain application plaintext data and application encrypted data includes: The encryption result and the arrangement data contained in the arrangement template are grammatically arranged to obtain application plaintext data and application ciphertext data; Based on the application plaintext data and the application ciphertext data, a field encryption record is generated, and the application ciphertext data and the field encryption record are used as the application encryption data.

5. The data processing method according to claim 4, wherein generating field-encrypted records based on the application plaintext data and the application ciphertext data comprises: The application plaintext data is key-value processed to obtain plaintext key-value data, and the application ciphertext data is key-value processed to obtain ciphertext key-value data. By comparing the plaintext key-value data and the ciphertext key-value data, the difference key-value data is obtained, and the difference key-value data is used as the field to encrypt the record.

6. The data processing method according to claim 4, after arranging the encryption result and the arrangement data contained in the arrangement template to obtain the application plaintext data and the application encrypted data, further includes: The initial resource definition page is updated to the target resource definition page based on the application encrypted data. The application's plaintext data is stored in the resource cluster to be deployed.

7. The data processing method according to claim 6, wherein upon receiving a data acquisition request submitted by a resource user for a deployed application, determining the target data corresponding to the data acquisition request based on the application's encrypted data includes: When the data acquisition request is associated with the target resource definition page, the application encrypted data corresponding to the application encrypted data is used as the target data corresponding to the data acquisition request.

8. The data processing method according to claim 6, wherein upon receiving a data acquisition request submitted by a resource user for a deployed application, determining the target data corresponding to the data acquisition request based on the application's encrypted data includes: When the data acquisition request is associated with the resource cluster to be deployed, the encrypted record of the field corresponding to the application encrypted data is determined; Read the application plaintext object corresponding to the application plaintext data from the resource cluster to be deployed; The target data corresponding to the data acquisition request is generated based on the application plaintext object and the field encrypted record.

9. The data processing method according to claim 8, wherein generating the target data corresponding to the data acquisition request based on the application plaintext object and the field encrypted record includes: Convert the application plaintext object into plaintext object data; The plaintext object data is encrypted based on the field encryption record to obtain ciphertext object data; The encrypted object data is converted into an application encrypted object, and the application encrypted object is used as the target data.

10. An application deployment system, comprising a server, an orchestration client, and a resource client; The orchestration client is used to determine the encrypted variable data and the orchestration template containing sensitive fields for the application to be deployed, and to send the encrypted variable data and the orchestration template to the server. The server is used to encrypt the sensitive field based on the variable encryption data; to arrange the encryption result and the arrangement data contained in the arrangement template to obtain application plaintext data and application encrypted data; and to deploy the application to be deployed based on the application plaintext data. The resource client is used to submit data retrieval requests to the server for the deployed application; The server is used to determine the target data corresponding to the data acquisition request based on the application encrypted data, and send the target data to the resource client.

11. A computing device, comprising: Memory and processor; The memory is used to store computer programs or instructions, and the processor is used to execute the computer programs or instructions, which, when executed by the processor, implement the steps of the method according to any one of claims 1-9.

12. A computer-readable storage medium storing a computer program or instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1-9.

13. A computer program product comprising a computer program or instructions which, when executed by a processor, implement the steps of the method according to any one of claims 1-9.

Images