TIPU-based container storage processing method, system, terminal and medium

Abstract

The application discloses a container storage processing method and system based on TIPU, a terminal and a medium, relates to the technical field of storage virtualization, and has the technical scheme as follows: the storage configuration information of NFS shared file information is subjected to encryption processing; a Configmap resource is created; a persistent storage declaration PVC is created, and a TIPU gateway is triggered to dynamically create a virtiofs device; a POD is created, and the virtiofs device is mounted to a container in the POD; the Configmap resource is parsed to inject a first key segment into a virtiofs file system; and a complete key is combined to decrypt file information. The application can ensure that a POD in a Kubernetes environment can perceive and directly access storage resources managed by TIPU in real time, and through seamless integration with a TIPU platform, efficient and dynamic unloading of storage load is achieved.

Description

Technical Field

[0001] This invention relates to the field of storage virtualization technology, and more specifically, to a TIPU-based container storage processing method, system, terminal, and medium. Background Technology

[0002] Container storage refers to the exchange and persistent management of data between containers and the host machine or external storage systems. Due to the short lifespan of containers, the file system inside a container is usually temporary, and data is lost when the container terminates. To ensure the persistence of data in container applications, container technology uses the volume mechanism, mounting storage volumes inside the container so that data can be retained even after the container terminates. Common storage volume types include bindmounts and named volumes. The former mounts a directory from the host machine into the container, while the latter uses the storage mechanisms provided by the container platform (such as Docker and Kubernetes). Taking Kubernetes as an example, Kubernetes provides Persistent Volume (PV) and Persistent Volume Claim (PVC) mechanisms to manage persistent storage for containers. When a container is unloaded, Kubernetes automatically handles the unloading and cleanup of storage volumes according to the definitions of PV and PVC, ensuring data consistency and resource reclamation. In Docker, storage volumes can be mounted and unmounted via command-line tools or APIs. Docker typically does not automatically delete volumes when a container is unloaded unless explicitly specified. Therefore, users need to pay special attention to volume management when unloading containers to avoid losing important data.

[0003] One of the key challenges of containerized storage is how to properly unload storage volumes at the end of a container's lifecycle. The container unloading process involves several technical challenges, primarily including: 1. Storage resource reclamation and release: Containers typically clean up their internal temporary storage data during unloading. However, for persistent storage volumes, properly releasing and reclaiming storage resources to avoid storage waste due to resource leaks or duplicate mounting is a critical issue in container storage management. This is especially true when multiple containers use the same storage volume; the unloading process requires careful attention to the dependencies between containers and storage volumes. 2. Storage volume dependency management: In a containerized environment, a storage volume may be shared by multiple containers or services. When a container unloads, it's essential to verify whether other containers still depend on the storage volume. Blindly unloading a storage volume may prevent other containers from accessing storage, or even cause system failures. Therefore, strict management of storage volume references is necessary during container unloading to ensure that other dependent containers are not affected. 3. Data consistency assurance: During container unloading, the data in the storage volume may not be fully synchronized or committed, especially when using distributed storage systems, where the data in the storage volume may be in an inconsistent state. To ensure data integrity and consistency, the unloading process must guarantee complete data write and employ necessary synchronization mechanisms. 4. Cross-platform compatibility: With the widespread adoption of container technology, containers are extensively deployed in various environments, including on-premises data centers, public clouds, and hybrid cloud environments. Storage systems on different platforms may have different unloading mechanisms and strategies. Container platforms need to provide cross-platform compatibility to ensure that storage unloading operations can be seamlessly executed in different environments.

[0004] Although existing container platforms provide storage management capabilities, problems such as incomplete unloading, data loss, or wasted storage resources still exist in complex container applications, especially when multiple storage backends and multiple containers share the same storage volume. Therefore, researching and designing a container storage technology that can overcome these shortcomings is an urgent problem we need to solve. Summary of the Invention

[0005] To address the shortcomings of existing technologies, the present invention aims to provide a TIPU-based container storage processing method, system, terminal, and medium that ensures that PODs in a Kubernetes environment can perceive and directly access storage resources managed by TIPU in real time. Through seamless integration with the TIPU platform, it achieves efficient and dynamic offloading of storage load, thereby significantly improving storage response speed, reducing host CPU load, and enabling secure data use.

[0006] The above-mentioned technical objective of the present invention is achieved through the following technical solution:

[0007] Firstly, a TIPU-based container storage processing method is provided, including the following steps:

[0008] The storage configuration information of NFS shared file information is encrypted by calling the TIPU gateway interface, and the encryption key is divided into a first key fragment and a second key fragment. The second key fragment is stored in the NFS storage server.

[0009] Create a Configmap resource in the Kubernetes environment that contains the encrypted information after encryption processing, the first key fragment, and the TIPU gateway connection parameters;

[0010] A persistent storage declaration PVC is created through the TIPU CSI driver, and the TIPU gateway is triggered to dynamically create the virtiofs device;

[0011] Create a POD in the Kubernetes environment, and mount the virtiofs device to a container in the POD;

[0012] Parse the Configmap resource to inject the first key fragment into the virtiofs file system;

[0013] When the container in the POD accesses the NFS storage server through the virtiofs device, the first key fragment and the second key fragment are combined into a complete key through the TIPU gateway to decrypt the file information.

[0014] Furthermore, the storage configuration information includes the NFS server IP address, shared folder path, and data key parameters.

[0015] Furthermore, the triggering of the TIPU gateway to dynamically create virtiofs devices includes:

[0016] Device configuration parameters are transmitted via the RPC interface provided by the TIPU gateway.

[0017] The TIPU gateway instantiates the virtiofs device based on the device configuration parameters and returns the device identifier and mount point information.

[0018] Furthermore, the device configuration parameters include the storage backend address, device capacity, and access control policy.

[0019] Furthermore, parsing the Configmap resource includes:

[0020] During the POD startup process, the Configmap is parsed through the Init container or CSI driver to extract the first key fragment;

[0021] The first key fragment is written to the first storage directory of the virtiofs file system for monitoring and access by the TIPU gateway.

[0022] Furthermore, the first storage directory and the second storage directory of the second key fragment in the NFS storage server are the same directory or related directories.

[0023] Furthermore, the method also includes:

[0024] When the container in the POD is closed, the TIPU CSI driver triggers an unloading operation of the virtiofs device from the container in the POD.

[0025] Secondly, it provides a TIPU-based container storage processing system, including:

[0026] The encryption processing module is configured to encrypt the storage configuration information of NFS shared file information by calling the TIPU gateway interface, and to divide the encryption key into a first key fragment and a second key fragment, with the second key fragment stored in the NFS storage server.

[0027] The resource creation module is configured to create a Configmap resource in the Kubernetes environment that contains encrypted information after encryption processing, the first key fragment, and TIPU gateway connection parameters;

[0028] The device creation module is configured to create a persistent storage declaration PVC through the TIPU CSI driver and trigger the TIPU gateway to dynamically create virtiofs devices;

[0029] The device mounting module is configured to create a POD in a Kubernetes environment and mount the virtiofs device to a container within the POD;

[0030] The key injection module is configured to parse the Configmap resource to inject a first key fragment into the virtiofs file system;

[0031] The key combination module is configured to combine the first key fragment and the second key fragment into a complete key through the TIPU gateway when the container in the POD accesses the NFS storage server through the virtiofs device, in order to decrypt file information.

[0032] Thirdly, a computer terminal is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the TIPU-based container storage processing method as described in any one of the first aspects.

[0033] Fourthly, a computer-readable medium is provided having a computer program stored thereon, the computer program being executed by a processor to implement the TIPU-based container storage processing method as described in any one of the first aspects.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] 1. The TIPU-based container storage processing method provided by this invention calls the TIPU gateway interface to encrypt data and splits the key in two. One part is used as a parameter of the configmap, and the other part is saved with the data. The two parts of the key are merged when the POD uses the data, and the data is decrypted using the key. This ensures that only PODs using virtiofs devices can access the data, and other PODs cannot see or use the data. In addition, by calling the TIPU gateway to dynamically create virtiofs devices and seamlessly integrate them with PODs, this process realizes flexible configuration and fast response of storage resources, meeting the demand for high-performance storage in the cloud computing environment.

[0036] 2. This invention directly senses and accesses the NFS file directory through TIPU, reducing the data transmission path between the CPU and storage device, significantly shortening storage access latency, and thus significantly improving the response speed of the storage system.

[0037] 3. This invention offloads the storage load originally borne by the CPU to the TIPU for processing, effectively reducing the workload of the host CPU and allowing the CPU to focus more on performing other critical tasks, thereby improving the overall system performance and efficiency.

[0038] 4. The intelligent scheduling and unloading mechanism of this invention can dynamically allocate storage resources according to the actual needs of the cloud environment, avoiding resource idleness and waste, and significantly improving the overall resource utilization rate of the cloud environment.

[0039] 5. This invention encrypts critical storage configuration information and securely transmits it in the form of metadata during container creation, ensuring the confidentiality and integrity of data during transmission and storage, thereby enhancing the security of the storage system. Attached Figure Description

[0040] The accompanying drawings, which are included to provide a further understanding of embodiments of the invention and form part of this application, do not constitute a limitation thereof. In the drawings:

[0041] Figure 1 This is a flowchart from Embodiment 1 of the present invention;

[0042] Figure 2 This is a system block diagram in Embodiment 2 of the present invention. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the embodiments and accompanying drawings. The illustrative embodiments and descriptions of the present invention are only used to explain the present invention and are not intended to limit the present invention.

[0044] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0045] TIPU: Trusted Intelligent Processing Unit;

[0046] virtiofs: A virtualized file system based on the Virtio protocol;

[0047] Kubernetes: An open-source container orchestration platform;

[0048] POD: The smallest scheduling unit in Kubernetes;

[0049] PVC (Persistent Volume Claim): A claim for persistent storage.

[0050] PV (Persistent Volume): A persistent volume;

[0051] Configmap: A configuration mapping resource in Kubernetes;

[0052] CSI (Container Storage Interface): Container storage interface;

[0053] Init container: The initialization container in Kubernetes;

[0054] NFS (Network File System): A network file system protocol;

[0055] RPC (Remote Procedure Call): Remote Procedure Call Protocol;

[0056] IP address: Internet Protocol address;

[0057] Virtio: A virtualized I / O protocol;

[0058] CPU (Central Processing Unit): Central processing unit;

[0059] I / O (Input / Output): Input / output operations.

[0060] Example 1: TIPU-based container storage processing method, such as Figure 1 As shown, this is achieved through the following steps.

[0061] Step 1: TIPU encrypts NFS shared file information.

[0062] The storage configuration information of NFS shared file information is encrypted by calling the TIPU gateway interface, and the encryption key is divided into a first key fragment and a second key fragment. The second key fragment is stored in the NFS storage server.

[0063] Storage configuration information includes, but is not limited to, NFS server IP address, shared folder path, and data key parameters.

[0064] NFS is a distributed file system protocol that allows users to access files and directories on remote servers over a network, enabling data sharing and persistent storage.

[0065] In some optional examples, encryption can be performed using national cryptographic algorithms, such as asymmetric encryption algorithms, which are not restricted here. Furthermore, key splitting can be implemented using a secret-sharing algorithm, ensuring that the first and second key fragments must be combined for decryption.

[0066] Step 2: Create a configmap in Kubernetes.

[0067] Create a Configmap resource in the Kubernetes environment that contains encrypted information after encryption processing, a first key fragment, and TIPU gateway connection parameters.

[0068] Kubernetes is an open-source container orchestration platform for automating the deployment, scaling, and management of containerized applications. As the foundational platform for container environments, Kubernetes integrates with TIPU to handle the mounting / unmounting of storage volumes.

[0069] Configmap is a configuration management resource in Kubernetes that stores non-confidential data (such as environment variables or file paths) in key-value pairs, thus decoupling configuration from containers.

[0070] Step 3: Create a PVC using Kubernetes.

[0071] The TIPU CSI driver creates a persistent storage declaration PVC and triggers the TIPU gateway to dynamically create virtiofs devices.

[0072] Specifically, device configuration parameters are transmitted via the RPC interface provided by the TIPU gateway. These parameters include, but are not limited to, the storage backend address, device capacity, and access control policies. The TIPU gateway instantiates the virtiofs device based on these configuration parameters and returns the device identifier and mount point information.

[0073] CSI is the standard interface for Kubernetes, allowing third-party storage systems to be integrated into container platforms, enabling dynamic provisioning and management of storage volumes. TIPU interacts with Kubernetes through the CSI driver.

[0074] RPC is a protocol that allows a program to call a subroutine (such as an API) on another computer.

[0075] A PVC is a resource object in Kubernetes used to request persistent storage resources. It abstracts the underlying storage details, and users declare their storage requirements (such as capacity and access mode) through the PVC.

[0076] Virtiofs is a virtualized file system based on the Virtio protocol that allows the host machine to efficiently share files with virtual machines or containers, providing low-latency I / O operations.

[0077] Step 4: Create a POD using Kubernetes.

[0078] Create a POD in the Kubernetes environment and mount the virtiofs device to a container within the POD.

[0079] A POD is the smallest scheduling unit in Kubernetes, which can contain one or more containers and share network and storage resources. A POD provides a runtime environment for applications and has a short lifespan.

[0080] Step 5: TIPU CSI injects the key from the configmap into the virtiofs file system.

[0081] Parse the Configmap resource to inject the first key fragment into the virtiofs file system.

[0082] Specifically, during the POD startup process, the Configmap is parsed through the Init container or CSI driver to extract the first key fragment; the first key fragment is written to the first storage directory of the virtiofs file system for monitoring and access by the TIPU gateway.

[0083] In some optional examples, the first storage directory and the second key fragment's second storage directory on the NFS storage server are the same directory. In other optional examples, the first storage directory and the second key fragment's second storage directory on the NFS storage server are associated directories.

[0084] When the container is shut down, the TIPU CSI driver triggers the unloading operation of the virtiofs device from the container, automatically destroying the first key fragment and temporary storage resources to ensure no resource leaks.

[0085] Step 6: TIPU gateway monitoring key injection.

[0086] When a container accesses an NFS storage server through a virtiofs device, the TIPU gateway combines the first key fragment with the second key fragment into a complete key to decrypt the file information.

[0087] It's important to note that a virtiofs device refers to a virtualized storage device implemented using the Virtio protocol, serving as a bridge between containers and backend storage (such as NFS). The virtiofs file system refers to the file system software layer running on top of the virtiofs device, responsible for managing data organization, access, and encryption / decryption.

[0088] This invention enables more flexible and efficient storage offloading between Kubernetes and TIPU through an intelligent scheduling mechanism. The system automatically selects to offload storage to TIPU based on the storage needs and load of the POD. By connecting with Kubernetes storage management components (such as Persistent Volumes, PVCs, etc.), the storage offloading operation is automatically triggered, which improves the utilization efficiency and scalability of storage resources in the Kubernetes cluster, solves the bottleneck of storage management between Kubernetes and TIPU and data security issues, and meets the needs of cloud computing and containerized applications for high-performance storage resource management.

[0089] Example 2: TIPU-based container storage processing system, such as Figure 2 As shown, the system is used to implement the TIPU-based container storage processing method described in Embodiment 1, including an encryption processing module, a resource creation module, a device creation module, a device mounting module, a key injection module, and a key combination module.

[0090] Specifically, the encryption processing module is configured to: encrypt the storage configuration information of NFS shared file information by calling the TIPU gateway interface, and divide the encryption key into a first key fragment and a second key fragment, with the second key fragment stored in the NFS storage server.

[0091] The resource creation module is configured to create a Configmap resource in the Kubernetes environment that contains encrypted information after encryption processing, a first key fragment, and TIPU gateway connection parameters.

[0092] The device creation module is configured to: create a persistent storage declaration PVC through the TIPU CSI driver, and trigger the TIPU gateway to dynamically create the virtiofs device.

[0093] The device mounting module is configured to create a POD in the Kubernetes environment and mount the virtiofs device to a container within the POD.

[0094] The key injection module is configured to parse the Configmap resource to inject the first key fragment into the virtiofs file system.

[0095] The key combination module is configured to combine the first key fragment and the second key fragment into a complete key through the TIPU gateway when the container accesses the NFS storage server through the virtiofs device, in order to decrypt the file information.

[0096] Example 3: A computer terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the TIPU-based container storage processing method as described in Example 1.

[0097] Example 4: A computer-readable medium having a computer program stored thereon, the computer program being executed by a processor to implement the TIPU-based container storage processing method as described in Example 1.

[0098] Working Principle: This invention first calls a dedicated encryption interface to encrypt critical storage configuration information, ensuring data security during transmission and storage. Subsequently, the encrypted data is stored in the Configmap during container creation. In Kubernetes CSI, the system can capture and parse this Configmap resource. Based on the parsing result, by calling the RPC interface provided by the TIPU gateway, a virtio device matching the storage requirements is dynamically created, and detailed device information is returned instantly. This process enables flexible configuration and rapid response of storage resources. Kubernetes CSI utilizes the virtio device information obtained from the TIPU gateway to mount the virtio device to the node and container when the container starts, and unmount the virtio device from the container and node when the container shuts down. Based on the encryption and decryption capabilities provided by TIPU, when a container accesses the backend storage server through the virtio device, data visibility and availability are maintained inside the container, while data outside the container is completely encrypted and inaccessible.

[0099] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0100] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0101] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1The function specified in one or more boxes.

[0102] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0103] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A TIPU-based container storage processing method, characterized in that, Includes the following steps: The storage configuration information of NFS shared file information is encrypted by calling the TIPU gateway interface, and the encryption key is divided into a first key fragment and a second key fragment. The second key fragment is stored in the NFS storage server. Create a Configmap resource in the Kubernetes environment that contains the encrypted information after encryption processing, the first key fragment, and the TIPU gateway connection parameters; A persistent storage declaration PVC is created through the TIPU CSI driver, and the TIPU gateway is triggered to dynamically create the virtiofs device; Create a POD in the Kubernetes environment, and mount the virtiofs device to a container in the POD; Parse the Configmap resource to inject the first key fragment into the virtiofs file system; When the container in the POD accesses the NFS storage server through the virtiofs device, the first key fragment and the second key fragment are combined into a complete key through the TIPU gateway to decrypt the file information; Among them, TIPU stands for Trusted Intelligent Computing Interconnect Card; The storage configuration information includes the NFS server IP address, shared folder path, and data key parameters; The parsing of the Configmap resource includes: During the POD startup process, the Configmap is parsed through the Init container or CSI driver to extract the first key fragment; The first key fragment is written to the first storage directory of the virtiofs file system for monitoring and access by the TIPU gateway.

2. The TIPU-based container storage processing method according to claim 1, characterized in that, The triggering of the TIPU gateway to dynamically create virtiofs devices includes: Device configuration parameters are transmitted via the RPC interface provided by the TIPU gateway. The TIPU gateway instantiates the virtiofs device based on the device configuration parameters and returns the device identifier and mount point information.

3. The TIPU-based container storage processing method according to claim 2, characterized in that, The device configuration parameters include the storage backend address, device capacity, and access control policy.

4. The TIPU-based container storage processing method according to claim 3, characterized in that, The first storage directory and the second key fragment are the same directory or related directories in the NFS storage server.

5. The TIPU-based container storage processing method according to claim 1, characterized in that, The method also includes: When the container in the POD is closed, the TIPU CSI driver triggers an unloading operation of the virtiofs device from the container in the POD.

6. A TIPU-based container storage processing system, characterized in that, include: The encryption processing module is configured to encrypt the storage configuration information of NFS shared file information by calling the TIPU gateway interface, and to divide the encryption key into a first key fragment and a second key fragment, with the second key fragment stored in the NFS storage server. The resource creation module is configured to create a Configmap resource in the Kubernetes environment that contains encrypted information after encryption processing, the first key fragment, and TIPU gateway connection parameters; The device creation module is configured to create a persistent storage declaration PVC through the TIPU CSI driver and trigger the TIPU gateway to dynamically create virtiofs devices; The device mounting module is configured to create a POD in a Kubernetes environment and mount the virtiofs device to a container within the POD; The key injection module is configured to parse the Configmap resource to inject a first key fragment into the virtiofs file system; The key combination module is configured to combine the first key fragment and the second key fragment into a complete key through the TIPU gateway when the container in the POD accesses the NFS storage server through the virtiofs device, in order to decrypt file information; Among them, TIPU stands for Trusted Intelligent Computing Interconnect Card; The storage configuration information includes the NFS server IP address, shared folder path, and data key parameters; The parsing of the Configmap resource includes: During the POD startup process, the Configmap is parsed through the Init container or CSI driver to extract the first key fragment; The first key fragment is written to the first storage directory of the virtiofs file system for monitoring and access by the TIPU gateway.

7. A computer terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the TIPU-based container storage processing method as described in any one of claims 1-5.

8. A computer-readable medium having a computer program stored thereon, characterized in that, The computer program, when executed by a processor, can implement the TIPU-based container storage processing method as described in any one of claims 1-5.

Images