CN114979286B - Access control method, device, equipment and computer storage medium for container service - Google Patents

Abstract

Access control methods, devices, equipment and computer storage media for container services. The embodiment of the present invention relates to the field of Internet technology and discloses a port exposure method based on a container cluster. The method includes: obtaining an access request sent to a target host port; and determining the target container port corresponding to the target host port according to the port mapping relationship. ; Wherein, the target container port is the port monitored by the target service instance; the port mapping relationship is determined according to the dynamic port segment corresponding to the target service instance; the dynamic port segment is pre-declared by the target service instance; Forward the access request to the target container port. Through the above method, the embodiment of the present invention realizes that the dynamic port during the operation of the container cluster is exposed to the outside of the cluster.

Description

Access control methods, devices, equipment and computer storage media for container services

Technical field

Embodiments of the present invention relate to the field of Internet technology, and specifically to an access control method, device, equipment and computer storage medium for container services.

Background technique

In the existing technology, when using a container cluster manager such as Kubernetes to deploy business services, the container cluster can expose the corresponding port monitored by the business service to the outside of the cluster through third-party components for access by clients outside the cluster. The common point is that it needs to be When a business service is deployed, it declares one or several network ports that it listens on, and the container cluster exposes them to the outside of the cluster through NAT or third-party components. The business service runtime must listen to the corresponding port according to the declaration during deployment to receive external requests.

For containerized services that require negotiation with the client during operation to determine the listening port, since container clusters such as Kubernetes cannot participate during runtime and the listening port determined by negotiation during operation changes dynamically, the existing The deployment method has the problem that the dynamically negotiated port cannot be exposed outside the container cluster cluster.

Contents of the invention

In view of the above problems, embodiments of the present invention provide an access control method for container services to solve the problem in the existing technology that the container port determined by negotiation during operation cannot be accessed outside the cluster.

According to one aspect of an embodiment of the present invention, an access control method for container services is provided, and the method includes:

Get the access request sent to the target host port;

The target container port corresponding to the target host port is determined according to the port mapping relationship; wherein the target container port is the port monitored by the target service instance; the port mapping relationship is determined according to the dynamic port segment corresponding to the target service instance; The dynamic port segment is pre-declared by the target service instance;

Forward the access request to the target container port.

In an optional manner, the dynamic port segment includes a container dynamic port segment and a host dynamic port segment; the method further includes:

Determine the container port to be monitored according to the port monitoring request sent by the target service instance; the target container port is one of the container ports to be monitored;

When it is determined that the container port to be monitored matches the container dynamic port segment, an optional host port is determined according to the host dynamic port segment; the target host port is one of the optional host ports;

A mapping relationship is established between the optional host port and the port to be monitored.

In an optional manner, the method further includes:

Any idle host port in the host dynamic port segment is determined as the optional host port.

In an optional manner, the method further includes:

When it is determined that the calling request for the kernel function in the Linux system includes the target network namespace identifier corresponding to the target service instance, the kernel function is intercepted to obtain the container port to be monitored; wherein, the kernel function uses In order to realize the monitoring of the container port to be monitored by the target service instance.

In an optional manner, the method further includes:

When it is determined that the dynamic port segment corresponding to the target service instance is not empty, obtain the target network namespace identifier of the target service instance;

The target network namespace identifier is sent to an interceptor; the interceptor is deployed in the kernel module of the Linux system; the interceptor is used to intercept the kernel function.

In an optional manner, the container cluster includes multiple host nodes; multiple optional service instances are deployed on one host node; the target service instance is one of the optional service instances; The dynamic port segment includes a host dynamic port segment; the method further includes:

When it is determined that the host dynamic port segments corresponding to multiple optional service instances on the same host node overlap, the optional service instances are migrated and deployed to other host nodes.

In an optional manner, the method further includes:

Obtain the traffic statistics information of each host node and the traffic scheduling rules and traffic estimation information of the optional service instance;

The host node where each service instance is deployed is determined based on the traffic statistics information, traffic scheduling rules and traffic estimation information.

According to another aspect of the embodiment of the present invention, an access control device for container services is provided, including:

Get the access request sent to the target host port;

The target container port corresponding to the target host port is determined according to the port mapping relationship; wherein the target container port is the port monitored by the target service instance; the port mapping relationship is determined according to the dynamic port segment corresponding to the target service instance; The dynamic port segment is pre-declared by the target service instance;

Forward the access request to the target container port.

According to another aspect of the embodiment of the present invention, an access control device for container services is provided, including:

Get the access request sent to the target host port;

The target container port corresponding to the target host port is determined according to the port mapping relationship; wherein the target container port is the port monitored by the target service instance; the port mapping relationship is determined according to the dynamic port segment corresponding to the target service instance; The dynamic port segment is pre-declared by the target service instance;

Forward the access request to the target container port.

According to yet another aspect of the embodiment of the present invention, a computer-readable storage medium is provided, and at least one executable instruction is stored in the storage medium. The executable instruction causes the access control device of the container service to perform the following operations:

Get the access request sent to the target host port;

The target container port corresponding to the target host port is determined according to the port mapping relationship; wherein the target container port is the port monitored by the target service instance; the port mapping relationship is determined according to the dynamic port segment corresponding to the target service instance; The dynamic port segment is pre-declared by the target service instance;

Forward the access request to the target container port.

The embodiment of the present invention obtains the access request sent to the target host port; determines the target container port corresponding to the target host port according to the port mapping relationship; wherein the target container port is the port monitored by the target service instance; the port The mapping relationship is determined based on the dynamic port segment corresponding to the target service instance; the dynamic port segment is pre-declared by the target service instance; thereby realizing the connection between the container port that the target instance dynamically monitors during operation and the external host The port is mapped to network rules, so that the access request outside the cluster is forwarded to the target container port newly monitored by the target service instance outside the cluster through this mapping, thereby realizing the external exposure of the dynamic port during service operation.

The above description is only an overview of the technical solutions of the embodiments of the present invention. In order to have a clearer understanding of the technical means of the embodiments of the present invention, they can be implemented according to the content of the description, and in order to achieve the above and other purposes, features and The advantages can be more clearly understood, and specific embodiments of the present invention are listed below.

Description of drawings

The drawings are only used to illustrate the embodiments and are not considered to be limitations of the present invention. Also throughout the drawings, the same reference characters are used to designate the same components. In the attached picture:

Figure 1 shows a schematic flowchart of the access control method for container services provided by an embodiment of the present invention;

Figure 2 shows a schematic flowchart of an access control method for container services provided by yet another embodiment of the present invention;

Figure 3 shows a schematic structural diagram of an access control device for container services provided by an embodiment of the present invention;

Figure 4 shows a schematic structural diagram of an access control device for container services provided by an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention may be embodied in various forms and should not be limited to the embodiments set forth herein.

Before describing the embodiments of the present invention, the prior art will be described first.

When using Kubernetes to deploy business service programs, it is often necessary to route external traffic to the business service program. Existing Kubernetes supports ClusterIp, NodePort, LoadBalancer, Ingress and other third-party controls to expose services in the cluster for clients outside the cluster to access. Each of the above methods is suitable for different scenarios. The common point is that you need to declare one or several network ports that you are listening to when deploying business services, and Kubernetes will expose them to the outside of the cluster through NAT or third-party components. The business service runtime must listen to the corresponding port according to the declaration during deployment to receive external requests.

However, Kubernetes only exposes the port through the content of the deployment script during the service deployment phase. During service operation, Kubernetes does not have a mechanism to detect the need for port exposure. Therefore, if there is a need to expose a new port to the outside world during service operation, the Kubernetes port deployment method in the existing technology cannot be implemented. This results in the inability to provide external services through the new port. Therefore, existing access control methods for container services have the problem that the dynamic container port negotiated between the service and the client during operation cannot be exposed outside the cluster, so the client cannot access the negotiated container port from outside the cluster.

Figure 1 shows a flow chart of an access control method for container services provided by an embodiment of the present invention. The method is executed by a computer processing device. The computer processing device may include a mobile phone, a laptop, etc. As shown in Figure 1, the method includes the following steps:

Step 10: Get the access request sent to the target host port.

In one embodiment of the present invention, the target host port is a port on the host where the target service instance is deployed. The target host port is used for visitors to access the container cluster from the outside. The container cluster can be Kubernetes, and the container cluster is composed of It consists of multiple host nodes, and multiple containers are deployed on each host node. A target service instance generally corresponds to a container.

Step 20: Determine the target container port corresponding to the target host port according to the port mapping relationship; wherein the target container port is the port monitored by the target service instance; the port mapping relationship is based on the dynamic port corresponding to the target service instance The segment is determined; the dynamic port segment is declared by the target service instance when it is deployed on the host node.

In one embodiment of the present invention, in order to provide container services for clients outside the cluster, the target service instance needs to negotiate with the client to determine which container port to provide services to the outside world. The target service instance is in conjunction with the requesting container service. After the client negotiates successfully, it will send a call request to the kernel function of the Linux network namespace, requesting to start listening on the negotiated target container port. Therefore, the target container port can be obtained by intercepting the kernel function call.

At the same time, considering that multiple service instances are generally deployed on a host node, each service instance may conflict with the container port negotiated by the client during operation. Therefore, when the target service instance is created, a dedicated host port segment and container port segment can be allocated to it for external mapping of the negotiated ports in the subsequent process, so that each service instance on a host can communicate with each other. The external services will not affect each other. Specifically, when the target service instance is deployed on the host node, the host port segment and container port segment it needs to occupy can be declared for external service use during subsequent service running. The port mapping relationship is used to map the container ports within the cluster to the host ports external to the cluster.

In one embodiment of the present invention, the dynamic port segment includes a container dynamic port segment and a host dynamic port segment. Among them, the container dynamic port segment includes the port number range of the container port that can be used to provide external services, and the host dynamic port segment includes the port number range of the host port that can be accessed outside the cluster.

Before step 20 also include:

Step 201: Determine a container port to be monitored based on the port monitoring request sent by the target service instance; the target container port is one of the container ports to be monitored.

In one embodiment of the present invention, to monitor the container port, it is necessary to call the kernel function of the network namespace in the Linux system, and pass the container port to be monitored and the listener to the kernel function, so the kernel function can Monitoring is performed. When it is detected that the target service instance calls the kernel function to monitor a new container port, the port monitoring parameters of the kernel function are obtained and the container port to be monitored is obtained.

In one embodiment of the present invention, step 201 further includes:

Step 2011: When it is determined that the calling request for the kernel function in the Linux system includes the target network namespace identifier corresponding to the target service instance, intercept the kernel function to obtain the container port to be monitored; wherein, The kernel function is used to implement the target service instance's monitoring of the container port to be monitored.

In one embodiment of the present invention, in order to monitor the new port, the target service instance needs to call a kernel function, and the call request includes the container port to be monitored and the target network namespace identifier of the target service instance itself. Among them, the kernel function can be such as: func(port, .., ..), where port is the port field of the container to be monitored sent by the target service instance. Specifically, tracing technology in Linux can be used to intercept kernel functions.

Step 2011 also includes: Step 210: when it is determined that the dynamic port segment corresponding to the target service instance is not empty, obtain the target network namespace identifier of the target service instance.

In one embodiment of the present invention, when the target service instance is created or deployed on the target host node, it can declare the dynamic port segment it needs to occupy. When the dynamic port segment corresponding to the target service instance is not empty, When , it means that the target service instance is configured with dynamic port segment information, so it is necessary to monitor the listening time of the new container port started by the target service instance, obtain the newly monitored container port of the target service instance, and then add the new monitored container port to the cluster. Exposed. The target network namespace identifier is used to specifically identify the target service instance in Linux systems.

Step 211: Send the target network namespace identifier to an interceptor; the interceptor is deployed in the kernel module of the Linux system; the interceptor is used to intercept the kernel function.

In one embodiment of the present invention, the interceptor intercepts the call request initiated by the target network namespace identifier for the kernel function, and obtains the port parameters of the container to be monitored included in the call request.

In another embodiment of the present invention, a node monitoring (pod-watch) service can also be created, and the pod-watch service is pre-deployed in each node of the Kubernetes cluster. The pod-watch service is used to monitor Kubernetes container scheduling events, check whether the pod scheduled to this node matches the instance selector of DynamicPortService (dynamic port service), and if it matches, collect its information and send it to the kernel module port-watch.

Among them, DynamicPortService is a resource object customized in Kubernetes, which is used to store business service names, instance selectors, communication protocols, container dynamic port segments, host dynamic port segments, network traffic estimates (units can be megabytes/second), Network traffic scheduling rules (idle first, host traffic load lower than a certain threshold, etc.) information.

The instance selector is a set of tags (each tag contains a name and a corresponding value, namely Key:Value). The service instance also has a set of tags. The function of the instance selector is to find the service instance (tag group) that DynamicPortService needs to be responsible for. same). If they match, it means that the service instance is handled by the current DynamicPortService. Then obtain the dynamic port of the current DynamicPortService and compare it with the DynamicPortService being deployed to confirm whether it is a duplicate.

In another embodiment of the present invention, a port monitoring (port-watch) service of the Linux kernel module can also be created based on the pod-watch service. The port-watch service is pre-deployed in each node of the Kubernetes cluster. The port-watch service is used to receive and store the service instance information sent by the aforementioned pod-watch service, intercept kernel function calls that create server-side monitoring, and set mapping relationships for ports that meet preset conditions. The preset condition may include that the container port to be monitored is located in the container dynamic port segment.

Step 202: When it is determined that the container port to be monitored matches the container dynamic port segment, determine an optional host port according to the host dynamic port segment; the target host port is one of the optional host ports.

In one embodiment of the present invention, when it is determined that the container port to be monitored is located within the container dynamic port segment, it is determined that the two match. Expose the matching port of the container to be listened to without affecting the external services of other service instances. You can select an idle host port from the host dynamic port segment as an optional host port.

In one embodiment of the present invention, step 202 further includes:

Step 2021: Determine any idle host port in the host dynamic port segment as the optional host port.

Step 203: Establish a mapping relationship between the optional host port and the port to be monitored.

In one embodiment of the present invention, the mapping relationship is used to establish a route between the optional host port and the port to be monitored, so that the out-of-cluster access request received by the optional host port can be forwarded to the corresponding port to be monitored according to the mapping relationship. Port to achieve access to container services in the cluster.

In one embodiment of the present invention, the container cluster includes multiple host nodes; multiple optional service instances are deployed on one host node; and the target service instance is one of the optional service instances. one; the dynamic port segment includes a host dynamic port segment.

Before step 20, it also includes: step 204: when it is determined that the host dynamic port segments corresponding to multiple optional service instances on the same host node overlap, migrate and deploy the optional service instance to other on the host node.

In one embodiment of the present invention, in order to avoid external host port conflicts between different service instances on the same host, that is, the access request sent by the client cannot be sent to the corresponding host port, the service instance can be configured in multiple Deployments on hosts are scheduled.

Specifically, all nodes in the cluster can be traversed. For each node, the scheduler obtains all the DynamicPortService information deployed on it from KubernetesApiServer, and compares the deployed DynamicPortService information of each node with the host dynamic port segment of the newly added DynamicPortService. , check whether there is an intersection, if there is no intersection, use this node as the preselected node, otherwise traverse the next node. For the pre-selected node, obtain its network traffic statistics from the indicator library (such as Prometheus, etc.), and combine it with the traffic estimation and traffic scheduling rules of the newly added DynamicPortService to calculate whether the node meets the deployment requirements. If it meets the requirements, publish the corresponding DynamicPortService The business service is deployed to the deployment information of the current node to the Kubernetes ApiServer, and finally the Kubelet component of the current node performs service deployment, otherwise the next node is traversed.

In another embodiment of the present invention, resource scheduling can be completed by extending the resource scheduler of Kubernetes. The expanded resource scheduler is used to check the newly added DynamicPortService service communication protocol, host dynamic port segment and schedule alternative host. The deployed DynamicPortService service communication protocol has an intersection with the host dynamic port segment; and based on the host network traffic statistics, service network traffic estimation, and traffic scheduling rules, it is judged whether the host's idle network traffic meets the requirements.

Before step 204, it also includes:

Step 205: Obtain the traffic statistical information of each host node and the traffic scheduling rules and traffic estimation information of the optional service instance.

In one embodiment of the present invention, the traffic statistics information includes the total network traffic of the host node. Traffic scheduling rules are used to characterize the rules for scheduling the host where the service is deployed based on the traffic load of the host. The traffic scheduling rules may include at least one of the most idle priority for deployment, priority for centralized deployment to the same host when the network traffic is lower than a certain threshold, and priority for distributed deployment to different hosts when the network traffic is lower than a certain threshold. Traffic estimation information includes the estimated traffic of each optional service instance.

Step 206: Determine the host node where each service instance is deployed based on the traffic statistics information, traffic scheduling rules and traffic estimation information.

In one embodiment of the present invention, the traffic estimate information is first matched with the traffic statistics information to obtain the expected load of each host node, and services are scheduled according to the traffic scheduling rules based on the expected load.

For example, when the traffic scheduling rule is to deploy the idlest first, the service instance currently to be deployed will be deployed to the idle host node.

When the traffic scheduling rule is to prioritize centralized deployment to the same host when the network traffic is lower than a certain threshold, the service instance currently to be deployed is deployed on the host where the last deployed service instance was deployed, or when the traffic scheduling rule is network When the traffic is lower than a certain threshold, priority is given to distributed deployment to different hosts, and the currently to-be-deployed service instance is deployed on a different host from the host where the previously deployed service instance was deployed.

Step 30: Forward the access request to the target container port.

In another embodiment of the present invention, the process of access control of the container service can also be shown in Figure 2.

As shown in Figure 2, step A, for each business service that needs to enable dynamic port exposure, create a Kubernetes resource object DynamicPortService (dynamic port service).

Among them, DynamicPortService mainly includes the following information: service name, instance selector, communication protocol (can be tcp, udp, etc.), container dynamic port segment, host dynamic port segment.

By declaring various information and rules of business services in Kubernetes, that is, the user's requirements for Kubernetes, the scheduler and other components need to be executed according to the data interpretation of this resource object in subsequent steps.

Step 2, perform port conflict checking through the extended Kubernetes scheduler.

The Kubernetes scheduler with expanded functions is used in the embodiment of the present invention. In addition to completing the original scheduling function, port duplication checking is first performed, specifically including the following:

First, obtain the service instance label and verify whether it matches the instance selector of a certain DynamicPortService; if it matches, check the communication protocol and host dynamic port segment of this DynamicPortService service and the communication protocol and host of all DynamicPortService service collections deployed on a node in the cluster Check whether the dynamic port segments overlap; if there is no overlap, continue with the following steps; otherwise, perform the above checks on other nodes in the cluster.

By extending the Kubernetes scheduler, we can avoid multiple services with the same port segment being deployed to the same node, causing port conflicts with each other and thus affecting the provision of external services.

Step C: The extended Kubernetes scheduler obtains host traffic statistics and determines whether it can be deployed on the current host based on the service network traffic estimate and network traffic scheduling rules.

Network traffic scheduling rules include but are not limited to the following methods: the most idle priority is deployed, when the network traffic is lower than a certain threshold, priority is given to centralized deployment to the same host, and when the network traffic is lower than a certain threshold, priority is given to dispersed deployment to different hosts. The scheduler selects the host that best meets the traffic scheduling rules to deploy the new service.

Step D: After completing the scheduling, the new service instance is started on the scheduled node.

The pod-watch service of the node where it is located listens to container scheduling events from Kubernetes ApiServer. If the service instance is scheduled to this node and a dynamic port segment is set, it waits for the instance to be created, obtains the instance network namespace identifier, and adds the network namespace identifier, communication protocol, The container dynamic port segment and the host dynamic port segment are sent to the kernel module port-watch of the current node.

pod-watch is a bridge that communicates between Kubernetes ApiServer and the kernel module port-watch, realizing the acquisition and transmission of information such as port segments and network namespace identifiers.

Step 5: Use the kernel module port-watch to generate NAT rules for the container port and host port so that they can be accessed through the deployed cluster node host port.

First, the kernel module port-watch receives and stores the network namespace identification, communication protocol, container dynamic port segment, and host dynamic port segment, and creates an interceptor for the service network namespace kernel function call.

Then, when the service instance starts monitoring a certain port, the kernel module port-watch obtains the communication protocol and port it is monitoring, and determines whether it is within the dynamic port range. If it is a dynamic port, calculates the host corresponding to this port. port, and generate NAT rules for the container port and host port so that they can be accessed through the host port of the deployed cluster node, thereby exposing it to the outside of the cluster.

Optionally, when a service instance is stopped, deleted, or migrated to other nodes for deployment, pod-watch listens to the above changes and transmits the network namespace identifier of the stopped container to the kernel module port-watch, and port-watch stops naming the service network. Space interceptor, clears service-related NAT rules, and deletes stored service dynamic port segment-related records. Through the process shown in Figure 2, it is possible to detect whether a certain container port is newly monitored during the running of the business service, and then expose the newly monitored container port outside the cluster.

The embodiment of the present invention obtains the access request sent to the target host port; determines the target container port corresponding to the target host port according to the port mapping relationship; wherein the target container port is the port monitored by the target service instance; the port The mapping relationship is determined based on the dynamic port segment corresponding to the target service instance; the dynamic port segment is pre-declared by the target service instance; thereby realizing the connection between the container port that the target instance dynamically monitors during operation and the external host The port is mapped to network rules, so that the access request outside the cluster is forwarded to the target container port newly monitored by the target service instance outside the cluster through this mapping, thereby realizing the external exposure of the dynamic port during service operation.

Figure 3 shows a schematic structural diagram of an access control device for container services provided by an embodiment of the present invention. As shown in Figure 3, the device 40 includes: an acquisition module 401, a determination module 402 and a forwarding module 403.

Among them, the obtaining module 401 is used to obtain the access request sent to the target host port;

The determination module 402 is configured to determine the target container port corresponding to the target host port according to the port mapping relationship; wherein the target container port is the port monitored by the target service instance; the port mapping relationship corresponds to the target service instance according to the port mapping relationship. The dynamic port segment is determined; the dynamic port segment is pre-declared by the target service instance;

Forwarding module 403 is used to forward the access request to the target container port.

The operation process performed by the access control device for the container service provided by the embodiment of the present invention is generally consistent with the foregoing method embodiment, and will not be described again.

The access control device of the container service provided by the embodiment of the present invention obtains the access request sent to the target host port; determines the target container port corresponding to the target host port according to the port mapping relationship; wherein the target container port is the target service instance The monitored port; the port mapping relationship is determined based on the dynamic port segment corresponding to the target service instance; the dynamic port segment is pre-declared by the target service instance; thereby realizing the dynamic port segment of the target instance during operation. The listening container port and the external host port are mapped with network rules, so that the access request outside the cluster is forwarded to the newly monitored target container port by the target service instance outside the cluster through this mapping, thereby realizing dynamic operation during service operation. The port is exposed to the outside world.

Figure 4 shows a schematic structural diagram of the access control device for the container service provided by the embodiment of the present invention. The specific embodiment of the present invention does not limit the specific implementation of the access control device for the container service.

As shown in Figure 4, the access control device of the container service may include: a processor (processor) 502, a communications interface (Communications Interface) 504, a memory (memory) 506, and a communication bus 508.

Among them: the processor 502, the communication interface 504, and the memory 506 complete communication with each other through the communication bus 508. The communication interface 504 is used to communicate with network elements of other devices such as clients or other servers. The processor 502 is configured to execute the program 510. Specifically, it can execute relevant steps in the above embodiment of the access control method for container services.

Specifically, program 510 may include program code including computer-executable instructions.

The processor 502 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The access control device of the container service includes one or more processors, which can be the same type of processor, such as one or more CPUs; or they can be different types of processors, such as one or more CPUs and one or more ASIC.

Memory 506 is used to store programs 510. The memory 506 may include high-speed RAM memory, and may also include non-volatile memory (non-volatile memory), such as at least one disk memory.

Specifically, the program 510 can be called by the processor 502 to cause the access control device of the container service to perform the following operations:

Get the access request sent to the target host port;

The target container port corresponding to the target host port is determined according to the port mapping relationship; wherein the target container port is the port monitored by the target service instance; the port mapping relationship is determined according to the dynamic port segment corresponding to the target service instance; The dynamic port segment is pre-declared by the target service instance;

Forward the access request to the target container port.

The operation process performed by the access control device of the container service provided by the embodiment of the present invention is generally consistent with the foregoing method embodiment, and will not be described again.

The access control device of the container service provided by the embodiment of the present invention obtains the access request sent to the target host port; determines the target container port corresponding to the target host port according to the port mapping relationship; wherein the target container port is the target service instance The monitored port; the port mapping relationship is determined based on the dynamic port segment corresponding to the target service instance; the dynamic port segment is pre-declared by the target service instance; thereby realizing the dynamic port segment of the target instance during operation. The listening container port and the external host port are mapped with network rules, so that the access request outside the cluster is forwarded to the newly monitored target container port by the target service instance outside the cluster through this mapping, thereby realizing dynamic operation during service operation. The port is exposed to the outside world.

Embodiments of the present invention provide a computer-readable storage medium that stores at least one executable instruction. When the executable instruction is run on an access control device of a container service, the access control device of the container service causes the access control device of the container service to Execute the access control method of the container service in any of the above method embodiments.

Specifically, executable instructions can be used to cause the access control device of the container service to perform the following operations:

Get the access request sent to the target host port;

The target container port corresponding to the target host port is determined according to the port mapping relationship; wherein the target container port is the port monitored by the target service instance; the port mapping relationship is determined according to the dynamic port segment corresponding to the target service instance; The dynamic port segment is pre-declared by the target service instance;

Forward the access request to the target container port.

The operation process used by the instructions stored in the computer storage medium provided by the embodiments of the present invention is generally consistent with the foregoing method embodiments, and will not be described again.

The instructions stored in the computer storage medium provided by the embodiment of the present invention obtain the access request sent to the target host port; determine the target container port corresponding to the target host port according to the port mapping relationship; wherein, the target container port serves the target The port monitored by the instance; the port mapping relationship is determined based on the dynamic port segment corresponding to the target service instance; the dynamic port segment is pre-declared by the target service instance; thereby achieving the target instance in the running process. The dynamically monitored container port and the external host port are mapped with network rules, so that the access request outside the cluster is forwarded to the newly monitored target container port by the target service instance outside the cluster through this mapping, thereby realizing the operation of the service. External exposure of dynamic ports.

An embodiment of the present invention provides an access control device for a container service, which is used to execute the above access control method for a container service.

Embodiments of the present invention provide a computer program, which can be called by a processor to cause the access control device of a container service to execute the access control method of the container service in any of the above method embodiments.

Embodiments of the present invention provide a computer program product. The computer program product includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions. When the program instructions are run on a computer, the computer causes the computer to execute any of the above. The access control method of container service in the method embodiment.

The algorithms or displays provided herein are not inherently associated with any particular computer, virtual system, or other device. Various general-purpose systems can also be used with teaching based on this. From the above description, the structure required to construct such a system is obvious. Furthermore, embodiments of the present invention are not directed to any specific programming language. It should be understood that the invention described herein may be implemented using a variety of programming languages and that the above descriptions of specific languages are for the purpose of disclosing the best mode for carrying out the invention.

In the instructions provided here, a number of specific details are described. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this description.

Similarly, it will be understood that in the above description of exemplary embodiments of the invention, various features of embodiments of the invention are sometimes grouped together into a single implementation in order to streamline the invention and assist in understanding one or more of the various inventive aspects. examples, diagrams, or descriptions thereof. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim.

Those skilled in the art will understand that modules in the devices in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. The modules or units or components in the embodiments may be combined into one module or unit or component, and they may be divided into multiple sub-modules or sub-units or sub-components. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method so disclosed may be employed in any combination, except that at least some of such features and/or processes or units are mutually exclusive. All processes or units of the equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention may be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the element claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, third, etc. does not indicate any order. These words can be interpreted as names. Unless otherwise specified, the steps in the above embodiments should not be understood as limiting the order of execution.

Claims (10)

1. A method of access control for a container service, the method comprising:

acquiring an access request sent to a target host port;

determining a target container port corresponding to the target host port according to the port mapping relation; the target container port is a port monitored by the target service instance; the port mapping relation is determined according to the dynamic port segment corresponding to the target service instance; the dynamic port segment is pre-declared for the target service instance;

forwarding the access request to the target container port.

2. The method of claim 1, wherein the dynamic port segment comprises a container dynamic port segment and a host dynamic port segment; before determining the target container port corresponding to the target host port according to the port mapping relation, the method comprises the following steps:

determining a port of a container to be monitored according to a port monitoring request sent by the target service instance; the target container port is one of the container ports to be monitored;

when the container port to be monitored is matched with the container dynamic port segment, determining an optional host port according to the host dynamic port segment; the target host port is one of the selectable host ports;

and establishing a mapping relation between the selectable host port and the port to be monitored.

3. The method of claim 2, wherein when determining that the to-be-listened container port matches the container dynamic port segment, determining an optional host port from the host dynamic port segment comprises:

and determining any idle host port in the host dynamic port section as the selectable host port.

4. The method according to claim 2, wherein the determining a port of the container to be listened to according to the port listening request sent by the target service instance comprises:

when the call request for the kernel function in the linux system is determined to comprise the target network name space identifier corresponding to the target service instance, intercepting the kernel function to obtain the port of the container to be monitored; the kernel function is used for realizing the monitoring of the target service instance on the port of the container to be monitored.

5. The method of claim 4, wherein intercepting the kernel function to obtain the container port to be listened to comprises:

when the dynamic port segment corresponding to the target service instance is determined not to be empty, acquiring the target network name space identifier of the target service instance;

transmitting the target network namespace identification to an interceptor; the interceptor is deployed in a kernel module of the linux system; the interceptor is used for intercepting the kernel function.

6. The method of claim 1, wherein the container cluster includes a plurality of the host nodes therein; one of the host nodes has a plurality of selectable service instances deployed thereon; the target service instance is one of the selectable service instances; the dynamic port segment comprises a host dynamic port segment; before determining the target container port corresponding to the target host port according to the port mapping relation, the method comprises the following steps:

and when determining that the intersection exists among the host dynamic port segments corresponding to the plurality of selectable service instances on the same host node, migrating and deploying the selectable service instances to other host nodes.

7. The method of claim 6, comprising, prior to said deploying the alternative service instance migration to other host nodes:

acquiring flow statistical information of each host node, and flow scheduling rules and flow estimated information of the selectable service instance;

and determining the host node where each service instance is deployed according to the flow statistic information, the flow scheduling rule and the flow estimation information.

8. An access control device for a container service, the device comprising:

the acquisition module is used for acquiring an access request sent to the target host port;

the determining module is used for determining a target container port corresponding to the target host port according to the port mapping relation; the target container port is a port monitored by the target service instance; the port mapping relation is determined according to the dynamic port segment corresponding to the target service instance; the dynamic port segment is pre-declared for the target service instance;

and the forwarding module is used for forwarding the access request to the target container port.

9. An access control device for a container service, comprising: the device comprises a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface complete communication with each other through the communication bus;

the memory is configured to store at least one executable instruction that causes the processor to perform the operations of the access control method for container services according to any one of claims 1-7.

10. A computer readable storage medium, characterized in that at least one executable instruction is stored in the storage medium, which executable instruction, when run on an access control device of a container service, causes the access control device of the container service to perform the operations of the access control method of the container service according to any of claims 1-7.