WO2020238751A1 - 无服务器架构下的资源访问方法、设备、系统及存储介质 - Google Patents

无服务器架构下的资源访问方法、设备、系统及存储介质 Download PDF

Info

Publication number
WO2020238751A1
WO2020238751A1 PCT/CN2020/091527 CN2020091527W WO2020238751A1 WO 2020238751 A1 WO2020238751 A1 WO 2020238751A1 CN 2020091527 W CN2020091527 W CN 2020091527W WO 2020238751 A1 WO2020238751 A1 WO 2020238751A1
Authority
WO
WIPO (PCT)
Prior art keywords
resource
target
service cluster
cluster
shared resource
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2020/091527
Other languages
English (en)
French (fr)
Inventor
匡大虎
李鹏
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alibaba Group Holding Ltd
Original Assignee
Alibaba Group Holding Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alibaba Group Holding Ltd filed Critical Alibaba Group Holding Ltd
Publication of WO2020238751A1 publication Critical patent/WO2020238751A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network

Definitions

  • This application relates to the field of Internet technology, and in particular to a resource access method, device, system and storage medium under a serverless architecture.
  • the serverless architecture is a new type of Internet architecture, in which application development does not use conventional service processes, which provides a new architecture for applications in edge computing scenarios.
  • the serverless architecture can shield tenants' servers, databases, and middleware and other server-side facilities, and tenants no longer participate in the deployment and maintenance of server-side facilities, which can greatly simplify tenants' deployment and operation and maintenance Difficulty.
  • Various aspects of the present application provide a resource access method, device, system, and storage medium under a serverless architecture, so as to realize the security isolation of shared resources among different tenants and improve the access security of shared resources.
  • the embodiment of the present application provides a serverless network system, including: a master control node, a serverless service cluster deployed by multiple tenants, and at least one type of global shared resource that can be shared by the multiple tenants; each;
  • the service cluster includes resource management and control nodes and service nodes;
  • the master control node is configured to provide the resource management and control node in the target service cluster with a private resource domain identifier corresponding to the target service cluster when the target service cluster needs to access global shared resources; wherein, the target The service cluster is any service cluster;
  • the resource management and control node is configured to, in the case of belonging to the target service cluster, determine the target shared resource to which the target service cluster has access authority according to the private resource domain identifier corresponding to the target service cluster, and notify the target The service node in the service cluster performs resource access to the target shared resource.
  • An embodiment of the application also provides an edge cloud network system based on a container orchestration system, including: a master control node deployed in a server device, a serverless serverless container cluster deployed by multiple tenants in an edge computing device, and At least one type of cloud resource that can be shared by the multiple tenants; wherein each container cluster includes a resource management node and an elastic container instance ECI node;
  • the master control node is configured to provide the resource management and control node in the target container cluster with a namespace identifier corresponding to the target container cluster when the target container cluster needs to access sharable cloud resources; wherein, the The target container cluster is any container cluster;
  • the resource management and control node is configured to, in the case of belonging to the target container cluster, determine, according to the namespace identifier corresponding to the target container cluster, a target shared resource to which the target container cluster has access rights, and notify the target container
  • the ECI nodes in the cluster access the target shared resource.
  • the embodiment of the present application also provides a resource access method, which is suitable for a master control node, and the method includes:
  • Target service cluster is any service cluster in a serverless network system where the master control node is located;
  • the resource access request declares access to the global shared resource
  • the resource access request and the private resource domain identifier are sent to the resource management and control node in the target service cluster to indicate that the resource management and control node is
  • the target service cluster determines the target shared resource.
  • the embodiment of the present application also provides a resource access method, which is suitable for resource management and control nodes, and the method includes:
  • the target service cluster is any service cluster in a serverless network system where the master control node is located, and the resource management and control node belongs to the target service cluster.
  • An embodiment of the application further provides a node device, including: a memory and a processor; the memory is used to store a computer program; when the computer program is executed by the processor, the processor is caused to implement the implementation of the application.
  • a node device including: a memory and a processor; the memory is used to store a computer program; when the computer program is executed by the processor, the processor is caused to implement the implementation of the application.
  • An embodiment of the application further provides a node device, including: a memory and a processor; the memory is used to store a computer program; when the computer program is executed by the processor, the processor is caused to implement the implementation of the application Examples provide steps in the resource access method that can be executed by the resource management node.
  • the embodiment of the present application also provides a computer-readable storage medium storing a computer program.
  • the processor When the computer program is executed by the processor, the processor is caused to implement the master node and/ Or the steps in the resource access method executed by the resource management and control node.
  • a resource management and control node is added to the service cluster deployed by the tenant.
  • the resource management and control node cooperates with the master control node in the serverless architecture and needs to be accessed in the service cluster to which it belongs.
  • the shared resource with access authority can be determined for the service cluster to which it belongs, and then the service node in the service cluster is notified of the determined shared resource Perform resource access.
  • the shared resource with access authority is determined for the service cluster.
  • the security isolation of access to the shared resource can be realized among different tenants;
  • tenants do not need to be aware of shared resources, which helps simplify the process of accessing shared resources.
  • FIG. 1a is a schematic structural diagram of a serverless network system provided by an exemplary embodiment of this application;
  • FIG. 1b is a schematic structural diagram of an edge cloud network system implemented based on Kubernetes according to an exemplary embodiment of this application;
  • FIG. 2a is a schematic flowchart of a resource access method provided by an exemplary embodiment of this application.
  • 2b is a schematic flowchart of another resource access method provided by an exemplary embodiment of this application.
  • FIG. 3 is a schematic structural diagram of a node device provided by an exemplary embodiment of this application.
  • Fig. 4 is a schematic structural diagram of another node device provided by an exemplary embodiment of this application.
  • the security isolation of access to shared resources in the existing serverless architecture in the multi-tenant scenario is a technical problem to be solved.
  • a resource management and control node is added to the service cluster deployed by the tenant, and the resource management and control node cooperates with the master control node in the serverless architecture based on
  • the private resource domain identifier of the service cluster determines the shared resources with access authority for the service cluster.
  • the security isolation of access to shared resources can be achieved between different tenants; in addition, tenants There is no need to perceive shared resources, which helps simplify the process of tenants accessing shared resources.
  • FIG. 1a is a schematic structural diagram of a serverless network system 10 provided by an exemplary embodiment of this application.
  • the network system 10 includes: a master control node 11, a serverless service cluster 12 deployed by multiple tenants, and at least one type of global shared resource 13 that can be shared by multiple tenants.
  • each service cluster 12 includes a resource management and control node 121 and a service node 122.
  • the network system 10 of this embodiment includes multiple resources, such as computing resources, storage resources, and network resources. These resources can be provided by physical devices in the network system.
  • the physical devices in the network system 10 include, but are not limited to: computer devices, sensor devices, storage devices, conventional servers, cloud servers, or server arrays.
  • the network system 10 of this embodiment can provide tenants with various resources required on the one hand, and can also provide tenants with required services on these resources.
  • the manner in which the network system 10 provides services to tenants is to allow the tenants to deploy their required service clusters in the network system 10 (specifically on physical devices in the network system).
  • the network system 10 of this embodiment can provide services for multiple tenants, that is, multiple tenants are allowed to deploy their required service clusters 12 in the network system respectively.
  • each tenant can deploy one or more service clusters 12. Different service clusters of the same tenant can provide the same service for the tenant or different services for the tenant.
  • service clusters deployed by different tenants can provide the same service or different services.
  • Each service cluster 12 includes service nodes 122 that can provide required services to the corresponding tenants, and the number of service nodes 122 may be one or more.
  • multiple service nodes 122 may be deployed on the same physical device or virtual machine in a centralized manner, or distributed on multiple physical devices or virtual machines.
  • this embodiment does not limit it.
  • each tenant has different identities, and the identity of each tenant can uniquely identify the tenant.
  • the identity of the tenant can be any information that can uniquely identify the tenant, for example, the ID of the tenant in the network system 10, or the tenant name, account number, phone number, e-mail address, and/or the tenant registered in the network system 10 Home address, etc.
  • each service cluster 12 also has its own identifier, and the identifier of each service cluster 12 can uniquely identify the service cluster.
  • the identifier of the service cluster 12 may be any information that can uniquely identify the service cluster, for example, may be the ID, name, and/or deployment time of the service cluster in the network system 10. In this embodiment, the correspondence between the identity of the tenant and the identity of the service cluster 12 deployed by the tenant is maintained.
  • each service cluster 12 has its own private resource domain, and the private resource domain includes various resources exclusive to the service cluster 12, such as various service programs deployed in the service cluster 12.
  • the embodiment of the present application does not limit the implementation form of the service program, for example, it may include various application programs and/or operating systems.
  • the private resource domain also has its own identifier, which can uniquely identify the private resource domain of a service cluster.
  • the identification of the private resource domain may be any information that can uniquely identify the private resource domain, for example, may be the ID or name of the private resource domain in the network system 10.
  • the correspondence between the identifier of the service cluster 12 and the identifier of the corresponding private resource domain (referred to as the private resource domain identifier for short) is maintained.
  • each service cluster 12 in addition to the private resources exclusive to each service cluster 12, it also includes some global resources; some of these global resources can be shared by different tenants, which are called global shared resources. Some of the global resources are not allowed to be used by tenants, which are called global non-shared resources.
  • This embodiment does not limit the type of global shared resources, and may include at least one type of global shared resources, for example, may include globally sharable storage resources, globally sharable computing nodes, and/or globally sharable network resources.
  • storage resources, computing nodes, and network resources are taken as examples to illustrate global shared resources.
  • the globally sharable storage resources may be local storage resources or network storage resources, such as network attached storage (NAS).
  • NAS network attached storage
  • a resource management and control node 121 is set in the service cluster 12 of this embodiment.
  • the resource management and control node 121 cooperates with the master control node 11 in the network system 10, and can help tenants to automatically complete the mapping of the service cluster 12 to the shared resource when the service cluster 12 to which it belongs needs to access the global shared resources to ensure the service to which they belong
  • the cluster can access the corresponding shared resources.
  • the asset management control node 121 may be deployed on a physical device or a virtual machine in the network system 10.
  • the resource management and control node 121 can be deployed in the same physical device or the same virtual machine with one or several service nodes 122 in the service cluster 12 to which it belongs.
  • the resource management and control node 121 and the service node 122 in the service cluster 12 may also be deployed in different physical devices or virtual machines.
  • the main control node 11 is a control node in the network system 10, and is mainly responsible for at least one of resource management, service scheduling, cluster management and control, security control, system monitoring, and error correction in the network system 10.
  • a series of processes related to system management and control can be run on the master control node 11, and these processes can realize management capabilities such as resource management, service scheduling, cluster management and control, security control, system monitoring, and error correction in the network system 10.
  • the number of master control nodes 11 may be one or more.
  • the master control node 11 may be deployed on a physical device or a virtual machine in the network system 10. In the case where there are multiple master control nodes 11, the multiple master control nodes 11 may be dispersedly deployed on multiple physical devices or virtual machines.
  • the master control node 11 may be deployed on a physical device or virtual machine in a certain service cluster 12.
  • the master control node 11 may be deployed with one or several service nodes 122 in the service cluster 12 On the same physical device or virtual machine, or the master control node 11 and the resource management and control node 121 in the service cluster 12 may also be deployed on the same physical device or virtual machine.
  • the master control node 11 may be independently deployed on one or more physical devices independent of each service cluster 12, or separately deployed in one or more virtual machines.
  • the master control node 11 can also cooperate with the resource management and control node 121 to allocate shared resources among the service clusters 12 based on the private resource domain identifier of the service cluster 12 when the service cluster 12 requests to access the global shared resources , To realize the safe isolation of the global shared resources in the network system 10 between different tenants.
  • the process of allocating shared resources for each service cluster 12 is the same or similar.
  • the target service cluster is any service cluster in the network system 10.
  • the master control node 11 can monitor the resource access requirements of the target service cluster, and when the target service cluster needs to access global shared resources, it provides the resource management and control node 121 in the target service cluster with a private resource domain corresponding to the target service cluster.
  • the identifier is used to instruct the resource management and control node 121 in the target service cluster as the target service cluster to determine the shared resource with the access authority.
  • the resource management and control node 121 if it belongs to the target service cluster, it can determine the shared resource to which the target service cluster has access rights according to the private resource domain identifier corresponding to the target service cluster, and notify the service node 122 in the target service cluster to that Share resources for resource access.
  • the shared resource with access authority determined by the resource management and control node 121 for the target service cluster is recorded as the target shared resource.
  • the target shared resource may be any type of shared resource, for example, it may be a computing resource or a storage resource.
  • the access of the service cluster to the shared resource is associated with the private resource domain identifier corresponding to the service cluster, and the resource management and control node in each service cluster can be its own service according to the private resource domain identifier corresponding to the service cluster to which it belongs
  • the cluster determines the shared resources that have access permissions. Based on the uniqueness of the private resource domain identifier, on the basis of ensuring that the service cluster successfully accesses the corresponding shared resources, the security isolation of access to shared resources can be achieved between different tenants. Further, in the network system 10 of this embodiment, not only can the security isolation of access to shared resources be achieved between tenants, but also the security isolation of access to shared resources can be achieved between different service clusters deployed by the same tenant. Sex. In addition, in the network system 10 of this embodiment, tenants do not need to perceive shared resources, and the allocation of shared resources is automatically completed by the resource management and control node, which helps simplify the process of tenants accessing shared resources.
  • the tenant deploying the target service cluster may generate a resource access request according to the resource access requirement of the target service cluster, and submit the resource access request to the master control node 11.
  • the network system 10 (specifically, the master node 11) can provide tenants with an interactive interface, through which the tenants can submit resource access requests to the master node 11, and can further communicate with the master node through the interactive interface 11 Conduct other interactions.
  • the interactive interface may be a web interface, a command window, or an application interface, depending on the product form implemented by the network system 10.
  • the interface resource access request carries information such as the identity of the tenant corresponding to the target service cluster, the identifier of the target service cluster, and the type of resource to be accessed.
  • the resource type to be accessed indicates the resource type that the target service cluster needs to access, for example, it may be a private resource, it may be a global shared resource, or it may be a global non-shared resource. According to different types of resources to be accessed, resource access requests will declare access to different types of resources.
  • the master control node 11 may monitor the resource access demand of the target service cluster by determining whether it receives the resource access request of the target service cluster. If receiving the resource access request of the target service cluster, the master control node 11 can obtain the private resource domain identifier corresponding to the target service cluster according to the resource access request on the one hand, and on the other hand can identify whether the resource access request declares access to the global shared resource. It is worth noting that the execution sequence between the operation of obtaining the private resource domain identifier corresponding to the target service cluster and the operation of identifying whether the resource access request declares access to the global shared resource is not limited. The two operations can be executed in parallel or in sequence. carried out.
  • the master control node 11 may pre-store the corresponding relationship between the service cluster identifier and the private resource domain identifier. Based on this, the master node 11 can match the pre-stored correspondence between the service cluster identifier and the private resource domain identifier according to the identifier of the target service cluster carried in the resource access request to obtain the private resource domain corresponding to the target service cluster.
  • logo the identifier of the target service cluster carried in the resource access request.
  • a global shared resource type such as a storage resource type, a computing resource type, etc.
  • the master node 11 can determine whether the resource type to be accessed carried in the resource access request belongs to the preset global shared resource type; if the resource type to be accessed belongs to the global shared resource type, it is determined that the resource access request declares access to the global shared resource.
  • the global non-shared resource type can also be preset.
  • the global non-shared resource type refers to the global resource that is not allowed to be accessed by the tenant. Based on this, the master control node 11 can also determine whether the resource type to be accessed belongs to the preset global non-shared resource type; if the resource type to be accessed belongs to the global non-shared resource type, the resource access request is blocked; further optionally, it can The tenant returns a prompt message for prohibiting resource access.
  • the master control node 11 may determine that the resource access request declares access to the private resource. The declaration of the resource access request to access private resources is described in the following embodiments, and will not be described in detail here.
  • this embodiment does not limit the foregoing operation of judging whether the resource type to be accessed carried in the resource access request belongs to the preset global shared resource type, and is the same as the foregoing judging whether the resource type to be accessed belongs to the preset global non-shared resource type.
  • the order of execution between the operations of the resource type, the two operations can be executed in parallel or sequentially. During sequential execution, you can first determine whether the resource type to be accessed carried in the resource access request belongs to the preset global shared resource type operation, and if the result of the determination is no, you can further determine whether the resource type to be accessed belongs to the preset operation. Set the global non-shared resource type.
  • the master control node 11 may send the resource access request and the acquired private resource domain identifier corresponding to the target service cluster to the resource management and control node 121 in the target service cluster , Using the instructing resource management and control node 121 as the target service cluster to determine the target shared resource with permission to access.
  • the master control node 11 may send the resource access request and the private resource domain identifier corresponding to the target service cluster to the resource management and control node 121 in the target service cluster in the same communication process. Further, the master control node 11 may add the private resource domain identifier corresponding to the target service cluster to the resource access request, and send the resource access request to the resource management and control node 121 in the target service cluster. Alternatively, the master control node 11 may also send the resource access request and the private resource domain identifier corresponding to the target service cluster to the resource management and control node 121 in the target service cluster in different communication processes.
  • the resource management and control node 121 in the target service cluster can maintain the correspondence between the private resource domain identifier corresponding to the target service cluster and the shared resource label under at least one candidate global shared resource type.
  • the candidate global shared resource type is the global shared resource type, just to distinguish and describe the global shared resource type, prefixed with the word "candidate".
  • the at least one candidate global shared resource type may be a part or all of the global shared resource types allowed in the network system 10.
  • the shared resource label under a certain global shared resource type indicates the shared resource that can be accessed by the target service cluster under the global shared resource type; if there are multiple shared resources that can be accessed by the target service cluster under the global shared resource type, Each shared resource is assigned a shared resource label, and different shared resources correspond to different shared resource labels. It is worth noting that, according to the different granularity of resource segmentation, the size of the shared resource under a certain global shared resource type in the embodiment of the present application will also be different.
  • the granularity may include multiple storage disks, and each storage disk can be used as the shared resource described in the embodiment of this application; further, if a certain storage disk can be accessed by the target service cluster , The storage disk will be marked as a shared resource.
  • the granularity can include multiple sectors, and each sector can be used as the shared resource described in the embodiment of this application; further, if a certain sector can be served by the target Cluster access, the sector will be marked as a shared resource label.
  • the shared resource indicated by a certain candidate global shared resource type is the physical device on which the ECI node is deployed, then the shared resource to which the target service cluster has access rights under the candidate global shared resource type refers to the target service cluster Visible physical equipment.
  • the shared resource indicated by a certain candidate global shared resource type is a storage resource
  • the shared resource that the target service cluster has access rights under the candidate global shared resource type refers to the storage resource that is free for the target service cluster And the target service cluster has been used.
  • the resource management and control node 121 in the target service cluster can receive the resource access request sent by the master control node 11 and the private resource domain identifier corresponding to the target service cluster; according to the private resource domain identifier corresponding to the target service cluster and the resource access request
  • the carried resource type to be accessed is matched in the correspondence relationship between the maintained private resource domain identifier corresponding to the target service cluster and the shared resource label under at least one candidate global shared resource type to obtain the target shared resource label;
  • the access request and the target shared resource tag are sent to the service node 122 in the target service cluster, so that the service node 122 can access the target shared resource.
  • the target shared resource tag identifies the target shared resource to which the target service cluster has access authority.
  • the resource management and control node 121 in the target service cluster may send the resource access request and the target shared resource tag to the service node 122 in the target service cluster in the same communication process. Further, the resource management and control node 121 in the target service cluster may add the target shared resource tag to the resource access request, and send the resource access request to the service node 122 in the target service cluster. Alternatively, the resource management and control node 121 in the target service cluster may also send the resource access request and the target shared resource tag to the service node 122 in the target service cluster in different communication processes.
  • the way for the resource management and control node 121 in the target service cluster to maintain the correspondence between the private resource domain identifier corresponding to the target service cluster and the shared resource tag under the at least one candidate global shared resource type includes but is not limited to:
  • the tenant administrator can provide the resource management and control node 121 with authorization configuration information corresponding to the tenant of the target service cluster.
  • the authorization configuration information includes the identity of the tenant and the type of global shared resources that the tenant has permission to access.
  • the authorization configuration information includes the identity of the tenant and the authority of the tenant, and the authority of the tenant determines the type of global shared resource that the tenant has the authority to access.
  • the candidate global shared resource type refers to the global shared resource type that the tenant has permission to access, and the number may be one or more. Based on this, the resource management and control node 121 can obtain at least one candidate global shared resource type that the tenant of the target service cluster has permission to access according to the authorization configuration information.
  • the resource management and control node 121 may periodically poll the global shared resources to obtain shared resource information under at least one candidate global shared resource type.
  • the resource management and control node 121 may send a polling request to the service node 122 in the target service cluster, so that the service node 122 can poll and report the shared resource information under at least one candidate global shared resource type; and receive the information reported by the service node 122 Shared resource information under at least one candidate global shared resource type.
  • the shared resource information under each candidate global shared resource type includes, but is not limited to: metadata and access control information of the shared resource.
  • the private resource domain identifier corresponding to the maintained target service cluster and the shared resource tag under at least one candidate global shared resource type can be updated in real time.
  • the corresponding relationship ensures that the corresponding relationship can change with the change of the access state of the shared resource, and the accuracy of the corresponding relationship is improved.
  • the resource management and control node 121 may have access to the target service cluster under at least one candidate global shared resource type. After the shared resource label of the authorized shared resource is assigned, the shared resource label of at least one candidate global shared resource type can be sent to the service node 122 in the target service cluster, so that the service node 122 can maintain at least one candidate global share locally The corresponding relationship between the shared resource label under the resource type and the corresponding shared resource. Furthermore, when the service node 122 receives the target shared resource tag sent by the resource management and control node 121, it can query the correspondence maintained locally, determine the target shared resource corresponding to the target shared resource tag, and then perform resource access to the target shared resource.
  • the manner in which the service node 122 performs resource access to the target shared resource will also be different. For example, if the resource access request is a resource query request, the service node 122 may return information such as metadata of the target shared resource to the tenant. For another example, if the resource access request is a resource use request, the service node 122 may perform corresponding operations on the target shared resource, such as performing resource operations such as disk mounting.
  • the resource access request can declare access to global shared resources, it is possible to declare access to private resources, or even access to global non-shared resources.
  • the master control node 11 will shield the resource access request to ensure the security of the global non-shared resource.
  • the master control node 11 may also send the resource access request and the private resource domain identifier corresponding to the target service cluster to the resource management and control node 121 in the target service cluster to instruct the resource management and control node 121 to forward To the service node 122 in the target service cluster.
  • resource access to the private resources of the target service cluster can be directly performed according to the resource access request and the private resource domain identifier corresponding to the target service cluster.
  • the master node 11 when the resource access request declares access to global shared resources and declares access to private resources, the master node 11 will send the resource access request and the private resource domain identifier corresponding to the target service cluster to the resources in the target service cluster.
  • the management and control node 121 but the actions performed by the instructing the resource management and control node 121 are different.
  • the resource management and control node 121 sets different resource access interfaces, which are a shared resource access interface and a private resource access interface, respectively.
  • the master control node 11 sends the resource access request and the private resource domain identifier corresponding to the target service cluster to the shared resource access on the resource management and control node 121 in the target service cluster
  • the interface is used to instruct the resource management and control node 121 as the target service cluster to determine the target shared resource.
  • the master control node 11 sends the resource access request and the private resource domain identifier corresponding to the target service cluster to the private resource access interface on the resource management and control node 121 in the target service cluster to indicate The resource management and control node 121 forwards it to the service node 122 in the target service cluster.
  • the resource management and control node 121 if it receives a resource access request and the private resource domain identifier corresponding to the target service cluster on the shared resource access interface, it can learn that the resource access request declares access to the global shared resource, and the access corresponding to the shared resource will be executed. Processing flow; if the resource access request and the private resource domain identifier corresponding to the target service cluster are received on the private resource access interface, it can be learned that the resource access request declares to access the private resource, and the corresponding access processing flow for the private resource will be executed.
  • serverless network system provided in this embodiment can be applied to various application scenarios, and according to different application scenarios, the implementation form of the service cluster deployed by the tenant, the service node in the service cluster, and the resource management node Will be different.
  • the serverless network system of this embodiment can be applied to edge cloud network scenarios such as edge computing.
  • tenants can deploy container clusters in edge computing devices.
  • the container clusters include Elastic Container Instance (ECI) nodes, and the ECI nodes provide tenants with corresponding cloud computing services.
  • ECI node is a containerized application deployed on the edge computing device, and is a specific implementation form of the service node, but it is not limited to this.
  • a container orchestration system can be used to create, manage, discover, access, and configure ECI nodes in the edge cloud network system, thereby freeing the system operation and maintenance personnel .
  • the container orchestration system refers to a system that can automatically deploy, expand, and manage containerized applications.
  • Kubernetes referred to as K8s
  • K8s Kubernetes
  • the embodiment of the present application also provides an edge cloud network system based on a container orchestration system, as shown in FIG. 1b.
  • the edge cloud network system 20 includes: a master control node 21 deployed in a server device, a serverless container cluster 22 deployed in edge computing devices by multiple tenants, and at least one type of cloud resource that can be shared by multiple tenants twenty three.
  • each container cluster 22 includes a resource management and control node 221 and an ECI node 222.
  • the edge cloud network system 20 includes a server device and an edge computing device.
  • the server device can be deployed in the cloud or in the client room, and can be one or more, for example, a conventional server, a cloud server, or a server array.
  • An edge computing device refers to a device located at the edge of the network, relatively close to the terminal side, with certain computing and processing capabilities, and capable of network communication with other devices in the network (such as server devices), such as personal computers, smart phones, and other terminals
  • server devices such as personal computers, smart phones, and other terminals
  • Such devices can also be large computers or servers deployed on the edge of the network, or of course, can also be virtual machines deployed on the edge of the network.
  • a container orchestration system such as Kubernetes, is used to logically divide the physical devices in the edge cloud network system 20 into a master node 21 and an ECI node 222.
  • a container orchestration system such as Kubernetes
  • Kubernetes an edge cloud network system based on Kubernetes is taken as an example for illustration in Figure 1b.
  • the master node 21 is deployed on the server equipment in the edge cloud network system 20, and a group of processes related to cluster management are running on the master node 21.
  • these processes include but are not limited to: kube- apiserver, kube-controller-manager and kube-scheduler, etc., these processes realize the management capabilities of the entire cluster, such as resource management, container group (such as Pod in Kubernetes) scheduling, elastic scaling, security control, system monitoring and error correction, and It's all done automatically.
  • ECI nodes are working nodes in the edge cloud network system 20 and run containerized applications. These ECI nodes 222 are distributed in the container clusters 22 deployed by different tenants; the container clusters 22 of different tenants are deployed in the edge cloud network system 20 Of edge computing devices.
  • the container group is the smallest operating unit managed by the container orchestration system, and the container group includes at least one container.
  • the smallest operating unit managed by Kubernetes is Pod.
  • Pod is literally translated as pod. In this embodiment, it refers to a set of containers, that is, the aforementioned container group.
  • the ECI node 222 runs the processes related to the container group in the container orchestration system. Taking Kubernetes as an example, the processes related to the container group include but are not limited to: Kubernetes kubelet and kube-proxy service processes. These service processes are responsible for the container group. (Such as Pod) creation, startup, monitoring, restart, destruction, and load balancer that implements software mode.
  • the number of ECI nodes 222 included in each container cluster 22 may be one or more.
  • the multiple ECI nodes 222 may be deployed on the same edge computing device in a centralized manner, or may be deployed on multiple edge computing devices in a distributed manner.
  • each tenant can uniquely identify the tenant.
  • the identity of a tenant can be any information that can uniquely identify the tenant. For example, it can be the tenant’s ID in the edge cloud network system 20, or the tenant’s name, account number, phone number, and electronic account registered in the edge cloud network system 20. Email and/or home address, etc.
  • each container cluster 22 also has its own identity, and the identity of each container cluster 22 can be unique. Identifies the service cluster.
  • the identifier of the container cluster 22 may be any information that can uniquely identify the service cluster, such as the ID or name of the container cluster 22 in the edge cloud network system 20. In this embodiment, the correspondence between the identity of the tenant and the identity of the container cluster 22 deployed by the tenant is maintained.
  • each container cluster 22 has its own namespace (Namespace).
  • Namespace is an important concept in container orchestration and scheduling system, such as Kubernetes.
  • groups or user groups logically grouped are formed to facilitate different The groups can be managed separately while sharing the resources of the entire system.
  • container groups such as Pods
  • RCs cyclic cyclic cyclic cyclic cyclic cyclic cyclic cyclic cyclic cyclic grouped
  • services created by a tenant in a certain container cluster 22 are all created in the Namespace of the container cluster 22.
  • Each namespace has its own identity, such as ID or name. In this embodiment, the correspondence between the identifier of the container cluster 22 and the identifier of the corresponding namespace is maintained.
  • edge cloud network system 20 in addition to the private resources exclusive to each container cluster 22, it also includes some global resources; some of these global resources can be shared by different tenants, called global shared resources , Some of these global resources are not allowed to be used by tenants, which are called global non-shared resources.
  • This embodiment does not limit the type of global shared resources, and may include at least one type of global shared resources, for example, may include globally sharable storage resources, globally sharable computing nodes, and/or globally sharable network resources.
  • NAS is taken as an example to illustrate the global shared resources.
  • the scalability of the container orchestration system is used. For example, taking Kubernetes as an example, the scalability of Virtual Kubelet can be used in each container.
  • a resource management and control node 221 is expanded from the cluster 22.
  • Virtual Kubelet is an implementation of Kubernetes Kubelet, which allows different vendors to expand the communication between the API implementation of the corresponding Kubernetes node and the system based on it, and realize the serverless capability of Kubernetes.
  • the resource management and control node 221 can help the tenant to automatically complete the mapping of the container cluster 22 to the shared resource when the container cluster 22 to which it belongs needs to access the global shared resource, so as to ensure that the container cluster 22 to which it belongs can access the corresponding shared resource.
  • the asset management control node 221 is deployed on an edge computing device in the edge cloud network system 20.
  • the resource management and control node 221 may be deployed in the same edge computing device with one or several ECI nodes 222 in the container cluster 22 to which it belongs.
  • the resource management and control node 221 and the ECI node 222 in the container cluster 22 may also be separately deployed in different edge computing devices.
  • a master control node 21 is also deployed in the server device.
  • the native master node (Master) of the container orchestration system can be expanded to obtain the master node 21 in the embodiment of the present application.
  • the way to extend the function of the native master node of the container orchestration system can be to extend an API proxy component for the native master node, which can be recorded as api-proxy.
  • the API proxy component is combined with the native master node to achieve The function of the master node 21 in this embodiment; or, directly modify the function of the native master node of the container orchestration system to realize the function of the master node 21 in this embodiment.
  • the Kubernetes native master node refers to its native apiserver component.
  • the extended API proxy component api-proxy is taken as an example for illustration.
  • the combination of the main control node 21 and the resource management and control node 221 can realize a container orchestration and scheduling system, such as the management and control system of Kubernetes. This is logically divided and does not mean that the main control node 21 and resources
  • the management and control node 221 is actually deployed in the same physical device.
  • the resource management and control node 221 belongs to the container cluster 22 and is deployed in the edge computing device.
  • the master control node 21 can control access to shared resources initiated by tenants, and cooperate with the resource management and control node 221 in the container cluster 22, and can be distributed among the container clusters 22 based on the namespace identifier of the container cluster 22 Shared resources realize the safe isolation of the global shared resources in the edge cloud network system 20 between different tenants.
  • the process of allocating shared resources to each container cluster 22 is the same or similar.
  • the target container cluster is any container cluster in the edge cloud network system 20.
  • the master node 21 (take Kubernetes as an example, specifically the newly added api-proxy component or the modified apiserver component in the master node 21) can monitor the resource access requirements of the target container cluster, and the target container cluster needs to be monitored.
  • the resource management and control node 221 in the target container cluster with a namespace identifier corresponding to the target container cluster to instruct the resource management and control node 221 in the target container cluster to determine the shared resource with access rights for the target container cluster .
  • the resource management and control node 221 if it belongs to the target container cluster, it can determine the shared resource to which the target container cluster has access rights according to the namespace identifier corresponding to the target container cluster, and notify the ECI node 222 in the target container cluster of the shared resource Resources for resource access.
  • the shared resource with access authority determined by the resource management and control node 221 for the target container cluster is recorded as the target shared resource.
  • the target shared resource may be any type of shared resource, for example, it may be a computing resource or a storage resource.
  • the container cluster’s access to shared resources is associated with the namespace corresponding to the container cluster, and the resource management and control node in each container cluster can determine the container cluster to which it belongs according to the namespace corresponding to the container cluster to which it belongs Shared resources with access permissions are based on the uniqueness of the namespace, and on the basis of ensuring that the container cluster successfully accesses the corresponding shared resources, the security isolation of access to shared resources can be achieved between different tenants. Further, in the edge cloud network system 20 of this embodiment, not only can the security isolation of access to shared resources be realized between tenants, but also the access to shared resources can be realized between different container clusters deployed by the same tenant. Security isolation. In addition, in the edge cloud network system 20 of this embodiment, tenants do not need to perceive shared resources, and the allocation of shared resources is automatically completed by the resource management and control node, which is beneficial to simplify the process of tenants accessing shared resources.
  • a resource access request may be generated according to the resource access requirement, and the resource access request is sent to the master control node 21.
  • the resource access request carries information such as the identity of the tenant corresponding to the target container cluster, the identifier of the target container cluster, and the type of resource to be accessed.
  • the resource type to be accessed indicates the resource type that the target container cluster needs to access, for example, it may be a private resource, it may be a global shared resource, or it may be a global non-shared resource. According to different types of resources to be accessed, resource access requests will declare access to different types of resources.
  • the master node 21 may receive a resource access request of the target container cluster; if it receives a resource access request of the target container cluster, on the one hand, it may obtain the private resource domain corresponding to the target container cluster according to the resource access request. Identification, which can identify whether the resource access request declares access to the global shared resource.
  • matching may be performed in a pre-stored correspondence between the container cluster identifier and the identifier of the namespace to obtain the identifier of the namespace corresponding to the target container cluster.
  • the global non-shared resource type can be preset, and the global non-shared resource type refers to global resources that are not allowed to be accessed by tenants.
  • global non-shared resources include but are not limited to: global namespace list, system component status, global network policy configuration and other resource information. Based on this, it can also be judged whether the resource type to be accessed belongs to the preset global non-shared resource type; if the resource type to be accessed belongs to the global non-shared resource type, the resource access request is shielded to ensure the security of the global non-shared resource.
  • the master control node 21 may send the resource access request and the namespace identifier corresponding to the target container cluster to the resource management and control node 221 in the target container cluster to indicate the resource
  • the management and control node 221 determines, for the target container cluster, target shared resources that have permission to access.
  • the resource management and control node 221 in the target container cluster may maintain the correspondence between the namespace identifier corresponding to the target container cluster and the shared resource label under the at least one candidate global shared resource type.
  • the at least one candidate global shared resource type refers to a global shared resource type that a tenant of the target container cluster has permission to access.
  • the resource management and control node 221 in the target container cluster can receive the resource access request sent by the master control node 21 and the namespace identifier corresponding to the target container cluster; according to the namespace identifier corresponding to the target container cluster and the resource access request carried
  • the resource type to be accessed is matched in the correspondence between the maintained namespace identifier corresponding to the target container cluster and the shared resource label under at least one candidate global shared resource type to obtain the target shared resource label; and the resource access request is matched with
  • the target shared resource tag is sent to the ECI node 222 in the target container cluster for the ECI node 222 to access the target shared resource.
  • the target shared resource tag identifies the target shared resource to which the target container cluster has access authority.
  • the resource management and control node 221 in the target container cluster obtains at least one candidate global shared resource type that the tenant of the target container cluster has permission to access, and obtains the shared resource information under the at least one candidate global shared resource type;
  • the shared resource information under at least one candidate global shared resource type, and the shared resources to which the target container cluster has access permissions under at least one candidate global shared resource type are respectively selected; for the target container cluster at least one candidate global shared resource type
  • the shared resource tags with access rights are allocated to the shared resource tags, and the corresponding relationship between the namespace identifier corresponding to the target container cluster and the shared resource tags under at least one candidate global shared resource type is established.
  • the resource management and control node 221 may periodically poll the global shared resources to obtain shared resource information under at least one candidate global shared resource type.
  • the resource management and control node 221 may send a polling request to the ECI node 222 in the target container cluster for the ECI node 222 to poll and report the shared resource information under at least one candidate global shared resource type; receive the information reported by the ECI node 222 Shared resource information under at least one candidate global shared resource type.
  • the shared resource information under each candidate global shared resource type includes, but is not limited to: metadata and access control information of the shared resource.
  • the correspondence between the maintained namespace identifier of the target container cluster and the shared resource tag under at least one candidate global shared resource type can be updated in real time Relationship, to ensure that the corresponding relationship can follow changes in the access state of the shared resource, and to improve the accuracy of the corresponding relationship.
  • the resource management and control node 221 may have access to the target container cluster under at least one candidate global shared resource type.
  • the shared resource label is assigned to the shared resource of the permission
  • the shared resource label under at least one candidate global shared resource type can be sent to the ECI node 222 in the target container cluster, so that the ECI node 222 can maintain at least one candidate global share locally
  • the ECI node 222 receives the target shared resource tag sent by the resource management and control node 221, it can query the correspondence maintained locally, determine the target shared resource corresponding to the target shared resource tag, and then perform resource access to the target shared resource.
  • the edge cloud network system 20 shown in Fig. 1b can be used as a specific implementation of the network system 10 shown in Fig. 1a. Some contents are the same as or similar to the network system 10 shown in Fig. 1a. For the contents not involved in this embodiment, please refer to the foregoing The description of the embodiment will not be repeated here.
  • Fig. 2a is a schematic flowchart of a resource access method provided by an exemplary embodiment of this application. This embodiment is described from the perspective of the master control node. As shown in Figure 2a, the method includes:
  • 201a Receive a resource access request of a target service cluster, where the target service cluster is any service cluster in a serverless network system where the master control node is located.
  • an implementation manner of step 202a includes: according to the identifier of the target service cluster carried in the resource access request, matching is performed in the correspondence between the pre-stored service cluster identifier and the private resource domain identifier to obtain the target service cluster The corresponding private resource domain ID.
  • the method further includes: determining whether the resource type to be accessed carried in the resource access request belongs to a preset global shared resource type; if the resource type to be accessed belongs to a global shared resource type, determining the resource access request statement Access global shared resources.
  • the method further includes: determining whether the resource type to be accessed belongs to the preset global non-shared resource type; if the resource type to be accessed belongs to the global non-shared resource type, shielding the resource access request; if the resource type to be accessed does not belong to the global shared resource If the type does not belong to the global non-shared resource type, it is determined that the resource access request declares access to private resources.
  • the method further includes: in the case that the resource access request declares access to the private resource, sending the resource access request and the private resource domain identifier to the resource management and control node in the target service cluster to instruct the resource management and control node to forward to the target service cluster Service node.
  • sending the resource access request and the private resource domain identifier to the resource management and control node in the target service cluster includes: sending the resource access request and the private resource domain identifier to the shared resource access on the resource management and control node in the target service cluster interface.
  • sending the resource access request and the private resource domain identifier to the resource management and control node in the target service cluster includes: sending the resource access request and the private resource domain identifier to the private resource access interface on the resource management and control node in the target service cluster .
  • Fig. 2b is a schematic flowchart of another resource access method provided by an exemplary embodiment of this application. This embodiment is described from the perspective of a resource management and control node, which belongs to a target service cluster. As shown in Figure 2b, the method includes:
  • the method further includes: receiving a resource access request from the target service cluster sent by the master control node, where the resource access request carries a resource type to be accessed.
  • an implementation of step 202b includes: according to the private resource domain identifier corresponding to the target service cluster and the resource type to be accessed, the private resource domain identifier corresponding to the maintained target service cluster and at least one candidate global shared resource type Matching is performed in the corresponding relationship of the shared resource tags under to obtain the target shared resource tag; where the target shared resource identifies the target shared resource.
  • an implementation manner for notifying the service node in the target service cluster to access the target shared resource includes: sending the resource access request and the target shared resource tag to the target service cluster The service node allows the service node to access the target shared resource.
  • the method further includes: obtaining at least one candidate global shared resource type that the tenant of the target service cluster has permission to access, and obtaining shared resource information under the at least one candidate global shared resource type; Shared resource information under a candidate global shared resource type, respectively selecting shared resources for which the target service cluster has access rights under at least one candidate global shared resource type; for the target service cluster under at least one candidate global shared resource type
  • the shared resource with the access authority allocates the shared resource label, and establishes the correspondence between the private resource domain identifier corresponding to the target service cluster and the shared resource label under at least one candidate global shared resource type.
  • the method further includes: sending the shared resource label of the at least one candidate global shared resource type to the service node in the target service cluster for the service node to locally maintain the shared resource under the at least one candidate global shared resource type Correspondence between tags and corresponding shared resources.
  • the resource management and control node in each service cluster cooperates with the master control node in the serverless architecture, and the shared resource with access authority can be determined for the service cluster based on the private resource domain identifier of the service cluster.
  • the security isolation of access to shared resources can be achieved between different service clusters and different tenants; in addition, tenants do not need to be aware of shared resources, which helps simplify the process of accessing shared resources. Improve the security of shared resources.
  • Fig. 3 is a schematic structural diagram of a node device provided by an exemplary embodiment of this application.
  • the node device can be implemented as the master node in the foregoing embodiment.
  • the node device includes a memory 31, a processor 32, and a communication component 33.
  • the memory 31 is used to store computer programs, and can be configured to store other various data to support operations on the node device. Examples of these data include instructions for any application or method operating on the node device, contact data, phone book data, messages, pictures, videos, etc.
  • the processor 32 is coupled with the memory 31, and is configured to execute a computer program in the memory 31 for:
  • the target service cluster is any service cluster in the serverless network system where the node device is located;
  • the resource access request and the private resource domain identifier are sent to the resource management and control node in the target service cluster through the communication component 33 to instruct the resource management and control node to determine the target shared resource for the target service cluster .
  • the processor 32 when the processor 32 obtains the private resource domain identifier corresponding to the target service cluster, it is specifically configured to: according to the identifier of the target service cluster carried in the resource access request, in the pre-stored service cluster identifier and the private resource domain identifier Matching is performed in the corresponding relationship to obtain the private resource domain identifier corresponding to the target service cluster.
  • the processor 32 is further configured to: determine whether the resource type to be accessed carried in the resource access request belongs to a preset global shared resource type; if the resource type to be accessed belongs to a global shared resource type, determine the resource access Request to declare access to global shared resources.
  • the processor 32 is further configured to: determine whether the resource type to be accessed belongs to the preset global non-shared resource type; if the resource type to be accessed belongs to the global non-shared resource type, shield the resource access request; if the resource type to be accessed is not global If the shared resource type does not belong to the global non-shared resource type, it is determined that the resource access request declares access to the private resource.
  • the processor 32 is further configured to: in the case that the resource access request declares access to the private resource, send the resource access request and the private resource domain identifier to the resource management and control node in the target service cluster to instruct the resource management and control node to forward to the target service The service node in the cluster.
  • the processor 32 when the processor 32 sends the resource access request and the private resource domain identifier to the resource management and control node in the target service cluster through the communication component 33, it is specifically configured to: through the communication component 33, the resource access request and the private resource domain identifier Sent to the shared resource access interface on the resource management and control node in the target service cluster.
  • the processor 32 when the processor 32 sends the resource access request and the private resource domain identifier to the resource management and control node in the target service cluster through the communication component 33, it is specifically used to: send the resource access request and the private resource domain identifier through the communication component 33 To the private resource access interface on the resource control node in the target service cluster.
  • the node device further includes: a display 34, a power supply component 35, an audio component 36 and other components. Only some components are schematically shown in FIG. 3, which does not mean that the node device only includes the components shown in FIG. 3. In addition, according to the different implementation forms of the node device, the components with a dashed frame in Figure 3 are optional components, not mandatory components.
  • an embodiment of the present application also provides a computer-readable storage medium storing a computer program, and when the computer program is executed, the steps that can be executed by the master node in the foregoing method embodiments can be implemented.
  • Fig. 4 is a schematic structural diagram of another node device provided by an exemplary embodiment of this application.
  • the node device can be implemented as the resource management and control node in the foregoing embodiment.
  • the node device includes a memory 41, a processor 42 and a communication component 43.
  • the memory 41 is used to store computer programs, and can be configured to store various other data to support operations on the node device. Examples of these data include instructions for any application or method operating on the node device, contact data, phone book data, messages, pictures, videos, etc.
  • the processor 42 coupled with the memory 41, is configured to execute the computer program in the memory 41 for:
  • the private resource domain identifier corresponding to the target service cluster determine the target shared resource to which the target service cluster has access rights
  • the target service cluster is any service cluster in the serverless network system where the master control node is located, and the resource management and control node belongs to the target service cluster.
  • the processor 42 is further configured to receive, through the communication component 43, a resource access request from the target service cluster sent by the master control node, where the resource access request carries the resource type to be accessed. Based on this, when the processor 42 determines the target shared resource to which the target service cluster has access rights, it is specifically configured to: according to the private resource domain identifier corresponding to the target service cluster and the resource type to be accessed, set the private resource corresponding to the maintained target service cluster The resource domain identifier is matched with the corresponding relationship of the shared resource label under at least one candidate global shared resource type to obtain the target shared resource label; wherein the target shared resource identifies the target shared resource.
  • the processor 42 when the processor 42 notifies the service node in the target service cluster to access the target shared resource, it is specifically configured to: send the resource access request and the target shared resource tag to the target service through the communication component 43 The service node in the cluster allows the service node to access target shared resources.
  • the processor 42 is further configured to: obtain at least one candidate global shared resource type that the tenant of the target service cluster has permission to access, and obtain shared resources under the at least one candidate global shared resource type; Among the shared resources under at least one candidate global shared resource type, respectively select the shared resources that the target service cluster has access rights under at least one candidate global shared resource type; for the target service cluster, at least one candidate global shared resource type A shared resource label is allocated to a shared resource with access rights under the shared resource, and a correspondence relationship between the private resource domain identifier corresponding to the target service cluster and the shared resource label under at least one candidate global shared resource type is established.
  • the processor 42 is further configured to: send the shared resource label of at least one candidate global shared resource type to the service node in the target service cluster through the communication component 43 for the service node to maintain locally Correspondence between shared resource tags under at least one candidate global shared resource type and corresponding shared resources.
  • the node device further includes: a display 44, a power supply component 45, an audio component 46 and other components. Only some components are schematically shown in FIG. 4, which does not mean that the node device only includes the components shown in FIG. 4. In addition, according to the different implementation forms of the node device, the components with the dashed frame in Figure 4 are optional components, not mandatory components.
  • an embodiment of the present application also provides a computer-readable storage medium storing a computer program, and when the computer program is executed, the steps that can be executed by the master node in the foregoing method embodiments can be implemented.
  • the memory in Figures 3 and 4 above can be implemented by any type of volatile or non-volatile storage devices or their combination, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.
  • SRAM static random access memory
  • EEPROM electrically erasable programmable read-only memory
  • EPROM erasable programmable read-only memory
  • PROM programmable read-only memory
  • ROM read-only memory
  • magnetic memory magnetic memory
  • flash memory magnetic disk or optical disk.
  • the communication components in Figures 3 and 4 are configured to facilitate wired or wireless communication between the device where the communication component is located and other devices.
  • the device where the communication component is located can access a wireless network based on communication standards, such as WiFi, 2G or 3G, or a combination of them.
  • the communication component receives a broadcast signal or broadcast related information from an external broadcast management system via a broadcast channel.
  • the communication component may further include a near field communication (NFC) module, radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, and Bluetooth (BT) technology Wait.
  • NFC near field communication
  • RFID radio frequency identification
  • IrDA infrared data association
  • UWB ultra-wideband
  • BT Bluetooth
  • the display in FIGS. 3 and 4 described above includes a screen, and the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user.
  • the touch panel includes one or more touch sensors to sense touch, sliding, and gestures on the touch panel. The touch sensor may not only sense the boundary of a touch or slide action, but also detect the duration and pressure related to the touch or slide operation.
  • the power components in Figures 3 and 4 above provide power for various components of the equipment where the power components are located.
  • the power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the device where the power supply component is located.
  • the audio component includes a microphone (MIC).
  • the microphone When the device where the audio component is located is in an operating mode, such as call mode, recording mode, and voice recognition mode, the microphone is configured to receive external audio signals.
  • the received audio signal can be further stored in a memory or sent via a communication component.
  • the audio component further includes a speaker for outputting audio signals.
  • the embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.
  • a computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the block diagram.
  • the computing device includes one or more processors (CPU), input/output interfaces, network interfaces, and memory.
  • processors CPU
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • the memory may include non-permanent memory in computer readable media, random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer readable media.
  • RAM random access memory
  • ROM read-only memory
  • flash RAM flash memory
  • Computer-readable media include permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology.
  • the information can be computer-readable instructions, data structures, program modules, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage, Magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media can be used to store information that can be accessed by computing devices. According to the definition in this article, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

本申请实施例提供一种无服务器架构下的资源访问方法、设备、系统及存储介质。在本申请实施例中，针对serverless架构中的多租户场景，在租户部署的服务集群中增加资源管控节点，该资源管控节点与serverless架构中的主控节点相互配合，基于服务集群的私有资源域标识为服务集群确定具有访问权限的共享资源，在保证服务集群成功访问相应共享资源的基础上，可在不同租户之间实现对共享资源访问的安全隔离性。

Description

无服务器架构下的资源访问方法、设备、系统及存储介质
本申请要求2019年05月28日递交的申请号为201910451596.X、发明名称为“无服务器架构下的资源访问方法、设备、系统及存储介质”中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及互联网技术领域，尤其涉及一种无服务器架构下的资源访问方法、设备、系统及存储介质。
背景技术
无服务器(serverless)架构是一种新型的互联网架构，其中应用开发不使用常规的服务进程，这为边缘计算场景中的应用程序提供了一种全新的体系架构。在serverless架构与边缘计算结合的模式下，serverless架构可将租户的服务器、数据库和中间件等服务端设施屏蔽，租户不再参与服务端设施的部署和维护，可大大简化租户的部署和运维难度。
但是，serverless架构在多租户场景下对共享资源访问的安全隔离是有待解决的问题，尤其是在结合海量边缘节点的多租户生产环境中，如何保证不同租户对共享资源的访问隔离性显得尤其重要。
发明内容
本申请的多个方面提供一种无服务器架构下的资源访问方法、设备、系统及存储介质，用以在不同租户之间实现共享资源的安全隔离，提高共享资源的访问安全性。
本申请实施例提供一种无服务器serverless的网络系统，包括：主控节点、多个租户部署的serverless的服务集群以及可供所述多个租户共享的至少一种类型的全局共享资源；每个服务集群包括资源管控节点和服务节点；
所述主控节点，用于在目标服务集群需要访问全局共享资源的情况下，为所述目标服务集群中的资源管控节点提供所述目标服务集群对应的私有资源域标识；其中，所述目标服务集群是任一服务集群；
所述资源管控节点，用于在属于所述目标服务集群的情况下，根据所述目标服务集群对应的私有资源域标识确定所述目标服务集群具有访问权限的目标共享资源，并通知 所述目标服务集群中的服务节点对所述目标共享资源进行资源访问。
本申请实施例还提供一种基于容器编排调度系统实现的边缘云网络系统，包括：部署于服务端设备中的主控节点、多个租户在边缘计算设备中部署的无服务器serverless的容器集群以及可供所述多个租户共享的至少一种类型的云资源；其中，每个容器集群包括资源管控节点和弹性容器实例ECI节点；
所述主控节点，用于在目标容器集群需要访问可共享的云资源的情况下，为所述目标容器集群中的资源管控节点提供所述目标容器集群对应的命名空间标识；其中，所述目标容器集群是任一容器集群；
所述资源管控节点，用于在属于所述目标容器集群的情况下，根据所述目标容器集群对应的命名空间标识确定所述目标容器集群具有访问权限的目标共享资源，并通知所述目标容器集群中的ECI节点对所述目标共享资源进行资源访问。
本申请实施例还提供一种资源访问方法，适用于主控节点，所述方法包括：
接收目标服务集群的资源访问请求，所述目标服务集群是所述主控节点所在无服务器serverless的网络系统中任一服务集群；
根据所述资源访问请求，获取所述目标服务集群对应的私有资源域标识；
在所述资源访问请求声明访问全局共享资源的情况下，将所述资源访问请求和所述私有资源域标识发送给所述目标服务集群中的资源管控节点，以指示所述资源管控节点为所述目标服务集群确定目标共享资源。
本申请实施例还提供一种资源访问方法，适用于资源管控节点，所述方法包括：
接收主控节点在确定目标服务集群需要访问全局共享资源的情况下发送的所述目标服务集群对应的私有资源域标识；
根据所述目标服务集群对应的私有资源域标识，确定所述目标服务集群具有访问权限的目标共享资源；
通知所述目标服务集群中的服务节点对所述目标共享资源进行资源访问；
其中，所述目标服务集群是所述主控节点所在无服务器serverless的网络系统中任一服务集群，所述资源管控节点属于所述目标服务集群。
本申请实施例还提供一种节点设备，包括：存储器和处理器；所述存储器，用于存储计算机程序；当所述计算机程序被所述处理器执行时，致使所述处理器实现本申请实施例提供的可由主控节点执行的资源访问方法中的步骤。
本申请实施例还提供一种节点设备，包括：存储器和处理器；所述存储器，用于存 储计算机程序；当所述计算机程序被所述处理器执行时，致使所述处理器实现本申请实施例提供的可由资源管控节点执行的资源访问方法中的步骤。
本申请实施例还提供一种存储有计算机程序的计算机可读存储介质，当所述计算机程序被所述处理器执行时，致使所述处理器实现本申请实施例提供的可由主控节点和/或资源管控节点执行的资源访问方法中的步骤。
在本申请实施例中，针对serverless架构中的多租户场景，在租户部署的服务集群中增加资源管控节点，该资源管控节点与serverless架构中的主控节点相互配合，在其所属服务集群需要访问全局共享资源的情况下，可根据主控节点提供的服务集群对应的私有资源域标识，为其所属服务集群确定具有访问权限的共享资源，进而通知服务集群中的服务节点对所确定的共享资源进行资源访问。其中，基于服务集群的私有资源域标识为服务集群确定具有访问权限的共享资源，在保证服务集群成功访问相应共享资源的基础上，可在不同租户之间实现对共享资源访问的安全隔离性；另外，租户不需要感知共享资源，有利于简化访问共享资源的过程。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1a为本申请示例性实施例提供的一种无服务器serverless的网络系统的结构示意图；
图1b为本申请示例性实施例提供的一种基于Kubernetes实现的边缘云网络系统的结构示意图；
图2a为本申请示例性实施例提供的一种资源访问方法的流程示意图；
图2b为本申请示例性实施例提供的另一种资源访问方法的流程示意图；
图3为本申请示例性实施例提供的一种节点设备的结构示意图；
图4为本申请示例性实施例提供的另一种节点设备的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合本申请具体实施例及相应的附图对本申请技术方案进行清楚、完整地描述。显然，所描述的实施例仅是本申请 一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
现有serverless架构在多租户场景下对共享资源访问的安全隔离是有待解决的技术问题。针对该技术问题，在本申请一些实施例中，针对serverless架构中的多租户场景，在租户部署的服务集群中增加资源管控节点，该资源管控节点与serverless架构中的主控节点相互配合，基于服务集群的私有资源域标识为服务集群确定具有访问权限的共享资源，在保证服务集群成功访问相应共享资源的基础上，可在不同租户之间实现对共享资源访问的安全隔离性；另外，租户不需要感知共享资源，有利于简化租户访问共享资源的过程。
以下结合附图，详细说明本申请各实施例提供的技术方案。
图1a为本申请示例性实施例提供的一种serverless的网络系统10的结构示意图。如图1a所示，该网络系统10包括：主控节点11、多个租户部署的serverless的服务集群12以及可供多个租户共享的至少一种类型的全局共享资源13。其中，每个服务集群12包括资源管控节点121和服务节点122。
本实施例的网络系统10包括多种资源，例如计算资源、存储资源和网络资源等，这些资源可由网络系统中的物理设备提供。网络系统10中的物理设备包括但不限于：计算机设备、传感器设备、存储设备、常规服务器、云服务器或服务器阵列等。本实施例的网络系统10，一方面可以向租户提供所需的各种资源，另一方面还可在这些资源上为租户提供所需的服务。其中，网络系统10为租户提供服务的方式是允许租户在网络系统10中(具体是在网络系统中的物理设备上)部署自己所需的服务集群。
本实施例的网络系统10可以为多个租户提供服务，即允许多个租户分别在网络系统中部署自己所需的服务集群12。其中，每个租户可以部署一个或多个服务集群12。同一租户的不同服务集群可以为该租户提供相同的服务，也可以为该租户提供不同的服务。另外，不同租户部署的服务集群可以提供相同的服务，也可以提供不同的服务。每个服务集群12中包括可为相应租户提供所需服务的服务节点122，服务节点122的数量可以是一个或多个。可选地，在服务节点12为多个的情况下，多个服务节点122可以集中部署在同一台物理设备或虚拟机上，也可以分散部署在多台物理设备或虚拟机上。关于同一服务集群12中的多个服务节点122在多台物理设备或虚拟机上的分散部署方式，本实施例不做限定。
其中，不同租户具有不同的身份标识，每个租户的身份标识可唯一标识该租户。租 户的身份标识可以任何能够唯一标识该租户的信息，例如可以是租户在网络系统10中的ID，也可以是租户在网络系统10中注册的租户名称、账号、电话号码、电子邮箱和/或家庭住址等。另外，为了区分不同租户部署的服务集群以及同一租户部署的不同服务集群，每个服务集群12也有自己的标识，每个服务集群12的标识可唯一标识该服务集群。服务集群12的标识可以是任何能够唯一标识该服务集群的信息，例如可以是服务集群在网络系统10中的ID、名称和/或部署时间等。在本实施例中，维护有租户的身份标识与租户部署的服务集群12的标识之间的对应关系。
其中，每个服务集群12都具有自己的私有资源域，该私有资源域中包括服务集群12独享的各种资源，例如服务集群12中部署的各种服务程序等。本申请实施例并不限定服务程序的实现形式，例如可以包括各类应用程序和/或操作系统等。为了区分不同服务集群12的私有资源域，私有资源域也具有自己的标识，该标识可唯一标识一个服务集群的私有资源域。私有资源域的标识可以是任何能够唯一标识私有资源域的信息，例如可以是私有资源域在网络系统10中的ID或名称等。在本实施例中，维护有服务集群12的标识与其对应的私有资源域的标识(简称为私有资源域标识)之间的对应关系。
在网络系统10中，除了包括每个服务集群12独享的私有资源之外，还包括一些全局性资源；这些全局性资源中有一部分是可供不同租户共享的，称为全局共享资源，这些全局资源中还有一部分资源是不允许租户使用的，称为全局非共享资源。本实施例并不限定全局共享资源的类型，可以包括至少一种类型的全局共享资源，例如可以包括全局可共享的存储类资源、全局可共享的计算节点和/或全局可共享的网络资源。在图1a中，以存储类资源、计算节点以及网络资源为例对全局共享资源进行图示。可选地，全局可共享的存储类资源可以是本地存储资源，也可以是网络存储资源，例如网络附属存储(Network Attached Storage，NAS)。
其中，不同租户均可以访问网络系统10中的全局共享资源，为了保证共享资源的访问安全，有必要在不同租户之间实现对共享资源访问的安全隔离。为了在不同租户之间实现对共享资源访问的安全隔离，在本实施例的服务集群12中设置资源管控节点121。资源管控节点121与网络系统10中的主控节点11相配合，可在其所属服务集群12需要访问全局共享资源的情况下，帮助租户自动完成服务集群12到共享资源的映射，保证其所属服务集群能够访问相应共享资源。可选地，资管管控节点121可以部署在网络系统10中的物理设备或虚拟机上。进一步可选地，资源管控节点121可以与其所属服务集群12中的某个或某几个服务节点122部署在同一台物理设备或同一虚拟机中。当然，服务 集群12中的资源管控节点121和服务节点122也可以分别部署在不同物理设备或虚拟机中。
其中，主控节点11是网络系统10中的管控节点，主要负责网络系统10中的资源管理、服务调度、集群管控、安全控制、系统监控和纠错等中至少一种管理。可选地，主控节点11上可以运行与系统管控相关的一系列进程，这些进程可实现网络系统10中的资源管理、服务调度、集群管控、安全控制、系统监控和纠错等管理能力。主控节点11的数量可以是一个或多个。主控节点11可以部署在网络系统10中的物理设备或虚拟机上。在主控节点11为多个的情况下，多个主控节点11可以分散部署在多台物理设备或虚拟机上。进一步可选地，主控节点11可以部署在某个服务集群12中的物理设备或虚拟机上，例如主控节点11可以与该服务集群12中的某个或某几个服务节点122部署在同一台物理设备或虚拟机上，或者主控节点11也可以与该服务集群12中的资源管控节点121部署在同一台物理设备或虚拟机上。或者，主控节点11可以独立于各个服务集群12单独部署在一台或多台物理设备上，或者单独部署在一个或多个虚拟机中。
在本实施例中，主控节点11还可以与资源管控节点121配合，在服务集群12请求访问全局共享资源的情况下，基于服务集群12的私有资源域标识在服务集群12之间分配共享资源，在不同租户之间实现对网络系统10中全局共享资源的安全隔离。其中，为每个服务集群12分配共享资源的过程相同或类似，为便于描述和理解，下面将以目标服务集群为例进行说明。其中，目标服务集群是网络系统10中的任一服务集群。
其中，主控节点11可以监控目标服务集群的资源访问需求，在监控到目标服务集群需要访问全局共享资源的情况下，为目标服务集群中的资源管控节点121提供目标服务集群对应的私有资源域标识，以指示目标服务集群中的资源管控节点121为目标服务集群确定具有访问权限的共享资源。对资源管控节点121来说，若其属于目标服务集群，则可以根据目标服务集群对应的私有资源域标识确定目标服务集群具有访问权限的共享资源，并通知目标服务集群中的服务节点122对该共享资源进行资源访问。为便于区分和描述，将资源管控节点121为目标服务集群确定的具有访问权限的共享资源记为目标共享资源。目标共享资源可以是任何类型的共享资源，例如可以是计算资源或存储资源。
在本实施例中，将服务集群对共享资源的访问与服务集群对应私有资源域标识相关联，每个服务集群中的资源管控节点可根据其所属服务集群对应的私有资源域标识为其所属服务集群确定具有访问权限的共享资源，基于私有资源域标识的唯一性，在保证服务集群成功访问相应共享资源的基础上，可在不同租户之间实现对共享资源访问的安全 隔离性。进一步，在本实施例的网络系统10中，不仅可以在租户之间实现对共享资源访问的安全隔离性，甚至在同一租户部署的不同服务集群之间，也可以实现对共享资源访问的安全隔离性。另外，在本实施例的网络系统10中，租户不需要感知共享资源，共享资源之间的分配由资源管控节点自动完成，有利于简化租户访问共享资源的过程。
在一可选实施例中，目标服务集群有资源访问需求时，部署目标服务集群的租户可以根据目标服务集群的资源访问需求生成资源访问请求，将资源访问请求提交给主控节点11。可选地，网络系统10(具体可以是主控节点11)可向租户提供交互界面，租户通过该交互界面可向主控节点11提交资源访问请求，进一步还可以通过该交互界面与主控节点11进行其它交互。该交互界面可以是web界面，命令窗口或者应用界面，具体可视网络系统10所实现的产品形态而定。接口该资源访问请求中携带有目标服务集群对应的租户的身份标识、目标服务集群的标识以及待访问资源类型等信息。其中，待访问资源类型表示目标服务集群需要访问的资源类型，例如可能是私有资源，也可能是全局共享资源，也可能是全局非共享资源。根据待访问资源类型的不同，资源访问请求会声明访问不同类型的资源。
在该可选实施例中，主控节点11可以通过判断是否接收到目标服务集群的资源访问请求，来监控目标服务集群的资源访问需求。若接收到目标服务集群的资源访问请求，主控节点11一方面可根据该资源访问请求获取目标服务集群对应的私有资源域标识，另一方面可识别该资源访问请求是否声明访问全局共享资源。值得说明的是，并不限定获取目标服务集群对应的私有资源域标识的操作与识别该资源访问请求是否声明访问全局共享资源的操作之间的执行顺序，两个操作可并行执行，也可以顺序执行。
可选地，主控节点11可以预先存储服务集群标识与私有资源域标识的对应关系。基于此，主控节点11可以根据资源访问请求中携带的目标服务集群的标识，在预先存储的服务集群标识与私有资源域标识的对应关系中进行匹配，以得到目标服务集群对应的私有资源域标识。
可选地，可以预先设定全局共享资源类型，例如存储资源类型、计算资源类型等。基于此，主控节点11可以判断资源访问请求中携带的待访问资源类型是否属于预设的全局共享资源类型；若待访问资源类型属于全局共享资源类型，确定资源访问请求声明访问全局共享资源。
进一步，还可以预先设定全局非共享资源类型，全局非共享资源类型是指不允许租户访问的全局资源。基于此，主控节点11还可以判断待访问资源类型是否属于预设的全 局非共享资源类型；若待访问资源类型属于全局非共享资源类型，屏蔽该资源访问请求；进一步可选地，可以向租户返回禁止资源访问的提示信息。对于待访问资源类型不属于全局共享资源类型且不属于全局非共享资源类型的情况，主控节点11可以确定资源访问请求声明访问私有资源。关于资源访问请求声明访问私有资源在后面实施例中描述，在此不做详述。
值得说明的是，本实施例并不限定上述判断资源访问请求中携带的待访问资源类型是否属于预设的全局共享资源类型的操作，与上述判断待访问资源类型是否属于预设的全局非共享资源类型的操作之间的执行顺序，两个操作可以并行执行，也可以顺序执行。在顺序执行的时候，可以先判断资源访问请求中携带的待访问资源类型是否属于预设的全局共享资源类型的操作，并在判断结果为否的情况下，进一步判断待访问资源类型是否属于预设的全局非共享资源类型。或者，在顺序执行的时候，可以先判断待访问资源类型是否属于预设的全局非共享资源类型的操作，并在判断结果为否的情况下，进一步判断资源访问请求中携带的待访问资源类型是否属于预设的全局共享资源类型。
进一步，在该资源访问请求声明访问全局共享资源的情况下，主控节点11可以将该资源访问请求和所获取的目标服务集群对应的私有资源域标识发送给目标服务集群中的资源管控节点121，以指示资源管控节点121为目标服务集群确定具有权限访问的目标共享资源。
可选地，主控节点11可以在同一通信过程中，将资源访问请求和目标服务集群对应的私有资源域标识一并发送给目标服务集群中的资源管控节点121。进一步，主控节点11可以将目标服务集群对应的私有资源域标识添加到资源访问请求中，将资源访问请求发送给目标服务集群中的资源管控节点121。或者，主控节点11也可以在不同通信过程中，将资源访问请求和目标服务集群对应的私有资源域标识分别发送给目标服务集群中的资源管控节点121。
在一可选实施例中，目标服务集群中的资源管控节点121，可以维护目标服务集群对应的私有资源域标识与至少一种候选全局共享资源类型下的共享资源标签的对应关系。其中，候选全局共享资源类型就是全局共享资源类型，只是为了区分和描述，在全局共享资源类型前面冠以“候选”二字。其中，至少一种候选全局共享资源类型可以是网络系统10中允许的全局共享资源类型中的一部分或全部。其中，某全局共享资源类型下的共享资源标签，表示该全局共享资源类型下可被目标服务集群访问的共享资源；若该全局共享资源类型下有多个可被目标服务集群访问的共享资源，每个共享资源都会被分 配共享资源标签，且不同共享资源对应的共享资源标签不同。值得说明的是，根据资源切分粒度的不同，本申请实施例中某全局共享资源类型下的共享资源的大小也会有所不同。例如，对于存储类资源，以存储盘为例粒度，可以包括多块存储盘，每块存储盘可作为本申请实施例所述的共享资源；进一步，如果某块存储盘可被目标服务集群访问，则该块存储盘会被打上共享资源标签。又例如，对于存储类资源，以扇区为例粒度，可以包括多个扇区，则每个扇区可作为本申请实施例所述的共享资源；进一步，如果某个扇区可被目标服务集群访问，则该扇区会被打上共享资源标签。
可选地，若某种候选全局共享资源类型指示的共享资源是部署ECI节点的物理设备，则在该候选全局共享资源类型下目标服务集群具有访问权限的共享资源是指对目标服务集群来说可见的物理设备。
可选地，若某种候选全局共享资源类型指示的共享资源是存储资源，则在该候选全局共享资源类型下目标服务集群具有访问权限的共享资源是指对目标服务集群来说空闲的存储资源和该目标服务集群已经使用的。
基于上述，目标服务集群中的资源管控节点121，可以接收主控节点11发送的资源访问请求和目标服务集群对应的私有资源域标识；根据目标服务集群对应的私有资源域标识和资源访问请求中携带的待访问资源类型，在所维护的目标服务集群对应的私有资源域标识与至少一种候选全局共享资源类型下的共享资源标签的对应关系中进行匹配，以得到目标共享资源标签；将资源访问请求和目标共享资源标签发送给目标服务集群中的服务节点122，以供服务节点122对目标共享资源进行资源访问。其中，目标共享资源标签标识目标服务集群具有访问权限的目标共享资源。
可选地，目标服务集群中的资源管控节点121，可以在同一通信过程中，将资源访问请求和目标共享资源标签一并发送给目标服务集群中的服务节点122。进一步，目标服务集群中的资源管控节点121，可以将目标共享资源标签添加至资源访问请求中，将资源访问请求发送给目标服务集群中的服务节点122。或者，目标服务集群中的资源管控节点121，也可以在不同通信过程中，将资源访问请求和目标共享资源标签分别发送给目标服务集群中的服务节点122。
其中，目标服务集群中的资源管控节点121，维护目标服务集群对应的私有资源域标识与所述至少一种候选全局共享资源类型下的共享资源标签的对应关系的方式包括但不限于：
获取目标服务集群的租户有权限访问的至少一种候选全局共享资源类型，并获取至 少一种候选全局共享资源类型下的共享资源信息；根据至少一种候选全局共享资源类型下的共享资源信息，分别选定目标服务集群在至少一种候选全局共享资源类型下具有访问权限的共享资源；为目标服务集群在至少一种候选全局共享资源类型下具有访问权限的共享资源分配共享资源标签，建立目标服务集群对应的私有资源域标识与至少一种候选全局共享资源类型下的共享资源标签的对应关系。
进一步可选地，租户管理员可以将目标服务集群的租户对应的授权配置信息提供给资源管控节点121。其中，该授权配置信息中包括租户的身份标识以及租户具有权限访问的全局共享资源类型。或者，该授权配置信息中包括租户的身份标识以及租户的权限，租户的权限决定了租户具有权限访问的全局共享资源类型。在本实施例中，候选全局共享资源类型是指租户具有权限访问的全局共享资源类型，其数量可以是一个或多个。基于此，资源管控节点121可以根据授权配置信息获取目标服务集群的租户有权限访问的至少一种候选全局共享资源类型。
进一步可选地，资源管控节点121可以定时对全局共享资源进行轮询，获取至少一种候选全局共享资源类型下的共享资源信息。或者，资源管控节点121可以向目标服务集群中的服务节点122发送轮询请求，以供服务节点122轮询至少一种候选全局共享资源类型下的共享资源信息并上报；接收服务节点122上报的至少一种候选全局共享资源类型下的共享资源信息。每一种候选全局共享资源类型下的共享资源信息包括但不限于：共享资源的元数据和访问控制信息等。其中，考虑到共享资源的访问状态是动态变化的，基于定时轮询方式，可以实时更新所维护的目标服务集群对应的私有资源域标识与至少一种候选全局共享资源类型下的共享资源标签的对应关系，保证该对应关系可跟随共享资源的访问状态的变化而变化，提高该对应关系的准确性。
进一步，为了便于目标服务集群中的服务节点122能够根据目标共享资源标签成功地对目标共享资源进行资源访问，资源管控节点121可以在为目标服务集群在至少一种候选全局共享资源类型下具有访问权限的共享资源分配共享资源标签之后，可将至少一种候选全局共享资源类型下的共享资源标签发送给目标服务集群中的服务节点122，以供服务节点122在本地维护至少一种候选全局共享资源类型下的共享资源标签与相应共享资源的对应关系。进而，服务节点122在接收到资源管控节点121发送的目标共享资源标签时，可以查询本地所维护的对应关系，确定目标共享资源标签对应的目标共享资源，进而对该目标共享资源进行资源访问。
值得说明的是，根据资源访问请求的不同，服务节点122对目标共享资源进行资源 访问的方式也会有所不同。例如，资源访问请求是资源查询请求，则服务节点122可以向租户返回目标共享资源的元数据等信息。又例如，资源访问请求是资源使用请求，则服务节点122可以在目标共享资源上进行相应操作，例如执行磁盘挂载类的资源操作等。
在本申请实施例中，资源访问请求可以声明访问全局共享资源，有可能声明访问私有资源，甚至可以声明访问全局非共享资源。对于资源访问请求声明访问全局非共享资源的情况，主控节点11会将该资源访问请求屏蔽掉，确保全局非共享资源的安全性。对于资源访问请求声明访问私有资源的情况，主控节点11还可以将资源访问请求和目标服务集群对应的私有资源域标识发送给目标服务集群中的资源管控节点121，以指示资源管控节点121转发给目标服务集群中的服务节点122。对服务节点122来说，可直接根据资源访问请求和目标服务集群对应的私有资源域标识，对目标服务集群的私有资源进行资源访问。
值得说明的是，在资源访问请求声明访问全局共享资源和声明访问私有资源的情况下，主控节点11都会将资源访问请求和目标服务集群对应的私有资源域标识发送给目标服务集群中的资源管控节点121，但是指示资源管控节点121执行的动作不同。为了进行区分，在一可选实施例中，资源管控节点121设置不同的资源访问接口，分别是共享资源访问接口和私有资源访问接口。基于此，在资源访问请求声明访问全局共享资源的情况下，主控节点11将资源访问请求和目标服务集群对应的私有资源域标识发送至目标服务集群中的资源管控节点121上的共享资源访问接口，以指示资源管控节点121为目标服务集群确定目标共享资源。在资源访问请求声明访问私有资源的情况下，主控节点11将资源访问请求和目标服务集群对应的私有资源域标识发送至目标服务集群中的资源管控节点121上的私有资源访问接口，以指示资源管控节点121转发给目标服务集群中的服务节点122。
对资源管控节点121来说，若在共享资源访问接口上接收到资源访问请求和目标服务集群对应的私有资源域标识，可以获知资源访问请求声明访问全局共享资源，则会执行共享资源对应的访问处理流程；若在私有资源访问接口上接收到资源访问请求和目标服务集群对应的私有资源域标识，可以获知资源访问请求声明访问私有资源，则会执行私有资源对应访问处理流程。
值得说明的是，本实施例提供的serverless的网络系统，可以应用到各种应用场景中，并且根据应用场景的不同，租户部署的服务集群、服务集群中的服务节点以及资源管控节点的实现形式都会有所不同。
例如，本实施例的serverless的网络系统可应用到边缘计算等边缘云网络场景中。在serverless的边缘云网络系统中，租户可以在边缘计算设备中部署容器集群，容器集群中包括弹性容器实例(Elastic Container Instance，ECI)节点，由ECI节点为租户提供相应云计算服务。其中，ECI节点是部署在边缘计算设备上的容器化的应用，是服务节点的一种具体实现形式，但并不限于此。
进一步可选地，在serverless的边缘云网络系统中，可以采用容器编排调度系统对边缘云网络系统中ECI节点进行创建、管理、发现、访问和配置等操作，从而将系统的运维人员解放出来。容器编排调度系统是指可自动部署、扩展和管理容器化应用程序的系统，例如可以采用Kubernetes(简称为K8s)，但不限于此。
基于上述，本申请实施例还提供一种基于容器编排调度系统实现的边缘云网络系统，如图1b所示。该边缘云网络系统20包括：部署在服务端设备中的主控节点21、多个租户在边缘计算设备中部署的serverless的容器集群22以及可供多个租户共享的至少一种类型的云资源23。其中，每个容器集群22包括资源管控节点221和ECI节点222。
在本实施例中，边缘云网络系统20包括服务端设备和边缘计算设备。其中，服务端设备可部署在云端或客户机房中，可以是一台或多台，例如可以是常规服务器、云服务器或服务器阵列等。边缘计算设备是指位于网络边缘，相对靠近终端侧，具有一定计算和处理能力，并可与网络中的其它设备(如服务端设备)进行网络通信的设备，可以是个人计算机、智能手机等终端类设备，也可以是部署于网络边缘的大型计算机或服务器等，当然也可以是部署于网络边缘的虚拟机。
在本实施例中，采用容器编排调度系统，例如Kubernetes，可从逻辑上将边缘云网络系统20中的物理设备划分为主控(Master)节点21和ECI节点222。为便于图示，在图1b中以基于Kubernetes实现的边缘云网络系统为例进行图示。其中，主控节点21部署在边缘云网络系统20中的服务端设备上，在主控节点21上运行着集群管理相关的一组进程，以Kubernetes为例，这些进程包括但不限于：kube-apiserver、kube-controller-manager和kube-scheduler等，这些进程实现了整个集群的资源管理、容器组(例如Kubernetes中的Pod)调度、弹性伸缩、安全控制、系统监控和纠错等管理能力，并且都是全自动完成的。ECI节点作为边缘云网络系统20中的工作节点，运行容器化的应用程序，这些ECI节点222分布在不同租户部署的容器集群22中；不同租户的容器集群22被部署在边缘云网络系统20中的边缘计算设备中。在ECI节点222上，容器组是容器编排调度系统管理的最小运行单元，该容器组包含至少一个容器。以 Kubernetes为例，Kubernetes管理的最小运行单元是Pod。Pod直译为豆荚，在本实施例中，是指一组容器的集合，即前面所述的容器组。ECI节点222上运行着容器编排调度系统中与容器组相关的进程，以Kubernetes为例，与容器组相关的进程包括但不限于：Kubernetes的kubelet和kube-proxy服务进程，这些服务进程负责容器组(例如Pod)的创建、启动、监控、重启、销毁以及实现软件模式的负载均衡器。
其中，每个容器集群22中包含的ECI节点222的数量可以是一个或多个。在容器集群22中包含多个ECI节点222的情况下，多个ECI节点222可以集中部署在同一台边缘计算设备上，也可以分散部署在多台边缘计算设备上。
其中，不同租户具有不同的身份标识，每个租户的身份标识可唯一标识该租户。租户的身份标识可以任何能够唯一标识该租户的信息，例如可以是租户在边缘云网络系统20中的ID，也可以是租户在边缘云网络系统20中注册的租户名称、账号、电话号码、电子邮箱和/或家庭住址等。另外，为了区分不同租户在边缘计算设备中部署的容器集群22以及同一租户在边缘计算设备中部署的不同容器集群22，每个容器集群22也有自己的标识，每个容器集群22的标识可唯一标识该服务集群。容器集群22的标识可以是任何能够唯一标识该服务集群的信息，例如可以是容器集群22在边缘云网络系统20中的ID或名称等。在本实施例中，维护有租户的身份标识与租户部署的容器集群22的标识之间的对应关系。
其中，每个容器集群22都具有自己的命名空间(Namespace)。命名空间是容器编排调度系统，如Kubernetes中一个重要的概念，通过将边缘云网络系统20内部的对象“分配”到不同的Namespace中，形成逻辑上分组的不同项目、小组或用户组，便于不同的分组在共享使用整个系统的资源的同时还能被分别管理。例如，租户在某个容器集群22中创建的容器组(如Pod)、RC、服务(Service)都被会创建到容器集群22的Namespace中。每个命名空间都有自己的标识，例如ID或名称。在本实施例中，维护有容器集群22的标识与其对应的命名空间的标识之间的对应关系。
在边缘云网络系统20中，除了包括每个容器集群22独享的私有资源之外，还包括一些全局性资源；这些全局性资源中有一部分是可供不同租户共享的，称为全局共享资源，这些全局资源中还有一部分资源是不允许租户使用的，称为全局非共享资源。本实施例并不限定全局共享资源的类型，可以包括至少一种类型的全局共享资源，例如可以包括全局可共享的存储类资源、全局可共享的计算节点和/或全局可共享的网络资源。在图1b中，以NAS为例对全局共享资源进行图示。
其中，不同租户均可以访问边缘云网络系统20中的全局共享资源，为了保证共享资源的访问安全，有必要在不同租户之间实现对共享资源访问的安全隔离。为了在不同租户之间实现对共享资源访问的安全隔离，在本实施例中，借助容器编排调度系统的可扩展性，例如以Kubernetes为例，可基于Virtual Kubelet的可扩展性，在每个容器集群22中扩展出资源管控节点221。其中，Virtual Kubelet是Kubernetes Kubelet的一个实现，它允许不同厂商基于它扩展相应Kubernetes节点的API实现与系统之间的通讯，实现Kubernetes的serverless能力。资源管控节点221可在其所属容器集群22需要访问全局共享资源的情况下，帮助租户自动完成容器集群22到共享资源的映射，保证其所属容器集群22能够访问相应共享资源。可选地，资管管控节点221部署在边缘云网络系统20中的边缘计算设备上。进一步可选地，资源管控节点221可以与其所属容器集群22中的某个或某几个ECI节点222部署在同一台边缘计算设备中。当然，容器集群22中的资源管控节点221和ECI节点222也可以分别部署在不同边缘计算设备中。
在本实施例中，除了扩展出资源管控节点221之外，还在服务端设备中部署了主控节点21。可选地，可对容器编排调度系统的原生主节点(Master)进行功能扩展，以得到本申请实施例中的主控节点21。可选地，对容器编排调度系统的原生主节点进行功能扩展的方式可以是为该原生主节点扩展一个API代理组件，可记为api-proxy，该API代理组件与原生主节点相结合，实现本实施例中主控节点21的功能；或者，是直接对容器编排调度系统的原生主节点进行功能修改，以实现本实施例中的主控节点21的功能。以Kubernetes为例，Kubernetes原生主节点是指其原生apiserver组件。在图1b中，以扩展API代理组件api-proxy为例进行图示。另外，如图1b所示，主控节点21与资源管控节点221相结合可实现容器编排调度系统，如Kubernetes的管控系统，这是从逻辑上划分的，并不意味着主控节点21与资源管控节点221实际部署在同一物理设备中。资源管控节点221隶属于容器集群22，部署在边缘计算设备中。在本实施例中，主控节点21可对租户发起的共享资源访问进行控制，与容器集群22中的资源管控节点221相配合，可基于容器集群22的命名空间标识在容器集群22之间分配共享资源，在不同租户之间实现对边缘云网络系统20中全局共享资源的安全隔离。其中，为每个容器集群22分配共享资源的过程相同或类似，为便于描述和理解，下面将以目标容器集群为例进行说明。其中，目标容器集群是边缘云网络系统20中的任一容器集群。
其中，主控节点21(以Kubernetes为例，具体是主控节点21中新增的api-proxy组件或修改后的apiserver组件)可以监控目标容器集群的资源访问需求，在监控到目标容 器集群需要访问全局共享资源的情况下，为目标容器集群中的资源管控节点221提供目标容器集群对应的命名空间标识，以指示目标容器集群中的资源管控节点221为目标容器集群确定具有访问权限的共享资源。对资源管控节点221来说，若其属于目标容器集群，则可以根据目标容器集群对应的命名空间标识确定目标容器集群具有访问权限的共享资源，并通知目标容器集群中的ECI节点222对该共享资源进行资源访问。为便于区分和描述，将资源管控节点221为目标容器集群确定的具有访问权限的共享资源记为目标共享资源。目标共享资源可以是任何类型的共享资源，例如可以是计算资源或存储资源。
在本实施例中，将容器集群对共享资源的访问与容器集群对应的命名空间相关联，每个容器集群中的资源管控节点可根据其所属容器集群对应的命名空间为其所属容器集群确定具有访问权限的共享资源，基于命名空间的唯一性，在保证容器集群成功访问相应共享资源的基础上，可在不同租户之间实现对共享资源访问的安全隔离性。进一步，在本实施例的边缘云网络系统20中，不仅可以在租户之间实现对共享资源访问的安全隔离性，甚至在同一租户部署的不同容器集群之间，也可以实现对共享资源访问的安全隔离性。另外，在本实施例的边缘云网络系统20中，租户不需要感知共享资源，共享资源之间的分配由资源管控节点自动完成，有利于简化租户访问共享资源的过程。
在一可选实施例中，目标容器集群有资源访问需求时，可以根据资源访问需求生成资源访问请求，将资源访问请求发送给主控节点21。该资源访问请求中携带有目标容器集群对应的租户的身份标识、目标容器集群的标识以及待访问资源类型等信息。其中，待访问资源类型表示目标容器集群需要访问的资源类型，例如可能是私有资源，也可能是全局共享资源，也可能是全局非共享资源。根据待访问资源类型的不同，资源访问请求会声明访问不同类型的资源。
在该可选实施例中，主控节点21可接收目标容器集群的资源访问请求；若接收到目标容器集群的资源访问请求，一方面可根据该资源访问请求获取目标容器集群对应的私有资源域标识，可识别该资源访问请求是否声明访问全局共享资源。可选地，可以根据资源访问请求中携带的目标容器集群的标识，在预先存储的容器集群标识与命名空间的标识的对应关系中进行匹配，以得到目标容器集群对应的命名空间的标识。
进一步，可以预先设定全局非共享资源类型，全局非共享资源类型是指不允许租户访问的全局资源。例如，全局非共享资源包括但不限于：全局命名空间列表，系统组件状态，全局网络策略配置等资源信息。基于此，还可以判断待访问资源类型是否属于预 设的全局非共享资源类型；若待访问资源类型属于全局非共享资源类型，屏蔽该资源访问请求，以保证全局非共享资源的安全性。
进一步，在该资源访问请求声明访问全局共享资源的情况下，主控节点21可以将该资源访问请求和目标容器集群对应的命名空间标识发送给目标容器集群中的资源管控节点221，以指示资源管控节点221为目标容器集群确定具有权限访问的目标共享资源。
在一可选实施例中，目标容器集群中的资源管控节点221，可以维护目标容器集群对应的命名空间标识与至少一种候选全局共享资源类型下的共享资源标签的对应关系。其中，至少一种候选全局共享资源类型是指目标容器集群的租户有权限访问的全局共享资源类型。基于此，目标容器集群中的资源管控节点221，可以接收主控节点21发送的资源访问请求和目标容器集群对应的命名空间标识；根据目标容器集群对应的命名空间标识和资源访问请求中携带的待访问资源类型，在所维护的目标容器集群对应的命名空间标识与至少一种候选全局共享资源类型下的共享资源标签的对应关系中进行匹配，以得到目标共享资源标签；将资源访问请求和目标共享资源标签发送给目标容器集群中的ECI节点222，以供ECI节点222对目标共享资源进行资源访问。其中，目标共享资源标签标识目标容器集群具有访问权限的目标共享资源。
可选地，目标容器集群中的资源管控节点221，获取目标容器集群的租户有权限访问的至少一种候选全局共享资源类型，并获取至少一种候选全局共享资源类型下的共享资源信息；根据至少一种候选全局共享资源类型下的共享资源信息，分别选定目标容器集群在至少一种候选全局共享资源类型下具有访问权限的共享资源；为目标容器集群在至少一种候选全局共享资源类型下具有访问权限的共享资源分配共享资源标签，建立目标容器集群对应的命名空间标识与至少一种候选全局共享资源类型下的共享资源标签的对应关系。
可选地，资源管控节点221可以定时对全局共享资源进行轮询，获取至少一种候选全局共享资源类型下的共享资源信息。或者，资源管控节点221可以向目标容器集群中的ECI节点222发送轮询请求，以供ECI节点222轮询至少一种候选全局共享资源类型下的共享资源信息并上报；接收ECI节点222上报的至少一种候选全局共享资源类型下的共享资源信息。每一种候选全局共享资源类型下的共享资源信息包括但不限于：共享资源的元数据和访问控制信息等。其中，考虑到共享资源的访问状态是动态变化的，基于定时轮询方式，可以实时更新所维护的目标容器集群对应的命名空间标识与至少一种候选全局共享资源类型下的共享资源标签的对应关系，保证该对应关系可跟随共享资源 的访问状态的变化而变化，提高该对应关系的准确性。
进一步，为了便于目标容器集群中的ECI节点222能够根据目标共享资源标签成功地对目标共享资源进行资源访问，资源管控节点221可以在为目标容器集群在至少一种候选全局共享资源类型下具有访问权限的共享资源分配共享资源标签之后，可将至少一种候选全局共享资源类型下的共享资源标签发送给目标容器集群中的ECI节点222，以供ECI节点222在本地维护至少一种候选全局共享资源类型下的共享资源标签与相应共享资源的对应关系。进而，ECI节点222在接收到资源管控节点221发送的目标共享资源标签时，可以查询本地所维护的对应关系，确定目标共享资源标签对应的目标共享资源，进而对该目标共享资源进行资源访问。
图1b所示边缘云网络系统20可以作为图1a所示网络系统10的一种具体实现，一些内容与图1a所示网络系统10相同或相似，本实施例中未涉及的内容，可参见前述实施例的描述，在此不再赘述。
图2a为本申请示例性实施例提供的一种资源访问方法的流程示意图。该实施例是从主控节点的角度进行的描述，如图2a所示，该方法包括：
201a、接收目标服务集群的资源访问请求，目标服务集群是主控节点所在无服务器(serverless)的网络系统中任一服务集群。
202a、根据资源访问请求，获取目标服务集群对应的私有资源域标识。
203a、在资源访问请求声明访问全局共享资源的情况下，将资源访问请求和私有资源域标识发送给目标服务集群中的资源管控节点，以指示资源管控节点为目标服务集群确定目标共享资源。
可选地，步骤202a的一种实施方式包括：根据资源访问请求中携带的目标服务集群的标识，在预先存储的服务集群标识与私有资源域标识的对应关系中进行匹配，以得到目标服务集群对应的私有资源域标识。
在一可选实施例中，该方法还包括：判断资源访问请求中携带的待访问资源类型是否属于预设的全局共享资源类型；若待访问资源类型属于全局共享资源类型，确定资源访问请求声明访问全局共享资源。
进一步，该方法还包括：判断待访问资源类型是否属于预设的全局非共享资源类型；若待访问资源类型属于全局非共享资源类型，屏蔽资源访问请求；若待访问资源类型不属于全局共享资源类型且不属于全局非共享资源类型，确定资源访问请求声明访问私有资源。
进一步，该方法还包括：在资源访问请求声明访问私有资源的情况下，将资源访问请求和私有资源域标识发送给目标服务集群中的资源管控节点，以指示资源管控节点转发给目标服务集群中的服务节点。
可选地，将资源访问请求和私有资源域标识发送给目标服务集群中的资源管控节点，包括：将资源访问请求和私有资源域标识发送至目标服务集群中的资源管控节点上的共享资源访问接口。相应地，将资源访问请求和私有资源域标识发送给目标服务集群中的资源管控节点，包括：将资源访问请求和私有资源域标识发送至目标服务集群中的资源管控节点上的私有资源访问接口。
图2b为本申请示例性实施例提供的另一种资源访问方法的流程示意图。该实施例是从资源管控节点的角度进行的描述，该资源管控节点属于目标服务集群。如图2b所示，该方法包括：
201b、接收主控节点在确定目标服务集群需要访问全局共享资源的情况下发送的目标服务集群对应的私有资源域标识。
202b、根据目标服务集群对应的私有资源域标识，确定目标服务集群具有访问权限的目标共享资源。
203b、通知目标服务集群中的服务节点对目标共享资源进行资源访问；其中，目标服务集群是主控节点所在无服务器(serverless)的网络系统中任一服务集群。
在一可选实施例中，该方法还包括：接收主控节点发送的来自目标服务集群的资源访问请求，资源访问请求中携带有待访问资源类型。基于此，步骤202b的一种实施方式包括：根据目标服务集群对应的私有资源域标识和待访问资源类型，在所维护的目标服务集群对应的私有资源域标识与至少一种候选全局共享资源类型下的共享资源标签的对应关系中进行匹配，以得到目标共享资源标签；其中，目标共享资源标识目标共享资源。
在一可选实施例中，步骤203b中，通知目标服务集群中的服务节点对目标共享资源进行资源访问的一种实施方式包括：将资源访问请求和目标共享资源标签发送给目标服务集群中的服务节点，以供服务节点对目标共享资源进行资源访问。
在一可选实施例中，该方法还包括：获取目标服务集群的租户有权限访问的至少一种候选全局共享资源类型，并获取至少一种候选全局共享资源类型下的共享资源信息；根据至少一种候选全局共享资源类型下的共享资源信息，分别选定目标服务集群在至少一种候选全局共享资源类型下具有访问权限的共享资源；为目标服务集群在至少一种候选全局共享资源类型下具有访问权限的共享资源分配共享资源标签，建立目标服务集群 对应的私有资源域标识与至少一种候选全局共享资源类型下的共享资源标签的对应关系。
进一步，该方法还包括：将至少一种候选全局共享资源类型下的共享资源标签发送给目标服务集群中的服务节点，以供服务节点在本地维护至少一种候选全局共享资源类型下的共享资源标签与相应共享资源的对应关系。
关于本申请上述方法实施例中的步骤以及其它一些内容，可参见前述系统实施例中的描述，在此不再赘述。
在本申请上述方法实施例中，每个服务集群中的资源管控节点与serverless架构中的主控节点相互配合，可基于服务集群的私有资源域标识为服务集群确定具有访问权限的共享资源，在保证服务集群成功访问相应共享资源的基础上，可在不同服务集群以及不同租户之间实现对共享资源访问的安全隔离性；另外，租户不需要感知共享资源，有利于简化访问共享资源的过程，提高共享资源的安全性。
需要说明的是，在上述实施例及附图中的描述的一些流程中，包含了按照特定顺序出现的多个操作，但是应该清楚了解，这些操作可以不按照其在本文中出现的顺序来执行或并行执行，操作的序号如201a、202a等，仅仅是用于区分开各个不同的操作，序号本身不代表任何的执行顺序。另外，这些流程可以包括更多或更少的操作，并且这些操作可以按顺序执行或并行执行。需要说明的是，本文中的“第一”、“第二”等描述，是用于区分不同的消息、设备、模块等，不代表先后顺序，也不限定“第一”和“第二”是不同的类型。
图3为本申请示例性实施例提供的一种节点设备的结构示意图。该节点设备可作为前述实施例中的主控节点实现，如图3所示，该节点设备包括：存储器31、处理器32以及通信组件33。
存储器31，用于存储计算机程序，并可被配置为存储其它各种数据以支持在节点设备上的操作。这些数据的示例包括用于在节点设备上操作的任何应用程序或方法的指令，联系人数据，电话簿数据，消息，图片，视频等。
处理器32，与存储器31耦合，用于执行存储器31中的计算机程序，以用于：
通过通信组件33接收目标服务集群的资源访问请求，目标服务集群是节点设备所在serverless的网络系统中任一服务集群；
根据资源访问请求，获取目标服务集群对应的私有资源域标识；
在资源访问请求声明访问全局共享资源的情况下，通过通信组件33将资源访问请求 和私有资源域标识发送给目标服务集群中的资源管控节点，以指示资源管控节点为目标服务集群确定目标共享资源。
可选地，处理器32在获取目标服务集群对应的私有资源域标识时，具体用于：根据资源访问请求中携带的目标服务集群的标识，在预先存储的服务集群标识与私有资源域标识的对应关系中进行匹配，以得到目标服务集群对应的私有资源域标识。
在一可选实施例中，处理器32还用于：判断资源访问请求中携带的待访问资源类型是否属于预设的全局共享资源类型；若待访问资源类型属于全局共享资源类型，确定资源访问请求声明访问全局共享资源。
进一步，处理器32还用于：判断待访问资源类型是否属于预设的全局非共享资源类型；若待访问资源类型属于全局非共享资源类型，屏蔽资源访问请求；若待访问资源类型不属于全局共享资源类型且不属于全局非共享资源类型，确定资源访问请求声明访问私有资源。
进一步，处理器32还用于：在资源访问请求声明访问私有资源的情况下，将资源访问请求和私有资源域标识发送给目标服务集群中的资源管控节点，以指示资源管控节点转发给目标服务集群中的服务节点。
可选地，处理器32在通过通信组件33将资源访问请求和私有资源域标识发送给目标服务集群中的资源管控节点时，具体用于：通过通信组件33将资源访问请求和私有资源域标识发送至目标服务集群中的资源管控节点上的共享资源访问接口。相应地，处理器32在通过通信组件33将资源访问请求和私有资源域标识发送给目标服务集群中的资源管控节点时，具体用于：通过通信组件33将资源访问请求和私有资源域标识发送至目标服务集群中的资源管控节点上的私有资源访问接口。
进一步，如图3所示，该节点设备还包括：显示器34、电源组件35、音频组件36等其它组件。图3中仅示意性给出部分组件，并不意味着节点设备只包括图3所示组件。另外，根据节点设备实现形态的不同，图3中带虚线框的组件为可选组件，而非必选组件。
相应地，本申请实施例还提供一种存储有计算机程序的计算机可读存储介质，计算机程序被执行时能够实现上述方法实施例中可由主控节点执行的各步骤。
图4为本申请示例性实施例提供的另一种节点设备的结构示意图。该节点设备可作为前述实施例中的资源管控节点实现，如图4所示，该节点设备包括：存储器41、处理器42以及通信组件43。
存储器41，用于存储计算机程序，并可被配置为存储其它各种数据以支持在节点设备上的操作。这些数据的示例包括用于在节点设备上操作的任何应用程序或方法的指令，联系人数据，电话簿数据，消息，图片，视频等。
处理器42，与存储器41耦合，用于执行存储器41中的计算机程序，以用于：
通过通信组件43接收主控节点在确定目标服务集群需要访问全局共享资源的情况下发送的目标服务集群对应的私有资源域标识；
根据目标服务集群对应的私有资源域标识，确定目标服务集群具有访问权限的目标共享资源；
通知目标服务集群中的服务节点对目标共享资源进行资源访问；
其中，目标服务集群是主控节点所在无服务器serverless的网络系统中任一服务集群，资源管控节点属于目标服务集群。
在一可选实施例中，处理器42还用于：通过通信组件43接收主控节点发送的来自目标服务集群的资源访问请求，资源访问请求中携带有待访问资源类型。基于此，处理器42在确定目标服务集群具有访问权限的目标共享资源时，具体用于：根据目标服务集群对应的私有资源域标识和待访问资源类型，在所维护的目标服务集群对应的私有资源域标识与至少一种候选全局共享资源类型下的共享资源标签的对应关系中进行匹配，以得到目标共享资源标签；其中，目标共享资源标识目标共享资源。
在一可选实施例中，处理器42在通知目标服务集群中的服务节点对目标共享资源进行资源访问时，具体用于：通过通信组件43将资源访问请求和目标共享资源标签发送给目标服务集群中的服务节点，以供服务节点对目标共享资源进行资源访问。
在一可选实施例中，处理器42还用于：获取目标服务集群的租户有权限访问的至少一种候选全局共享资源类型，并获取至少一种候选全局共享资源类型下的共享资源；从至少一种候选全局共享资源类型下的共享资源中，分别选定目标服务集群在至少一种候选全局共享资源类型下具有访问权限的共享资源；为目标服务集群在至少一种候选全局共享资源类型下具有访问权限的共享资源分配共享资源标签，建立目标服务集群对应的私有资源域标识与至少一种候选全局共享资源类型下的共享资源标签的对应关系。
在一可选实施例中，处理器42还用于：通过通信组件43将至少一种候选全局共享资源类型下的共享资源标签发送给目标服务集群中的服务节点，以供服务节点在本地维护至少一种候选全局共享资源类型下的共享资源标签与相应共享资源的对应关系。
进一步，如图4所示，该节点设备还包括：显示器44、电源组件45、音频组件46 等其它组件。图4中仅示意性给出部分组件，并不意味着节点设备只包括图4所示组件。另外，根据节点设备实现形态的不同，图4中带虚线框的组件为可选组件，而非必选组件。
相应地，本申请实施例还提供一种存储有计算机程序的计算机可读存储介质，计算机程序被执行时能够实现上述方法实施例中可由主控节点执行的各步骤。
上述图3和图4中的存储器可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，如静态随机存取存储器(SRAM)，电可擦除可编程只读存储器(EEPROM)，可擦除可编程只读存储器(EPROM)，可编程只读存储器(PROM)，只读存储器(ROM)，磁存储器，快闪存储器，磁盘或光盘。
上述图3和图4中的通信组件被配置为便于通信组件所在设备和其他设备之间有线或无线方式的通信。通信组件所在设备可以接入基于通信标准的无线网络，如WiFi，2G或3G，或它们的组合。在一个示例性实施例中，通信组件经由广播信道接收来自外部广播管理系统的广播信号或广播相关信息。在一个示例性实施例中，所述通信组件还可以包括近场通信(NFC)模块，射频识别(RFID)技术，红外数据协会(IrDA)技术，超宽带(UWB)技术，蓝牙(BT)技术等。
上述图3和图4中的显示器包括屏幕，其屏幕可以包括液晶显示器(LCD)和触摸面板(TP)。如果屏幕包括触摸面板，屏幕可以被实现为触摸屏，以接收来自用户的输入信号。触摸面板包括一个或多个触摸传感器以感测触摸、滑动和触摸面板上的手势。所述触摸传感器可以不仅感测触摸或滑动动作的边界，而且还检测与所述触摸或滑动操作相关的持续时间和压力。
上述图3和图4中的电源组件，为电源组件所在设备的各种组件提供电力。电源组件可以包括电源管理系统，一个或多个电源，及其他与为电源组件所在设备生成、管理和分配电力相关联的组件。
上述图3和图4中的音频组件，可被配置为输出和/或输入音频信号。例如，音频组件包括一个麦克风(MIC)，当音频组件所在设备处于操作模式，如呼叫模式、记录模式和语音识别模式时，麦克风被配置为接收外部音频信号。所接收的音频信号可以被进一步存储在存储器或经由通信组件发送。在一些实施例中，音频组件还包括一个扬声器，用于输出音频信号。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面 的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计 算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
以上所述仅为本申请的实施例而已，并不用于限制本申请。对于本领域技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的权利要求范围之内。

Claims (28)

  1. 一种无服务器serverless的网络系统，其特征在于，包括：主控节点、多个租户部署的serverless的服务集群以及可供所述多个租户共享的至少一种类型的全局共享资源；每个服务集群包括资源管控节点和服务节点；
    所述主控节点，用于在目标服务集群需要访问全局共享资源的情况下，为所述目标服务集群中的资源管控节点提供所述目标服务集群对应的私有资源域标识；其中，所述目标服务集群是任一服务集群；
    所述资源管控节点，用于在属于所述目标服务集群的情况下，根据所述目标服务集群对应的私有资源域标识确定所述目标服务集群具有访问权限的目标共享资源，并通知所述目标服务集群中的服务节点对所述目标共享资源进行资源访问。
  2. 根据权利要求1所述的网络系统，其特征在于，所述主控节点具体用于：
    接收所述目标服务集群的资源访问请求，根据所述资源访问请求获取所述目标服务集群对应的私有资源域标识，并在所述资源访问请求声明访问全局共享资源的情况下，将所述资源访问请求和所述私有资源域标识发送给所述目标服务集群中的资源管控节点，以指示所述资源管控节点为所述目标服务集群确定所述目标共享资源。
  3. 根据权利要求2所述的网络系统，其特征在于，所述主控节点具体用于：
    根据所述资源访问请求中携带的所述目标服务集群的标识，在预先存储的服务集群标识与私有资源域标识的对应关系中进行匹配，以得到所述目标服务集群对应的私有资源域标识。
  4. 根据权利要求2所述的网络系统，其特征在于，所述主控节点还用于：
    判断所述资源访问请求中携带的待访问资源类型是否属于预设的全局共享资源类型；
    若所述待访问资源类型属于全局共享资源类型，确定所述资源访问请求声明访问全局共享资源。
  5. 根据权利要求4所述的网络系统，其特征在于，所述主控节点还用于：
    判断所述待访问资源类型是否属于预设的全局非共享资源类型；
    若所述待访问资源类型属于全局非共享资源类型，屏蔽所述资源访问请求；
    若所述待访问资源类型不属于全局共享资源类型且不属于全局非共享资源类型，确定所述资源访问请求声明访问私有资源。
  6. 根据权利要求5所述的网络系统，其特征在于，所述主控节点还用于：
    在所述资源访问请求声明访问私有资源的情况下，将所述资源访问请求和所述私有资源域标识发送给所述目标服务集群中的资源管控节点，以指示所述资源管控节点转发给所述目标服务集群中的服务节点。
  7. 根据权利要求6所述的网络系统，其特征在于，所述主控节点具体用于：
    在所述资源访问请求声明访问全局共享资源的情况下，将所述资源访问请求和所述私有资源域标识发送至所述目标服务集群中的资源管控节点上的共享资源访问接口，以指示所述资源管控节点为所述目标服务集群确定所述目标共享资源；
    在所述资源访问请求声明访问私有资源的情况下，将所述资源访问请求和所述私有资源域标识发送至所述目标服务集群中的资源管控节点上的私有资源访问接口，以指示所述资源管控节点转发给所述目标服务集群中的服务节点。
  8. 根据权利要求2-7任一项所述的网络系统，其特征在于，所述资源管控节点具体用于：
    根据所述目标服务集群对应的私有资源域标识和所述资源访问请求中携带的待访问资源类型，在所维护的所述目标服务集群对应的私有资源域标识与至少一种候选全局共享资源类型下的共享资源标签的对应关系中进行匹配，以得到目标共享资源标签；将所述资源访问请求和所述目标共享资源标签发送给所述目标服务集群中的服务节点，以供所述服务节点对所述目标共享资源进行资源访问，所述目标共享资源标签标识所述目标共享资源。
  9. 根据权利要求8所述的网络系统，其特征在于，所述资源管控节点还用于：
    获取所述目标服务集群的租户有权限访问的至少一种候选全局共享资源类型，并获取所述至少一种候选全局共享资源类型下的共享资源信息；
    根据所述至少一种候选全局共享资源类型下的共享资源信息，分别选定所述目标服务集群在所述至少一种候选全局共享资源类型下具有访问权限的共享资源；
    为所述目标服务集群在所述至少一种候选全局共享资源类型下具有访问权限的共享资源分配共享资源标签，建立所述目标服务集群对应的私有资源域标识与所述至少一种候选全局共享资源类型下的共享资源标签的对应关系。
  10. 根据权利要求9所述的网络系统，其特征在于，所述资源管控节点还用于：
    将所述至少一种候选全局共享资源类型下的共享资源标签发送给所述目标服务集群中的服务节点，以供所述服务节点在本地维护所述至少一种候选全局共享资源类型下的共享资源标签与相应共享资源的对应关系。
  11. 根据权利要求9所述的网络系统，其特征在于，所述资源管控节点具体用于：
    向所述目标服务集群中的服务节点发送轮询请求，以供所述服务节点轮询所述至少一种候选全局共享资源类型下的共享资源信息并上报；
    接收所述服务节点上报的所述至少一种候选全局共享资源类型下的共享资源信息。
  12. 一种基于容器编排调度系统实现的边缘云网络系统，其特征在于，包括：部署于服务端设备中的主控节点、多个租户在边缘计算设备中部署的无服务器serverless的容器集群以及可供所述多个租户共享的至少一种类型的云资源；其中，每个容器集群包括资源管控节点和弹性容器实例ECI节点；
    所述主控节点，用于在目标容器集群需要访问可共享的云资源的情况下，为所述目标容器集群中的资源管控节点提供所述目标容器集群对应的命名空间标识；其中，所述目标容器集群是任一容器集群；
    所述资源管控节点，用于在属于所述目标容器集群的情况下，根据所述目标容器集群对应的命名空间标识确定所述目标容器集群具有访问权限的目标共享资源，并通知所述目标容器集群中的ECI节点对所述目标共享资源进行资源访问。
  13. 根据权利要求12所述的网络系统，其特征在于，所述主控节点包括：API代理组件和所述容器编排调度系统中的原生主节点，且由所述API代理组件在目标容器集群需要访问可共享的云资源的情况下，为所述目标容器集群中的资源管控节点提供所述目标容器集群对应的命名空间标识。
  14. 根据权利要求12所述的网络系统，其特征在于，每个容器集群部署在至少一台边缘计算设备上。
  15. 一种资源访问方法，适用于主控节点，其特征在于，所述方法包括：
    接收目标服务集群的资源访问请求，所述目标服务集群是所述主控节点所在无服务器serverless的网络系统中任一服务集群；
    根据所述资源访问请求，获取所述目标服务集群对应的私有资源域标识；
    在所述资源访问请求声明访问全局共享资源的情况下，将所述资源访问请求和所述私有资源域标识发送给所述目标服务集群中的资源管控节点，以指示所述资源管控节点为所述目标服务集群确定目标共享资源。
  16. 根据权利要求15所述的方法，其特征在于，根据所述资源访问请求，获取所述目标服务集群对应的私有资源域标识，包括：
    根据所述资源访问请求中携带的所述目标服务集群的标识，在预先存储的服务集群 标识与私有资源域标识的对应关系中进行匹配，以得到所述目标服务集群对应的私有资源域标识。
  17. 根据权利要求15所述的方法，其特征在于，还包括：
    判断所述资源访问请求中携带的待访问资源类型是否属于预设的全局共享资源类型；
    若所述待访问资源类型属于全局共享资源类型，确定所述资源访问请求声明访问全局共享资源。
  18. 根据权利要求17所述的方法，其特征在于，还包括：
    判断所述待访问资源类型是否属于预设的全局非共享资源类型；
    若所述待访问资源类型属于全局非共享资源类型，屏蔽所述资源访问请求；
    若所述待访问资源类型不属于全局共享资源类型且不属于全局非共享资源类型，确定所述资源访问请求声明访问私有资源。
  19. 根据权利要求18所述的方法，其特征在于，还包括：
    在所述资源访问请求声明访问私有资源的情况下，将所述资源访问请求和所述私有资源域标识发送给所述目标服务集群中的资源管控节点，以指示所述资源管控节点转发给所述目标服务集群中的服务节点。
  20. 根据权利要求19所述的方法，其特征在于，将所述资源访问请求和所述私有资源域标识发送给所述目标服务集群中的资源管控节点，包括：将所述资源访问请求和所述私有资源域标识发送至所述目标服务集群中的资源管控节点上的共享资源访问接口；
    将所述资源访问请求和所述私有资源域标识发送给所述目标服务集群中的资源管控节点，包括：将所述资源访问请求和所述私有资源域标识发送至所述目标服务集群中的资源管控节点上的私有资源访问接口。
  21. 一种资源访问方法，适用于资源管控节点，其特征在于，所述方法包括：
    接收主控节点在确定目标服务集群需要访问全局共享资源的情况下发送的所述目标服务集群对应的私有资源域标识；
    根据所述目标服务集群对应的私有资源域标识，确定所述目标服务集群具有访问权限的目标共享资源；
    通知所述目标服务集群中的服务节点对所述目标共享资源进行资源访问；
    其中，所述目标服务集群是所述主控节点所在无服务器serverless的网络系统中任 一服务集群，所述资源管控节点属于所述目标服务集群。
  22. 根据权利要求21所述的方法，其特征在于，还包括：
    接收所述主控节点发送的来自所述目标服务集群的资源访问请求，所述资源访问请求中携带有待访问资源类型；
    所述根据所述目标服务集群对应的私有资源域标识，确定所述目标服务集群具有访问权限的目标共享资源，包括：
    根据所述目标服务集群对应的私有资源域标识和所述待访问资源类型，在所维护的所述目标服务集群对应的私有资源域标识与至少一种候选全局共享资源类型下的共享资源标签的对应关系中进行匹配，以得到目标共享资源标签；所述目标共享资源标识所述目标共享资源。
  23. 根据权利要求22所述的方法，其特征在于，通知所述目标服务集群中的服务节点对所述目标共享资源进行资源访问，包括：
    将所述资源访问请求和所述目标共享资源标签发送给所述目标服务集群中的服务节点，以供所述服务节点对所述目标共享资源进行资源访问。
  24. 根据权利要求23所述的方法，其特征在于，还包括：
    获取所述目标服务集群的租户有权限访问的至少一种候选全局共享资源类型，并获取所述至少一种候选全局共享资源类型下的共享资源信息；
    根据所述至少一种候选全局共享资源类型下的共享资源信息，分别选定所述目标服务集群在所述至少一种候选全局共享资源类型下具有访问权限的共享资源；
    为所述目标服务集群在所述至少一种候选全局共享资源类型下具有访问权限的共享资源分配共享资源标签，建立所述目标服务集群对应的私有资源域标识与所述至少一种候选全局共享资源类型下的共享资源标签的对应关系。
  25. 根据权利要求24所述的方法，其特征在于，还包括：
    将所述至少一种候选全局共享资源类型下的共享资源标签发送给所述目标服务集群中的服务节点，以供所述服务节点在本地维护所述至少一种候选全局共享资源类型下的共享资源标签与相应共享资源的对应关系。
  26. 一种节点设备，其特征在于，包括：存储器和处理器；所述存储器，用于存储计算机程序；当所述计算机程序被所述处理器执行时，致使所述处理器实现权利要求15-20任一项所述方法中的步骤。
  27. 一种节点设备，其特征在于，包括：存储器和处理器；所述存储器，用于存储 计算机程序；当所述计算机程序被所述处理器执行时，致使所述处理器实现权利要求21-25任一项所述方法中的步骤。
  28. 一种存储有计算机程序的计算机可读存储介质，其特征在于，当所述计算机程序被处理器执行时，致使所述处理器实现权利要求15-25任一项所述方法中的步骤。
PCT/CN2020/091527 2019-05-28 2020-05-21 无服务器架构下的资源访问方法、设备、系统及存储介质 Ceased WO2020238751A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910451596.XA CN112019475B (zh) 2019-05-28 2019-05-28 无服务器架构下的资源访问方法、设备、系统及存储介质
CN201910451596.X 2019-05-28

Publications (1)

Publication Number Publication Date
WO2020238751A1 true WO2020238751A1 (zh) 2020-12-03

Family

ID=73501718

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/091527 Ceased WO2020238751A1 (zh) 2019-05-28 2020-05-21 无服务器架构下的资源访问方法、设备、系统及存储介质

Country Status (2)

Country Link
CN (1) CN112019475B (zh)
WO (1) WO2020238751A1 (zh)

Cited By (29)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112445550A (zh) * 2020-12-08 2021-03-05 中国科学院深圳先进技术研究院 一种预处理函数的无服务器计算方法及其系统
CN113079545A (zh) * 2021-03-29 2021-07-06 维沃移动通信有限公司 网络共享方法、装置及电子设备
CN113162910A (zh) * 2021-03-10 2021-07-23 视联动力信息技术股份有限公司 一种资源传输方法、装置、电子设备及存储介质
CN113283859A (zh) * 2021-05-14 2021-08-20 西安交通大学 一种应用于边缘计算管理的边缘平台系统
CN113590329A (zh) * 2021-08-02 2021-11-02 北京百度网讯科技有限公司 资源处理方法及装置
CN113839995A (zh) * 2021-09-06 2021-12-24 阿里巴巴（中国）有限公司 跨域资源纳管系统、方法、设备及存储介质
CN113835844A (zh) * 2021-09-29 2021-12-24 新华三大数据技术有限公司 一种容器集群的管理方法、装置及云计算平台
CN113923023A (zh) * 2021-10-09 2022-01-11 京东科技信息技术有限公司 权限配置和数据处理的方法、装置、电子设备及介质
CN113986139A (zh) * 2021-10-31 2022-01-28 济南浪潮数据技术有限公司 一种混合存储集群的部署方法、装置、计算机及存储介质
CN114153566A (zh) * 2021-12-20 2022-03-08 浪潮电子信息产业股份有限公司 跨处理器架构多容器集群间服务发现方法、装置及设备
CN114422492A (zh) * 2022-01-17 2022-04-29 星环信息科技(上海)股份有限公司 一种请求转发方法、设备及存储介质
CN114500047A (zh) * 2022-01-26 2022-05-13 烽台科技（北京）有限公司 一种工业网络靶场异构互联的方法及系统
CN114610480A (zh) * 2022-02-09 2022-06-10 阿里巴巴（中国）有限公司 一种弹性资源调度方法、控制设备、装置及可读存储介质
CN114629958A (zh) * 2022-03-15 2022-06-14 北京字节跳动网络技术有限公司 资源分配方法、装置、电子设备及存储介质
CN114826964A (zh) * 2022-04-11 2022-07-29 京东科技信息技术有限公司 一种资源监控方法、装置和系统
CN114827157A (zh) * 2022-04-12 2022-07-29 北京云思智学科技有限公司 集群任务处理方法、装置、系统、电子设备及可读介质
CN114862414A (zh) * 2022-03-31 2022-08-05 中国海洋石油集团有限公司 服务确定方法、装置、电子设备及存储介质
CN114898152A (zh) * 2022-05-13 2022-08-12 电子科技大学 嵌入式弹性自扩展通用学习框架
CN114924781A (zh) * 2022-06-07 2022-08-19 中国工商银行股份有限公司 软件资源的管理方法及其装置、电子设备
CN115016863A (zh) * 2022-06-28 2022-09-06 北京搜狐新媒体信息技术有限公司 一种提升首屏性能的方法及装置
CN115208686A (zh) * 2022-07-29 2022-10-18 济南浪潮数据技术有限公司 一种web控制台及访问集群方法、系统、设备、介质
CN115314354A (zh) * 2022-07-19 2022-11-08 中电通商数字技术(上海)有限公司 一种海量容器集群管理方法及系统
CN115361389A (zh) * 2022-10-20 2022-11-18 阿里巴巴（中国）有限公司 一种云计算实例创建方法及装置
CN115361285A (zh) * 2022-07-05 2022-11-18 海南车智易通信息技术有限公司 实现离在线业务混合部署的方法、装置、设备及介质
CN116258622A (zh) * 2023-02-16 2023-06-13 青软创新科技集团股份有限公司 一种基于容器的gpu分配方法、装置、电子设备和介质
WO2024074196A1 (en) * 2022-10-04 2024-04-11 Telefonaktiebolaget Lm Ericsson (Publ) Methods and apparatus for data sharing for services
CN118550676A (zh) * 2024-07-30 2024-08-27 天津市天河计算机技术有限公司 Hpc集群下的资源调度方法、资源调度系统和存储介质
US12563034B2 (en) 2024-03-13 2026-02-24 Oracle International Corporation Authentication mechanisms in a container orchestration system
WO2026056529A1 (zh) * 2024-09-10 2026-03-19 云智能资产控股（新加坡）私人股份有限公司 分布式服务系统、实例分裂方法、设备、介质及程序产品

Families Citing this family (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113301102A (zh) * 2021-02-03 2021-08-24 阿里巴巴集团控股有限公司 资源调度方法、设备、边缘云网络、程序产品及存储介质
CN115914218B (zh) * 2021-08-09 2025-08-26 中移(苏州)软件技术有限公司 一种平台接入服务中心的方法、装置及设备
CN113934512A (zh) * 2021-10-21 2022-01-14 平安国际智慧城市科技股份有限公司 负载均衡实现方法、装置、设备及存储介质
CN114143315B (zh) * 2021-11-30 2024-08-02 阿里巴巴（中国）有限公司 边缘云系统、主机访问方法及设备
CN114726854B (zh) * 2021-12-27 2024-06-07 天翼云科技有限公司 一种服务请求的处理方法、装置及云服务系统
CN114462016B (zh) * 2022-02-08 2026-01-23 远景智能国际私人投资有限公司 资源请求方法、装置及系统
CN114615268B (zh) * 2022-03-28 2023-09-12 阿里巴巴（中国）有限公司 基于Kubernetes集群的服务网络、监控节点、容器节点及设备
CN115086234B (zh) * 2022-05-09 2024-04-26 阿里巴巴（中国）有限公司 消息处理方法及系统、设备及存储介质
CN115442129B (zh) * 2022-09-01 2025-04-15 京东科技信息技术有限公司 一种管理集群访问权限的方法、装置和系统
CN115509549B (zh) * 2022-11-23 2023-03-24 中国电子信息产业集团有限公司 一种数据元件加工处理方法及计算机可读存储介质
CN118400114A (zh) * 2023-01-19 2024-07-26 华为云计算技术有限公司 基于公有云技术的资源共享管理方法及云管理平台
CN117453380B (zh) * 2023-12-25 2024-02-23 阿里云计算有限公司 集群的容器组调度方法、系统以及计算机设备
CN120378489A (zh) * 2024-01-25 2025-07-25 杭州阿里云飞天信息技术有限公司 一种服务方法、设备、存储介质及计算机程序产品
CN119420741B (zh) * 2024-10-21 2025-10-28 浙江大学 一种在大规模场景下高效调度Serverless函数计算任务的调度系统
CN120343030B (zh) * 2025-04-28 2026-04-10 阿里云计算有限公司 云计算服务系统、云计算服务提供方法、存储介质及产品

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170060642A1 (en) * 2015-08-28 2017-03-02 Vmware, Inc. Constrained placement in hierarchical randomized schedulers
CN106933648A (zh) * 2015-12-31 2017-07-07 中国电信股份有限公司 用于多租户容器资源管理的方法和系统
US20180314556A1 (en) * 2017-04-28 2018-11-01 Databricks Inc. Serverless execution of code using cluster resources
CN109376009A (zh) * 2018-09-26 2019-02-22 郑州云海信息技术有限公司 一种共享资源的方法及装置
CN109743199A (zh) * 2018-12-25 2019-05-10 中国联合网络通信集团有限公司 基于微服务的容器化管理系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9438506B2 (en) * 2013-12-11 2016-09-06 Amazon Technologies, Inc. Identity and access management-based access control in virtual networks
US10303582B2 (en) * 2016-10-25 2019-05-28 International Business Machines Corporation Facilitating debugging serverless applications via graph rewriting
CN107864131A (zh) * 2017-11-03 2018-03-30 郑州云海信息技术有限公司 一种实现Kubernetes集群多租户网络隔离的方法及系统
WO2019090523A1 (zh) * 2017-11-08 2019-05-16 华为技术有限公司 一种无服务器架构下业务部署的方法和函数管理平台
CN109067827B (zh) * 2018-06-22 2021-12-21 杭州才云科技有限公司 基于Kubernetes和OpenStack容器云平台多租户构建方法、介质、设备
CN109189568A (zh) * 2018-09-04 2019-01-11 山东浪潮云投信息科技有限公司 一种集群资源管理方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170060642A1 (en) * 2015-08-28 2017-03-02 Vmware, Inc. Constrained placement in hierarchical randomized schedulers
CN106933648A (zh) * 2015-12-31 2017-07-07 中国电信股份有限公司 用于多租户容器资源管理的方法和系统
US20180314556A1 (en) * 2017-04-28 2018-11-01 Databricks Inc. Serverless execution of code using cluster resources
CN109376009A (zh) * 2018-09-26 2019-02-22 郑州云海信息技术有限公司 一种共享资源的方法及装置
CN109743199A (zh) * 2018-12-25 2019-05-10 中国联合网络通信集团有限公司 基于微服务的容器化管理系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
BILA, NILTON ET AL.: "Leveraging the Serverless Architecture for Securing Linux Containers", 2017 IEEE 37TH INTERNATIONAL CONFERENCE ON DISTRIBUTED COMPUTING SYSTEMS WORKSHOPS, 31 December 2017 (2017-12-31), XP033122913, DOI: 20200810104059A *

Cited By (42)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112445550A (zh) * 2020-12-08 2021-03-05 中国科学院深圳先进技术研究院 一种预处理函数的无服务器计算方法及其系统
CN112445550B (zh) * 2020-12-08 2024-05-17 中国科学院深圳先进技术研究院 一种预处理函数的无服务器计算方法及其系统
CN113162910A (zh) * 2021-03-10 2021-07-23 视联动力信息技术股份有限公司 一种资源传输方法、装置、电子设备及存储介质
CN113162910B (zh) * 2021-03-10 2024-04-09 视联动力信息技术股份有限公司 一种资源传输方法、装置、电子设备及存储介质
CN113079545A (zh) * 2021-03-29 2021-07-06 维沃移动通信有限公司 网络共享方法、装置及电子设备
CN113079545B (zh) * 2021-03-29 2023-08-25 维沃移动通信有限公司 网络共享方法、装置及电子设备
CN113283859A (zh) * 2021-05-14 2021-08-20 西安交通大学 一种应用于边缘计算管理的边缘平台系统
CN113590329A (zh) * 2021-08-02 2021-11-02 北京百度网讯科技有限公司 资源处理方法及装置
CN113839995A (zh) * 2021-09-06 2021-12-24 阿里巴巴（中国）有限公司 跨域资源纳管系统、方法、设备及存储介质
CN113835844B (zh) * 2021-09-29 2024-05-24 新华三大数据技术有限公司 一种容器集群的管理方法、装置及云计算平台
CN113835844A (zh) * 2021-09-29 2021-12-24 新华三大数据技术有限公司 一种容器集群的管理方法、装置及云计算平台
CN113923023A (zh) * 2021-10-09 2022-01-11 京东科技信息技术有限公司 权限配置和数据处理的方法、装置、电子设备及介质
CN113923023B (zh) * 2021-10-09 2024-04-05 京东科技信息技术有限公司 权限配置和数据处理的方法、装置、电子设备及介质
CN113986139A (zh) * 2021-10-31 2022-01-28 济南浪潮数据技术有限公司 一种混合存储集群的部署方法、装置、计算机及存储介质
CN113986139B (zh) * 2021-10-31 2024-02-13 济南浪潮数据技术有限公司 一种混合存储集群的部署方法、装置、计算机及存储介质
CN114153566A (zh) * 2021-12-20 2022-03-08 浪潮电子信息产业股份有限公司 跨处理器架构多容器集群间服务发现方法、装置及设备
CN114422492A (zh) * 2022-01-17 2022-04-29 星环信息科技(上海)股份有限公司 一种请求转发方法、设备及存储介质
CN114422492B (zh) * 2022-01-17 2023-12-12 星环信息科技(上海)股份有限公司 一种请求转发方法、设备及存储介质
CN114500047B (zh) * 2022-01-26 2023-06-27 烽台科技（北京）有限公司 一种工业网络靶场异构互联的方法及系统
CN114500047A (zh) * 2022-01-26 2022-05-13 烽台科技（北京）有限公司 一种工业网络靶场异构互联的方法及系统
CN114610480A (zh) * 2022-02-09 2022-06-10 阿里巴巴（中国）有限公司 一种弹性资源调度方法、控制设备、装置及可读存储介质
CN114629958A (zh) * 2022-03-15 2022-06-14 北京字节跳动网络技术有限公司 资源分配方法、装置、电子设备及存储介质
CN114629958B (zh) * 2022-03-15 2024-01-30 抖音视界有限公司 资源分配方法、装置、电子设备及存储介质
CN114862414A (zh) * 2022-03-31 2022-08-05 中国海洋石油集团有限公司 服务确定方法、装置、电子设备及存储介质
CN114826964A (zh) * 2022-04-11 2022-07-29 京东科技信息技术有限公司 一种资源监控方法、装置和系统
CN114826964B (zh) * 2022-04-11 2024-04-05 京东科技信息技术有限公司 一种资源监控方法、装置和系统
CN114827157A (zh) * 2022-04-12 2022-07-29 北京云思智学科技有限公司 集群任务处理方法、装置、系统、电子设备及可读介质
CN114898152A (zh) * 2022-05-13 2022-08-12 电子科技大学 嵌入式弹性自扩展通用学习框架
CN114898152B (zh) * 2022-05-13 2023-05-30 电子科技大学 嵌入式弹性自扩展通用学习系统
CN114924781A (zh) * 2022-06-07 2022-08-19 中国工商银行股份有限公司 软件资源的管理方法及其装置、电子设备
CN115016863A (zh) * 2022-06-28 2022-09-06 北京搜狐新媒体信息技术有限公司 一种提升首屏性能的方法及装置
CN115361285A (zh) * 2022-07-05 2022-11-18 海南车智易通信息技术有限公司 实现离在线业务混合部署的方法、装置、设备及介质
CN115361285B (zh) * 2022-07-05 2024-02-23 海南车智易通信息技术有限公司 实现离在线业务混合部署的方法、装置、设备及介质
CN115314354A (zh) * 2022-07-19 2022-11-08 中电通商数字技术(上海)有限公司 一种海量容器集群管理方法及系统
CN115208686A (zh) * 2022-07-29 2022-10-18 济南浪潮数据技术有限公司 一种web控制台及访问集群方法、系统、设备、介质
WO2024074196A1 (en) * 2022-10-04 2024-04-11 Telefonaktiebolaget Lm Ericsson (Publ) Methods and apparatus for data sharing for services
CN115361389A (zh) * 2022-10-20 2022-11-18 阿里巴巴（中国）有限公司 一种云计算实例创建方法及装置
WO2024082930A1 (zh) * 2022-10-20 2024-04-25 杭州阿里云飞天信息技术有限公司 一种云计算实例创建方法及装置
CN116258622A (zh) * 2023-02-16 2023-06-13 青软创新科技集团股份有限公司 一种基于容器的gpu分配方法、装置、电子设备和介质
US12563034B2 (en) 2024-03-13 2026-02-24 Oracle International Corporation Authentication mechanisms in a container orchestration system
CN118550676A (zh) * 2024-07-30 2024-08-27 天津市天河计算机技术有限公司 Hpc集群下的资源调度方法、资源调度系统和存储介质
WO2026056529A1 (zh) * 2024-09-10 2026-03-19 云智能资产控股（新加坡）私人股份有限公司 分布式服务系统、实例分裂方法、设备、介质及程序产品

Also Published As

Publication number Publication date
CN112019475A (zh) 2020-12-01
CN112019475B (zh) 2021-12-21

Similar Documents

Publication Publication Date Title
CN112019475B (zh) 无服务器架构下的资源访问方法、设备、系统及存储介质
US10992535B2 (en) Hybrid cloud integration fabric and ontology for integration of data, applications, and information technology infrastructure
US10560345B2 (en) Consistent placement between private and public cloud deployments of application services
KR102209276B1 (ko) 메시징 프로토콜 통신 관리
US20190089588A1 (en) Network function instance management method and related device
US10455028B2 (en) Allocating edge services with large-scale processing framework clusters
EP3913859B1 (en) Vnf life cycle management method and apparatus
US9130943B1 (en) Managing communications between client applications and application resources of on-premises and cloud computing nodes
US20130007737A1 (en) Method and architecture for virtual desktop service
US12106253B2 (en) Container management method, apparatus, and device
US9021478B1 (en) Provisioning virtual machines from template by splitting and building index for locating content portions via content-centric network
US20160246626A1 (en) Resource reconciliation in a virtualized computer system
CN113691575A (zh) 通信方法、装置及系统
US20230195695A1 (en) File Sharing Method and Terminal Device
CN105103125B (zh) 时钟中断信号的获取方法和nfv装置
CN112015524A (zh) 工作流部署方法、设备、系统及存储介质
CN116405567A (zh) 用户资源管理方法、系统、设备及存储介质
WO2024251107A1 (zh) 容器编排与数据访问方法、电子设备及存储介质
EP4304154B1 (en) INFORMATION PROCESSING DEVICE, INFORMATION PROCESSING METHOD, PROGRAM, AND INFORMATION PROCESSING SYSTEM
US11853560B2 (en) Conditional role decision based on source environments
CN117435608A (zh) 多集群的数据查询方法、装置、设备和存储介质
US12244672B2 (en) Cloud data ingestion system
KR101495562B1 (ko) 데이터 분석 서비스를 제공하기 위한 장치 및 그 방법
US11907075B2 (en) Method and system for continuous mapping of protection policies to data cluster components
US20230161603A1 (en) Handling the running of software

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20813555

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20813555

Country of ref document: EP

Kind code of ref document: A1