WO2022247359A1 - 集群访问方法、装置、电子设备和介质 - Google Patents

集群访问方法、装置、电子设备和介质 Download PDF

Info

Publication number
WO2022247359A1
WO2022247359A1 PCT/CN2022/076922 CN2022076922W WO2022247359A1 WO 2022247359 A1 WO2022247359 A1 WO 2022247359A1 CN 2022076922 W CN2022076922 W CN 2022076922W WO 2022247359 A1 WO2022247359 A1 WO 2022247359A1
Authority
WO
WIPO (PCT)
Prior art keywords
client
cluster
access
current
standard
Prior art date
Application number
PCT/CN2022/076922
Other languages
English (en)
French (fr)
Inventor
林战波
Original Assignee
北京百度网讯科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京百度网讯科技有限公司 filed Critical 北京百度网讯科技有限公司
Priority to EP22757466.2A priority Critical patent/EP4120109A1/en
Priority to KR1020227029834A priority patent/KR20220160549A/ko
Priority to JP2022552283A priority patent/JP2023530802A/ja
Publication of WO2022247359A1 publication Critical patent/WO2022247359A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/33—User authentication using certificates
    • G06F21/335—User authentication using certificates for accessing specific resources, e.g. using Kerberos tickets
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords

Definitions

  • the present disclosure relates to the field of computer technology, to the field of container technology, cloud computing and cloud service technology, for example, to a cluster access method, device, electronic equipment and media.
  • the mainstream communication method is to centrally manage Kubernetes clusters in different regions through cloud service providers.
  • a client Before a client wants to access a Kubernetes cluster, it usually needs to be authenticated by the gateway server of the cluster.
  • the present disclosure provides a method, device, electronic device and medium for establishing a connection between a client and a cluster.
  • a cluster access method including:
  • a cluster access simulation request is sent to the gateway server of the target cluster to establish a connection between the client and the target cluster; wherein, the cluster access simulation request is based on user simulation technology obtained by performing simulation on the client side.
  • a cluster access device including:
  • the authentication module is configured to obtain the current client port code from the cluster access request sent by the client, and authenticate the client according to the current client port code;
  • the communication connection module is configured to send a cluster access simulation request to the gateway server of the target cluster to establish a connection between the client and the target cluster when the authentication is passed; wherein, the cluster access simulation request It is obtained by simulating the client based on the user simulation technology.
  • an electronic device including:
  • the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor, so that the at least one processor can execute the above cluster access method.
  • a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause the computer to execute the above cluster access method.
  • a computer program product including a computer program, the computer program implements the above-mentioned cluster access method when executed by a processor.
  • FIG. 1 is a flow chart of a cluster access method disclosed according to an embodiment of the present disclosure
  • Fig. 2 is a flowchart of another cluster access method disclosed according to an embodiment of the present disclosure
  • Fig. 3 is a schematic structural diagram of a cluster access device disclosed according to an embodiment of the present disclosure.
  • Fig. 4 is a block diagram of an electronic device used to implement the cluster access method disclosed in the embodiment of the present disclosure.
  • the client directly sends a cluster access request to the gateway server of the target cluster, and the gateway server authenticates the client through the OpenID Connect scheme.
  • the gateway server does not enable support for the OpenID Connect solution, so you need to configure the parameters of the OpenID Connect solution on the gateway server first to enable it.
  • Fig. 1 is a flow chart of a cluster access method disclosed according to an embodiment of the present disclosure, and this embodiment may be applicable to the case of establishing a connection between a client and a cluster.
  • the method in this embodiment can be executed by the cluster access device disclosed in the embodiment of the present disclosure, the device can be implemented by software and/or hardware, and can be integrated on any electronic device with computing capability.
  • the cluster access method disclosed in this embodiment may include:
  • S101 Acquire a current client token from a cluster access request sent by a client, and authenticate the client according to the current client token.
  • the client means the client device used by the user who wants to access the target cluster, which may be software installed in the smart device, or a web browser.
  • This embodiment does not limit the form of the client.
  • a cluster represents a collection of devices that implement the same service function.
  • the cluster in this embodiment may optionally include a Kubernetes cluster, that is, a group of node computers running containerized applications.
  • the client sends a cluster access request for the target cluster to the proxy server through address information previously exposed by the proxy server, such as a Uniform Resource Locator (Uniform Resource Locator, URL) address.
  • the proxy server parses the cluster access request to determine whether the cluster access request contains the current client port password. If the cluster access request does not contain the current client token, the proxy server immediately rejects the client’s access to the target cluster; if the cluster access request contains the current client token, the proxy server determines the validity period of the current client token, and then Determine if the current client token has expired.
  • Uniform Resource Locator Uniform Resource Locator
  • the proxy server rejects the client’s access to the target cluster; if the current client port token has not expired, the proxy server authenticates the client according to the current client port token.
  • Authentication methods include but are not limited to At least one of the following implementations:
  • the client encrypts the current client token with a private key, generates a cluster access request based on the encrypted current client token and sends it to the proxy server, and the proxy server uses the public key to encrypt the encrypted current client token.
  • Decryption if the current client port token obtained by decryption is the same as the standard client port code issued to the client in advance, then the authentication of the client side is passed.
  • the client uses its own standard client ID as an interference code to encrypt the current client port order, and generates a cluster access request according to the encrypted current client port order and sends it to the proxy server.
  • the terminal identifier decrypts the encrypted current client port token, and if the decryption is successful, the authentication of the client is passed.
  • the client authorizes the proxy server to obtain the standard client information of the client, and the proxy server generates a standard client port token according to the standard client information and returns it to the client.
  • the client sends the cluster access request carrying the current client port token to the proxy server, and the proxy server parses the current client port token to obtain the current client information, and compares the current client information with the standard client information. If successful, the client authentication is passed.
  • This embodiment does not limit the implementation manner of authenticating the client based on the current client port token, and any identity authentication method based on the client port token falls within the scope of protection of this embodiment.
  • the authentication of the client based on the proxy server is realized, and the security of the client accessing the cluster is guaranteed.
  • the client is simulated using user simulation technology to generate a cluster access simulation request from the client to the target cluster, wherein the user simulation technology is User Impersonation technology, It is a technique for one user to simulate another user to perform related operations.
  • the proxy server simulates the client to send a cluster access request to the gateway server of the target cluster.
  • the proxy server sends the generated cluster access simulation request to the gateway server of the target cluster.
  • the cluster access simulation request is obtained by simulating the client based on user simulation technology, from the perspective of the gateway server side, it is equivalent to
  • the real client sends a cluster access request to the gateway server, so that the gateway server responds to the cluster access simulation request and exposes an externally accessible designated port to the client, so that the client can access the target cluster based on the designated port.
  • This disclosure obtains the current client token from the cluster access request sent by the client, and authenticates the client according to the current client token, so that the client authentication process is executed on the proxy server instead of on the gateway server. , avoiding the problem of client authentication by the gateway server in the related technology, which intrudes into the gateway server, resulting in security risks in the cluster, and improves the security of the cluster; simulates the client to serve the gateway through the proxy server based on user simulation technology
  • the client sends a cluster access request, which ensures that even the cluster access simulation request sent by the proxy server itself can also achieve the effect of establishing a connection between the client and the cluster, so that the client can access the target cluster smoothly.
  • the permission information to be updated of the target cluster is determined; according to the permission information to be updated, the target cluster is controlled to update the permission information.
  • Permission information indicates the relevant attribute information of cluster permissions, including but not limited to permission rules and authorized person information.
  • Permission rules define the content of permissions in the cluster, such as "access A namespace” permission or “modify A namespace” permission etc.
  • the authorized person information indicates the object to which any permission rule applies, for example, if permission rule A is given to user A, then user A is the authorized person of permission rule A.
  • the proxy server communicates with multiple managed clusters, the user configures the permission information of the target cluster in the corresponding front end of the proxy server, and the proxy server responds to the user's permission configuration on the front end Operation, determine the permission information to be updated of the target cluster, and control the managed target cluster to update the current permission information to the permission information to be updated.
  • the user configures the permission information of the target Kubernetes cluster on the corresponding front end of the proxy server, including but not limited to “Role” configuration, “ClusterRole” configuration, “Rolebinding” configuration, and “Cluster Rolebinding” configuration, etc., where “Role” means any Permission rules for a namespace in a Kubernetes cluster, “ClusterRole” indicates the permission rules of any Kubernetes cluster itself, “Rolebinding” indicates the authorized person information corresponding to any “Role” in any Kubernetes cluster, “Cluster Rolebinding” Indicates the authorized person information of any “ClusterRole” in any Kubernetes cluster.
  • the proxy server determines at least one permission information among the updated "Role”, “ClusterRole”, “Rolebinding” and “Cluster Rolebinding” according to the user's permission configuration operation, and controls the target Kubernetes cluster to update the permission information accordingly . For example, if the user configures the "Role” of the target Kubernetes cluster on the front end, the proxy server will correspondingly update the configured "Role” to the target Kubernetes cluster synchronously.
  • the permission information to be updated of the target cluster is determined, and the target cluster is controlled to update the permission information according to the permission information to be updated, so that the unified management of the cluster permission information based on the proxy server is realized, and the improvement is improved.
  • Efficiency of cluster authority information management is improved.
  • Fig. 2 is a flow chart of another cluster access method disclosed according to an embodiment of the present disclosure, which is extended based on the above technical solution and can be combined with the above optional implementation.
  • the cluster access method disclosed in this embodiment may include:
  • S201 Acquire standard client information of the client according to an access configuration file acquisition request sent by the client.
  • An access configuration file is a certificate required for a client to access a cluster, and each client needs to access a cluster based on an access configuration file. To access the configuration file, the client needs to apply to the authoritative party to obtain it.
  • Standard client information refers to some private information of the client, such as client name and client status.
  • the client sends an access configuration file acquisition request to the proxy server according to the address information exposed by the proxy server.
  • the proxy server obtains the request according to the access configuration file, applies to the client to obtain the standard client information, and obtains the standard client information of the client under the authorization of the client.
  • this embodiment provides an implementation manner of S201 in a real scene.
  • the user logs in the browser, and enters the address information of the proxy server in the browser to send the proxy server a request for obtaining the access configuration file.
  • the proxy server forwards the access configuration file acquisition request to the identity service component, and the identity service component controls the browser to jump to display personal information authorization according to the preset authorization protocol, such as the Open Authorization 2.0 (OAuth2.0) protocol, etc. interface.
  • OAuth2.0 Open Authorization 2.0
  • the user performs personal information authorization operations in the personal information authorization interface of the browser, including but not limited to authorization based on account password, authorization based on QR code or authorization based on verification code, etc.
  • the identity service component obtains the user's personal information from the third-party server associated with the browser.
  • standard client information is encoded using preset encoding techniques, such as Base64 encoding, to generate payload information; standard client port token type information and signature algorithm information are also encoded using encoding techniques to generate header information. internal information; use signature algorithm to encrypt payload information and header information to generate signature information; finally generate standard client port token according to header information, payload information and signature information.
  • a standard access profile including the standard client token is generated based on the standard client token.
  • the proxy server feeds back the generated standard access configuration file to the client, so that the client subsequently performs cluster access through a cluster access request including the standard access configuration file.
  • the client sends the current access configuration file including the current client password to the proxy server, and the proxy server parses the current access configuration file and extracts the current client password from the preset field area.
  • the current access configuration file in the cluster access request is not necessarily the standard access configuration file obtained by the client in S203. Therefore, the proxy server needs to check the current access configuration file in the cluster access request.
  • the access configuration file is parsed and verified to ensure that the client is accessing the cluster through a cluster access request that includes a standard access configuration file.
  • S205 Determine current client information of the client according to the current client port order, and authenticate the client according to the current client information.
  • the proxy server after the proxy server obtains the current client password, it first decodes the payload information part of the current client password to obtain the password expiration time, and determines whether the current client password is expired based on the current time and the password expiration time, If the current client token has not expired, take out the payload information and header information in the current client token, calculate the signature information again, and compare the calculated signature information with the signature information in the current client token. If the signature information of the payload is consistent with the signature information in the current client port order, then the payload information is decoded to obtain the current client information. Then, the client is authenticated according to the current client information.
  • the authentication methods include but are not limited to: 1) comparing the current client information with the standard client information, and if the current client information is consistent with the standard client information, then determine the client The terminal is legal, that is, the authentication of the client is passed. 2) Obtain the client status corresponding to the current client information from the third-party server through the data interface, and authenticate the client according to the client status. For example, if it is determined that the client status is abnormal, the authentication of the client will not pass.
  • the proxy server determines the target cluster according to the target cluster identifier included in the cluster access request.
  • multiple clients send their respective cluster access requests to the proxy server, so each client adds a target cluster ID to the cluster access request, so that the proxy server determines each The target cluster corresponding to a cluster access request.
  • S207 Determine whether the target cluster is in an abnormal state; wherein, the abnormal state includes at least one of a disconnection abnormal state and a health value abnormal state, and when the target cluster is not in an abnormal state, send it to the gateway server of the target cluster Cluster access simulation request.
  • the abnormal state of disconnection indicates that the cluster is disconnected from the gateway server.
  • the abnormal state of the health value indicates that some indicator data of the cluster are abnormal, such as the central processing unit (Central Processing Unit, CPU) usage rate is too high or the remaining available memory is too high. Wait a minute.
  • CPU Central Processing Unit
  • the proxy server regularly checks the connection status and health value of each cluster through List-watch, and if it is determined that the target cluster is in an abnormal state, it stops sending cluster access simulation requests to the gateway server of the target cluster . If the target cluster is not in an abnormal state, a cluster access simulation request is sent to the gateway server of the target cluster. The gateway server establishes a connection with the client according to the received cluster access simulation request.
  • This disclosure obtains the standard client information of the client by obtaining the request according to the access configuration file sent by the client, generates a standard client port token according to the standard client information, and generates a standard access configuration file according to the standard client port code, and converts the standard access configuration file Send it to the client, laying the foundation for the subsequent client to access the target cluster according to the standard access configuration file, and ensure the smooth progress of the cluster access; obtain the current access configuration file of the client from the cluster access request, and update the current access configuration file Analyze and determine the current client port order, which lays the foundation for subsequent authentication of the client according to the current client port order; by determining the current client information of the client according to the current client port order, and authenticating the client based on the current client information, The effect of authenticating the client is realized, which improves the security of cluster access; by determining the target cluster according to the cluster access request, the effect of determining the target cluster that each client wants to access is realized, and it is used for subsequent sending to the target cluster.
  • the cluster access simulation request lays the foundation; by determining whether the target cluster is in an abnormal state; wherein, the abnormal state includes at least one of a disconnection abnormal state and a health value abnormal state, and when the target cluster is not in an abnormal state, send to The gateway server of the target cluster sends a cluster access simulation request, which ensures that the target cluster can be accessed normally and avoids the problem that the client cannot access the target cluster.
  • the acquisition, storage and application of the user's personal information involved are in compliance with relevant laws and regulations, and do not violate public order and good customs.
  • Fig. 3 is a schematic structural diagram of a cluster access device disclosed according to an embodiment of the present disclosure, which may be applicable to the case of establishing a connection between a client and a cluster.
  • the apparatus in this embodiment can be implemented by software and/or hardware, and can be integrated on any electronic device with computing capability.
  • the cluster access device 30 disclosed in this embodiment may include an authentication module 31 and a communication connection module 32, wherein:
  • the authentication module 31 is configured to obtain the current client token from the cluster access request sent by the client, and authenticates the client according to the current client token;
  • the communication connection module 32 is configured to pass the authentication , sending a cluster access simulation request to the gateway server of the target cluster to establish a connection between the client and the target cluster; wherein, the cluster access simulation request simulates the client based on user simulation technology owned.
  • the device also includes a target cluster determination module, which is set to:
  • the authentication module 31 is configured to obtain the current client password from the cluster access request sent by the client in the following manner:
  • the device also includes an access configuration file sending module, which is set to:
  • the authentication module 31 is configured to authenticate the client according to the client port order in the following manner:
  • the device also includes an abnormal state judging module, which is set to:
  • the communication connection module 32 is configured to send the target cluster to the gateway server in the following manner Sending a cluster access simulation request: when the target cluster is not in an abnormal state, sending the cluster access simulation request to the gateway server of the target cluster.
  • the device also includes a permission information update module, which is set to:
  • the permission information to be updated of the target cluster is determined; according to the permission information to be updated, the target cluster is controlled to update the permission information.
  • the cluster access device 30 disclosed in the embodiment of the present disclosure can execute the cluster access method disclosed in the embodiment of the present disclosure, and has corresponding functional modules and effects for executing the method.
  • the cluster access device 30 disclosed in the embodiment of the present disclosure can execute the cluster access method disclosed in the embodiment of the present disclosure, and has corresponding functional modules and effects for executing the method.
  • the present disclosure also provides an electronic device, a readable storage medium, and a computer program product.
  • FIG. 4 shows a schematic block diagram of an example electronic device 400 that may be used to implement embodiments of the present disclosure.
  • Electronic device 400 is intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other suitable computers.
  • Electronic device 400 may also represent various forms of mobile devices, such as personal digital processing, cellular telephones, smartphones, wearable devices, and other similar computing devices.
  • the components shown herein, their connections and relationships, and their functions, are by way of example only, and are not intended to limit implementations of the disclosure described and/or claimed herein.
  • the device 400 includes a computing unit 401 that can be loaded into a random access memory (Random Access Memory, RAM) according to a computer program stored in a read-only memory (Read-Only Memory, ROM) 402 or from a storage unit 408. ) 403 to perform various appropriate actions and processes. In the RAM 403, various programs and data necessary for the operation of the device 400 can also be stored.
  • the computing unit 401, ROM 402, and RAM 403 are connected to each other through a bus 404.
  • An input/output (Input/Output, I/O) interface 405 is also connected to the bus 404 .
  • the I/O interface 405 includes: an input unit 406, such as a keyboard, a mouse, etc.; an output unit 407, such as various types of displays, speakers, etc.; a storage unit 408, such as a magnetic disk, an optical disk, etc. ; and a communication unit 409, such as a network card, a modem, a wireless communication transceiver, and the like.
  • the communication unit 409 allows the device 400 to exchange information/data with other devices over a computer network such as the Internet and/or various telecommunication networks.
  • Computing unit 401 may be various general-purpose and/or special-purpose processing components having processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a CPU, a graphics processing unit (Graphics Processing Unit, GPU), a variety of dedicated artificial intelligence (Artificial Intelligence, AI) computing chips, a variety of computing units that run machine learning model algorithms, digital Signal processor (Digital Signal Processing, DSP), and any suitable processor, controller, microcontroller, etc.
  • the calculation unit 401 executes the methods and processes described above, such as the cluster access method.
  • the cluster access method may be implemented as a computer software program tangibly embodied on a machine-readable medium, such as storage unit 408 .
  • part or all of the computer program may be loaded and/or installed on the device 400 via the ROM 402 and/or the communication unit 409.
  • the computer program When the computer program is loaded into RAM 403 and executed by computing unit 401, one or more steps of the cluster access method described above may be performed.
  • the computing unit 401 may be configured in any other suitable way (for example, by means of firmware) to execute the cluster access method.
  • Various embodiments may include being implemented in one or more computer programs executable and/or interpretable on a programmable system including at least one programmable processor that can is a special-purpose or general-purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.
  • a programmable processor that can is a special-purpose or general-purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.
  • Program codes for implementing the methods of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special purpose computer, or other programmable data processing devices, so that the program codes, when executed by the processor or controller, make the functions/functions specified in the flow diagrams and/or block diagrams Action is implemented.
  • the program code may execute entirely on the machine, partly on the machine, as a stand-alone software package partly on the machine and partly on a remote machine or entirely on the remote machine or server.
  • a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device.
  • a machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium.
  • a machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing.
  • machine-readable storage media examples include one or more wire-based electrical connections, portable computer disks, hard disks, RAM, ROM, Erasable Programmable Read-Only Memory (Erasable Programmable Read-Only Memory, EPROM, or Flash memory) ), fiber optics, Compact Disc Read-Only Memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.
  • wire-based electrical connections portable computer disks, hard disks, RAM, ROM, Erasable Programmable Read-Only Memory (Erasable Programmable Read-Only Memory, EPROM, or Flash memory)
  • fiber optics Compact Disc Read-Only Memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.
  • CD-ROM Compact Disc Read-Only Memory
  • the systems and techniques described herein can be implemented on a computer having a display device (e.g., a cathode ray tube (CRT) or a liquid crystal display ( Liquid Crystal Display (LCD) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which a user can provide input to the computer.
  • a display device e.g., a cathode ray tube (CRT) or a liquid crystal display ( Liquid Crystal Display (LCD) monitor
  • a keyboard and pointing device e.g., a mouse or trackball
  • Other types of devices may also be configured to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and may be in any form (including Acoustic input, speech input or, tactile input) to receive input from the user.
  • the systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., as a a user computer having a graphical user interface or web browser through which a user can interact with embodiments of the systems and techniques described herein), or including such backend components, middleware components, Or any combination of front-end components in a computing system.
  • the components of the system can be interconnected by any form or medium of digital data communication, eg, a communication network. Examples of communication networks include: Local Area Network (LAN), Wide Area Network (Wide Area Network, WAN), blockchain networks, and the Internet.
  • a computer system may include clients and servers.
  • Clients and servers are generally remote from each other and typically interact through a communication network.
  • the relationship of client and server arises by computer programs running on the respective computers and having a client-server relationship to each other.
  • the server can be a cloud server, also known as cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the problems existing in traditional physical host and virtual private server (Virtual Private Server, VPS) services.
  • VPS Virtual Private Server
  • the defects of difficult management and weak business expansion can also be a server of a distributed system, or a server combined with a blockchain.
  • Steps can be reordered, added, or removed using the various forms of flow shown above.
  • steps described in the present disclosure may be executed in parallel, sequentially, or in a different order, as long as the desired result of the technical solution disclosed in the present disclosure can be achieved, no limitation is imposed herein.

Abstract

本文公开一种集群访问方法、装置、电子设备和介质。集群访问方法包括：从客户端发送的集群访问请求中获取当前客户端口令，并根据当前客户端口令对客户端进行认证；在认证通过的情况下，向目标集群的网关服务端发送集群访问模拟请求，以建立客户端与目标集群之间的连接；其中，集群访问模拟请求是基于用户模拟技术对客户端进行模拟得到的。

Description

集群访问方法、装置、电子设备和介质
本申请要求在2021年05月27日提交中国专利局、申请号为202110606924.6的中国专利申请的优先权，该申请的全部内容通过引用结合在本申请中。
技术领域
本公开涉及计算机技术领域，涉及容器技术、云计算及云服务技术领域，例如涉及一种集群访问方法、装置、电子设备和介质。
背景技术
随着Kubernetes技术的发展，实现了公共云和私有云内不同的基础设施之间可以无障碍地沟通。主流的沟通方法是通过云服务商将不同地区的Kubernetes集群统一纳管。
在一个客户端想要访问Kubernetes集群之前，通常需要通过集群的网关服务端对该客户端进行认证。
发明内容
本公开提供了一种用于客户端与集群之间建立连接的方法、装置、电子设备和介质。
根据本公开的一方面，提供了一种集群访问方法，包括：
从客户端发送的集群访问请求中获取当前客户端口令，并根据所述当前客户端口令对所述客户端进行认证；
在认证通过的情况下，向目标集群的网关服务端发送集群访问模拟请求，以建立所述客户端与所述目标集群之间的连接；其中，所述集群访问模拟请求是基于用户模拟技术对所述客户端进行模拟得到的。
根据本公开的另一方面，提供了一种集群访问装置，包括：
认证模块，设置为从客户端发送的集群访问请求中获取当前客户端口令，并根据所述当前客户端口令对所述客户端进行认证；
通信连接模块，设置为在认证通过的情况下，向目标集群的网关服务端发送集群访问模拟请求，以建立所述客户端与所述目标集群之间的连接；其中，所述集群访问模拟请求是基于用户模拟技术对所述客户端进行模拟得到的。
根据本公开的另一方面，提供了一种电子设备，包括：
至少一个处理器；以及
与所述至少一个处理器通信连接的存储器；其中，
所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行上述的集群访问方法。
根据本公开的另一方面，提供了一种存储有计算机指令的非瞬时计算机可读存储介质，其中，所述计算机指令用于使所述计算机执行上述的集群访问方法。
根据本公开的另一方面，提供了一种计算机程序产品，包括计算机程序，所述计算机程序在被处理器执行时实现上述的集群访问方法。
附图说明
图1是根据本公开实施例公开的一种集群访问方法的流程图；
图2是根据本公开实施例公开的另一种集群访问方法的流程图；
图3是根据本公开实施例公开的一种集群访问装置的结构示意图；
图4是用来实现本公开实施例公开的集群访问方法的电子设备的框图。
具体实施方式
以下结合附图对本公开的示范性实施例做出说明，其中包括本公开实施例的多种细节以助于理解，应当将它们认为仅仅是示范性的。为了清楚和简明，以下的描述中省略了对公知功能和结构的描述。
集群访问过程中，客户端直接向目标集群的网关服务端发送集群访问请求，网关服务端通过OpenID Connect方案来对客户端进行认证。但是默认情况下网关服务端并未开启对于OpenID Connect方案的支持，因此需要首先在网关服务端配置OpenID Connect方案参数才能够开启。
然而由于需要在网关服务端进行参数配置，这就造成了对网关服务端的侵入，改变了网关服务端的运行环境，而网关服务端又是构建外界与集群之间连接的桥梁，因此这无疑加大了集群的安全风险，降低了集群的安全性。
图1是根据本公开实施例公开的一种集群访问方法的流程图，本实施例可以适用于客户端与集群之间建立连接的情况。本实施例方法可以由本公开实施例公开的集群访问装置来执行，所述装置可采用软件和/或硬件实现，并可集成在任意的具有计算能力的电子设备上。
如图1所示，本实施例公开的集群访问方法可以包括：
S101、从客户端发送的集群访问请求中获取当前客户端口令，并根据所述当前客户端口令对所述客户端进行认证。
客户端表示想要访问目标集群的用户所使用的用户端设备，其可以是智能设备中安装的软件，也可以是网页浏览器，本实施例并不对客户端的形式进行限定。集群表示实现相同业务功能的设备的集合，例如本实施例中的集群可选的包括Kubernetes集群，即一组运行容器化应用程序的节点计算机。
在一种实施方式中，客户端通过代理服务端预先暴露的地址信息，例如统一资源定位器(Uniform Resource Locator，URL)地址，向代理服务端发送针对目标集群的集群访问请求。代理服务端获取到集群访问请求后对集群访问请求进行解析，确定集群访问请求中是否包含有当前客户端口令。若集群访问请求中没有包含当前客户端口令，则代理服务端立即拒绝客户端对于目标集群的访问；若集群访问请求中包含当前客户端口令，则代理服务端确定当前客户端口令的有效期，进而确定当前客户端口令是否过期。若当前客户端口令过期，则代理服务端拒绝客户端对于目标集群的访问；若当前客户端口令未过期，则代理服务端根据当前客户端口令对客户端进行认证，认证的方式包括但不限于如下的至少一种实现方式：
1)客户端将当前客户端口令通过私钥进行加密，并根据加密后的当前客户端口令生成集群访问请求并发送给代理服务端，代理服务端采用公钥对加密后的当前客户端口令进行解密，若解密得到的当前客户端口令与预先向客户端颁发的标准客户端口令相同，则对客户端的认证通过。
2)客户端将自身的标准客户端标识作为干扰码对当前客户端口令进行加密，并根据加密后的当前客户端口令生成集群访问请求并发送给代理服务端，代理服务端通过客户端的当前客户端标识对加密后的当前客户端口令进行解密，若可以解密成功，则对客户端的认证通过。
3)客户端授权代理服务端获取客户端的标准客户端信息，代理服务端根据标准客户端信息生成标准客户端口令并返回给客户端。客户端将携带有当前客户端口令的集群访问请求发送给代理服务端，代理服务端解析当前客户端口令得到当前客户端信息，并基于当前客户端信息与标准客户端信息进行比对，若比对成功则对客户端认证通过。
本实施例并不对根据当前客户端口令对客户端进行认证的实现方式进行限定，凡是基于客户端口令的身份认证方式均处于本实施例的保护范围内。
通过从客户端发送的集群访问请求中获取当前客户端口令，并根据当前客户端口令对客户端进行认证，实现了基于代理服务端对客户端的认证，保 证了客户端访问集群的安全性。
S102、在认证通过的情况下，向目标集群的网关服务端发送集群访问模拟请求，以建立所述客户端与所述目标集群之间的连接；其中，所述集群访问模拟请求是基于用户模拟技术对所述客户端进行模拟得到的。
在一种实施方式中，当代理服务端对客户端认证通过后，采用用户模拟技术对客户端进行模拟，生成客户端对于目标集群的集群访问模拟请求，其中，用户模拟技术即User Impersonation技术，是一个用户模拟另一个用户进行相关操作的技术，在本实施例中即代理服务端模拟客户端向目标集群的网关服务端发送集群访问请求。代理服务端将生成的集群访问模拟请求发送给目标集群的网关服务端，由于集群访问模拟请求是基于用户模拟技术对客户端进行模拟得到的，所以从网关服务端一侧来看，等效于真实的客户端向网关服务端发送集群访问请求，从而网关服务端响应于集群访问模拟请求，向客户端暴露一个外部可访问的指定端口，以使得客户端基于该指定端口访问目标集群。
通过在认证通过的情况下，向目标集群的网关服务端发送集群访问模拟请求，以建立客户端与目标集群之间的连接，实现了模拟客户端向网关服务端发送集群访问请求的效果，使得在代理服务端对客户端认证通过的情况下，能够建立客户端与目标集群之间的连接。
本公开通过从客户端发送的集群访问请求中获取当前客户端口令，并根据当前客户端口令对客户端进行认证，从而将客户端认证过程依托于代理服务端执行，而无需在网关服务端执行，避免了相关技术中由网关服务端进行客户端认证，存在侵入网关服务端，导致集群存在安全风险的问题，提高了集群的安全性；通过代理服务端基于用户模拟技术模拟客户端向网关服务端发送集群访问请求，保证了即使是由代理服务端本身发送的集群访问模拟请求，同样可以实现建立客户端与集群之间连接的效果，使得客户端对于目标集群的访问能够顺利进行。
在上述实施例的基础上，还包括：
根据用户对目标集群的权限配置操作，确定所述目标集群的待更新权限信息；根据所述待更新权限信息控制所述目标集群进行权限信息的更新。
权限信息表示集群权限的相关属性信息，其包括但不限于权限规则以及被授权人信息，权限规则即定义了集群中权限的内容，例如“访问A命名空间”权限或“修改A命名空间”权限等等，而被授权人信息表示任一权限规则适用的对象，例如将权限规则A赋予给用户A，那么用户A就是权限规则A 的被授权人。
在一种实施方式中，代理服务端与多个纳管集群之间通信连接，用户在代理服务端对应前端中对目标集群的权限信息进行配置，代理服务端则响应于用户在前端的权限配置操作，确定目标集群的待更新权限信息，并控制纳管的目标集群将当前权限信息更新为待更新权限信息。
示例性的，以集群为Kubernetes集群为例对上述实施方式进行解释说明。
用户在代理服务端对应的前端对目标Kubernetes集群进行权限信息配置，包括但不限于“Role”配置、“ClusterRole”配置、“Rolebinding”配置和“Cluster Rolebinding”配置等，其中，“Role”表示任一Kubernetes集群中针对一命名空间的权限规则，“ClusterRole”表示任一Kubernetes集群本身的权限规则，“Rolebinding”表示任一Kubernetes集群中任一“Role”对应的被授权人信息，“Cluster Rolebinding”表示任一Kubernetes集群中任一“ClusterRole”的被授权人信息。代理服务端根据用户的权限配置操作，确定更新后的“Role”、“ClusterRole”、“Rolebinding”和“Cluster Rolebinding”中的至少一种权限信息，并相应的控制目标Kubernetes集群进行权限信息的更新。例如若用户在前端对目标Kubernetes集群的“Role”进行了配置，则代理服务端相应的将配置后的“Role”同步更新到目标Kubernetes集群中。
通过根据用户对目标集群的权限配置操作，确定目标集群的待更新权限信息，根据待更新权限信息控制目标集群进行权限信息的更新，实现了基于代理服务端对集群权限信息的统一管理，提高了集群权限信息管理的效率。
图2是根据本公开实施例公开的另一种集群访问方法的流程图，基于上述技术方案进行扩展，并可以与上述可选实施方式进行结合。
如图2所示，本实施例公开的集群访问方法可以包括：
S201、根据客户端发送的访问配置文件获取请求，获取客户端的标准客户端信息。
访问配置文件是客户端访问集群所需的一种证书，每个客户端访问集群都需要基于访问配置文件来实现。访问配置文件需要客户端向权威方申请才能得到。标准客户端信息即客户端的一些私有信息，例如客户端名称和客户端状态等。
在一种实施方式中，客户端根据代理服务端暴露的地址信息向代理服务端发送访问配置文件获取请求。代理服务端根据访问配置文件获取请求，向客户端申请获取标准客户端信息，在客户端授权的情况下，获取客户端的标 准客户端信息。
示例性的，本实施例提供了一种真实场景中S201的实现方式。
用户登录浏览器，并在浏览器中输入代理服务端的地址信息以向代理服务端发送访问配置文件获取请求。代理服务端将访问配置文件获取请求转发给身份服务组件，身份服务组件根据预设的授权协议，例如开放授权2.0(Open Authorization 2.0，OAuth2.0)协议等，控制浏览器跳转显示个人信息授权界面。用户在浏览器的个人信息授权界面中执行个人信息授权操作，包括但不限于根据账号密码授权、根据二维码授权或者根据验证码授权等等。当用户对个人信息授权后，身份服务组件从浏览器关联的第三方服务端中获取用户个人信息。
S202、根据标准客户端信息生成标准客户端口令，并根据标准客户端口令生成标准访问配置文件。
在一种实施方式中，采用预设编码技术，例如Base64编码等，对标准客户端信息进行编码，生成荷载信息；同样采用编码技术对标准客户端口令类型信息以及签名算法信息进行编码，生成头部信息；采用签名算法对荷载信息和头部信息进行加密，生成签名信息；最终根据头部信息、荷载信息和签名信息生成标准客户端口令。根据标准客户端口令生成包含该标准客户端口令的标准访问配置文件。
S203、将标准访问配置文件发送给客户端。
在一种实施方式中，代理服务端将生成的标准访问配置文件反馈给客户端，以使得客户端后续通过包含有标准访问配置文件的集群访问请求，进行集群访问。
S204、从客户端发送的集群访问请求中获取客户端的当前访问配置文件，并对当前访问配置文件进行解析确定当前客户端口令。
在一种实施方式中，客户端向代理服务端发送包含当前客户端口令的当前访问配置文件，代理服务端对当前访问配置文件进行解析，从预设字段区域间中提取出当前客户端口令。
在客户端通过集群访问请求进行集群访问时，该集群访问请求中的当前访问配置文件不一定是客户端在S203中获得的标准访问配置文件，因此，代理服务端需要对集群访问请求中的当前访问配置文件进行解析以及验证，确保客户端是在通过包含有标准访问配置文件的集群访问请求进行集群访问。
S205、根据当前客户端口令确定客户端的当前客户端信息，并根据当前客户端信息对客户端进行认证。
在一种实施方式中，代理服务端获取当前客户端口令后，首先对当前客户端口令的荷载信息部分进行解码得到口令过期时间，并基于当前时间和口令过期时间确定当前客户端口令是否过期，若当前客户端口令未过期，则取出当前客户端口令中的荷载信息和头部信息，再计算一次签名信息，并将计算出的签名信息与当前客户端口令中的签名信息比较，若计算出的签名信息与当前客户端口令中的签名信息一致，则对荷载信息进行解码得到当前客户端信息。进而根据当前客户端信息对客户端进行认证，认证的方式包括但不限于：1)将当前客户端信息与标准客户端信息进行比对，若当前客户端信息与标准客户端信息一致则确定客户端合法，即对客户端的认证通过。2)通过数据接口从第三方服务端获取当前客户端信息对应的客户端状态，并根据客户端状态对客户端进行认证，例如若确定客户端状态为异常状态，则对客户端的认证不通过。
S206、在认证通过的情况下，根据集群访问请求，确定目标集群。
在一种实施方式中，代理服务端根据集群访问请求中包含的目标集群标识，确定目标集群。在本实施例中，多个客户端都将各自的集群访问请求发送至代理服务端中，因此每个客户端在集群访问请求中添加目标集群标识，以使得代理服务端根据目标集群标识确定每个集群访问请求对应的目标集群。
S207、确定目标集群是否处于异常状态；其中，异常状态包括失联异常状态和健康值异常状态中的至少一种，并在目标集群未处于异常状态的情况下，向目标集群的网关服务端发送集群访问模拟请求。
失联异常状态表示集群断开了与网关服务端之间的连接，健康值异常状态表示集群的一些指标数据异常，例如中央处理单元(Central Processing Unit，CPU)占用率过高或者可用内存剩余过小等等。
在一种实施方式中，代理服务器通过List-watch的方式定时检查每个集群的连接状态和健康值，若确定目标集群处于异常状态时，则停止向目标集群的网关服务端发送集群访问模拟请求。若目标集群未处于异常状态，则向目标集群的网关服务端发送集群访问模拟请求。网关服务端根据接收到的集群访问模拟请求，建立与客户端之间的连接。
本公开通过根据客户端发送的访问配置文件获取请求，获取客户端的标准客户端信息，根据标准客户端信息生成标准客户端口令，并根据标准客户端口令生成标准访问配置文件，将标准访问配置文件发送给客户端，为后续客户端根据标准访问配置文件对目标集群进行访问奠定了基础，保证集群访问的顺利进行；通过从集群访问请求中获取客户端的当前访问配置文件，并对当前访问配置文件进行解析确定当前客户端口令，为后续根据当前客户端 口令对客户端进行认证奠定了基础；通过根据当前客户端口令确定客户端的当前客户端信息，并根据当前客户端信息对客户端进行认证，实现了对客户端进行认证的效果，提高了集群访问的安全性；通过根据集群访问请求，确定目标集群，实现了确定每个客户端想要访问的目标集群的效果，为后续向目标集群发送集群访问模拟请求奠定了基础；通过确定目标集群是否处于异常状态；其中，异常状态包括失联异常状态和健康值异常状态中的至少一种，并在目标集群未处于异常状态的情况下，向目标集群的网关服务端发送集群访问模拟请求，保证了目标集群能够正常访问，避免了客户端无法访问目标集群的问题。
本公开的技术方案中，所涉及的用户个人信息的获取，存储和应用等，均符合相关法律法规的规定，且不违背公序良俗。
图3是根据本公开实施例公开的一种集群访问装置的结构示意图，可以适用于客户端与集群之间建立连接的情况。本实施例装置可采用软件和/或硬件实现，并可集成在任意的具有计算能力的电子设备上。
如图3所示，本实施例公开的集群访问装置30可以包括认证模块31和通信连接模块32，其中：
认证模块31，设置为从客户端发送的集群访问请求中获取当前客户端口令，并根据所述当前客户端口令对所述客户端进行认证；通信连接模块32，设置为在认证通过的情况下，向目标集群的网关服务端发送集群访问模拟请求，以建立所述客户端与所述目标集群之间的连接；其中，所述集群访问模拟请求是基于用户模拟技术对所述客户端进行模拟得到的。
可选的，所述装置还包括目标集群确定模块，设置为：
根据所述集群访问请求，确定所述目标集群。
可选的，所述认证模块31设置为通过如下方式从客户端发送的集群访问请求中获取当前客户端口令：
从所述集群访问请求中获取所述客户端的当前访问配置文件，并对所述当前访问配置文件进行解析确定所述当前客户端口令。
可选的，所述装置还包括访问配置文件发送模块，设置为：
根据所述客户端发送的访问配置文件获取请求，获取所述客户端的标准客户端信息；根据所述标准客户端信息生成标准客户端口令，并根据所述标准客户端口令生成标准访问配置文件；将所述标准访问配置文件发送给所述 客户端。
可选的，所述认证模块31设置为通过如下方式根据所述客户端口令对所述客户端进行认证：
根据所述当前客户端口令确定所述客户端的当前客户端信息，并根据所述当前客户端信息对所述客户端进行认证。
可选的，所述装置还包括异常状态判断模块，设置为：
确定所述目标集群是否处于异常状态；其中，所述异常状态包括失联异常状态和健康值异常状态中的至少一种；所述通信连接模块32设置为通过如下方式向目标集群的网关服务端发送集群访问模拟请求：在所述目标集群未处于异常状态的情况下，向所述目标集群的所述网关服务端发送所述集群访问模拟请求。
可选的，所述装置还包括权限信息更新模块，设置为：
根据用户对目标集群的权限配置操作，确定所述目标集群的待更新权限信息；根据所述待更新权限信息控制所述目标集群进行权限信息的更新。
本公开实施例所公开的集群访问装置30可执行本公开实施例所公开的集群访问方法，具备执行方法相应的功能模块和效果。本实施例中未详尽描述的内容可以参考本公开任意方法实施例中的描述。
根据本公开的实施例，本公开还提供了一种电子设备、一种可读存储介质和一种计算机程序产品。
图4示出了可以用来实施本公开的实施例的示例电子设备400的示意性框图。电子设备400旨在表示多种形式的数字计算机，诸如，膝上型计算机、台式计算机、工作台、个人数字助理、服务器、刀片式服务器、大型计算机、和其它适合的计算机。电子设备400还可以表示多种形式的移动装置，诸如，个人数字处理、蜂窝电话、智能电话、可穿戴设备和其它类似的计算装置。本文所示的部件、它们的连接和关系、以及它们的功能仅仅作为示例，并且不意在限制本文中描述的和/或者要求的本公开的实现。
如图4所示，设备400包括计算单元401，其可以根据存储在只读存储器(Read-Only Memory，ROM)402中的计算机程序或者从存储单元408加载到随机访问存储器(Random Access Memory，RAM)403中的计算机程序，来执行多种适当的动作和处理。在RAM 403中，还可存储设备400操作所需的多种程序和数据。计算单元401、ROM 402以及RAM 403通过总线404 彼此相连。输入/输出(Input/Output，I/O)接口405也连接至总线404。
设备400中的多个部件连接至I/O接口405，包括：输入单元406，例如键盘、鼠标等；输出单元407，例如多种类型的显示器、扬声器等；存储单元408，例如磁盘、光盘等；以及通信单元409，例如网卡、调制解调器、无线通信收发机等。通信单元409允许设备400通过诸如因特网的计算机网络和/或多种电信网络与其他设备交换信息/数据。
计算单元401可以是多种具有处理和计算能力的通用和/或专用处理组件。计算单元401的一些示例包括但不限于CPU、图形处理单元(Graphics Processing Unit，GPU)、多种专用的人工智能(Artificial Intelligence，AI)计算芯片、多种运行机器学习模型算法的计算单元、数字信号处理器(Digital Signal Processing，DSP)、以及任何适当的处理器、控制器、微控制器等。计算单元401执行上文所描述的方法和处理，例如集群访问方法。例如，在一些实施例中，集群访问方法可被实现为计算机软件程序，其被有形地包含于机器可读介质，例如存储单元408。在一些实施例中，计算机程序的部分或者全部可以经由ROM 402和/或通信单元409而被载入和/或安装到设备400上。当计算机程序加载到RAM 403并由计算单元401执行时，可以执行上文描述的集群访问方法的一个或多个步骤。备选地，在其他实施例中，计算单元401可以通过其他任何适当的方式(例如，借助于固件)而被配置为执行集群访问方法。
本文中以上描述的系统和技术的多种实施方式可以在数字电子电路系统、集成电路系统、场可编程门阵列(Field Programmable Gate Array，FPGA)、专用集成电路(Application Specific Integrated Circuit，ASIC)、专用标准产品(Application Specific Standard Parts，ASSP)、芯片上的系统(System on Chip，SoC)、复杂可编程逻辑设备(Complex Programmable Logic Device，CPLD)、计算机硬件、固件、软件、和/或它们的组合中实现。多种实施方式可以包括：实施在一个或者多个计算机程序中，该一个或者多个计算机程序可在包括至少一个可编程处理器的可编程系统上执行和/或解释，该可编程处理器可以是专用或者通用可编程处理器，可以从存储系统、至少一个输入装置、和至少一个输出装置接收数据和指令，并且将数据和指令传输至该存储系统、该至少一个输入装置、和该至少一个输出装置。
用于实施本公开的方法的程序代码可以采用一个或多个编程语言的任何组合来编写。这些程序代码可以提供给通用计算机、专用计算机或其他可编程数据处理装置的处理器或控制器，使得程序代码当由处理器或控制器执行时使流程图和/或框图中所规定的功能/操作被实施。程序代码可以完全在机 器上执行、部分地在机器上执行，作为独立软件包部分地在机器上执行且部分地在远程机器上执行或完全在远程机器或服务器上执行。
在本公开的上下文中，机器可读介质可以是有形的介质，其可以包含或存储以供指令执行系统、装置或设备使用或与指令执行系统、装置或设备结合地使用的程序。机器可读介质可以是机器可读信号介质或机器可读储存介质。机器可读介质可以包括但不限于电子的、磁性的、光学的、电磁的、红外的、或半导体系统、装置或设备，或者上述内容的任何合适组合。机器可读存储介质的示例会包括基于一个或多个线的电气连接、便携式计算机盘、硬盘、RAM、ROM、可擦除可编程只读存储器(Erasable Programmable Read-Only Memory，EPROM或快闪存储器)、光纤、便捷式紧凑盘只读存储器(Compact Disc Read-Only Memory，CD-ROM)、光学储存设备、磁储存设备、或上述内容的任何合适组合。
为了提供与用户的交互，可以在计算机上实施此处描述的系统和技术，该计算机具有：设置为向用户显示信息的显示装置(例如，阴极射线管(Cathode Ray Tube，CRT)或者液晶显示器(Liquid Crystal Display，LCD)监视器)；以及键盘和指向装置(例如，鼠标或者轨迹球)，用户可以通过该键盘和该指向装置来将输入提供给计算机。其它种类的装置还可以设置为提供与用户的交互；例如，提供给用户的反馈可以是任何形式的传感反馈(例如，视觉反馈、听觉反馈、或者触觉反馈)；并且可以用任何形式(包括声输入、语音输入或者、触觉输入)来接收来自用户的输入。
可以将此处描述的系统和技术实施在包括后台部件的计算系统(例如，作为数据服务器)、或者包括中间件部件的计算系统(例如，应用服务器)、或者包括前端部件的计算系统(例如，具有图形用户界面或者网络浏览器的用户计算机，用户可以通过该图形用户界面或者该网络浏览器来与此处描述的系统和技术的实施方式交互)、或者包括这种后台部件、中间件部件、或者前端部件的任何组合的计算系统中。可以通过任何形式或者介质的数字数据通信(例如，通信网络)来将系统的部件相互连接。通信网络的示例包括：局域网(Local Area Network，LAN)、广域网(Wide Area Network，WAN)、区块链网络和互联网。
计算机系统可以包括客户端和服务器。客户端和服务器一般远离彼此并且通常通过通信网络进行交互。通过在相应的计算机上运行并且彼此具有客户端-服务器关系的计算机程序来产生客户端和服务器的关系。服务器可以是云服务器，又称为云计算服务器或云主机，是云计算服务体系中的一项主机产品，以解决了传统物理主机与虚拟专用服务器(Virtual Private Server，VPS) 服务中，存在的管理难度大，业务扩展性弱的缺陷。服务器也可以为分布式系统的服务器，或者是结合了区块链的服务器。
可以使用上面所示的多种形式的流程，重新排序、增加或删除步骤。例如，本公开中记载的多个步骤可以并行地执行也可以顺序地执行也可以不同的次序执行，只要能够实现本公开公开的技术方案所期望的结果，本文在此不进行限制。

Claims (17)

  1. 一种集群访问方法，包括：
    从客户端发送的集群访问请求中获取当前客户端口令，并根据所述当前客户端口令对所述客户端进行认证；
    在认证通过的情况下，向目标集群的网关服务端发送集群访问模拟请求，以建立所述客户端与所述目标集群之间的连接；其中，所述集群访问模拟请求是基于用户模拟技术对所述客户端进行模拟得到的。
  2. 根据权利要求1所述的方法，在所述向目标集群的网关服务端发送集群访问模拟请求之前，还包括：
    根据所述集群访问请求，确定所述目标集群。
  3. 根据权利要求1所述的方法，其中，所述从客户端发送的集群访问请求中获取当前客户端口令，包括：
    从所述集群访问请求中获取所述客户端的当前访问配置文件，并对所述当前访问配置文件进行解析确定所述当前客户端口令。
  4. 根据权利要求1所述的方法，在所述从客户端发送的集群访问请求中获取当前客户端口令之前，还包括：
    根据所述客户端发送的访问配置文件获取请求，获取所述客户端的标准客户端信息；
    根据所述标准客户端信息生成标准客户端口令，并根据所述标准客户端口令生成标准访问配置文件；
    将所述标准访问配置文件发送给所述客户端，以使所述客户端通过包含所述标准访问配置文件的集群访问请求进行集群访问。
  5. 根据权利要求1所述的方法，其中，所述根据所述当前客户端口令对所述客户端进行认证，包括：
    根据所述当前客户端口令确定所述客户端的当前客户端信息，并根据所述当前客户端信息对所述客户端进行认证。
  6. 根据权利要求1所述的方法，在所述认证通过之后，所述向目标集群的网关服务端发送集群访问模拟请求之前，还包括：
    确定所述目标集群是否处于异常状态；其中，所述异常状态包括失联异常状态和健康值异常状态中的至少一种；
    所述向目标集群的网关服务端发送集群访问模拟请求，包括：
    在所述目标集群未处于异常状态的情况下，向所述目标集群的所述网关服务端发送所述集群访问模拟请求。
  7. 根据权利要求1所述的方法，还包括：
    根据用户对所述目标集群的权限配置操作，确定所述目标集群的待更新权限信息；
    根据所述待更新权限信息控制所述目标集群进行权限信息的更新。
  8. 一种集群访问装置，包括：
    认证模块，设置为从客户端发送的集群访问请求中获取当前客户端口令，并根据所述当前客户端口令对所述客户端进行认证；
    通信连接模块，设置为在认证通过的情况下，向目标集群的网关服务端发送集群访问模拟请求，以建立所述客户端与所述目标集群之间的连接；其中，所述集群访问模拟请求是基于用户模拟技术对所述客户端进行模拟得到的。
  9. 根据权利要求8所述的装置，还包括目标集群确定模块，设置为：
    根据所述集群访问请求，确定所述目标集群。
  10. 根据权利要求8所述的装置，其中，所述认证模块设置为通过如下方式从客户端发送的集群访问请求中获取当前客户端口令：
    从所述集群访问请求中获取所述客户端的当前访问配置文件，并对所述当前访问配置文件进行解析确定所述当前客户端口令。
  11. 根据权利要求8所述的装置，还包括访问配置文件发送模块，设置为：
    根据所述客户端发送的访问配置文件获取请求，获取所述客户端的标准客户端信息；
    根据所述标准客户端信息生成标准客户端口令，并根据所述标准客户端口令生成标准访问配置文件；
    将所述标准访问配置文件发送给所述客户端，以使所述客户端通过包含所述标准访问配置文件的集群访问请求进行集群访问。
  12. 根据权利要求8所述的装置，其中，所述认证模块设置为通过如下方式根据所述客户端口令对所述客户端进行认证：
    根据所述当前客户端口令确定所述客户端的当前客户端信息，并根据所述当前客户端信息对所述客户端进行认证。
  13. 根据权利要求8所述的装置，还包括异常状态判断模块，设置为：
    确定所述目标集群是否处于异常状态；其中，所述异常状态包括失联异常状态和健康值异常状态中的至少一种；
    所述通信连接模块设置为通过如下方式向目标集群的网关服务端发送集群访问模拟请求：
    在所述目标集群未处于异常状态的情况下，向所述目标集群的所述网关服务端发送所述集群访问模拟请求。
  14. 根据权利要求8所述的装置，其中，所述装置还包括权限信息更新模块，设置为：
    根据用户对所述目标集群的权限配置操作，确定所述目标集群的待更新权限信息；
    根据所述待更新权限信息控制所述目标集群进行权限信息的更新。
  15. 一种电子设备，包括：
    至少一个处理器；以及
    与所述至少一个处理器通信连接的存储器；其中，
    所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行权利要求1-7中任一项所述的集群访问方法。
  16. 一种存储有计算机指令的非瞬时计算机可读存储介质，其中，所述计算机指令用于使所述计算机执行根据权利要求1-7中任一项所述的集群访问方法。
  17. 一种计算机程序产品，包括计算机程序，所述计算机程序在被处理器执行时实现根据权利要求1-7中任一项所述的集群访问方法。
PCT/CN2022/076922 2021-05-27 2022-02-18 集群访问方法、装置、电子设备和介质 WO2022247359A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP22757466.2A EP4120109A1 (en) 2021-05-27 2022-02-18 Cluster access method and apparatus, electronic device, and medium
KR1020227029834A KR20220160549A (ko) 2021-05-27 2022-02-18 클러스터 접속 방법, 장치, 전자 설비 및 매체
JP2022552283A JP2023530802A (ja) 2021-05-27 2022-02-18 クラスタアクセス方法、クラスタアクセス装置、電子機器、コンピュータ可読記憶媒体およびコンピュータプログラム

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110606924.6A CN113360882A (zh) 2021-05-27 2021-05-27 集群访问方法、装置、电子设备和介质
CN202110606924.6 2021-05-27

Publications (1)

Publication Number Publication Date
WO2022247359A1 true WO2022247359A1 (zh) 2022-12-01

Family

ID=77530840

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/076922 WO2022247359A1 (zh) 2021-05-27 2022-02-18 集群访问方法、装置、电子设备和介质

Country Status (5)

Country Link
EP (1) EP4120109A1 (zh)
JP (1) JP2023530802A (zh)
KR (1) KR20220160549A (zh)
CN (1) CN113360882A (zh)
WO (1) WO2022247359A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116909757A (zh) * 2023-09-13 2023-10-20 中移(苏州)软件技术有限公司 集群管理的控制系统、方法、电子设备和存储介质

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113360882A (zh) * 2021-05-27 2021-09-07 北京百度网讯科技有限公司 集群访问方法、装置、电子设备和介质
CN114143313B (zh) * 2021-11-30 2024-03-19 招商局金融科技有限公司 基于云原生的集群通信装置、方法及相关设备
CN114745185A (zh) * 2022-04-18 2022-07-12 阿里巴巴（中国）有限公司 集群访问方法及装置
CN115988078A (zh) * 2022-11-28 2023-04-18 中国联合网络通信集团有限公司 通信方法、系统、电子设备及存储介质
CN116094763A (zh) * 2022-12-07 2023-05-09 天翼云科技有限公司 一种基于云手机的上网行为管控方法及系统

Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110175077A (zh) * 2019-05-27 2019-08-27 浪潮云信息技术有限公司 一种基于命令管理容器资源的方法及系统
CN110971646A (zh) * 2018-09-30 2020-04-07 浙江大学 一种集群控制装置、系统及方法
CN111212077A (zh) * 2020-01-08 2020-05-29 中国建设银行股份有限公司 主机访问系统及方法
CN111510444A (zh) * 2020-04-09 2020-08-07 上海云励科技有限公司 容器的远程访问方法、系统、服务端和访问辅助组件
CN111796858A (zh) * 2020-07-07 2020-10-20 金蝶软件（中国）有限公司 Kubernetes集群内部应用程序访问检测的方法、系统及相关设备
US20200351332A1 (en) * 2017-07-28 2020-11-05 Kong Inc. Auto-documentation for application program interfaces based on network requests and responses
CN111935110A (zh) * 2020-07-24 2020-11-13 北京金山云网络技术有限公司 一种对租户访问容器实例的权限的控制方法和装置
CN112468442A (zh) * 2020-10-28 2021-03-09 苏州浪潮智能科技有限公司 双因子认证方法、装置、计算机设备及存储介质
CN113360882A (zh) * 2021-05-27 2021-09-07 北京百度网讯科技有限公司 集群访问方法、装置、电子设备和介质

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109344620B (zh) * 2018-09-07 2021-08-31 国网福建省电力有限公司 一种基于对hadoop安全配置的检测方法

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200351332A1 (en) * 2017-07-28 2020-11-05 Kong Inc. Auto-documentation for application program interfaces based on network requests and responses
CN110971646A (zh) * 2018-09-30 2020-04-07 浙江大学 一种集群控制装置、系统及方法
CN110175077A (zh) * 2019-05-27 2019-08-27 浪潮云信息技术有限公司 一种基于命令管理容器资源的方法及系统
CN111212077A (zh) * 2020-01-08 2020-05-29 中国建设银行股份有限公司 主机访问系统及方法
CN111510444A (zh) * 2020-04-09 2020-08-07 上海云励科技有限公司 容器的远程访问方法、系统、服务端和访问辅助组件
CN111796858A (zh) * 2020-07-07 2020-10-20 金蝶软件（中国）有限公司 Kubernetes集群内部应用程序访问检测的方法、系统及相关设备
CN111935110A (zh) * 2020-07-24 2020-11-13 北京金山云网络技术有限公司 一种对租户访问容器实例的权限的控制方法和装置
CN112468442A (zh) * 2020-10-28 2021-03-09 苏州浪潮智能科技有限公司 双因子认证方法、装置、计算机设备及存储介质
CN113360882A (zh) * 2021-05-27 2021-09-07 北京百度网讯科技有限公司 集群访问方法、装置、电子设备和介质

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116909757A (zh) * 2023-09-13 2023-10-20 中移(苏州)软件技术有限公司 集群管理的控制系统、方法、电子设备和存储介质
CN116909757B (zh) * 2023-09-13 2024-01-26 中移(苏州)软件技术有限公司 集群管理的控制系统、方法、电子设备和存储介质

Also Published As

Publication number Publication date
JP2023530802A (ja) 2023-07-20
KR20220160549A (ko) 2022-12-06
EP4120109A1 (en) 2023-01-18
CN113360882A (zh) 2021-09-07

Similar Documents

Publication Publication Date Title
WO2022247359A1 (zh) 集群访问方法、装置、电子设备和介质
US11736469B2 (en) Single sign-on enabled OAuth token
CN111556006B (zh) 第三方应用系统登录方法、装置、终端及sso服务平台
US9094208B2 (en) User identity management and authentication in network environments
US9386007B2 (en) Multi-domain applications with authorization and authentication in cloud environment
US10237254B2 (en) Conditional login promotion
CN112422532B (zh) 业务通信方法、系统、装置及电子设备
CN108880822B (zh) 一种身份认证方法、装置、系统及一种智能无线设备
US20170006020A1 (en) Authentication context transfer for accessing computing resources via single sign-on with single use access tokens
JP2017517823A (ja) 機械生成認証トークンによってサービスを運用する技法
CN107743702B (zh) 托管移动设备的单点登录
CN107534557A (zh) 提供访问控制和单点登录的身份代理
US9571495B2 (en) Methods and systems for authorizing web service requests
US20230370265A1 (en) Method, Apparatus and Device for Constructing Token for Cloud Platform Resource Access Control
JP2017524214A (ja) サードパーティの認証サポートを介した企業認証
CN113923020A (zh) SaaS多租户架构的微服务鉴权方法、装置、及设备
KR20220019834A (ko) 디바이스로의 보안 자격증명 전송을 인증하는 방법 및 시스템
CN111865882A (zh) 一种微服务认证方法和系统
KR101836211B1 (ko) 전자 기기 인증 매니저 장치
EP4149053B1 (en) Authorization processing method and apparatus, and storage medium
Huang et al. A method for trusted usage control over digital contents based on cloud computing
US11405379B1 (en) Multi-factor message-based authentication for network resources
CN113794571A (zh) 一种基于动态口令的认证方法、装置及介质
CN115834252B (zh) 一种服务访问方法及系统
TWI768307B (zh) 開源軟體整合方法

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2022552283

Country of ref document: JP

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 17909295

Country of ref document: US

ENP Entry into the national phase

Ref document number: 2022757466

Country of ref document: EP

Effective date: 20220830

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22757466

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE