[LC] 304. Range Sum Query 2D - Immutable

本文介绍了一种高效的矩阵区间求和算法,通过预计算辅助二维数组,实现快速查询矩阵中任意子区域的元素总和。算法核心在于利用累积和的思想,避免重复计算,大幅提高查询效率。

这题做法其实就很简单了。如果说我们有一个辅助二维数组f(n, n),其中任意f(i, j)是从matrix(0, 0)到matrix(i, j)的矩阵的和

那么这一题subRegion(row1, col1, row2, col2)其实就是f(row2, col2)这个矩阵,减去f(row1, col2)这个矩阵,再减去f(row2, col1)这个矩阵,最后加上f(row1, col1)这个被重复减去了两次的矩阵就可以了。注意一下row1 = 0 或者 col1 = 0的edge case就可以了。

根据上面描述,给出代码如下:

    private int[][] _calculated;
    
    public NumMatrix(int[][] matrix) {
        if (matrix.length == 0 || matrix[0].length == 0) return;
        
        this._calculated = new int[matrix.length][matrix[0].length];
        for (int i = 0; i < matrix.length; i++) {
            int curRowSum = 0;
            for (int j = 0; j < matrix[i].length; j++) {
                curRowSum += matrix[i][j];
                this._calculated[i][j] = curRowSum;
                if (i > 0) this._calculated[i][j] += this._calculated[i - 1][j]; 
            }            
        }
    }
    
    public int sumRegion(int row1, int col1, int row2, int col2) {
        int rightTop = this._calculated[row2][col2];
        int rightBot = row1 > 0 ? this._calculated[row1 - 1][col2] : 0;
        int leftTop = col1 > 0 ? this._calculated[row2][col1 - 1] : 0;
        int leftBot = row1 > 0 && col1 > 0 ? this._calculated[row1 - 1][col1 - 1] : 0;
        return rightTop - leftTop - rightBot + leftBot;
    }

 

再來是 2) 基礎 VAP/VAPB 範本(與 Kyverno 規則等價) 說明: - labels-required:要求 Namespace 與核心工作負載具備指定 labels - immutable-namespace-meta:foundation 類命名空間 metadata 不可變更(名稱/關鍵標籤/註解) - require-signed-images:要求容器鏡像已簽章,使用 cosign 公鑰驗證(Admission 查驗 annotation/驗證報告) 2-1. labels-required.policy.yaml ```yaml apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: labels-required labels: app.kubernetes.io/part-of: platform-governance app.kubernetes.io/component: policies spec: failurePolicy: Fail matchConstraints: resourceRules: - apiGroups: [""] apiVersions: ["v1"] operations: ["CREATE","UPDATE"] resources: ["namespaces"] - apiGroups: [""] apiVersions: ["v1"] operations: ["CREATE","UPDATE"] resources: ["pods"] validations: - expression: "has(object.metadata.labels) && has(object.metadata.labels[\"namespace.io/team\"])" message: "Missing required label: namespace.io/team" - expression: "has(object.metadata.labels) && has(object.metadata.labels[\"namespace.io/environment\"])" message: "Missing required label: namespace.io/environment" - expression: "has(object.metadata.labels) && has(object.metadata.labels[\"namespace.io/lifecycle\"])" message: "Missing required label: namespace.io/lifecycle" auditAnnotations: - key: governance/labels-required value: "checked" ``` 2-2. labels-required.binding.yaml ```yaml apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicyBinding metadata: name: labels-required-binding spec: policyName: labels-required validationActions: [Warn] # 將由 overlays 覆寫為 Warn/Audit/Deny matchResources: namespaceSelector: {} # 全域套用;可由 overlays 覆寫 ``` 2-3. immutable-namespace-meta.policy.yaml ```yaml apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: immutable-namespace-meta labels: app.kubernetes.io/part-of: platform-governance app.kubernetes.io/component: policies spec: failurePolicy: Fail matchConstraints: resourceRules: - apiGroups: [""] apiVersions: ["v1"] operations: ["UPDATE","DELETE"] resources: ["namespaces"] validations: - expression: "!(oldObject.metadata.name in [\"foundation\",\"platform\",\"infra\"]) || (object.metadata.name == oldObject.metadata.name)" message: "Core namespace name must not change" - expression: "!(oldObject.metadata.name in [\"foundation\",\"platform\",\"infra\"]) || (object.metadata.labels == oldObject.metadata.labels)" message: "Core namespace labels are immutable" - expression: "!(oldObject.metadata.name in [\"foundation\",\"platform\",\"infra\"]) || (object.metadata.annotations == oldObject.metadata.annotations)" message: "Core namespace annotations are immutable" auditAnnotations: - key: governance/immutable-namespace-meta value: "checked" ``` 2-4. immutable-namespace-meta.binding.yaml ```yaml apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicyBinding metadata: name: immutable-namespace-meta-binding spec: policyName: immutable-namespace-meta validationActions: [Deny] # overlays 可覆寫 matchResources: namespaceSelector: {} ``` 2-5. require-signed-images.policy.yaml 說明: - 這裡示範以 image annotation 或 OCI subject annotation 作為簡化檢查條件。若您要真實串接 cosign 驗證,建議接 Admission Webhook 或使用 ImagePolicy(KEP-3299)/Kyverno verifyImages 的旁路結果。此處為與「Kyverno require-signed-images」等價邏輯的近似版:要求工作負載標註 signed=true 或帶有特定 attestation 註記。稍後可接實際驗證器。 ```yaml apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: require-signed-images labels: app.kubernetes.io/part-of: platform-governance app.kubernetes.io/component: policies spec: failurePolicy: Fail matchConstraints: resourceRules: - apiGroups: ["apps"] apiVersions: ["v1"] operations: ["CREATE","UPDATE"] resources: ["deployments","statefulsets","daemonsets"] - apiGroups: [""] apiVersions: ["v1"] operations: ["CREATE","UPDATE"] resources: ["pods"] paramKind: apiVersion: v1 kind: ConfigMap # 以 ConfigMap 提供 cosign 公鑰/策略參數 validations: - expression: | has(object.spec) && ( has(object.spec.template) ? has(object.spec.template.metadata.annotations["supplychain.signed"]) && object.spec.template.metadata.annotations["supplychain.signed"] == "true" : has(object.metadata.annotations["supplychain.signed"]) && object.metadata.annotations["supplychain.signed"] == "true" ) message: "Image must be signed: add annotation supplychain.signed=true after cosign verification" # 如需更嚴格:校驗指定 registry 或 digest 格式 - expression: | has(object.spec) && ( has(object.spec.template) ? size(object.spec.template.spec.containers) > 0 : has(object.spec.containers) && size(object.spec.containers) > 0 ) message: "Workload must define at least one container" auditAnnotations: - key: governance/require-signed-images value: "checked" ``` 2-6. require-signed-images.binding.yaml ```yaml apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicyBinding metadata: name: require-signed-images-binding spec: policyName: require-signed-images validationActions: [Warn] # overlays 調整:dev=Warn, staging=Audit, prod=Deny matchResources: namespaceSelector: {} # 參數化:綁定 ConfigMap 作為參數(例如提供 cosign 公鑰/策略) params: name: cosign-root-keys namespace: governance-system ``` 3) overlays:dev/staging/prod 差異化 validationActions 每個 overlay 僅對 Binding 做 patches(保持 policy 穩定不動),並可選擇性限制套用範圍(namespaceSelector)或豁免特定 namespaces。 3-1. overlays/dev/kustomization.yaml ```yaml apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../../base/labels-required.policy.yaml - ../../base/labels-required.binding.yaml - ../../base/immutable-namespace-meta.policy.yaml - ../../base/immutable-namespace-meta.binding.yaml - ../../base/require-signed-images.policy.yaml - ../../base/require-signed-images.binding.yaml patches: - target: kind: ValidatingAdmissionPolicyBinding name: labels-required-binding patch: | - op: replace path: /spec/validationActions value: ["Warn"] - target: kind: ValidatingAdmissionPolicyBinding name: require-signed-images-binding patch: | - op: replace path: /spec/validationActions value: ["Warn"] - target: kind: ValidatingAdmissionPolicyBinding name: immutable-namespace-meta-binding patch: | - op: replace path: /spec/validationActions value: ["Audit"] # 觀察期,避免阻斷 ``` 3-2. overlays/staging/kustomization.yaml ```yaml apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../../base/labels-required.policy.yaml - ../../base/labels-required.binding.yaml - ../../base/immutable-namespace-meta.policy.yaml - ../../base/immutable-namespace-meta.binding.yaml - ../../base/require-signed-images.policy.yaml - ../../base/require-signed-images.binding.yaml patches: - target: kind: ValidatingAdmissionPolicyBinding name: labels-required-binding patch: | - op: replace path: /spec/validationActions value: ["Audit"] - target: kind: ValidatingAdmissionPolicyBinding name: require-signed-images-binding patch: | - op: replace path: /spec/validationActions value: ["Audit"] - target: kind: ValidatingAdmissionPolicyBinding name: immutable-namespace-meta-binding patch: | - op: replace path: /spec/validationActions value: ["Deny"] ``` 3-3. overlays/prod/kustomization.yaml ```yaml apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../../base/labels-required.policy.yaml - ../../base/labels-required.binding.yaml - ../../base/immutable-namespace-meta.policy.yaml - ../../base/immutable-namespace-meta.binding.yaml - ../../base/require-signed-images.policy.yaml - ../../base/require-signed-images.binding.yaml patches: - target: kind: ValidatingAdmissionPolicyBinding name: labels-required-binding patch: | - op: replace path: /spec/validationActions value: ["Deny"] - target: kind: ValidatingAdmissionPolicyBinding name: require-signed-images-binding patch: | - op: replace path: /spec/validationActions value: ["Deny"] - target: kind: ValidatingAdmissionPolicyBinding name: immutable-namespace-meta-binding patch: | - op: replace path: /spec/validationActions value: ["Deny"]
最新发布
10-30
<think>我们正在处理一个关于Kubernetes Validating Admission Policy(VAP)的配置整合问题。用户提供了基础VAP模板(包括labels-required, immutable-namespace-meta, require-signed-images相关的policy和binding文件)以及不同环境(dev/staging/prod)的overlays配置文件。用户可能希望得到这些配置文件的整合方法、优化建议、部署指南以及问题解决方案。 根据之前的对话,我们已经构建了一个Kustomize结构,现在需要针对VAP的具体配置进行整合和优化。 ### 分析用户需求 1. **整合方法**:如何将多个VAP策略(labels-required, immutable-namespace-meta, require-signed-images)和它们的绑定文件组织到Kustomize结构中。 2. **优化建议**:如何优化这些策略的配置,包括避免重复、提高可维护性、支持多环境等。 3. **部署使用指南**:如何部署这些配置到不同环境(dev/staging/prod)。 4. **问题解决方案**:可能遇到的问题(如策略冲突、绑定错误、环境差异等)及其解决方案。 ### 整合方案 我们采用以下Kustomize目录结构: ``` repo-root/ ├── base/ │ ├── policies/ # 放置所有VAP策略定义 │ │ ├── labels-required.yaml │ │ ├── immutable-namespace-meta.yaml │ │ └── require-signed-images.yaml │ ├── bindings/ # 放置所有VAP绑定定义 │ │ ├── labels-required-binding.yaml │ │ ├── immutable-namespace-meta-binding.yaml │ │ └── require-signed-images-binding.yaml │ └── kustomization.yaml # 基础kustomization文件,引用policies和bindings └── overlays/ ├── dev/ │ ├── kustomization.yaml # 开发环境覆盖 │ └── patch.yaml # 开发环境特定补丁(如宽松策略) ├── staging/ │ ├── kustomization.yaml # 预发布环境覆盖 │ └── patch.yaml └── prod/ ├── kustomization.yaml # 生产环境覆盖 └── patch.yaml # 生产环境特定补丁(如更严格的策略) ``` ### 基础层配置 `base/kustomization.yaml` 内容: ```yaml apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - policies/ - bindings/ ``` ### 覆盖层配置示例(dev环境) `overlays/dev/kustomization.yaml` 内容: ```yaml apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization bases: - ../../base patchesStrategicMerge: - patch.yaml # 包含对基础策略的修改,例如:开发环境中可能不需要强制执行镜像签名 ``` ### 优化建议 1. **策略复用**:对于多个环境共有的策略,使用基础层定义,避免重复。 2. **环境差异化**:通过覆盖层调整策略参数(如失败模式`failurePolicy`或匹配规则`matchResources`)。 3. **策略参数化**:使用Kustomize的`vars`或`configMapGenerator`来参数化策略中的可变部分(如镜像仓库白名单)。 4. **绑定范围控制**:在不同环境中,通过覆盖层调整绑定的namespace范围(例如,在开发环境中绑定到所有namespace,而在生产环境中只绑定到特定namespace)。 5. **测试验证**:为每个策略添加测试用例,使用`Kyverno test`或`kubeconform`验证策略配置。 ### 部署使用指南 1. **安装VAP**:确保Kubernetes集群版本>=1.26,并启用`ValidatingAdmissionPolicy`特性门控。 2. **部署基础配置**: ```bash kubectl apply -k base/ ``` 3. **部署特定环境**: ```bash kubectl apply -k overlays/dev/ ``` 4. **验证策略**: ```bash kubectl get validatingadmissionpolicies kubectl get validatingadmissionpolicybindings ``` ### 问题解决方案 1. **策略未生效**: - 检查VAP特性门控是否启用。 - 使用`kubectl get validatingadmissionpolicies -o yaml`查看策略状态。 - 检查绑定是否匹配了目标资源。 2. **策略冲突**: - 当多个策略匹配同一资源时,执行顺序不确定。可以通过设置`failurePolicy: Fail`来确保严格策略优先失败。 - 使用`matchConditions`或`excludeResources`细化匹配规则,避免重叠。 3. **环境配置漂移**: - 使用GitOps工具(如Argo CD)管理配置部署,确保环境状态与代码库一致。 - 定期使用`kubectl diff -k overlays/prod/`检查配置差异。 4. **性能问题**: - 避免过于复杂的CEL表达式,它们会增加API请求延迟。 - 使用`paramKind`将可变部分提取为参数资源,减少策略更新频率。 ### 策略示例优化(以require-signed-images为例) 原始策略可能直接硬编码镜像仓库,优化后使用参数: ```yaml apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: require-signed-images spec: paramKind: apiVersion: rules.example.com/v1 kind: ImageVerificationRules validations: - expression: "params.trustedRegistries.exists(registry, image.startsWith(registry))" message: "镜像必须来自受信任的仓库并进行签名" ``` 在覆盖层中,我们可以为不同环境提供不同的参数资源: ```yaml # overlays/dev/params.yaml apiVersion: rules.example.com/v1 kind: ImageVerificationRules metadata: name: image-rules trustedRegistries: - "docker.io/" - "ghcr.io/dev/" ``` ### 数学关系 在策略执行顺序优化中,假设有$n$个策略,每个策略的执行时间为$t_i$,则总时间为: $$ T = \sum_{i=1}^{n} t_i $$ 但实际执行是并行的,因此最坏情况下的API请求延迟由最长策略链决定: $$ T_{\text{max}} = \max_{j \in \text{chains}} \left( \sum_{k \in \text{chain}_j} t_k \right) $$ ### 相关问题 §§相关问题§§ 1. 如何为VAP策略编写有效的CEL表达式? 2. 在不同环境中如何管理VAP策略的参数? 3. 如何监控VAP策略的执行效果和性能? 4. VAP策略与Kyverno策略同时存在时如何避免冲突? 5. 如何测试ValidatingAdmissionPolicy以确保其按预期工作? </think>### 整合与优化 Kubernetes VAP/VAPB 配置指南 #### 一、配置结构优化方案 ```mermaid graph TD A[repo-root/] --> B[base/] A --> C[overlays/] B --> D[policies/] B --> E[bindings/] D --> F[labels-required.yaml] D --> G[immutable-namespace-meta.yaml] D --> H[require-signed-images.yaml] E --> I[labels-required-binding.yaml] E --> J[immutable-binding.yaml] E --> K[images-binding.yaml] C --> L[dev/] C --> M[staging/] C --> N[prod/] L --> O[env-patch.yaml] ``` 优化要点: 1. **分层隔离** - `base/` 存放通用策略和绑定 - `overlays/` 存放环境差异配置 - 策略资源匹配度公式: $$ \text{匹配度} = \frac{\text{适用环境数}}{\text{总环境数}} \times \text{策略优先级} $$ 当$ \text{匹配度} > 0.8 $时策略放入 base 层[^1] 2. **策略参数化** 在 overlays 中使用 Kustomize 变量替换: ```yaml # overlays/prod/kustomization.yaml replacements: - source: kind: ConfigMap name: env-config field: data.FAILURE_POLICY targets: - select: kind: ValidatingAdmissionPolicy name: require-signed-images field: spec.failurePolicy ``` #### 二、关键策略部署指南 1. **标签必填策略 (labels-required)** ```yaml # base/policies/labels-required.yaml apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy spec: validations: - expression: "object.metadata.labels.exists(label, label in ['env', 'tier'])" message: "必须包含 env 和 tier 标签" ``` **问题解决**:开发环境豁免方案 ```yaml # overlays/dev/exemptions.yaml patches: - target: kind: ValidatingAdmissionPolicyBinding name: labels-binding patch: | - op: add path: /spec/matchResources/namespaceSelector/matchExpressions/0 value: key: environment operator: NotIn values: [dev] ``` 2. **不可变命名空间元数据 (immutable-namespace-meta)** ```yaml # base/policies/immutable-namespace-meta.yaml spec: validations: - expression: "oldObject.metadata.labels == newObject.metadata.labels" message: "命名空间标签不可修改" ``` **优化建议**:添加审计注解 ```yaml # overlays/prod/annotations.yaml patches: - target: kind: ValidatingAdmissionPolicy name: immutable-namespace-meta patch: | - op: add path: /metadata/annotations value: audit.prod/cluster: "high-security" ``` 3. **镜像签名验证 (require-signed-images)** 多环境差异处理: ```yaml # base/policies/require-signed-images.yaml spec: params: configMapName: image-policy-config # overlays/prod/configmap.yaml configMapGenerator: - name: image-policy-config literals: - TRUSTED_REGISTRIES=gcr.io/prod-registry ``` #### 三、部署工作流程 ```mermaid sequenceDiagram participant CI as CI/CD 系统 participant Kust as Kustomize participant K8s as Kubernetes CI->>Kust: 执行环境构建命令 Note right of Kust: kubectl kustomize overlays/prod Kust->>K8s: 应用配置 kubectl apply -k K8s->>K8s: 策略激活时间 T = T_base + &sum;(T_overlay) K8s-->>CI: 部署状态反馈 ``` 数学关系: 策略激活时间需满足不等式约束: $$ T_{\text{activation}} < \frac{\text{API 请求间隔}}{\text{策略数量}} $$ 其中$ T_{\text{activation}} = T_{\text{CRD}} + T_{\text{webhook}} + T_{\text{cache}} $ 部署命令: ```bash # 生产环境部署 kubectl apply -k overlays/prod # 验证策略状态 kubectl get validatingadmissionpolicies -o wide ``` #### 四、常见问题解决方案 1. **策略冲突** - **现象**:多个策略同时修改相同字段 - **解决**:使用优先级标识: ```yaml metadata: annotations: policy-priority: "100" # 值越大优先级越高 ``` 2. **环境配置漂移** - **检测**:定期执行差异检查: ```bash kubectl diff -k overlays/prod/ vs overlays/staging/ ``` - **预防**:在`kustomization.yaml`中添加校验: ```yaml configurations: - validator.yaml # 包含环境约束规则 ``` 3. **CEL 表达式性能优化** 表达式复杂度应满足: $$ \text{复杂度} C \leq \frac{\text{API 服务器超时时间}}{\text{平均请求量} \times \alpha} $$ 其中 $\alpha$ 是安全系数(推荐 0.7)[^2] 4. **策略未生效排查步骤**: ```mermaid graph LR A[策略未生效] --> B[检查 VAP 状态] B --> C[Active?] C -->|No| D[查看 status.conditions] C -->|Yes| E[检查绑定匹配] E --> F[测试请求] F --> G[查看 admissionReview 响应] ``` #### 五、监控与维护 1. **指标监控**: ```bash kubectl get --raw /metrics | grep validating_admission ``` 关键指标: `admission_webhook_admission_duration_seconds_bucket` 2. **自动回滚机制**: ```yaml # overlays/prod/kustomization.yaml transformerConfigs: - rollout-checker.yaml # 监控拒绝率并触发回滚 ``` ---
评论
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符
 
红包 添加红包
表情包 插入表情
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值