Network security service configuration method and device and electronic equipment

Abstract

The invention discloses a network security service configuration method, which comprises the following steps: when an application service created by any user is obtained, generating a firewall CRD rule resource corresponding to the application service according to a preset black and white list configuration rule; when the firewall CRD rule resource is monitored, judging whether an application service corresponding to the firewall CRD rule resource is deployed to a local container or not; and when an application service corresponding to the firewall CRD rule resource is deployed to a local container, writing the firewall CRD rule resource into a kernel module through a ct - filter tool. According to the method, firewall black and white list configuration rules on each host are defined in a k8s operator programmable mode, meanwhile, the configuration rules are deployed to a specified K8S node, the k8s operator controls firewall configuration in a final state mode to update and refresh, the firewall configuration can be configured along with a deployed working node of an application service container, and the configuration efficiency of the application service container is improved. And meanwhile, the method has relatively high flexibility and expansibility.

Description

technical field [0001] The invention relates to the technical field of big data analysis, in particular to a network security service configuration method, device and electronic equipment. Background technique [0002] In the k8s environment, using the iptables command to maintain the host firewall rules has the following three problems: When the number of iptables entries and firewall entries on the machine is large, there is a certain probability of operation conflicts. After the operation conflicts, the firewalld background service will be abnormal. Or the kube-proxy guardian container network rules are lost, which eventually leads to abnormal service on the external request machine; the entry distributed in the netfilter framework of the protocol stack by the container network is earlier than the filtering entry of the firewall, resulting in the failure of data packets entering the container network. Get the effective control of the firewall; k8s has made unified schedul...

AI Technical Summary

Problems solved by technology

[0003] Therefore, the technical problem to be solved by the present invention is to overcome the defects that the existing host firewall and k8s components conflict, the host firewall cannot control container network messages, and the firewall rules cannot follow the destination node scheduled by k8s, thereby providing a network security service configuration method , devices and electronic equipment

Images