Method for realizing Kubernetes cluster service public network access through P2P network and gateway

Abstract

The invention provides a method for achieving Kubernetes cluster service public network access through a P2P network and a gateway. The method is characterized in that the method is based on a Service Controller assembly, a gateway system, a P2P virtual network and a DNS system; comprising the following steps: S1, deploying a gateway system, and configuring domain names and extensive domain name certificates; s2, deploying a P2P system; s3, configuring a routing forwarding rule for the P2P node of the K8S cluster through the P2P server; s4, the resource change in the Kubernetes cluster is monitored in real time; s5, performing gateway configuration; according to the invention, through the P2P virtual network and the point-to-point distributed architecture, the risk of single point failure is eliminated, through end-to-end encryption and dynamic key negotiation, the risk of certificate leakage is prevented, and through a multi-level security mechanism, the overall security of the system is enhanced, the network forwarding level is reduced, and the service access delay is reduced.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to a method for implementing public network access to Kubernetes cluster services through a P2P network and a gateway. Background Art

[0002] With the rapid development of cloud computing and container technology, Kubernetes has become a standard platform for enterprises to build cloud-native applications. Through its powerful container orchestration capabilities, Kubernetes helps enterprises realize the automated deployment, expansion and management of applications. However, as the scale of enterprise business expands and the complexity of distributed systems increases, how to achieve secure and efficient interconnection between multiple Kubernetes clusters and securely open internal services to the public network has become an urgent problem to be solved. In the existing technology, the above problems are usually solved through VPN, cloud service provider, and Service Mesh. These three solutions mainly have problems in security and operation and maintenance. In terms of security, VPN has the risk of single point failure and credential leakage, API gateway may become an attack target, and lacks end-to-end encryption protection. In terms of operation and maintenance, it is necessary to maintain a complex network topology, the configuration process is cumbersome and prone to errors, and multi-component deployment increases the difficulty of maintenance. In addition, these solutions also face performance and scalability challenges. The centralized architecture leads to performance bottlenecks and high cross-region access latency. At the same time, it is difficult to adapt to dynamic service changes. The expansion process requires a lot of manual operations and has limited support in cross-cloud deployment scenarios, which seriously affects the efficiency of enterprises using Kubernetes in large-scale distributed environments. Summary of the invention

[0003] The purpose of the present invention is to solve the shortcomings of the prior art and propose a method for implementing public network access to Kubernetes cluster services through a P2P network and a gateway.

[0004] To achieve the above object, the present invention adopts the following technical solutions: A method for implementing public network access to Kubernetes cluster services through a P2P network and a gateway, the method being based on a Service Controller component, a gateway system, a P2P virtual network, and a DNS system; The Service Controller component is deployed inside the Kubernetes cluster and is used to monitor changes in resources in Kubernetes and dynamically update gateway routing rules; The gateway system is used for the management and termination of SSL / TLS certificates, and for optimizing service performance through a multi-level load balancing strategy; The P2P virtual network is used to build a P2P-based secure communication tunnel, supporting end-to-end encrypted communication and dynamic node management; The DNS system is used to manage service domain names, provide policy-based intelligent resolution and selection of nearby access nodes, and has an automatic failover function; The following sub-steps are included: S1: Deploy the gateway system, configure the domain name and wildcard domain name certificate; The following sub-steps are included: S11: Deploy the gateway system; The following sub-steps are included: S111: Assess and prepare the basic environment; Before deploying the gateway system, evaluate and prepare the basic environment, including hardware resource evaluation, operating system configuration, and database preparation; Specifically, perform a hardware resource assessment in advance, the hardware resources include computing resources CPU, memory RAM, storage, network bandwidth, etc.; ensure that the hardware resources meet the minimum requirements of the gateway; Select a stable Linux distribution operating system, such as CentOS, Ubuntu, Debian, etc., and ensure that the kernel version of the selected operating system meets the gateway requirements, that is, supports Linux kernel 4.x or higher; and configure the network parameters, file descriptor limits, and kernel parameters of this operating system; Deploy a high-availability PostgreSQL database as the backend storage of the gateway and perform performance optimization; the performance optimization includes index optimization, query optimization and cache strategy; S112: deploying a gateway; The architecture of separating the control plane and data plane is used to implement the deployment of API gateway; Specifically, deploy the control plane node of the gateway, perform configuration management of the API gateway through the control plane node, and the configuration includes routing, authentication, flow control, etc.; and use the gateway Admin API for configuration management; Deploy multiple gateway data plane nodes to process actual API requests through the data plane nodes. Each data plane node independently processes external API requests, including request forwarding, response return, API request load balancing, authentication and authorization, etc. S12: Configure domain name; The following sub-steps are included: S121: Register the primary domain name; Choose a suitable domain name registrar based on actual needs and register a primary domain name that meets business or personal needs; S122: Configure A record and wildcard domain name resolution record; Log in to the control panel of the selected domain name registrar, and in the DNS management or domain name resolution settings option of the domain name management interface, add a new A record to point the registered primary domain name to the public IP address of the gateway; The A record is a type of DNS record used to map a domain name to a corresponding IPv4 address; it includes a primary domain name, type, value, TTL, etc.; the primary domain name is the registered primary domain name, the type is an A record, the value is the public IP address of the gateway, and the TTL lifetime is usually 300 seconds; Add a wildcard domain name resolution record in the DNS management of the domain name management interface, and configure the A record of the wildcard domain name resolution so that the A record of the wildcard domain name resolution points to the same public IP address as the primary domain name; the wildcard domain name resolution record is a type of DNS record, so that all subdomains under the registered primary domain name point to the same IP address, that is, the public IP address; S123: Verify domain name resolution; After the configuration is complete, use the nslookup or dig tool in the command line terminal to verify that each primary domain name and subdomain name points to the public IP address; S13: Configure wildcard domain name certificate; Apply for wildcard domain name certificates and distribute them; Use automated tools such as Certbot to apply for a wildcard certificate. After successfully applying for a wildcard certificate, distribute the wildcard certificate to all gateway nodes that need to use it, ensuring that the wildcard certificate is consistent on all gateway nodes so that the gateway can process HTTPS requests. At the same time, automated tools are used to manage wildcard domain name certificates to ensure timely updates and security of certificates.

[0005] S2: deploy P2P system; The following sub-steps are included: S21: Deploy the core components of the P2P server; The core components of the P2P server include deployment of a P2P management server, a signaling server, and a user authentication management system; The P2P management server is used to manage the entire P2P network, including node registration, connection, routing and other functions; the signaling server is used for signal transmission between nodes; the user authentication management system is used to verify the identity of each node to ensure that only authenticated nodes can join the P2P network; Generate and configure the registration KEY required for P2P node registration. The registration KEY consists of a key pair, which includes a public key and a private key. The private key is kept by the node, and the public key is shared by other nodes. Generate a key pair using OpenSSL, GPG or other encryption tools, configure the generated registration KEY into the P2P management system, and verify the nodes to be added to the P2P network; S22: deploy P2P client nodes; On the gateway node, use the Docker container and the registration key provided by the P2P server to register and verify the node, and deploy the P2P client; In the Kubernetes cluster, deploy multiple P2P client instances using the StatefulSet controller and the registration key provided by the P2P server.

[0006] S3: Configure routing and forwarding rules for the K8S cluster P2P nodes through the P2P server; Log in to the P2P server management interface and create routing rules; The routing rule includes a target network, a next hop, a priority, and a description. Specifically, the IP range of the Pod in the K8S cluster is entered in the target network, a P2P node in the K8S cluster is selected as the next hop, the priority of the routing rule is set, and a description of the routing rule is added. After the creation is completed, the routing rules are saved to the P2P server, and the P2P server distributes the routing rules to all relevant P2P nodes, so that the P2P nodes can perform routing forwarding according to the rules; The P2P nodes inside the K8S cluster periodically synchronize routing rules from the P2P server. When the P2P nodes receive new routing rules, they update their routing tables according to the rules. On the gateway node, try to access the IP addresses of the Pods and Services inside the K8S cluster. If the routing rules are configured correctly, the gateway node successfully accesses the Pods and Services inside K8S and achieves direct communication.

[0007] S4: monitors resource changes in the Kubernetes cluster in real time; The following sub-steps are included: S41: monitor service resource changes; Monitor service resource changes in the Kubernetes cluster in real time through the Service Controller component deployed in the Kubernetes cluster; S42: Start the automatic configuration process and collect metadata information; When monitoring the creation, update, or deletion of a service, the Service Controller component starts the automatic configuration process and collects metadata information about the service; The automatic configuration process includes automatic configuration of network settings, logs, monitoring, authorization, etc. of this service; The metadata information includes the service's port, protocol, selector, path, load balancing configuration, etc.

[0008] S5: Perform gateway configuration; The following sub-steps are included: S51: Generate gateway routing rules according to service information; Based on the metadata information of the service, the gateway generates gateway routing rules according to the port, protocol, and path of the new service; Configure path mapping for services according to their specific needs and configure corresponding security policies; S52: Automatic certificate management and HTTPS configuration; Generate SSL / TLS certificates for services through integrated certificate management tools or certificate management tools in Kubernetes; and configure HTTPS routing for services to achieve encrypted transmission of requests; S53: Implement the load balancing strategy of the request; The gateway configures load balancing strategies for the service, including polling, minimum number of connections, weighted load balancing, health check and failover, etc. Implement public network access to Kubernetes cluster services.

[0009] Compared with the prior art, the present invention has the following beneficial effects: The present invention eliminates the risk of single point failure in VPN solutions through P2P virtual networks and point-to-point distributed architecture, prevents the risk of credential leakage in VPN solutions through end-to-end encryption and dynamic key negotiation, and enhances the overall security of the system through multi-level security mechanisms, including HTTPS, P2P encryption and network isolation; Through P2P direct connection, the network forwarding level is reduced and the service access delay is reduced; through distributed architecture and efficient data transmission mechanism, the system throughput is improved; through automatic registration and discovery of services by Service Controller, the service discovery process of K8S Service is simplified; through dynamic update of gateway routing rules, the gateway service routing registration is automated; through unified gateway management, the configuration complexity is reduced and the operation and maintenance efficiency is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 The present invention is a flowchart of the steps of a method for implementing public network access to Kubernetes cluster services through a P2P network and a gateway. DETAILED DESCRIPTION

[0011] In order to provide a further understanding of the purpose, structure, features, and functions of the present invention, the following detailed description is given in conjunction with the embodiments.

[0012] like Figure 1 As shown, a method for implementing public network access to Kubernetes cluster services through a P2P network and a gateway is based on a Service Controller component, a gateway system, a P2P virtual network, and a DNS system; The Service Controller component is deployed inside the Kubernetes cluster and is used to monitor changes in resources in Kubernetes and dynamically update gateway routing rules; The gateway system is used for the management and termination of SSL / TLS certificates, and for optimizing service performance through a multi-level load balancing strategy; The P2P virtual network is used to build a P2P-based secure communication tunnel, supporting end-to-end encrypted communication and dynamic node management; The DNS system is used to manage service domain names, provide policy-based intelligent resolution and selection of nearby access nodes, and has an automatic failover function; Through the collaborative work of these core components, the present invention can efficiently and securely open the k8s intranet service to the public network, while simplifying the operation and maintenance management process and improving the scalability and reliability of the system.

[0013] The following sub-steps are included: S1: Deploy the gateway system, configure the domain name and wildcard domain name certificate; The following sub-steps are included: S11: Deploy the gateway system; The following sub-steps are included: S111: Assess and prepare the basic environment; Before deploying the gateway system, evaluate and prepare the basic environment, including hardware resource evaluation, operating system configuration, and database preparation; Specifically, perform a hardware resource assessment in advance, the hardware resources include computing resources CPU, memory RAM, storage, network bandwidth, etc.; ensure that the hardware resources meet the minimum requirements of the gateway; Specifically, select the appropriate CPU configuration based on the expected API interface request traffic and processing complexity, select the appropriate memory capacity based on the expected load, and ensure that the storage capacity can meet daily operation needs, ensure that the bandwidth is sufficient to support traffic demand, and configure redundant networks to cope with traffic surges in high concurrency situations; Select a stable Linux distribution operating system, such as CentOS, Ubuntu, Debian, etc., and ensure that the kernel version of the selected operating system meets the gateway requirements, that is, supports Linux kernel 4.x or higher; and configure the network parameters, file descriptor limits, and kernel parameters of this operating system; Deploy a high-availability PostgreSQL database as the backend storage of the gateway and perform performance optimization; the performance optimization includes index optimization, query optimization and cache strategy; By evaluating hardware resources, ensure that the server has sufficient computing power and storage space to support the stable operation and scalability of the gateway; S112: deploying a gateway; The architecture of separating the control plane and data plane is used to implement the deployment of API gateway; Specifically, deploy the control plane node of the gateway, perform configuration management of the API gateway through the control plane node, and the configuration includes routing, authentication, flow control, etc.; and use the gateway Admin API for configuration management; Deploy multiple gateway data plane nodes to process actual API requests through the data plane nodes. Each data plane node independently processes external API requests, including request forwarding, response return, API request load balancing, authentication and authorization, etc. S12: Configure domain name; The following sub-steps are included: S121: Register the primary domain name; Choose a suitable domain name registrar based on actual needs and register a primary domain name that meets business or personal needs; S122: Configure A record and wildcard domain name resolution record; Log in to the control panel of the selected domain name registrar, and in the DNS management or domain name resolution settings option of the domain name management interface, add a new A record to point the registered primary domain name to the public IP address of the gateway; The A record is a type of DNS record used to map a domain name to a corresponding IPv4 address; it includes a primary domain name, type, value, TTL, etc.; the primary domain name is the registered primary domain name, the type is an A record, the value is the public IP address of the gateway, and the TTL lifetime is usually 300 seconds; Add a wildcard domain name resolution record in the DNS management of the domain name management interface, and configure the A record of the wildcard domain name resolution so that the A record of the wildcard domain name resolution points to the same public IP address as the primary domain name; the wildcard domain name resolution record is a type of DNS record, so that all subdomains under the registered primary domain name point to the same IP address, that is, the public IP address; S123: Verify domain name resolution; After the configuration is complete, use the nslookup or dig tool in the command line terminal to verify that each primary domain name and subdomain name points to the public IP address; S13: Configure wildcard domain name certificate; Apply for wildcard domain name certificates and distribute them; Use automated tools such as Certbot to apply for a wildcard certificate. After successfully applying for a wildcard certificate, distribute the wildcard certificate to all gateway nodes that need to use it, ensuring that the wildcard certificate is consistent on all gateway nodes so that the gateway can process HTTPS requests. At the same time, automated tools are used to manage wildcard domain name certificates to ensure timely updates and security of certificates.

[0014] By registering a domain name, configuring A records, setting up wildcard domain name resolution, and finally applying for and configuring a wildcard domain name SSL certificate, all subdomains can be securely accessed through HTTPS.

[0015] S2: deploy P2P system; The following sub-steps are included: S21: Deploy the core components of the P2P server; The core components of the P2P server include deployment of a P2P management server, a signaling server, and a user authentication management system; The P2P management server is used to manage the entire P2P network, including node registration, connection, routing and other functions; the signaling server is used for signal transmission between nodes; the user authentication management system is used to verify the identity of each node to ensure that only authenticated nodes can join the P2P network; Generate and configure the registration KEY required for P2P node registration. The registration KEY consists of a key pair, which includes a public key and a private key. The private key is kept by the node, and the public key is shared by other nodes. Generate a key pair using OpenSSL, GPG or other encryption tools, configure the generated registration KEY into the P2P management system, and verify the nodes to be added to the P2P network; S22: deploy P2P client nodes; On the gateway node, use the Docker container and the registration key provided by the P2P server to register and verify the node, and deploy the P2P client; In the Kubernetes cluster, deploy multiple P2P client instances using the StatefulSet controller and the registration key provided by the P2P server.

[0016] S3: Configure routing and forwarding rules for the K8S cluster P2P nodes through the P2P server; Log in to the P2P server management interface and create routing rules; The routing rule includes a target network, a next hop, a priority, and a description. Specifically, the IP range of the Pod in the K8S cluster is entered in the target network, a P2P node in the K8S cluster is selected as the next hop, the priority of the routing rule is set, and a description of the routing rule is added. After the creation is completed, the routing rules are saved to the P2P server, and the P2P server distributes the routing rules to all relevant P2P nodes, so that the P2P nodes can perform routing forwarding according to the rules; The P2P nodes inside the K8S cluster periodically synchronize routing rules from the P2P server. When the P2P nodes receive new routing rules, they update their routing tables according to the rules. On the gateway node, try to access the IP addresses of the Pods and Services inside the K8S cluster. If the routing rules are configured correctly, the gateway node successfully accesses the Pods and Services inside K8S and achieves direct communication.

[0017] S4: monitors resource changes in the Kubernetes cluster in real time; The following sub-steps are included: S41: monitor service resource changes; Monitor service resource changes in the Kubernetes cluster in real time through the Service Controller component deployed in the Kubernetes cluster; S42: Start the automatic configuration process and collect metadata information; When monitoring the creation, update, or deletion of a service, the Service Controller component starts the automatic configuration process and collects metadata information about the service; The automatic configuration process includes automatic configuration of network settings, logs, monitoring, authorization, etc. of this service; The metadata information includes the service's port, protocol, selector, path, load balancing configuration, etc.

[0018] S5: Perform gateway configuration; The following sub-steps are included: S51: Generate gateway routing rules according to service information; Based on the metadata information of the service, the gateway generates gateway routing rules according to the port, protocol, and path of the new service; Configure path mapping for services according to their specific needs and configure corresponding security policies; S52: Automatic certificate management and HTTPS configuration; Generate SSL / TLS certificates for services through integrated certificate management tools or certificate management tools in Kubernetes; and configure HTTPS routing for services to achieve encrypted transmission of requests; S53: Implement the load balancing strategy of the request; The gateway configures load balancing strategies for the service, including polling, least number of connections, weighted load balancing, health check and failover.

[0019] Implement public network access to Kubernetes cluster services.

[0020] The present invention constructs a full-link security protection system from the client to the server; by implementing transmission encryption, it supports complete certificate chain verification to prevent data from being eavesdropped or tampered with during transmission; based on P2P technology, point-to-point encrypted communication is realized, and node identity authentication is performed through asymmetric encryption to ensure the secure transmission of data in the virtual network; all encryption certificates are automatically applied for, distributed and rotated by a unified certificate management center, reducing the operation and maintenance costs of certificate management; at the access control level, a unified gateway and P2P network policy control center are constructed; all access policies can be updated in real time and issued to each execution layer, including gateways and P2P nodes.

[0021] The present invention has been described by the above-mentioned relevant embodiments, however, the above-mentioned embodiments are only examples for implementing the present invention. It must be pointed out that the disclosed embodiments do not limit the scope of the present invention. On the contrary, changes and modifications made without departing from the spirit and scope of the present invention are all within the scope of patent protection of the present invention.

Claims

1. A method for implementing public network access to Kubernetes cluster services through a P2P network and a gateway, characterized in that: Based on Service Controller components, gateway system, P2P virtual network and DNS system; The following steps are involved: S1: Deploy the gateway system, configure the domain name and wildcard domain name certificate; The following sub-steps are included: S11: Deploy the gateway system; Before deploying the gateway system, evaluate and prepare the basic environment, including hardware resource evaluation, operating system configuration, and database preparation; After the evaluation is completed, the API gateway is deployed using an architecture that separates the control plane and data plane. S12: Configure domain name; Choose a suitable domain name registrar based on actual needs and register a primary domain name that meets business or personal needs; Configure A records and wildcard domain name resolution records. After configuration is complete, verify the domain name resolution. S13: Configure wildcard domain name certificate; Apply for wildcard domain name certificates and distribute them; Use automated tools such as Certbot to apply for a wildcard certificate. After successfully applying for a wildcard certificate, distribute the wildcard certificate to all gateway nodes that need to use it, ensuring that the wildcard certificate is consistent on all gateway nodes so that the gateway can process HTTPS requests. At the same time, use automated tools to manage wildcard domain name certificates; S2: deploy P2P system; The following sub-steps are included: S21: Deploy the core components of the P2P server; S22: deploy P2P client nodes; S3: Configure routing and forwarding rules for the K8S cluster P2P nodes through the P2P server; Log in to the P2P server management interface and create routing rules; After the creation is complete, configure the routing forwarding rules for the K8S cluster P2P nodes through the P2P server; S4: monitors resource changes in the Kubernetes cluster in real time; The following sub-steps are included: S41: monitor service resource changes; S42: Start the automatic configuration process and collect metadata information; S5: Perform gateway configuration; The following sub-steps are included: S51: Generate gateway routing rules according to service information; S52: Automatic certificate management and HTTPS configuration; S53: Implement the load balancing strategy for the request.

2. The method for implementing public network access to Kubernetes cluster services through a P2P network and a gateway as claimed in claim 1, characterized in that: Step S12 includes the following sub-steps: S121: Register the primary domain name; Choose a suitable domain name registrar based on actual needs and register a primary domain name that meets business or personal needs; S122: Configure A record and wildcard domain name resolution record; Log in to the control panel of the selected domain name registrar, and in the DNS management or domain name resolution settings option of the domain name management interface, add a new A record to point the registered primary domain name to the public IP address of the gateway; The A record is a type of DNS record used to map a domain name to a corresponding IPv4 address; the primary domain name is the registered primary domain name, the type is an A record, and the value is the public IP address of the gateway; Add a wildcard domain name resolution record in the DNS management of the domain name management interface, and configure the A record of the wildcard domain name resolution so that the A record of the wildcard domain name resolution points to the same public IP address as the primary domain name; The wildcard domain name resolution record is a type of DNS record, which enables all subdomains under the registered primary domain name to point to the same IP address, i.e., the public IP address; S123: Verify domain name resolution; After the configuration is complete, use the nslookup or dig tool in the command line terminal to verify that each primary domain name and subdomain name points to the public IP address.

3. The method for implementing public network access to Kubernetes cluster services through a P2P network and a gateway as claimed in claim 1, characterized in that: The specific content of step S2 is as follows: S21: Deploy the core components of the P2P server; The core components of the P2P server include deploying a P2P management server, a signaling server, and a user authentication management system; The P2P management server is used to manage the entire P2P network, including node registration, connection, and routing functions; the signaling server is used for signal transmission between nodes; the user authentication management system is used to verify the identity of each node to ensure that only authenticated nodes can join the P2P network; Generate and configure the registration KEY required for P2P node registration. The registration KEY consists of a key pair, which includes a public key and a private key. The private key is kept by the node, and the public key is shared by other nodes. Generate a key pair using OpenSSL, GPG or other encryption tools, configure the generated registration KEY into the P2P management system, and verify the nodes to be added to the P2P network; S22: deploy P2P client nodes; On the gateway node, use the Docker container and the registration key provided by the P2P server to register and verify the node, and deploy the P2P client; In the Kubernetes cluster, deploy multiple P2P client instances using the StatefulSet controller and the registration key provided by the P2P server.

4. The method for implementing public network access to Kubernetes cluster services through a P2P network and a gateway as claimed in claim 1, characterized in that: The specific content of step S3 is as follows: Log in to the P2P server management interface and create routing rules; The routing rule includes a target network, a next hop, a priority, and a description. Specifically, the IP range of the Pod in the K8S cluster is entered in the target network, a P2P node in the K8S cluster is selected as the next hop, the priority of the routing rule is set, and a description of the routing rule is added. After the creation is completed, the routing rules are saved to the P2P server, and the P2P server distributes the routing rules to all relevant P2P nodes, so that the P2P nodes can perform routing forwarding according to the rules; The P2P nodes inside the K8S cluster periodically synchronize routing rules from the P2P server. When the P2P nodes receive new routing rules, they update their routing tables according to the rules. On the gateway node, try to access the IP addresses of the Pods and Services inside the K8S cluster. If the routing rules are configured correctly, the gateway node successfully accesses the Pods and Services inside K8S and achieves direct communication.

5. The method for implementing public network access to Kubernetes cluster services through a P2P network and a gateway as claimed in claim 1, characterized in that: The specific contents of step S4 are as follows: S41: monitor service resource changes; Monitor service resource changes in the Kubernetes cluster in real time through the Service Controller component deployed in the Kubernetes cluster; S42: Start the automatic configuration process and collect metadata information; When monitoring the creation, update, or deletion of a service, the Service Controller component starts the automatic configuration process and collects metadata information about the service; The automatic configuration process includes the automatic configuration of network settings, logs, monitoring, and authorization for this service.

6. The method for implementing public network access to Kubernetes cluster services through a P2P network and a gateway as claimed in claim 1, characterized in that: The specific contents of step S5 are as follows: S51: Generate gateway routing rules according to service information; Based on the metadata information of the service, the gateway generates gateway routing rules according to the port, protocol, and path of the new service; Configure path mapping for services according to their specific needs and configure corresponding security policies; S52: Automatic certificate management and HTTPS configuration; Generate SSL / TLS certificates for services using integrated certificate management tools or certificate management tools in Kubernetes; And configure HTTPS routing for the service to achieve encrypted transmission of requests; S53: Implement the load balancing strategy of the request; The gateway configures a load balancing policy for the service to enable public network access to the Kubernetes cluster service. Implement public network access to Kubernetes cluster services.

Images