Kubernetes-based DMZ area dynamic configuration access system, method and equipment and storage medium

Abstract

The invention relates to a Kubernetes-based DMZ area dynamic configuration access system, method and device and a storage medium, the system creates an Ingress object and a Service object corresponding to each computing service in a Kubernetes cluster through a deployment module, and the Ingress object and the Service object are configured with corresponding forwarding rules; the domain name resolution information of the CoreDNS component is configured; an access request of a terminal user is forwarded to the Ingress controller through a Kubernetes cluster; through the Ingress controller, based on the access request, a corresponding forwarding rule is matched, the IP address of the computing service is obtained through the CoreDNS component, and the Ingress controller forwards the access request to the IP address, so that convenience and expansibility of providing service to the outside by an application are realized, and security of accessing an internal network is improved.

Description

Technical Field

[0001] This application relates to the technical field of computer network security, and particularly to a dynamic configuration access system, method, device, and storage medium for a DMZ area based on Kubernetes. Background Art

[0002] DMZ (Demilitarized Zone) is an important concept in network security architecture, used to establish a buffer zone between the internal network and the external network. The main purpose is to enhance network security. By isolating the servers that provide services to the outside (such as Web servers, mail servers, etc.), it can prevent external attacks from directly threatening the internal network.

[0003] In the current network environment, with the rapid development of cloud computing and microservices architecture, enterprises are facing more and more network security challenges and the need for rapid deployment. Traditional DMZ gateways usually require manual configuration and management, and the configuration and management are relatively complex. This not only increases the management workload but also easily leads to problems such as configuration errors and vulnerabilities, resulting in network security risks. Summary of the Invention

[0004] Based on this, it is necessary to provide a dynamic configuration access system, method, device, and storage medium for a DMZ area based on Kubernetes to address the above technical problems.

[0005] In a first aspect, an embodiment of this application provides a dynamic configuration access system for a DMZ area based on Kubernetes, including a deployment module, a Kubernetes cluster, a CoreDNS component, an Ingress controller, and a computing cluster. The computing cluster includes multiple computing services. The Kubernetes cluster, the CoreDNS component, and the Ingress controller are located in the DMZ area; The deployment module is configured to create Ingress objects and Service objects corresponding to each of the computing services in the Kubernetes cluster, where the Ingress objects and Service objects are configured with corresponding forwarding rules; and configure the domain name resolution information of the CoreDNS component; The Kubernetes cluster is configured to forward the access requests of end users to the Ingress controller; The Ingress controller is configured to match corresponding forwarding rules based on the access request, determine the internal domain name of the corresponding computing service based on the matched forwarding rules, and send a domain name resolution request to the CoreDNS component; The CoreDNS component is used to obtain the IP address of the computing service based on the internal domain name resolution information and send the IP address to the Ingress controller; the Ingress controller is used to forward the access request to the IP address.

[0006] In one embodiment, the access request includes authentication information, and the system further includes an authentication module. The authentication module is used to receive the verification request sent by the Ingress controller, verify the authentication information carried in the access request, and send the verification result to the Ingress controller. The Ingress controller is used to determine the internal domain name of the corresponding computing service based on the matching forwarding rule when the verification result passes.

[0007] In one embodiment, the system further includes: A load balancing module is used to forward the access requests of the end users to multiple servers in the Kubernetes cluster based on a preset allocation rule.

[0008] In one embodiment, the system further includes: A firewall is used to monitor and control network traffic to protect the network security of the system.

[0009] In a second aspect, an embodiment of the present application further provides a method for dynamically configuring access in the DMZ area based on Kubernetes, which is applied to the system described in the first aspect above. The method includes: Using a deployment module to create Ingress objects and Service objects corresponding to each computing service in the Kubernetes cluster, where the Ingress objects and Service objects are configured with corresponding forwarding rules; and configuring the domain name resolution information of the CoreDNS component. Using the Kubernetes cluster to forward the access requests of the end users to the Ingress controller. Using the Ingress controller to match the corresponding forwarding rule based on the access request, determine the internal domain name of the corresponding computing service based on the matching forwarding rule, and send a domain name resolution request to the CoreDNS component. Using the CoreDNS component to obtain the IP address of the computing service based on the internal domain name resolution information and send the IP address to the Ingress controller. Using the Ingress controller to forward the access request to the IP address.

[0010] In one embodiment, by using the Ingress controller, based on the access request, matching corresponding forwarding rules, and based on the matched forwarding rules, determining the internal domain name of the corresponding computing service includes: By using the Ingress controller, based on the access request, matching the corresponding Ingress object; By using the Ingress controller, according to the Service name specified in the Ingress object, matching the corresponding Service object, and based on the Service object, determining the internal domain name of the corresponding computing service.

[0011] In one embodiment, the method further includes: If the Ingress controller fails to query an Ingress object matching the access request, the end user rejects the access request.

[0012] In one embodiment, when the computing cluster is a Kubernetes computing cluster, the method further includes: Using a deployment module to create a second Ingress object and a second Service object corresponding to each of the computing services in the Kubernetes computing cluster, where the second Ingress object and the second Service object are configured with corresponding second forwarding rules; After using the Ingress controller to forward the access request to the IP address externally exposed by the computing service, using the Kubernetes computing cluster to match the second forwarding rule corresponding to the access request, and forwarding the access request to the corresponding computing service based on the second forwarding rule.

[0013] In a third aspect, an embodiment of the present application further provides a computer device, including a memory and a processor, where a computer program is stored in the memory, and the processor is configured to run the computer program to execute the method described in the second aspect above.

[0014] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, where a computer program is stored in the storage medium, and the computer program, when executed by a processor, implements the method described in the second aspect above.

[0015] The above-mentioned Kubernetes-based DMZ zone dynamic configuration access system, method, device, and storage medium create Ingress objects and Service objects corresponding to each computing service in the Kubernetes cluster by using a deployment module, where the Ingress objects and Service objects are configured with corresponding forwarding rules; and configure the domain name resolution information of the CoreDNS component; use the Kubernetes cluster to forward the access requests of end users to the Ingress controller; use the Ingress controller to match the corresponding forwarding rules based on the access requests, determine the internal domain name of the corresponding computing service based on the matched forwarding rules, and send a domain name resolution request to the CoreDNS component; use the CoreDNS component to obtain the IP address of the computing service based on the internal domain name resolution information and send the IP address to the Ingress controller; the Ingress controller is used to forward the access request to the IP address, reducing the difficulty of gateway service configuration, supporting dynamic configuration of access rules, realizing the convenience and scalability of the application to provide services externally, shortening the application online cycle; only forwarding requests that meet the specified rules and directly rejecting requests for which no rules are found, providing effective protection for the security inside the data center and enhancing the security of accessing the internal network.

[0016] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects, and advantages of this application more concise and understandable. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of this application and form a part of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an improper limitation of this application. In the drawings: Figure 1 It is a hardware structure block diagram of a Kubernetes-based DMZ zone dynamic configuration access system in one embodiment; Figure 2 It is a hardware structure block diagram of a Kubernetes-based DMZ zone dynamic configuration access system in another embodiment; Figure 3 It is a flowchart of a Kubernetes-based DMZ zone dynamic configuration access method in one embodiment; Figure 4 It is a hardware structure block diagram of a Kubernetes-based DMZ zone dynamic configuration access system in another embodiment; Figure 5It is a hardware structure block diagram of a Kubernetes-based DMZ zone dynamic configuration access system in another embodiment; Figure 6 It is a schematic diagram of the structure of a computer device in one embodiment.

[0018] Among them, 10 is the deployment module; 20 is the Kubernetes cluster; 30 is the CoreDNS component; 40 is the Ingress controller; 50 is the computing cluster; 60 is the authentication module; 70 is the load balancing module; 80 is the firewall. Detailed implementation manners

[0019] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be described and illustrated below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments provided in the present application without creative efforts belong to the scope of protection of the present application.

[0020] Obviously, the accompanying drawings in the following description are only some examples or embodiments of the present application. For those of ordinary skill in the art, the present application can be applied to other similar scenarios based on these drawings without creative efforts. In addition, it can also be understood that although the efforts made in this development process may be complex and lengthy, for those of ordinary skill in the art related to the content disclosed in the present application, some design, manufacturing or production changes based on the technical content disclosed in the present application are only conventional technical means and should not be understood that the content disclosed in the present application is insufficient.

[0021] When "embodiment" is mentioned in the present application, it means that the specific features, structures or characteristics described in connection with the embodiment may be included in at least one embodiment of the present application. The appearance of this phrase in various positions in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment mutually exclusive with other embodiments. Those of ordinary skill in the art explicitly and implicitly understand that the embodiments described in the present application can be combined with other embodiments without conflict.

[0022] Unless otherwise defined, the technical terms or scientific terms involved in this application shall have the ordinary meanings understood by those with ordinary skills in the technical field to which this application belongs. The words such as "a", "an", "one kind", "the" and the like involved in this application do not indicate a quantity limitation and may represent a singular or plural number. The terms "include", "comprise", "have" and any variations thereof involved in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may further include unlisted steps or units, or may further include other steps or units inherent to these processes, methods, products or devices. The words such as "connect", "be connected", "be coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "multiple" involved in this application means two or more. "And / or" describes the association relationship of associated objects and indicates that three relationships may exist. For example, "A and / or B" may represent: A exists alone, A and B exist simultaneously, and B exists alone. The character " / " generally represents an "or" relationship between the front and back associated objects. The terms "first", "second", "third" and the like involved in this application are only used to distinguish similar objects and do not represent a specific sorting of the objects.

[0023] The following is an explanation of the relevant terms that appear in the embodiments of this application: Kubernetes: It is an open-source container orchestration platform used for automating the deployment, scaling, and management of containerized applications. Currently, Kubernetes has become the de facto standard in the field of container orchestration and is widely used in the development and operation and maintenance of cloud-native applications.

[0024] Ingress: It is an API object used to manage external access to services within a cluster, acting as an entry for HTTP / HTTPS traffic, providing routing rules based on hostnames or paths, forwarding external requests to Services or Pods within the cluster, and can also be forwarded to the outside of the cluster in the way of ExternalName. Ingress is usually used in conjunction with an Ingress controller.

[0025] The embodiments of this application provide a dynamic configuration access system for the DMZ area based on Kubernetes, as Figure 1 shown, including a deployment module 10, a Kubernetes cluster 20, a CoreDNS component 30, an Ingress controller 40, and a computing cluster 50. The computing cluster 50 includes multiple computing services. The Kubernetes cluster 20, the CoreDNS component 30, and the Ingress controller 40 are located in the DMZ area.

[0026] The deployment module 10 is used to create Ingress objects and Service objects corresponding to each of the computing services in the Kubernetes cluster 20, wherein the Ingress objects and Service objects are configured with corresponding forwarding rules; and configure the domain name resolution information of the CoreDNS component 30; the Kubernetes cluster 20 is used to forward the access requests of end users to the Ingress controller 40; the Ingress controller 40 is used to match the corresponding forwarding rules based on the access requests, determine the internal domain name of the corresponding computing service based on the matched forwarding rules, and send a domain name resolution request to the CoreDNS component 30; the CoreDNS component 30 provides DNS services, is used to obtain the IP address of the computing service based on the internal domain name resolution information, and send the IP address to the Ingress controller 40; the Ingress controller 40 is used to forward the access request to the IP address.

[0027] This application uses the open-source features of Kubernetes in the DMZ area, can quickly build a dynamic configuration access system supporting the DMZ area, and both configuration and management use open-source technologies, reducing the difficulty of gateway service configuration; the deployment module 10 supports dynamic configuration of access rules, realizes the convenience and scalability of applications providing services externally, and shortens the application online cycle; the Ingress controller 40 only forwards requests with specified rules, and requests without found rules are directly rejected, providing effective protection for the security inside the data center and improving the security of accessing the internal network.

[0028] In one embodiment, the access request includes authentication information, such as Figure 2 As shown, the system further includes an authentication module 60, and the authentication module 60 is used to receive the verification request sent by the Ingress controller 40, verify the authentication information carried in the access request, and send the verification result to the Ingress controller 40; the Ingress controller 40 is used to determine the internal domain name of the corresponding computing service based on the matched forwarding rules when the verification result passes. The system of this embodiment reduces the development workload of the application authentication system by accessing a unified authentication system.

[0029] Further, please continue to refer to Figure 2, the system further includes a load balancing module 70, which is configured to forward the access requests of the end users to multiple servers in the Kubernetes cluster based on a preset allocation rule. The load balancing module 70 in the system optimizes resource usage, maximizes throughput, reduces response time, and avoids overloading of any single resource by distributing network or application traffic to multiple servers.

[0030] Further, please continue to refer to Figure 2 , the system further includes a firewall 80, which is configured to monitor and control network traffic to protect the internal network from unauthorized access and potential network attacks, thereby protecting the network security of the system.

[0031] In a second aspect, an embodiment of the present application further provides a method for dynamically configuring access in a DMZ area based on Kubernetes, which is applied to the system described in the first aspect above. As Figure 3 shown, the method includes the following steps: Step 201, use the deployment module to create Ingress objects and Service objects corresponding to each computing service in the Kubernetes cluster, where the Ingress objects and Service objects are configured with corresponding forwarding rules; and configure the domain name resolution information of the CoreDNS component.

[0032] First, use the deployment module to deploy the Ingress and Service forwarding rules in the DMZ area. The specific deployment method includes the following: The user sends a request for deploying the computing service forwarding rules to the deployment module, including configuration information such as whether to provide an authentication service, the server address, and external access; the deployment module creates corresponding Ingress objects, Service objects, and Secret objects in the Kubernetes cluster in the DMZ area. Among them, the Service object is of the ExternalName type, the Ingress and Service forwarding rules are written in the corresponding Ingress objects and Service objects, and the TLS certificate specified by the user is stored in the Secret object. The deployment module is also used to dynamically configure the domain name resolution information of the CoreDNS component.

[0033] Step 202, use the Kubernetes cluster to forward the access requests of the end users to the Ingress controller.

[0034] Step 203, use the Ingress controller to match the corresponding forwarding rules based on the access request, determine the internal domain name of the corresponding computing service based on the matched forwarding rules, and send a domain name resolution request to the CoreDNS component.

[0035] In this step, the Ingress controller only forwards requests that comply with specified rules, and directly rejects requests for which no rules are found, providing effective protection for the security within the data center and enhancing the security of accessing the internal network.

[0036] Step 204: Using the CoreDNS component, obtain the IP address of the computing service based on the internal domain name resolution information, and send the IP address to the Ingress controller.

[0037] Step 205: Use the Ingress controller to forward the access request to the IP address.

[0038] This application uses the open-source features of Kubernetes in the DMZ area, enabling rapid setup of a dynamic configuration access system for the DMZ area. Both configuration and management use open-source technologies, reducing the difficulty of gateway service configuration; supporting dynamic configuration of access rules, achieving the convenience and scalability of applications providing external services, and shortening the application launch cycle; only forwarding requests that comply with specified rules, and directly rejecting requests for which no rules are found, providing effective protection for the security within the data center and enhancing the security of accessing the internal network.

[0039] In one embodiment, using the Ingress controller to match corresponding forwarding rules based on the access request, and determining the internal domain name of the corresponding computing service based on the matched forwarding rules includes the following steps: Step 301: Using the Ingress controller, match the corresponding Ingress object based on the access request; that is, after the Ingress controller receives a request from a terminal user, it queries and matches the Ingress object according to the domain name and route of the request.

[0040] Further, the Ingress controller also performs TLS certificate authentication with the client of the terminal user using the TLS certificate specified in the Ingress object. After successful authentication, proceed to Step 302.

[0041] Step 302: Using the Ingress controller, match the corresponding Service object according to the Service name specified in the matched Ingress object, and determine the internal domain name of the corresponding computing service based on the Service object.

[0042] In one embodiment, the method further includes: if the Ingress controller fails to query an Ingress object that matches the access request, the terminal user's access request is rejected.

[0043] Specifically, after receiving the request from the terminal user, the Ingress controller queries the Ingress object according to the requested domain name and route. If no matching Ingress object is found, the connection is rejected, and the next step is performed if the match is successful. That is, according to the Service name specified in the matching Ingress object, the corresponding Service object is matched, and based on the Service object, the internal domain name of the corresponding computing service is determined.

[0044] In a specific embodiment, the DMZ zone dynamic configuration access method based on Kubernetes is applied to Figure 4 The method of the dynamic configuration forwarding system based on the Kubernetes container cloud platform comprises the following steps: Step 1: The end user initiates an https access request to the service domain name; Step 2: The domain name is resolved to the public IP address of the firewall in the data center through the public DNS domain name resolution service; Step 3: The access request is forwarded to the firewall of the data center; Step 4: The firewall forwards the request to the load balancing module; Step 5: The load balancing module forwards the access request to the specified port in the DMZ zone according to the allocation rule. The port can be specified in the Service object configured by the Ingress controller in the Kubernetes cluster. Step 6: After receiving the access request from the terminal user, the Ingress controller queries the Ingress object according to the requested domain name and route. If no matching Ingress object is found, the connection is rejected. If the match is successful, proceed to the next step. Step 7: The Ingress controller uses the TLS certificate specified in the Ingress object to perform the TLS certificate authentication process with the end user's client. Step 8: The Ingress controller verifies the authentication information carried in the request. If the verification fails, the connection is rejected. If the verification succeeds, the next step is performed. Step 9: The Ingress controller finds the corresponding Service object according to the service name specified in the Ingress object, and finds the internal domain name of the corresponding service according to the ExternalName field in the Service object; Step 10: The Ingress controller sends a domain name resolution request to the CoreDNS component to obtain the IP address of the corresponding service. Step 11: The Ingress controller forwards the http request, i.e., the access request, to the IP address of the corresponding service.

[0045] Preferably, in step 8, the Ingress controller verifies the authentication information carried in the request, including the following sub-steps: Step 8.1: If the matching Ingress object does not indicate that authentication verification is required, the verification is successful by default. If it is indicated that authentication verification is required, proceed to the next step. Step 8.2, the Ingress controller initiates an authentication request to the authentication module based on the "nginx.ingress.kubernetes.io / auth-signin" field and the "nginx.ingress.kubernetes.io / auth-method" field filled in the Ingress object; Step 8.3: The authentication module authenticates the request and returns 200OK if the authentication succeeds, or 401 if the authentication fails. Step 8.4: If the Ingress controller receives 200OK, the verification is successful and the verification ends. Otherwise, proceed to the next step. In step 8.5, the Ingress controller receives a 401 error, indicating that the verification has failed. According to the "nginx.ingress.kubernetes.io / auth-url" field of the Ingress object, the terminal user is prompted to jump to the login page.

[0046] In one of the embodiments, when the computing cluster is a Kubernetes computing cluster, the method further includes: using a deployment module to create a second Ingress object and a second Service object corresponding to each of the computing services in the Kubernetes computing cluster, wherein the second Ingress object and the second Service object are configured with corresponding second forwarding rules; after using the Ingress controller to forward the access request to the IP address exposed to the outside of the computing service, using the Kubernetes computing cluster to match the second forwarding rule corresponding to the access request, and forwarding the access request to the corresponding computing service based on the second forwarding rule.

[0047] Specifically, the deployment module creates a computing service in the Kubernetes computing cluster, and creates an Ingress object and a Service object accordingly, and writes the Ingress and Service forwarding rules in the corresponding Ingress objects and Service objects.

[0048] In a specific embodiment, the DMZ zone dynamic configuration access method based on Kubernetes is applied to Figure 5The dynamic configuration forwarding system based on the Kubernetes container cloud platform, the computing cluster in the system is a Kubernetes computing cluster, and the method includes the following steps: Step 1: The end user initiates an https access request to the service domain name; Step 2: The domain name is resolved to the public IP address of the firewall in the data center through the public DNS domain name resolution service; Step 3: The access request is forwarded to the firewall of the data center; Step 4: The firewall forwards the request to the load balancing module; Step 5: The load balancing module forwards the access request to the specified port in the DMZ zone according to the allocation rule. The port can be specified in the Service object configured by the Ingress controller in the Kubernetes cluster. Step 6: After receiving the access request from the terminal user, the Ingress controller queries the Ingress object according to the requested domain name and route. If no matching Ingress object is found, the connection is rejected. If the match is successful, proceed to the next step. Step 7: The Ingress controller uses the TLS certificate specified in the Ingress object to perform the TLS certificate authentication process with the end user's client. Step 8: The Ingress controller verifies the authentication information carried in the request. If the verification fails, the connection is rejected. If the verification succeeds, the next step is performed. Step 9: The Ingress controller finds the corresponding Service object according to the service name specified in the Ingress object, and finds the internal domain name of the corresponding service according to the ExternalName field in the Service object; Step 10: The Ingress controller sends a domain name resolution request to the CoreDNS component to obtain the IP address of the corresponding service, and finds that the corresponding IP address is the gateway IP of the k8s computing cluster; Step 11: The Ingress controller forwards the http request to the gateway of the Kubernetes computing cluster.

[0049] Step 12: After receiving the request, the Ingress controller in the k8s computing cluster queries the Ingress object according to the requested domain name and route. If no matching Ingress object is found, the connection is rejected. If the match is successful, proceed to the next step. Step 13: The Ingress controller in the k8s computing cluster finds the corresponding Service object according to the Service name specified in the Ingress object, and finds the IP of the final service Pod according to the Service object and its corresponding Endpoint object. Step 14: The Ingress controller in the k8s computing cluster forwards the request to the service Pod in the cluster.

[0050] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as Figure 6 shown. The computer device includes a processor, a memory, and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, it implements a method for dynamically configuring access to the DMZ area based on Kubernetes.

[0051] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, it implements the steps in any of the above embodiments of the method for dynamically configuring access to the DMZ area based on Kubernetes.

[0052] Those of ordinary skill in the art can understand that all or part of the processes in the above method embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the above method embodiments. Among them, any reference to the memory, storage, database, or other media used in the various embodiments provided in the present application can include at least one of non-volatile and volatile memories. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical memory, etc. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0053] The technical features of the above-described embodiments can be combined arbitrarily. For the sake of brevity of description, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered as the scope recorded in this specification.

[0054] The above-described embodiments only represent several implementation manners of the present application. The description is relatively specific and detailed, but it should not be construed as a limitation on the scope of the invention patent. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present application, several modifications and improvements can still be made, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the appended claims.

Claims

1. A DMZ zone dynamic configuration access system based on Kubernetes, characterized in that: It includes a deployment module, a Kubernetes cluster, a CoreDNS component, an Ingress controller, and a computing cluster. The computing cluster includes multiple computing services. The Kubernetes cluster, the CoreDNS component, and the Ingress controller are located in a DMZ area. The deployment module is used to create an Ingress object and a Service object corresponding to each of the computing services in the Kubernetes cluster, wherein the Ingress object and the Service object are configured with corresponding forwarding rules; and configure the domain name resolution information of the CoreDNS component; The Kubernetes cluster is used to forward the access request of the terminal user to the Ingress controller; The Ingress controller is used to match the corresponding forwarding rule based on the access request, determine the internal domain name of the corresponding computing service based on the matched forwarding rule, and send a domain name resolution request to the CoreDNS component; The CoreDNS component is used to obtain the IP address of the computing service based on the internal domain name resolution information, and send the IP address to the Ingress controller; the Ingress controller is used to forward the access request to the IP address.

2. The system according to claim 1, characterized in that The access request includes authentication information, and the system further includes an authentication module. The authentication module is used to receive the verification request sent by the Ingress controller, verify the authentication information carried in the access request, and send the verification result to the Ingress controller; The Ingress controller is used to determine the internal domain name of the corresponding computing service based on the matched forwarding rule when the verification result passes.

3. The system according to claim 1, characterized in that The system further comprises: A load balancing module is used to forward the access request of the terminal user to multiple servers in the Kubernetes cluster based on a preset allocation rule.

4. The system according to claim 1, characterized in that The system further comprises: Firewalls are used to monitor and control network traffic to protect the network security of the system.

5. A DMZ zone dynamic configuration access method based on Kubernetes, applied to the system according to any one of claims 1 to 4, characterized in that: The method comprises: Use the deployment module to create Ingress objects and Service objects corresponding to each computing service in the Kubernetes cluster, where the Ingress objects and Service objects are configured with corresponding forwarding rules; and configure the domain name resolution information of the CoreDNS component; Utilize the Kubernetes cluster to forward the terminal user's access request to the Ingress controller; Using the Ingress controller, based on the access request, matching the corresponding forwarding rule, determining the internal domain name of the corresponding computing service based on the matched forwarding rule, and sending a domain name resolution request to the CoreDNS component; Using the CoreDNS component, based on the internal domain name resolution information, obtain the IP address of the computing service, and send the IP address to the Ingress controller; The Ingress controller is used to forward the access request to the IP address.

6. The method according to claim 5, characterized in that Using the Ingress controller, matching a corresponding forwarding rule based on the access request, and determining the internal domain name of the corresponding computing service based on the matched forwarding rule includes: Using the Ingress controller, based on the access request, a corresponding Ingress object is matched; The Ingress controller is used to match a corresponding Service object according to the Service name specified in the Ingress object, and based on the Service object, an internal domain name of the corresponding computing service is determined.

7. The method according to claim 6, characterized in that The method further comprises: If the Ingress controller does not find that the access request matches the Ingress object, the terminal user rejects the access request.

8. The method according to claim 6, characterized in that When the computing cluster is a Kubernetes computing cluster, the method further includes: Using a deployment module to create a second Ingress object and a second Service object corresponding to each of the computing services in the Kubernetes computing cluster, wherein the second Ingress object and the second Service object are configured with a corresponding second forwarding rule; After using the Ingress controller to forward the access request to the IP address exposed by the computing service, using the Kubernetes computing cluster, matching the second forwarding rule corresponding to the access request, and forwarding the access request to the corresponding computing service based on the second forwarding rule.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the method according to any one of claims 5 to 8 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 5 to 8 is implemented.

Images