A control method, system, electronic device and storage medium for container access
By deploying user-state programs in Kubernetes clusters and using eBPF programs to share access permission tables with the kernel, the problem of low traffic processing efficiency in Kubernetes clusters is solved, and efficient container access control and network security is achieved.
Patent Information
- Application Number
- CN202111227654.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-10-21
- Publication Date
- 2025-08-01
- Estimated Expiration
- 2041-10-21
AI Technical Summary
In the prior art, the traffic of each pod in the Kubernetes cluster needs to be processed by a sidecar container, resulting in increased resource consumption and response time, and performance problems.
Deploy user-state programs in Kubernetes clusters, use eBPF programs to share access permission tables with the Linux system kernel, and control external traffic at the kernel level through eBPF programs, including allowing or denying access.
Improves the efficiency of container access control, reduces resource consumption and response time, and improves network security.
Smart Images
Figure CN113986459B_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of cloud computing technology, and in particular, to a method, a system, an electronic device, and a storage medium for controlling container access. Background Art
[0002] In the era of cloud computing, a large number of microservices applications are deployed on cloud platforms, and how to manage their networks becomes very important. In related technologies, a sidecar proxy container is usually added to each pod in the cluster to control access to the pod by external traffic. Multiple containers in the cluster are encapsulated in the above-mentioned pod. In the above method, each piece of traffic passing through the pod has to pass through the sidecar container first, which greatly increases resource consumption and response time, and there are relatively large performance problems.
[0003] Therefore, how to improve the efficiency of container access control is a technical problem that those skilled in the art need to solve at present. Summary of the Invention
[0004] The purpose of the present application is to provide a method, a system, an electronic device, and a storage medium for controlling container access, which can improve the efficiency of container access control.
[0005] To solve the above technical problems, the present application provides a method for controlling container access, which is applied to a Kubernetes cluster. The method for controlling container access includes:
[0006] Deploy a user-space program in the Kubernetes cluster, and use the user-space program to maintain an access permission table; wherein, the access permission table is shared by the user-space program and the Linux system kernel;
[0007] Use the user-space program to create an eBPF program and inject the eBPF program into the Linux system kernel;
[0008] Determine whether there is external traffic accessing a pod of the Kubernetes cluster; wherein, the pod is used to encapsulate containers in the Kubernetes cluster;
[0009] If so, use the eBPF program to query and execute a control action corresponding to the external traffic from the access permission table; wherein, the control action includes allowing access or denying access.
[0010] Optionally, using the user-space program to maintain an access permission table includes:
[0011] Use the user-mode program to maintain an access permission table in the form of a hash table; wherein, the key of the access permission table includes the source address, source port, destination address, and destination port, and the value of the access permission table includes the control action.
[0012] Optionally, deploying a user-mode program in the Kubernetes cluster includes:
[0013] Deploy the user-mode program in the Kubernetes cluster by means of a daemonset.
[0014] Optionally, it further includes:
[0015] Control the user-mode program to monitor the IP change information of the pod by using the list-watch mechanism;
[0016] Update the access permission table according to the IP change information.
[0017] Optionally, determining whether there is external traffic accessing the pod of the Kubernetes cluster includes:
[0018] Determine whether the receive message event of the socket of the pod is triggered;
[0019] If so, it is determined that there is external traffic accessing the pod of the Kubernetes cluster;
[0020] If not, it is determined that there is no external traffic accessing the pod of the Kubernetes cluster.
[0021] Optionally, after injecting the eBPF program into the Linux system kernel, it further includes:
[0022] Determine whether there is internal traffic accessing an external IP address;
[0023] If so, use the eBPF program to query and execute the control action corresponding to the internal traffic from the access permission table.
[0024] Optionally, using the user-mode program to maintain the access permission table includes:
[0025] Use the user-mode program to obtain the pod access policy and maintain the access permission table according to the obtained pod access policy.
[0026] This application also provides a container access control system, which is applied to a Kubernetes cluster. The control system includes:
[0027] A user-mode program deployment module, which is used to deploy a user-mode program in the Kubernetes cluster and maintain an access permission table by using the user-mode program; wherein, the access permission table is shared by the user-mode program and the Linux system kernel;
[0028] A kernel program injection module, which is used to create an eBPF program by using the user-mode program and inject the eBPF program into the Linux system kernel;
[0029] A judgment module, which is used to judge whether there is external traffic accessing the pod of the Kubernetes cluster; wherein, the pod is used to encapsulate the containers in the Kubernetes cluster;
[0030] An access control module, which is used to, if there is external traffic accessing the pod of the Kubernetes cluster, query and execute the control action corresponding to the external traffic from the access permission table by using the eBPF program; wherein, the control action includes allowing access or denying access.
[0031] The present application also provides a storage medium, on which a computer program is stored, and when the computer program is executed, the steps executed by the above container access control method are implemented.
[0032] The present application also provides an electronic device, which includes a memory and a processor, a computer program is stored in the memory, and when the processor calls the computer program in the memory, the steps executed by the above container access control method are implemented.
[0033] The present application provides a container access control method, which is applied to a Kubernetes cluster, and the control method includes: deploying a user-mode program in the Kubernetes cluster and maintaining an access permission table by using the user-mode program; wherein, the access permission table is shared by the user-mode program and the Linux system kernel; creating an eBPF program by using the user-mode program and injecting the eBPF program into the Linux system kernel; judging whether there is external traffic accessing the pod of the Kubernetes cluster; wherein, the pod is used to encapsulate the containers in the Kubernetes cluster; if so, query and execute the control action corresponding to the external traffic from the access permission table by using the eBPF program; wherein, the control action includes allowing access or denying access.
[0034] This application deploys user-mode programs in a Kubernetes cluster and maintains an access permission table shared by user-mode programs and the Linux system kernel through the user-mode programs. After injecting the eBPF program into the Linux system kernel, the eBPF program can use the access permission table shared with the user-mode program to filter external traffic, so as to allow or deny the actions of external traffic accessing the pod. This application realizes the access of external traffic to containers at the kernel level based on eBPF, which can improve the efficiency of container access control. This application also provides a container access control system, an electronic device, and a storage medium, which have the above beneficial effects and will not be elaborated here. BRIEF DESCRIPTION OF THE DRAWINGS
[0035] To more clearly illustrate the embodiments of the present application, the following will briefly introduce the drawings required for the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.
[0036] Figure 1 It is a flowchart of a container access control method provided by an embodiment of the present application;
[0037] Figure 2 It is a schematic diagram of an eBPF program injection method provided by an embodiment of the present application;
[0038] Figure 3 It is a schematic diagram of a process for an access policy to take effect provided by an embodiment of the present application;
[0039] Figure 4 It is a schematic diagram of the principle of a network security control solution for pods in Kubernetes based on the ebpf technology provided by an embodiment of the present application;
[0040] Figure 5 It is a schematic diagram of the structure of a container access control system provided by an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS
[0041] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some, but not all, of the embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative efforts fall within the scope of protection of the present application.
[0042] Please refer to the following Figure 1 , Figure 1Flowchart of a container access control method provided by an embodiment of this application.
[0043] The specific steps may include:
[0044] S101: Deploy a user-space program in the Kubernetes cluster, and use the user-space program to maintain an access permission table;
[0045] This embodiment can be applied to a Kubernetes cluster, and can be specifically implemented on the node devices of the Kubernetes cluster. Kubernetes, also known as K8S, is an open-source system for managing containerized applications on multiple hosts in a cloud platform. The goal of a Kubernetes cluster is to make it simple and efficient to deploy containerized applications. The Kubernetes cluster provides mechanisms for application deployment, scheduling, updating, and maintenance.
[0046] In this embodiment, the above-mentioned user-space program can be deployed in the Kubernetes cluster in the form of a daemonset. After deploying the user-space program, this application can use the user-space program to maintain an access permission table in the form of a hash table; where the keys of the access permission table include the source address, source port, target address, and target port, and the values of the access permission table include the control actions (such as allow and deny). Specifically, the user-space program can first determine the access rules created by the user, and maintain the access permission table based on the access rules.
[0047] The above-mentioned access permission table is shared by the user-space program and the Linux system kernel, that is, both the user-space program and the kernel-space program can read and write the access permission table.
[0048] S102: Use the user-space program to create an eBPF program, and inject the eBPF program into the Linux system kernel;
[0049] Among them, eBPF (Extended BPF) is a kernel technology in Linux 4.x+. It is equivalent to a lightweight sandbox virtual machine. The eBPF program runs inside the Linux kernel and can provide verified access to kernel memory. eBPF allows the kernel to run BPF bytecode. Although the front-end language used can be different, it is usually a restricted subset of the C language. Usually, Clang is first used to compile the C code into BPF bytecode, and then the bytecode is verified to ensure its safe execution. These strict verifications ensure that the machine code will not deliberately or accidentally harm the Linux kernel, and ensure that the BPF probe can be executed within a certain number of instructions every time it is triggered. These guarantees enable the eBPF program to be used for performance-critical workloads, such as packet filtering, network monitoring, etc.
[0050] The eBPF program can be written using code tools, and then the written program is loaded into the Linux system kernel through bpf(). The injection program bpf_load_program() incorporates a more complex verifier mechanism. Before running the injection program, a series of security checks can be performed to ensure the security of the system to the greatest extent. The bpf bytecode that passes the security checks is compiled using the kernel JIT to generate native assembly instructions, which are attached to the program at specific kernel hooks. Finally, the kernel state and the user state communicate through an efficient map mechanism. The user-state program can create the above eBPF program according to the access rules created by the user and inject the eBPF program into the Linux system kernel.
[0051] S103: Determine whether there is external traffic accessing the pod of the Kubernetes cluster; if so, proceed to S104; if not, end the process.
[0052] Among them, the Kubernetes cluster includes multiple pods, and the above pods are used to encapsulate the containers in the Kubernetes cluster; external traffic accesses the containers by accessing the pods of the Kubernetes cluster. In this embodiment, it can be determined at a preset period whether there is external traffic accessing the pods of the Kubernetes cluster. If not, the operation process of this embodiment can be ended and the relevant operations of S103 - S104 can be re-executed after a preset time period.
[0053] S104: Use the eBPF program to query and execute the control action corresponding to the external traffic from the access permission table.
[0054] Among them, this embodiment is based on the operation of detecting external traffic accessing the pod. This embodiment can use the eBPF program running in the Linux kernel to query the control action corresponding to the external traffic from the access permission table and execute the above control action. When the control action is to allow access, allow the external traffic to be sent to the pod; when the control action is to deny access, prohibit the external traffic from being sent to the pod.
[0055] In this embodiment, a user-state program is deployed in the Kubernetes cluster, and the access permission table shared by the user-state program and the Linux system kernel is maintained through the user-state program. After injecting the eBPF program into the Linux system kernel, the eBPF program can use the access permission table shared with the user-state program to filter external traffic, so as to allow or deny the action of external traffic accessing the pod. This embodiment realizes the access of external traffic to the container at the kernel level based on eBPF, which can improve the efficiency of container access control.
[0056] As for Figure 1 For further introduction of the embodiments, the access rules created by the user can specifically be pod access policies. The above embodiments can use the user-mode program to obtain the pod access policies and maintain the access permission table according to the obtained pod access policies.
[0057] As for Figure 1 For further introduction of the embodiments, since the IP addresses of the Kubernetes cluster change in real time, the access permission table needs to be adjusted accordingly. Therefore, during the implementation of the container access control method, the user-mode program can also be controlled to monitor the IP change information of the pod by using the list-watch mechanism; and update the access permission table according to the IP change information. The above IP change information includes the correspondence between the identity identifier of the pod, the original IP address, and the new IP address. Therefore, when the IP change of a certain pod is detected, the original IP address in the access permission table can be modified to the new IP address according to the identity identifier of the pod. The role of the original IP address in the above IP change information is to improve the reliability of the access permission table update operation and avoid misoperations.
[0058] As for Figure 1 For further introduction of the corresponding embodiments, it is possible to determine whether there is external traffic accessing the pod in the following way: determine whether the receive message event of the socket of the pod is triggered; if so, it is determined that there is external traffic accessing the pod of the Kubernetes cluster; if not, it is determined that there is no external traffic accessing the pod of the Kubernetes cluster.
[0059] As for Figure 1 For further introduction of the corresponding embodiments, before injecting the eBPF program into the Linux system kernel, it is also possible to perform a security check on the eBPF program; if the eBPF program passes the security check, then proceed to the step of injecting the eBPF program into the Linux system kernel. In this way, the security of the Linux system kernel can be improved and malicious programs can be prevented from being injected into the Linux system kernel.
[0060] As for Figure 1 For further introduction of the corresponding embodiments, after injecting the eBPF program into the Linux system kernel, it is also possible to determine whether there is internal traffic accessing an external IP address; if so, use the eBPF program to query and execute the control actions corresponding to the internal traffic from the access permission table. The above internal traffic is the traffic sent by pods within Kubernetes to an external IP address. The present application uses the eBPF program to filter the internal traffic from the access permission table, improving network security.
[0061] The following describes the process described in the above embodiments through examples in actual applications.
[0062] Kubernetes is a specification for the communication rules allowed between pods and between pods and other network endpoints. It can relatively precisely control the access between pods and also control the addresses of pods in the cluster accessing the public network. However, it cannot control the access of external IPs to pods through nodeport or ingress. If the app in the Kubernetes cluster enables nodeport or ingress, in the related art, it is impossible to implement IP-based black and white list access control. The ingress-gateway in the Istio service mesh can implement IP black and white list control, but it adds a sidecar proxy container to each pod, and every traffic passing through the pod has to go through the sidecar container first, which greatly increases resource consumption and response time, and there are relatively large performance problems.
[0063] In view of the problems existing in the above related art, this application provides a k8s cluster container network security control solution based on eBPF. This solution uses eBPF technology to inject the kernel by writing an ebpf program, monitors the traffic entering and leaving the pod, and realizes the network security control of the pod according to the set inbound and outbound rules. This solution applies eBPF technology to the container network control of the Kubernetes cluster, and is more efficient than the original iptable method and sidecar method. This solution can perform black and white list control on the situation of external access to pods, and is more powerful than the traditional networkpolicy function.
[0064] Please refer to Figure 2 , Figure 2 which is a schematic diagram of an eBPF program injection method provided by an embodiment of this application. Figure 2The BPF Program in the middle is a well-written eBPF program. The BPF Program compiles the eBPF program into the BPF bytecode prog.bpf through LLVM (Low Level Virtual Machine) or Clang (a lightweight compiler), and loads the above BPF bytecode from the userspace to the kernel through the bpf() method. The BPF bytecode in the kernel uses the security verification of the verifier and the compilation of the kernel JIT to obtain the native assembly instruction Native Code, and attaches the native assembly instruction Native Code to the program Kernel Functions hooked to the kernel specifically. The user reader can update the access permission table BPF Maps shared by the userspace program and the eBPF program through the bpf() method.
[0065] Please refer to Figure 3 , Figure 3 which is a schematic diagram of the process for an access policy to take effect provided by an embodiment of this application. Figure 3 In the figure, Client represents the client, socket represents the socket. The source address of the client traffic Client ip is 10.48.51.100, the source port Client port is 30001, the target address Remote ip is 10.233.10.100, and the target port Remote port is 20120. Map is the access permission table. The key of the access permission table is a four-tuple (4-tuple) composed of the source address, source port, target address, and target port of the traffic, and the value of the access permission table is two actions: allow and deny. Figure 3 In the figure, pod ip is the ip address of the pod. The userspace program can update the access permission table according to the pod access policy set by the user. The eBPF program allows the client traffic to enter the pod if the action corresponding to the four-tuple of the client traffic is allowed according to the access permission table.
[0066] As Figure 3 shown, the implementation idea of this embodiment is as follows:
[0067] (1) Write the eBPF program; the eBPF type involved in the above eBPF program is BPF_PROG_TYPE_SOCKET_FILTER, and this type of eBPF program can implement the filter operation on the data packet.
[0068] (2) The user space creates and maintains an access permission table hashmap. The key of the access permission table hashmap is a quadruple composed of the source address, source port, destination address, and destination port of the traffic. The value is the permission for this traffic access, which is divided into two types: allow and deny. The access permission table realizes data sharing between the user space and the kernel space, enabling the kernel to perform corresponding filter operations on network traffic according to the permission settings in the access permission table when receiving traffic.
[0069] (3) The eBPF program makes corresponding responses in the kernel according to specified kernel events. The BPF_PROG_TYPE_SOCKET_FILTER type program used in this embodiment is triggered to execute when the kernel receives a message. If it is determined that the source address of the traffic belongs to the blacklist IP, 0 is returned in the program and the packet is discarded.
[0070] Please refer to Figure 4 , Figure 4 which is the schematic diagram of a network security control solution for pods in Kubernetes based on the ebpf technology provided by the embodiments of this application. Figure 4 In it, update represents the operation of updating the access permission table, creat represents the operation of creating the eBPF program, kernal represents the Linux system kernel, and apiserver is used to provide interfaces for adding, deleting, modifying, and querying various resource objects in the Kubernetes cluster. Figure 4 The implementation process of the container network security control solution shown is as follows:
[0071] The user space program is deployed in the k8s cluster in the form of a daemonset. The user space program creates an eBPF program and updates the access permission table shared by the user space and the kernel according to the pod access policy set by the user (i.e., the rules created by the user). When the user creates a pod access policy, the daemonset will create a corresponding eBPF program and inject it into the kernel, and at the same time update the access permission table in the kernel.
[0072] The user space program uses the Kubernetes listwatch mechanism to monitor the IP address changes of pods in real time. Once the IP address changes of the pods are detected, the changed IP addresses are synchronized to the access permission table.
[0073] When traffic accesses a pod from the outside, the eBPF program is triggered by the socket receive message event. The kernel program executed after the trigger includes the following steps: reading the allow and deny information in the access permission table and determining whether to discard the packet or continue to execute according to the read result.
[0074] This embodiment realizes the security control of containers in the Kubernetes cluster and uses eBPF technology to monitor the traffic of apps in the k8s cluster. This embodiment first achieves an effect similar to a black and white list according to the pre-configured pod access policy; if the quadruple of external traffic includes the pre-configured blacklist IP, access to or from this app will be prohibited. Different from traditional k8s control policies, the control policy of this embodiment can not only control the traffic in and out of the Kubernetes cluster, but also control the access of external traffic to apps in the cluster and the access of apps to external IPs in the cluster.
[0075] This embodiment directly controls the network access of containers at the kernel level based on eBPF technology. It can not only perform access control between pods in the cluster, but also perform access control on external accessed IPs. This embodiment supports multiple architectures such as amd64, arm, and mips. This embodiment uses eBPF technology to implement container network filtering at the kernel level, making the filtering efficiency higher.
[0076] Please refer to Figure 5 , Figure 5 which is a schematic structural diagram of a container access control system provided by an embodiment of this application. This system is applied to the Kubernetes cluster and specifically may include:
[0077] A user-space program deployment module 501, configured to deploy a user-space program in the Kubernetes cluster and use the user-space program to maintain an access permission table; wherein, the access permission table is shared by the user-space program and the Linux system kernel;
[0078] A kernel program injection module 502, configured to create an eBPF program using the user-space program and inject the eBPF program into the Linux system kernel;
[0079] A judgment module 503, configured to judge whether there is external traffic accessing a pod of the Kubernetes cluster; wherein, the pod is used to encapsulate a container in the Kubernetes cluster;
[0080] An access control module 504, configured to, if there is external traffic accessing a pod of the Kubernetes cluster, query and execute a control action corresponding to the external traffic from the access permission table using the eBPF program; wherein, the control action includes allowing access or denying access.
[0081] In this embodiment, a user-space program is deployed in a Kubernetes cluster, and the user-space program is used to maintain an access permission table shared by the user-space program and the Linux system kernel. After injecting the eBPF program into the Linux system kernel, the eBPF program can use the access permission table shared with the user-space program to filter external traffic, so as to allow or deny the action of external traffic accessing the pod. This embodiment realizes the access of external traffic to containers at the kernel level based on eBPF, which can improve the efficiency of container access control.
[0082] Further, the user-space program deployment module 501 includes:
[0083] A permission table maintenance unit, configured to use the user-space program to maintain an access permission table in the form of a hash table; wherein, the key of the access permission table includes the source address, source port, destination address, and destination port, and the value of the access permission table includes the control action.
[0084] Further, the user-space program deployment module 501 includes:
[0085] A deployment unit, configured to deploy the user-space program in the Kubernetes cluster in the way of daemonset.
[0086] Further, it further includes:
[0087] A permission table update module, configured to control the user-space program to monitor the IP change information of the pod by using the list-watch mechanism; and is also configured to update the access permission table according to the IP change information.
[0088] Further, the judgment module 503 is configured to judge whether the receive message event of the socket of the pod is triggered; if so, it is determined that there is external traffic accessing the pod of the Kubernetes cluster; if not, it is determined that there is no external traffic accessing the pod of the Kubernetes cluster.
[0089] Further, it further includes:
[0090] An internal traffic control module, configured to judge whether there is internal traffic accessing an external IP address after injecting the eBPF program into the Linux system kernel; if so, use the eBPF program to query and execute the control action corresponding to the internal traffic from the access permission table.
[0091] Further, the process in which the user-mode program deployment module 501 uses the user-mode program to maintain the access permission table includes: using the user-mode program to obtain the pod access policy and maintaining the access permission table according to the obtained pod access policy.
[0092] Since the embodiments in the system part correspond to the embodiments in the method part, please refer to the description of the embodiments in the method part for the embodiments in the system part, and details are not described here.
[0093] The present application also provides a storage medium on which a computer program is stored, and when the computer program is executed, the steps provided in the above embodiments can be implemented. The storage medium may include: various media such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disc that can store program codes.
[0094] The present application also provides an electronic device, which may include a memory and a processor. When the processor calls the computer program stored in the memory, the steps provided in the above embodiments can be implemented. Of course, the electronic device may also include various network interfaces, power supplies, and other components.
[0095] The embodiments in the specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The same or similar parts among the embodiments can be referred to each other. For the system disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the description in the method part. It should be noted that for those of ordinary skill in the art in this technical field, without departing from the principle of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the protection scope of the claims of the present application.
[0096] It should also be noted that in this specification, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variation thereof is intended to cover a non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements but also other elements not expressly listed, or also includes elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "including a..." does not exclude the existence of another identical element in the process, method, article or device including the element.
Claims
1. A control method for container access, characterized in that Applied to a Kubernetes cluster, the control method includes: Deploy a user-space program in the Kubernetes cluster and use the user-space program to maintain an access permission table; wherein, the access permission table is shared by the user-space program and the Linux system kernel; Use the user-space program to create an eBPF program and inject the eBPF program into the Linux system kernel; Determine whether there is external traffic accessing a pod in the Kubernetes cluster; wherein, the pod is used to encapsulate containers in the Kubernetes cluster; If so, use the eBPF program to query and execute the control action corresponding to the external traffic from the access permission table; wherein, the control action includes allowing access or denying access; Wherein, it further includes: Control the user-space program to monitor the IP change information of the pod by using the list-watch mechanism; wherein, the IP change information includes the correspondence between the identity identifier of the pod, the original IP address, and the new IP address; Update the access permission table according to the IP change information; wherein, when the IP change of a certain pod is detected, the original IP address in the access permission table is modified to the new IP address according to the identity identifier of the pod.
2. The control method for container access according to claim 1, wherein Using the user-space program to maintain the access permission table includes: Use the user-space program to maintain an access permission table in the form of a hash table; wherein, the key of the access permission table includes the source address, source port, destination address, and destination port, and the value of the access permission table includes the control action.
3. The control method for container access according to claim 1, characterized in that, Deploying the user-space program in the Kubernetes cluster includes: Deploy the user-space program in the Kubernetes cluster in the way of daemonset.
4. The control method for container access according to claim 1, wherein, The determination of whether there is external traffic accessing a pod in the Kubernetes cluster includes: Determine whether the receive message event of the socket of the pod is triggered; If so, it is determined that there is external traffic accessing the pod in the Kubernetes cluster; If not, it is determined that there is no external traffic accessing the pod in the Kubernetes cluster.
5. The control method for container access according to claim 1, wherein After injecting the eBPF program into the Linux system kernel, it further includes: Determine whether there is internal traffic accessing an external IP address; If so, use the eBPF program to query and execute the control action corresponding to the internal traffic from the access permission table.
6. The control method for container access according to any one of claims 1 to 5, characterized in that, Using the user-space program to maintain the access permission table includes: Use the user-space program to obtain the pod access policy and maintain the access permission table according to the obtained pod access policy.
7. A control system for container access, characterized in that, Applied to a Kubernetes cluster, the control system includes: A user-space program deployment module, configured to deploy a user-space program in the Kubernetes cluster and use the user-space program to maintain an access permission table; wherein, the access permission table is shared by the user-space program and the Linux system kernel; A kernel program injection module, which is used to create an eBPF program by using the user-mode program and inject the eBPF program into the Linux system kernel; A judgment module, which is used to judge whether there is external traffic accessing the pod of the Kubernetes cluster; wherein, the pod is used to encapsulate the containers in the Kubernetes cluster; An access control module, which is used to, if there is external traffic accessing the pod of the Kubernetes cluster, query and execute the control action corresponding to the external traffic from the access permission table by using the eBPF program; wherein, the control action includes allowing access or denying access; Wherein, it further includes: A permission table update module, which is used to control the user-mode program to monitor the IP change information of the pod by using the list-watch mechanism; wherein, the IP change information includes the correspondence between the identity identifier of the pod, the original IP address and the new IP address; and is further used to update the access permission table according to the IP change information; wherein, when the IP change of a certain pod is detected, the original IP address in the access permission table is modified to the new IP address according to the identity identifier of the pod.
8. An electronic device, characterized in that, It includes a memory and a processor. When the processor calls the computer program stored in the memory, the steps of the control method for container access according to any one of claims 1 to 6 are implemented.
9. A storage medium, characterized in that, The computer-executable instructions are stored in the storage medium. When the computer-executable instructions are loaded and executed by the processor, the steps of the control method for container access according to any one of claims 1 to 6 are implemented.