Blacklist control method and device for cloud-native kubernetes network

Abstract

Embodiments of the present disclosure disclose a black list control method and device for cloud-native kubernetes network. The specific implementation of the method comprises: importing a configuration file for interacting with an API service node to obtain a container resource and a network access control custom resource; receiving an event synchronized by the API service node, wherein the event is triggered by the API service node according to a change in the pre-configured container resource and network access control custom resource; obtaining an IP list according to the container resource and the network access control custom resource; generating a black list according to the IP list; and discarding data in response to receiving data meeting the black list. The implementation realizes a black list management and configuration scheme for kubernetes cloud-native.

Description

Technical Field

[0001] The embodiments disclosed herein relate to the field of computer technology, and more specifically to a blacklist control method and apparatus for cloud-native Kubernetes networks. Background Technology

[0002] Cloud-native Kubernetes provides powerful container orchestration capabilities, exposes network interfaces, and supports custom and flexible container networks. In a Kubernetes network solution, each pod (container) has an independent IP address, pods run in a flat network, and containers can directly connect to each other. The CNI (Container Network Interface) defines the interface specification for container networks, and container networks can be configured through custom CNI plugins.

[0003] Common network access control methods include whitelists and blacklists. Whitelists allow access to IP addresses and ports, while blacklists block access to IP addresses and ports.

[0004] Existing cloud-native Kubernetes (k8s) can implement whitelist functionality using NetworkPolicy and network plugins (such as Calico). However, k8s lacks the definition and implementation of network blacklists and therefore does not have user blacklist functionality. Summary of the Invention

[0005] The embodiments disclosed herein present a blacklist control method and apparatus for cloud-native Kubernetes networks.

[0006] In a first aspect, embodiments of this disclosure provide a blacklist control method for a cloud-native Kubernetes network, comprising: importing a configuration file for interacting with an API service node to obtain container resources and network access control custom resources; receiving an event synchronized by the API service node, wherein the event is triggered by the API service node based on changes in pre-configured container resources and network access control custom resources; obtaining an IP list based on the container resources and the network access control custom resources; generating a blacklist based on the IP list; and discarding the data in response to receiving data matching the blacklist.

[0007] In some embodiments, the network access control custom resource includes a network segment type, and the matching parameters of the network access control custom resource for the network segment type include: network protocol, source IP network segment, source port, destination IP network segment, and destination port; and the step of obtaining the IP list based on the container resource and the network access control custom resource includes: if the event is a network access control custom resource event and the network access control custom resource is a network segment type, then traffic filtering network segment and port rules are compiled based on the network protocol, source IP network segment, source port, destination IP network segment, and destination port.

[0008] In some embodiments, the network access control custom resource includes a container type, and the matching parameters for the container type network access control custom resource include: a label selector, inbound network segment and port, and outbound network segment and port; and the step of obtaining an IP list based on the container resource and the network access control custom resource includes: if the event is a network access control custom resource event and the network access control custom resource is a container type, then filtering the target container from the container resource according to the label selector; and organizing traffic filtering network segment and port rules according to the inbound network segment and port, and outbound network segment and port of the target container.

[0009] In some embodiments, the network access control custom resource includes a container type, and the matching parameters of the network access control custom resource for the container type include: label selector, inbound network segment and port, and outbound network segment and port; and the step of obtaining the IP list based on the container resource and the network access control custom resource includes: if the event is a container resource event, then checking whether the matching parameters of the network access control custom resource can match the label selector resolving to the target container; if they can match, then organizing the traffic filtering network segment and port rules according to the inbound network segment and port, and the outbound network segment and port of the target container.

[0010] In some embodiments, generating a blacklist based on the IP list includes: generating a custom chain based on the namespace and naming of the network access control list; configuring filtering rules for the custom chain; generating a 5-tuple based on the IP list; and performing a discard operation by matching the filtering rules with the 5-tuple.

[0011] In some embodiments, configuring the filtering rules for the custom chain includes configuring the custom chain to jump from the input and the forwarding point.

[0012] In some embodiments, the changes include additions, modifications, and deletions.

[0013] Secondly, embodiments of this disclosure provide a blacklist control device for a cloud-native Kubernetes network, comprising: an import unit configured to import a configuration file for interacting with an API service node to obtain container resources and network access control custom resources; a synchronization unit configured to receive an event synchronized by the API service node, wherein the event is triggered by the API service node based on changes in pre-configured container resources and network access control custom resources; an acquisition unit configured to acquire an IP list based on the container resources and the network access control custom resources; a generation unit configured to generate a blacklist based on the IP list; and a filtering unit configured to discard data that matches the blacklist upon receipt.

[0014] In some embodiments, the network access control custom resource includes a network segment type, and the matching parameters of the network access control custom resource of the network segment type include: network protocol, source IP network segment, source port, destination IP network segment, and destination port; and the acquisition unit is further configured to: if the event is a network access control custom resource event and the network access control custom resource is a network segment type, then organize the traffic filtering network segment and port rules according to the network protocol, source IP network segment, source port, destination IP network segment, and destination port.

[0015] In some embodiments, the network access control custom resource includes a container type, and the matching parameters for the container type network access control custom resource include: a label selector, inbound network segment and port, and outbound network segment and port; and the acquisition unit is further configured to: if the event is a network access control custom resource event and the network access control custom resource is a container type, then filter the target container from the container resource according to the label selector; and organize the traffic filtering network segment and port rules according to the inbound network segment and port, and outbound network segment and port of the target container.

[0016] In some embodiments, the network access control custom resource includes a container type, and the matching parameters of the network access control custom resource for the container type include: label selector, inbound network segment and port, and outbound network segment and port; and the acquisition unit is further configured to: if the event is a container resource event, then check whether the matching parameters of the network access control custom resource can match the label selector to resolve to the target container; if they can match, then organize the traffic filtering network segment and port rules according to the inbound network segment and port, and the outbound network segment and port of the target container.

[0017] In some embodiments, the generation unit is further configured to: generate a custom chain based on the namespace and name of the network access control list; configure filtering rules for the custom chain; generate a 5-tuple based on the IP list; and perform a discard operation by matching the filtering rules with the 5-tuple.

[0018] In some embodiments, the generation unit is further configured to configure the custom chain to jump from the input and the forwarding point.

[0019] In some embodiments, the changes include additions, modifications, and deletions.

[0020] Thirdly, embodiments of this disclosure provide an electronic device for blacklist control of cloud-native Kubernetes networks, comprising: one or more processors; and a storage device having one or more computer programs stored thereon, wherein when the one or more computer programs are executed by the one or more processors, the one or more processors implement the method as described in any one of the first aspects.

[0021] Fourthly, embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method as described in any one of the first aspects.

[0022] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0023] Other features, objects, and advantages of this disclosure will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0024] Figure 1 This is an exemplary system architecture diagram to which one embodiment of this disclosure can be applied;

[0025] Figure 2 This is a flowchart of one embodiment of the blacklist control method for cloud-native Kubernetes networks according to this disclosure;

[0026] Figures 3a-3b This is a schematic diagram illustrating an application scenario of the blacklist control method for cloud-native Kubernetes networks disclosed herein.

[0027] Figure 4 This is a schematic diagram of the structure of an embodiment of a blacklist control device for a cloud-native Kubernetes network according to the present disclosure;

[0028] Figure 5 This is a schematic diagram of the structure of a computer system suitable for implementing embodiments of the present disclosure. Detailed Implementation

[0029] The present disclosure will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0030] It should be noted that, unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other. This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0031] Figure 1 An exemplary system architecture is shown, illustrating embodiments of the blacklist control method or apparatus for cloud-native Kubernetes networks to which the present disclosure can be applied.

[0032] like Figure 1 As shown, the system architecture is divided into two parts: the control plane and the data plane. The control plane includes the apiserver (API service node) and the NetworkAcl CRD (Network Access Control Custom Resource). The apiserver is Kubernetes' own management platform, capable of registering pod resources (setting pod IPs, tags, etc.) and managing them. The data plane includes aclcontroller, iptables, and ipset. aclcontroller is the blacklist controller (i.e., plugin) designed in this application, while iptables and ipset are modules built into existing firewalls.

[0033] iptables can create a list of rules to implement highly detailed access control. It operates in user space and is a tool for defining rules; it is not itself a firewall. The rules it defines can be read by netfilter in kernel space, enabling the firewall to function. The location within the kernel must be specific, somewhere the TCP / IP protocol stack passes through. This necessary passage for the TCP / IP protocol stack to read the rules is called netfilter (network filter).

[0034] When a host receives a data packet, it first processes it in kernel space. If the destination address is found to be itself, the packet is forwarded to user space for processing by the corresponding application. If the destination is not itself, the packet is either dropped or forwarded. Netfilter determines whether data is retained or rejected based on the rules defined by iptables.

[0035] The principle behind iptables' firewall functionality is as follows: there are five key points in the process of a data packet passing through the kernel, namely PREROUTING, INPUT, OUTPUT, FORWARD, and POSTROUTING, which are called hook functions. The user-space software iptables can write rules in these five places to process the data packets that pass through. The rules are generally defined as "if the data packet header meets these conditions, then process the data packet in this way".

[0036] However, in iptables, matching multiple IP addresses results in multiple iptables rules (these IPs are random). When matching hundreds or even thousands of IP addresses, performance becomes severely impacted. This is where ipset comes in. ipset significantly improves this, primarily in its structure and rule lookup. In situations like the one described above, ipset maintains a relatively stable performance. The addition of ipset also makes blacklist management much easier.

[0037] In Kubernetes, NetworkAcl CRD (CustomResourceDefinition) defines the structure of a blacklist. The aclcontroller plugin is used to parse user-configured CR resources into network configurations for the data plane.

[0038] Add a new CRD (CustomResourceDefinition) structure definition NetworkAcl that supports blacklists, as follows:

[0039]

[0040]

[0041] The Type field specifies the NetworkAcl type, supporting two types: "cidr" (network segment type) and "pod" (container type). "cidr" indicates that the blacklist matching parameter is a network segment, and all traffic matching the corresponding network segment + port rule will be disabled. "pod" indicates that the blacklist matching parameter is a pod label, and only pods containing the matching label will be blacklisted, disabling both inbound and outbound traffic.

[0042] CidrBlackListSpec is the matching parameter in CIDR mode. The matching information is a five-tuple (source IP address segment, source port, destination IP address segment, destination port, network protocol).

[0043] PodBlackListSpec is a matching parameter in pod mode. The matching information is podSelector, which restricts Ingress and Egress access for pods that match this label.

[0044] It should be noted that the blacklist control method for cloud-native Kubernetes networks provided in the embodiments of this disclosure is generally executed by ACL controller, and correspondingly, the blacklist control device for cloud-native Kubernetes networks is generally set in ACL controller.

[0045] It should be understood that Figure 1 The number of apiserver and aclcontroller shown is merely illustrative. Depending on the implementation requirements, there can be any number of terminal devices, networks, and servers.

[0046] Continue to refer to Figure 2 The diagram illustrates a flow 200 of an embodiment of a blacklist control method for cloud-native Kubernetes networks according to this disclosure. The blacklist control method for cloud-native Kubernetes networks includes the following steps:

[0047] Step 201: Import the configuration file used to interact with the API service node to obtain container resources and network access control custom resources.

[0048] In this embodiment, the execution entity of the blacklist control method for cloud-native Kubernetes networks (e.g., Figure 1 The ACL controller shown can download configuration files via wired or wireless connection, such as... Figure 3aThe kubeconfig shown is configured to interact with the API service node to obtain container resources and custom network access control resources. The aclcontroller can obtain container resources and custom network access control resources via list (full access) or watch (incremental access). Container resources may include labels, IP addresses, and other information. Custom network access control resources (NetworkAclCR) may include information such as type and blacklist matching parameters. The specific data structure is as described above. The Type field represents the NetworkAcl type, supporting two types ("cidr" and "pod"): cidr indicates that the blacklist matching parameter is a network segment, and all traffic matching the corresponding network segment + port rule will be disabled; pod indicates that the blacklist matching parameter is a pod label, and only pods containing the matching label will use the blacklist, disabling both inbound and outbound traffic.

[0049] CidrBlackListSpec is the matching parameter in CIDR mode. The matching information is a five-tuple (source IP address segment, source port, destination IP address segment, destination port, network protocol).

[0050] PodBlackListSpec is a matching parameter in pod mode. The matching information is podSelector, which restricts Ingress and Egress access for pods that match this label.

[0051] Step 202: Receive the API service node synchronization event.

[0052] In this embodiment, the event is triggered by the API service node based on changes in pre-configured container resources and network access control custom resources.

[0053] Changes can include the addition, modification, or deletion of container resources, or the addition, modification, or deletion of custom resources for network access control. For example, cluster expansion increases the number of containers, triggering a container resource addition event. The API service node will synchronously send the event to the aclcontroller.

[0054] If a user edits a custom resource for network access control, a custom resource event for network access control will also be triggered. The API service node will then synchronously send the event to the aclcontroller.

[0055] Step 203: Obtain the IP list based on container resources and network access control custom resources.

[0056] In this embodiment, when an event is received, indicating that the container resource and the network access control custom resource have changed, the IP address in the updated network access control custom resource is obtained, or the IP address of the updated container resource's label is obtained that matches the label selector of the network access control custom resource.

[0057] Step 204: Generate a blacklist based on the IP list.

[0058] In this embodiment, the existing iptables and ipset modules can be used to generate the blacklist. Alternatively, only the iptables module can be used to generate the blacklist.

[0059] Step 205: In response to receiving data that matches the blacklist, discard the data.

[0060] In this embodiment, the blacklist can filter data based on the IP address 5-tuple (source IP network segment, source port, destination IP network segment, destination port, network protocol), and data that matches the blacklist is discarded.

[0061] The method provided in the above embodiments of this disclosure provides a Kubernetes custom network ACL blacklist access controller, which realizes dynamic configuration of the cluster network blacklist.

[0062] In some optional implementations of this embodiment, the network access control custom resource includes a network segment type, and the matching parameters of the network access control custom resource for the network segment type include: network protocol, source IP network segment, source port, destination IP network segment, and destination port; and

[0063] The step of obtaining the IP list based on the container resources and the network access control custom resources includes:

[0064] If the event is a network access control custom resource event and the network access control custom resource is a network segment type, then traffic filtering network segment and port rules are compiled based on the network protocol, source IP network segment, source port, destination IP network segment, and destination port.

[0065] The data structure for matching parameters of custom resources in network access control for network segment types is shown below:

[0066]

[0067]

[0068] Custom resources for CIDR-type network access control can be configured directly with iptables and ipset rules in the data plane.

[0069] In some optional implementations of this embodiment, the network access control custom resource includes a container type, and the matching parameters of the container type's network access control custom resource include: label selector, inbound network segment and port, and outbound network segment and port; and

[0070] The step of obtaining the IP list based on the container resources and the network access control custom resources includes:

[0071] If the event is a network access control custom resource event and the network access control custom resource is a container type, then the target container is selected from the container resources according to the tag selector;

[0072] Based on the inbound network segment and port, and the outbound network segment and port of the target container, traffic filtering network segment and port rules are compiled.

[0073] The data structure for matching parameters of custom resources in network access control for container types is shown below:

[0074]

[0075] The type is pod, and the list contains all pods that match the label selector. This retrieves the list of IPs and completes the configuration of the data plane iptables and ipset.

[0076] In some optional implementations of this embodiment, the network access control custom resource includes a container type, and the matching parameters of the container type's network access control custom resource include: label selector, inbound network segment and port, and outbound network segment and port; and

[0077] The step of obtaining the IP list based on the container resources and the network access control custom resources includes:

[0078] If the event is a container resource event, then check whether the matching parameters of the network access control custom resource can match the target container resolved by the tag selector;

[0079] If a match is found, traffic filtering network segment and port rules are generated based on the inbound network segment and port, and the outbound network segment and port of the target container.

[0080] When AclController receives a pod event synchronized from the Kubernetes API server, it checks whether a matching label selector can be resolved to that pod in the NetworkAcl CR. If so, it completes the configuration of the data plane iptables and ipset.

[0081] In some optional implementations of this embodiment, generating a blacklist based on the IP list includes: generating a custom chain based on the namespaces and names of the network access control list; configuring filtering rules for the custom chain; generating 5-tuples based on the IP list; and performing a drop operation by matching the filtering rules against the 5-tuples. The custom chain is generated based on the namespaces and names of the NetworkAcl, configured to redirect from INPUT and FORWARD, or alternatively, redirect from PREROUTING, INPUT, OUTPUT, FORWARD, and POSTROUTING. Then, the corresponding 5-tuples are matched to perform a drop operation.

[0082] In some optional implementations of this embodiment, configuring the filtering rules for the custom chain includes: configuring the custom chain to jump from the input and forwarding points; configuring jumps from INPUT and FORWARD.

[0083] In some optional implementations of this embodiment, the changes include adding, modifying, and deleting. Each change alters the IP addresses in the blacklist, therefore, a blacklist update needs to be triggered based on the changes.

[0084] See also Figures 3a-3b , Figures 3a-3b This is a schematic diagram illustrating an application scenario of the blacklist control method for cloud-native Kubernetes networks according to this embodiment. The specific process is described as follows:

[0085] 1. The Aclcontroller initializes by importing the kubeconfig file, interacting with the k8s apiserver, and listing / watching pod resources and NetworkAcl CR resources.

[0086] 2. Users can perform CR operations (add, delete, modify, and query) to configure the network ACL.

[0087] 3. When the AclController receives a NetworkAcl CR event synchronized from the Kubernetes API server, it follows different processing procedures depending on whether the CR type is pod or CIDR. If the type is CIDR, it directly configures iptables and ipset rules in the data plane; if the type is pod, it lists all pods that match the label selector, obtains the IP list, and completes the configuration of iptables and ipset rules in the data plane.

[0088] 4. When the AclController receives a pod event synchronized from the Kubernetes API server, it checks whether the label selector in the NetworkAcl CR matches and resolves to the pod. If so, it completes the configuration of the data plane iptables and ipset.

[0089] like Figure 3b As shown, the data plane uses the iptables and ipset modules to complete ACL configuration. A custom chain is generated based on the NetworkAcl namespaces and name, configuring jumps from INPUT and FORWARD, and executing a drop operation when matching the corresponding 5-tuple. Disabled network segments in the inbound direction are configured in inress-src-pool and inress-dst-pool, while disabled network segments in the outbound direction are configured in egress-src-pool and egress-dst-pool. An example is shown below:

[0090] ipset create test1-ingress-src-pool hash:net

[0091] ipset add test1-ingress-src-pool 10.0.0.0 / 24

[0092] ipset create test1-ingress-dst-pool hash:net

[0093] ipset add test1-ingress-dst-pool 172.16.0.0 / 24

[0094] iptables -N TEST_CHAIN

[0095] iptables -A INPUT -j TEST_CHAIN

[0096] iptables-A FORWARD-j TEST_CHAIN

[0097] iptables-A TEST_CHAIN-m set--match-set test1-ingress-src-pool src-mset--match-set test1-ingress-dst-pool dst-j DROP

[0098] This example demonstrates how to disable traffic from the source network segment 10.0.0.0 / 24 to the destination network segment 172.16.0.0 / 24.

[0099] Further reference Figure 4 As an implementation of the methods shown in the above figures, this disclosure provides an embodiment of a blacklist control device for cloud-native Kubernetes networks. This device embodiment is similar to... Figure 2 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0100] like Figure 4 As shown, the cloud-native Kubernetes network blacklist control device 400 of this embodiment includes: an import unit 401, a synchronization unit 402, an acquisition unit 403, a generation unit 404, and a filtering unit 405. The import unit 401 is configured to import configuration files used to interact with API service nodes to obtain container resources and network access control custom resources; the synchronization unit 402 is configured to receive synchronization events from the API service nodes, wherein the events are triggered by the API service nodes based on changes in pre-configured container resources and network access control custom resources; the acquisition unit 403 is configured to acquire an IP list based on the container resources and the network access control custom resources; the generation unit 404 is configured to generate a blacklist based on the IP list; and the filtering unit 405 is configured to discard data that matches the blacklist upon receipt.

[0101] In this embodiment, the specific processing of the import unit 401, synchronization unit 402, acquisition unit 403, generation unit 404, and filtering unit 405 of the cloud-native Kubernetes network blacklist control device 400 can be referred to Figure 2 The corresponding steps are 201, 202, 203, 204 and 205 in the embodiment.

[0102] In some optional implementations of this embodiment, the network access control custom resource includes a network segment type, and the matching parameters of the network access control custom resource of the network segment type include: network protocol, source IP network segment, source port, destination IP network segment, and destination port; and the acquisition unit 403 is further configured to: if the event is a network access control custom resource event and the network access control custom resource is a network segment type, then organize the traffic filtering network segment and port rules according to the network protocol, source IP network segment, source port, destination IP network segment, and destination port.

[0103] In some optional implementations of this embodiment, the network access control custom resource includes a container type, and the matching parameters of the container type network access control custom resource include: a label selector, inbound network segment and port, and outbound network segment and port; and the acquisition unit 403 is further configured to: if the event is a network access control custom resource event and the network access control custom resource is a container type, then filter the target container from the container resource according to the label selector; and organize the traffic filtering network segment and port rules according to the inbound network segment and port, and outbound network segment and port of the target container.

[0104] In some optional implementations of this embodiment, the network access control custom resource includes a container type, and the matching parameters of the network access control custom resource for the container type include: label selector, inbound network segment and port, and outbound network segment and port; and the acquisition unit 403 is further configured to: if the event is a container resource event, then check whether the matching parameters of the network access control custom resource can match the label selector to resolve to the target container; if they can match, then organize the traffic filtering network segment and port rules according to the inbound network segment and port, and the outbound network segment and port of the target container.

[0105] In some optional implementations of this embodiment, the generation unit 404 is further configured to: generate a custom chain based on the namespace and name of the network access control list; configure filtering rules for the custom chain; generate a 5-tuple based on the IP list; and perform a discard operation by matching the filtering rules with the 5-tuple.

[0106] In some embodiments, the generation unit 404 is further configured to configure the custom chain to jump from the input and the forwarding point.

[0107] In some embodiments, the changes include additions, modifications, and deletions.

[0108] It should be noted that the collection, gathering, updating, analysis, processing, use, transmission, and storage of user personal information involved in this disclosed technical solution all comply with relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken to prevent unauthorized access to user personal information data and to safeguard user personal information security, network security, and national security.

[0109] According to embodiments of this disclosure, this disclosure also provides an electronic device and a readable storage medium.

[0110] An electronic device includes: one or more processors; and a storage device having one or more computer programs stored thereon, which, when executed by the one or more processors, cause the one or more processors to implement the method described in process 200 or 400.

[0111] A computer-readable medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method described in process 200.

[0112] Figure 5 A schematic block diagram of an example electronic device 500 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0113] like Figure 5 As shown, device 500 includes a computing unit 501, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 502 or a computer program loaded from storage unit 508 into random access memory (RAM) 503. RAM 503 may also store various programs and data required for the operation of device 500. The computing unit 501, ROM 502, and RAM 503 are interconnected via bus 504. Input / output (I / O) interface 505 is also connected to bus 504.

[0114] Multiple components in device 500 are connected to I / O interface 505, including: input unit 506, such as keyboard, mouse, etc.; output unit 507, such as various types of monitors, speakers, etc.; storage unit 508, such as disk, optical disk, etc.; and communication unit 509, such as network card, modem, wireless transceiver, etc. Communication unit 509 allows device 500 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0115] The computing unit 501 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 501 performs the various methods and processes described above, such as the blacklist control method for cloud-native Kubernetes networks. For example, in some embodiments, the blacklist control method for cloud-native Kubernetes networks can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 508. In some embodiments, part or all of the computer program can be loaded and / or installed on device 500 via ROM 502 and / or communication unit 509. When the computer program is loaded into RAM 503 and executed by the computing unit 501, one or more steps of the blacklist control method for cloud-native Kubernetes networks described above can be performed. Alternatively, in other embodiments, computing unit 501 may be configured to perform a blacklist control method for cloud-native Kubernetes networks by any other suitable means (e.g., by means of firmware).

[0116] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0117] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0118] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0119] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0120] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0121] Computer systems can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be servers in distributed systems or servers incorporating blockchain technology. Servers can also be cloud servers, or intelligent cloud computing servers or intelligent cloud hosts with artificial intelligence technology.

[0122] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0123] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A blacklist control method for cloud-native Kubernetes networks, comprising: Import the configuration file used to interact with the API service node to obtain container resources and custom resources for network access control; Receive the synchronization event from the API service node, wherein the event is triggered by the API service node based on changes in pre-configured container resources and network access control custom resources; Obtain the IP list based on the container resources and the network access control custom resources; Generate a blacklist based on the IP list; Upon receiving data that matches the blacklist, the data is discarded; The step of generating a blacklist based on the IP list includes: Generate a custom chain based on the namespace and name of the network access control list; Configure the filtering rules for the custom chain; Generate a quintuple based on the IP list; The filtering rule is matched with the quintuple and a discard operation is performed.

2. The method according to claim 1, wherein, Custom resources for network access control include network segment types. The matching parameters for custom resources for network access control of network segment types include: network protocol, source IP network segment, source port, destination IP network segment, and destination port; and... The step of obtaining the IP list based on the container resources and the network access control custom resources includes: If the event is a network access control custom resource event and the network access control custom resource is a network segment type, then traffic filtering network segment and port rules are compiled based on the network protocol, source IP network segment, source port, destination IP network segment, and destination port.

3. The method according to claim 1, wherein, Custom resources for network access control include container types. Matching parameters for container-type custom resources for network access control include: label selector, inbound network segment and port, and outbound network segment and port; and The step of obtaining the IP list based on the container resources and the network access control custom resources includes: If the event is a network access control custom resource event and the network access control custom resource is a container type, then the target container is selected from the container resources according to the tag selector; Based on the inbound network segment and port, and the outbound network segment and port of the target container, traffic filtering network segment and port rules are compiled.

4. The method according to claim 1, wherein, Custom resources for network access control include container types. Matching parameters for container-type custom resources for network access control include: label selector, inbound network segment and port, and outbound network segment and port; and The step of obtaining the IP list based on the container resources and the network access control custom resources includes: If the event is a container resource event, then check whether the matching parameters of the network access control custom resource can match the target container resolved by the tag selector; If a match is found, traffic filtering network segment and port rules are generated based on the inbound network segment and port, and the outbound network segment and port of the target container.

5. The method according to claim 1, wherein, The configuration of the filtering rules for the custom chain includes: Configure the custom chain to jump from the input and forwarding points.

6. The method according to any one of claims 1-5, wherein the changes include additions, modifications, and deletions.

7. A blacklist control device for a cloud-native Kubernetes network, comprising: The import unit is configured to import configuration files used to interact with API service nodes to obtain container resources and network access control custom resources. The synchronization unit is configured to receive synchronization events from the API service node, wherein the events are triggered by the API service node based on changes in pre-configured container resources and network access control custom resources. The acquisition unit is configured to acquire an IP list based on the container resources and the network access control custom resources; The generation unit is configured to generate a blacklist based on the IP list; The filtering unit is configured to discard the data in response to receiving data that matches the blacklist; The step of generating a blacklist based on the IP list includes: Generate a custom chain based on the namespace and name of the network access control list; Configure the filtering rules for the custom chain; Generate a quintuple based on the IP list; The filtering rule is matched with the quintuple and a discard operation is performed.

8. An electronic device for blacklist control in cloud-native Kubernetes networks, comprising: One or more processors; Storage device, on which one or more computer programs are stored, When the one or more computer programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-6.

9. A computer-readable medium having a computer program stored thereon, wherein, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-6.

Images