Method and system for entering Kubernetes container based on SSH reverse proxy

Abstract

The present application discloses a method and system for accessing a Kubernetes container based on an SSH reverse proxy. The method includes receiving a development machine request sent by a client to a startup configuration manager; the startup configuration manager selects an FRPS instance based on the development machine request, configures a free port, and feeds back the address and free port of the FRPS instance to the client; when a development machine controller monitors the development machine configuration information in the startup configuration manager, it creates a custom resource in the API server of the Kubernetes cluster based on the development machine configuration information, and writes the local public key in the development machine request to the configuration mapping of the Kubernetes cluster; configures the development machine container environment; and establishes a connection between FRPC and FRPS. The present invention implements access to the Kubernetes container network through the FRP proxy, achieving simple and secure development environment configuration.

Description

Technical Field

[0001] The present application relates to the field of interaction and container technology, and in particular to a method and system for entering a Kubernetes container based on a secure shell (SSH) reverse proxy. Background Art

[0002] Kubernetes (often referred to as K8s) is an open-source management platform designed to automate the deployment, scaling, and management of containerized applications. The Kubernetes platform provides a powerful container orchestration and management system designed to simplify the deployment and maintenance of containerized applications, making the development and operation of modern cloud-native applications more convenient and efficient.

[0003] A development machine is a computer device used for software development, typically a workstation used by developers to write, test, and debug code. Development machines play a crucial role in the software development process, providing an integrated development environment that enables developers to efficiently create, modify, and test software applications. To achieve unified resource scheduling and workload orchestration, internal development machines can also be containerized and managed within a Kubernetes cluster.

[0004] When Kubernetes manages the development machine, developers usually use the kubectlexec command to log in or enter the target container. kubectlexec is a command-line tool for Kubernetes that is used to execute commands within a running container. The kubectlexec command first communicates with the Application Programming Interface (API) server (i.e., APIServer) of the Kubernetes cluster. The API server is the core control center of the Kubernetes cluster. Before initiating the exec request, the API server of the Kubernetes cluster will authenticate and authorize the exec request. Only authorized users or service accounts with sufficient permissions can perform the exec operation. After determining which container of which Pod (pod, the smallest / simplest basic unit created or deployed by Kubernetes) component to execute the command, kubectlexec communicates with the kubelet on the node where the Pod component is located, and finally executes the command in the specified container through interaction with the container runtime interface (such as Docker, containerd).

[0005] The above method of using the kubectlexec command to log in to or enter the target container has the following defects:

[0006] (1) Developers need to have basic Kubernetes skills, such as configuring the kubectl client, obtaining development machine Pod information, and understanding RBAC permission control. Compared to traditional development environments where only the development machine address is needed and logging in via SSH (Secure Shell) commands is required, using the kubectlexec command to log in to the target container may increase the learning cost for beginners or non-professionals.

[0007] (2) All traffic must pass through the Kubernetes cluster's API server. When a large number of development machines are used, this may put significant performance pressure on the Kubernetes cluster's API server. Given that the API server is a core component of the Kubernetes cluster, performance pressure may affect the entire system.

[0008] (3) The developer's enterprise network (i.e., office network) needs to be connected to the Kubernetes container network. However, in order to maintain network security isolation, it is usually necessary to isolate the enterprise network from the Kubernetes container network.

[0009] The content of this background technology description is only for facilitating understanding of the relevant technology in this field and is not regarded as an admission of the prior art. Summary of the Invention

[0010] The present invention intends to provide a method and system for accessing Kubernetes containers based on SSH reverse proxy, so as to solve the problems of cumbersome Kubernetes configuration in the existing kubectlexec command login or entry method, which brings great performance pressure to the API server and cannot maintain network security isolation.

[0011] In a first aspect, the present invention provides a method for accessing Kubernetes based on an SSH reverse proxy, comprising the following steps:

[0012] Receive a request for a development machine sent by the client to the boot configuration manager;

[0013] The boot configuration manager selects a reverse proxy server instance according to the application development machine request, configures an idle port, and feeds back the address and idle port of the reverse proxy server instance to the client;

[0014] When the development machine controller monitors the development machine configuration information in the startup configuration manager, it creates a custom resource in the application programming interface server of the Kubernetes cluster based on the development machine configuration information, and writes the local public key in the development machine application request into the configuration map of the Kubernetes cluster; wherein the custom resource is used to describe the development machine requirements;

[0015] Configure the development machine container environment;

[0016] Establish a connection between the reverse proxy client and the reverse proxy server.

[0017] Furthermore, the request to apply for a development machine includes development machine specifications and a local public key.

[0018] Furthermore, the development machine container environment includes an initialization container, an FRPC sidecar container, and a main container;

[0019] Perform SSH initialization configuration in the initialization container; start the reverse proxy client process in the FRPC sidecar container, connect to the reverse proxy server, and proxy the secure shell daemon process of the internal container; start the secure shell daemon process service in the main container.

[0020] Furthermore, a proxy is used to establish a connection between the reverse proxy client and the reverse proxy server.

[0021] In a second aspect, the present invention provides a system for accessing a Kubernetes container based on an SSH reverse proxy, comprising:

[0022] The client is configured to generate a request for applying for a development machine and send the request to the startup configuration manager;

[0023] A boot configuration manager is configured to select a reverse proxy server instance according to the application development machine request, configure an idle port, and feed back the address and idle port of the reverse proxy server instance to the client;

[0024] The development machine controller is configured to monitor the development machine configuration information in the startup configuration manager, and upon monitoring the development machine configuration information in the startup configuration manager, create a custom resource in the application programming interface server of the Kubernetes cluster based on the development machine configuration information, and write the local public key in the development machine application request into the configuration map of the Kubernetes cluster; wherein the custom resource is used to describe the development machine requirements;

[0025] Kubernetes container, configured to configure the development machine container environment;

[0026] The proxy server is configured to establish a connection between the reverse proxy client and the reverse proxy server.

[0027] In the method or system for entering the Kubernetes container based on SSH reverse proxy used by the present invention, access to the Kubernetes container network is achieved through the FRP proxy, effectively converging the intercommunication range between the enterprise network and the Kubernetes container network to a minimum; the FRP proxy server supports horizontal expansion, and its instance and port allocation are controlled by centralized components, improving the scalability and performance of the system; through Kubernetes resource customization (CRD) and the corresponding controller, refined orchestration and control of the development machine container is achieved, which can fully utilize the powerful functions of Kubernetes and make the deployment and management of the development machine more flexible and controllable.

[0028] Through the method of the present invention, users can successfully enter or log in to the development machine in the Kubernetes container through SSH instructions, FRPS and FRPC agents in the enterprise network, realizing simple and secure development environment configuration.

[0029] Other optional features and technical effects of the present invention are partially described below, and partially can be understood by reading this document. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. The elements shown are not limited to the scale shown in the drawings. The same or similar reference numerals in the drawings represent the same or similar elements, wherein:

[0031] Figure 1 An example flow chart of a method for entering a Kubernetes container based on an SSH reverse proxy according to an embodiment of the present invention is shown;

[0032] Figure 2 An example structural diagram of a system for entering a Kubernetes container based on an SSH reverse proxy according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below in conjunction with specific embodiments and accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0034] As used herein, the term "including" and its variations represent open inclusion, i.e., "including but not limited to." Unless otherwise stated, the term "or" means "and / or." The term "based on" means "based at least in part on." The terms "an example embodiment" and "an embodiment" mean "at least one example embodiment." The term "another embodiment" means "at least one additional embodiment." The terms "first," "second," etc. may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0035] In order to make the present invention clearer, the following terms are explained here:

[0036] Kubernetes: Often referred to as K8s, is an open source management platform designed to automate the deployment, scaling, and management of container applications.

[0037] SSH (Secure Shell): A network protocol used for remote connections in an encrypted manner.

[0038] FRPS (FastReverseProxyServer): reverse proxy server;

[0039] FRPC (FastReverseProxyClient): reverse proxy client;

[0040] Init container: Initialization container, responsible for configuring the initialization components of the development machine container environment;

[0041] A sidecar container is an auxiliary container that shares the same Pod with the main container and provides additional functions and resources to enhance or extend the functions of the main container.

[0042] Main container: The main container responsible for starting the Secure Shell Daemon (SSHD) service.

[0043] Figure 1 A flowchart of a method for entering a Kubernetes container based on an SSH reverse proxy is shown. Figure 1 As shown, the method includes the following steps:

[0044] Step S1: receiving a request for a development machine sent by a user to a startup configuration manager via a client;

[0045] Step S2: The boot configuration manager selects a FRPS instance according to the application development machine request, configures an idle port, and feeds back the address and idle port of the FRPS instance to the client;

[0046] Step S3: When the development machine controller monitors the development machine configuration information in the startup configuration manager, it creates a custom resource (DevMachineCR) in the Kubernetes API server based on the development machine configuration information, and writes the local public key in the development machine application request into the configuration map (configMap) of the Kubernetes cluster; wherein the custom resource is used to describe the development machine requirements;

[0047] Step S4: Configure the development machine container environment;

[0048] Step S5: Establish a connection between FRPC and FRPS.

[0049] The present invention involves two main network components: the company's enterprise network (Employee network) and the Kubernetes container network (K8s network). The enterprise network (Employee network) includes: a client used by Developers (developers), who are company employees and professionals responsible for application development; DevMachineManager (startup configuration manager), a component responsible for managing the startup configuration of the development machine; FRPS (reverse proxy server), a reverse proxy server based on the open source implementation of fatedier / frp, used to handle external requests. The Kubernetes container network (K8s network) includes: DevMachineController (development machine controller), a component that monitors the development machine configuration information (or description information) in DevMachineManager; FRPC (proxy server), a proxy server based on the open source implementation of fatedier / frp, which connects to FRPS and proxies internal containers; Init container (initialization container), an initialization component responsible for configuring the development machine container environment; Main container (SSHD main container), the main container responsible for starting the SSHD service.

[0050] The user in step S1 is a developer. When the development machine needs to be managed by a Kubernetes container, the developer logs in to the client and generates a development machine application request on the client based on the development machine specifications and local public key. The development machine application request includes the development machine specifications and the local public key.

[0051] The enterprise network (or office network) machine used by developers cannot be directly connected to the Kubernetes container network machine, but the Kubernetes container network machine can access the server online, so the enterprise network machine can connect to the Kubernetes container network machine through the server. The FRP of the present invention adopts the C / S (Client / Server) mode, deploys the server on a machine with a public IP (Internet Protocol) address (i.e., the enterprise network machine of the present invention), and deploys the client on a machine in the intranet or within the firewall (i.e., the Kubernetes container network machine). By accessing the port exposed on the server, it reverse proxies to the service in the intranet. FRP supports multiple protocols such as TCP (Transmission Control Protocol), UDP (User Datagram Protocol), HTTP (Hypertext Transfer Protocol), HTTPS (Hypertext Transfer Protocol Secure), and provides many capabilities such as encryption, compression, identity authentication, proxy speed limiting, and load balancing.

[0052] In an embodiment of the present invention, a development machine controller creates custom resources in the Kubernetes cluster's API server based on the development machine's configuration information. These custom resources describe the development machine's requirements. This invention extends the API through Custom Resource Definitions (CRDs), enabling interaction with custom resources using kubectl and the Kubernetes API. This addresses the performance issues associated with requiring all traffic to pass through the API server.

[0053] In an embodiment of the present invention, the development machine container environment includes an Init container, an FRPCSidecar container, and a Main container. SSH initialization configuration is performed in the Init container; the FRPC process is started in the FRPCSidecar container, connected to FRPS, and proxying the SSHD of the internal container; and the SSHD service is started in the Main container.

[0054] Init containers perform preparatory work before application containers start, such as setting configuration files, downloading application dependencies, waiting for other services to be ready, or migrating databases. Init containers must run to completion before application containers start. One or more Init containers must run to completion before an application container starts, and one Init container must run to completion before the next Init container starts.

[0055] A sidecar container is a secondary container that shares the same pod as the main container and provides additional functionality and resources to enhance or extend the functionality of the main container. Sidecar containers can be responsible for collecting, aggregating, and formatting logs generated by the main container and sending them to a centralized log storage or processing system for monitoring and analysis. Sidecar containers can be responsible for collecting performance metrics, operating status, and other information from the main container and sending it to a monitoring system for real-time monitoring and alerting. Sidecar containers can provide authentication and authorization services, perform access control and permission management on the main container, and ensure that only authenticated and authorized requests can access the main container. Sidecar containers can act as proxies for the main container, handling network request forwarding and load balancing, and implementing traffic management and request distribution. Sidecar containers allow different functional modules to be independently deployed in different containers, allowing application components to be scaled, updated, and maintained independently of each other. They also provide improved observability and reliability, as well as more flexible deployment and management.

[0056] The Main container runs the main application. First, create the Main container, then define the Sidecar container in the Main container, and then build and deploy the Pod to run the Main container and Sidecar container in Kubernetes.

[0057] The present invention redirects the access of the enterprise network machine to the specific port of the cloud server to a port of the Kubernetes container network machine through FRP. In the present invention, the developer needs to remotely log in to the Kubernetes container through the client, which is actually the client using the SSH program on the Kubernetes container. Specifically, the client's SSH command is transmitted to the idle port on the boot configuration manager, and the idle port is monitored by the running FRPS instance; when the FRPS instance listens to an SSH command, it sends it to the Kubernetes container through other ports of the boot configuration manager. After the FRPC running on the Kubernetes container receives the SSH command sent by the client, the SSH command is finally processed by the service program on the Kubernetes container. The SSH service is essentially a text transmission service, and the SSH data packet uses the TCP protocol.

[0058] In an embodiment of the present invention, a proxy is used to establish a connection between FRPC and FRPS. At this time, the developer uses SSH instructions to log in to the development machine container in the Kubernetes container through the enterprise network after passing through the proxy of FRPS and FRPC. The present invention realizes communication between the enterprise network and the Kubernetes container network through intranet penetration technology and maintains the secure isolation of the network.

[0059] like Figure 2 As shown, an embodiment of the present invention provides a system for entering a Kubernetes container based on an SSH reverse proxy, including a client, a startup configuration manager, a development machine controller, a Kubernetes container, and a proxy server.

[0060] The client is configured to generate a request for a development machine and send the request to the startup configuration manager. A developer generates a request for a development machine through the client and sends the request to the startup configuration manager. In this embodiment of the present invention, the request includes the development machine specifications and a local public key.

[0061] A boot configuration manager is configured to select a FRPS instance according to the application development machine request, configure an idle port, and feed back the address and idle port of the FRPS instance to the client;

[0062] The development machine controller is configured to monitor the development machine configuration information in the startup configuration manager, and when monitoring the development machine configuration information in the startup configuration manager, create custom resources in the API server of the Kubernetes cluster according to the development machine configuration information, and write the local public key in the development machine application request into the configuration mapping of the Kubernetes cluster; wherein the custom resources are used to describe the development machine requirements.

[0063] Kubernetes container, configured to configure the development machine container environment.

[0064] The proxy server is configured to establish a connection between the FRPC and the FRPS.

[0065] In some embodiments, the system for entering a Kubernetes container based on an SSH reverse proxy can be combined with the method features of entering a Kubernetes container based on an SSH reverse proxy in any embodiment, and vice versa, which will not be repeated here.

[0066] In the method or system for entering the Kubernetes container based on SSH reverse proxy used by the present invention, access to the Kubernetes container network is achieved through the FRP proxy, effectively converging the intercommunication range between the enterprise network and the Kubernetes container network to a minimum; the FRP proxy server supports horizontal expansion, and its instance and port allocation are controlled by centralized components, improving the scalability and performance of the system; through Kubernetes resource customization (CRD) and the corresponding controller, refined orchestration and control of the development machine container is achieved, which can fully utilize the powerful functions of Kubernetes and make the deployment and management of the development machine more flexible and controllable.

[0067] Through the method of the present invention, users can successfully enter or log in to the development machine in the Kubernetes container through SSH instructions, FRPS and FRPC agents in the enterprise network, realizing simple and secure development environment configuration.

[0068] Unless explicitly stated, the actions or steps of the methods, procedures, and methods described in accordance with the embodiments of the present invention do not have to be performed in a specific order and can still achieve the desired results. In some implementations, multitasking and parallel processing are also possible or may be advantageous.

[0069] In this document, multiple embodiments of the present invention are described, but for the sake of brevity, the description of each embodiment is not exhaustive, and the same or similar features or parts between the embodiments may be omitted. In this document, "one embodiment", "some embodiments", "example", "specific example", or "some examples" are intended to apply to at least one embodiment or example according to the present invention, but not all embodiments. The above terms do not necessarily mean to refer to the same embodiment or example. Those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are mutually contradictory.

[0070] While the exemplary systems and methods of the present invention have been specifically shown and described with reference to the foregoing embodiments, these are merely examples of the best modes for implementing the present systems and methods. Those skilled in the art will appreciate that various changes may be made to the embodiments of the systems and methods described herein when implementing the present systems and / or methods without departing from the spirit and scope of the present invention as defined in the appended claims.

Claims

1. A method for entering a Kubernetes container based on SSH reverse proxy, characterized in that: The method comprises the following steps: Receive the request for development machine sent by the user to the boot configuration manager through the client; The boot configuration manager selects a reverse proxy server instance according to the application development machine request, configures an idle port, and feeds back the address and idle port of the reverse proxy server instance to the client; When the development machine controller monitors the development machine configuration information in the startup configuration manager, it creates a custom resource in the application programming interface server of the Kubernetes cluster based on the development machine configuration information, and writes the local public key in the development machine application request into the configuration map of the Kubernetes cluster; wherein the custom resource is used to describe the development machine requirements; Configure a development machine container environment in the Kubernetes cluster, the development machine container environment including an initialization container, an FRPC sidecar container, and a main container; perform SSH initialization configuration in the initialization container; start a reverse proxy client process in the FRPC sidecar container, connect to the reverse proxy server, and proxy the secure shell daemon process of the internal container; start the secure shell daemon process service in the main container; Establish a connection between the reverse proxy client and the reverse proxy server, so that the user can access the development machine container in the Kubernetes cluster based on SSH.

2. The method for entering a Kubernetes container based on an SSH reverse proxy according to claim 1, wherein: The request to apply for a development machine includes the development machine specifications and the local public key.

3. The method for entering a Kubernetes container based on an SSH reverse proxy according to claim 1 or 2, wherein: Use proxy to establish a connection between the reverse proxy client and the reverse proxy server.

4. A system for accessing Kubernetes containers based on SSH reverse proxy, characterized in that: The system comprises: The client is configured to generate a request for applying for a development machine and send the request to the startup configuration manager; A boot configuration manager is configured to select a reverse proxy server instance according to the application development machine request, configure an idle port, and feed back the address and idle port of the reverse proxy server instance to the client; The development machine controller is configured to monitor the development machine configuration information in the startup configuration manager, and upon monitoring the development machine configuration information in the startup configuration manager, create a custom resource in the application programming interface server of the Kubernetes cluster based on the development machine configuration information, and write the local public key in the development machine application request into the configuration map of the Kubernetes cluster; wherein the custom resource is used to describe the development machine requirements; A Kubernetes container is configured to configure a development machine container environment in the Kubernetes cluster, the development machine container environment including an init container, an FRPC sidecar container, and a main container; perform SSH initialization configuration in the init container; start a reverse proxy client process in the FRPC sidecar container, connect to a reverse proxy server, and proxy the secure shell daemon process of the internal container; and start the secure shell daemon process service in the main container; The proxy server is configured to establish a connection between the reverse proxy client and the reverse proxy server, so that the user can access the development machine container in the Kubernetes cluster based on SSH.

5. The system for entering Kubernetes containers based on SSH reverse proxy according to claim 4 is characterized in that The request to apply for a development machine includes the development machine specifications and the local public key.

Images