Deployment method and system of Ingress controller in host network mode

Abstract

This disclosure provides a deployment method, system, electronic device, and storage medium for an Ingress controller in a host network mode to address the problems of wide port exposure and information insecurity. The method includes: deploying the control plane and data plane containers on the same host machine; using a local dummy interface to listen on the management port and a local loopback interface to listen on the monitoring port; defining a first domain name and pointing it to the data plane container monitoring address and port; enabling the data plane container monitoring service; exposing a preset monitoring API for the data plane container; when the monitoring server makes a monitoring interface access request, rewriting the request URI according to ingress rules, forwarding it to the data plane container monitoring service, and enabling authentication and specific security restrictions; after successful verification, forwarding the request to the first domain name. This disclosure effectively reduces port exposure and ensures the security of the monitoring API.

Description

Technical Field

[0001] This disclosure relates to the field of computer cloud computing technology, specifically to a method for deploying an Ingress controller in a host network mode, a system for deploying an Ingress controller in a host network mode, an electronic device, and a computer-readable storage medium. Background Technology

[0002] In a Kubernetes cluster (hereinafter referred to as the cluster), an Ingress controller is typically deployed as the entry point for external network traffic. The Nginx Ingress controller, which is officially recommended by Kubernetes, shares the same data plane and control plane, which poses significant security and stability risks. In addition, plugin development is very difficult. Therefore, there are a large number of third-party Ingress controllers available for selection.

[0003] The Kong Ingress controller employs a data plane and control plane separation architecture. The data plane processes business traffic according to ingress rules, while the control plane monitors changes in cluster ingress rules and dynamically updates the data plane configuration. It also provides numerous plug-and-play plugins based on OpenResty for authentication, security, rate limiting, monitoring, and logging. Furthermore, it was among the first to introduce an API (Application Programming Interface) gateway to the Ingress controller, aligning with the Kubernetes community's development direction and making it an ideal choice for Ingress controllers. When deploying the Kong Ingress controller (hereinafter referred to as the Ingress controller), in addition to using the officially recommended LoadBalancer, it can also be deployed using NodePort or hostNetwork host network modes.

[0004] The Ingress controller consists of two containers: the data plane and the control plane. The ports and uses of each container are as follows: 1. Data plane container listening: (1) Proxy port, such as 80 / 443, for external access to internal services of the cluster, which needs to be exposed to the outside of the cluster; (2) Management port, such as 8444, used to update ingress rule configuration, which is a sensitive port and should be restricted to non-local access; (3) Monitoring port, such as 8100, provides monitoring API, the URI (Uniform Resource Identifier) ​​defaults to " / metrics", which can return sensitive information such as the IP and port of the internal container of the cluster, and should be hardened. 2. Control plane container listening: (1) Web hook port, such as 8008, used to verify ingress configuration, which should be restricted to external access to the cluster; (2) Monitoring port: such as 10255, provides monitoring API, which contains Ingress controller status information, which should be restricted to external access to the cluster.

[0005] However, the existing deployment method has the following drawbacks:

[0006] 1. When deploying using NodePort mode, the following issues exist: (1) All cluster nodes will expose the data plane container proxy port of the Ingress controller, thus expanding the port exposure surface;

[0007] (2) NodePort mode requires the use of the cluster kube-proxy component for traffic forwarding, which results in some performance loss.

[0008] 2. When deploying using LoadBalancer mode, there are the following problems: (1) Each LoadBalancer service requires a load balancing IP, and this IP is generally provided by the cloud service provider, which is inconvenient for self-built and self-maintained clusters; (2) LoadBalancer mode uses NodePort at the bottom layer, which has the same problems as NodePort mode.

[0009] 3. Using hostNetwork mode for deployment has the following problems: (1) The monitoring port of the data plane container is directly exposed to the host machine, which poses a risk of information leakage; (2) The management address of the data plane container is generally configured as the loopback interface address 127.0.0.1, which can only be accessed by the local machine. If the control plane container is deployed separately in Cluster mode, the control plane container cannot connect to the management address of the data plane container 127.0.0.1, which makes it impossible to update the ingress rule configuration. Therefore, the control plane container can only be deployed in hostNetwork mode; (3) The control plane container does not provide services outside the cluster, but in hostNetwork mode, all ports are exposed to the host machine. The web hook port needs to be accessed by each node in the cluster, and security hardening cannot be performed by configuring the address as the loopback interface 127.0.0.1. Summary of the Invention

[0010] To address at least some of the issues of wide port exposure, performance degradation, and information insecurity in existing Ingress controller deployment methods, this disclosure provides a deployment method, system, electronic device, and computer-readable storage medium for Ingress controllers in a host network mode. In host network mode, dummy interface addresses and loopback interface addresses are used to protect the data plane container management and monitoring ports of the Ingress controller. This ensures that the management address can only be accessed from the host machine where the data plane container is deployed, and also allows the control plane container to access the local data plane container management address. A monitoring API is exposed externally through the ingress, and the monitoring API is security-hardened using multi-factor authentication, authorization, and access restriction plugins. This ensures the security of the data plane container monitoring API, which contains cluster-sensitive information.

[0011] In a first aspect, this disclosure provides a method for deploying an Ingress controller in a host network mode, the method comprising:

[0012] Deploy the control plane container and the data plane container on the same host machine;

[0013] In host network mode, the native dummy interface listens on the management port and provides it for the control plane container to call. The native loopback interface listens on the monitoring port and provides monitoring data.

[0014] Define a custom primary domain name and point it to the monitoring address and port of the local data plane container;

[0015] Enable the data plane container monitoring service and create ingress rules;

[0016] By exposing the monitoring API of the preset data plane container through ingress, when the monitoring server makes a monitoring interface access request through the monitoring API of the preset data plane container, the URI of the request is rewritten according to the created ingress rules, the request is forwarded to the data plane container monitoring service, and the data plane container monitoring service performs identity authentication and enables specific security restrictions on the request according to the ingress rules. After the identity authentication and security restriction checks are passed, the request is forwarded to the first domain name according to the service configuration, and finally forwarded to the local data plane container monitoring address and monitoring port.

[0017] Furthermore, the step of authenticating the request and enabling specific security restrictions according to the ingress rules includes:

[0018] The plugins enabled for the service are determined based on the ingress rules;

[0019] The requests are authenticated using the enabled baisc-auth and key-auth plugins, which include username, password, and API key authentication.

[0020] The authorization of the requesting user's permission group is determined based on the enabled ACL (Access Control List) plugin.

[0021] Perform security checks on the IP address of the monitoring server based on the enabled ip-restriction plugin.

[0022] Furthermore, the method also includes:

[0023] The control plane container calls the data plane management port through the dummy interface to update the ingress rule configuration.

[0024] Furthermore, the monitoring API of the preset data plane container is obtained through the host machine IP where the data plane container is located and the URI of the rewritten monitoring API.

[0025] Secondly, this disclosure provides a deployment system for an Ingress controller in a host network mode, the system comprising:

[0026] The deployment module is configured to deploy the control plane container and the data plane container on the same host machine;

[0027] The configuration module is set to listen to the management port using the local dummy interface in host network mode, which is then provided for the control plane container to call; and to listen to the monitoring port on the local loopback interface to provide monitoring data.

[0028] Define a module that is set to a custom first domain name, which points to the local data plane container monitoring address and monitoring port;

[0029] Create a module, configure it to enable the data plane container monitoring service, and create ingress rules;

[0030] The access module is configured to expose the monitoring API of a preset data plane container through an ingress. When the monitoring server makes a monitoring interface access request through the monitoring API of the preset data plane container, it rewrites the URI of the request according to the created ingress rules, forwards the request to the data plane container monitoring service, and enables the data plane container monitoring service to authenticate the request and enable specific security restrictions according to the ingress rules. After the authentication and security restriction checks are passed, the request is forwarded to the first domain name according to the service configuration, and finally forwarded to the local data plane container monitoring address and monitoring port.

[0031] Furthermore, the access module includes a security hardening component, which is configured as follows:

[0032] The plugins enabled for the service are determined based on the ingress rules;

[0033] The requests are authenticated using the enabled baisc-auth and key-auth plugins, which include username, password, and API key authentication.

[0034] Authentication is performed on the permission group to which the requesting user belongs, based on the enabled ACL plugin; and,

[0035] Perform security checks on the IP address of the monitoring server based on the enabled ip-restriction plugin.

[0036] Furthermore, the system also includes an update module:

[0037] The update module is configured to update the ingress rule configuration by calling the data plane management port through the control plane container on the dummy interface.

[0038] Furthermore,

[0039] The monitoring API of the preset data plane container is obtained through the host machine IP where the data plane container is located and the URI of the rewritten monitoring API.

[0040] Thirdly, this disclosure provides an electronic device including a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes a deployment method of an Ingress controller in a host network mode as described in any of the first aspects.

[0041] Fourthly, this disclosure provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the deployment method of the Ingress controller in any of the host network modes described in the first aspect above.

[0042] Beneficial effects:

[0043] This disclosure provides a deployment method, system, electronic device, and storage medium for the Ingress controller in host network mode. In host network mode, it uses dummy interface addresses and loopback interface addresses to protect the data plane container management port and monitoring port of the Ingress controller. This ensures that the management address can only be accessed from the host machine where the data plane container is deployed, and also allows the control plane container to access the local data plane container management address. The monitoring API is exposed externally through the ingress, its default URI is rewritten, and access to the monitoring port is achieved through the data plane container monitoring service. Furthermore, the monitoring API is security-hardened using multi-factor authentication, authorization, and access restriction plugins, ensuring the security of the data plane container monitoring API, which contains cluster-sensitive information. Attached Figure Description

[0044] Figure 1 This is a flowchart illustrating a method for deploying an Ingress controller in a host network mode, as provided in Embodiment 1 of this disclosure.

[0045] Figure 2 This is a flowchart illustrating how a Prometheus monitoring server accesses a data plane container monitoring API, as provided in Embodiment 2 of this disclosure.

[0046] Figure 3 This is an architecture diagram of an Ingress controller deployment system in a host network mode provided in Embodiment 3 of this disclosure;

[0047] Figure 4 This is an architectural diagram of an electronic device provided in Embodiment 4 of this disclosure. Detailed Implementation

[0048] To enable those skilled in the art to better understand the technical solutions of this disclosure, the disclosure will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments and drawings described herein are merely for explaining the invention and are not intended to limit the invention.

[0049] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence; furthermore, in the absence of conflict, the embodiments and features in the embodiments of this disclosure can be arbitrarily combined with each other.

[0050] The terminology used in the embodiments of this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of this disclosure. The singular forms “a,” “the,” and “the” as used in the embodiments of this disclosure and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0051] In the following description, the use of suffixes such as “module,” “part,” or “unit” to denote elements is solely for the purpose of illustrative purposes and has no specific meaning in itself. Therefore, “module,” “part,” or “unit” may be used interchangeably.

[0052] The following detailed embodiments illustrate the technical solutions of this disclosure and how they solve the aforementioned problems in the prior art. It is understood that in the embodiments of this application, the executing entity may perform some or all of the steps in the embodiments of this application. These steps or operations are merely examples, and the embodiments of this application may also perform other operations or variations thereof. Furthermore, the steps may be executed in different orders as presented in the embodiments of this application, and it is not necessary to execute all the operations in the embodiments of this application. Moreover, the following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0053] Figure 1 This is a flowchart illustrating a method for deploying an Ingress controller in a host network mode, as provided in Embodiment 1 of this disclosure. Figure 1 As shown, the method includes:

[0054] Step S101: Deploy the control plane container and the data plane container on the same host machine;

[0055] Step S102: In host network mode, use the local dummy interface to listen to the management port and provide it for the control plane container to call. Listen to the monitoring port on the local loopback interface and provide monitoring data.

[0056] Step S103: Define a custom first domain name and point it to the local data plane container monitoring address and monitoring port;

[0057] Step S104: Enable the data plane container monitoring service and create ingress rules;

[0058] Step S105: Expose the preset monitoring API of the data plane container to the outside world through ingress. When the monitoring server makes a monitoring interface access request through the preset monitoring API of the data plane container, it rewrites the URI of the request according to the created ingress rules, forwards the request to the data plane container monitoring service, and enables the data plane container monitoring service to perform identity authentication and enable specific security restrictions on the request according to the ingress rules. After the identity authentication and security restriction checks are passed, the request is forwarded to the first domain name according to the service configuration, and finally forwards the request to the local data plane container monitoring address and monitoring port.

[0059] For Ingress controllers, the management port listened to by the data plane container is a sensitive port, and access from non-local users should be restricted. The monitoring port, which returns sensitive information such as container IPs and ports within the cluster, also requires access restriction to ensure data security. However, existing Ingress controller deployments suffer from wide port exposure, performance degradation, and information insecurity. To address this issue, this embodiment uses dummy interface addresses and loopback interface addresses in host network mode to protect the Ingress controller's data plane container management and monitoring ports. A specific monitoring API is exposed externally through the ingress. By rewriting the access URI, requests are forwarded to a pre-created data plane container monitoring service. This provides security hardening for the monitoring API using multi-factor authentication, authorization, and security restrictions. The request is then forwarded to a custom domain pointing to the local data plane container monitoring address and port, achieving securely restricted access to the monitoring port. Simultaneously, through the dummy interface's management port, the control plane container on the same host can perform ingress configuration verification and updates, controlling information proxy forwarding rules and synchronizing updates to the data plane container.

[0060] Regarding dummy interfaces

[0061] A coredns component is typically installed in a cluster for cluster domain name resolution. The coredns component enables a dummy interface on each node in the cluster, typically listening on the address 169.254.20.10. If the coredns component is not installed in the cluster, a dummy interface can be enabled manually. For example, in CentOS distributions, the systemd-networkd service allows you to customize the dummy interface and IP address and enable it on the host machine.

[0062] Similar to the loopback interface 127.0.0.1, the dummy interface only allows access from the local machine. However, the dummy interface can also communicate between containers and the host machine, avoiding the problem that containers deployed on the local machine cannot access the host machine service when the host machine service is listening on the loopback interface address 127.0.0.1 (which can only be accessed within the local machine).

[0063] In this embodiment of the disclosure, the Ingress controller's data plane container is enabled according to "Table 1: Data plane container deployment configuration":

[0064] 1. The data plane container uses the host network to expose proxy ports such as 80 and 443 to respond to external requests and forward them to services within the cluster for processing;

[0065] 2. The local dummy interface listens on the management port, which is provided to the control plane container for updating ingress rule configuration;

[0066] 3. Listen on the monitoring port on the local loopback interface to provide monitoring data, which can only be accessed by the local machine.

[0067] By deploying the control plane container and the data plane container on the same host, the control plane container can access the management port through the dummy interface.

[0068] Table 1: Data Plane Container Deployment Configuration

[0069]

[0070]

[0071] Then, create a new monitoring user through "Monitoring User KongConsumer Configuration", determine its authentication and authorization method, configure the account and password, configure the user's permission group and various security plugins, and realize powerful functions such as traffic control, request forwarding, authentication and authorization; providing a foundation for subsequent ingress rules to authenticate access requests and enable specific security restrictions.

[0072] Since IPs cannot be directly configured in ingress, a primary domain name is defined and pointed to the local data plane container monitoring address and port. For example, a custom domain name (primary domain name) for accessing the original data plane container monitoring API can be defined through the hosts plugin of the cluster coredns component, such as kong.status.api, which points to the data plane container monitoring API address 127.0.0.1 in "Table 1: Data Plane Container Deployment Configuration".

[0073] Then enable the data plane container monitoring service and create ingress rules;

[0074] Enable the data plane container monitoring service according to "Table 2: Data plane container monitoring service configuration":

[0075] 1. This service forwards requests to an external DNS, that is, it forwards the ":8100 / metrics" request to "kong.status.api:8100 / metrics";

[0076] 2. This service uses various restriction plugins and security hardening plugins. Access to the service is granted after successful authentication.

[0077] Table 2: Configuration of Data Plane Container Monitoring Service

[0078]

[0079]

[0080] Create ingress rules according to "Table 3: Ingress Rules for Accessing Data Surface Container Monitoring API".

[0081]

[0082] By exposing a pre-defined monitoring API for the data plane container via an ingress, such as http: / / abcd / kong-admin-api / metrics, when the monitoring server requests access to the monitoring interface through this API, the ingress rules are used to match the request. The URI of the request is rewritten (e.g., changing / metrics in a general monitoring API to / kong-admin-api / metrics, thus customizing the API's access address). The request is then forwarded to the data plane container monitoring service at http: / / kong-status-api:8100 / metrics. The service uses a plugin enabled by the data plane container monitoring service for authentication and specific security restrictions. After successful authentication and security checks, the request is forwarded to the first domain, kong.status.api, according to the service configuration. Finally, based on the configured domain name resolution, the request is forwarded to the local data plane container monitoring address and port: http: / / 127.0.0.1:8100 / metrics. This ensures secure and reliable access to monitoring data.

[0083] Using the host network mode, the Ingress controller does not use the cluster network but directly uses the host machine's network. The container's ports are exposed directly on the host machine. Instead of listening to the cluster's internal IP address, ports 80 / 443 are now directly accessed on the host machine, and the Ingress controller only exposes these ports on the currently deployed server. Only this one server will expose the Ingress controller's ports; other servers will not. Furthermore, because it directly uses the host machine's network, performance is also better.

[0084] Management port, update the proxy forwarding configuration of the data plane container.

[0085] The monitoring port is configured to be accessible only from within the data plane container. The system's monitoring center, such as the Prometheus monitoring server, accesses the data container's monitoring port externally. Due to the loopback interface's characteristics, access is restricted to internal sources. By modifying the default monitoring API and rewriting the URI, ordinary users cannot guess the correct access method to the data plane container's monitoring API. Furthermore, access requests are authenticated with usernames, passwords, and API keys, and permission groups are authorized. Security checks are performed on the server's IP address to ensure that although the monitoring API is exposed, it is securely protected by the monitoring system. This enables secure access to the monitoring API from outside the cluster.

[0086] In this embodiment of the disclosure, dummy interface addresses and loopback interface addresses are used to protect the data plane container management port and monitoring port of the Ingress controller in host network mode. This ensures that the management address can only be accessed from the host machine where the data plane container is deployed, and also enables the control plane container to access the local data plane container management address. The monitoring API is exposed externally through the ingress, and its default URI is rewritten and forwarded to the data plane container monitoring service. Access to the monitoring port is achieved through the data plane container monitoring service. Furthermore, the monitoring API is security-hardened using plugins such as multi-factor authentication, authorization, and access restrictions to ensure the security of the data plane container monitoring API, which contains cluster-sensitive information.

[0087] Furthermore, the step of authenticating the request and enabling specific security restrictions according to the ingress rules includes:

[0088] The plugins enabled for the service are determined based on the ingress rules;

[0089] The requests are authenticated using the enabled baisc-auth and key-auth plugins, which include username, password, and API key authentication.

[0090] The authorization of the requesting user's permission group is determined based on the enabled ACL plugin;

[0091] Perform security checks on the IP address of the monitoring server based on the enabled ip-restriction plugin.

[0092] When the data plane container monitoring service authenticates the request and enables specific security restrictions based on the ingress rules, this can be achieved by configuring a corresponding security detection plugin; the implementation steps include:

[0093] Create a new monitoring user according to "Table 4: Monitoring User KongConsumer Configuration", and set its authentication and authorization methods to baisc-auth, key-auth, and acl.

[0094] Table 4: Monitoring User KongConsumer Configuration

[0095]

[0096] Configure the username and password of the user being monitored by Prometheus according to "Table 5: User account and password secret configuration".

[0097] Table 5: User account password / secret configuration for monitoring users

[0098] Secret configuration items Configuration item value Remark stringData.username prometheus Username of the monitoring user stringData.password xxxpasswordxxx Monitor user passwords stringData.kongCredType basic-auth The type of this secret is account password authentication.

[0099] Configure the API key value for the Prometheus monitoring user according to "Table 6: API key secret configuration for monitoring users".

[0100] Table 6: API key / secret configuration for monitoring users

[0101] Secret configuration items Configuration item value Remark stringData.key xxxkeyxxx Monitor the value of the user's apikey stringData.kongCredType key-auth The secret is of type API key authentication.

[0102] Configure the permission groups to which the Prometheus monitoring users belong according to "Table 7: ACL user group secret configuration for monitoring users".

[0103] Table 7: ACL user group secret configuration for monitoring users

[0104] Secret configuration items Configuration item value Remark stringData.group admin Monitor the permission groups to which users belong. stringData.kongCredType acl The secret is of type ACL authentication.

[0105] According to "Table 8: KongPlugin Configuration for Account Password Authentication Plugin", create a new basic-auth authentication plugin.

[0106] Table 8: Configuration of KongPlugin Account Password Authentication Plugin

[0107] KongPlugin configuration items Configuration item value Remark plugin basic-auth The plugin type is basic-auth authentication plugin.

[0108] Create a new key-auth authentication plugin according to "Table 9: KongPlugin Configuration for API Key Authentication Plugin".

[0109] Table 9: KongPlugin Configuration for API Key Authentication Plugin

[0110] KongPlugin configuration items Configuration item value Remark plugin key-auth The plugin type is key-auth authentication plugin. config.key_names apikey The name of the API key for monitoring users config.key_in_query true Allow passing keys via request parameters

[0111] Create a new ACL authentication plugin according to "Table 10: KongPlugin Configuration for ACL Authentication Plugin".

[0112] Table 10: KongPlugin Configuration for ACL Authentication Plugin

[0113] KongPlugin configuration items Configuration item value Remark plugin acl The plugin type is ACL authentication plugin. config.allow admin Allow admin group users to access

[0114] Create a new IP restriction security plugin according to "Table 11: KongPlugin Configuration for IP Restriction Security Plugins".

[0115] Table 11: KongPlugin Configuration for IP Restriction Security Plugin

[0116] KongPlugin configuration items Configuration item value Remark plugin ip-restriction The plugin type is an IP restriction security plugin. config.allow xxxx / xx Allow access from the network segment where the Prometheus server is located.

[0117] After creating the corresponding security plugins, when an access request is made, authentication and specific security restrictions are enabled through the plugins enabled for the services added in Table 2: Data Plane Container Monitoring Service configuration, including:

[0118] Enable the IP restriction plugin for the data plane container monitoring service to allow access only from the network segment where the Prometheus server is located;

[0119] This service uses the basic-auth authentication plugin and requires authentication using an account and password.

[0120] This service also enables the key-auth authentication plugin, requiring authentication using an API key in addition to the username and password.

[0121] The service also has an ACL authentication plugin enabled, allowing access only to users belonging to the admin privilege group;

[0122] The created Prometheus monitoring user belongs to the admin privilege group and is configured with a username, password, and API key. After successful two-factor authentication, access to the service is granted. This process achieves security hardening of the pre-defined monitoring API exposed after rewriting a general URI, using plugins for multi-factor authentication, authorization, and IP restriction.

[0123] Furthermore, the method also includes:

[0124] The control plane container calls the data plane management port through the dummy interface to update the ingress rule configuration.

[0125] Enable the control plane container of the Ingress controller by clicking “Table 12: Control plane container deployment configuration”.

[0126] Table 12: Control plane container deployment configuration

[0127]

[0128] 1. The control plane container uses a cluster network and does not expose ports to the host machine;

[0129] 2. The control plane container, configured via Pod affinity, must be deployed on the same host machine as the data plane container;

[0130] 3. The control plane container is configured via Pod anti-affinity, meaning only one node can be deployed on a single host node;

[0131] 4. The control plane container calls the data plane management interface through the dummy interface to update the ingress rule configuration.

[0132] The cluster network used by the control plane container does not expose any ports to the host machine and can only be accessed within the cluster network. Through certain K8s configurations, external access to the cluster is restricted to ensure the security of the ports listened to by the control plane container.

[0133] On each host machine, the control plane container and the data plane container are deployed on the same host machine. The control plane container listens for changes in the ingress configuration of the entire cluster. When it detects a rule change, it updates the ingress rules to the broker through the management port of 169.254.20.10, which is the listening address of the dummy interface. This ensures that the configuration of every node is updated during the configuration update process.

[0134] Furthermore, the monitoring API of the preset data plane container is obtained through the host machine IP where the data plane container is located and the URI of the rewritten monitoring API.

[0135] By obtaining the monitoring API of the preset data plane container through the host address and the rewritten monitoring API URI, it is possible to access the host machine through the host machine IP where the data plane container is located. Then, the / metrics of the general monitoring API is changed to a specific URI: / kong-admin-api / metrics, thus rewriting the monitoring API and customizing the access address of the monitoring API so that ordinary users cannot guess it.

[0136] In this embodiment of the disclosure, dummy interface addresses and loopback interface addresses are used in host network mode to protect the data plane container management port and monitoring port of the Ingress controller. The dummy interface address not only prevents external access from the host machine, but also allows the control plane container on the same host to call the data plane management interface through the dummy interface to update the ingress rule configuration. In addition to ensuring that the management address can only be accessed from the host machine where the data plane container is deployed, it also enables the control plane container to access the local data plane container management address. The monitoring API is exposed externally through the ingress, and its default URI is rewritten to prevent general users from accessing the monitoring API. The request URI is rewritten through the created ingress rules, and the request is forwarded to the data plane container monitoring service. Access to the monitoring port is realized through the data plane container monitoring service. Furthermore, the monitoring API is security-hardened using plugins such as multi-factor authentication, authorization, and access restrictions to ensure the security of the data plane container monitoring API containing cluster-sensitive information.

[0137] This disclosure also provides a method for deploying an Ingress controller in a host network mode, the purpose of which is:

[0138] In host network mode, dummy interface addresses and loopback interface addresses are used to protect the data plane container management port and monitoring port of the Ingress controller, and the monitoring API is exposed to the outside world through Ingress. The monitoring API is hardened with plugins such as multi-factor authentication, authorization, and IP restriction.

[0139] 1. Deploy the Ingress controller's data plane container using hostNetwork mode, and deploy the Ingress controller's control plane container using Cluster mode;

[0140] 2. Using the dummy interface as the management address of the data plane container ensures that the management address can only be accessed from the host machine where the data plane container is deployed, and also enables the control plane container to access the management address of the local data plane container.

[0141] 3. Expose the monitoring API of the data plane container to the outside world through ingress, rewrite its default URI, and use account password + apikey for dual authentication of monitoring interface requests. Also enable IP restriction for interface access to ensure the security of the data plane container monitoring API containing cluster sensitive information.

[0142] The method includes:

[0143] 1. Enable dummy interface

[0144] A coredns component is typically installed in a cluster for cluster domain name resolution. The coredns component enables a dummy interface on each node in the cluster, typically listening on the address 169.254.20.10. If the coredns component is not installed in the cluster, a dummy interface can be enabled manually. For example, in CentOS distributions, the systemd-networkd service allows you to customize the dummy interface and IP address and enable it on the host machine.

[0145] Similar to the loopback interface 127.0.0.1, the dummy interface only allows access from the local machine. However, the dummy interface can also communicate between containers and the host machine, avoiding the problem that containers deployed on the local machine cannot access the host machine service when the host machine service is listening on the loopback interface address 127.0.0.1.

[0146] 2. Enable the Ingress controller's data plane container according to "Table 1: Data plane container deployment configuration":

[0147] 1. The data plane container uses the host network to expose proxy ports such as 80 and 443 to respond to external requests and forward them to services within the cluster for processing;

[0148] 2. The local dummy interface listens on the management port, which is provided to the control plane container for updating ingress rule configuration;

[0149] 3. Listen on the monitoring port on the local loopback interface to provide monitoring data, which can only be accessed by the local machine.

[0150] Table 1: Data Plane Container Deployment Configuration

[0151]

[0152] 3. Enable the control plane container of the Ingress controller according to "Table 12: Control plane container deployment configuration":

[0153] 1. The control plane container uses a cluster network and does not expose ports to the host machine;

[0154] 2. The control plane container, configured via Pod affinity, must be deployed on the same host machine as the data plane container;

[0155] 3. The control plane container is configured via Pod anti-affinity, meaning only one node can be deployed on a single host node;

[0156] 4. The control plane container calls the data plane management interface through the dummy interface to update the ingress rule configuration.

[0157] Table 12: Control plane container deployment configuration

[0158]

[0159]

[0160] 4. Create a new monitoring user according to "Table 4: Monitoring User KongConsumer Configuration", and its authentication and authorization methods are baisc-auth, key-auth and acl.

[0161] Table 4: Monitoring User KongConsumer Configuration

[0162]

[0163] 5. Configure the account and password of the Prometheus monitoring user according to "Table 5: User account and password secret configuration".

[0164] Table 5: User account password / secret configuration for monitoring users

[0165] Secret configuration items Configuration item value Remark stringData.username prometheus Username of the monitored user stringData.password xxxpasswordxxx Monitor user passwords stringData.kongCredType basic-auth The type of this secret is account password authentication.

[0166] 6. Configure the API key value for the Prometheus monitoring user according to "Table 6: API key secret configuration for monitoring users".

[0167] Table 6: API key / secret configuration for monitoring users

[0168] Secret configuration items Configuration item value Remark stringData.key xxxkeyxxx Monitor the value of the user's apikey stringData.kongCredType key-auth The secret is of type API key authentication.

[0169] 7. Configure the permission groups to which the Prometheus monitoring users belong according to "Table 7: ACL user group secret configuration for monitoring users".

[0170] Table 7: ACL user group secret configuration for monitoring users

[0171] Secret configuration items Configuration item value Remark stringData.group admin Monitor the permission groups to which users belong. stringData.kongCredType acl The secret is of type ACL authentication.

[0172] 8. According to "Table 8: KongPlugin Configuration for Account Password Authentication Plugin", create a new basic-auth authentication plugin.

[0173] Table 8: Configuration of KongPlugin Account Password Authentication Plugin

[0174] KongPlugin configuration items Configuration item value Remark plugin basic-auth The plugin type is basic-auth authentication plugin.

[0175] 9. Create a new key-auth authentication plugin according to "Table 9: KongPlugin Configuration for API Key Authentication Plugin".

[0176] Table 9: KongPlugin Configuration for API Key Authentication Plugin

[0177] KongPlugin configuration items Configuration item value Remark plugin key-auth The plugin type is key-auth authentication plugin. config.key_names apikey The name of the API key for monitoring users config.key_in_query true Allow passing keys via request parameters

[0178] 10. Create a new ACL authentication plugin according to "Table 10: KongPlugin Configuration of ACL Authentication Plugin".

[0179] Table 10: KongPlugin Configuration for ACL Authentication Plugin

[0180] KongPlugin configuration items Configuration item value Remark plugin acl The plugin type is ACL authentication plugin. config.allow admin Allow admin group users to access

[0181] 11. Create a new IP restriction security plugin according to "Table 11: KongPlugin Configuration for IP Restriction Security Plugin".

[0182] Table 11: KongPlugin Configuration for IP Restriction Security Plugin

[0183] KongPlugin configuration items Configuration item value Remark plugin ip-restriction The plugin type is an IP restriction security plugin. config.allow xxxx / xx Allow access from the network segment where the Prometheus server is located.

[0184] 12. Customize a primary domain name (a custom data plane container monitoring API domain name) through the hosts plugin of the cluster corens component, for example, kong.status.api, pointing to the data plane container monitoring API address in "Table 1: Data Plane Container Deployment Configuration": 127.0.0.1.

[0185] 13. Enable the data plane container monitoring service according to "Table 2: Data plane container monitoring service configuration":

[0186] Table 2: Configuration of Data Plane Container Monitoring Service

[0187]

[0188] 1. This service forwards requests to an external DNS, that is, it forwards the ":8100 / metrics" request to "kong.status.api:8100 / metrics";

[0189] 2. This service uses an IP restriction plugin, allowing access only from the network segment where the Prometheus server is located;

[0190] 3. This service uses the basic-auth authentication plugin and requires authentication using an account and password;

[0191] 4. This service also enables the key-auth authentication plugin. In addition to the username and password, an API key is also required for authentication.

[0192] 5. This service also has an ACL authentication plugin enabled, allowing access only to users belonging to the admin privilege group;

[0193] 6. The Prometheus monitoring user created in step four belongs to the admin privilege group and is configured with an account, password, and API key. After successful two-factor authentication, the user can access the service.

[0194] 14. Create ingress rules according to "Table 3: Ingress Rules for Accessing the Data Surface Container Monitoring API".

[0195] Table 3: Ingress Rules for Accessing the Data Plane Container Monitoring API

[0196]

[0197] 15. The process of the Prometheus monitoring server accessing the data plane container monitoring API is as follows: Figure 2 :

[0198] 1. Access the Prometheus monitoring server via the data plane container monitoring API: http: / / abcd / kong-admin-api / metrics, along with your username, password, and API key authentication information.

[0199] 2. The data plane container matches access requests according to the ingress rules;

[0200] 3. Matching the ingress rule created in step fourteen, rewrite the request URI and forward the request to the data plane container monitoring service created in step thirteen. The forwarding address is: http: / / kong-status-api:8100 / metrics;

[0201] 4. The data plane container monitoring service performs account password and API key authentication based on the enabled baisc-auth and key-auth plugins; it performs authorization of the permission groups to which the Prometheus monitoring users belong based on the enabled acl plugin; and it performs security checks on the IP address of the Prometheus monitoring server based on the ip-restriction plugin.

[0202] 5. After authentication and IP restriction checks pass, forward requests to the external domain: kong.status.api according to the service configuration;

[0203] 6. Based on the domain name resolution configured in step 12, the request will eventually be forwarded to the local data plane container monitoring address and port: http: / / 127.0.0.1:8100 / metrics.

[0204] In this embodiment, the Ingress controller's data plane container is deployed in hostNetwork mode, and the Ingress controller's control plane container is deployed in Cluster mode. The management port and monitoring port of the Ingress controller's data plane container are protected by dummy interface addresses and loopback interface addresses. The rewritten monitoring API is exposed to the outside world through ingress, and the monitoring API is hardened with plugins such as multi-factor authentication, authorization, and IP restriction to ensure the security of monitoring data.

[0205] Embodiment 3 of this disclosure also provides a deployment system for an Ingress controller in a host network mode, such as Figure 3 As shown, the system includes:

[0206] Deployment module 11 is configured to deploy the control plane container and the data plane container on the same host machine;

[0207] Module 12 is configured to listen to the management port using the local dummy interface in host network mode, providing it for the control plane container to call, and to listen to the monitoring port on the local loopback interface to provide monitoring data.

[0208] Define module 13, which is set to a custom first domain name, pointing to the local data plane container monitoring address and monitoring port;

[0209] Create module 14, configure it to enable the data plane container monitoring service, and create ingress rules;

[0210] Access module 15 is configured to expose a preset monitoring API of the data plane container through ingress. When the monitoring server makes a monitoring interface access request through the preset monitoring API of the data plane container, it rewrites the URI of the request according to the created ingress rules, forwards the request to the data plane container monitoring service, and enables the data plane container monitoring service to authenticate the request and enable specific security restrictions according to the ingress rules. After the authentication and security restriction checks are passed, the request is forwarded to the first domain name according to the service configuration, and finally forwarded to the local data plane container monitoring address and monitoring port.

[0211] Furthermore, the access module 15 includes a security hardening component, which is configured as follows:

[0212] The plugins enabled for the service are determined based on the ingress rules;

[0213] The requests are authenticated using the enabled baisc-auth and key-auth plugins, which include username, password, and API key authentication.

[0214] Authentication is performed on the permission group to which the requesting user belongs, based on the enabled ACL plugin; and,

[0215] Perform security checks on the IP address of the monitoring server based on the enabled ip-restriction plugin.

[0216] Furthermore, the system also includes an update module 16:

[0217] The update module 16 is configured to update the configuration of ingress rules by calling the data plane management port through the control plane container in the dummy interface.

[0218] Furthermore,

[0219] The monitoring API of the preset data plane container is obtained through the host machine IP where the data plane container is located and the URI of the rewritten monitoring API.

[0220] The deployment system for the Ingress controller in host network mode of this disclosure is used to implement the deployment method of the Ingress controller in host network mode in method embodiment one and embodiment two. Therefore, the description is relatively simple. For details, please refer to the relevant descriptions in the previous method embodiments, which will not be repeated here.

[0221] In addition, such as Figure 4As shown, Embodiment 4 of this disclosure also provides an electronic device, including a memory 100 and a processor 200. The memory 100 stores a computer program. When the processor 200 runs the computer program stored in the memory 100, the processor 200 executes the various possible methods described above.

[0222] The memory 100 is connected to the processor 200. The memory 100 can be a flash memory, a read-only memory, or another type of memory. The processor 200 can be a central processing unit or a microcontroller.

[0223] Furthermore, embodiments of this disclosure also provide a computer-readable storage medium storing a computer program, which is executed by a processor using the various possible methods described above.

[0224] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media includes, but is not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory or other memory technologies, CD-ROM (Compact Disc Read-Only Memory), Digital Video Disc (DVD) or other optical disc storage, cartridges, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer.

[0225] It is understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of this disclosure, and this disclosure is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and substance of this disclosure, and these modifications and improvements are also considered to be within the scope of protection of this disclosure.

Claims

1. A method for deploying an Ingress controller in a host network mode, characterized in that, The method includes: Deploy the control plane container and the data plane container on the same host machine; In host network mode, the native dummy interface listens on the management port and provides it for the control plane container to call. The native loopback interface listens on the monitoring port and provides monitoring data. Define a custom primary domain name and point it to the monitoring address and port of the local data plane container; Enable the data plane container monitoring service and create ingress rules; By exposing the monitoring application interface (API) of the preset data plane container to the outside world through ingress, when the monitoring server makes a monitoring interface access request through the monitoring API of the preset data plane container, the Uniform Resource Identifier (URI) of the request is rewritten according to the created ingress rules, the request is forwarded to the data plane container monitoring service, and the data plane container monitoring service performs identity authentication and enables specific security restrictions on the request according to the ingress rules. After the identity authentication and security restriction checks are passed, the request is forwarded to the first domain name according to the service configuration, and finally forwarded to the local data plane container monitoring address and monitoring port.

2. The method according to claim 1, characterized in that, The process of authenticating the request and enabling specific security restrictions according to ingress rules includes: The plugins enabled for the service are determined based on the ingress rules; The request is authenticated with the username / password and API key (apikey) using the enabled basic authentication (baisc-auth) and keyword authentication (key-auth) plugins. The authorization of the requesting user's permission group is performed based on the enabled access control list (ACL) plugin. Perform security checks on the IP address of the monitoring server based on the enabled ip-restriction plugin.

3. The method according to claim 1, characterized in that, The method further includes: The control plane container calls the data plane management port through the dummy interface to update the ingress rule configuration.

4. The method according to claim 1, characterized in that, The monitoring API of the preset data plane container is obtained through the host machine IP where the data plane container is located and the URI of the rewritten monitoring API.

5. A deployment system for an Ingress controller in a host network mode, characterized in that, The system includes: The deployment module is configured to deploy the control plane container and the data plane container on the same host machine; The configuration module is set to listen to the management port using the local dummy interface in host network mode, which is then provided for the control plane container to call; and to listen to the monitoring port on the local loopback interface to provide monitoring data. Define a module that is set to a custom first domain name, which points to the local data plane container monitoring address and monitoring port; Create a module, configure it to enable the data plane container monitoring service, and create ingress rules; The access module is configured to expose the monitoring API of a preset data plane container through an ingress. When the monitoring server makes a monitoring interface access request through the monitoring API of the preset data plane container, it rewrites the URI of the request according to the created ingress rules, forwards the request to the data plane container monitoring service, and enables the data plane container monitoring service to authenticate the request and enable specific security restrictions according to the ingress rules. After the authentication and security restriction checks are passed, the request is forwarded to the first domain name according to the service configuration, and finally forwarded to the local data plane container monitoring address and monitoring port.

6. The system according to claim 5, characterized in that, The access module includes a security hardening component, which is configured as follows: The plugins enabled for the service are determined based on the ingress rules; The requests are authenticated using the enabled baisc-auth and key-auth plugins, which include username, password, and API key authentication. The authorization of the requesting user's permission group is determined based on the enabled ACL plugin; as well as, Perform security checks on the IP address of the monitoring server based on the enabled ip-restriction plugin.

7. The system according to claim 5, characterized in that, The system also includes an update module: The update module is configured to update the ingress rule configuration by calling the data plane management port through the control plane container on the dummy interface.

8. The system according to claim 5, characterized in that, The monitoring API of the preset data plane container is obtained through the host machine IP where the data plane container is located and the URI of the rewritten monitoring API.

9. An electronic device, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the deployment method of the Ingress controller in host network mode as described in any one of claims 1-4.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the deployment method of the Ingress controller in host network mode as described in any one of claims 1-4.

Images