Firewall policy configuration method and device, equipment, storage medium and product

Abstract

The invention discloses a firewall policy configuration method and device, equipment, a storage medium and a product, and relates to the technical field of network security, and the method comprises the steps: creating an IP address pool for a target namespace; an IP allocation strategy of the target namespace is configured by adding the annotation, and the IP address pool and the target namespace are bound; and applying the IP address pool and the IP allocation strategy of the target namespace in the target cluster system, and verifying whether the IP address of the container instance in the target namespace accords with a predefined IP address range. If yes, configuring a hardware firewall strategy based on a predefined IP address range; and if the IP address does not accord with the predefined IP address range, reconfiguring the IP address pool, and returning to the step of configuring the IP allocation strategy of the target namespace by adding the annotation until the IP address of the container instance in the target namespace accords with the predefined IP address range. By dividing the IP address range, the management efficiency of the firewall policy is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a configuration method, device, equipment, storage medium and product of a firewall policy. Background Art

[0002] In the banking data center environment, in order to ensure the security of information systems, a network security partitioning architecture design is usually adopted. Different business systems are deployed in different security partitions according to their security levels, and each security partition is isolated and access controlled by a firewall.

[0003] Traditionally, bank data centers mainly use virtualization technology to deploy business systems. Since virtual machines have fixed IP addresses, access control policies can be configured on firewalls based on IP addresses to achieve precise access control across security partitions. However, with the development of cloud-native technologies, more and more bank data centers are turning to containerized deployment. During the operation of this method, the life cycle of containers is usually short, and the creation and destruction of containers may be accompanied by changes in IP addresses. This makes it difficult for firewall policies based on static IPs to adapt to the dynamic characteristics of containers, resulting in complex and inefficient firewall policy management.

[0004] Therefore, how to improve the management efficiency of container firewall policies when IP addresses change dynamically is a problem that needs to be solved urgently. Summary of the invention

[0005] The main purpose of this application is to provide a firewall policy configuration method, device, equipment, storage medium and product, aiming to solve the technical problem of low management efficiency of container firewall policies when IP addresses change dynamically.

[0006] To achieve the above object, the present application proposes a method for configuring a firewall policy, the method comprising:

[0007] Creating an IP address pool for the target namespace, where the IP address pool is used to define an IP address range for container instances in the target namespace;

[0008] Configuring the IP allocation policy of the target namespace by adding annotations, wherein the added annotations are used to bind the IP address pool to the target namespace;

[0009] Apply the IP address pool and the IP allocation policy of the target namespace in the target cluster system, and verify whether the IP address of the container instance in the target namespace conforms to the predefined IP address range;

[0010] If the IP address of the container instance in the target namespace matches a predefined IP address range, configuring a hardware firewall policy based on the predefined IP address range;

[0011] If the IP address of the container instance in the target namespace does not conform to the predefined IP address range, the IP address pool is reconfigured, and the step of configuring the IP allocation policy of the target namespace by adding annotations is returned until the IP address of the container instance in the target namespace conforms to the predefined IP address range.

[0012] In one embodiment, the step of configuring the IP allocation policy of the target namespace by adding annotations includes:

[0013] Adding the identification information of the IP address pool to the target namespace in the form of annotations, and obtaining the added annotation information;

[0014] Based on the added annotation information, the IP addresses in the IP address pool are allocated to the container instances in the target namespace.

[0015] In one embodiment, the step of verifying whether the IP address of the container instance in the target namespace conforms to a predefined IP address range includes:

[0016] Start at least one container instance in the target namespace and obtain an IP address corresponding to the container instance;

[0017] Compare the IP address corresponding to the container instance with the predefined IP address range to obtain a first comparison result;

[0018] According to the first comparison result, verify whether the IP address of the container instance in the target namespace conforms to the predefined IP address range.

[0019] In one embodiment, if the IP address of the container instance in the target namespace conforms to a predefined IP address range, the step of configuring a hardware firewall policy based on the predefined IP address range includes:

[0020] If the IP address of the container instance in the target namespace matches the predefined IP address range, determining the configuration requirements of the firewall rule based on the predefined IP address range;

[0021] Based on the configuration requirements of the firewall rules, setting the firewall rules through the firewall management interface or the target interface;

[0022] Apply the firewall rules to the firewall system and verify whether the firewall rule configuration meets the preset requirements.

[0023] In one embodiment, the step of applying the firewall rule to the firewall system and verifying whether the firewall rule configuration meets the preset requirements includes:

[0024] Initiate a network connection request to the target address through the container instance to verify whether the firewall policy configuration meets the preset requirements and obtain a verification result;

[0025] If the verification result does not meet the preset requirements, return to the step of determining the configuration requirements of the firewall rules based on the predefined IP address range until the verification result meets the preset requirements.

[0026] In one embodiment, if the IP address of the container instance in the target namespace conforms to the predefined IP address range, the step of recreating the IP address pool includes:

[0027] If the IP address of the container instance in the target namespace does not conform to the predefined IP address range, then, according to the error prompt of the target cluster system, the currently input configuration command is compared with the correct configuration command to obtain a second comparison result;

[0028] Recreate an IP address pool for the target namespace according to the second comparison result and the correct configuration command.

[0029] In addition, to achieve the above purpose, the present application also proposes a firewall policy configuration device, the firewall policy configuration device comprising:

[0030] An address creation module, used to create an IP address pool for a target namespace, where the IP address pool is used to define an IP address range for a container instance in the target namespace;

[0031] A first configuration module, configured to configure the IP allocation policy of the target namespace by adding annotations, wherein the added annotations are used to bind the IP address pool to the target namespace;

[0032] An address verification module, used to apply the IP address pool and the IP allocation policy of the target namespace in the target cluster system, and verify whether the IP address of the container instance in the target namespace conforms to the predefined IP address range;

[0033] A second configuration module is configured to configure a hardware firewall policy based on a predefined IP address range if the IP address of the container instance in the target namespace conforms to the predefined IP address range;

[0034] A reconfiguration module is used to reconfigure the IP address pool if the IP address of the container instance in the target namespace does not conform to the predefined IP address range, and return to the step of configuring the IP allocation policy of the target namespace by adding annotations until the IP address of the container instance in the target namespace conforms to the predefined IP address range.

[0035] In addition, to achieve the above-mentioned purpose, the present application also proposes a firewall policy configuration device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the firewall policy configuration method as described above.

[0036] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the firewall policy configuration method described above are implemented.

[0037] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the method for configuring the firewall policy as described above are implemented.

[0038] One or more technical solutions proposed in this application have at least the following technical effects:

[0039] Create an IP address pool for the target namespace, and the IP address pool is used to define the IP address range of the container instance in the target namespace; configure the IP allocation policy of the target namespace by adding annotations, and add annotations to bind the IP address pool to the target namespace; apply the IP address pool and the IP allocation policy of the target namespace in the target cluster system, and verify whether the IP address of the container instance in the target namespace meets the predefined IP address range. If the IP address of the container instance in the target namespace meets the predefined IP address range, configure the hardware firewall policy based on the predefined IP address range; if the IP address of the container instance in the target namespace does not meet the predefined IP address range, recreate the IP address pool and return to the step of configuring the IP allocation policy of the target namespace by adding annotations until the IP address of the container instance in the target namespace meets the predefined IP address range. By creating a dedicated IP address pool for the target namespace, it is possible to clearly distinguish the network resources of different namespaces, realize the refined management of IP addresses, and avoid IP conflicts and resource waste. Through closed-loop configuration and verification steps, it can automatically return to reconfiguration when the IP pool configuration fails, reducing human intervention. In the hardware firewall policy configuration link, the precise range of the IP address pool is used to greatly simplify the definition and maintenance of firewall rules, avoiding the frequent manual creation and update of firewall rules due to the dynamic IP allocation of container instances, simplifying the firewall policy management process, and improving the management efficiency of container firewall policies. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0042] Figure 1 This is a schematic diagram of the network security partition architecture of the bank data center for this application;

[0043] Figure 2 This is a flowchart of the first embodiment of the configuration method of the firewall policy of this application;

[0044] Figure 3 This is a flow chart of the second embodiment of the method for configuring the firewall policy of this application;

[0045] Figure 4A flowchart of a third embodiment of a method for configuring a firewall policy of the present application;

[0046] Figure 5 A schematic diagram of the overall configuration process of the firewall policy of an embodiment of the present application;

[0047] Figure 6 A schematic diagram of the module structure of a configuration device for a firewall policy according to an embodiment of the present application;

[0048] Figure 7 A schematic diagram of the device structure of the hardware operating environment involved in the method for configuring the firewall policy in the embodiment of the present application.

[0049] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0050] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0051] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0052] In the bank data center environment, in order to ensure the security of information systems, the network security partition architecture design is usually adopted. Different business systems are deployed in different security partitions according to the security level, and each security partition is isolated and access controlled by a firewall. Traditionally, bank data centers mainly use virtualization technology to deploy business systems. Since virtual machines have fixed IP addresses, access control policies can be configured on the firewall based on the IP address to achieve precise access control across security partitions.

[0053] With the development of cloud-native technology, more and more bank data centers are turning to containerized deployment and widely adopting Kubernetes (K8S) as a container management platform. Calico BGP (Border Gateway Protocol) is used in network solutions to support intercommunication between different nodes. Figure 1As shown. Since K8S uses random allocation to assign IP addresses to Pods by default, and the IP addresses of Pods change dynamically during operation, the configuration of firewall policies for cross-partition data flows initiated from containers faces challenges: operation and maintenance personnel need to constantly identify and update the IP addresses of Pods and manually maintain firewall policies. This method is not only inefficient but also prone to errors. In addition, in a hybrid environment where virtualization clusters and container clusters are deployed in the same data center, virtual machines can perform effective firewall policy control through fixed IP addresses, while containers, due to the dynamic characteristics of their IP addresses, are difficult to implement simple and efficient firewall policy management similar to virtual machines, which increases the operation and maintenance complexity of network security control in container environments. Therefore, how to improve the management efficiency of container firewall policies when IP addresses change dynamically is a problem that needs to be solved urgently.

[0054] The present application provides a solution, which creates an IP address pool for the target namespace, and the IP address pool is used to define the IP address range of the container instance in the target namespace; configures the IP allocation policy of the target namespace by adding annotations, and adds annotations to bind the IP address pool to the target namespace; applies the IP address pool and the IP allocation policy of the target namespace in the target cluster system, and verifies whether the IP address of the container instance in the target namespace meets the predefined IP address range. If the IP address of the container instance in the target namespace meets the predefined IP address range, the hardware firewall policy is configured based on the predefined IP address range; if the IP address of the container instance in the target namespace does not meet the predefined IP address range, the IP address pool is recreated, and the step of configuring the IP allocation policy of the target namespace by adding annotations is returned until the IP address of the container instance in the target namespace meets the predefined IP address range. By creating an exclusive IP address pool for the target namespace, it is possible to clearly distinguish the network resources of different namespaces, realize the refined management of IP addresses, and avoid IP conflicts and resource waste. Through closed-loop configuration and verification steps, it can automatically return to reconfiguration when the IP pool configuration fails, reducing human intervention. In the hardware firewall policy configuration link, the precise range of the IP address pool is used to greatly simplify the definition and maintenance of firewall rules, avoiding the frequent manual creation and update of firewall rules due to the dynamic IP allocation of container instances, simplifying the firewall policy management process, and improving the management efficiency of container firewall policies.

[0055] Based on this, the present application embodiment provides a method for configuring a firewall policy, referring to Figure 2 , Figure 2 This is a flowchart of the first embodiment of the method for configuring the firewall policy of the present application.

[0056] In this embodiment, the method for configuring the firewall policy includes steps S10 to S50:

[0057] Step S10: Create an IP address pool for the target namespace.

[0058] It should be noted that the target namespace can be understood as a logical grouping defined in a container orchestration system (such as Kubernetes) to organize and isolate resources. The IP address pool is used to define the IP address range of the container instance in the target namespace. The container instance in the target namespace can be understood as the smallest operating unit (Pod) in Kubernetes, which can be used as a specific object for IP address allocation and network access. An IPPool resource can be created in a Kubernetes cluster for a specified namespace to define the IP address range of the Pod within the namespace. For example, the following code snippet defines a 192.168.1.0 / 24 network segment for the IPPool configuration, which is subsequently applied to a specific namespace.

[0059] apiVersion:projectcalico.org / v3

[0060] kind:IPPool

[0061] metadata:

[0062] name:example-ip-pool

[0063] spec:

[0064] blockSize:26

[0065] cidr:192.168.1.0 / 24

[0066] ipipMode:Never

[0067] natOutgoing:false

[0068] nodeSelector:all()

[0069] Step S20, configuring the IP allocation policy of the target namespace by adding annotations.

[0070] It should be noted that the IP allocation policy is used to determine the rules or mechanisms for allocating IP addresses to container instances in the target namespace. Annotations can be understood as adding specific annotation fields to the configuration file of the target namespace. Annotations are added to bind the IP address pool to the target namespace, so that container instances in the target namespace are allocated addresses from the specified IP address pool.

[0071] Step S30: Apply the IP address pool and the IP allocation policy of the target namespace in the target cluster system, and verify whether the IP address of the container instance in the target namespace conforms to the predefined IP address range.

[0072] It should be noted that the target cluster system can be understood as a cluster environment for running containerized applications, such as a Kubernetes cluster or other container orchestration platforms. The predefined IP address range can be understood as a standardized IP address interval set for the target namespace and its container instances. For example, you can apply an IP address pool and IP allocation policy in a Kubernetes cluster (executable command example: kubectl apply-f ippool.yaml example-namespace.yaml), start some Pods in the target namespace, and verify whether their IP addresses are in the specified network segment (192.168.1.0 / 24).

[0073] Step S40: If the IP address of the container instance in the target namespace conforms to the predefined IP address range, a hardware firewall policy is configured based on the predefined IP address range.

[0074] It should be noted that firewall rules can be used to define allowed or denied network access behaviors based on the IP address range of the target namespace. Hardware firewall policies are used to control the communication between container instances in the target namespace and external or other networks.

[0075] Step S50, if the IP address of the container instance in the target namespace does not conform to the predefined IP address range, recreate the IP address pool and return to the step of configuring the IP allocation policy of the target namespace by adding annotations until the IP address of the container instance in the target namespace conforms to the predefined IP address range.

[0076] Exemplarily, when the IP address pool is misconfigured or verification fails, a new IP address pool is redefined and set to ensure that its range meets the needs of the target namespace. At the same time, based on the reconfigured IP address pool, the IP allocation policy of the target namespace is reconfigured by adding annotations.

[0077] In this embodiment, by creating a dedicated IP address pool for the target namespace, the network resources of different namespaces can be clearly distinguished, and the refined management of IP addresses can be achieved to avoid IP conflicts and resource waste. Through the closed-loop configuration and verification steps, it can automatically return to reconfiguration when the IP pool configuration fails, reducing human intervention. In the hardware firewall policy configuration link, the precise range of the IP address pool can be used to greatly simplify the definition and maintenance of firewall rules, avoiding the frequent manual creation and update of firewall rules due to the dynamic IP allocation of container instances, simplifying the management process of firewall policies, and improving the management efficiency of container firewall policies.

[0078] Reference Figure 3 , Figure 3 This is a flow chart of the second embodiment of the configuration method of the firewall policy of this application, based on the above Figure 2 The first embodiment shown provides a second embodiment of the method for configuring the firewall policy of the present application.

[0079] In the second embodiment, the step S20 includes:

[0080] Step S201, adding the identification information of the IP address pool to the target namespace in the form of annotation, and obtaining the added annotation information.

[0081] It should be noted that the identification information of the IP address pool can be used to uniquely identify the metadata information of the IP address pool, such as the name of the IP address pool, CIDR range (Classless Inter-Domain Routing), block size, etc. The annotation form can be understood as recording additional metadata in the form of key-value pairs (such as Annotations in Kubernetes) in the configuration file of the target namespace.

[0082] Step S202: Based on the added annotation information, the IP addresses in the IP address pool are allocated to the container instances in the target namespace.

[0083] It should be noted that, based on the annotation information of the target namespace, an IP address can be dynamically allocated to the container instance from the bound IP address pool according to the defined rules. For example, when allocating an IP to a Pod in a namespace, the network segment 192.168.1.0 / 24 in the first embodiment is used. Taking the example-namespace namespace as an example, the configuration of adding annotations is as follows:

[0084] apiVersion:v1

[0085] kind:Namespace

[0086] metadata:

[0087] name:example-namespace

[0088] annotations:

[0089] "cni.projectcalico.org / ipv4pools":"192.168.1.0 / 24"

[0090] In this embodiment, by adding the identification information of the IP address pool to the target namespace in the form of annotations, the binding information of the IP address pool and the target namespace is recorded, which simplifies the configuration management process, helps to quickly locate and adjust network resources, and can ensure that the container instances in the target namespace are allocated IP addresses from the specified IP address pool, thereby improving the management efficiency of IP allocation.

[0091] In one implementation, based on the above embodiment, the step of verifying whether the IP address of the container instance in the target namespace conforms to the predefined IP address range includes: starting at least one container instance in the target namespace and obtaining an IP address corresponding to the container instance; comparing the IP address corresponding to the container instance with the predefined IP address range to obtain a first comparison result; and verifying, based on the first comparison result, whether the IP address of the container instance in the target namespace conforms to the predefined IP address range.

[0092] It should be noted that the first comparison result can be understood as the match between the actual IP address of the container instance and the predefined IP address range, which is used to determine whether the configuration is correct. For example, a container instance running in example-namespace is set to frontend-pod-1. If the IP address of frontend-pod-1 is 192.168.1.5, which falls within the range of 192.168.1.0 / 24, the first comparison result is compliance; if the IP address is 10.0.0.5, which is not within the range of 192.168.1.0 / 24, the first comparison result is non-compliance.

[0093] In this implementation, by verifying whether the IP address of the container instance matches the predefined IP address range, it is possible to ensure that the container instance in the target namespace is allocated an IP from the correct IP address pool, avoiding IP conflicts or misallocations caused by configuration errors. Through the comparison and verification mechanism, IP address allocation problems caused by configuration errors can be discovered and corrected in a timely manner, ensuring that the allocated IP address is consistent with the predefined range, and providing a reliable basis for subsequent configuration of hardware firewall policies based on IP address ranges.

[0094] Reference Figure 4 , Figure 4 This is a flow chart of the third embodiment of the configuration method of the firewall policy of this application, based on the above Figure 3 The second embodiment shown provides a third embodiment of the method for configuring the firewall policy of the present application.

[0095] In the third embodiment, the step S40 includes:

[0096] Step S401: If the IP address of the container instance in the target namespace conforms to the predefined IP address range, the configuration requirements of the firewall rules are determined based on the predefined IP address range.

[0097] It should be noted that firewall rules are used to define specific policies for network access control, including allowing or denying access requests from certain IP address ranges. The configuration requirements of firewall rules can be understood as determining the parameters that need to be configured in firewall rules based on the IP address range of the target namespace and communication requirements, including at least one of the source address range, target address range, protocol type, port number, and access action. For example, a firewall rule that allows the 192.168.1.0 / 24 network segment to access port 2881 of the 192.168.2.0 / 24 network segment can be represented as the following code segment.

[0098] yaml

[0099] -name:allow-example-namespace-to-obdb

[0100] type:ipv4

[0101] origin:192.168.1.0 / 24

[0102] action:permit

[0103] destination:192.168.2.0 / 24

[0104] protocol:tcp / 2881

[0105] Step S402, based on the configuration requirements of the firewall rules, setting the firewall rules through the firewall management interface or the target interface.

[0106] It should be noted that the firewall management interface can be understood as the graphical user interface (GUI) provided by the firewall system, which is used to intuitively configure and manage firewall rules. The target interface can be understood as the API (Application Programming Interface) interface. The API interface can be a programming interface provided by the firewall system, which is used to automatically configure firewall rules through code. Exemplarily, you can add a firewall rule through the Web interface, set parameters such as source address, destination address and protocol type, or submit a rule through the API with a source address of 192.168.1.0 / 24 and a destination address of 192.168.2.0 / 24. Exemplarily, if the firewall policy is configured through the management interface, the submitted form must contain the following field information:

[0107] Name: allow-example-namespace-to-obdb

[0108] Type: IPv4

[0109] Source address: 192.168.1.0 / 24

[0110] Destination address: 192.168.2.0 / 24

[0111] Protocol / Port number: tcp / 2881

[0112] Operation: permit

[0113] Step S403, applying the firewall rules to the firewall system and verifying whether the firewall rule configuration meets the preset requirements.

[0114] It should be noted that the firewall system can be a hardware or software system used to manage and execute network access control policies, and control traffic based on configured firewall rules. Through actual network access testing or simulated traffic, check whether the firewall rules are correctly effective according to the preset requirements.

[0115] In this embodiment, the configuration requirements of the firewall rules are determined based on the predefined IP address range, and the firewall rule requirements can be dynamically adjusted according to the actual IP address range of the target namespace, enhancing the flexibility and adaptability of the configuration. Two methods, the firewall management interface or the API interface, are provided to meet different demand scenarios. Through the verification mechanism, it is ensured that the applied firewall rules are strictly executed in accordance with the configuration requirements, realizing a closed-loop process from IP verification to rule configuration and verification, and being able to dynamically adapt to changes in the network environment of the target namespace.

[0116] In one implementation, based on the above-mentioned embodiments and implementation methods, step S403 includes: initiating a network connection request to the target address through a container instance to verify whether the firewall policy configuration meets the preset requirements, and obtaining a verification result; if the verification result is that it does not meet the preset requirements, returning to the step of determining the configuration requirements of the firewall rules based on a predefined IP address range until the verification result meets the preset requirements.

[0117] It should be noted that the network connection request is a network communication attempt issued by the container instance to test whether the target address can be successfully connected. The request usually uses a specific protocol (such as TCP) and port. For example, frontend-pod-1 sends a TCP connection request to the target address 192.168.2.10:2881. Frontend-pod-1 successfully connects to the target address 192.168.2.10:2881, and the verification result is that it meets the preset requirements. The connection request fails, and the verification result is that it does not meet the preset requirements. If frontend-pod-1 cannot access the target address 192.168.2.10:2881, return to reconfigure the firewall rules, such as changing the source IP range in the firewall rules from 192.168.1.0 / 24 to 192.168.1.0 / 23, and then re-verify until the test succeeds.

[0118] In this implementation, the actual network connection test is used to ensure that the container instance of the target namespace can stably and normally access the target address, and the network access failure caused by configuration errors is avoided by verifying whether the firewall policy configuration meets the preset requirements. If the verification result does not meet the preset requirements, the firewall rule requirements can be redefined and the configuration can be adjusted to form a closed-loop adjustment process. The dynamic adjustment mechanism can support the elastic requirements of the container network and improve the system adaptability and configuration efficiency.

[0119] In one implementation, based on the above-mentioned embodiments and implementation methods, the step of recreating the IP address pool if the IP address of the container instance in the target namespace conforms to the predefined IP address range includes: if the IP address of the container instance in the target namespace does not conform to the predefined IP address range, then according to the error prompt of the target cluster system, comparing the current input configuration command with the correct configuration command to obtain a second comparison result; and recreating the IP address pool for the target namespace according to the second comparison result and the correct configuration command.

[0120] It should be noted that the error prompt of the target cluster system can be understood as the diagnostic information generated by the target cluster system when a configuration error is detected, which is used to prompt the specific problem of the current configuration. The current input configuration command can be a command or parameter entered by the user when configuring the IP address pool and allocation strategy. The correct configuration command can be a standardized command generated according to the predefined IP address range and configuration requirements, which is used to repair the wrong configuration. The second comparison result can be understood as the difference comparison result between the current input configuration command and the correct configuration command, which is used to clearly locate the specific content of the configuration error. In order to make the specification clearer, a flowchart is provided based on this implementation method ( Figure 5 ), which is used to represent the overall configuration process of the firewall policy.

[0121] In this implementation, through system error prompts and command comparison, problems in the IP address pool configuration can be quickly discovered and located, reducing the possibility of human intervention and operational errors. The closed-loop mechanism for recreating the IP address pool effectively prevents IP address allocation conflicts or network anomalies caused by configuration errors, and improves the reliability of network resource management. Through error prompts, configuration command comparison, and automatic re-creation of the IP address pool mechanism, not only the configuration accuracy and operational efficiency are improved, but also a strong technical guarantee is provided for the security and stability of the dynamic container network.

[0122] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the configuration method of the firewall policy of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0123] This application also provides a firewall policy configuration device, please refer to Figure 6 , the configuration device of the firewall policy includes:

[0124] An address creation module 10, configured to create an IP address pool for a target namespace, wherein the IP address pool is used to define an IP address range of a container instance in the target namespace;

[0125] A first configuration module 20, configured to configure the IP allocation policy of the target namespace by adding annotations, wherein the added annotations are used to bind the IP address pool to the target namespace;

[0126] An address verification module 30, used to apply the IP address pool and the IP allocation policy of the target namespace in the target cluster system, and verify whether the IP address of the container instance in the target namespace conforms to a predefined IP address range;

[0127] A second configuration module 40 is configured to configure a hardware firewall policy based on a predefined IP address range if the IP address of the container instance in the target namespace conforms to the predefined IP address range;

[0128] The reconfiguration module 50 is used to reconfigure the IP address pool if the IP address of the container instance in the target namespace does not conform to the predefined IP address range, and return to the step of configuring the IP allocation policy of the target namespace by adding annotations until the IP address of the container instance in the target namespace conforms to the predefined IP address range.

[0129] The firewall policy configuration device provided by the present application adopts the firewall policy configuration method in the above embodiment, which can solve the technical problem of low management efficiency of container firewall policy when the IP address changes dynamically. Compared with the prior art, the beneficial effects of the firewall policy configuration device provided by the present application are the same as the beneficial effects of the firewall policy configuration method provided by the above embodiment, and the other technical features in the firewall policy configuration device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0130] The present application provides a firewall policy configuration device, the firewall policy configuration device includes: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the firewall policy configuration method in the above-mentioned embodiment 1.

[0131] Reference below Figure 7 , which shows a schematic diagram of the structure of a configuration device for a firewall policy suitable for implementing an embodiment of the present application. The configuration device for the firewall policy in the embodiment of the present application may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The configuration device of the firewall policy shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0132] like Figure 7As shown, the configuration device of the firewall policy may include a processing device 1001 (such as a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM: Read Only Memory) 1002 or the program loaded from the storage device 1003 to the random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the configuration device of the firewall policy are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 may allow the firewall policy configuration device to communicate with other devices wirelessly or by wire to exchange data. Figure 7 The configuration device of the firewall policy with various systems is shown, but it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have instead.

[0133] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0134] The firewall policy configuration device provided by the present application adopts the firewall policy configuration method in the above embodiment, which can solve the technical problem of low management efficiency of container firewall policy when the IP address changes dynamically. Compared with the prior art, the beneficial effects of the firewall policy configuration device provided by the present application are the same as the beneficial effects of the firewall policy configuration method provided by the above embodiment, and the other technical features in the firewall policy configuration device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0135] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0136] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0137] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the method for configuring the firewall policy in the above-mentioned embodiment.

[0138] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0139] The computer-readable storage medium may be included in the firewall policy configuration device; or may exist independently without being assembled into the firewall policy configuration device.

[0140] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the firewall policy configuration device, the firewall policy configuration device: creates an IP address pool for the target namespace, the IP address pool is used to define the IP address range of the container instance in the target namespace; configures the IP allocation policy of the target namespace by adding annotations, the added annotations are used to bind the IP address pool to the target namespace; applies the IP address pool and the IP allocation policy of the target namespace in the target cluster system, and verifies whether the IP address of the container instance in the target namespace conforms to the predefined IP address range; if the IP address of the container instance in the target namespace conforms to the predefined IP address range, configures the hardware firewall policy based on the predefined IP address range; if the IP address of the container instance in the target namespace does not conform to the predefined IP address range, recreates the IP address pool, and returns to the step of configuring the IP allocation policy of the target namespace by adding annotations until the IP address of the container instance in the target namespace conforms to the predefined IP address range.

[0141] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0142] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0143] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0144] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned firewall policy configuration method, and can solve the technical problem of low management efficiency of container firewall policies when IP addresses change dynamically. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the firewall policy configuration method provided by the above-mentioned embodiment, and will not be repeated here.

[0145] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned firewall policy configuration method when executed by a processor.

[0146] The computer program product provided by the present application can solve the technical problem of low management efficiency of container firewall policies when IP addresses change dynamically. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as the beneficial effects of the firewall policy configuration method provided by the above embodiment, which will not be repeated here.

[0147] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A method for configuring a firewall policy, characterized in that: The method includes: Creating an IP address pool for the target namespace, where the IP address pool is used to define an IP address range for container instances in the target namespace; Configuring the IP allocation policy of the target namespace by adding annotations, wherein the added annotations are used to bind the IP address pool to the target namespace; Apply the IP address pool and the IP allocation policy of the target namespace in the target cluster system, and verify whether the IP address of the container instance in the target namespace conforms to the predefined IP address range; If the IP address of the container instance in the target namespace matches a predefined IP address range, configuring a hardware firewall policy based on the predefined IP address range; If the IP address of the container instance in the target namespace does not conform to the predefined IP address range, the IP address pool is recreated, and the step of configuring the IP allocation policy of the target namespace by adding annotations is returned until the IP address of the container instance in the target namespace conforms to the predefined IP address range.

2. The method according to claim 1, characterized in that The step of configuring the IP allocation strategy of the target namespace by adding annotations includes: Adding the identification information of the IP address pool to the target namespace in the form of annotations, and obtaining the added annotation information; Based on the added annotation information, the IP addresses in the IP address pool are allocated to the container instances in the target namespace.

3. The method according to claim 1, characterized in that The step of verifying whether the IP address of the container instance in the target namespace conforms to the predefined IP address range includes: Start at least one container instance in the target namespace and obtain an IP address corresponding to the container instance; Compare the IP address corresponding to the container instance with the predefined IP address range to obtain a first comparison result; According to the first comparison result, verify whether the IP address of the container instance in the target namespace conforms to the predefined IP address range.

4. The method according to claim 1, characterized in that The step of configuring a hardware firewall policy based on the predefined IP address range if the IP address of the container instance in the target namespace conforms to the predefined IP address range includes: If the IP address of the container instance in the target namespace matches the predefined IP address range, determining the configuration requirements of the firewall rule based on the predefined IP address range; Based on the configuration requirements of the firewall rules, setting the firewall rules through the firewall management interface or the target interface; Apply the firewall rules to the firewall system and verify whether the firewall rule configuration meets the preset requirements.

5. The method according to claim 4, characterized in that The step of applying the firewall rules to the firewall system and verifying whether the firewall rule configuration meets the preset requirements includes: Initiate a network connection request to the target address through the container instance to verify whether the firewall policy configuration meets the preset requirements and obtain a verification result; If the verification result does not meet the preset requirements, return to the step of determining the configuration requirements of the firewall rules based on the predefined IP address range until the verification result meets the preset requirements.

6. The method according to claim 5, characterized in that The step of recreating an IP address pool if the IP address of the container instance in the target namespace conforms to the predefined IP address range includes: If the IP address of the container instance in the target namespace does not conform to the predefined IP address range, then, according to the error prompt of the target cluster system, the currently input configuration command is compared with the correct configuration command to obtain a second comparison result; Recreate an IP address pool for the target namespace according to the second comparison result and the correct configuration command.

7. A firewall policy configuration device, characterized in that: The device comprises: An address creation module, used to create an IP address pool for a target namespace, where the IP address pool is used to define an IP address range for a container instance in the target namespace; A first configuration module, configured to configure the IP allocation policy of the target namespace by adding annotations, wherein the added annotations are used to bind the IP address pool to the target namespace; An address verification module, used to apply the IP address pool and the IP allocation policy of the target namespace in the target cluster system, and verify whether the IP address of the container instance in the target namespace conforms to the predefined IP address range; A second configuration module is configured to configure a hardware firewall policy based on a predefined IP address range if the IP address of the container instance in the target namespace conforms to the predefined IP address range; A reconfiguration module is used to reconfigure the IP address pool if the IP address of the container instance in the target namespace does not conform to the predefined IP address range, and return to the step of configuring the IP allocation policy of the target namespace by adding annotations until the IP address of the container instance in the target namespace conforms to the predefined IP address range.

8. A firewall policy configuration device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the method for configuring a firewall policy according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the method for configuring the firewall policy according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the method for configuring a firewall policy according to any one of claims 1 to 6 are implemented.

Images