Communication method and device based on dynamic firewall in K8s cluster

Abstract

The present invention relates to a communication method and device based on a dynamic reactive firewall in a K8s cluster, the method comprising: a link reachability detection component of each node in the K8s cluster detects the communication status between the current node and the cluster control node in real time; if it is detected that the communication status of the node management plane is a fault state, the dynamic reactive firewall configures the data path firewall rules of the management plane in the current node to the backup management plane, so that the backup management plane communicates with the cluster control node based on the firewall rules. The above method solves the technical problem in the prior art that when a single dedicated management network fails, the cluster node loses control due to network isolation.

Description

Technical Field

[0001] The present invention relates to the field of cluster technology, and in particular to a communication method and device based on a dynamic reactive firewall in a K8s cluster. Background Art

[0002] Most of the existing K8s clusters are fully open networks, and all networks can access each other without any security isolation. If an access firewall is configured in the K8s cluster node, the node will be unable to log in due to failure of a single data path. In order to ensure the accessibility of the node, the default K8s cluster uses a simplified firewall configuration, directly shuts down all access control and firewall configurations, and opens the forwarding configuration of all data planes. This configuration facilitates the accessibility and connectivity of the node, but due to the full-pass configuration, the node will be completely exposed to the network without any protection.

[0003] To this end, in view of the situation where the K8s cluster has multiple data planes and strict data communication channel isolation is configured between the data planes, when a network device connected to a data plane fails and the failure cannot be repaired by link redundancy, how to achieve the technical problem of management plane communication? It is necessary to provide a solution to restore the backup data path for cluster communication. Summary of the invention

[0004] 1. Technical issues to be resolved

[0005] In view of the above-mentioned shortcomings and deficiencies of the prior art, the present invention provides a communication method and device based on a dynamic reactive firewall in a K8s cluster, which solves the technical problem in the prior art that when a single dedicated cluster control node fails, the cluster node loses control due to network isolation.

[0006] (II) Technical solution

[0007] In order to achieve the above object, the main technical solutions adopted by the present invention include:

[0008] In a first aspect, an embodiment of the present invention provides a communication method based on a dynamic reactive firewall in a K8s cluster, comprising:

[0009] The link reachability detection component of each node in the K8s cluster detects the communication status between the current node and the cluster control node in real time;

[0010] If it is detected that the communication state of the node management plane is a fault state, the dynamic reactive firewall configures the data path firewall rules of the management plane in the current node to the backup management plane, so that the backup management plane communicates with the cluster control node based on the firewall rules.

[0011] Optionally, the method further comprises:

[0012] If the communication status between the current node and the management plane of the cluster control node returns to normal, the dynamic reactive firewall switches the data path firewall rules configured on the backup management plane in the current node to the original management plane.

[0013] Optionally, each cluster node in the K8s cluster is fixedly configured to use a dedicated switching network with network isolation. Each cluster node in the K8s cluster includes multiple data planes. The data planes in each cluster node are not connected to each other, and the data planes between two cluster nodes are connected to each other.

[0014] Optionally, the dynamic reactive firewall configures the data path firewall rules of the management plane in the current node to the backup management plane, including:

[0015] Configure one or more of the following: ssh connection, ntp synchronization, https management link rules, access control rules, status check rules, security policy rules, QoS rules, role rules, and geographic location rules on the backup management plane;

[0016] Optionally, the backup management plane opens a backup management plane communication port to communicate with the management network;

[0017] And / or, each cluster node in the K8s cluster detects the communication status of the management plane between the cluster node and the cluster control node through ping and TCP management port connection.

[0018] Optionally, before the link reachability detection component of each node in the K8s cluster detects the communication status between the current node and the cluster control node in real time, the method further includes:

[0019] Pre-configured dynamic reactive firewall rules are loaded to each cluster node according to the attributes and roles of each cluster node in the firewall configuration database.

[0020] In a second aspect, an embodiment of the present invention further discloses a communication device based on a dynamic reactive firewall in a K8s cluster, comprising:

[0021] The detection module is used to detect the communication status between the current node and the cluster control node in real time;

[0022] The switching module is used to configure the management plane data path firewall rules in the current node to the backup management plane when detecting that the node management plane communication state is a fault state, so that the backup management plane communicates with the cluster control node based on the firewall rules.

[0023] In a third aspect, an embodiment of the present invention further discloses a cluster node, located in a K8s cluster, comprising the communication device described in the second aspect above.

[0024] In a fourth aspect, an embodiment of the present invention further discloses a computer storage medium having instructions stored thereon, which, when executed by one or more processors, enables the processors to execute the method as described in any one of the first aspects.

[0025] (III) Beneficial effects

[0026] In an embodiment of the present invention, when the management data plane fails due to the failure of the underlying link or the cluster control node, the management plane is switched to a backup management plane, and the management plane communication port is opened on the backup management plane to avoid the node losing management connection in this situation. This solves the technical problem in the prior art that when a single cluster control node fails, the cluster node loses control due to network isolation. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 A flow chart of the steps of a communication method based on a dynamic reactive firewall in a K8s cluster provided by an embodiment of the present invention;

[0028] Figure 2 A flow chart of the steps of a communication method based on a dynamic reactive firewall in a K8s cluster provided by an embodiment of the present invention;

[0029] Figure 3 A flow chart of the steps of a communication method based on a dynamic reactive firewall in a K8s cluster provided by an embodiment of the present invention;

[0030] Figure 4 A device block diagram of a communication device based on a dynamic reactive firewall in a K8s cluster provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to better explain the present invention and facilitate understanding, the present invention is described in detail below through specific implementation modes in conjunction with the accompanying drawings.

[0032] In a Kubernetes (K8s) cluster, a dynamic firewall is an important security mechanism used to control network traffic in and out of the cluster. The dynamic firewall can dynamically adjust rules based on the state and strategy of the cluster to ensure network security.

[0033] Dynamic firewall rules can be dynamically generated and updated based on the state and policies of the cluster. These rules can be applied to resources such as Pods, Services, and Nodes. For example, control the communication between Pods within the cluster to ensure that only authorized Pods can communicate with each other. For example, only allow specific Pods to access database Pods, etc. Or, control external traffic entering and leaving the cluster. For example, only allow specific IP addresses to access services in the cluster.

[0034] Currently, a strict firewall configuration is performed on the K8s cluster. When the data plane of a single node in the K8s cluster fails, the node will become unreachable, making it inaccessible and unable to restore node access through methods such as ssh and web. This reactive firewall configuration isolates each data plane from each other, making it impossible to access nodes in the cluster across data planes, and ensures that the external access interface of the backup data plane will be opened when a single data plane fails, thereby ensuring that the nodes in the cluster can still provide external access backup interfaces when a single network plane fails, in order to restore node data connection failures.

[0035] The embodiments of the present invention aim at the situation where a K8s cluster has multiple data planes and strict data communication channel isolation is configured between the data planes. When a node device connected to a data plane fails and the failure cannot be repaired by link redundancy, other data planes are used for emergency data communication to solve the problem of loss of control of nodes in the K8s cluster due to a circuit break in a single data plane.

[0036] In the embodiment of the present invention, the single dedicated management network in the K8s cluster can be understood as an independent network designed specifically for managing and monitoring cluster components. This network is separated from the network used by user application traffic, ensuring that management traffic will not be affected by application traffic, while also improving security and manageability.

[0037] The dedicated management network is used to transmit management and control information within the cluster, such as communication between core components such as the API server, scheduler, and controller manager. The purpose is to separate management traffic from user application traffic to avoid management traffic delays or packet loss due to application traffic peaks, thereby ensuring the stability and responsiveness of the cluster. Dedicated management networks usually implement strict security policies, such as firewall rules, VLAN isolation, etc., to limit access to authorized administrators and systems. A single dedicated management network is an important component of the Kubernetes cluster architecture. It provides a more robust infrastructure support for the cluster by isolating management traffic, enhancing security, simplifying troubleshooting, and improving reliability.

[0038] In an embodiment of the present invention, in a K8s cluster, the management network refers to a dedicated network used to support cluster management and communication between control plane components.

[0039] The data plane or data communication in the embodiment of the present invention generally refers to all data communications, and usually different types of data communications are isolated from each other.

[0040] like Figure 1 As shown, Figure 1A flow chart showing the steps of a communication method based on a dynamic reactive firewall in a K8s cluster provided by an embodiment of the present invention is shown.

[0041] 101. The link reachability detection component of each node in the K8s cluster detects the communication status between the current node and the cluster control node in real time.

[0042] The cluster control node in this embodiment may be a management network node or a management network device in the K8s cluster.

[0043] In this embodiment, each cluster node in the K8s cluster is fixedly configured to use a dedicated switching network with network isolation. Each cluster node in the K8s cluster includes multiple data planes. The data planes in each cluster node are not connected to each other, and the data planes between two cluster nodes are connected to each other.

[0044] 102. If it is detected that the communication state of the node management plane is a fault state, the dynamic reactive firewall configures the data path firewall rules of the management plane in the current node to the backup management plane, so that the backup management plane communicates with the cluster control node based on the firewall rules.

[0045] The backup management plane in this embodiment can be a specified data plane. Figure 1 shown.

[0046] Currently, the default configuration of the K8s cluster does not support any firewall configuration. It uses a full-pass network configuration structure. After the firewall rules are configured, they will conflict with the NAT, Mangle, and Filter firewall rules used for data distribution in the K8s cluster, causing the cluster with the firewall configured to be interrupted sometimes.

[0047] In this embodiment, the netfilter netdev rules of the Linux K8s cluster are used to configure a stateless firewall to filter and screen data communications in and out of the cluster nodes in the K8s cluster, remove data traffic that is not in the cluster, and manage the data traffic in and out of the cluster. When the management plane fails due to the failure of the underlying link or the network device, the management plane is switched to a backup management plane, that is, a designated data plane, and the communication port of the plane is opened on the backup management plane to communicate with the management network, thereby avoiding the situation where the node loses the management connection in this case. This solves the technical problem of cluster node loss of control due to network isolation when a single dedicated management network fails in the prior art.

[0048] like Figure 2 and Figure 3 As shown, a step flow chart of a communication method based on a dynamic reactive firewall in a K8s cluster provided by an embodiment of the present invention is respectively shown.

[0049] In this embodiment, the K8s cluster includes a set of firewall templates defined according to the K8s role and communication mode, which are stored in the firewall configuration database. The firewall templates include the control plane node, K8s storage node, and K8s working node in the K8s cluster. Each different firewall template configures the pre-defined netdev firewall rules according to the defined role, and divides the configuration data into physical links according to the network interface data link, and classifies the firewall rules according to the node role in the K8s cluster.

[0050] The dynamic firewall engine is responsible for continuously detecting the reachability of the current node to the cluster control node. If the reachability detection fails, the node's dynamic reactive firewall automatically configures the management plane firewall rules to the backup management plane to prevent node communication failure due to a disconnection in the data link layer of the cluster control node. In this embodiment, each node is independently configured with a dynamic firewall engine.

[0051] Dynamic firewalls can effectively solve the problem that when the K8s cluster has a detailed data communication plane division, and the management network composed of cluster control nodes is fixedly configured in a dedicated switching network using network isolation, when the dedicated switching device or network connection fails and causes the entire cluster management network to be disconnected, when this happens, the dynamic firewall will configure the firewall rules of the management network plane on the backup management plane, allowing the cluster to use the data plane / data communication plane to carry management plane communication for a short time, and after the current node and the management network resume communication, the management network will be switched back to the previously invalid management plane. Figure 3 As shown, the specific steps include:

[0052] 201. According to the attributes and roles of each node in the firewall configuration database, pre-configured dynamic reactive firewall rules are loaded to each node.

[0053] 202. The link reachability detection component of each node in the K8s cluster detects the communication status between the current node and the cluster control node in real time;

[0054] 203. If the communication state is detected to be a fault state, the dynamic reactive firewall configures the data path firewall rules of the management plane in the current node to the backup management plane, so that the backup management plane communicates with the management network based on the firewall rules.

[0055] For example, the dynamic reactive firewall configures the firewall rules of the management plane (ie, communicating with the management network) in the current node to the backup management plane (ie, a designated data plane) so that the backup management plane communicates with the management network based on the firewall rules.

[0056] The backup management plane opens the communication port of the backup data plane to communicate with the management network.

[0057] 204. If the communication status between the current node and the management plane of the cluster control node returns to normal, the dynamic reactive firewall switches the data path firewall rules configured on the backup management plane in the current node to the original management plane.

[0058] Each cluster control node in the K8s cluster in this embodiment is fixedly configured to use a dedicated switching network with network isolation.

[0059] This embodiment can effectively solve the problem of a K8s cluster using dedicated network isolation. When a single dedicated management network fails, the core management network can be migrated across networks. After the key management network connection is restored, the management network can be switched back to the dedicated network, thereby avoiding the situation where the cluster nodes lose control due to the failure of a single key network data plane caused by network isolation.

[0060] In addition, if Figure 4 As shown, the embodiment of the present invention further discloses a communication device based on a dynamic reactive firewall in a K8s cluster, including:

[0061] The detection module is used to detect the communication status between the current node and the cluster control node in real time;

[0062] The switching module is used to configure the management plane data path firewall rules in the current node to the backup management plane when detecting that the node management plane communication state is a fault state, so that the backup management plane communicates with the cluster control node based on the firewall rules.

[0063] In this embodiment, when the management data plane fails due to failure of the underlying link or network equipment, the management plane is switched to a backup management plane, i.e., a designated data plane, and the management plane communication port is opened in the backup management plane to avoid the node losing management connection in this situation. This solves the technical problem in the prior art that when a single dedicated management network fails, the cluster nodes lose control due to network isolation.

[0064] On the other hand, an embodiment of the present invention further discloses a server located as a node in a K8s cluster, including a communication device based on a dynamic reactive firewall in the above-mentioned K8s cluster.

[0065] On the other hand, an embodiment of the present invention provides a computer storage medium having instructions stored thereon, which, when executed by one or more processors, enables the processors to execute a communication method based on a dynamic reactive firewall in a K8s cluster as described in any of the above embodiments.

[0066] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0067] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present invention. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions.

[0068] It should be noted that in the claims, any reference numerals placed between brackets shall not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention may be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In the claims enumerating several means, several of these means may be embodied by the same hardware. The use of the words first, second, third, etc., is for convenience of expression only and does not indicate any order. These words may be understood as part of the component name.

[0069] In addition, it should be noted that, in the description of this specification, the description of the terms "one embodiment", "some embodiments", "embodiment", "example", "specific example" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0070] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments after knowing the basic creative concept. Therefore, the claims should be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present invention.

[0071] Obviously, those skilled in the art can make various modifications and variations to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention should also include these modifications and variations.

Claims

1. A communication method based on a dynamic reactive firewall in a K8s cluster, characterized in that: include: The link reachability detection component of each node in the K8s cluster detects the communication status between the current node and the cluster control node in real time; If it is detected that the communication state of the node management plane is a fault state, the dynamic reactive firewall configures the data path firewall rules of the management plane in the current node to the backup management plane, so that the backup management plane communicates with the cluster control node based on the firewall rules.

2. The method according to claim 1, characterized in that The method further comprises: If the communication status between the current node and the management plane of the cluster control node returns to normal, the dynamic reactive firewall switches the data path firewall rules configured on the backup management plane in the current node to the original management plane.

3. The method according to claim 1, characterized in that: Each cluster node in the K8s cluster is fixedly configured to use a dedicated switching network with network isolation. Each cluster node in the K8s cluster includes multiple data planes. The data planes in each cluster node are not connected to each other, but the data planes between two cluster nodes are connected to each other.

4. The method according to claim 3, characterized in that The dynamic reactive firewall configures the data path firewall rules of the management plane in the current node to the backup management plane, including: Configure one or more of the following: ssh connection, ntp synchronization, https management link rules, access control rules, status check rules, security policy rules, QoS rules, role rules, and geographic location rules on the backup management plane.

5. The method according to claim 4, characterized in that: The backup management plane opens a backup management plane communication port to communicate with the cluster control node; And / or, each cluster node in the K8s cluster detects the communication status of the management plane between the cluster node and the cluster control node through ping and TCP management port connection.

6. The method according to claim 1, characterized in that Before the link reachability detection component of each node in the K8s cluster detects the communication status between the current node and the cluster control node in real time, the method further includes: Pre-configured dynamic reactive firewall rules are loaded to each cluster node according to the attributes and roles of each cluster node in the firewall configuration database.

7. A communication device based on a dynamic reactive firewall in a K8s cluster, characterized in that: include: The detection module is used to detect the communication status between the current node and the cluster control node in real time; The switching module is used to configure the management plane data path firewall rules in the current node to the backup management plane when detecting that the node management plane communication state is a fault state, so that the backup management plane communicates with the cluster control node based on the firewall rules.

8. A cluster node, characterized in that: Located in the K8s cluster, including the communication device described in claim 7 above.

9. A computer storage medium, characterized in that Instructions are stored thereon, which, when executed by one or more processors, cause the processors to perform the method according to any one of claims 1 to 6.

Images