Method and system for monitoring and intercepting container traffic communication of a container management engine

Abstract

The present invention relates to the technical field of cloud computing, and discloses a method and system for monitoring and intercepting container traffic communication of a container management engine. By driving a network interception plug-in controller to obtain container application information in an API Server, configuring network rules between applications through an interface of a REST service module, and then using the network interception plug-in controller to persistently store the network rules in a Consul database. When the node agent program listens to the latest network rules, according to the network rules of the traffic, the traffic that was originally directly transmitted into the container network namespace is redirected to the corresponding proxy network namespace, and finally, traffic auditing and interception processing are performed on the container traffic through each proxy network namespace. Thus, the best proxy network namespace is allocated for the traffic auditing and interception of each container, realizing efficient and accurate auditing and interception of container traffic communication in the container management engine.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud computing, and in particular to a method and system for monitoring and intercepting container traffic communication of a container management engine. Background Art

[0002] In the field of cloud computing, a container management engine is a system that schedules and orchestrates containers. As the number and complexity of containers increase, the need for efficient container management and orchestration becomes increasingly urgent. Consequently, many companies have launched their own container management engines. A qualified container management engine provides comprehensive container management capabilities, including service discovery, load balancing, automated deployment, automatic scaling, and health checks.

[0003] With the growth of container services, container services within container management engines have become increasingly complex. Although container management engines provide virtual networks, and container runtimes (such as Docker and Containerd) use namespaces and cgroups to provide network isolation, containers can still communicate via IP addresses, preventing the interception of individual traffic flows. Containers within container management engines often need to access each other, and auditing and intercepting access between containers is a current pain point. With the advancement of container technology, the concept of service mesh has emerged in the cloud native field.

[0004] The service mesh is an infrastructure layer that handles service-to-service communication. It allows developers to configure and manage these communication rules in a declarative manner without modifying the application code. For example, the Istio component injects sidecar (such as istio-proxy) into the container to hijack and manage the application's import and export traffic. However, this requires injecting an initialization Init container into each application Pod, and configuring label tags for auditing. It is often used in conjunction with Prometheu, and the interface provides complex data and deployment is also very complex. Therefore, finding a more efficient and simple browsing interception and auditing technology is urgently needed in the current cloud native field.

[0005] Therefore, how to achieve efficient and accurate auditing and interception of inter-container traffic communication in the container management engine is a technical problem that needs to be solved urgently. Summary of the Invention

[0006] The main purpose of the present invention is to provide a container traffic communication monitoring and interception method and system for a container management engine, aiming to solve at least one of the above technical problems.

[0007] To achieve the above object, the present invention provides a method for monitoring and intercepting container traffic communication of a container management engine, the method comprising the following steps:

[0008] S1: Configure the API Server, network interception plug-in controller and node agent program of the container management engine; wherein, the network interception plug-in controller includes a REST service module and a Consul database;

[0009] S2: Drive the network interception plug-in controller to obtain container application information in the API Server by using the List-Watch mechanism and cache it, and provide the application configuration information of the user;

[0010] S3: The user configures network rules between applications through the interface of the REST service module;

[0011] S4: Use the network interception plug-in controller to persistently store the network rules in the Consul database;

[0012] S5: When the node agent program monitors the latest network rules, trigger the traffic diversion operation in the node agent program, audit all traffic, and intercept the traffic that meets the rules;

[0013] S6: The node agent program reports its own network interception events;

[0014] S7: The user calls the interface of the REST service module to view the network rule interception events of the application.

[0015] Optionally, the API Server of the container management engine is configured to provide an interface for REST API, and drive all components in the container management engine to obtain and operate resources through the API Server.

[0016] Optionally, in the network interception plug-in controller:

[0017] The REST service module is configured to externally provide an interface for operating network rules, so that the user can configure the network between containers through the interface of the REST service module; wherein, the configuration parameters include source application, destination application, communication protocol and port;

[0018] The Consul database is configured to store network rules and synchronize the network interception plug-in controller and the node agent program on the node.

[0019] Optionally, the node agent program is configured to listen to the network rules of the network interception plug-in controller, intercept and audit container traffic, and report the corresponding event traffic.

[0020] Optionally, in step S2: drive the network interception plug-in controller to use the List-Watch mechanism to obtain container application information in the API Server and cache it, and provide the user's application configuration information, specifically including:

[0021] S21: Drive the network interception plug-in controller to start, connect to the interface of the REST API of the API Server through authentication, and request resource invocation;

[0022] S22: Establish a local cache based on List-Watch, and drive the network interception plug-in controller to store the resources obtained by List-Watch in the local memory cache.

[0023] Optionally, the network communication between containers in the container management engine is configured to use the CNI plug-in for network communication. The traffic of the container is imported into the proxy network namespace, audited in the proxy network namespace, and then the traffic is redirected to the container network namespace of the corresponding container.

[0024] Optionally, in step S5, trigger the drainage operation in the node proxy program, audit all traffic, and intercept the traffic that meets the rules, specifically including:

[0025] S51: When it is monitored that the traffic reaches the target container, according to the network rules, redirect the traffic that was originally directly passed into the container network namespace to the corresponding proxy network namespace;

[0026] S52: Each proxy network namespace makes a compliance judgment on the traffic according to the configured traffic audit rules. If the traffic does not meet the rules, discard the traffic and trigger a traffic interception event to the network interception plug-in controller. If the traffic meets the rules, transfer the traffic to the container network namespace to which the target container belongs.

[0027] Optionally, in step S51, according to the network rules of the traffic, redirect the traffic that was originally directly passed into the container network namespace to the corresponding proxy network namespace, specifically including:

[0028] S511: According to the network rules of the traffic, determine the priority and compliance detection items of the traffic compliance detection for several containers;

[0029] S512: Obtain the compliance detection items for each proxy network namespace and several detection resources allocated for performing compliance judgment. Determine based on the several detection resource occupancies of each compliance detection item, the several detection resources of each proxy network namespace, and the priorities of the traffic reaching several containers and the compliance detection items. Take the sum of the detection resource occupancies determined by the compliance detection items of the traffic of the containers allocated to each proxy network namespace and the several detection resource occupancies of each compliance detection item to be less than the corresponding detection resources allocated for the proxy network namespace to perform compliance judgment as the constraint condition. When the traffic of all containers performs compliance judgment in the allocated proxy network namespaces, take the minimum of the sum of the products of the number of compliance detection items of the traffic of each container that are not detected by the proxy network namespace and the priority of the container as the optimization objective, and optimize and solve the traffic of the containers allocated to each proxy network namespace;

[0030] S513: Based on the traffic of the containers allocated to each proxy network namespace, redirect the traffic that was originally directly passed into the container network namespace to the corresponding proxy network namespace.

[0031] Optionally, in step S511, the determination of the priority and the compliance detection item is configured to determine the priority and the compliance detection item of the traffic of the container according to the corresponding relationship of the traffic reaching each container recorded in the network rule in the pre-priority and compliance detection item comparison table; among them, different priorities are named using numerical values, and the priority with a larger numerical value is higher, and the compliance detection item is named using an identification code.

[0032] In addition, to achieve the above object, the present invention also provides a container traffic communication monitoring and interception system for a container management engine, including:

[0033] The first configuration module is used to configure the API Server, the network interception plug-in controller, and the node agent program of the container management engine; among them, the network interception plug-in controller includes a REST service module and a Consul database;

[0034] The acquisition module is used to drive the network interception plug-in controller to use the List-Watch mechanism to obtain the container application information in the API Server and cache it, and provide the user's application configuration information;

[0035] The second configuration module is used for the user to configure network rules between applications through the interface of the REST service module;

[0036] The storage module is used to use the network interception plug-in controller to persistently store the network rules in the Consul database;

[0037] An auditing module, which is used to trigger the traffic diversion operation in the node agent when the node agent listens to the latest network rules, audit all traffic, and intercept the traffic that meets the rules;

[0038] A reporting module, which is used for the node agent to report its own network interception events;

[0039] A viewing module, which is used for users to call the interface of the REST service module to view the network rule interception events of the application.

[0040] The beneficial effects of the present invention are as follows: A method and system for monitoring and intercepting container traffic communication in a container management engine are proposed. By driving the network interception plugin controller to obtain container application information in the API Server, configuring network rules between applications through the interface of the REST service module, and then using the network interception plugin controller to persistently store the network rules in the Consul database. When the node agent listens to the latest network rules, according to the network rules of the traffic, the traffic that was originally directly transmitted into the container network namespace is redirected to the corresponding proxy network namespace, and finally, each proxy network namespace performs traffic auditing and interception processing on the container traffic. Thus, the best proxy network namespace is allocated for the traffic auditing and interception of each container, realizing the efficient and accurate auditing and interception of container - to - container traffic communication in the container management engine. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is a flowchart of the method for monitoring and intercepting container traffic communication in the container management engine of the present invention;

[0042] Figure 2 It is an architecture diagram of the method for monitoring and intercepting container traffic communication in the container management engine of the present invention;

[0043] Figure 3 It is a structural diagram of the system for monitoring and intercepting container traffic communication in the container management engine of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0044] In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0045] The embodiment of the present invention provides a method for monitoring and intercepting container traffic communication in a container management engine. Refer to Figure 1 , Figure 1 It is a schematic flowchart of the embodiment of the method for monitoring and intercepting container traffic communication in the container management engine of the present invention.

[0046] In this embodiment, a method for monitoring and intercepting container traffic communication of a container management engine includes the following steps:

[0047] S1: Configure the API Server, network interception plugin controller, and node agent of the container management engine; among them, the network interception plugin controller includes a REST service module and a Consul database;

[0048] S2: Drive the network interception plugin controller to obtain container application information in the API Server using the List-Watch mechanism and cache it, and provide the user's application configuration information;

[0049] S3: The user configures network rules between applications through the interface of the REST service module;

[0050] S4: Use the network interception plugin controller to persistently store the network rules in the Consul database;

[0051] S5: When the node agent listens to the latest network rules, trigger the traffic diversion operation in the node agent, audit all traffic, and intercept the traffic that meets the rules;

[0052] S6: The node agent reports its own network interception events;

[0053] S7: The user calls the interface of the REST service module to view the network rule interception events of the application.

[0054] It should be noted that with the increase in container services, the in-container services in the container management engine have become more complex. Although the container management engine provides a virtual network, and the container runtime (Docker, Contianerd, etc.) uses namespace and cgroups technologies to provide network isolation, each container can still communicate through IP, and there is no effect of intercepting single traffic. Containers in the container management engine usually need to access each other, and how to audit and intercept the access between different containers is the current pain point. With the development of container technology, the concept of service mesh has emerged in the cloud native field.

[0055] A service mesh is an infrastructure layer for handling service-to-service communication. It allows developers to configure and manage these communication rules in a declarative manner without modifying the application code. For example, the Istio component. Istio hijacks and manages the application's inbound and outbound traffic by injecting a sidecar (such as istio-proxy) into the container. However, the implementation requires injecting an initialization Init container into each application Pod, and label tags need to be configured for auditing. It is often used together with Prometheus, and the interfaces provide complex data and the deployment is also very complex. Therefore, finding a more efficient and simple browsing interception and auditing technology is urgently needed in the current cloud-native field.

[0056] To solve the above problems, in this embodiment, the network interception plugin controller is driven to obtain container application information in the API Server, configure the network rules between applications through the interfaces of the REST service module, and then use the network interception plugin controller to persistently store the network rules in the Consul database. When the node proxy program listens to the latest network rules, according to the network rules of the traffic, the traffic that was originally directly passed into the container network namespace is redirected to the corresponding proxy network namespace, and finally, each proxy network namespace performs traffic auditing and interception processing on the container traffic. Thus, the best proxy network namespace is allocated for the traffic auditing and interception of each container, achieving efficient and accurate auditing and interception of the traffic communication between containers in the container management engine.

[0057] In a preferred embodiment, the API Server of the container management engine is configured to provide an interface for the REST API, driving all components in the container management engine to obtain and operate resources through the API Server.

[0058] In a preferred embodiment, in the network interception plugin controller: the REST service module is configured to externally provide an interface for operating network rules, enabling users to configure the network between containers through the interfaces of the REST service module; among them, the configuration parameters include the source application, destination application, communication protocol, and port; the Consul database is configured to store network rules and synchronize the network interception plugin controller with the node proxy program on the node.

[0059] In a preferred embodiment, the node proxy program is configured to listen to the network rules of the network interception plugin controller, perform interception and auditing operations on the container traffic, and report the corresponding event traffic.

[0060] In a preferred embodiment, step S2: Drive the network interception plugin controller to use the List-Watch mechanism to obtain container application information in the API Server and cache it, and provide the user's application configuration information, specifically including:

[0061] S21: Drive the network interception plugin controller to start, connect to the interface of the REST API of the API Server through authentication, and request resource invocation;

[0062] S22: Establish a local cache based on List-Watch, and drive the network interception plugin controller to store the resources obtained by List-Watch in the local memory cache.

[0063] In this embodiment, a method for monitoring and intercepting container traffic communication of a container management engine is proposed. This method does not require the cooperation and support of other components, has no association with the CNI plugin of the container management engine, and supports different CNI plugins. It can configure network rules between different containers and intercept and alarm traffic that violates the rules. As Figure 2 shown, it is an architecture diagram for the present invention to implement network traffic monitoring and interception.

[0064] Container management engine API Server: Refers to the interface that provides the REST API in the container management engine. All components in the container management engine obtain or operate resources through the API Server.

[0065] Controller: It is the controller provided by the network interception plugin, which includes two internal modules. The REST service module mainly provides interfaces for operating network rules externally. Users can configure the network between containers through the interfaces of the REST service module, such as parameters like source application, destination application, communication protocol, port, etc. The Consul database is used to store network rules. And synchronize the Controller with the dp proxy program on the node.

[0066] Node proxy program DP: Used to listen to the network rules in the Controller, perform real interception and auditing operations on container traffic, and report the corresponding event traffic.

[0067] The following is the specific execution process of the architecture.

[0068] Step 1: The Controller component uses the List and Watch mechanisms to obtain container application information in the API Server, cache it locally, and provide relevant information for the user to configure the application.

[0069] Step 2: The user configures network rules between applications through the REST API interface.

[0070] Step 3: The Controller persists the newly added network rules into the Consul database internally.

[0071] Step 4: The node agent program DP monitors the latest network rules, and then triggers the traffic diversion operation in DP to audit all traffic and intercept the traffic that meets the rules.

[0072] Step 5: The node agent program reports its own network interception events.

[0073] Step 6: The user calls the REST API to view the network rule interception events of the application.

[0074] The above are the working process steps of the entire network interception component. The following will specifically introduce how to intercept the traffic on the node in the present invention.

[0075] In a preferred embodiment, the network communication between containers in the container management engine is configured to use the CNI plugin for network communication. The traffic of the container is imported into the proxy network namespace, audited in the proxy network namespace, and then the traffic is redirected to the container network namespace of the corresponding container.

[0076] This method changes the default traffic communication method, imports the traffic of the default vex-peer into another network namespace, then audits the traffic, and redirects the traffic to the network space of the corresponding container.

[0077] In a preferred embodiment, in step S5, triggering the traffic diversion operation in the node agent program to audit all traffic and intercept the traffic that meets the rules specifically includes:

[0078] S51: When it is monitored that the traffic reaches the target container, according to the network rules, redirect the traffic that was originally directly passed into the container network namespace to the corresponding proxy network namespace;

[0079] S52: Each proxy network namespace makes a compliance judgment on the traffic according to the configured traffic audit rules. If the traffic does not meet the rules, discard the traffic and trigger a traffic interception event to the network interception plugin controller. If the traffic meets the rules, transfer the traffic to the container network namespace to which the target container belongs.

[0080] Furthermore, in step S51, redirecting the traffic that was originally directly passed into the container network namespace to the corresponding proxy network namespace according to the network rules of the traffic specifically includes:

[0081] S511: Determine the priorities and compliance detection items for traffic compliance detection for several containers according to network rules for traffic.

[0082] S512: Obtain the compliance detection items for each proxy network namespace and several detection resources allocated for performing compliance judgment. Consider the resources occupied by several detections for each compliance detection item, the several detection resources for each proxy network namespace, and the priorities and compliance detection items of the traffic arriving at several containers. Determine that the sum of the resources occupied by each detection determined by the compliance detection items of the traffic of the containers allocated to each proxy network namespace and the resources occupied by several detections for each compliance detection item is less than the corresponding detection resources allocated for the proxy network namespace to perform compliance judgment as the constraint condition. Take the minimum cumulative sum of the product of the number of compliance detection items of the traffic of each container that are not detected by the proxy network namespace and the priority of the container when the traffic of all containers performs compliance judgment in the allocated proxy network namespace as the optimization objective, and optimize and solve the traffic of the containers allocated to each proxy network namespace.

[0083] S513: Based on the traffic of the containers allocated to each proxy network namespace, redirect the traffic that was originally directly passed into the container network namespace to the corresponding proxy network namespace.

[0084] Furthermore, in step S511, the determination of priorities and compliance detection items is configured to determine the priorities and compliance detection items of the traffic of the containers according to the corresponding relationships in the pre - established priority and compliance detection item comparison table for the traffic arriving at each container recorded in the network rules; among them, different priorities are named using numerical values, and the higher the numerical value, the higher the priority, and the compliance detection items are named using identification codes.

[0085] In this embodiment, by configuring the API Server, network interception plugin controller, and node agent of the container management engine, the network interception plugin controller is driven to obtain container application information in the API Server using the List-Watch mechanism and cache it. The network rules between applications are configured through the interface of the REST service module, and then the network rules are persistently stored in the Consul database by the network interception plugin controller. Finally, when the node agent listens for the latest network rules, the traffic diversion operation in the node agent is triggered. Then, according to the network rules of the traffic, considering the resource occupancy of several detection items for each compliance detection item, the detection resources of several items for each proxy network namespace, and the priority and compliance detection items of the traffic reaching several containers, the traffic that was originally directly passed to the container network namespace is redirected to the corresponding proxy network namespace. Finally, traffic auditing and interception processing are performed on the traffic through each proxy network namespace. Thus, the best proxy network namespace is allocated for the traffic auditing and interception of each container, achieving efficient and accurate auditing and interception of container-to-container traffic communication in the container management engine.

[0086] The traffic interception technology of the container management engine proposed by the present invention does not depend on the CNI plugin of the container management engine and is different from the Sidcar mode in Istio service governance, which requires each application to inject an initialization application. It is simple and efficient to use. Only one controller needs to be deployed and a node agent needs to be deployed on each node. All traffic is centrally diverted to the agent-ns space for centralized traffic auditing without invading the business code. This interception technology can provide security services for container-to-container network communication in the container management engine and strengthen container security at the network level.

[0087] Refer to Figure 3 , Figure 3 It is a structural block diagram of an embodiment of the container traffic communication monitoring and interception system of the container management engine of the present invention.

[0088] As Figure 3 shown, the container traffic communication monitoring and interception system of the container management engine proposed by the embodiment of the present invention includes:

[0089] The first configuration module 10 is used to configure the API Server, network interception plugin controller, and node agent of the container management engine; among them, the network interception plugin controller includes a REST service module and a Consul database;

[0090] The acquisition module 20 is used to drive the network interception plugin controller to obtain container application information in the API Server using the List-Watch mechanism and cache it, and provide the application configuration information of the user;

[0091] The second configuration module 30 is used for users to configure network rules between applications through the interface of the REST service module;

[0092] The storage module 40 is used to persistently store network rules into the Consul database by using the network interception plug-in controller;

[0093] The auditing module 50 is used to trigger the drainage operation in the node agent program when the node agent program listens to the latest network rules, audit all traffic, and intercept the traffic that meets the rules;

[0094] The reporting module 60 is used for the node agent program to report its own network interception events;

[0095] The viewing module 70 is used for users to call the interface of the REST service module to view the network rule interception events of applications.

[0096] For other embodiments or specific implementation manners of the container traffic communication monitoring and interception system of the container management engine of the present invention, reference may be made to the above method embodiments, which will not be elaborated herein.

[0097] It can be understood that in the description of this specification, the descriptions referring to the terms "one embodiment", "another embodiment", "other embodiments", or "the first embodiment to the Nth embodiment", etc. mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in a suitable manner in any one or more embodiments or examples.

[0098] It should be noted that in this article, the term "comprising", "including", or any other variant thereof is intended to cover a non-exclusive inclusion, so that a process, method, article, or system including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or further includes elements inherent to such process, method, article, or system. Without further limitations, the element defined by the statement "including one..." does not exclude the existence of additional identical elements in the process, method, article, or system including the element.

[0099] The above are only the preferred embodiments of the present invention, and do not limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made by using the content of the specification and drawings of the present invention, or directly or indirectly applied in other related technical fields, shall be equally included in the patent protection scope of the present invention.

Claims

1. A container traffic communication monitoring and interception method for a container management engine, characterized in that: The method comprises the following steps: S1: Configure the container management engine's API server, network interception plug-in controller, and node agent. The network interception plug-in controller includes the REST service module and the Consul database. S2: Drives the network interception plug-in controller to use the List-Watch mechanism to obtain and cache container application information from the API server, providing the user's application configuration information; S3: Users configure network rules between applications through the interface of the REST service module; S4: Use the network interception plug-in controller to persist network rules to the Consul database; S5: When the node agent program monitors the latest network rules, it triggers the traffic diversion operation in the node agent program, audits all traffic, and intercepts the traffic that meets the rules; The network communication between containers in the container management engine is configured to use the CNI plug-in for network communication. The container traffic is imported into the proxy network namespace, where it undergoes traffic auditing and is then redirected to the container network namespace of the corresponding container. In step S5, the traffic diversion operation in the node agent is triggered to audit all traffic and intercept traffic that meets the rules, specifically including: S51: When monitoring traffic reaching the target container, redirect the traffic from the original direct flow to the container network namespace to the corresponding proxy network namespace according to the network rules; S52: Each proxy network namespace determines traffic compliance based on the configured traffic audit rules. If the traffic does not comply with the rules, the traffic is discarded and a traffic interception event is triggered to the network interception plug-in controller. If the traffic complies with the rules, the traffic is transferred to the container network namespace to which the target container belongs. In step S51, according to the network rules of the traffic, the traffic originally directly transmitted to the container network namespace is redirected to the corresponding proxy network namespace, specifically including: S511: Determine, based on the network rules of the traffic, the priority and compliance detection items for traffic compliance detection of the plurality of containers. S512: Obtain the compliance detection items of each proxy network namespace and the number of detection resources allocated for performing compliance judgment, consider the number of detection resources occupied by each compliance detection item, the number of detection resources of each proxy network namespace, and the priority of the traffic reaching several containers and the compliance detection item determination, take the compliance detection items of the traffic of the container assigned to each proxy network namespace and the number of detection resources occupied by each compliance detection item to be less than the corresponding detection resource allocated for performing compliance judgment of the proxy network namespace as a constraint condition, take the cumulative sum of the product of the number of compliance detection items of the traffic of each container that has not been detected by the proxy network namespace and the priority of the container when the compliance judgment is performed on the traffic of all containers in the assigned proxy network namespace as the minimum as the optimization goal, and optimize the solution for the traffic of the container assigned to each proxy network namespace; S513: Based on the traffic of the container to which each proxy network namespace is assigned, redirect the traffic originally directly transmitted to the container network namespace to the corresponding proxy network namespace; S6: The node agent reports its own network interception event; S7: The user calls the interface of the REST service module to view the network rule interception events of the application.

2. The container traffic communication monitoring and interception method of the container management engine according to claim 1 is characterized in that: The API Server of the container management engine is configured to provide a REST API interface, driving all components in the container management engine to obtain and operate resources through the API Server.

3. The container traffic communication monitoring and interception method of the container management engine according to claim 1 is characterized in that: In the network interception plug-in controller: The REST service module is configured to provide an interface for operating network rules to the outside world, so that users can configure the network between containers through the interface of the REST service module; wherein the configuration parameters include the source application, the destination application, the communication protocol and the port; The Consul database is configured to store network rules and synchronize the network interception plugin controller with the node agent on the node.

4. The container traffic communication monitoring and interception method of the container management engine according to claim 1, characterized in that: The node agent is configured to monitor the network rules of the network interception plug-in controller, intercept and audit the container traffic, and report the corresponding event traffic.

5. The container traffic communication monitoring and interception method of the container management engine according to claim 1, characterized in that: Step S2: The network interception plug-in controller uses the List-Watch mechanism to obtain container application information from the API Server and cache it, providing the user's application configuration information, including: S21: drives the network interception plug-in controller to start, connects to the REST API interface of the API Server through authentication, and requests resource calls; S22: Establish a local cache based on List-Watch, driving the network interception plug-in controller to store the resources obtained by List-Watch in the local memory cache.

6. The container traffic communication monitoring and interception method of the container management engine according to claim 1, characterized in that: In step S511, the priority and compliance detection item determination is configured to determine the priority and compliance detection item of the container traffic based on the correspondence between the traffic arriving at each container recorded in the network rules in the pre-priority and compliance detection item comparison table; wherein, different priorities are named using numerical values, and the priority with a larger numerical value is higher, and the compliance detection item is named using an identification code.

7. A container traffic communication monitoring and interception system for a container management engine, characterized in that: A container traffic communication monitoring and interception method for a container management engine according to any one of claims 1 to 6, comprising: A first configuration module is used to configure the API server, network interception plug-in controller, and node agent of the container management engine; wherein the network interception plug-in controller includes a REST service module and a Consul database; The acquisition module is used to drive the network interception plug-in controller to use the List-Watch mechanism to obtain and cache container application information from the API Server, providing the user's application configuration information; The second configuration module is used for users to configure network rules between applications through the interface of the REST service module; The storage module is used to store network rules persistently in the Consul database using the network interception plug-in controller; The audit module is used to trigger the traffic diversion operation in the node agent program when the node agent program monitors the latest network rules, audit all traffic, and intercept the traffic that meets the rules; Reporting module, used by node agent program to report its own network interception events; The viewing module is used by users to call the interface of the REST service module to view the network rule interception events of the application.

Images