Method, device and equipment for intercepting K8s operation request

Abstract

The embodiment of the invention relates to the technical field of server operation and maintenance, and discloses a K8s operation request intercepting method, device and equipment, and the method comprises the steps: obtaining an operation request which is used for operating resources in K8s; if the global switch is turned on, the preset interception rule set is used for verifying the intercepted operation request, and the global switch is used for representing whether the operation request is subjected to interception verification or not. Whether the operation requests are intercepted and verified is determined through a global switch, and full-coverage and undifferentiated interception verification of all the operation requests of K8s is achieved. The interception verification mechanism does not depend on the permission level of the permission account of the initiator of the operation request, even if the initiator initiates the operation request by using the account with the high permission level, interception verification still needs to be carried out, and the operation request which fails to be verified can be intercepted. The misoperation or high-risk operation initiated by using a high-authority account is effectively avoided, and the stability and safety of the system are greatly guaranteed.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of server operation and maintenance, in particular to a method and device for intercepting K8s operation requests. BACKGROUND

[0002] Kubernetes has been widely used in the automatic deployment, scheduling and operation and maintenance management of enterprise-level services due to its powerful automation capability, which significantly improves the efficiency of automated operation and maintenance. However, the high automation characteristics of Kubernetes, while improving the efficiency of operation and maintenance, also bring an unignorable risk. The efficiency of automatically executing operation requests initiated by each account is high, and if the operation request is a misoperation, the automatic execution of the operation request will quickly spread the exception caused by the operation request to the entire system. In the prior art, in order to reduce the potential risks brought by the automatic execution of operation requests by Kubernetes to the system, the operation request is often intercepted and permission controlled through RBAC mechanism, so as to reduce the risks brought by misoperation to the system, but this mechanism cannot effectively verify and intercept the operation requests of high-privilege accounts, and the exception caused by the operation request will still be quickly spread to the entire system, thereby causing service interruption, data loss and other serious consequences, resulting in poor stability and security of the system. SUMMARY

[0003] The purpose of the present application is to at least provide a method and device for intercepting K8s operation requests, which can at least solve the technical problem that the operation requests of high-privilege accounts in K8s cannot be effectively verified and intercepted, which easily affects the stability and security of the system, and can at least achieve the same treatment of each privilege account in K8s, effectively avoid misoperation or high-risk operation initiated by high-privilege accounts, and greatly ensure the stability and security of the system.

[0004] To solve the above technical problems, at least one embodiment of the present application provides a method for intercepting K8s operation requests, comprising: obtaining an operation request, wherein the operation request is used to operate resources in the K8s; if a global switch is opened, verifying the intercepted operation request using a preset interception rule set, wherein the global switch is used to indicate whether to intercept and verify the operation request.

[0005] The global switch is used to determine whether the operation request is intercepted and verified, so as to realize full coverage of the operation request of the K8s and non-discriminatory interception verification. The interception verification mechanism does not depend on the permission level of the permission account of the initiator of the operation request. Even if the initiator initiates the operation request by using a high permission level account, the interception verification is still needed. For the operation request that fails in the verification, the interception can be performed. The misoperation or high-risk operation initiated by using the high permission account is effectively avoided, and the stability and security of the system are greatly guaranteed.

[0006] In some examples, the verifying and intercepting the operation request by using the preset interception rule set comprises: verifying whether the operation request needs to be intercepted by using the preset interception rule set; if yes, generating interception information to intercept the operation request based on the interception information.

[0007] In some examples, the preset interception rule set comprises a plurality of interception rules, and each interception rule comprises at least an interception operation type, an operation frequency threshold, an instance number threshold, a prohibited operation range, and a prohibited operation resource.

[0008] In some examples, the operation request is also used to modify the interception rule. If the operation request is a request for modifying the interception rule, before verifying and intercepting the operation request by using the preset interception rule set, the method further comprises: obtaining an evaluation result of the operation request, and updating the operation request based on the evaluation result. The evaluation result comprises evaluation pass information and an operation request after evaluation modification.

[0009] In some examples, the evaluation result further comprises evaluation fail information. If the evaluation result comprises the evaluation fail information, the interception information is generated to intercept the operation request based on the interception information.

[0010] In some examples, the evaluation result can further comprise a latest interception rule. The method further comprises: updating the preset interception rule set based on the latest interception rule in the evaluation result.

[0011] In some examples, after intercepting the operation request based on the interception information, the method further comprises: obtaining initiator information of the operation request; generating an audit log based on the interception information, the operation request, and the initiator information, and storing the audit log.

[0012] At least one embodiment of the present application also provides an interception K8s operation request device, comprising: an obtaining unit configured to obtain an operation request, wherein the operation request is used to operate a resource in the K8s; and an interception unit configured to verify and intercept the operation request by using a preset interception rule set if a global switch is turned on, wherein the global switch is used to indicate whether the operation request is intercepted and verified.

[0013] At least one embodiment of this application also provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the above-described method for intercepting K8s operation requests.

[0014] At least one embodiment of this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method for intercepting K8s operation requests. Attached Figure Description

[0015] One or more embodiments are illustrated by way of example with reference to the accompanying drawings, and these illustrative descriptions do not constitute a limitation on the embodiments.

[0016] Figure 1 This is a flowchart illustrating a method for intercepting K8s operation requests, provided in one embodiment of this application.

[0017] Figure 2 This is a schematic diagram of a structure for intercepting and verifying Kubernetes operation requests, provided in one embodiment of this application.

[0018] Figure 3 This is a schematic diagram of an interception process for intercepting K8s operation requests, provided in one embodiment of this application;

[0019] Figure 4 This is a schematic diagram of a device for intercepting K8s operation requests provided in another embodiment of this application;

[0020] Figure 5 This is a schematic diagram of the structure of an electronic device provided in another embodiment of this application. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the various embodiments of this application will be described in detail below with reference to the accompanying drawings. However, those skilled in the art will understand that many technical details have been provided in the various embodiments of this application to help readers better understand this application. However, the technical solutions claimed in this application can be implemented even without these technical details and various changes and modifications based on the following embodiments. The division of the various embodiments below is for the convenience of description and should not constitute any limitation on the specific implementation of this application. The various embodiments can be combined with and referenced by each other without contradiction.

[0022] It should be noted that the acquisition or use of data in the embodiments of this application requires the user's consent. The relevant data can only be obtained after the user's authorization, and the acquisition or use of the data complies with the provisions of relevant laws and regulations.

[0023] To facilitate understanding of the embodiments of this application, the relevant content regarding the method of intercepting K8s operation requests will be introduced first.

[0024] API server, the control plane of Kubernetes, is used to manage and store container and object metadata, and to perform specific operations on resource objects; node, namespace, and pv are Kubernetes resource objects.

[0025] operation-webhook accepts calls from the API server, intercepts and verifies operation requests, and determines whether the operation request needs to be intercepted.

[0026] A webhook is an external service used to dynamically validate or modify Kubernetes resources before they are created, updated, or deleted.

[0027] K8s, short for Kubernetes, is a container orchestration system that runs on servers and enables automated deployment, scaling, and operation by managing containerized applications on servers.

[0028] Kubernetes, with its powerful automation capabilities, has been widely used for the automated deployment, scheduling, and operation and maintenance management of enterprise services, significantly improving the efficiency of automated operation and maintenance. However, while Kubernetes' high degree of automation improves operational efficiency, it also brings significant risks. Its high efficiency in automatically executing operation requests initiated by various accounts means that if an operation request is a erroneous or high-risk operation, its automatic execution can rapidly spread the resulting exceptions throughout the entire system. Current technologies often use mechanisms like Restricted Access Control (RBAC) to intercept and control access to these requests, mitigating the risks posed by erroneous or high-risk operations. However, these mechanisms cannot effectively verify and intercept operation requests from high-privilege accounts, allowing the exceptions to still spread rapidly throughout the system, leading to serious consequences such as service interruptions and data loss, resulting in poor system stability and security.

[0029] To address the technical problem of the inability to effectively verify and intercept operation requests from high-privilege accounts in Kubernetes, which can easily affect system stability and security, this invention proposes a method for intercepting Kubernetes operation requests. The implementation details of this method are described below. The following content is provided for ease of understanding and is not essential for implementing this solution.

[0030] Example 1:

[0031] The method for intercepting Kubernetes operation requests in this embodiment can be applied to electronic devices with communication, computing, and data storage capabilities. Its specific process can be as follows: Figure 1 As shown, it includes:

[0032] Step 110: Obtain an operation request, wherein the operation request is used to operate on the resources in the K8s.

[0033] Operation requests refer to requests to manipulate resources in Kubernetes, including requests to modify, delete, and add resources. Resources include nodes, namespaces, pods (the smallest deployment unit), PVs (user storage), PVCs (user-to-user storage), DaemonSets, ConfigMaps, and secrets. Operation requests are also used to modify interception rules, including modifying, deleting, and updating interception rules.

[0034] Specifically, the operation request can be initiated via kubectl or a platform service, for example, such as Figure 2 As shown, operations personnel initiate operation requests to the API server via kubectl, or platform services initiate operation requests by calling interfaces provided by the API server. Here, platform services refer to a series of services that provide specific functions within the Kubernetes cluster, including a unified access control platform (e.g., an inbound / outbound pool platform) and a front controller (e.g., FEC). These are used to initiate operation requests to K8s resources via interfaces.

[0035] Step 120: If the global switch is turned on, the operation request is intercepted using a preset interception rule set. The global switch indicates whether the operation request is intercepted and verified.

[0036] The global switch being on indicates that every operation request should be intercepted and verified using the preset interception rule set; if the global switch being off, it indicates that the preset interception rule set should not be used to intercept and verify every operation request. The preset interception rule set is used to verify whether an operation request is safe and compliant. An operation request verified by using the preset interception rule set is safe and compliant, meaning that the operation risk of the operation request is very low.

[0037] Specifically, the preset interception rule set includes multiple interception rules, and each interception rule includes at least an interception rule activation identifier, an interception operation type, an operation frequency threshold, an instance count threshold, a prohibited operation scope, and prohibited operation resources.

[0038] The intercepted operation type refers to the type of resource request in Kubernetes, which can include any of the following: modifying, deleting, or adding resources. Preset interception rules can include multiple interception rules for the same operation type, or multiple interception rules for different operation types. The operation frequency threshold refers to the maximum operation frequency of the operation request corresponding to this intercepted operation type and the maximum number of operations that the operation request can perform per unit time. The instance count threshold refers to the maximum number of instances that can be operated on in a single request. The prohibited operation scope refers to the range of resources that the operation request corresponding to this intercepted operation type is not allowed to operate on. This operation scope includes global operations, cross-namespace operations, and cluster-level operations. Prohibited operation resources refer to resources that the operation request corresponding to this intercepted operation type is not allowed to operate on.

[0039] The maximum operation frequency is the ratio of the number of operations per unit time to that unit time.

[0040] For example, a preset interception rule set can be written into Kubernetes via a configuration file. For instance, a preset interception rule set and a global switch can be represented as: {"switch1":"on","rules":[{"switch2":"on","resource":["namespace","node"],"operate":["delete","update","deletecollection","patch"],"thresholdNum":2,"intervalSecond":2,"intervalNum":3,"glabal":false},{"switch2":"on","resource":["defa"]} The code snippet `ult"],"operate":["delete","update","deletecollection","patch"],"thresholdNum":0,"intervalSecond":0,"intervalNum":0,"glabal":true}],"defalut":["pod","pvc","pv"]}` sets the default set of interception rules. `rules` represents the default set of interception rules; `switch1` is a global switch, where `on` indicates the default setting is enabled and `off` indicates it is disabled. `switch2` is a flag indicating whether the interception rules are enabled; `on` means the rules are active and `off` means they are disabled. It's important to understand that `switch1` is a global switch to determine whether the default set of interception rules is active, while `switch2` is a local switch to determine whether the corresponding interception rules within the default set are active. `resource` indicates the resource to be blocked, `operate` indicates the type of interception operation: `delete` for deleting resources, `update` for updating resource configuration, `deletecollection` for batch deleting resources, and `patch` for adding resource configuration. `thresholdNum` is the instance count threshold. `intervalSecond` is the maximum number of operations that can be performed per unit of time. The maximum operation frequency is `intervalNum / intervalSecond`. `global` specifies the scope of prohibited operations globally. `false` indicates that global operations are not prohibited, and `true` indicates that global operations are prohibited. `default` indicates resources that are not prohibited from operation. If `resource` is `default`, then all resources except those corresponding to `default` are prohibited from operation.

[0041] Furthermore, in step 120 above, the step of using a preset interception rule set to verify and intercept the operation request includes: using the preset interception rule set to verify whether the operation request needs to be intercepted; if so, generating interception information to intercept the operation request based on the interception information.

[0042] Specifically, verifying whether the operation request needs to be intercepted using a preset interception rule set includes: obtaining the operation type of the operation request; if at least one interception rule corresponding to an interception operation type matching the operation type is determined from the preset interception rule set, wherein at least one interception rule is an interception rule enabled by an enable flag; then for each interception rule, if any of the following exist: the number of instances of the operation requested by the operation request exceeds an instance count threshold, the operation frequency of the operation request exceeds an operation frequency threshold, the operation scope of the operation request falls within a prohibited operation range, or the resource operated by the operation request falls within a prohibited operation resource, then it is determined that the operation request needs to be intercepted, wherein the instance count threshold, operation frequency threshold, prohibited operation range, and prohibited operation resource belong to the same interception rule; if for each interception rule, none of the following exist: the number of instances of the requested operation exceeds an instance count threshold, the operation frequency of the operation request exceeds an operation frequency threshold, the operation scope of the operation request falls within a prohibited operation range, or the resource operated by the operation request falls within a prohibited operation resource, then the operation request is considered not to be intercepted; if no interception operation type matching the operation type is determined from the preset interception rule set, then the operation request is considered not to be intercepted. In particular, if the resource requested for an operation includes related resources, or if the resource requested for an operation includes any resource that is prohibited from operation, the resource requested for an operation is considered to be a prohibited resource.

[0043] For example, the process of determining whether to block an operation request based on a preset set of interception rules can be found in [reference needed]. Figure 3 The system determines whether the interception operation type of the interception rule includes the operation type corresponding to the operation request. If not, it checks whether the interception operation type of the next interception rule includes the operation type corresponding to the operation request and writes it to the audit log. If it includes the operation type, it determines whether the number of instances of the operation request exceeds the instance count threshold. If it does, it determines that the interception operation needs to be intercepted. If it does not exceed the threshold, it determines whether the operation scope of the operation request falls within the prohibited operation scope. If it does, it determines that the interception operation needs to be intercepted. If it does not fall within the prohibited operation scope, it determines whether the resource operated on by the operation request is a prohibited operation resource. If it is, it determines that the interception operation needs to be intercepted.

[0044] For example, such as Figure 2As shown, after receiving an operation request, the API server sends the operation request to the operation-webhook by calling the webhook. The operation-webhook uses a preset set of interception rules to intercept and verify the operation request, and returns the interception and verification result (i.e. whether it is intercepted) to the API server. If it is not intercepted, the API server executes the operation request to realize the operation of Kubernetes resources.

[0045] Therefore, by using a global switch to determine whether to intercept and verify operation requests, full coverage of all operation requests in Kubernetes can be achieved, ensuring indiscriminate interception and verification. This interception and verification mechanism does not depend on the permission level of the account initiating the operation request. Even if the initiator uses a high-privilege account to initiate the operation request, interception and verification are still required. Operation requests that fail verification can be blocked. This effectively avoids accidental or high-risk operations initiated by high-privilege accounts, greatly ensuring the stability and security of the system.

[0046] It should be noted that, as Figure 2 As shown, the interception rules in the preset interception rule set can be configured by developers before deployment, i.e., before the Kubernetes system runs. Alternatively, they can be modified via an operation request; if modified via an operation request, they must be reviewed and approved by the administrator before modification.

[0047] In some examples, the operation request is also used to modify the interception rules. If the operation request is a request to modify the interception rules, before verifying and intercepting the operation request using a preset interception rule set, the method further includes: obtaining the review result of the operation request, and updating the operation request based on the review result. The review result includes review approval information and the modified operation request.

[0048] The approved information includes information that allows the execution of the operation request, in order to modify the interception rules in the preset interception rule set. The modified operation request refers to the new approved operation request obtained after the reviewer modifies the operation request.

[0049] Specifically, the review result also includes review failure information. If the review result includes review failure information, interception information is generated to intercept the operation request based on the interception information.

[0050] The information indicating that the review failed includes information that the operation request was not allowed to be executed, along with the corresponding reason for disallowance.

[0051] Specifically, the review result may also include the latest blocking rules, and the method further includes: updating the preset blocking rule set based on the latest blocking rules in the review result.

[0052] In some examples, after intercepting the operation request based on the interception information, the method further includes: obtaining the initiator information of the operation request; generating an audit log based on the interception information, the operation request, and the initiator information, and storing the audit log.

[0053] The audit log is formatted as JSON. The initiator information may include at least one of the initiating account and the initiation time of the operation request. The interception information includes an interception identifier and a reason for interception. The operation request includes the operation type, the requested resource, and the resource name. For example, the audit log could be {"timestamp":"2023-07-20T08:30:45Z","operation1":"delete","resource1":"namespace","name":["production"],"source1":"fec","decision":"deny","reason":"namespace resource exists"}, where timestamp is the initiation time, source1 is the initiating account, operation is the operation type, resource1 is the requested resource, name is the resource name, decision indicates whether interception occurred (deny indicates interception, pass indicates pass), and reason is the reason for interception.

[0054] Specifically, after executing the operation request, the method further includes: obtaining the initiator information of the operation request; generating an audit log based on the operation request and the initiator information, and storing the audit log.

[0055] In summary, this solution proposes obtaining operation requests, where the operation requests are used to operate on resources in the Kubernetes (K8s) database. If a global switch is enabled, the operation request is intercepted using a preset interception rule set. The global switch indicates whether to intercept and verify the operation request. By determining whether to intercept and verify the operation request through the global switch, full coverage of all operation requests in K8s is achieved, ensuring indiscriminate interception and verification. This interception and verification mechanism does not depend on the permission level of the account initiating the operation request. Even if the initiator uses a high-privilege account to initiate the operation request, interception and verification are still required. Operation requests that fail verification can be intercepted. This effectively avoids erroneous or high-risk operations initiated by high-privilege accounts, greatly ensuring the stability and security of the system.

[0056] Specifically, this solution can prevent accidental large-scale deletion of Namespaces and Nodes, prevent high-frequency deletion or modification operations within a short period, prevent deletion of Namespaces or Nodes containing resources, and prevent the global deletion and editing of prohibited resources. For example, if the prohibited resources are DaemonSet, ConfigMap, or secret, it can also prevent the deletion or editing of DaemonSet, ConfigMap, and secret. The global switch in this solution also provides an emergency operation switch mechanism. By turning the global switch on or off, it is possible to control whether to enable or disable interception verification based on a preset set of interception rules. Operation traceability can be achieved through audit logs.

[0057] Example 2:

[0058] Another embodiment of this application relates to a device for intercepting Kubernetes operation requests. The implementation details of this embodiment's Kubernetes operation request interception device are described below. The following implementation details are provided for ease of understanding and are not essential for implementing this solution. A schematic diagram of the Kubernetes operation request interception device 40 in this embodiment can be seen as follows: Figure 4 As shown, it includes an acquisition unit 401 and an interception unit 402.

[0059] The acquisition unit 402 is used to acquire an operation request, wherein the operation request is used to operate on resources in the K8s;

[0060] The interception unit 402 is used to verify and intercept the operation request using a preset interception rule set if the global switch is turned on, wherein the global switch is used to indicate whether to intercept and verify the operation request.

[0061] In some examples, when the interception unit 402 is used to verify whether the operation request needs to be intercepted using a preset interception rule set, it is specifically used to: verify whether the operation request needs to be intercepted using the preset interception rule set; if so, generate interception information to intercept the operation request based on the interception information.

[0062] In some examples, the preset interception rule set in the interception unit 402 includes multiple interception rules, and each interception rule includes at least the interception operation type, operation frequency threshold, instance count threshold, prohibited operation scope, and prohibited operation resources.

[0063] In some examples, the operation request is also used to modify the interception rules. If the operation request is a request to modify the interception rules, before using the preset interception rule set to verify and intercept the operation request, the interception unit 402 is also used to: obtain the review result of the operation request, and update the operation request based on the review result. The review result includes review pass information and the modified operation request.

[0064] In some examples, the review result also includes review failure information, and the interception unit 402 is further configured to: if the review result includes review failure information, generate interception information to intercept the operation request based on the interception information.

[0065] In some examples, the review result may also include the latest interception rules, and the interception unit 402 is further configured to update the preset interception rule set based on the latest interception rules in the review result.

[0066] In some examples, after the operation request is intercepted based on the interception information, the device further includes an auditing unit, which is used to: obtain the initiator information of the operation request; generate an audit log based on the interception information, the operation request, and the initiator information, and store the audit log.

[0067] It is worth mentioning that all units involved in this embodiment are logical units. In practical applications, a logical unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. Furthermore, to highlight the innovative aspects of this application, this embodiment does not introduce units that are not closely related to solving the technical problems proposed in this application; however, this does not mean that other units are absent in this embodiment.

[0068] Example 3:

[0069] Another embodiment of this application relates to an electronic device, such as... Figure 5 As shown, it includes: at least one processor 901; and a memory 902 communicatively connected to at least one processor 901; wherein the memory 902 stores instructions executable by at least one processor 901, the instructions being executed by at least one processor 901 to enable at least one processor 901 to execute the intercept Kubernetes operation request method in the above embodiments.

[0070] The memory and processor are connected via a bus, which can include any number of interconnecting buses and bridges, connecting various circuits of one or more processors and memories. The bus can also connect various other circuits, such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and will not be described further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by the processor is transmitted over the wireless medium via an antenna, which further receives data and transmits it to the processor.

[0071] The processor manages the bus and general processing, and also provides various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory is used to store data used by the processor during operation.

[0072] Example 4:

[0073] Another embodiment of this application relates to a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the method embodiments described above.

[0074] That is, those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. This program is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0075] Those skilled in the art will understand that the above embodiments are specific embodiments for implementing this application, and in practical applications, various changes can be made to them in form and detail without departing from the spirit and scope of this application.

Claims

1. A method for intercepting Kubernetes operation requests, characterized in that, include: Obtain an operation request, wherein the operation request is used to operate on resources in the K8s; If the global switch is turned on, the operation request will be intercepted using a preset set of interception rules. The global switch indicates whether the operation request will be intercepted and verified.

2. The method for intercepting Kubernetes operation requests according to claim 1, characterized in that, The step of using a preset interception rule set to verify and intercept the operation request includes: Verify whether the operation request needs to be intercepted using a preset set of interception rules; If so, then interception information is generated to intercept the operation request based on the interception information.

3. The method for intercepting Kubernetes operation requests according to claim 1, characterized in that, The preset interception rule set includes multiple interception rules, and each interception rule includes at least the interception operation type, operation frequency threshold, instance count threshold, prohibited operation scope, and prohibited operation resources.

4. The method for intercepting Kubernetes operation requests according to claim 1, characterized in that, The operation request is also used to modify the interception rules. If the operation request is a request to modify the interception rules, before verifying and intercepting the operation request using a preset interception rule set, the method further includes: Obtain the review result of the operation request, and update the operation request based on the review result. The review result includes review approval information and the revised operation request.

5. The method for intercepting Kubernetes operation requests according to claim 4, characterized in that, The review result also includes review failure information. If the review result includes review failure information, then interception information is generated to intercept the operation request based on the interception information.

6. The method for intercepting Kubernetes operation requests according to claim 4, characterized in that, The review results may also include the latest blocking rules, and the method further includes: The preset interception rule set is updated based on the latest interception rules in the review results.

7. The method for intercepting Kubernetes operation requests according to claim 2 or 5, characterized in that, After intercepting the operation request based on the interception information, the method further includes: Obtain the information of the initiator of the operation request; An audit log is generated and stored based on the interception information, the operation request, and the initiator information.

8. A device for intercepting Kubernetes operation requests, characterized in that, include: The acquisition unit is used to acquire operation requests, wherein the operation requests are used to operate on resources in the K8s; An interception unit is used to verify and intercept the operation request using a preset interception rule set if the global switch is turned on, wherein the global switch is used to indicate whether to intercept and verify the operation request.

9. An electronic device, characterized in that, include: At least one processor; as well as, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method for intercepting K8s operation requests as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the method for intercepting K8s operation requests as described in any one of claims 1 to 7.

Images