DNS-Based Cluster Topology Mapping for Network Policy Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for determining network topology in computing clusters, such as Kubernetes environments, are computationally intensive and specific to the version of the Kubernetes cluster network interface (CNI) implementation, lacking efficiency and flexibility.
Innovation Solution
Utilizing DNS requests to infer connection and dependency relationships between pods and services within a computing cluster, generating network topology information that is agnostic to the CNI implementation, and using this information to automatically or semi-automatically generate network policies to manage network connectivity and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network flow logs are used to determine network topology, then network connection information can be obtained, but the computational complexity and resource consumption increase significantly
Solution Approach 1:
The patent extracts only the necessary DNS query information (source IP, destination domain, query type) from network traffic to build topology graphs, avoiding the need to process entire network flow logs. This selective extraction maintains topology accuracy while dramatically reducing computational overhead.
Solution Approach 2:
The patent uses DNS query records as a simplified copy or representation of actual network connections. Instead of analyzing complete network flow data, it creates a topological model based on DNS resolution patterns, which captures essential connectivity information with minimal processing requirements.
2Measurement precision
If CNI-specific methods are used to determine network topology, then detailed cluster interface information can be obtained, but the solution becomes specific to particular Kubernetes versions and CNI implementations
Solution Approach 1:
The patent implements a universal DNS-based topology detection method that works across different Kubernetes versions and CNI implementations. By using DNS queries as the common denominator for network communication, the solution achieves multi-functionality and broad adaptability without being tied to specific cluster interface versions.
Solution Approach 2:
Instead of analyzing network traffic from the traditional CNI perspective (interface-level), the patent inverts the approach by using DNS application-layer queries to infer network topology. This inversion bypasses CNI version dependencies and provides a version-agnostic solution.
3Loss of information
If comprehensive network flow log analysis is performed, then complete network dependency relationships can be identified, but the processing time and system complexity increase
Solution Approach 1:
The patent performs preliminary DNS query collection and filtering before topology construction. By pre-processing and storing DNS resolution data, the system prepares connectivity information in advance, enabling faster topology graph generation when needed without performing comprehensive flow log analysis in real-time.
Solution Approach 2:
The patent uses DNS query samples as a partial representation of complete network traffic. Rather than analyzing every network flow, it processes DNS queries which provide sufficient information for topology inference, achieving acceptable dependency relationship identification with reduced processing time.
Data Source
AI summary
Systems, methods, apparatuses, and computer program products are disclosed for determining network topology information using domain name system (DNS) queries. Network connection and dependency information of elements in a compute cluster are determined from DNS requests. A network topology is generated based on the determined network connection and dependency information. A network policy is generated for the computing cluster based on the network topology.