Method and system for implementing network isolation of multiple tenants of Kubernetes cluster

Abstract

The invention provides a method and a system for implementing network isolation of multiple tenants of a Kubernetes cluster. A Kubernetes foreground interfaces receives configuration built by a tenant, a Namespace name is used as a label, after receiving a parameter, a background automatically builds a Namespace refusing to communicate with any Pod, a NetworkPolicy that can communicate with the Pod of the Namespace is built, and thus setting of network isolation of the Namespace corresponding to the tenant is completed. When a user builds an application or a service, the label is automaticallytransferred as the label of the Pod, for marking the NetworkPolicy that the pod uses the Namespace; when the user deletes the Pod of the application or the service, the Kubernetes cluster will also automatically clear the related NetworkPolicies without influencing the other Pod accesses of the existing environment. The network isolation of the multiple tenants of the Kubernetes cluster is configured through combining the Calico network plug-in with the NetworkPolicy network strategy, so that the defect that the different Namespaces of the Kubernetes do not have network isolation can be overcome, and the method and the system help the user use the Kubernetes cluster network safer, and meanwhile help operation and maintenance personnel manage the Kubernetes cluster network with multiple tenants better.

Description

technical field [0001] The present invention relates to the technical field of cloud computing, in particular to a method and a system for implementing Kubernetes cluster multi-tenant network isolation. Background technique [0002] Namespace (namespace) is an abstract collection of a set of resources and objects in a Kubernetes cluster. For example, it can be used to divide objects within the system into different project groups or user groups. Common ones include Pod, Service, and Deployment, etc., which are generally used Isolate different tenants. Currently, the resource quota management of Kubernetes can limit the resources occupied by different tenants, such as CPU and memory, but it does not achieve network isolation. In some application environments, such as public cloud, it cannot meet the network isolation requirement that Pods of different tenants should not communicate with each other. NetworkPolicy provides policy-based network control, uses label selectors to...

AI Technical Summary

Problems solved by technology

In some application environments, such as public cloud, it cannot meet the network isolation requirements that Pods of different tenants should not communicate with each other.

NetworkPolicy provides policy-based network control, uses label selectors to simulate traditional segmented networks, and controls the traffic between them through policies. The implementation of NetworkPolicy requires a specific network solution; otherwise, even if NetworkPolicy is configured, it will not help

Images