Kubernetes complex network strategy system and implementation method thereof

Abstract

The invention discloses a kubernetes complex network strategy system and an implementation method thereof, and belongs to the technical field of cloud computing. The system comprises a global networkgroup which represents any set of IP subnets / CIDRs; the global network strategy comprises a plurality of global network groups or resource selectors arranged in the strategy; the project network groupis suitable for a specific Namespace; the project network strategy is suitable for a specific Namespace; the command controller is used for an administrator to check or modify the four types of network policies; the strategy controller is connected with the kube-apiserver, and a specific network strategy is stored, wherein the strategy controller is operated in the form of a deploygent; the strategy trigger is operated in a daemon set mode; and the strategy generated by the strategy controller is applied to the corresponding node by the strategy trigger to take effect, and the strategy is realized by adding self-defined chains caihcloud-chains in filters, raw and mangle tables in a Linux kernel data packet processing module Netfilter. According to the invention, cluster network strategy management can be simplified, the application service capability of kubernetes is enhanced, and the service capability of kubernetes service providers is further improved.

Description

technical field [0001] The invention belongs to the technical field of cloud computing, in particular to a kubernetes complex network policy system and an implementation method thereof. Background technique [0002] In recent years, container technology and the Kubernetes platform have continued to heat up. Kubernetes has greatly improved the speed and manageability of application deployment. Due to its flexibility, scalability and ease of use, Kubernetes has become the de facto standard for container orchestrators and quickly landed And empower the industry, greatly improving resource utilization efficiency and productivity. [0003] As a new technology that is still in the development stage, the progress of Kubernetes in network isolation is relatively slow and rudimentary compared with the computing field. Kubernetes currently provides the NetworkPolicy function by default, which supports network access control at the Namespace and Pod levels. Use labels to specify name...

AI Technical Summary

Problems solved by technology

[0004] In the process of using the Kubernetes platform, it is obviously difficult to meet the needs of most scenarios based on Namespace and Pod level network control and label matching resources.

First of all, the label-based matching method is too simple to match logical expressions, complex operators or arrays, and configure policy priorities; second, the default network policy cannot achieve a general policy at the cluster level, and the same policy needs to be All Namespaces are configured repeatedly; again, other types of resources in kubernetes cannot be matched, and the network policy effect is not universal; at the same time, when the cluster begins to take shape, managers can no longer ignore the management costs of labels; finally, the default network policy cannot be implemented Logging, not friendly to development and testing based on network policies

[0005] Due to the above problems, when faced with massive applications and containers, the kubernetes cluster cannot implement a flexible and efficient application isolation strategy, and the problem will become more serious after the kubernetes cluster scales up

Images