Application isolation method, system and device, and computer-readable storage medium

An application isolation apparatus, comprising:

• a processor;
• and
• a memory, storing a computer program that is executed executable by a processor, and upon execution by the processor, is configured to cause the processor to a processor configured for implementing steps:
• determine a target application to be isolated in Kubernetes;
• acquire an isolation policy for each component in the target application;
• create an initial network security policy corresponding to the target application;
• modify a push rule, a pop rule, and a match label of the initial network security policy according to the isolation policy to obtain a target network security policy;
• convert the target network security policy into an Iptables rule matching the Kubernetes;
• and
• isolate the target application according to the Iptables rule;
• creating the initial network security policy corresponding to the target application comprises:
• creating the initial network security policy;
• setting a podSelector field of the initial network security policy as in a form of matchExpression;
• setting a value of an operator of the initial network security policy as a conditional operator In;
• and
• setting the match label of the initial network security policy as a set of identifications of all components in the target application.

A non-transitory computer-readable storage medium storing a computer program that is executed executable by a processor, and upon execution by the processor, is configured to cause the processor to:

• determine a target application to be isolated in the Kubernetes;
• acquire an isolation policy for each component in the target application;
• creat an initial network security policy corresponding to the target application;
• modify a push rule, a pop rule, and a match label of the initial network security policy according to the isolation policy to obtain a target network security policy;
• convert the target network security policy into an Iptables rule matching the Kubernetes;
• and
• isolate the target application according to the Iptables rule;
• creating the initial network security policy corresponding to the target application comprises:
• creating the initial network security policy;
• setting a podSelector field of the initial network security policy as in a form of match Expression;
• setting a value of an operator of the initial network security policy as a conditional operator In;
• and
• setting the match label of the initial network security policy as a set of identifications of all components in the target application.