Determining network topology information from domain name system (DNS) queries
Systems, methods, apparatuses, and computer program products are disclosed for determining network topology information using domain name system (DNS) queries. Network connection and dependency information of elements in a compute cluster are determined from DNS requests. A network topology is generated based on the determined network connection and dependency information. A network policy is generated for the computing cluster based on the network topology.
1 . A system comprising:
a processor; and
a memory device that stores program code structured to cause the processor to:
detect, from network traffic associated with a computing cluster, a domain name system (DNS) request;
determine, based on the DNS request, network connection and dependency information of the computing cluster;
generate, based on the network connection and dependency information, a network topology of the computing cluster; and
generate, based on the network topology, a network policy.
2 . The system of claim 1 , wherein, to determine, based on the DNS request, network connection and dependency information of the computing cluster, the program code is structured to cause the processor to:
determine a source service associated with the DNS request;
determine, based on a hostname being queried in the DNS request, a target service associated with the DNS request; and
infer a dependency relationship between the source service and target service.
3 . The system of claim 2 , wherein the program code is further structured to cause the processor to:
display a graphical representation of the network topology comprising a first node representing the source service, a second node representing the target service, and an edge representing the dependency relationship that connects the first node to the second node.
4 . The system of claim 2 , wherein the target service is a network resource external to the computing cluster.
5 . The system of claim 1 , wherein the network policy comprises at least one of:
a policy that restricts a network access that is inconsistent with the dependency information; or
a firewall rule that allows network traffic to a network resource that is external to the computing cluster.
6 . The system of claim 1 , wherein the computing cluster comprises at least one of:
a container cluster;
a Kubernetes cluster; or
a Docker cluster.
7 . A method comprising:
accessing a domain name system (DNS) request in an audit log associated with a computing cluster;
determining, based on the DNS request, network connection and dependency information of the computing cluster;
generating, based on the network connection and dependency information, a network topology of the computing cluster; and
generating, based on the network topology, a network policy.
8 . The method of claim 7 , wherein said determining, based on the DNS request, network connection and dependency information of a computing cluster comprises:
determining a source service associated with the DNS request;
determining, based on a hostname queried in the DNS request, a target service associated with the DNS request; and
inferring a dependency relationship between the source service and target service.
9 . The method of claim 8 , further comprising:
displaying a graphical representation of the network topology comprising a first node representing the source service, a second node representing the target service, and an edge representing the dependency relationship that connects the first node to the second node.
10 . The method of claim 8 , wherein the target service is a network resource external to the computing cluster.
11 . The method of claim 7 , wherein the network policy comprises at least one of:
a policy that restricts a network access that is inconsistent with the dependency information; or
a firewall rule that allows network traffic to a network resource that is external to the computing cluster.
12 . The method of claim 7 , wherein the computing cluster comprises at least one of:
a container cluster;
a Kubernetes cluster; or
a Docker cluster.
13 . A computer-readable storage medium comprising executable instructions that, when executed by a processor, cause the processor to:
determine, based on a domain name system (DNS) request associated with a computing cluster, network connection and dependency information of the computing cluster;
generate, based on the network connection and dependency information, a network topology of the computing cluster; and
generate, based on the network topology, a network policy, the network policy comprising at least one of: a policy that restricts a network access that is inconsistent with the dependency information, or a firewall rule that allows network traffic to a network resource that is external to the computing cluster.
14 . The computer-readable storage medium of claim 13 , wherein, to determine, based on the DNS request, network connection and dependency information of the computing cluster, the executable instructions, when executed by the processor, cause the processor to:
determine a source service associated with the DNS request;
determine, based on a hostname being queried in the DNS request, a target service associated with the DNS request; and
infer a dependency relationship between the source service and target service.
15 . The computer-readable storage medium of claim 13 , wherein the executable instructions, when executed by the processor, cause the processor to:
display a graphical representation of the network topology comprising a first node representing the source service, a second node representing the target service, and an edge representing the dependency relationship that connects the first node to the second node.
16 . The computer-readable storage medium of claim 13 , wherein the target service is a network resource external to the computing cluster.
17 . The computer-readable storage medium of claim 13 , wherein, to determine, based on the DNS request, network connection and dependency information of the computing cluster the executable instructions, when executed by the processor, cause the processor to perform at least one of:
access the DNS request in an audit log associated with the computing cluster; or
detect, from network traffic associated with the computing cluster, the DNS request.
18 . The system of claim 1 , wherein the network topology comprises at least one of:
a directed graph; or
a dependency graph.
19 . The method of claim 7 , wherein the network topology comprises at least one of:
a directed graph; or
a dependency graph.
20 . The computer-readable storage medium of claim 13 , wherein the computing cluster comprises at least one of:
a container cluster;
a Kubernetes cluster; or
a Docker cluster.