Granted Patent B2

US 12,684,017 · App. 17/487,524 · Granted Jul 14, 2026

Inventors: Chiradeep Vittal (Santa Clara, CA); Sharvari Mithyantha (Bangalore, IN); Apoorva Kamath (Bangalore, IN); Bharathi M (Bangalore, IN)

H04L63/20G06F9/45558H04L63/0227G06F2009/45591G06F2009/45595

Abstract

Claims (80)

1 . A computing device comprising:

one or more processors; and

memory storing instructions that, when executed by the one or more processors, cause the computing device to:

receive a template object file comprising:

a format for both of:

a Kubernetes Ingress object,

a Kubernetes Custom Resource Definition (CRD); and

a template identifier;

receive an indication of a network security policy;

identify a Kubernetes service object that comprises the template identifier; generate,

based on the template object file and based on the network security policy, a new Kubernetes object wherein:

the template object file defines structural parameters and placeholders to be populated;

the network security policy defines dynamic rules for access control and traffic filtering; and

the new Kubernetes object comprises:

a new Kubernetes Ingress object for the Kubernetes service object, and

a new CRD for the Kubernetes service object; and

store the newly generated Kubernetes object in a Kubernetes-accessible data store for deployment;

wherein the newly generated CRD comprises one or more programmatically-inserted Internet Protocol (IP) addresses indicated by the network security policy, and wherein the Kubernetes service object is configured with an IP blocklist to prevent communications, from the one or more IP addresses to the Kubernetes service object.

2 . The computing device of claim 1 , wherein the new Kubernetes Ingress object is configured to manage, based on the network security policy, input to the Kubernetes service object.

3 . The computing device of claim 1 , wherein the instructions, when executed by the one or more processors, cause the computing device to retrieve the indication of the network security policy based on detecting a change to the network security policy, and wherein the instructions, when executed by the one or more processors, cause the computing device to generate the new Kubernetes object based on detecting the change to the network security policy.

4 . The computing device of claim 1 , wherein the instructions, when executed by the one or more processors, further cause the computing device to:

detect a change to the template object file;

generate, based on the change to the template object file, a second new Kubernetes object; and

replace the new Kubernetes object with a second new Kubernetes object.

5 . The computing device of claim 1 , wherein the instructions, when executed by the one or more processors, further cause the computing device to:

responsive to detecting a deletion of the Kubernetes service object, delete one or more of:

the new Kubernetes Ingress object, or

the new CRD.

6 . The computing device of claim 1 , wherein the network security policy specifies a blocklist, and wherein the newly generated Kubernetes object is configured to filter traffic associated with the blocklist.

7 . A method comprising:

receiving, by a computing device, a template object file comprising:

a format for both of:

a Kubernetes Ingress object,

a Kubernetes Custom Resource Definition (CRD); and

a template identifier;

receiving, by the computing device, an indication of a network security policy; identifying, by the computing device, a Kubernetes service object that comprises the template identifier;

generating, by the computing device, based on the template object file, and based on the network security policy, a new Kubernetes object wherein:

the template object file defines structural parameters and placeholders to be populated;

the network security policy defines dynamic rules for access control and traffic filtering; and

the new Kubernetes object comprises:

a new Kubernetes Ingress object for the Kubernetes service object, and

a new CRD for the Kubernetes service object; and

storing, by the computing device, the newly generated Kubernetes object in a Kubernetes-accessible data store for deployment;

wherein the newly generated CRD comprises one or more programmatically-inserted Internet Protocol (IP) addresses indicated by the network security policy, and wherein the Kubernetes service object is configured with an IP blocklist to prevent communications, from the one or more IP addresses to the Kubernetes service object.

8 . The method of claim 7 , wherein the new Kubernetes Ingress object is configured to manage, based on the network security policy, input to the Kubernetes service object.

9 . The method of claim 7 , wherein retrieving the indication of the network security policy is based on detecting a change to the network security policy, and wherein generating the new Kubernetes object is based on detecting the change to the network security policy.

10 . The method of claim 7 , further comprising:

detecting a change to the template object file;

generating, based on the change to the template object file, a second new Kubernetes object; and

replacing the new Kubernetes object with a second new Kubernetes object.

11 . The method of claim 7 , further comprising:

responsive to detecting a deletion of the Kubernetes service object, delete one or more of:

the new Kubernetes Ingress object, or

the new CRD.

12 . The method of claim 7 , wherein the network security policy specifies a blocklist, and wherein the new Kubernetes object is configured to filter traffic associated with the blocklist.

13 . One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors of a computing device, cause the computing device to:

receive a template object file comprising:

a format for both of:

a Kubernetes Ingress object,

a Kubernetes Custom Resource Definition (CRD); and

a template identifier;

receive an indication of a network security policy;

identify a Kubernetes service object that comprises the template identifier;

generate, based on the template object file and based on the network security policy, a new Kubernetes object wherein:

the template object file defines structural parameters and placeholders to be populated;

the network security policy defines dynamic rules for access control and traffic filtering; and

the new Kubernetes object comprises:

a new Kubernetes Ingress object for the Kubernetes service object, and

a new CRD for the Kubernetes service object; and

store the newly generated Kubernetes object in a Kubernetes-accessible data store for deployment;

wherein the newly generated CRD comprises one or more programmatically-inserted Internet Protocol (IP) addresses indicated by the network security policy, and wherein the Kubernetes service object is configured with an IP blocklist to prevent communications, from the one or more IP addresses to the Kubernetes service object.

14 . The one or more non-transitory computer-readable media of claim 13 , wherein the new Kubernetes Ingress object is configured to manage, based on the network security policy, input to the Kubernetes service object.

15 . The one or more non-transitory computer-readable media of claim 13 , wherein the instructions, when executed by the one or more processors, cause the computing device to retrieve the indication of the network security policy based on detecting a change to the network security policy, and wherein the instructions, when executed by the one or more processors, cause the computing device to generate the new Kubernetes object based on detecting the change to the network security policy.

16 . The one or more non-transitory computer-readable media of claim 13 , wherein the instructions, when executed by the one or more processors, further cause the computing device to:

detect a change to the template object file;

generate, based on the change to the template object file, a second new Kubernetes object; and

replace the new Kubernetes object with a second new Kubernetes object.

17 . The one or more non-transitory computer-readable media of claim 13 , wherein the instructions, when executed by the one or more processors, further cause the computing device to:

responsive to detecting a deletion of the Kubernetes service object, delete one or more of:

the new Kubernetes Ingress object, or the new CRD.

Assignments (9)

Continuity (1)

References Cited (8)