TWI773200B - Provision and management system and method for container infrastructure service and computer readable medium - Google Patents

Abstract

The present invention is a provision and management system and method for container infrastructure service and thereof, which performs the following steps: providing storage space and deploying the network according to parameters of service nodes to construct a shared environment required by a container service platform; and constructing master-slave computing nodes and firewalls and configuring the parameters of the cluster stored in the shared environment in the master-slave computing node, filtering out the only master computing node from the master-slave computing node by using a locking mechanism and a first-in-first-out algorithm and enabling the network between the storage space and the master-slave computing nodes. The goal of accelerating the installation service in the present invention can be achieved by judging the dependencies between various resources. The present invention further provides a computer-readable medium for performing a provision and management method for container infrastructure service.

Description

Container service infrastructure provisioning management system, method, and computer-readable medium

The present invention relates to the technology of container service infrastructure, and more particularly, to a container service infrastructure provisioning management system, method and computer-readable medium.

With the rise of the concept of cloud native (Cloud Native), the concept of containers, software development (DevOps, which is the combination of Development and Operations), microservices and other technologies have risen, making it easier to integrate and deploy new versions of service applications, and In the stages of building, testing, running applications, etc., there is no need to spend huge additional burdens, the cost of cloudification is reduced, coupled with the portability of containers, it is more flexible to expand and extend application services, attracting more enterprise service applications to invest in containers In the environment of technology, let enterprises start to move traditional applications to the cloud for planning and execution, so as to achieve the purpose of cloudification of service applications.

However, even though the service application technology for integrating and deploying new versions has been developed to a considerable extent, how to reduce procedures, improve supply and installation efficiency, and reduce resources and maintenance costs is still very important. In addition, the network security of the service platform is also valued by service users, which will be the goal of enterprise service providers committed to R&D and improvement.

In view of this, how to provide a container service infrastructure technology, which can be built more simply and quickly in the integration and deployment of new versions of service application technology, and can meet the requirements of low cost, high efficiency and security. It will become the goal that those skilled in the art are striving to pursue.

In order to solve the above-mentioned problems of the prior art, the present invention proposes a new technology and method for the supply and installation management mechanism of container service infrastructure for container service infrastructure, and provides enterprises and individuals with a simple and rapid solution for building container service platform infrastructure , through the above purpose to improve the efficiency of resource utilization and supply and installation, reduce the cost of resources and maintenance operations, and strengthen the network security of the entire service platform.

The invention provides a container service infrastructure supply and installation management system, which includes: a service template collaborative management module, which is used to organize serial computing resources, storage resources, network resources, network address translation resources, firewall resources, and routing resources. , to coordinate with its state to adjust to be able to complete the provisioning infrastructure; the computing resource management module, which is connected to the service template collaborative management module, is used to set the storage resource path, network configuration, and virtual machine template , and parallel processing and deployment of multiple computing nodes to determine a unique master computing node; and a network resource management module, which is linked to the service template collaborative management module for determining and deploying the master virtual address and logical isolation gateway Network address translation (NAT) of addresses, deployment of the multiple computing nodes, configuration of servers and storage clusters for internal-external and external-to-internal firewall rule establishment, and deployment of the logical isolation network external network routing table to connect the configuration server, wherein based on the service node parameters, the storage space and the deployment network are provided, so as to construct a shared environment required by the container service platform, and configure the storage cluster in the shared environment among the plurality of computing nodes parameters to complete the provisioning and management of the infrastructure of the container service platform.

In one embodiment, the container service infrastructure provisioning management system further includes a storage resource management module connected to the service template collaborative management module, for managing and configuring the storage space.

In one embodiment, the container service infrastructure provisioning management system further includes a resource distribution management module connected to the service template collaborative management module, for allocating the network resource, the storage resource and the computing resource.

In one embodiment, the network resource management module further includes dividing the network into a management network segment and a service network segment, so that the container service platform is established on the logically isolated network of the service network segment.

The present invention further proposes a container service infrastructure provisioning management method, which includes: providing a storage space and deploying a network according to service node parameters, so as to construct a shared environment required by the container service platform; and constructing a master-slave computing node and a firewall, And configure the parameters of the storage cluster in the shared environment in the master-slave computing node, and then install the master-slave computing node in parallel, adopt a locking mechanism and a first-in-first-out algorithm on the master-slave computing node to filter out a unique master computing node The node and parallel open the network between the storage space and the master-slave computing node.

In the above method, the step of constructing the shared environment required by the container service platform includes dividing the network into a management network segment and a service network segment, so that the container service platform is established on the logically isolated network of the service network segment. .

In the above method, the step of constructing a master-slave computing node includes obtaining a pre-established virtual machine template from a database, and combining the service node parameters input by the user and the virtual machine template to generate the master-slave computing node. multiple sets of service nodes.

In the above method, the step of constructing the firewall further includes obtaining the network address of the configuration server management configuration source and the unique master virtual network address of the network resource distribution in the database, and obtaining the The network address translation server generates a port number corresponding to the configuration server service during resource deployment, so as to establish firewall rules to penetrate the network.

In the aforementioned method, according to the dependencies of the computing nodes, the master and slave computing nodes combine different firewall rules to establish a first firewall rule for the only master computing node to connect to the configuration server and the master-slave computing node to connect. The second firewall rule for the storage space.

The present invention further provides a computer-readable medium, which is applied to a computing device or a computer and stores instructions for executing the above-mentioned container service infrastructure provisioning management method.

To sum up, the present invention proposes a container service infrastructure supply and installation management mechanism, which is a simple and fast construction of container service platform infrastructure, one-click supply and installation according to the resource demand parameters input by the user, combined with the foundation of the container service platform Facility service supply and installation template, according to the regional configuration supply and installation resources, the tree structure of the tree diagram of the container service infrastructure supply and installation management mechanism is used to dynamically generate service supply and installation nodes, among which the root node (root) is mainly used to extract The shared environment required by the container service platform, unified deployment of the network architecture and storage space of the container service infrastructure supply and installation management mechanism, reduce the consumption required for supply and installation, and dynamically generate multiple tree-like child nodes (child) according to resource requirements, parallel Supply and install master-slave computing nodes and firewalls to achieve the goal of accelerating supply and installation services.

1: Container service infrastructure supply management system

11: Service Template Collaborative Management Module

12: Computing resource management module

13: Network resource management module

14: Storage resource management module

15: Resource distribution management module

2: Supply and installation process management database

501-505: Process

601-611: Process

S41-S42: Steps

FIG. 1 is a schematic structural diagram of a container service infrastructure provisioning management system of the present invention.

FIG. 2 is a tree diagram of the provisioning management mechanism for building a container service infrastructure according to the present invention.

FIG. 3 is a network architecture diagram of the container service infrastructure provisioning management mechanism of the present invention.

FIG. 4 is a step diagram of a container service infrastructure provisioning management method according to the present invention.

FIG. 5 is a necessary flow chart of each module in the construction of the container service infrastructure provisioning management mechanism of the present invention.

FIG. 6 is a flow chart of a specific embodiment of the provisioning management mechanism for constructing a container service infrastructure according to the present invention.

The following describes the technical content of the present invention through specific embodiments, and those skilled in the art can easily understand the advantages and effects of the present invention from the content disclosed in this specification. However, the present invention can also be implemented or applied by other different specific embodiments.

FIG. 1 is a schematic structural diagram of a container service infrastructure provisioning management system of the present invention. As shown in the figure, the present invention proposes a container service infrastructure supply and installation management system 1, which can implement the container service infrastructure supply and installation management mechanism. The collaborative management module 11 receives user requirements and starts supplying and installing, and in the process of supplying and installing the entire service platform, in order to reduce the complexity of resource integration among network resources, storage resources and computing resources, and in order to effectively reduce the operation and maintenance operation. Cost, the present invention judges the dependencies between various resources through the supply process, thereby ensuring the correctness of the container service infrastructure for supply, wherein the container service infrastructure supply management system 1 is connected to the supply process management for storing relevant data The database 2 , the container service infrastructure provisioning management system 1 includes a service profile collaborative management module 11 , a computing resource management module 12 and a network resource management module 13 .

The service template collaborative management module 11 is used to organize serial computing resources, storage resources, network resources, network address translation resources, firewall resources, and routing resources, so as to coordinate their state adjustment to be able to complete the provisioning infrastructure.

The computing resource management module 12 is connected to the service template cooperative management module 11 to set the path of the storage resource, the network configuration, the virtual machine template, and to process and deploy a plurality of computing nodes in parallel to determine the Determine the only primary computing node. In short, the computing resource management module 12 provides for deploying computing nodes from a virtual machine (VM) template and determining a unique master computing node, setting clusters, storage resource paths, network configuration, and configuring a unique master computing node for all computing nodes. Compute node network address (IP), set different role levels (for example: master (Master), work (Worker)).

The network resource management module 13 is connected to the service profile cooperative management module 11 to decide and decide to deploy the network address translation (NAT) of the main virtual address and the logically isolated network gateway address, and to deploy the multiple Internal-to-external and external-to-internal firewall rules are established for each computing node, configuration server and storage cluster, and the external network routing table of the logically isolated network is deployed to communicate with the configuration server.

The network resource management module 13 further includes dividing the network into a management network segment and a service network segment, so that the container service platform is established on the logically isolated network of the service network segment. Specifically, for information security considerations, the network architecture is divided into management network segments and service network segments, and the container service platform is built on a logically isolated network of service network segments. Therefore, network penetration needs to be constructed when deploying the platform.

The present invention provides storage space and deployment network through service node parameters to construct a shared environment required by the container service platform, and configures the parameters of the storage cluster in the shared environment in the master-slave computing node to complete the container service platform. Infrastructure provisioning and management.

In one embodiment, the container service infrastructure provisioning management system 1 further includes a storage resource management module 14 connected to the service profile collaborative management module 11 for managing and configuring the storage space. Specifically, the storage resource management module 14 can be used to manage and configure storage space and record space information.

In another embodiment, the container service infrastructure provisioning management system 1 further includes a resource distribution management module 15 connected to the service template collaborative management module 11 for allocating the network resource, the storage resource and the resource distribution management module 15. the computing resource. Specifically, the resource allocation management module 15 can be used to allocate network resources, storage resources and computing resources, and to handle related resource setting issues.

In addition, the novel container service infrastructure supply and installation management mechanism of the present invention involves three types of resources, including network resources, storage resources, and computing resources. In one embodiment, the network resource may be, for example, an interface IP address, a gateway IP address, a virtual local area network (VLAN), or a network function virtualization (NFV) network. resources such as road interfaces, firewalls or routing tables; the storage resources may be resources such as storage clusters; the computing resources may be resources such as virtual devices.

To sum up, the present invention designs a configuration system and method for a new container service infrastructure supply management mechanism for cloud services, providing network operators with low-complexity, high-security container service platform network services, and satisfying The elastic configuration of the cloud environment solves the maintenance and operation and the migration of heterogeneous cloud platforms, so as to reduce the trouble of migrating service applications to the cloud.

FIG. 2 is a tree diagram of a container service infrastructure provisioning management mechanism of the present invention, and FIG. 3 is a network architecture diagram of the container service infrastructure provisioning management mechanism of the present invention. As shown in FIG. 2 , the architecture diagram generated by the container service infrastructure supply and installation management mechanism of the service template collaborative management module 11 of FIG. 1 of the present invention is a tree diagram for performing two-stage infrastructure combination supply and installation, wherein, The root node (root) in the first stage is mainly used to install storage space and deploy the network to build the shared environment required by the container service platform, while the child node (child) in the second stage can build master-slave The computing nodes and firewalls are configured with the shared environment generated in the first stage. Through parallel provisioning computing nodes, the master-slave computing node is locked using a lock mechanism, and the first-in-first-out algorithm is used to filter out the only master node, parallel open storage space and between computing nodes The second stage is the deployment of the master computing node and its firewall, and the deployment of the worker computing node and its firewall.

In order to consider information security, the container service infrastructure provisioning management mechanism of the present invention proposes a logical isolation mechanism for security on the network architecture. As shown in Figure 3, the network is divided into management network segments and service network segments, and The container service platform is built on a logically isolated network of service network segments. In short, the provisioning server and the configuration server are set in the management network segment, which is separated from the service network segment of the client, and multiple computing nodes in the service network segment are located in a logically isolated The cluster is in another logically isolated network, because multiple computing nodes are structured on the logically isolated network, so when the client has information security problems, it can avoid affecting the server on the installation side. In addition, when deploying the platform, network penetration is required, through deployment management routing rules, firewall rules, Network Address Translation (NAT), and the use of port forwarding (Port Forwarding) and configuration servers to build management Configure the necessary secure connections.

FIG. 4 is a step diagram of a container service infrastructure provisioning management method according to the present invention. In step S41, a storage space and a deployment network are provided according to the service node parameters, so as to construct a shared environment required by the container service platform. This step is mainly about the provision of storage space and deployment network, so as to establish the shared environment required by the container service platform.

When constructing the shared environment required for the container service platform, the network is divided into a management network segment and a service network segment, so that the container service platform is built on the logically isolated network of the service network segment, that is, the computing node is constructed on the Logically isolate the network to prevent the server from being affected when the client has information security issues.

In step S42, a master-slave computing node and a firewall are constructed, and the parameters of the storage cluster in the shared environment are configured in the master-slave computing node. The computing node adopts a locking mechanism and a first-in-first-out algorithm to filter out the only master computing node and open the network between the storage space and the master-slave computing node in parallel. In this step, a master-slave computing node and a firewall are constructed, and a piece of storage space is cut out from the shared environment, and the computing node is mounted, that is, the parameters of the storage cluster in the shared environment are configured in the computing node, so that the computing node can succeed. The storage space cut out from the storage cluster connected to the shared environment, and further according to the dependencies between the nodes, the corresponding network connection relationship is generated.

When the firewall is constructed above, the network address of the configuration server management configuration source and the unique main virtual network address of network resource distribution are obtained from the database, and the network address translation server is obtained when the resource is deployed. The port number corresponding to the configuration server service is used to establish firewall rules to penetrate the network. In addition, according to the dependencies of the computing nodes, the master-slave computing node can combine different firewall rules to establish a firewall rule for the only master computing node to connect to the configuration server and the master-slave computing node to connect the storage space. rule.

FIG. 5 is a necessary flow chart of each module in the construction of the container service infrastructure supply management mechanism of the present invention, please refer to FIG. 1 for description. FIG. 5 illustrates the necessary resource management and control process that must be provided in the container service infrastructure supply and installation management system of FIG. 1 , which includes five steps: the necessary process 501 for constructing the service template collaborative management module, and the necessary process 502 for constructing the resource distribution management module. , the necessary flow 503 for constructing the storage resource management module, the necessary flow 504 for constructing the network resource management module, and the necessary flow 505 for constructing the computing resource management module.

The necessary process 501 for constructing the service template collaborative management module is a pre-operation for the service template collaborative management module 11 of the container service infrastructure provisioning management system 1 to be able to run successfully. In addition, service node parameters, service template specifications, service templates, and service node tree data structure levels must be set in the database. Layer, supply and installation application demand interface, process status of service nodes (such as lease application, change, lease cancellation), supply and installation process, etc. drive the configuration necessary for the overall system to collaboratively manage supply and installation.

The necessary process 502 for constructing the resource distribution management module is a pre-operation for the resource distribution management module 15 of the container service infrastructure provisioning management system 1 to run successfully. In addition, three types of resources to be monitored must be set in the database for viewing actions, such as network resources, storage resources, computing resources and other resources. Furthermore, after the resource monitoring items are set, the system sets the supply resource status required by the container service infrastructure supply management system 1 in the database according to the supply resource status, including application, transaction and removal. In addition, the container service infrastructure provisioning management system 1 needs to establish a plurality of resource selection rules to perform resource item selection actions.

The necessary process 503 for constructing the storage resource management module is a pre-operation for the storage resource management module 14 of the container service infrastructure provisioning management system 1 to run successfully. In addition, multiple sets of required monitoring storage resource information, such as storage cluster information, must be set in the database. The information content is the information necessary to operate the actual storage resource, including IP, account, password, etc.

The necessary process 504 for constructing the network resource management module is a pre-operation for the network resource management module 13 of the container service infrastructure provisioning management system 1 to run successfully. In addition, the required monitoring network resource information, such as network security equipment information, must be set in the database.

The necessary process 505 for constructing the computing resource management module is a pre-operation for the computing resource management module 12 of the container service infrastructure provisioning management system 1 to run successfully. In addition, necessary virtual machine templates must be created in advance, and related information must be managed in the database.

It should be noted that the above-mentioned processes have no absolute order, that is, the processes 501-505 may be executed out of order.

FIG. 6 is a flow chart of a specific embodiment of the provisioning management mechanism for constructing a container service infrastructure according to the present invention. As shown in the figure, the decision-making resource supply and installation management can include two stages. The first stage includes processes 601-606, and the second stage includes processes 607-611. Please refer to FIG. 1 for description.

In process 601, the service profile cooperates to configure storage, network, network address translation (NAT), firewall, and routing resources. In short, the service profile collaborative management module 11 receives user service instructions, integrates the instruction parameters of resources such as storage, network, NAT, firewall, and routing with the parameters in the service profile to form service node parameters, and according to the service The node parameters are assembled into the parameters required by the interface, and the provisioning application programming interface is called to perform the processes 602-606.

In process 602, a decision is made to distribute the management resource item. In short, the resource distribution management module 15 receives the service node parameters, checks the network resources and storage resources required for monitoring settings in the database according to the parameter requirements, distributes the required supply and installation resources, and updates the resource status.

In process 603, it is determined to deploy the storage resource item. In short, the storage resource management module 14 receives the service node parameters, sends a storage space request to the storage cluster, and returns storage space information, such as mounting path, storage space configuration file, login account password and other information.

In process 604, it is decided to deploy the NAT resource item. In short, the network resource management module 13 receives the service node parameters, obtains the main virtual address and the gateway address of the logically isolated network resource in the database, and randomly obtains the unoccupied and configured servers from the physical resource layer. Multiple groups of port numbers corresponding to the service, complete the internal main virtual address and port number translation corresponding to the gateway address and port number network address translation setting.

In process 605, it is determined to deploy the configuration server firewall resource item. The network resource management module 13 obtains the configuration server management configuration source network address (IP) and the unique primary virtual IP distributed by the network resource from the database, and generates a corresponding configuration server service when the NAT resource is deployed. port number, create Multiple sets of firewall rules penetrate the network, set the external interface to correspond to the internal interface, and connect internal resources through port forwarding.

In process 606, it is determined to deploy the routing resource item. The network resource management module 13 obtains the external IP of the configuration server and the external IP of the storage cluster from the database, and obtains the gateway address and the gateway interface from the logically isolated network resource, so as to establish an external network routing table.

The above completes the physical resource layer configuration and installation of the first stage, and then returns to the process 601, and enters the second stage according to the instructions.

In the process 607, the service profile cooperates to configure computing and firewall resources. That is, the service profile collaborative management module 11 generates multiple groups of service nodes to process and supply resources in parallel.

In process 608, a decision is made to allocate the computing resource item. The resource distribution management module 15 sets the network resources and computing resources required for monitoring in the database, obtains the resources for installation and updates the status settings according to the pre-built network resource selection rules.

In process 609, it is determined to deploy the computing resource item. The computing resource management module 12 obtains pre-established VM template information from the database, deploys computing nodes from the virtual machine template, and determines and determines the only main computing node, sets clusters, storage resource paths, network configuration, Configure the unique master computing node IP for all computing nodes, and set different master-slave role levels.

In process 610, it is decided to deploy the computing node firewall project. The network resource management module 13 depends on the computing nodes, and combines different firewall rules corresponding to the master and slave computing nodes, establishes a firewall rule for the only master node to connect to the configuration server, and/or establishes a firewall rule for the master and slave nodes to connect to the storage space.

In process 611, the server configuration management settings are configured. This process is to configure the server host to connect the deployed storage resources and computing resources through the network structure established in the processes 604, 605, 606, and 610, complete the configuration and configuration of the container service infrastructure, and report back to the client interface.

The above is to complete the physical resource layer configuration and installation of the second stage. If the process 602-611 fails, it will enter manual processing, that is, the maintenance terminal will manually process the error information.

The technology of the present application is described below with a specific embodiment, and please refer to FIG. 6 for the description. After the user completes the parameter settings of the rental container service platform in the virtual network applied by the user and sends the order, the back end of the system will enter the installation procedure.

In the process 601, a request for renting a container service is received, a first-stage service template is established according to common resource storage cluster space, resource decision distribution and unified NAT, firewall and routing resources, and storage space is configured in the first-phase service template. size and virtual network parameters. In the process 602, the system determines the configuration of the allocation resource area, resource service area, virtual firewall specification, main service virtual IP, virtual network external interface, etc. according to the resource parameters configured in the first service template. In the process 603, the required resource space is cut out from the common storage cluster space resource pool that has been built in the independent virtual network, and the storage space information that needs to be used for subsequent mounting of the computing node is recorded in the database. In the process 604, a network forwarding is established in the user virtual network to connect the configuration server and the main service IP. In the process 605, several port numbers of the firewall are opened in the user virtual network to communicate with the configuration server and the main service IP. In the process 606, a route to the storage cluster space and the configuration server is established in the user virtual network, and all services of the first service template are established here.

In the process 607, the service is activated on the computing node and the firewall of the independent resource, the second-stage service template is established, the parameters brought down by the order, the storage space size, the number of computing nodes and the virtual network parameters are configured in the second-phase service template, The second stage of installation is mainly based on computing nodes. The system generates several service templates according to the number of master and slave computing nodes (mainly divided into two types of templates, namely control computing node templates and work computing node templates), and the service templates are installed in parallel. . In the process 608, each generated service profile decides to distribute resource areas, resource service areas, virtual firewall specifications, and virtual network pairs respectively. External interface and other resource configuration. In the process 609, since it is necessary to first determine the main operation node in the control operation node, the working node also needs to wait for the main operation node to appear. After the main computing node appears, all control computing nodes and working computing nodes will continue to complete the installation, and mount the storage cluster space cut out in the first stage. In the process 610, each service profile establishes its own computing node's firewall to open, and completes the network connection between the configuration server and the computing node in the user's virtual network. In the process 611, the configuration server completes the construction of the entire container service.

Each module of the container service infrastructure supply management system of the present invention can run in a computer device or server including a microprocessor and a memory. The algorithm, data, programs, etc. are stored in the memory or chip. The device can load data or algorithms or programs from the memory or chip to perform data analysis or calculation processing, which will not be repeated here.

In addition, the present invention also discloses a computer-readable medium, which is applied to a computing device or computer having a processor (such as a CPU, GPU, etc.) and/or memory, stores instructions, and can utilize the computing device or computer The computer-readable medium is executed by a processor and/or a memory, so as to execute the above-mentioned methods and steps when the computer-readable medium is executed.

In summary, the container service infrastructure provisioning management system, method and computer-readable medium of the present invention relate to the container service infrastructure provisioning management mechanism, using a tree diagram for constructing the container service infrastructure provisioning management mechanism A tree-like structure provides a two-stage infrastructure combination and completes the container service platform. The first stage root node (root) can be used to install storage space and deploy the network to build the shared environment required by the container service platform. Consideration of information security , the present invention divides the network architecture into management network segments and service network segments, the container service platform is built on the logically isolated network of the service network segment, and penetrates the network by deploying network resources. Tree-like child nodes (child) construct master-slave operation nodes The shared environment generated in the first stage is configured with the firewall, and the master-slave node is locked through a parallel supply of computing nodes, and the first-in-first-out algorithm is used to filter out the only master node, parallel open storage space and network between computing nodes. Road, build a container service supply platform, improve the supply speed and quality, can adjust the platform computing and capacity specifications, provide scalability, reduce the cost and complexity of construction and management, and increase availability.

The above-mentioned embodiments are only illustrative, and are not intended to limit the present invention. Any person skilled in the art can modify and change the above embodiments without departing from the spirit and scope of the present invention. Therefore, the scope of the right protection of the present invention is defined by the scope of the patent application attached to the present invention, as long as the effect and implementation purpose of the present invention are not affected, it shall be included in the technical content disclosed herein.

1: Container service infrastructure supply management system

11: Service Template Collaborative Management Module

12: Computing resource management module

13: Network resource management module

14: Storage resource management module

15: Resource distribution management module

2: Supply and installation process management database

Claims (8)

A container service infrastructure supply and installation management system includes: a service template collaborative management module, which is used to organize serial computing resources, storage resources, network resources, network address translation resources, firewall resources, and routing resources to collaborate Its state is adjusted to be able to be used to complete the provisioning infrastructure; the computing resource management module is connected to the service template collaborative management module to set the storage resource path, network configuration, virtual machine template, and parallel Process and deploy a plurality of computing nodes to determine a unique main computing node; and a network resource management module, which is linked to the service template collaborative management module, used to determine the deployment of the main virtual address and the logically isolated network gateway address network address translation, deployment of the multiple computing nodes, configuration server and storage cluster internal-external and external-to-internal firewall rule establishment, and deployment of the logically isolated network external network routing table to connect the configuration server , wherein the storage space and deployment network are provided based on the service node parameters, thereby constructing a shared environment required by the container service platform, and the parameters of the storage cluster in the shared environment are configured in the plurality of computing nodes to complete the container service. Provisioning and management of platform infrastructure. The container service infrastructure provisioning management system of claim 1 further includes a storage resource management module linked to the service template collaborative management module, which is used to manage and configure the storage space. The container service infrastructure provisioning management system of claim 1 further includes a resource distribution management module linked to the service template collaborative management module for allocating the network resource, the storage resource and the computing resource. The container service infrastructure provisioning management system of claim 1, wherein the network resource management module further includes dividing the network into a management network segment and a service network segment, so as to make the container service level The station is established on the logically isolated network of the service network segment. A container service infrastructure provisioning management method, comprising: provisioning storage space and deploying a network according to service node parameters to construct a shared environment required by a container service platform; and constructing a master-slave computing node and a firewall, Configure the parameters of the storage cluster in the shared environment from the computing node, and then install the master-slave computing node in parallel, adopt a locking mechanism and a first-in-first-out algorithm for the master-slave computing node to filter out the only master computing node and parallel open The network between the storage space and the master-slave computing node, wherein the construction of the firewall includes obtaining the network address of the configuration server management configuration source and the unique master virtual network address of the network resource distribution from the database, and obtain the port number corresponding to the configuration server service generated by the network address translation server during resource deployment, so as to establish firewall rules to penetrate the network, and then combine the master and slave computing nodes according to the dependencies of the computing nodes. Different firewall rules are used to establish a first firewall rule for connecting the unique master computing node to the configuration server and a second firewall rule for connecting the master-slave computing node to the storage space. The container service infrastructure provisioning management method of claim 5, wherein the step of constructing the shared environment required by the container service platform comprises dividing the network into a management network segment and a service network segment, so that the container service platform can Established on the logically isolated network of the service network segment. According to the container service infrastructure provisioning management method of claim 5, the step of constructing a master-slave computing node includes obtaining a pre-established virtual machine template from a database, and combining the service node parameters and the virtual machine template to generate an Multiple groups of service nodes of the master-slave computing node. A computer-readable medium, applied in a computing device or a computer, stores instructions for executing the container service infrastructure provisioning management method as described in any one of claims 5 to 7.

Images