WO2021042846A1

WO2021042846A1 - Network isolation policy management method and network isolation policy management system

Info

Publication number: WO2021042846A1
Application number: PCT/CN2020/099021
Authority: WO
Inventors: 杨帆; 张军
Original assignee: 南京中兴软件有限责任公司
Priority date: 2019-09-04
Filing date: 2020-06-29
Publication date: 2021-03-11
Also published as: CN112543108A; CN112543108B

Abstract

Provided in the present disclosure is a network isolation policy management method, comprising: in response to a pod creation request sent by a user terminal, binding a corresponding label and writing the creation location information of a first pod to be created to a virtual switch configuration library in order to create an associated network bridge on the virtual switch; sending a network port creation and policy issuing request to a software-defined network controller so that the software-defined network controller can create a virtual network port for the first pod in response to the network port creation and policy issuing quest and, when network isolation policy information matching the label of the first pod is stored therein, send the network isolation policy information to the virtual switch in which the first pod is located. Also provided in the embodiments of the present disclosure is a network isolation policy management system.

Description

Network isolation strategy management method and network isolation strategy management system

Technical field

The present disclosure relates to the technical field of virtual networks, and in particular to a network isolation strategy management method, a container cluster management system, a software-defined network controller, and a network isolation strategy management system.

Background technique

As an open source container cluster management system, Kubernetes can easily run, operate, and expand applications, and can easily manage containerized applications that run across hosts. However, the current capabilities of Kubernetes in container network management and isolation are not complete. An important feature of Kubernetes is to connect the pods of different virtual switch nodes, ignoring the limitations of physical nodes. However, in some application environments, such as public clouds, Pods of different tenants should not communicate with each other, and network isolation is required at this time. For this reason, how to manage the network isolation strategy has become a technical problem that needs to be solved urgently.

In view of the above-mentioned problems existing in related technologies, no effective solutions have been proposed at present.

Summary of the invention

The present disclosure aims to solve at least one of the technical problems existing in the prior art, and proposes a network isolation policy management method, a container cluster management system, a software-defined network controller, and a network isolation policy management system.

In the first aspect, embodiments of the present disclosure provide a network isolation policy management method, including: in response to a container warehouse creation request sent by a user terminal, binding a corresponding label, and combining the creation location information of the first container warehouse to be created Write the virtual switch configuration library to create an associated network bridge on the virtual switch; send a network port creation and policy issuance request to the software-defined network controller for the software-defined network controller to respond to the network Port creation and policy issuance request, create a virtual network port for the first container warehouse, and when the network isolation policy information that matches the label of the first container warehouse is stored, the network isolation policy information Sent to the virtual switch where the first container warehouse is located.

In a second aspect, embodiments of the present disclosure also provide a network isolation policy management method, including: in response to a network port creation and policy issuance request sent by a container cluster management system, creating a virtual network port for the first container warehouse, and The virtual network port is assigned an IP address, and the network port creation and policy issuance request includes: the warehouse name and label of the first container; and according to the label of the first container warehouse, it is inquired whether it has stored information related to the The network isolation policy information that matches the label of the first container warehouse; when the network isolation policy information that matches the label of the first container warehouse is queried, the queried network isolation policy is used through the IP address The information is sent to the virtual switch where the first container warehouse is located.

In a third aspect, the embodiments of the present disclosure also provide a container cluster management system, including: one or more first processors; a first storage device on which one or more programs are stored; when the one or more When a program is executed by the one or more first processors, the one or more first processors implement the method provided in the foregoing first aspect.

In a fourth aspect, embodiments of the present disclosure also provide a software-defined network controller, including: one or more second processors; a second storage device, on which one or more programs are stored; when the one or more When multiple programs are executed by the one or more second processors, the one or more first processors implement the method provided in the above second aspect.

In a fifth aspect, embodiments of the present disclosure also provide a network isolation policy management system, including: the container cluster management system as described above and the software-defined network controller as described above.

The embodiments of the present disclosure provide a network isolation policy management method, a container cluster management system, a software-defined network controller, and a network isolation policy management system, using the powerful network orchestration capabilities of the SDN controller, and combining network policies to support tag-level networks The characteristics of isolation strategy orchestration, so as to flexibly customize and manage the effective isolation of container networks in various application scenarios.

Description of the drawings

FIG. 1 is a flowchart of a network isolation policy management method provided by an embodiment of the disclosure;

2 is a flowchart of another network isolation policy management method provided by an embodiment of the disclosure;

FIG. 3 is a signaling diagram of the container cluster management system and the software-defined network controller in the embodiment of the disclosure to implement the network policy landing process,

4 is a flowchart of another network isolation policy management method provided by an embodiment of the disclosure;

FIG. 5 is a flowchart of yet another network isolation policy management method provided by an embodiment of the present disclosure;

6 is a signaling diagram of a container cluster management system and a software-defined network controller in an embodiment of the disclosure to implement a network policy storage process;

FIG. 7 is a flowchart of yet another network isolation policy management method provided by an embodiment of the present disclosure;

FIG. 8 is a flowchart of yet another network isolation policy management method provided by an embodiment of the present disclosure;

FIG. 9 is a signaling diagram of the container cluster management system and the software-defined network controller in the embodiment of the disclosure to implement the container warehouse deletion process;

FIG. 10 is a flowchart of yet another network isolation policy management method provided by an embodiment of the present disclosure;

FIG. 11 is a flowchart of yet another network isolation policy management method provided by an embodiment of the present disclosure;

FIG. 12 is a signaling diagram of the container cluster management system and the software-defined network controller in the embodiment of the disclosure to implement the process of deleting the network isolation strategy scheme.

detailed description

In order to enable those skilled in the art to better understand the technical solutions of the present disclosure, a network isolation policy management method and system provided by the present disclosure will be described in detail below with reference to the accompanying drawings.

Hereinafter, example embodiments will be described more fully with reference to the accompanying drawings, but the example embodiments may be embodied in different forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, the purpose of providing these embodiments is to make the present disclosure thorough and complete, and to enable those skilled in the art to fully understand the scope of the present disclosure.

The terms used herein are only used to describe specific embodiments and are not intended to limit the present disclosure. As used herein, the singular forms "a" and "the" are also intended to include the plural forms, unless the context clearly dictates otherwise. It will also be understood that when the terms "comprising" and/or "made of" are used in this specification, it specifies the presence of the described features, wholes, steps, operations, elements and/or components, but does not exclude the presence or Add one or more other features, wholes, steps, operations, elements, components, and/or groups thereof.

It will be understood that although the terms first, second, etc. may be used herein to describe various elements/instructions/requests, these elements/instructions/requests should not be limited by these terms. These terms are only used to distinguish one element/instruction/request from another element/instruction/request.

Unless otherwise defined, the meanings of all terms (including technical and scientific terms) used herein are the same as those commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having meanings consistent with their meanings in the context of the related technology and the present disclosure, and will not be interpreted as having idealized or excessive formal meanings, Unless this article specifically defines it as such.

The present disclosure provides a network isolation policy management method based on a container cluster management system and a software defined network (Software Defined Network, SDN) controller, wherein the container cluster management system preferably adopts Kubernetes.

The technical solution of the present disclosure utilizes the powerful network orchestration capability of the SDN controller, and combines the network policy (Network Policy) to support tag-level network isolation strategy orchestration, thereby flexibly customizing and managing effective isolation of container networks in various application scenarios .

Fig. 1 is a flowchart of a network isolation policy management method provided by an embodiment of the present disclosure. As shown in Fig. 1, the execution body of the method is a container cluster management system, and the method includes:

Step S1, in response to the container warehouse creation request sent by the client, bind the corresponding label, and write the creation location information of the first container warehouse to be created into the virtual switch configuration database for creating associated information on the virtual switch Bridge.

The client submits a container warehouse creation request to the container cluster management system, and the container cluster management system responds to the request by binding a corresponding label to the Pod to be created (called the first Pod), and attaching the label of the first Pod And the creation location information is sent to the external container warehouse creation system (with a virtual switch configuration library); after the container warehouse creation system receives the label, it creates a bridge on the selected virtual switch based on the label and creation location information, and Associate the first Pod, the first Pod can provide applications or services for tenants to use.

It should be noted that the specific process of the container warehouse creation system creating Pod according to the label belongs to the conventional technology in the field, and will not be described in detail here. At this time, the first Pod created has a pod name. The pod name may be manually designated by the client or automatically assigned by the container cluster management system.

Step S2: Send a network port creation and policy issuance request to the software-defined network controller.

After the container cluster management system issues a label to the container warehouse creation system, it will also send a network port creation and policy issuance request to the SDN controller, so that the SDN controller can respond to the network port creation and policy issuance request and become the first Pod Create a virtual network port and use it as a virtual network port, and when the SDN controller itself stores the network isolation policy information that matches the label of the first container warehouse, the SDN controller sends the queried network isolation policy information to the first Pod. Virtual switch.

Among them, the network port creation and policy issuance request includes the warehouse name and label of the first Pod, and of course, may also include related information such as the location information of the virtual switch where the first Pod is located.

Fig. 2 is a flowchart of another network isolation policy management method provided by an embodiment of the present disclosure. As shown in Fig. 1, the execution body of the method is an SDN controller, and the method includes:

Step S3: In response to the network port creation and policy issuance request sent by the container cluster management system, a virtual network port is created for the container warehouse and an IP address is assigned to the virtual network port.

The SDN controller, in response to the network port creation request sent by the container cluster management system, the SDN controller creates a virtual network port for the first Pod according to the warehouse name of the first Pod, and assigns an IP address to the virtual network port.

As an optional solution, after the SDN controller creates a virtual network port for the first Pod, when the virtual network port is online (connected to the network), the virtual switch where the first Pod is located will send an asynchronous message to the SDN controller. Inform the SDN controller that the virtual network port is online, and the asynchronous message contains the device number and port number of the virtual network port. After receiving the asynchronous information that the virtual network port is online, the SDN controller calls the open virtual switch database (Open vSwitch Database, OVSDB) background service of the virtual switch to query the device number and port number corresponding to the virtual network port. The identity identification number (a 32-bit string) is the identity identification number of the virtual network port, and then based on the identity identification number of the virtual network port, the IP address is converted and used as the IP address assigned to the virtual network port.

Step S4: According to the label of the first container warehouse, query whether there is network isolation policy information matching the label of the first container warehouse in its own policy storage module.

The SDN controller has a strategy storage module, which stores different network isolation strategy information and corresponding label selectors; among them, the network isolation strategy information records the network isolation strategy configured by the client; the label selector defines the application The label of the Pod corresponding to the network isolation policy information, that is, it is determined which Pod with the label will apply the corresponding network isolation policy.

The process and method for the policy storage module to store the network isolation policy information and its corresponding label selector will be described in detail in the subsequent content.

In step S4, the SDN controller inquires in the policy storage module according to the label of the first Pod whether there is network isolation policy information matching the label of the first Pod.

Specifically, the SDN controller matches the label of the first Pod with each label selector, and if the label of the first Pod is a label defined by at least one label selector, the policy storage module is queried for the existence of a label with the Pod. Match the network isolation policy information, and query the network isolation policy information that matches the label of the first Pod, and then perform step S5; if the label of the first Pod is not a label defined by any label selector, query There is no network isolation policy information matching the label of the first Pod in the policy storage module, that is, there is no network isolation policy that needs to be applied in the first Pod.

It should be noted that in step S4, the label of the Pod may match multiple label selectors (network isolation policy information), that is, the Pod needs to apply multiple network isolation policies.

Step S5: Send the queried network isolation policy information to the virtual switch where the first container warehouse is located through the IP address of the virtual network port of the first container warehouse.

The SDN controller sends the network isolation policy information queried in step S4 to the corresponding virtual switch through the IP address of the virtual network port of the first Pod, which completes the implementation of the network policy.

In some embodiments, the SDN controller maps the queried network isolation policy information to an access control list (Access Control List, ACL for short), and then uses the openflow protocol to stream all the access control lists mapped from the network isolation policy information The form of the table is sent to the corresponding virtual switch.

The technical solution of the present disclosure uses the container warehouse creation request as the trigger mechanism, and when the virtual network port of the created Pod is online, the network isolation strategy corresponding to the Pod can be sent to the corresponding virtual switch to realize the network strategy. Landing.

Figure 3 is a signaling diagram of the container cluster management system and the software-defined network controller in the embodiment of the disclosure to implement the network policy implementation process. As shown in Figure 3, the implementation process of the network policy implementation in the embodiment of the present disclosure includes the above steps S1~ Step S5, for the specific description of each step, please refer to the foregoing content, which will not be repeated here.

FIG. 4 is a flowchart of another network isolation policy management method provided by an embodiment of the disclosure. As shown in FIG. 4, the execution body of the method is a container cluster management system. The method not only includes the above steps S1 to S2, but also Including: step S6, only step S6 will be described in detail below.

Step S6: In response to the network isolation strategy scheme configuration request sent by the user terminal, forward the received network isolation strategy scheme to the software-defined network controller.

In the embodiment of the present disclosure, the container cluster management system is provided with a visual policy configuration interface through which the user terminal can complete the configuration of the network isolation strategy scheme and submit the corresponding network isolation strategy scheme to the container cluster management system. The container cluster management system will The received network isolation strategy scheme is forwarded to the SDN controller, so that the SDN controller stores the received network isolation strategy scheme in its own strategy storage module. Among them, the network isolation strategy scheme includes: network isolation strategy information and a label selector, and the tag selector defines the label of the container bin to which the network isolation strategy information is applied.

In some scenarios, the client can create a yaml file of a Kubernetes object of type Network Policy, and then send the yaml file to the container cluster management system.

As an example, the configuration content fragment of the yaml file is as follows:

In the above example, the content carried by the podSelector is used as the label selector, which defines that all inbound and outbound traffic of the Pod with the label label1 must follow the constraints of this network policy. The content carried by Ingress is used as network isolation policy information, which defines: all IP addresses belonging to the 172.17.0.0/16 network segment, except for the IP addresses in the 172.17.1.0/24 network segment, other IP addresses (as the source IP address) ) Can access the Pod labeled labels1 (the IP address of the virtual network card of the Pod labeled labels1 is used as the destination IP address).

In practical applications, when the container cluster management system receives the network isolation strategy scheme configured using the yaml file, the container cluster management system can first convert the yaml file, translate it into a file type that the SDN controller can recognize, and then complete The converted and translated network isolation strategy scheme is sent to the SDN controller through the restconf interface. It should be noted that in the process of converting and translating the yaml file, the network isolation strategy information remains unchanged.

The above-mentioned Network Policy has a standard policy model. Based on the policy model, the client can formulate the required network policy for the selected Pod. The process of using the Network Policy to configure a network policy belongs to a conventional technology in this field, and the specific configuration process is not described in detail here.

It should be noted that the technical solution of the present disclosure does not limit the execution order of step S6 and step S1 to step S2, that is, step S6 can be executed before step S1 to step S2, or can be executed after step S1 to step S2. It can be executed synchronously with step S1 to step S2. In FIG. 4, only the case where step S6 is executed after step S1 to step S2 is exemplified.

FIG. 5 is a flowchart of another network isolation policy management method provided by an embodiment of the disclosure. As shown in FIG. 5, the execution body of the method is the SDN controller. The method not only includes the above steps S3 to S5, but also includes : Step S7, only step S7 will be described in detail below.

Step S7: Receive the network isolation strategy scheme sent by the container cluster management system, and store the received network isolation strategy scheme in the strategy storage module.

In some embodiments, step S7 specifically includes: the SDN network controller creates a security container in the policy storage module, and encapsulates the network isolation policy information in the network isolation policy solution in the security container in the form of security group rules; and, Establish the corresponding relationship between the security container and the label selector in the network isolation strategy scheme.

In the present disclosure, the Network Policy can be mapped to the security group rule of the SDN controller to facilitate storage by the SDN controller. The security group rules of the Network Policy and the SDN controller have standard formats. The field mapping strategy for mapping the Network Policy to the security group rules of the SDN controller is shown in Table 1:

Table 1. Field mapping strategy of Network Policy and SDN Controller Security Group

After conversion based on the mapping policy, the network isolation policy information in the yaml file can be converted into the following two security group rules;

1) The source ip network segment is 172.17.0.0/16, the direction is ingress, and the action type is permit;

2) The source ip network segment is 172.17.1.0/24, the direction is ingress, and the action type is drop;

It should be noted that when the network isolation policy information stored in the SDN controller in the form of security group rules needs to be sent to the corresponding virtual switch through the aforementioned step S5, these group rules can be mapped to an access control list first, and then It is sent to the corresponding virtual switch through the openflow protocol in the form of a flow table.

As an example, the above two security group rules can be mapped to the following two access control lists:

1) dst_ip=ip1, src_ip=172.17.0.0/16, priority=100, actions=go_to_next_table;

2) dst_ip=ip1, src_ip=172.17.1.0/24, priority=130, actions=drop;

Among them, dst_ip represents the destination IP address, src_ip represents the source IP address, and ip represents the IP address of the network port of the Pod labeled label1.

In some embodiments, the network isolation policy information in the network isolation policy solution exists in the form of yaml file fragments of type Network Policy in the container cluster management system, and in the SDN controller as a security group encapsulated in a secure container Rules exist in the form of access control lists in the virtual switch.

It should be noted that the technical solution of the present disclosure does not limit the execution order of step S7 and step S3 to step S5, that is, step S7 can be executed before step S3 to step S5, or it can be located in step S3 to step S3. After S5 is executed, it can also be executed synchronously with step S3 to step S5. In FIG. 5, only the case where step S7 is executed after step S3 to step S5 is exemplified.

FIG. 6 is a signaling diagram of the container cluster management system and the software-defined network controller in the embodiment of the present disclosure to implement the network policy storage process. As shown in FIG. 6, the network policy storage process in the embodiment of the present disclosure includes the above steps S6~ Step S7, for the specific description of each step, please refer to the foregoing content, which will not be repeated here.

FIG. 7 is a flowchart of another network isolation policy management method provided by an embodiment of the present disclosure. As shown in FIG. 7, the execution body of the method is a container cluster management system. The method not only includes the above steps S1 to S2, but also Including: step S8 to step S9, only step S8 to step S9 will be described in detail below.

Step S8: In response to the container warehouse deletion request sent by the user terminal, forward the container warehouse deletion request to the container warehouse deletion system.

The client submits the container warehouse delete system to the container cluster management system, and the container cluster management system forwards the container warehouse delete request to the external container warehouse delete system, so that the container warehouse delete system deletes the related configuration data of the second Pod. Among them, the container warehouse delete request includes the warehouse name of the second Pod to be deleted.

Step S9: Determine the IP address of the virtual network port of the second container warehouse according to the warehouse name of the second container warehouse, and send a first delete control request to the software-defined network controller.

The container cluster management system queries its own database for the IP address of the virtual network port of the second Pod according to the warehouse name of the second Pod (after the SDN controller assigns the IP address of the virtual network port to the Pod, the Pod will assign it to To inform the container cluster management system of the IP address of the container cluster management system to facilitate the management of the container cluster management system), and send the first delete control request to the software-defined network controller, so that the software-defined network controller can respond to the first delete control request by itself When there is network isolation policy information corresponding to the IP address of the virtual network port of the second container warehouse in the pre-stored correspondence table, the policy delete instruction is sent to the virtual switch where the second container warehouse is located, so that the second container warehouse is located. The virtual switch deletes its stored network isolation policy information applied to the second container warehouse. Wherein, the first delete control request includes the IP address of the virtual network port of the second Pod.

It should be noted that the technical solution of the present disclosure does not limit the execution sequence of steps S8 to S9 and steps S1 to S2, that is, steps S8 to S9 can be executed before steps S1 to S2, or they can be executed in steps S1 to S1. It is executed after step S2, and it can also be executed synchronously with step S1 to step S2. FIG. 7 only exemplarily shows the case where step S8 to step S9 are executed after step S1 to step S2.

FIG. 8 is a flowchart of another network isolation policy management method provided by an embodiment of the disclosure. As shown in FIG. 8, the execution body of the method is the SDN controller. The method not only includes the above steps S3 to S5, but also includes : Step S5a and step S10 to step 12, only step S5a and step S10 to step S12 will be described in detail below.

Step S5a: Establish a correspondence between the IP address of the virtual network port of the first Pod and the queried network isolation policy information, and store the correspondence in a predefined correspondence table.

In step S4, when the SDN controller inquires that there is network isolation policy information matching the label of the container warehouse in its own policy storage module, step S5a may be performed while step S5 is performed.

The SDN controller establishes a corresponding relationship between the IP address allocated for the first Pod in step S3 and the network isolation policy information queried in step S4, and stores the corresponding relationship in a predefined corresponding relationship table.

It should be noted that when the network isolation policy information in the SDN controller is encapsulated in the security container in the form of security group rules, the establishment of the corresponding relationship between the IP address and the network isolation policy information is essentially to establish the IP address and the security container The corresponding relationship.

Step S10: In response to the first delete control request sent by the container cluster management system, query whether there is network isolation policy information corresponding to the IP address of the virtual network port of the second container warehouse in the correspondence table stored in advance.

After the SDN controller receives the first delete control request, it queries whether there is network isolation policy information corresponding to the IP address of the virtual network port of the second container warehouse in its pre-stored correspondence table. Among them, different IP addresses and their corresponding network isolation policy information are stored in the correspondence table, and the correspondence stored in the correspondence table can be generated by the above step S5a.

When the correspondence table is queried, there is network isolation policy information corresponding to the IP address of the virtual network port of the second Pod, it indicates that the virtual switch where the second pod is located stores the network isolation policy corresponding to the second pod. After that, step S11 and step S12 are executed; when the corresponding relationship table does not have the network isolation policy information corresponding to the IP address of the virtual network port of the second Pod, it indicates that the virtual switch where the second Pod is located does not store the network isolation policy information. The network isolation strategy corresponding to the second pod does not need to be deleted.

Step S11: Send a policy deletion instruction to the virtual switch where the second container warehouse is located according to the queried network isolation policy information.

The SDN controller sends a policy deletion instruction to the virtual switch where the second Pod is located according to the queried network isolation policy information, so that the virtual switch where the second Pod is located deletes the stored network isolation policy information applied to the second Pod.

It should be noted that when the SDN controller in the foregoing step S5 delivers the network isolation policy information to the corresponding virtual switch in the form of an access control list, the network isolation policy information in the virtual switch is performed in the form of an access control list. storage. At this time, before the SDN controller sends the policy delete instruction to the virtual switch where the second Pod is located, it needs to map the queried network isolation policy information to an access control list, and then encapsulate the mapped access control list in the policy delete instruction . At this time, the same access control list in the virtual switch where the second Pod is located can be deleted through the openflow protocol.

Step S12: Delete the correspondence between the IP address of the virtual network port of the second container warehouse and the network isolation policy information recorded in the correspondence table.

When the SDN controller sends a policy deletion instruction to the virtual switch where the second Pod is located, it also deletes the correspondence between the IP address of the virtual network port of the second Pod and the network isolation policy information recorded in its correspondence table. , In order to save the storage space of the SDN controller.

It should be noted that the technical solution of the present disclosure does not limit the execution order of steps S10 to S12 and steps S3 to S5, that is, steps S10 to S12 can be executed before steps S3 to S5, or they can be executed in steps S3 to S3. It is executed after step S5, and it can also be executed synchronously with step S3 to step S5. FIG. 8 only exemplarily shows the case where step S10 to step S12 are executed after step S3 to step S5.

FIG. 9 is a signaling diagram of the container cluster management system and the software-defined network controller in the embodiment of the disclosure to implement the container warehouse deletion process. As shown in FIG. 9, the storage process of the network policy in the embodiment of the disclosure includes the above steps S8~ Step S12, for the specific description of each step, please refer to the foregoing content, which will not be repeated here.

FIG. 10 is a flowchart of another network isolation policy management method provided by an embodiment of the disclosure. As shown in FIG. 10, the execution body of the method is a container cluster management system. The method not only includes the above steps S1 to S2, but also Including: step S13, only step S13 will be described in detail below.

Step S13: In response to the network isolation policy plan deletion request sent by the user terminal, a second deletion control request is sent to the software-defined network controller.

The client submits a network isolation strategy plan deletion request to the container cluster management system, and the network isolation strategy plan deletion request contains the policy name of the target network isolation strategy plan to be deleted.

After receiving the network isolation strategy plan deletion request, the container cluster management system sends a second deletion control request to the SDN controller, so that the SDN controller can query whether there is an isolation strategy from the target network in the strategy storage module in response to the second deletion control request The network isolation strategy information corresponding to the strategy name of the scheme, and when the strategy storage module has network isolation strategy information corresponding to the strategy name of the target network isolation strategy scheme, the strategy storage module is separated from the target network isolation strategy information. The network isolation policy information corresponding to the policy name is deleted. Wherein, the second deletion control request includes the policy name of the target network isolation policy scheme.

It should be noted that the technical solution of the present disclosure does not limit the execution order of step S13 and step S1 to step S2, that is, step S13 can be executed before step S1 to step S2, or can be executed after step S1 to step S2. It can be executed synchronously with step S1 to step S2. In FIG. 10, only the case where step S13 is executed after step S1 to step S2 is exemplified.

FIG. 11 is a flowchart of another network isolation policy management method provided by an embodiment of the present disclosure. As shown in FIG. 11, the execution body of the method is the SDN controller. The method not only includes the above steps S3 to S5, but also includes : Steps S14 to S15, only steps S14 to S15 will be described in detail below.

Step S14: In response to the second delete control request sent by the container cluster management system, query whether there is network isolation policy information corresponding to the policy name of the target network isolation policy scheme in the policy storage module.

It should be noted that when the SDN controller stores the network isolation strategy information based on the network isolation strategy scheme, the strategy storage module will not only store the network isolation strategy information and the corresponding relationship between the label selector, but also store the network isolation strategy synchronously. Correspondence between the information and the strategy name of the network isolation strategy scheme. That is, the policy name of the network isolation strategy scheme, the network isolation strategy information contained in the network isolation strategy scheme, and the label selector contained in the network isolation strategy scheme, there is a one-to-one correspondence between the three.

When it is queried that the strategy storage module has network isolation strategy information corresponding to the strategy name of the target network isolation strategy scheme, step S15 is executed; when the strategy storage module is queried, there is no strategy name corresponding to the strategy name of the target network isolation strategy scheme. When the network isolation policy information, subsequent deletion processing is not required.

Step S15: Delete the network isolation strategy information corresponding to the strategy name of the target network isolation strategy scheme in the strategy storage module.

The SDN controller deletes the network isolation strategy information and the label selector corresponding to the strategy name of the target network isolation strategy scheme in the strategy storage module, so as to save the storage space of the SDN controller.

It should be noted that, in some embodiments, when the policy storage module is queried for network isolation policy information corresponding to the policy name of the target network isolation policy solution, the SDN query finds out that the policy name corresponds to the target network isolation policy solution. Network isolation policy information, and then based on the queried network isolation policy information, query whether there is an IP address corresponding to the queried network isolation policy information in the aforementioned correspondence table (query the network isolation policy information in which virtual The landing is completed on the switch), if it exists, the policy deletion instruction is sent to the corresponding virtual switch according to the queried IP address, so that these virtual switches can delete the corresponding network isolation policy information.

The technical solution of the present disclosure does not limit the execution order of step S14 to step S15 and step S3 to step S5, that is, step S14 to step S15 can be executed before step S3 to step S5, or can be executed after step S3 to step S5. It can also be executed synchronously with step S3 to step S5. In FIG. 11, only the case where step S14 to step S15 is executed after step S3 to step S5 is exemplified.

FIG. 12 is a signaling diagram of the container cluster management system and the software-defined network controller in the embodiment of the disclosure to implement the network isolation strategy plan deletion process. As shown in FIG. 12, the implementation of the network strategy deletion process in the embodiment of the disclosure includes the above steps S13 to step S15, for the specific description of each step, please refer to the foregoing content, which will not be repeated here.

It should be noted that in the present disclosure, different steps in the foregoing embodiments can be combined with each other to obtain a new technical solution, and the new technical solution resulting from the combination should also fall within the protection scope of the present disclosure. As a combined solution, the network isolation strategy management method includes the above-mentioned steps S1 to S15, which simultaneously implements network strategy landing, network strategy storage, container warehouse deletion, and network isolation strategy solutions.

The embodiment of the present disclosure also provides a container cluster management system, including: one or more first processors and a first storage device; wherein, one or more programs are stored on the first storage device; when the one or more When a program is executed by the one or more first processors, the one or more first processors implement the network isolation policy management method provided in the foregoing embodiments.

The embodiment of the present disclosure also provides a software-defined network controller, including: one or more second processors and a second storage device; wherein, one or more programs are stored on the second storage device; when the one or more When multiple programs are executed by the one or more second processors, the one or more first processors implement the network isolation policy management method provided in the foregoing embodiments.

The embodiments of the present disclosure also provide a network isolation policy management system, including: the container cluster management system and the software-defined network controller provided in the foregoing embodiments.

A person of ordinary skill in the art can understand that all or some of the steps in the methods disclosed above, and the functional modules/units in the device can be implemented as software, firmware, hardware, and appropriate combinations thereof. In the hardware implementation, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may consist of several physical components. The components are executed cooperatively. Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit . Such software may be distributed on a computer-readable medium, and the computer-readable medium may include a computer storage medium (or a non-transitory medium) and a communication medium (or a transitory medium). As is well known to those of ordinary skill in the art, the term computer storage medium includes volatile and non-volatile data implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Sexual, removable and non-removable media. Computer storage media include but are not limited to RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or Any other medium used to store desired information and that can be accessed by a computer. In addition, as is well known to those of ordinary skill in the art, communication media usually contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as carrier waves or other transmission mechanisms, and may include any information delivery media. .

Example embodiments have been disclosed herein, and although specific terms are adopted, they are used and should only be construed as general descriptive meanings, and are not used for the purpose of limitation. In some instances, it is obvious to those skilled in the art that, unless clearly indicated otherwise, the features, characteristics, and/or elements described in combination with a specific embodiment may be used alone, or features, characteristics, and/or elements described in combination with other embodiments may be used, Combination of features and/or components. Therefore, those skilled in the art will understand that various changes in form and details can be made without departing from the scope of the present disclosure as set forth by the appended claims.

Industrial applicability

As described above, the network isolation policy management method, container cluster management system, software-defined network controller, and network isolation policy management system provided by the embodiments of the present invention have the following beneficial effects: using the powerful network orchestration capability of the SDN controller, and Combined with the characteristics of network strategy support for label-level network isolation strategy orchestration, it is possible to flexibly customize and manage the effective isolation of container networks in various application scenarios.

Claims

A network isolation strategy management method, including:

Respond to the container warehouse creation request sent by the user terminal, bind the corresponding label, and write the creation location information of the first container warehouse to be created into the virtual switch configuration library for creating the associated network bridge on the virtual switch;

Sending a network port creation and policy issuance request to the software-defined network controller, so that the software-defined network controller creates a virtual network port for the first container warehouse in response to the network port creation and policy issuance request, And when the network isolation policy information that matches the label of the first container warehouse is stored by itself, the network isolation policy information is sent to the virtual switch where the first container warehouse is located.
The network isolation policy management method according to claim 1, further comprising:

In response to the network isolation strategy scheme configuration request sent by the user end, the received network isolation strategy scheme is forwarded to the software-defined network controller. The network isolation strategy scheme includes: network isolation strategy information and a label selector. The label selector defines the label of the container bin to which the network isolation policy information is applied.
The network isolation policy management method according to claim 1, further comprising:

In response to the container warehouse delete request sent by the user terminal, forward the container warehouse delete request to the container warehouse delete system for the container warehouse delete system to delete the corresponding second container warehouse, and the container warehouse delete request includes: to be deleted The warehouse name of the second container warehouse;

Determine the IP address of the virtual network port of the second container warehouse according to the warehouse name of the second container warehouse, and send a first delete control request to the software-defined network controller for the software-defined network controller In response to the first delete control request, when the network isolation policy information corresponding to the IP address of the virtual network port of the second container warehouse exists in the corresponding relationship table stored in advance, the second container warehouse The virtual switch where it is located sends a policy deletion instruction.
The network isolation policy management method according to claim 1, further comprising:

In response to the network isolation policy plan deletion request sent by the client, a second deletion control request is sent to the software-defined network controller so that the software-defined network controller can store in itself in response to the second deletion control request. When there is network isolation strategy information corresponding to the strategy name of the target network isolation strategy scheme, delete the network isolation strategy information corresponding to the strategy name of the target network isolation strategy scheme;

The second deletion control request includes: the policy name of the target network isolation policy scheme.
A network isolation strategy management method, including:

In response to the network port creation and policy issuance request sent by the container cluster management system, a virtual network port is created for the first container warehouse and an IP address is assigned to the virtual network port. The network port creation and policy issuance request includes: The name and label of the first container warehouse;

According to the label of the first container warehouse, query whether it stores network isolation policy information that matches the label of the first container warehouse;

When it is queried that the network isolation policy information that matches the label of the first container warehouse is stored by itself, the queried network isolation policy information is sent to the virtual switch where the first container warehouse is located through the IP address.
The network isolation policy management method according to claim 5, further comprising:

Receive the network isolation strategy scheme sent by the container cluster management system, and store the received network isolation strategy scheme in the strategy storage module. The network isolation strategy scheme includes: network isolation strategy information and a label selector, the label selector Define the label of the container warehouse to which the network isolation policy information is applied.
The network isolation policy management method according to claim 6, wherein the step of storing the received network isolation policy scheme in a policy storage module comprises:

Creating a security container in the policy storage module, and encapsulating the network isolation policy information in the network isolation strategy scheme in the security container in the form of a security group rule;

Establish a correspondence between the security container and the label selector in the network isolation strategy scheme.
The network isolation policy management method according to claim 5, wherein, when the query finds out that the network isolation policy information that matches the label of the container warehouse is stored by itself, the method further comprises:

The corresponding relationship between the IP address and the queried network isolation policy information is established, and the corresponding relationship is stored in a predefined corresponding relationship table.
The network isolation policy management method according to claim 5, further comprising:

In response to the first delete control request sent by the container cluster management system, query whether there is network isolation policy information corresponding to the IP address of the virtual network port of the second container warehouse in the correspondence table stored in advance; The first deletion control request includes: the IP addresses of the virtual network ports of the second container warehouse, and the IP addresses of the virtual network ports of different container warehouses and their corresponding network isolation policy information are recorded in the correspondence table;

When the network isolation policy information corresponding to the IP address of the virtual network port of the second container warehouse is found in the corresponding relationship table, the network isolation policy information found out is reported to the location where the second container warehouse is located. The virtual switch sends a policy deletion instruction for the virtual switch where the second container warehouse is located to delete the stored network isolation policy information applied to the second container warehouse.
The network isolation policy management method according to claim 9, wherein when the corresponding relationship table is queried, there is network isolation policy information corresponding to the IP address of the virtual network port of the second container warehouse, further comprising: :

The correspondence between the IP address of the virtual network port of the second container warehouse and the network isolation policy information recorded in the correspondence table is deleted.
The network isolation policy management method according to claim 5, further comprising:

In response to the second deletion control request sent by the container cluster management system, query whether it has stored network isolation policy information corresponding to the policy name of the target network isolation strategy scheme; wherein, the second deletion control request includes: State the strategy name of the target network isolation strategy plan;

When it is queried that the network isolation policy information corresponding to the policy name of the target network isolation strategy scheme is stored by itself, the network isolation policy information corresponding to the policy name of the target network isolation strategy scheme stored by itself is deleted .
The network isolation policy management method according to claim 5, wherein the step of sending the queried network isolation policy information to the virtual switch where the first container warehouse is located through the IP address comprises:

Map the queried network isolation policy information to an access control list;

The mapped access control list is sent to the corresponding virtual switch in the form of a flow table using the openflow protocol through the IP address.
A container cluster management system, including:

One or more first processors;

The first storage device has one or more programs stored thereon;

When the one or more programs are executed by the one or more first processors, the one or more first processors are caused to implement the method according to any one of claims 1-4.
A software-defined network controller includes:

One or more second processors;

The second storage device has one or more programs stored thereon;

When the one or more programs are executed by the one or more second processors, the one or more first processors are caused to implement the method according to any one of claims 5-12.
A network isolation policy management system, comprising: the container cluster management system according to claim 13 and the software-defined network controller according to claim 14.