WO2021051933A1

WO2021051933A1 - Container cloud platform-based available area construction method and apparatus, device and storage medium

Info

Publication number: WO2021051933A1
Application number: PCT/CN2020/098934
Authority: WO
Inventors: 李迎春
Original assignee: 平安科技（深圳）有限公司
Priority date: 2019-09-20
Filing date: 2020-06-29
Publication date: 2021-03-25
Also published as: CN110830546A

Abstract

The embodiments of the present application relate to the field of cloud computing technologies, and relate to a container cloud platform-based available area construction method and apparatus, a device and a storage medium. The method comprises: creating at least two cloud hosts on a cloud platform according to a region, the cloud hosts being used for providing container services; adding the cloud hosts to a network isolation area and a network security area, respectively; configuring double-available-area labels for the cloud hosts and deploying the cloud hosts to a container cluster; and managing the cloud hosts added to the container cluster. By creating at least two cloud hosts by means of a container cloud platform, performing dual-available-area configuration on each cloud host, putting the cloud hosts in different network areas, and then adding the cloud hosts to a container cluster for unified management, the high availability and automation level of the cloud host container cluster can be improved.

Description

Available domain construction method, device, equipment and storage medium of container cloud platform

This application is based on the Chinese invention patent application filed on September 20, 2019 with the application number 201910889656.6, titled "Available domain construction method, device, equipment and storage medium based on container cloud platform", and claims its priority.

Technical field

This application relates to the field of cloud computing technology, and in particular to a method, device, device, and storage medium for building an available domain based on a container cloud platform.

Background technique

In the era of mobile Internet, companies need to find new software delivery processes and IT architectures to achieve platform-based architecture, continuous delivery, and service-oriented business. Containers are the standard deliverables of a new generation of applications. Container Cloud will help enterprise users build R&D processes and cloud platform infrastructure, shorten the delivery cycle of applications to the cloud, lower operational thresholds, and accelerate the enterprise's dual transformation of Internet technology and business.

At present, many container cloud platforms, such as PaaS (platform as a service), SaaS (software as a service), CaaS (container cloud platform), provide application operating platforms through Docker (containers) and Kubernetes (referred to as K8s) and other technologies to achieve operation and maintenance Automation, rapid application deployment, elastic scaling and dynamic adjustment of application environment resources. For example, Alibaba Cloud uses a multi-region deployment solution to improve the high availability of ECS (Elastic Computing Server). However, in the process of implementing this application, the inventor realized that Some implementation methods have at least the following problems: 1. ECS itself does not have high availability and disaster tolerance, and requires multiple regions, especially a logical multi-region architecture to achieve; 2. The application runs on ECS, which requires manual multi-regions. Disperse the deployment; 3. The load balancing ELB of the cluster needs to consider the impact of the node recovery, and the node needs to be manually disabled, which is inefficient.

Summary of the invention

The purpose of the embodiments of the present application is to propose a method, device, equipment, and storage medium for building an available domain of a container cloud platform, so as to improve the high availability and automation level of a cloud host container cluster.

In order to solve the above technical problems, an embodiment of the present application provides a method for building an available domain of a container cloud platform, which includes the following steps:

Create at least two cloud hosts on the cloud platform according to regions, where the cloud hosts are used to provide container services;

Adding the cloud host to the network isolation zone and the network security zone respectively;

Configure a dual-availability domain label for the cloud host and deploy it to the container cluster;

Manage the cloud hosts added to the container cluster.

In order to solve the above technical problems, an embodiment of the present application also provides an available domain construction device based on a container cloud platform, which adopts the following technical solutions:

The available domain construction device based on the container cloud platform includes:

The creation module is used to create at least two cloud hosts on the cloud platform according to regions, and the cloud hosts are used to provide container services;

The joining module is used to join the cloud host to the network isolation zone and the network security zone respectively;

A deployment module, configured to configure a dual-availability domain label for the cloud host and deploy it to a container cluster;

The management module is used to manage the cloud hosts added to the container cluster.

In order to solve the above technical problems, the embodiments of the present application also provide a computer device, which adopts the following technical solutions:

The computer device includes a memory and a processor, and a computer process is stored in the memory. When the processor executes the computer process, the container-based cloud platform described in any one of the embodiments of the present application is available. Steps of the domain construction method:

Create at least two cloud hosts on the container cloud platform according to regions, where the cloud hosts are used to provide container services;

Manage the cloud hosts added to the container cluster.

In order to solve the above technical problems, the embodiments of the present application also provide a computer-readable storage medium, which adopts the following technical solutions:

The computer-readable storage medium stores a computer process, and when the computer process is executed by a processor, the steps of any one of the container cloud platform-based available domain construction methods proposed in the embodiments of the present application are implemented:

Manage the cloud hosts added to the container cluster.

The details of one or more embodiments of the present application are set forth in the following drawings and description, and other features and advantages of the present application will become apparent from the description, drawings, and claims.

Create at least two cloud hosts on the cloud platform according to regions, the cloud hosts are used to provide container services; add the cloud hosts to the network isolation zone and the network security zone respectively; configure the cloud host with dual-availability domain tags and deploy To the container cluster; to manage the cloud hosts added to the container cluster. At least two cloud hosts are created through the container cloud platform, and each cloud host is configured with dual availability domains and placed in different network areas and then added to the container cluster for unified management, which can improve the high availability and automation level of the cloud host container cluster.

Description of the drawings

In order to explain the solution in this application more clearly, the following will briefly introduce the drawings used in the description of the embodiments of the application. Obviously, the drawings in the following description are some embodiments of the application. Ordinary technicians can obtain other drawings based on these drawings without creative work.

Figure 1 is an exemplary system architecture diagram to which the present application can be applied;

Fig. 2 is a flowchart of an embodiment of a method for building available domains based on a container cloud platform according to the present application;

FIG. 3 is a flowchart of a specific implementation of step 201 in FIG. 2;

FIG. 4 is a flowchart of a specific implementation of step 202 in FIG. 2;

FIG. 5 is a flowchart of a specific implementation of step 203 in FIG. 2;

Fig. 6 is a schematic structural diagram of an embodiment of an available domain construction device based on a container cloud platform according to the present application;

FIG. 7 is a schematic structural diagram of a specific implementation of the creation module 301 shown in FIG. 6;

Fig. 8 is a schematic structural diagram of an embodiment of a computer device according to the present application.

detailed description

Unless otherwise defined, all technical and scientific terms used herein have the same meanings as commonly understood by those skilled in the technical field of the application; the terms used in the specification of the application herein are only for describing specific embodiments. The purpose is not to limit the application; the terms "including" and "having" in the specification and claims of the application and the above-mentioned description of the drawings and any variations thereof are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the application or the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific sequence.

Reference to "embodiments" herein means that a specific feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment mutually exclusive with other embodiments. Those skilled in the art clearly and implicitly understand that the embodiments described herein can be combined with other embodiments.

In order to enable those skilled in the art to better understand the solutions of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the accompanying drawings.

As shown in FIG. 1, the system architecture 100 may include

terminal devices

101, 102, 103, a network 104, and a server 105. The network 104 is used to provide a medium for communication links between the

terminal devices

101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, and so on.

The user can use the

terminal devices

101, 102, and 103 to interact with the server 105 through the network 104 to receive or send messages and so on. Various communication client applications, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, and social platform software, may be installed on the

terminal devices

101, 102, and 103.

The

terminal devices

101, 102, and 103 may be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III, dynamic Video experts compress standard audio layer 3), MP4 (Moving Picture Experts Group Audio Layer IV, dynamic image experts compress standard audio layer 4) players, laptop portable computers and desktop computers, etc.

The server 105 may be a server that provides various services, for example, a background server that provides support for pages displayed on the

terminal devices

101, 102, and 103.

It should be noted that the available domain construction method based on the container cloud platform provided by the embodiments of the present application is generally executed by the server/terminal device. Accordingly, the available domain construction device based on the container cloud platform is generally set in the server/terminal device.

It should be understood that the numbers of terminal devices, networks, and servers in FIG. 1 are merely illustrative. According to implementation needs, there can be any number of terminal devices, networks, and servers.

Continuing to refer to FIG. 2, a flowchart of an embodiment of the method for building available domains based on the container cloud platform according to the present application is shown. The method for constructing available domains based on the container cloud platform includes the following steps:

Step 201: Create at least two cloud hosts on the container cloud platform according to regions, where the cloud hosts are used to provide container services.

In this embodiment, it is possible to connect and log in to the electronic device (such as the server/terminal device shown in FIG. 1) on which the available domain construction method based on the container cloud platform runs through a wired connection or a wireless connection. It should be pointed out that the above-mentioned wireless connection methods can include, but are not limited to, 3G/4G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or developed in the future .

Among them, the address of the cloud platform is the domain name of the platform website, such as yun.pingan.com. All users can access and select the service type according to their needs, such as file storage and sharing, application process creation and deployment, etc., and then according to the service type and location Select and create a cloud host that provides container services. Users can include, but are not limited to, individuals, organizations, or R&D teams.

Step 202: Add the cloud host to the network isolation zone and the network security zone respectively.

Among them, the network isolation zone and the network security zone are the virtual network VPC (Virtual Private Cloud) obtained by further dividing the Internet according to a certain security strategy, and the VPC is in the public cloud (all users share a public network resource pool, and users are not Do logical isolation) on a custom logical network space, the above-mentioned network isolation zone DMZ is a special area between the external network and the internal network, which adds a security line of defense to the network security zone SF (internal network) to be protected. Among them, the above-mentioned access control policies can be formulated, added, deleted, and modified according to the access needs, including the intranet SF can access the external network, the internal network SF can access the DMZ, the external network cannot access the internal SF, the external network can access the DMZ, and the DMZ cannot access The intranet SF and DMZ cannot access the external network, etc.

In this embodiment, the created cloud host can be added to the network isolation zone and network security zone respectively, so as to provide services of different security levels.

Step 203: Configure a dual-availability domain label for the cloud host and deploy it to the container cluster.

In this embodiment, when a lot of container applications are arranged on multiple cloud hosts, a container cluster is formed. At this time, some tools or systems, such as Kubernetes (k8s), are required to uniformly manage multiple hosts in the cloud platform. Containerized applications on the Internet; the goal of Kubernetes is to make the deployment of containerized applications simple and efficient. It provides a unified management of these container clusters by providing application deployment, planning, update, and maintenance mechanisms. Furthermore, the container clusters can be divided into regions. Management, which provides functions such as resource scheduling, deployment and operation, service discovery, capacity expansion and contraction for containerized applications. It can also provide container orchestration services, so that containers can communicate with each other, transfer runtimes to each other, and manage the behavior of multiple containers at the same time For example, when a container cluster builds an application architecture together, it is necessary to consider the containers in the cluster environment, which ports need to be exposed, and which volumes need to be mounted.

Among them, the available domain label can be a custom identifier used to indicate the available domain in the availability zone. Configure a customized available domain label for the created cloud host and add it to the container cluster. The available domain label can be used to access the container cluster. Find the corresponding cloud host node in, and then use the container cluster management tool to manage the container on the cloud host node.

Step 204: Manage the cloud hosts added to the container cluster.

In this embodiment, the above-mentioned container management tool k8s is used to manage the cloud hosts added to the container cluster, such as monitoring the running status, performing load balancing, and disaster recovery backup.

It should be noted that the available domain construction method based on the container cloud platform provided by the embodiments of the application can be applied to the available domain construction equipment based on the container cloud platform, for example: computers, servers, workstations, etc. can perform the available domain based on the container cloud platform Construction equipment.

In this embodiment, at least two cloud hosts are created on the cloud platform according to regions, the cloud hosts are used to provide container services; the cloud hosts are added to the network isolation zone and the network security zone respectively; the cloud host is configured The dual-availability domain label is deployed to the container cluster; and the cloud hosts added to the container cluster are managed. At least two cloud hosts are created through the container cloud platform, and each cloud host is configured with dual availability domains and placed in different network areas and then added to the container cluster for unified management, which can improve the high availability and automation level of the cloud host container cluster.

Further, as shown in FIG. 3, the above step 201 may include:

Step 2011, log in to the container cloud platform.

In this embodiment, an account that has been registered on the cloud platform is used to log in to the above-mentioned container cloud platform (CaaS) cloud platform, and the address of the cloud platform is the domain name of the platform website, such as yun.pingan.com. A container is a running instance created from an image. It can be started, started, stopped, and deleted, and the environment of each container is isolated from each other to ensure safety. Moreover, the start, stop, and destruction of the container are in seconds or milliseconds. Compared with traditional virtualization technology, the performance loss of the CPU, memory, network IO and other resources of the container has the same level or even better performance. . The above-mentioned Docker container image can be stored in a local public/private image warehouse. Users can create an image or update an existing image through the warehouse, or download a ready-made image directly from another place and use it directly. The deployment of container applications is very convenient for migration and deployment through this mirroring mechanism.

In step 2012, on the cloud platform, select an availability zone in the local area to create at least two cloud host nodes.

In this embodiment, one of the two Availability Zones A/B is selected to create a cloud host on the aforementioned cloud platform based on the location (such as Hong Kong, Shenzhen, Shanghai, etc.). For example, there are two Availability Zones A in Hong Kong. , B, you can select the available zone A, and further select the basic configuration parameters of the cloud host according to your needs, such as the number of CPU cores, memory capacity, operating system type, etc. The above-mentioned available area refers to a physical area in the same area where power and network are independent of each other. In the same area, the available area and the available area can communicate with each other in the intranet.

Among them, the cloud host can be used to store data, or to execute application processes to provide services; further, multiple container applications and the environment that the application depends on can also be installed on the cloud host through the docker image, for example: one image can contain A complete ubuntu operating system environment, which only installs Apache or other application processes required by the user; the image can be used to create a Docker container, and then use the container to run the application.

Further, as shown in FIG. 4, the foregoing step 202 may include:

Step 2021: Create a corresponding security group according to different access control policies, including a network isolation zone security group and a network security zone security group.

Furthermore, the step of creating corresponding security groups according to different access control policies specifically includes:

Dividing the network where the cloud host is located at least into a network isolation zone and a network security zone according to the security level;

Create corresponding security groups according to the access control policies of the network isolation zone and the network security zone, namely, the network isolation zone security group and the network security zone security group.

Specifically, for the Internet, the network can be divided into three zones according to the security level: the SF zone with the highest security level (intranet), the DMZ zone with the medium security level and the Internet zone with the lowest security level (external network). The three areas have different access control strategies due to their different tasks.

Among them, the above-mentioned DMZ (network isolation zone) area is a special area between the external network and the internal network, which adds a security line of defense for the internal network SF (network security zone) to be protected, and at the same time it provides an area for placement Public services, external networks can access these services, such as corporate Web servers, FTP servers, and forums.

In this embodiment, the DMZ network isolation zone and the SF network security zone are the virtual network VPC (Virtual Private Cloud) that is further divided on the above availability zone A or B, and the VPC is in the public cloud (all users share public network resources) The purpose is to build an isolated virtual network environment on the cloud platform that can independently manage configurations and policies, so as to improve resources in the network environment. In the VPC environment, you can further manage your own subnet structure, IP address range and allocation method, network routing strategy, etc., and achieve multi-layer security protection through security groups and network ACLs.

The above-mentioned access control strategy can be formulated, deleted, and modified according to the access needs, including the intranet SF can access the external network, the internal network SF can access the DMZ, the external network cannot access the internal SF, the external network can access the DMZ, and the DMZ cannot access the internal network SF and DMZ cannot access external networks, etc. For example, you can create the above-mentioned DMZ network isolation zone security group based on the external network can access the DMZ but not the internal network SF directly; according to the internal network SF can access the DMZ, the DMZ can access the internal network SF to create the above SF network security zone security group .

Step 2022: Bind the created at least two cloud host nodes to the two created security groups respectively.

In this embodiment, the access policy of the DMZ network isolation zone security group created in step 2021 is issued to one of the at least two cloud host nodes created in the availability zone A/B, and the SF network security zone The access policy of the security group is issued to the other one to complete the binding, so that the two cloud host nodes belong to different VPCs and provide services of different security levels.

Further, as shown in FIG. 5, the above step 203 may include:

Step 2031: Label the at least two cloud host nodes with dual-availability domain labels respectively.

In this embodiment, the above-mentioned available domain label may be a custom identifier used to indicate the available domain in the above-mentioned Availability Zone A/B, for example, hka-az1 and hka-az2 indicate the az1 and az2 available domains in Zone A of Hong Kong Availability Zone. ;Then use the command line of the container management tool k8s to associate the above available domain label with the cloud host created above, and then the corresponding cloud host node can be found through the available domain label, as follows: Kubectl label no dmz_node1ip failure-domain.beta. kubernetes.io/zone=hka-az1; kubectl label no dmz_node2ip failure-domain.beta.kubernetes.io/zone=hka-az2; kubectl label no sf_node1ip failure-domain.beta.kubernetes.io/zone=hka-az1; kubectl label no sf_node2ip failure-domain.beta.kubernetes.io/zone=hka-az2;

Among them, dmz_node1ip and dmz_node2ip represent the two independent containers of the cloud host node in the DMZ network area, which are used to carry the available domains hka-az1 and hka-az2 respectively; similarly, sf_node1ip and sf_node2ip represent the cloud host node in the SF network area The two independent containers are used to carry the available domains hka-az1 and hka-az2 respectively. In this way, the definition, configuration, and management of dual-availability domain tags through the container management tool k8s can enable cloud hosts to have architectural high-availability support at the IAAS (infrastructure) level.

Step 2032: Add the dual-availability domain label to the node deployment template of the cloud platform, thereby deploying the cloud host node to the container cluster.

In this embodiment, through the container management tool k8s, execute the command kubectl edit deployment deployment_name-n namespace, open the node affinity deployment template, and add the following information in the template section:

In this way, the two cloud host nodes marked with the available domain labels hka-az1 and hka-az2 can be deployed to the k8s cluster for unified management; the multi-availability domain deployment method based on the template configuration provided by the container management tool k8s is flexible and Convenient.

Step 2033: Perform load balancing on the container clusters that have been added to the network isolation zone of the cloud host node.

Among them, Load Balance (LB) is a cluster technology of servers or network devices, which shares specific services (network services, network traffic, etc.) to multiple servers or network devices, thereby improving business processing capabilities , To ensure the high availability of the business. For example, in this embodiment, a container application cluster that has been added to the network isolation zone of a cloud host node can be deployed to multiple cloud hosts, and then user requests can be distributed to different servers through load balancing to improve websites, applications, and The performance and reliability of databases or other services.

Furthermore, the above step 2033 may include:

Step 20331: Add the cloud host node bound to the security group of the network isolation zone to the resource pool.

In this embodiment, under the load balancing ELB page of the container cloud platform CaaS cloud platform, find the server resource pool in the DMZ network isolation area, and add the cloud host node bound to the security group of the DMZ network isolation area to the resource pool. Can be load balanced.

Further, the above step 204 may include:

Step 2041: Add monitoring scripts to the at least two cloud host nodes respectively, and collect and report operating data of the nodes.

The docker container process monitoring script is added to the cloud host node to collect the operating data of the host, such as CPU usage, memory usage, etc., and use the crontab tool command to regularly report the operating status of the host node to the cloud platform.

A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing relevant hardware through a computer process. The computer process can be stored in a computer readable storage medium. When executed, it may include the procedures of the above-mentioned method embodiments. Among them, the aforementioned storage medium may be a non-volatile storage medium such as a magnetic disk, an optical disc, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random Access Memory, RAM), etc.

It should be understood that although the various steps in the flowchart of the drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless explicitly stated in this article, the execution of these steps is not strictly limited in order, and they can be executed in other orders. Moreover, at least part of the steps in the flowchart of the drawings may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the order of execution is also It is not necessarily performed sequentially, but may be performed alternately or alternately with at least a part of other steps or sub-steps or stages of other steps.

With further reference to FIG. 6, as an implementation of the method shown in FIG. 2, this application provides an embodiment of an available domain construction device based on a container cloud platform, which is similar to the method embodiment shown in FIG. Correspondingly, the device can be specifically applied to various electronic devices.

As shown in FIG. 6, the device 300 for building an available domain based on a container cloud platform in this embodiment includes: a creation module 301, a joining module 302, a deployment module 303, and a management module 304. among them:

The creation module 301 is configured to create at least two cloud hosts on the cloud platform according to regions, and the cloud hosts are used to provide container services;

The joining module 302 is used to join the cloud host to the network isolation zone and the network security zone respectively;

The deployment module 303 is configured to configure a dual-availability domain label for the cloud host and deploy it to the container cluster;

The management module 304 is used to manage the cloud hosts added to the container cluster.

Further, as shown in FIG. 7, which is a schematic structural diagram of a specific implementation of the creation module 301, the creation module 301 further includes:

The login sub-module 3011 is used to log in to the container-based cloud platform;

The creation sub-module 3012 is used to select an availability zone in the local area to create at least two cloud host nodes on the cloud platform.

The device for constructing available domains based on the container cloud platform provided by the embodiments of the present application can implement the various implementation manners in the method embodiments of FIGS. 2 to 5 and the corresponding beneficial effects. To avoid repetition, details are not described herein again.

In order to solve the above technical problems, the embodiments of the present application also provide computer equipment. Please refer to FIG. 8 for details. FIG. 8 is a block diagram of the basic structure of the computer device in this embodiment.

The computer device 8 includes a memory 81, a processor 82, and a network interface 83 that communicate with each other through a system bus. It should be pointed out that the figure only shows the computer device 8 with components 81-83, but it should be understood that it is not required to implement all the illustrated components, and more or fewer components may be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculation and/or information processing in accordance with pre-set or stored instructions. Its hardware includes, but is not limited to, a microprocessor, a dedicated Integrated Circuit (Application Specific Integrated Circuit, ASIC), Programmable Gate Array (Field-Programmable Gate Array, FPGA), Digital Processor (Digital Signal Processor, DSP), embedded equipment, etc.

The computer device may be a computing device such as a desktop computer, a notebook, a palmtop computer, and a cloud server. The computer device can interact with the user through a keyboard, a mouse, a remote control, a touch panel, or a voice control device.

The memory 81 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static memory Random access memory (SRAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), programmable read only memory (PROM), magnetic memory, magnetic disk, optical disk, etc., the computer readable storage The medium can be non-volatile or volatile. In some embodiments, the memory 81 may be an internal storage unit of the computer device 8, such as a hard disk or memory of the computer device 8. In other embodiments, the memory 81 may also be an external storage device of the computer device 8, such as a plug-in hard disk equipped on the computer device 8, a smart media card (SMC), a secure digital (Secure Digital, SD) card, flash card (Flash Card), etc. Of course, the memory 81 may also include both the internal storage unit of the computer device 8 and its external storage device. In this embodiment, the memory 81 is generally used to store an operating system and various application software installed on the computer device 8, such as computer readable instructions based on a container cloud platform's available domain construction method. In addition, the memory 81 can also be used to temporarily store various types of data that have been output or will be output.

In some embodiments, the processor 82 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips. The processor 82 is generally used to control the overall operation of the computer device 8. In this embodiment, the processor 82 is configured to run computer-readable instructions or processed data stored in the memory 81, for example, run the computer-readable instructions of the container cloud platform-based available domain construction method.

The network interface 83 may include a wireless network interface or a wired network interface, and the network interface 83 is generally used to establish a communication connection between the computer device 8 and other electronic devices.

This application also provides another implementation manner, that is, to provide a computer-readable storage medium that stores the available domain construction process based on the container cloud platform, and the available domain construction based on the container cloud platform The process may be executed by at least one processor, so that the at least one processor executes the steps of the aforementioned container cloud platform-based available domain construction method.

Through the description of the above implementation manners, those skilled in the art can clearly understand that the above-mentioned embodiment method can be implemented by means of software plus the necessary general hardware platform, of course, it can also be implemented by hardware, but in many cases the former is better.的实施方式。 Based on this understanding, the technical solution of this application essentially or the part that contributes to the existing technology can be embodied in the form of a software product, and the computer software product is stored in a storage medium (such as ROM/RAM, magnetic disk, The optical disc) includes several instructions to enable a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the method described in each embodiment of the present application.

It should be noted that for the foregoing method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should know that this application is not limited by the described sequence of actions. Because according to this application, some steps can be performed in other order or at the same time. Secondly, those skilled in the art should also know that the embodiments described in the specification are all optional embodiments, and the involved actions and modules are not necessarily required by this application.

In the above-mentioned embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in an embodiment, reference may be made to related descriptions of other embodiments.

In the several embodiments provided in this application, it should be understood that the disclosed device may be implemented in other ways. For example, the device embodiments described above are merely illustrative, for example, the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or software flow module.

If the integrated unit is implemented in the form of a software flow module and sold or used as an independent product, it can be stored in a computer readable memory. Based on this understanding, the technical solution of the present application essentially or the part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a memory. A number of instructions are included to enable a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned memory includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk, etc., which can store computer readable instructions. medium.

Obviously, the embodiments described above are only a part of the embodiments of the present application, rather than all of the embodiments. The drawings show preferred embodiments of the present application, but do not limit the patent scope of the present application. This application can be implemented in many different forms. On the contrary, the purpose of providing these examples is to make the understanding of the disclosure of this application more thorough and comprehensive. Although this application has been described in detail with reference to the foregoing embodiments, for those skilled in the art, it is still possible for those skilled in the art to modify the technical solutions described in each of the foregoing specific embodiments, or equivalently replace some of the technical features. . All equivalent structures made using the contents of the description and drawings of this application, directly or indirectly used in other related technical fields, are similarly within the scope of patent protection of this application.

Claims

A method for building available domains based on a container cloud platform, which includes:

Create at least two cloud hosts on the container cloud platform according to regions, where the cloud hosts are used to provide container services;

Adding the cloud host to the network isolation zone and the network security zone respectively;

Configure a dual-availability domain label for the cloud host and deploy it to the container cluster;

Manage the cloud hosts added to the container cluster.
The method according to claim 1, wherein the step of creating at least two cloud hosts on a cloud platform according to regions specifically comprises:

Log in to the container cloud platform;

On the container cloud platform, at least two cloud host nodes are created by selecting an available zone in the local area.
The method according to claim 1, wherein the step of adding the cloud host to the network isolation zone and the network security zone respectively comprises:

Create corresponding security groups according to different access control policies, including network isolation zone security groups and network security zone security groups;

Bind the created at least two cloud host nodes to the two created security groups respectively.
The method according to claim 3, wherein the step of creating corresponding security groups according to different access control policies specifically comprises:

Dividing the network where the cloud host is located at least into a network isolation zone and a network security zone according to the security level;

Create corresponding security groups according to the access control policies of the network isolation zone and the network security zone, namely, the network isolation zone security group and the network security zone security group.
The method according to claim 4, wherein the step of configuring a dual-availability domain label for the cloud host and deploying to a container cluster specifically comprises:

Label the at least two cloud host nodes with dual-availability domain labels;

Adding the dual-availability domain label to the node deployment template of the cloud platform, thereby deploying the cloud host node to the container cluster;

Load balance the above-mentioned container clusters that have joined the network isolation zone of the cloud host node.
The method according to claim 5, wherein the step of performing load balancing on the container clusters that have been added to the network isolation zone of the cloud host node specifically comprises:

The cloud host node bound to the security group of the network isolation zone is added to the resource pool.
The method according to claim 1, wherein the step of managing the cloud host added to the container cluster specifically comprises:

Add monitoring scripts to the at least two cloud host nodes respectively, and collect and report the operating data of the nodes.
An available domain construction device based on a container cloud platform, which includes:

The creation module is used to create at least two cloud hosts on the cloud platform according to regions, and the cloud hosts are used to provide container services;

The joining module is used to join the cloud host to the network isolation zone and the network security zone respectively;

A deployment module, configured to configure a dual-availability domain label for the cloud host and deploy it to a container cluster;

The management module is used to manage the cloud hosts added to the container cluster.
The device for building an available domain based on a container cloud platform according to claim 8, wherein the creation module comprises:

Platform login sub-module, used to log in to the container cloud platform;

The node creation submodule is used to select an availability zone in the local area to create at least two cloud host nodes on the container cloud platform.
The device for building an available domain based on a container cloud platform according to claim 8, wherein the joining module comprises:

The security group creation sub-module is used to create corresponding security groups according to different access control policies, including the network isolation zone security group and the network security zone security group;

The node binding submodule is used to bind the created at least two cloud host nodes to the two created security groups respectively.
A computer device including a memory, a processor, and computer-readable instructions stored in the memory and capable of running on the processor, wherein the processor executes the computer-readable instructions as follows The steps of the available domain construction method based on the container cloud platform:

Create at least two cloud hosts on the container cloud platform according to regions, where the cloud hosts are used to provide container services;

Adding the cloud host to the network isolation zone and the network security zone respectively;

Configure a dual-availability domain label for the cloud host and deploy it to the container cluster;

Manage the cloud hosts added to the container cluster.
The computer device according to claim 11, wherein the step of creating at least two cloud hosts on a cloud platform according to regions specifically comprises:

Log in to the container cloud platform;

On the container cloud platform, at least two cloud host nodes are created by selecting an available zone in the local area.
The computer device according to claim 11, wherein the step of adding the cloud host to the network isolation zone and the network security zone respectively comprises:

Create corresponding security groups according to different access control policies, including network isolation zone security groups and network security zone security groups;

Bind the created at least two cloud host nodes to the two created security groups respectively.
The computer device according to claim 13, wherein the step of creating corresponding security groups according to different access control policies specifically comprises:

Dividing the network where the cloud host is located at least into a network isolation zone and a network security zone according to the security level;

Create corresponding security groups according to the access control policies of the network isolation zone and the network security zone, namely, the network isolation zone security group and the network security zone security group.
The computer device according to claim 14, wherein the step of configuring a dual-availability domain label for the cloud host and deploying it to a container cluster specifically comprises:

Label the at least two cloud host nodes with dual-availability domain labels;

Adding the dual-availability domain label to the node deployment template of the cloud platform, thereby deploying the cloud host node to the container cluster;

Load balance the above-mentioned container clusters that have joined the network isolation zone of the cloud host node.
A non-volatile computer-readable storage medium, wherein, when the computer-readable instruction is executed by a processor, the process is caused to execute the steps of the container cloud platform-based available domain construction method :

Create at least two cloud hosts on the container cloud platform according to regions, where the cloud hosts are used to provide container services;

Adding the cloud host to the network isolation zone and the network security zone respectively;

Configure a dual-availability domain label for the cloud host and deploy it to the container cluster;

Manage the cloud hosts added to the container cluster.
The non-volatile computer-readable storage medium of claim 16, wherein the step of creating at least two cloud hosts on a cloud platform according to regions specifically comprises:

Log in to the container cloud platform;

On the container cloud platform, at least two cloud host nodes are created by selecting an available zone in the local area.
The non-volatile computer-readable storage medium according to claim 16, wherein the step of adding the cloud host to the network isolation zone and the network security zone respectively comprises:

Create corresponding security groups according to different access control policies, including network isolation zone security groups and network security zone security groups;

Bind the created at least two cloud host nodes to the two created security groups respectively.
The non-volatile computer-readable storage medium of claim 18, wherein the step of creating corresponding security groups according to different access control policies specifically comprises:

Dividing the network where the cloud host is located at least into a network isolation zone and a network security zone according to the security level;

Create corresponding security groups according to the access control policies of the network isolation zone and the network security zone, namely, the network isolation zone security group and the network security zone security group.
The non-volatile computer-readable storage medium of claim 19, wherein the step of configuring the cloud host with a dual-availability domain label and deploying it to a container cluster specifically comprises:

Label the at least two cloud host nodes with dual-availability domain labels;

Adding the dual-availability domain label to the node deployment template of the cloud platform, thereby deploying the cloud host node to the container cluster;

Load balance the above-mentioned container clusters that have joined the network isolation zone of the cloud host node.