WO2022063170A1 - 一种公有云的网络配置方法及相关设备 - Google Patents

一种公有云的网络配置方法及相关设备 Download PDF

Info

Publication number
WO2022063170A1
WO2022063170A1 PCT/CN2021/119867 CN2021119867W WO2022063170A1 WO 2022063170 A1 WO2022063170 A1 WO 2022063170A1 CN 2021119867 W CN2021119867 W CN 2021119867W WO 2022063170 A1 WO2022063170 A1 WO 2022063170A1
Authority
WO
WIPO (PCT)
Prior art keywords
interface
sub
virtual machine
network
container
Prior art date
Application number
PCT/CN2021/119867
Other languages
English (en)
French (fr)
Inventor
郜忠华
王睿
Original Assignee
华为云计算技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为云计算技术有限公司 filed Critical 华为云计算技术有限公司
Priority to EP21871539.9A priority Critical patent/EP4221103A4/en
Publication of WO2022063170A1 publication Critical patent/WO2022063170A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0806—Configuration setting for initial configuration or provisioning, e.g. plug-and-play
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0895—Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/18—Delegation of network management function, e.g. customer network management [CNM]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45595—Network integration; Enabling network access in virtual machine instances
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/084—Configuration by using pre-existing information, e.g. using templates or copying from other elements
    • H04L41/0843—Configuration by using pre-existing information, e.g. using templates or copying from other elements based on generic templates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0894—Policy-based network configuration management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H04L61/5014—Internet protocol [IP] addresses using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00—Reducing energy consumption in communication networks
    • Y02D30/50—Reducing energy consumption in communication networks in wire-line communication networks, e.g. low power modes or reduced link rate

Definitions

  • the invention relates to the technical field of cloud computing, and in particular, to a network configuration method and related equipment of a public cloud.
  • Sub IP Sub-Internet Protocol
  • a Sub on the same network segment as the interface IP can be configured.
  • IP IP virtual local area network
  • This communication method is difficult to use network security groups to achieve container communication security, and the communication policy configuration is complex, and it needs to rely on the IP VLAN module to convert the Sub IP into a logical interface.
  • the container address and the interface address of the virtual machine are in the same network segment, and the container migrates.
  • network services such as elastic load balance (ELB) and elastic public IP (elastic IP, EIP) do not support the Sub IP model, containers deployed in virtual machines It also cannot support network services such as ELB and EIP.
  • ELB elastic load balance
  • the embodiment of the present invention discloses a network configuration method and related equipment of a public cloud, which can set a sub-interface to a network port of a virtual machine, so as to realize that a container in the virtual machine can use the cloud service on the public cloud through the set sub-interface, Has the same networking capabilities as a virtual machine.
  • the present application provides a network configuration method for a public cloud, the method comprising: providing an input interface for a tenant, where the input interface is used to receive a virtual machine network port identifier input by the tenant, and the virtual machine network The port identifier is used to identify the network port of the virtual machine that needs to configure the sub-interface; determine the network port of the virtual machine corresponding to the virtual machine network port identifier, set the sub-interface for the network port, and provide the information of the sub-interface. to the tenant.
  • the network port of the virtual machine is determined according to the network port identifier of the virtual machine input by the tenant, and a sub-interface is configured for the network port, and then the information of the sub-interface is provided to the tenant, so that the container in the virtual machine is You can use the cloud services on the public cloud through the configured sub-interfaces, and have the same network capabilities as virtual machines.
  • the input interface is further configured to receive configuration information of the sub-interface input by the tenant, and the cloud management platform configures the sub-interface according to the configuration information subinterface.
  • the tenant makes the cloud management platform configure the sub-interface by inputting the sub-interface configuration information, so as to ensure that the configured sub-interface has the same network capability as the virtual machine.
  • the sub-interface is bound to a container in the virtual machine, and the container processes network packets through the sub-interface.
  • the configuration information of the sub-interface includes a security group rule, and the security group rule is used for reporting to the container bound to the sub-interface.
  • the document is processed by the security group.
  • the network security group can be used to realize the container access security, which simplifies the configuration of the container access policy.
  • the configuration information of the sub-interface includes subnet information of the sub-interface and a virtual local area network identifier VlanID of the sub-interface.
  • the sub-interface is configured by using the subnet information and VlanID of the sub-interface to ensure that the configured sub-interface has the same network capability as the main interface of the virtual machine.
  • the network configurator after receiving the virtual machine network port identifier input by the tenant, the network configurator first determines the server where the virtual machine corresponding to the virtual machine network port identifier is located, and then notifies the virtual machine manager in the server. Complete the configuration of the sub-interface.
  • the information of the sub-interface includes the sub-interface identifier UUID of the sub-interface, the private network address and subnet information of the sub-interface, the sub-interface One or any combination of the MAC address of the interface and the VlanID of the sub-interface.
  • the input interface includes a configuration interface, an application programming interface API, and an input template.
  • the tenant inputs the virtual machine network port identifier and sub-interface configuration information through the configuration interface, API and input template provided by the network configurator, so that the network configurator can complete the sub-interface configuration, and the configured sub-interface Specifically the same network capability as the virtual machine's main interface.
  • the present application provides a network device, including: a receiving module configured to receive a virtual machine network port identifier input by a tenant, where the virtual machine network port identifier is used to identify a network port of a virtual machine that needs to configure a sub-interface a processing module, configured to determine the network port of the virtual machine corresponding to the virtual machine network port identifier, set a sub-interface for the network port, and provide the information of the sub-interface to the tenant.
  • a receiving module configured to receive a virtual machine network port identifier input by a tenant, where the virtual machine network port identifier is used to identify a network port of a virtual machine that needs to configure a sub-interface
  • a processing module configured to determine the network port of the virtual machine corresponding to the virtual machine network port identifier, set a sub-interface for the network port, and provide the information of the sub-interface to the tenant.
  • the receiving module is further configured to receive the configuration information of the sub-interface input by the tenant; the processing module is further configured to configure the sub-interface according to the configuration information.
  • the sub-interface is bound to a container in the virtual machine, and the container processes network packets through the sub-interface.
  • the configuration information of the sub-interface includes a security group rule, and the security group rule is used to report the container bound to the sub-interface.
  • the document is processed by the security group.
  • the configuration information of the sub-interface includes subnet information of the sub-interface and a virtual local area network identifier VlanID of the sub-interface.
  • the processing module is specifically configured to: determine the server where the virtual machine corresponding to the virtual machine network port identifier is located; notify the virtual machine of the server The manager sets the sub-interface under the network port of the virtual machine.
  • the information of the sub-interface includes the sub-interface identifier UUID of the sub-interface, the private network address and subnet information of the sub-interface, the sub-interface One or any combination of the media access control MAC address of the interface and the virtual local area network identification VlanID of the sub-interface.
  • the input interface includes a configuration interface, an application programming interface API, and an input template.
  • the present application provides a computing device, the computing device includes a processor and a memory, the memory is used for storing program codes, and the processor is used for calling the program code in the memory to execute the above-mentioned first aspect and a method in combination with any one of the implementation manners of the above first aspect.
  • the present application provides a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium.
  • the computer program is executed by a processor, the above-mentioned first aspect can be implemented and combined with the above-mentioned first aspect.
  • the flow of the network configuration method of the public cloud provided by any one of the implementation manners.
  • the present application provides a computer program product, the computer program product comprising instructions, when the computer program is executed by a computer, the computer can execute the above-mentioned first aspect and realize in combination with any one of the above-mentioned first aspects
  • the flow of the network configuration method of the public cloud provided by the method.
  • FIG. 1 is a schematic diagram of a scenario of deploying a container in a virtual machine according to an embodiment of the present application
  • FIG. 2 is a schematic diagram of another scenario of deploying a container in a virtual machine provided by an embodiment of the present application
  • FIG. 3 is a schematic structural diagram of a system architecture provided by an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of a network configuration method for a public cloud provided by an embodiment of the present application
  • FIG. 5 is a schematic diagram of a configuration interface provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of a scenario for setting a sub-interface provided by an embodiment of the present application.
  • FIG. 7 is a schematic diagram of a network packet processing provided by an embodiment of the present application.
  • FIG. 8 is a schematic diagram of a security group configuration of a sub-interface provided by an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of a network device provided by an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of a computing device provided by an embodiment of the present application.
  • VPC virtual private cloud
  • a virtual private cloud is a dynamically provisioned pool of public cloud computing resources that requires the use of encryption protocols, tunneling protocols and other security procedures to transfer data between enterprises and cloud service providers.
  • VPC builds an isolated virtual network environment for elastic cloud servers that users configure and manage independently, improve the security of resources in the user cloud, and simplify the network deployment of users.
  • Security groups, virtual private networks (virtual private networks) can be defined in VPC. With network features such as VPN), IP address segment, and bandwidth, tenants can easily manage and configure internal networks through VPC, and make secure and fast network changes.
  • IPVlan Internet Protocol Virtual Local Area Network
  • IPVlan can virtualize multiple virtual network sub-interfaces from one host interface, each sub-interface has the same MAC address, when using dynamic host configuration protocol (dynamic host configuration protocol, DHCP) to assign IP, need Configure the unique host ID (clientID) field as the machine ID.
  • IPVlan has two different working modes. A parent interface (ie, host interface) can only choose one of the modes, and cannot use mixed mode. All virtual devices attached to it can only choose one of them. All sub-interfaces will run in this mode.
  • Namespace is a powerful feature of the Linux kernel, which brings great convenience to the implementation of container virtualization. Using this feature, each container can have its own separate namespace, and applications running in it seem to operate independently As in the system environment, the naming mechanism ensures that containers do not affect each other. With the gradual improvement of the namespace function of the Linux system, processes have now been run in isolated namespaces, although these processes still share the same The kernel and some runtime environments (such as some system commands and system libraries) are invisible to each other and consider themselves exclusive to the system.
  • a security group is a logical grouping that provides access policies for ECSs within the same VPC that have the same security protection requirements and trust each other.
  • tenants can define various access rules in the security group, such as outbound rules and inbound rules. These rules control access to the network traffic in and out of the ECS within the security group. After the security group, it is protected by these access rules.
  • An elastic network interface is a logical network component in a VPC, representing a virtual network card.
  • ENI is an elastic network interface bound to a cloud server in a private network and can be freely migrated between multiple cloud servers. Bind multiple network cards to the cloud server to implement a high-availability network, or bind multiple intranet IPs to the elastic network card to achieve single-host multi-IP deployment.
  • a virtual machine refers to a complete computer system with complete hardware system functions through a software model and running in a completely isolated environment. All work that can be done in a physical computer can be implemented in a VM. When creating a VM, part of the hard disk and memory capacity of the physical computer needs to be used as the hard disk and capacity of the VM. Each VM has an independent hard disk and operating system, etc. Operates virtual machines as if they were physical machines.
  • Container is a virtualization technology in computer operating systems, which makes processes run in relatively independent and isolated environments (including independent file systems, namespaces, resource views, etc.), thereby simplifying the software deployment process. , enhance the portability and security of software, and improve the utilization rate of system resources.
  • Container technology is widely used in service-oriented scenarios in the field of cloud computing.
  • Network port network interface, such as eth0, eth0, the network interface represents a network card in the operating system.
  • Sub-interface The sub-interface virtualized by the network interface, such as eth0.1, eth0.2, is the sub-network card virtualized from this network card, and the sub-interface represents the virtual sub-network card of the network card in the operating system.
  • the above-mentioned network card may be a physical network card, or a virtual network card allocated for use by the virtual machine.
  • the SubIP of the virtual machine interface is required to support containers.
  • the host 100 and the host 200 are connected through a hypervisor (HyperVisor) tunnel, a virtual machine 110 and a hypervisor 120 are running in the host 100 , and a container 1110 and a container are deployed in the virtual machine 110 1120, the IP of the interface of the virtual machine 110 is: 10.1.0.100.
  • the IP corresponding to the container 1110 can be configured as: 10.1.
  • each SubIP creates a logical interface in the virtual machine 110 through IPVlan, and associates the created logical interface with the container namespace, so that Each container corresponds to a logical interface.
  • the host 200 is similar to the host 100.
  • SubIPs are configured for the container 2110 and the container 2120 deployed in the virtual machine 210 through the same method described above, and corresponding logical interfaces are created. After the above configuration is completed, the containers can communicate normally. For example, the container 1110 in the virtual machine 110 can communicate with the container 2110 in the virtual machine 210.
  • SubIP needs to be converted into a logical interface to bind the container namespace, and the container address and the virtual machine address are in the same network segment. If the container is migrated to another If the virtual machine is not in the same network segment as the original virtual machine address, you need to modify the container address.
  • the network security group adopts the port model, a security group cannot be used to express a container application, and the network security group cannot be used to implement container security, resulting in complicated configuration of container access policies, and network services such as ELB and EIP do not support SubIP, so Containers also cannot support network services such as ELB and EIP.
  • the host 300 and the host 400 are connected through the HyperVisor tunnel, they belong to the same VPC, the virtual machine 310 and the hypervisor 320 are running in the host 300, and the container 3110 and the container 3120 are deployed in the virtual machine 310 And gateway 3130, the interface IP of virtual machine 310 is: 10.1.0.100, container 3110 and container 3120 use a fixed IP address segment, for example, the IP corresponding to container 3110 is: 192.168.1.2, and the IP corresponding to container 3120 is: 192.168. 1.3.
  • the container 4110 and the container 4120 deployed in the virtual machine 410 running on the host 400 also use a fixed IP address segment.
  • the IP corresponding to the container 4110 is: 192.168.2.2
  • the IP corresponding to the container 4120 is: 192.168. 2.3.
  • the address segment from 192.168.1.0 to 192.168.1.16 corresponds to virtual machine 310
  • the address segment from 192.168.2.0 to 192.168.2.16 corresponds to virtual machine 410.
  • the obtained routing table is saved in the gateway of each virtual machine (eg gateway 3130 and gateway 4130), so that different containers can communicate normally.
  • a container needs to access a container in another virtual machine, it can use VPC to automatically Define the entry of the routing table for access.
  • the network security group cannot be used to implement container security, it cannot support network services such as ELB and EIP, and it cannot be used to access cloud services such as object storage service (OBS).
  • OBS object storage service
  • the present application provides a public cloud network configuration method and related equipment.
  • the method is applied to a cloud management platform, and the network port of the virtual machine that needs to be configured with a sub-interface is identified through the network port identifier of the virtual machine input by the tenant. port, and set the network port to obtain a sub-interface, and use the sub-interface obtained by setting to support applications such as containers in the virtual machine, so that the container has the same network capabilities as the virtual machine, and the network security group can be used to implement the container. Secure and support various network services.
  • NFV network function virtualization
  • FIG. 3 is a schematic diagram of a system architecture provided by an embodiment of the present application.
  • the system includes a virtual machine 310 and a virtual machine 320.
  • the virtual machine 310 has two Ethernet ports, namely the network port 3110 and the network port 3120, wherein for the network port 3110, two sub-interfaces are set, namely The sub-interface 3111 and the sub-interface 3112 are provided with the sub-interface 3121 for the network port 3120.
  • each sub-interface is a sub-interface of ENI inside the virtual machine, each sub-interface corresponds to a unique VlanID, each sub-interface can be bound to a different subnet from the network port, and the subnet can belong to different VPCs .
  • network port 3110, sub-interface 3111, sub-interface 3112, and sub-interface 3211 all belong to subnet 1
  • network port 3120 and network port 3210 belong to subnet 2
  • sub-interface 3121 and sub-interface 3212 belong to subnet 3.
  • 1 and subnet 2 belong to the same VPC, namely VPC1, and subnet 3 belongs to VPC2.
  • FIG. 4 is a schematic flowchart of a network configuration method for a public cloud according to an embodiment of the present application. As shown in Figure 4, the method includes but is not limited to the following steps:
  • S401 The network configurator provides an input interface for the tenant.
  • the network configurator provides an input interface to the tenant to receive the virtual machine network port identifier input by the tenant. Since the virtual machine network port identifier is unique, the network configurator can use the virtual machine network port identifier input by the tenant to display the data in the public cloud. Select the virtual machine corresponding to the virtual machine network port identifier in the center, and determine the network port that needs to be configured in the virtual machine.
  • the virtual machine network port identifier may be the network port 3110 in FIG. 3 above.
  • the input interface provided by the network configurator may include a configuration interface, an API interface, and an input template, and the network configurator may choose any method to receive the virtual machine network port identifier input by the tenant, which is not limited in this application.
  • the network configurator receives the configuration information of the sub-interface input by the tenant.
  • the network configurator further receives the configuration information of the sub-interface corresponding to the network port input by the tenant, so that the cloud management platform can configure the sub-interface according to the received configuration information of the sub-interface .
  • the configuration information of the sub-interface may include the subnet information of the sub-interface and the VlanID of the sub-interface, and the sub-interface may be configured after acquiring the subnet information and the VlanID of the sub-interface. It can be understood that by configuring the subnet and VlanID for the sub-interface, it can be ensured that the configured sub-interface and the network port of the virtual machine have the same network capability and can support various network services.
  • the tenant inputs the virtual machine network port identifier, the subnet information and VlanID of the sub-interface in the configuration interface, and the tenant inputs After completing the relevant parameter configuration, click the OK button in the interface, and the cloud management platform can configure the sub-interface according to the configuration information entered by the tenant.
  • S403 The network configurator notifies the virtual machine manager to set the sub-interface.
  • the network configurator determines the server where the virtual machine corresponding to the virtual machine network port identifier is located according to the virtual machine network port identifier input by the tenant, and then notifies the virtual machine manager of the server to set a sub-network port under the virtual machine network port. interface.
  • the virtual machine manager creates a SubENI corresponding to the container inside the virtual machine, then creates a corresponding VLAN sub-interface, and assigns the sub-interface to the corresponding container network namespace.
  • the sub-interface will pass the dynamic host configuration protocol. (dynamic host configuration protocol, DHCP) automatically obtains an IP for subsequent communication with each other.
  • DHCP dynamic host configuration protocol
  • SubENI is a network interface in the system, and its API model is consistent with the existing ENI API model. For other network services that use network interfaces, they cannot perceive the difference between SubENI and ENI. Since the API model of SubENI is consistent with the API model of ENI, when creating SubENI, the API interface of SubENI is directly extended on the API of ENI, but three attributes are added, namely: interface type, main interface ID and child interface VLAN corresponding to the interface, where the interface type is represented by a string, including the ENI main interface and SubENI sub-interface; the main interface ID is also represented by a string, which is valid when the interface type is a SubENI sub-interface, indicating that the main interface is a sub-interface.
  • the ID of the interface; the VLAN corresponding to the sub-interface is represented by an integer, and its content is the VlanID of the sub-interface.
  • This value can be an available VlanID that is automatically allocated in the VLAN space of the main interface when the SubENI is created by the virtual machine manager, or It is specified by the tenant, but must ensure that the specified value does not conflict in the VLAN space of the main interface.
  • the value ranges from 1 to 4094.
  • FIG. 6 is a schematic diagram of a sub-interface setting scenario provided by an embodiment of the present application.
  • the virtual machine 610, the virtual machine 620, and the virtual machine manager 630 belong to the same VPC on the public cloud, and communicate with each other through ENI.
  • the virtual machine 610 is deployed with network ports 6110, 6120, Node agent (kubelet) 6130, container 6140, container 6150, container 6160 and container 6170, virtual machine 620 deploys network port 6210, node agent 6220, container 6230 and container 6240, virtual machine manager 630 includes network port 6310 and management Program 6320, the management program 6320 calls the API of the public cloud through the API gateway provided by the public cloud, and creates the SubENI corresponding to the container in the virtual machine 610.
  • the node agent 6130 Create VLAN sub-interfaces corresponding to SubENI, namely sub-interface 6111, sub-interface 6112, sub-interface 6113 and sub-interface 6114, and assign the sub-interfaces to the corresponding container network namespace, for example, assign sub-interface 6111 to container 6140,
  • the interface 6112 is classified as a container 6150
  • the sub-interface 6113 is classified as a container 6160
  • the sub-interface 6114 is classified as a container 6170
  • the SubENI corresponding to the container is created in the virtual machine 620, and then the sub-ENI corresponding to the SubENI is created through the node agent 6220.
  • Interface 6211 and sub-interface 6212 and sub-interface 6211 is classified as container 6230, and sub-interface 6212 is classified as container 6240.
  • each sub-interface will automatically obtain an IP through DHCP.
  • each container can communicate with each other to achieve business interoperability, and each container can support various network services. Same networking capabilities as virtual machines.
  • the sub-interface is bound to a container in the virtual machine, and the container processes network packets through the sub-interface.
  • the container since the sub-interface has subnet information and VlanID, after the sub-interface is bound to the container in the virtual machine, the container has the same network capabilities as the virtual machine, and can process network packets through the sub-interface.
  • a virtual machine 7110 and a virtual switch 7120 are deployed in the host 710, a container 71110 and a container 71120 are deployed in the virtual machine 7110, the container 71110 is bound to the sub-interface 71111, and the container 71120 is connected to the sub-interface 71121 Binding.
  • the structure of the host 720 is similar to that of the host 710. It also deploys a virtual machine 7210 and a virtual switch 7220. The virtual machine 7210 deploys the container 72110 and the container 72120. 72121 binding.
  • the packet sent by the container 71110 through the sub-interface 71111 is a packet carrying the VlanID, namely packet 1, which includes a 6-bit destination address and a 6-bit source address.
  • VlanID virtual local area network identification
  • 2-bit message type and payload after virtual switch 7120 receives message 1, according to the VlanID of sub-interface 71111 that sent the message, find the corresponding sub-interface 71111
  • the routing table that is, the VPC routing table
  • VxLAN encapsulates the packet 1 according to the routes in the routing table.
  • the virtual switch 7120 deletes the VLAN ID field of the packet 1, and uses the destination interface information (that is, sub-interface 72111) VxLAN encapsulation obtains packet 2. Compared with packet 1, packet 2 adds a tunnel endpoint field, an 8-bit user datagram protocol (UDP) field and a destination interface field (such as the destination interface) to its header. The subnet to which it belongs or the VPC to which the destination interface belongs), the VLAN ID field is removed. The virtual switch 7120 sends the packet 2 to the virtual switch 7220.
  • UDP 8-bit user datagram protocol
  • the virtual switch 7220 After receiving the packet 2, the virtual switch 7220 finds the corresponding routing table (ie, the VPC routing table) according to the destination interface field in the packet 2, and then removes the packet 2
  • the tunnel endpoint field, UDP field and destination interface field then look up the table and forward according to the destination address in the message, determine that it is the sub-interface 72111 in the virtual machine 7210, and add the virtual local area network identification field.
  • the virtual local area network identifier added here is It is different from the VLAN ID in the message 1.
  • the message 3 is obtained, and finally the message 3 is sent to the virtual machine 7210.
  • the virtual machine 7210 After the virtual machine 7210 receives the message 3, it will remove the virtual LAN ID field in it. Then it is sent to the container 72110 through the sub-interface 72111, and finally the communication between the container 71110 and the container 72110 is successfully realized.
  • the configuration information of the sub-interface further includes a security group rule, where the security group rule is used to perform security group processing on the packet of the container bound to the sub-interface.
  • a security group can be used to express a container application, and then the security group processing is performed on the container packets bound to the sub-interface to ensure that the container App access security.
  • an application uses a security group, the security within the security group is trustworthy, and different applications can configure access policies through the security policies between the security groups.
  • a container 8110, a container 8120, a container 8130, and a container 8140 are deployed in the virtual machine 810, wherein the container 8110 is bound to the sub-interface 8111, the container 8120 is bound to the sub-interface 8121, and the container 8130 is bound to sub-interface 8131, container 8140 is bound to sub-interface 8141; container 8210 and container 8220 are deployed in virtual machine 820, container 8210 is bound to sub-interface 8211, and container 8220 is bound to sub-interface 8221 .
  • sub-interface 8111 can directly access sub-interface 8131
  • sub-interface 8141 can directly access sub-interface 8221.
  • Different security groups can use the default security group rules or set security group rules as needed to meet the The actual need and guarantee of container application access security.
  • sub-interface 8111 can access sub-interface 8121 and sub-interface 8211, but sub-interface 81221 and sub-interface 8211 cannot access sub-interface 8111. Interface 8111 and sub-interface 8131.
  • configuring a sub-interface into a security group can ensure that when a container is migrated, the security group to which it belongs will not change, and the access between containers still follows the security group rules, and there is no need to modify the container address and perform additional related tasks.
  • Access policy configuration For example, if the container 8110 is migrated to the virtual machine 820, the sub-interface 8111 still belongs to the security group 1.
  • S404 The network configurator provides the information of the sub-interface to the tenant.
  • the virtual machine manager After the virtual machine manager completes the sub-interface configuration, it will obtain relevant information of the sub-interface, such as the sub-interface identifier of the sub-interface, the private network address and subnet information of the sub-interface, the MAC address of the sub-interface and the VlanID of the sub-interface, The information of the sub-interface is then provided to the tenant so that the tenant can configure various network services for the sub-interface.
  • S405 The network configurator configures the network service for the container through the sub-interface.
  • the network capability of the container is the same as the network capability of the virtual machine. All network services that the virtual machine can support can also be supported by the container, such as mounting ELB and binding EIP. , access to OBS, etc., which can expand the applicable scenarios of containers.
  • FIG. 9 is a schematic structural diagram of a network device provided by an embodiment of the present application.
  • the network device may be the network configurator in the method embodiment described in FIG. 4, and may execute the public cloud described in FIG. 4.
  • the network configurator is used as the main body of the method and steps.
  • the network device 900 includes a receiving module 910 and a processing module 920 . in,
  • a receiving module 910 configured to receive the virtual machine network port identifier input by the tenant, where the virtual machine network port identifier is used to identify the network port of the virtual machine that needs to configure the sub-interface;
  • the processing module 920 is configured to determine the network port of the virtual machine corresponding to the virtual machine network port identifier, set a sub-interface for the network port, and provide information of the sub-interface to the tenant.
  • the receiving module 910 is configured to execute the aforementioned steps S401 and S402, and optionally execute the optional methods in the aforementioned steps
  • the processing module 920 is configured to execute the aforementioned steps S403-S405, and optionally execute the aforementioned steps Optional method in step.
  • the above-mentioned two modules can transmit data to each other through a communication channel.
  • each module included in the network device 900 may be a software module, a hardware module, or a part of a software module and a part of a hardware module.
  • the receiving module 910 is further configured to receive configuration information of the sub-interface input by the tenant; the processing module 920 is further configured to configure the sub-interface according to the configuration information.
  • the sub-interface is bound to a container in the virtual machine, and the container processes network packets through the sub-interface.
  • the configuration information of the sub-interface includes a security group rule, and the security group rule is used to perform security group processing on the packet of the container bound to the sub-interface.
  • the configuration information of the sub-interface includes subnet information of the sub-interface and a virtual local area network identifier VlanID of the sub-interface.
  • the processing module 920 is specifically configured to: determine the server where the virtual machine corresponding to the virtual machine network port identifier is located; notify the virtual machine manager of the server that the network port of the virtual machine is located Set the sub-interface below.
  • the information of the sub-interface includes a sub-interface identifier UUID of the sub-interface, a private network address and subnet information of the sub-interface, a MAC address of the sub-interface, and the sub-interface One or any combination of the VLAN IDs VlanID.
  • the input interface includes a configuration interface, an application programming interface API, and an input template.
  • the receiving module 910 in this embodiment of the present application may be implemented by a transceiver or a transceiver-related circuit component
  • the processing module 920 may be implemented by a processor or a processor-related circuit component.
  • each module in the network device may be added, reduced or combined as required.
  • the operation and/or function of each module in the network device is to implement the corresponding flow of the method described in FIG. 4 , which is not repeated here for brevity.
  • FIG. 10 is a schematic structural diagram of a computing device provided by an embodiment of the present application.
  • the computing device 10 includes a processor 11 , a communication interface 12 and a memory 13 , and the processor 11 , the communication interface 12 and the memory 13 are connected to each other through an internal bus 14 .
  • the computing device 10 may be a computing device in a public cloud.
  • the processor 11 may be composed of one or more general-purpose processors, such as a central processing unit (central processing unit, CPU), or a combination of a CPU and a hardware chip.
  • the above-mentioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof.
  • ASIC application-specific integrated circuit
  • PLD programmable logic device
  • the above-mentioned PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (generic array logic, GAL) or any combination thereof.
  • CPLD complex programmable logic device
  • FPGA field-programmable gate array
  • GAL general array logic
  • the bus 14 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus or the like.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the bus 14 can be divided into an address bus, a data bus, a control bus, and the like. For ease of presentation, only one thick line is used in FIG. 10, but it does not mean that there is only one bus or one type of bus.
  • the memory 13 may include a volatile memory (volatile memory), such as random access memory (RAM); the memory 730 may also include a non-volatile memory (non-volatile memory), such as a read-only memory (read- only memory, ROM), flash memory (flash memory), hard disk drive (hard disk drive, HDD) or solid-state drive (solid-state drive, SSD); the memory 13 may also include a combination of the above types.
  • volatile memory such as random access memory (RAM)
  • the memory 730 may also include a non-volatile memory (non-volatile memory), such as a read-only memory (read- only memory, ROM), flash memory (flash memory), hard disk drive (hard disk drive, HDD) or solid-state drive (solid-state drive, SSD); the memory 13 may also include a combination of the above types.
  • non-volatile memory such as a read-only memory (read- only memory, ROM), flash memory (flash memory), hard disk drive (hard disk drive, HDD) or solid
  • the memory 13 of the computing device 10 stores codes corresponding to each module of the network device 900, and the processor 11 executes the codes to implement the functions of each module of the network device 900, that is, executes the methods of S401-S405.
  • the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, any part of any one of the foregoing method embodiments can be implemented or all steps.
  • the embodiment of the present invention also provides a computer program, the computer program includes instructions, when the computer program is executed by the computer, the computer can execute part or all of the steps of any method for issuing regional resources.
  • the disclosed apparatus may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative, for example, the division of the above-mentioned units is only a logical function division, and other division methods may be used in actual implementation, for example, multiple units or components may be combined or integrated. to another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical or other forms.
  • the units described above as separate components may or may not be physically separated, and components shown as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供一种公有云的网络配置方法及相关设备。其中，该方法应用于云管理平台，包括：为租户提供输入接口，所述输入接口用于接收所述租户输入的虚拟机网口标识，所述虚拟机网口标识用于识别需要配置子接口的虚拟机的网口；确定所述虚拟机网口标识对应的虚拟机的网口，为所述网口设置子接口，并将所述子接口的信息提供给所述租户。上述方法能够对虚拟机的网口设置子接口，以实现虚拟机中的容器等通过设置的子接口使用公有云上的云服务，具备与虚拟机相同的网络能力。

Description

一种公有云的网络配置方法及相关设备 技术领域
本发明涉及云计算技术领域，尤其涉及一种公有云的网络配置方法及相关设备。
背景技术
云计算作为近年来新兴的产业，获得了科研界和产业界的广泛关注。云计算在全世界范围的兴起，以其灵活、高效、低成本、节能的运作方式成为推动产业绿色发展的重要引擎和21世纪新的商业平台。在公有云场景下，租户在公有云上部署虚拟机(virtual machine，VM)时，需要为虚拟机在租户的虚拟私有云(virtual private cloud，VPC)内的子网(subnet)内创建接口(interface)，用以和VPC内其它的虚拟机进行通信。
现有公有云技术在虚拟机内支持容器，而容器之间的通信通过接口的子网际互连协议(Sub IP)支持，对每个虚拟机的接口，可以配置与接口IP相同网段的Sub IP，每个Sub IP通过IP虚拟局域网(virtual local area network，VLAN)的方式在虚拟机内创建逻辑接口，并将逻辑接口与容器网络名空间关联。这种通信方式难以利用网络安全组实现容器通信安全且通信策略配置复杂，而且需要依赖IP VLAN模块将Sub IP转换为逻辑接口，容器地址与虚拟机的接口地址在同一个网段，容器发生迁移时可能将会导致地址修改，此外，由于弹性负载均衡(elastic load balance，ELB)、弹性公网IP(elastic IP，EIP)等网络服务不支持Sub IP模型，因此，部署于虚拟机内的容器也不能支持ELB、EIP等网络服务。
发明内容
本发明实施例公开了一种公有云的网络配置方法及相关设备，能够对虚拟机的网口设置子接口，以实现虚拟机中的容器等通过设置的子接口使用公有云上的云服务，具备与虚拟机相同的网络能力。
第一方面，本申请提供一种公有云的网络配置方法，所述方法包括：为租户提供输入接口，所述输入接口用于接收所述租户输入的虚拟机网口标识，所述虚拟机网口标识用于识别需要配置子接口的虚拟机的网口；确定所述虚拟机网口标识对应的虚拟机的网口，为所述网口设置子接口，并将所述子接口的信息提供给所述租户。
在本申请提供的方案中，根据租户输入的虚拟机网口标识从而确定虚拟机的网口并为该网口配置子接口，然后将子接口的信息提供给租户，以使得虚拟机中的容器等可以通过配置的子接口使用公有云上的云服务，具备与虚拟机等同的网络能力。
结合第一方面，在第一方面的一种可能的实现方式中，所述输入接口还用于接收租户输入的所述子接口的配置信息，所述云管理平台根据所述配置信息配置所述子接口。
在本申请提供的方案中，租户通过输入子接口配置信息以使云管理平台配置子接口，保证配置得到的子接口具备与虚拟机相同的网络能力。
结合第一方面，在第一方面的一种可能的实现方式中，所述子接口与所述虚拟机中的容器绑定，所述容器通过所述子接口进行网络报文处理。
在本申请提供的方案中，通过将配置的子接口与虚拟机中的容器绑定，可以保证容器之间可以利用配置的子接口进行相互通信，从而完成网络报文处理，简化了容器通信过程。
结合第一方面，在第一方面的一种可能的实现方式中，所述子接口的配置信息包括安全组规则，所述安全组规则用于对绑定所述子接口的所述容器的报文进行安全组处理。
在本申请提供的方案中，可以利用网络安全组实现容器访问安全，简化了容器访问策略配置。
结合第一方面，在第一方面的一种可能的实现方式中，所述子接口的配置信息包括所述子接口的子网信息以及所述子接口的虚拟局域网标识VlanID。
在本申请提供的方案中，利用子接口的子网信息和VlanID对子接口进行配置，保证所配置得到的子接口具备与虚拟机的主接口相同的网络能力。
结合第一方面，在第一方面的一种可能的实现方式中，确定所述虚拟机网口标识对应的虚拟机所在的服务器；通知所述服务器的虚拟机管理器在所述虚拟机的所述网口下设置所述子接口。
在本申请提供的方案中，网络配置器在接收到租户输入的虚拟机网口标识之后，首先确定该虚拟机网口标识对应的虚拟机所在的服务器，然后通知该服务器中的虚拟机管理器完成子接口的配置。
结合第一方面，在第一方面的一种可能的实现方式中，所述子接口的信息包括所述子接口的子接口标识UUID、所述子接口的私网地址和子网信息、所述子接口的MAC地址以及所述子接口的VlanID中的一者或任意组合。
结合第一方面，在第一方面的一种可能的实现方式中，所述输入接口包括配置界面、应用程序编程接口API和输入模板。
在本申请提供的方案中，租户通过网络配置器提供的配置界面、API和输入模板输入虚拟机网口标识和子接口配置信息，从而使得网络配置器能够完成子接口配置，使得配置得到的子接口具体与虚拟机的主接口相同的网络能力。
第二方面，本申请提供了一种网络设备，包括：接收模块，用于接收租户输入的虚拟机网口标识，所述虚拟机网口标识用于识别需要配置子接口的虚拟机的网口；处理模块，用于确定所述虚拟机网口标识对应的虚拟机的网口，为所述网口设置子接口，并将所述子接口的信息提供给所述租户。
结合第二方面，在第二方面的一种可能的实现方式中，所述接收模块，还用于接收所述租户输入的所述子接口的配置信息；所述处理模块，还用于根据所述配置信息配置所述子接口。
结合第二方面，在第二方面的一种可能的实现方式中，所述子接口与所述虚拟机 中的容器绑定，所述容器通过所述子接口进行网络报文处理。
结合第二方面，在第二方面的一种可能的实现方式中，所述子接口的配置信息包括安全组规则，所述安全组规则用于对绑定所述子接口的所述容器的报文进行安全组处理。
结合第二方面，在第二方面的一种可能的实现方式中，所述子接口的配置信息包括所述子接口的子网信息以及所述子接口的虚拟局域网标识VlanID。
结合第二方面，在第二方面的一种可能的实现方式中，所述处理模块，具体用于：确定所述虚拟机网口标识对应的虚拟机所在的服务器；通知所述服务器的虚拟机管理器在所述虚拟机的所述网口下设置所述子接口。
结合第二方面，在第二方面的一种可能的实现方式中，所述子接口的信息包括所述子接口的子接口标识UUID、所述子接口的私网地址和子网信息、所述子接口的媒体存取控制MAC地址以及所述子接口的虚拟局域网标识VlanID中的一者或任意组合。
结合第二方面，在第二方面的一种可能的实现方式中，所述输入接口包括配置界面、应用程序编程接口API和输入模板。
第三方面，本申请提供了一种计算设备，所述计算设备包括处理器和存储器，所述存储器用于存储程序代码，所述处理器用于调用所述存储器中的程序代码执行上述第一方面以及结合上述第一方面中的任意一种实现方式的方法。
第四方面，本申请提供了一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，当该计算机程序被处理器执行时，可以实现上述第一方面以及结合上述第一方面中的任意一种实现方式所提供的公有云的网络配置方法的流程。
第五方面，本申请提供了一种计算机程序产品，该计算机程序产品包括指令，当该计算机程序被计算机执行时，使得计算机可以执行上述第一方面以及结合上述第一方面中的任意一种实现方式所提供的公有云的网络配置方法的流程。
附图说明
为了更清楚地说明本发明实施例技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请实施例提供的一种虚拟机中部署容器的场景示意图；
图2是本申请实施例提供的又一种虚拟机中部署容器的场景示意图；
图3是本申请实施例提供的一种系统架构的结构示意图；
图4是本申请实施例提供的一种公有云的网络配置方法的流程示意图；
图5是本申请实施例提供的一种配置界面的示意图；
图6是本申请实施例提供的一种设置子接口的场景示意图；
图7是本申请实施例提供的一种网络报文处理的示意图；
图8是本申请实施例提供的一种子接口的安全组配置示意图；
图9是本申请实施例提供的一种网络设备的结构示意图；
图10是本申请实施例提供的一种计算设备的结构示意图。
具体实施方式
下面结合附图对本申请实施例中的技术方案进行清楚、完整的描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
在本文中提及“实施例”意味着，结合实施例描述的特定特征、结构或特性可以包含在本申请的至少一个实施例中。在说明书中的各个位置出现该短语并不一定均是指相同的实施例，也不是与其它实施例互斥的独立的或备选的实施例。本领域技术人员显式地和隐式地理解的是，本文所描述的实施例可以与其它实施例相结合。
首先，结合附图对本申请中所涉及的部分用语和相关技术进行解释说明，以便于本领域技术人员理解。
虚拟私有云(virtual private cloud，VPC)是一个公共云计算资源的动态配置池，需要使用加密协议、隧道协议和其它安全程序，在企业和云服务提供商之间传输数据。VPC为弹性云服务器构建隔离的、用户自主配置和管理的虚拟网络环境，提升用户云中资源的安全性，简化用户的网络部署，可以在VPC中定义安全组、虚拟专用网(virtual private network，VPN)、IP地址段、带宽等网络特性，租户可以通过VPC方便的管理、配置内部网络，进行安全快捷的网络变更。
网际协议虚拟局域网(IPVlan)可以从一个主机接口虚拟出多个虚拟网络子接口，每个子接口都具有相同的MAC地址，当使用动态主机配置协议(dynamic host configuration protocol，DHCP)分配IP时，需要配置唯一的主机标识(clientID)字段作为机器的标识，IPVlan有两种不同的工作模式，一个父接口(即主机接口)只能选择其中一种模式，不能采用混用模式，依附于它的所有虚拟子接口都会运行在这个模式下。
命名空间是Linux内核的一个强大特性，为容器虚拟化的实现带来极大便利，利用这个特性，每个容器都可以拥有自己单独的命名空间，运行在其中的应用都像是在独立的操作系统环境中一样，命名机制保证了容器之间彼此互不影响，随着Linux系统对于命名空间功能的逐步完善，现在已经让进程在彼此隔离的命名空间中运行，虽然这些进程仍在共用同个内核和某些运行环境(例如一些系统命令和系统库)，但是彼此之间是不可见的，并且认为自己是独占系统的。
安全组是一个逻辑上的分组，为同一个VPC内具有相同安全保护需求并相互信任的弹性云服务器提供访问策略。安全组创建后，租户可以在安全组中定义各种访问规则，例如出方向规则和入方向规则，这些规则会对安全组内部的弹性云服务器出入方向网络流量进行访问控制，当弹性云服务器加入该安全组后，即受到这些访问规则的保护。
弹性网络接口(elastic network interface，ENI)是VPC中的一个逻辑网络组 件，代表虚拟网卡，ENI是绑定私有网络内云服务器的一种弹性网络接口，可在多个云服务器间自由迁移，可以在云服务器上绑定多个网卡实现高可用网络或者在弹性网卡上绑定多个内网IP，实现单主机多IP部署。
虚拟机(virtual machine，VM)是指通过软件模型的具有完整硬件系统功能的、运行在一个完全隔离环境中的完整计算机系统。实体计算机中能够完成的工作在VM中都能够实现，在创建VM时，需要将实体计算机的部分硬盘和内存容量作为VM的硬盘和容量，每个VM都有独立的硬盘和操作系统等，可以像使用实体机一样对虚拟机进行操作。
容器(container)是计算机操作系统中的一种虚拟化技术，该技术使得进程运行于相对独立和隔离的环境(包含独立的文件系统、命名空间、资源视图等)，从而能够简化软件的部署流程，增强软件的可移植性和安全性，提高系统资源的利用率，容器技术广泛应用于云计算领域的服务化场景。
网口：网络接口，例如为eth0，eth0，网络接口在操作系统中表示一个网卡。
子接口：由网络接口虚拟出来的子接口，例如为eth0.1，eth0.2，具体是从此网卡上虚拟出来的子网卡，子接口在操作系统中表示网卡虚拟出来的子网卡。
其中，上述的网卡可以是物理网卡，或者是分配给虚拟机使用的虚拟网卡。
在租户虚拟机中部署容器化应用的场景中，需要通过虚拟机接口的SubIP以支持容器。如图1所示，主机100和主机200之间通过虚拟机监控程序(HyperVisor)隧道进行连接，主机100中运行着虚拟机110和虚拟机监控程序120，虚拟机110中部署了容器1110和容器1120，虚拟机110的接口的IP为：10.1.0.100，为了支持容器1110和容器1120，需要配置与虚拟机110接口IP相同网段的SubIP，例如可以将容器1110对应的IP配置为：10.1.0.101，将容器1120对应的IP配置为：10.1.0.102，在配置SubIP完成之后，每个SubIP通过IPVlan方式在虚拟机110内创建逻辑接口，并将创建的逻辑接口与容器名空间关联，以使得每个容器都对应一个逻辑接口。同理，主机200与主机100类似，通过上述相同的方法为虚拟机210中部署的容器2110和容器2120配置SubIP并创建相应的逻辑接口。在完成上述配置之后，容器之间就可以正常进行通信了，例如虚拟机110中的容器1110可以与虚拟机210中的容器2110进行通信。
可以看出，在图1所示的利用SubIP支持容器的场景中，需要将SubIP转换为逻辑接口才能绑定容器名空间，且容器地址与虚拟机地址在同一个网段，若容器迁移至别的虚拟机，与原来虚拟机地址不在同一个网段时，需要修改容器地址。此外，由于网络安全组采用端口模型，因此不能利用一个安全组来表达一个容器应用，无法利用网络安全组实现容器安全，导致容器访问策略配置复杂，且ELB、EIP等网络服务不支持SubIP，所以容器也无法支持ELB、EIP等网络服务。
或者，通过VPC内自定义路由表以支持容器。如图2所示，主机300和主机400之间通过HyperVisor隧道连接，它们属于同一个VPC，主机300中运行着虚拟机310和虚拟机监控程序320，虚拟机310中部署了容器3110、容器3120和网关3130，虚拟机310的接口IP为：10.1.0.100，容器3110和容器3120使用一个固定的IP地址 段，例如容器3110对应的IP为：192.168.1.2，容器3120对应的IP为：192.168.1.3，针对每个容器对应的IP，在虚拟机310内创建逻辑接口，并将创建的逻辑接口与容器名空间关联，以使得每个容器都对应一个逻辑接口。同理，主机400中运行的虚拟机410中所部署的容器4110和容器4120也使用一个固定的IP地址段，例如容器4110对应的IP为：192.168.2.2，容器4120对应的IP为：192.168.2.3，在虚拟机410内创建逻辑接口，并与容器名空间关联。之后，将IP地址段配置为VPC的路由表，示例性的，192.168.1.0至192.168.1.16的地址段对应虚拟机310，192.168.2.0至192.168.2.16的地址段对应虚拟机410，然后将配置得到的路由表保存至每个虚拟机的网关中(例如网关3130和网关4130)，这样，不同容器之间可以进行正常通信，当容器需要访问另一个虚拟机中的容器时，可以利用VPC自定义路由表的表项进行访问。
同样的，图2所示的利用VPC自定义路由表支持容器的场景中，也需要将容器对应的IP转换为逻辑接口才能绑定容器名空间，不同的虚拟机使用独立的网段，容器跨虚拟机迁移后需要修改容器地址，每个虚拟机内需要做转发网关以处理默认路由、地址解析协议(address resolution protocol，ARP)等，导致容器实现复杂。此外，也无法利用网络安全组实现容器安全，不能支持ELB、EIP等网络服务，也不能用于访问对象存储服务(object storage service，OBS)等云服务。
为了解决上述问题，本申请提供了一种公有云的网络配置方法及相关设备，该方法应用于云管理平台，通过租户输入的虚拟机网口标识，识别出需要配置子接口的虚拟机的网口，并对该网口进行设置得到子接口，利用设置得到的子接口以支持该虚拟机中的容器等应用程序，使得容器具备和虚拟机一样的网络能力，且可以利用网络安全组实现容器安全并支持各种网络服务。
本申请实施例的技术方案还可以应用于各种需要依赖于公有云下网络子接口的场景，包括但不限于网络功能虚拟化(network function virtualization，NFV)场景、虚拟机支持多租户、多VPC访问场景等。
图3是本申请实施例提供的一种系统架构的示意图。如图3所示，该系统包括虚拟机310和虚拟机320，虚拟机310存在两个以太网口，分别为网口3110和网口3120，其中针对网口3110，设置了两个子接口，即子接口3111和子接口3112，针对网口3120设置了子接口3121，虚拟机320中存在一个以太网口3210，针对该网口设置了两个子接口，分别为子接口3211和子接口3212。需要说明的是，各个子接口在虚拟机内部都是ENI的一个子接口，每个子接口对应唯一的VlanID，每个子接口都可以绑定与网口不同的子网，子网可以属于不同的VPC。例如，网口3110、子接口3111、子接口3112以及子接口3211都属于子网1，网口3120和网口3210属于子网2，子接口3121和子接口3212属于子网3，其中，子网1和子网2属于同一个VPC，即VPC1，子网3属于VPC2。
基于上述，下面对本申请实施例提供的公有云的网络配置方法及相关设备进行描述。参见图4，图4为本申请实施例提供的一种公有云的网络配置方法的流程示意图。 如图4所示，该方法包括但不限于以下步骤：
S401：网络配置器为租户提供输入接口。
具体地，网络配置器向租户提供输入接口以接收租户输入的虚拟机网口标识，由于虚拟机网口标识是唯一的，所以网络配置器可以根据租户输入的虚拟机网口标识在公有云数据中心中选择该虚拟机网口标识对应的虚拟机，并确定在该虚拟机中需要配置的网口。示例性的，该虚拟机网口标识可以是上述图3中的网口3110。
可选的，网络配置器所提供的输入接口可以包括配置界面、API接口和输入模板，网络配置器可以任意选择一种方式以接收租户输入的虚拟机网口标识，本申请对此不作限定。
S402：网络配置器接收租户输入的子接口的配置信息。
具体地，网络配置器在确定需要配置的网口之后，进一步接收租户输入的针对该网口对应的子接口的配置信息，以使得云管理平台可以根据接收到的子接口的配置信息配置子接口。
该子接口的配置信息可以包括子接口的子网信息以及子接口的VlanID，在获取到该子接口的子网信息以及VlanID之后可以配置子接口。可以理解，通过为子接口配置子网和VlanID，可以保证配置得到的子接口与虚拟机的网口具备相同的网络能力，能够支持各种网络服务。
示例性的，以网络配置器所提供的输入接口为配置界面为例，如图5所示，租户在该配置界面中输入虚拟机网口标识以及子接口的子网信息和VlanID，租户在输入完成相关参数配置之后，点击界面中的确认按钮，云管理平台即可以根据租户输入的配置信息配置子接口。
S403：网络配置器通知虚拟机管理器设置子接口。
具体地，网络配置器根据租户输入的虚拟机网口标识确定该虚拟机网口标识对应的虚拟机所在的服务器，然后通知该服务器的虚拟机管理器在所述虚拟机的网口下设置子接口。
进一步的，虚拟机管理器在虚拟机内部创建容器对应的SubENI，然后创建对应的VLAN子接口，并将该子接口划归对应的容器网络名空间，此时该子接口将通过动态主机配置协议(dynamic host configuration protocol，DHCP)自动获取IP，以便于后续相互进行通信。
需要说明的是，SubENI是系统中的网络接口，其API模型与已有的ENI的API模型一致，对于其它使用网络接口的网络服务来说，其感知不到SubENI与ENI的区别。由于SubENI的API模型与ENI的API模型一致，所以在创建SubENI时，对于SubENI的API接口是直接在ENI的API上进行扩展，但是增加了三个属性，分别为：接口类型、主接口ID和子接口对应的VLAN，其中，接口类型是用字符串进行表示的，包含ENI主接口和SubENI子接口；主接口ID也是用字符串进行表示的，是在接口类型为SubENI子接口时有效，表示主接口的ID；子接口对应的VLAN是用整数进行表示的，其内容为子接口的VlanID，该值可以是由虚拟机管理器创建SubENI时在主接口的VLAN空间中自动分配可用VlanID，或者是由租户指定，但必须保证所指定的值在主接口的VLAN空间中不发生冲突，该值的取值范围是1-4094。
示例性的，参见图6，图6是本申请实施例提供的一种设置子接口场景示意图。如图6所示，虚拟机610、虚拟机620和虚拟机管理器630属于公有云上的同一个VPC，它们之间通过ENI进行通信，虚拟机610中部署了网口6110、网口6120、节点代理(kubelet)6130、容器6140、容器6150、容器6160和容器6170，虚拟机620中部署了网口6210、节点代理6220、容器6230和容器6240，虚拟机管理器630包含网口6310和管理程序6320，管理程序6320通过公有云提供的API网关调用公有云的API，在虚拟机610中创建容器对应的SubENI，在创建SubENI时可以指定VLAN或者让公有云自行分配VLAN，然后通过节点代理6130创建SubENI对应的VLAN子接口，即子接口6111、子接口6112、子接口6113和子接口6114，并将子接口划归对应的容器网络名空间，例如将子接口6111划归为容器6140，将子接口6112划归为容器6150，将子接口6113划归为容器6160，将子接口6114划归为容器6170；以及在虚拟机620中创建容器对应的SubENI，然后通过节点代理6220创建SubENI对应的子接口6211和子接口6212，并将子接口6211划归为容器6230，将子接口6212划归为容器6240。在将子接口划归对应的容器网络名空间之后，各个子接口将通过DHCP自动获取IP，此时，各个容器之间可以进行通信以实现业务互通，且各个容器能够支持各种网络服务，具备与虚拟机相同的网络能力。
在一种可能的实现方式中，所述子接口与虚拟机中的容器绑定，所述容器通过所述子接口进行网络报文处理。
具体地，由于子接口具备子网信息和VlanID，因此在将子接口在与虚拟机中的容器绑定之后，容器具备和虚拟机一样的网络能力，可以通过子接口进行网络报文处理。
示例性的，如图7所示，主机710中部署了虚拟机7110和虚拟交换机7120，虚拟机7110中部署了容器71110和容器71120，容器71110与子接口71111绑定，容器71120与子接口71121绑定，主机720的结构与主机710类似，其同样部署了虚拟机7210和虚拟交换机7220，虚拟机7210中部署了容器72110和容器72120，容器72110与子接口72111绑定，容器72120与子接口72121绑定。若容器71110需要与容器72110进行通信，那么容器71110通过子接口71111发送的报文是一个携带VlanID的报文，即报文1，该报文1包括6比特的目的地址、6比特的源地址、4比特的虚拟局域网标识(VlanID)、2比特的报文类型和有效载荷，虚拟交换机7120在接收到报文1之后，根据发送该报文的子接口71111的VlanID，找到子接口71111对应的路由表(即VPC路由表)，之后根据路由表中的路由对报文1进行VxLAN封装，虚拟交换机7120删掉报文1的虚拟局域网标识字段，并使用目的接口信息(即子接口72111)进行VxLAN封装得到报文2，报文2与报文1相比，在其头部增加了隧道端点字段、8比特的用户数据报协议(user datagram protocol，UDP)字段和目的接口字段(例如目的接口所属的子网或者目的接口所属的VPC)，去掉了虚拟局域网标识字段。虚拟交换机7120将报文2发送至虚拟交换机7220，虚拟交换机7220在接收到报文2之后，根据报文2中的目的接口字段找到对应的路由表(即VPC路由表)，然后去掉报文2的隧道端点字段、UDP字段和目的接口字段，之后根据报文中的目的地址查表转发，确定是虚拟机7210中的子接口72111，添加虚拟局域网标识字段，应理解，这里添加的虚拟局域网标识与报文1中的虚拟局域网标识是不一样的，得到报文3，最后将报文3发送给 虚拟机7210，虚拟机7210在接收到报文3之后，将去掉其中的虚拟局域网标识字段，然后通过子接口72111发送给容器72110，最终成功实现容器71110和容器72110之间的通信。
在一种可能的实现方式中，所述子接口的配置信息还包括安全组规则，该安全组规则用于对绑定子接口的容器的报文进行安全组处理。
具体地，由于配置得到的子接口具备和虚拟机的主接口一样的网络能力，因此可以利用一个安全组来表达一个容器应用，然后对绑定子接口的容器报文进行安全组处理，保证容器应用访问安全。
进一步的，一个应用使用一个安全组，安全组内部安全可信，不同的应用之间可以通过安全组之间的安全策略配置访问策略。示例性的，如图8所示，虚拟机810中部署了容器8110、容器8120、容器8130和容器8140，其中容器8110与子接口8111进行绑定，容器8120与子接口8121进行绑定，容器8130与子接口8131进行绑定，容器8140与子接口8141进行绑定；虚拟机820中部署了容器8210和容器8220，容器8210与子接口8211进行绑定，容器8220与子接口8221进行绑定。将子接口8111和子接口8131配置到安全组1中，将子接口8121和子接口8211配置到安全组2中，将子接口8141和子接口8221配置到安全组3中，同一个安全组中的子接口可以互相访问，不受限制，例如子接口8111可以直接访问子接口8131，子接口8141可以直接访问子接口8221，不同安全组之间可以使用默认安全组规则或者根据需要设置安全组规则，以满足实际需要和保证容器应用访问安全。例如，若将安全组规则设置为安全组1允许访问安全组2，安全组2不允许访问安全组1，那么子接口8111可以访问子接口8121和子接口8211，子接口81221和子接口8211不能访问子接口8111和子接口8131。
此外，将子接口配置到安全组中，可以保证在容器发生迁移时，其所属的安全组不会发生改变，容器之间的访问仍遵循安全组规则，不需要修改容器地址以及额外的进行相关访问策略配置。例如，将容器8110迁移至虚拟机820中，那么子接口8111仍属于安全组1。
S404：网络配置器将子接口的信息提供给租户。
具体地，在虚拟机管理器完成子接口配置之后，将得到子接口的相关信息，例如子接口的子接口标识、子接口的私网地址和子网信息、子接口的MAC地址和子接口的VlanID，然后将子接口的信息提供给租户以使得租户可以为子接口配置各种网络服务。
S405：网络配置器通过子接口给容器配置网络服务。
具体地，子接口在与容器绑定之后，此时容器的网络能力与虚拟机的网络能力是一样的，所有虚拟机能够支持的网络服务，容器同样能够支持，例如挂载ELB、绑定EIP、访问OBS等，这样可以扩展容器的适用场景。
上述详细阐述了本申请实施例的方法，为了便于更好的实施本申请实施例的上述方案，相应地，下面还提供用于配合实施上述方案的相关设备。
参见图9，图9是本申请实施例提供的一种网络设备的结构示意图，该网络设备可以是上述图4所述的方法实施例中的网络配置器，可以执行图4所述的公有云的网 络配置方法实施例中以网络配置器为执行主体的方法和步骤。如图9所示，该网络设备900包括接收模块910和处理模块920。其中，
接收模块910，用于接收租户输入的虚拟机网口标识，所述虚拟机网口标识用于识别需要配置子接口的虚拟机的网口；
处理模块920，用于确定所述虚拟机网口标识对应的虚拟机的网口，为所述网口设置子接口，并将所述子接口的信息提供给所述租户。
具体地，所述接收模块910用于执行前述步骤S401和S402，且可选的执行前述步骤中可选的方法，所述处理模块920用于执行前述步骤S403-S405，且可选的执行前述步骤中可选的方法。上述两个模块之间互相可以通过通信通路进行数据传输，应理解，网络设备900包括的各模块可以软件模块、也可以为硬件模块、或部分为软件模块部分为硬件模块。
作为一个实施例，所述接收模块910，还用于接收所述租户输入的所述子接口的配置信息；所述处理模块920，还用于根据所述配置信息配置所述子接口。
作为一个实施例，所述子接口与所述虚拟机中的容器绑定，所述容器通过所述子接口进行网络报文处理。
作为一个实施例，所述子接口的配置信息包括安全组规则，所述安全组规则用于对绑定所述子接口的所述容器的报文进行安全组处理。
作为一个实施例，所述子接口的配置信息包括所述子接口的子网信息以及所述子接口的虚拟局域网标识VlanID。
作为一个实施例，所述处理模块920，具体用于：确定所述虚拟机网口标识对应的虚拟机所在的服务器；通知所述服务器的虚拟机管理器在所述虚拟机的所述网口下设置所述子接口。
作为一个实施例，所述子接口的信息包括所述子接口的子接口标识UUID、所述子接口的私网地址和子网信息、所述子接口的媒体存取控制MAC地址以及所述子接口的虚拟局域网标识VlanID中的一者或任意组合。
作为一个实施例，所述输入接口包括配置界面、应用程序编程接口API和输入模板。
可以理解，本申请实施例中的接收模块910可以由收发器或收发器相关电路组件实现，处理模块920可以由处理器或处理器相关电路组件实现。
需要说明的是，上述网络设备的结构仅仅作为一种示例，不应构成具体限定，可以根据需要对该网络设备中的各个模块进行增加、减少或合并。此外，该网络设备中的各个模块的操作和/或功能是为了实现上述图4所描述的方法的相应流程，为了简洁，在此不再赘述。
参见图10，图10是本申请实施例提供的一种计算设备的结构示意图。如图10所示，该计算设备10包括：处理器11、通信接口12以及存储器13，所述处理器11、通信接口12以及存储器13通过内部总线14相互连接。应理解，该计算设备10可以是公有云中的计算设备。
所述处理器11可以由一个或者多个通用处理器构成，例如中央处理器(central  processing unit，CPU)，或者CPU和硬件芯片的组合。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，ASIC)、可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)、现场可编程逻辑门阵列(field-programmable gate array，FPGA)、通用阵列逻辑(generic array logic，GAL)或其任意组合。
总线14可以是外设部件互连标准(peripheral component interconnect，PCI)总线或扩展工业标准结构(extended industry standard architecture，EISA)总线等。所述总线14可以分为地址总线、数据总线、控制总线等。为便于表示，图10中仅用一条粗线表示，但不表示仅有一根总线或一种类型的总线。
存储器13可以包括易失性存储器(volatile memory)，例如随机存取存储器(random access memory，RAM)；存储器730也可以包括非易失性存储器(non-volatile memory)，例如只读存储器(read-only memory，ROM)、快闪存储器(flash memory)、硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)；存储器13还可以包括上述种类的组合。
需要说明的是，计算设备10的存储器13中存储了网络设备900的各个模块对应的代码，处理器11执行这些代码实现了网络设备900的各个模块的功能，即执行了S401-S405的方法。
本申请还提供一种计算机可读存储介质，其中，所述计算机可读存储介质存储有计算机程序，当该计算机程序被处理器执行时，可以实现上述方法实施例中记载的任意一种的部分或全部步骤。
本发明实施例还提供一种计算机程序，该计算机程序包括指令，当该计算机程序被计算机执行时，使得计算机可以执行任意一种发放区域资源的方法的部分或全部步骤。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其它实施例的相关描述。
需要说明的是，对于前述的各方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本申请并不受所描述的动作顺序的限制，因为依据本申请，某些步骤可能可以采用其它顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本申请所必须的。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置，可通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如上述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性或其它的形式。
上述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到 多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。

Claims (18)

  1. 一种公有云的网络配置方法，其特征在于，所述方法应用于云管理平台，包括：
    为租户提供输入接口，所述输入接口用于接收所述租户输入的虚拟机网口标识，所述虚拟机网口标识用于识别需要配置子接口的虚拟机的网口；
    确定所述虚拟机网口标识对应的虚拟机的网口，为所述网口设置子接口，并将所述子接口的信息提供给所述租户。
  2. 如权利要求1所述的方法，其特征在于，所述输入接口还用于接收所述租户输入的所述子接口的配置信息，所述方法还包括：
    所述云管理平台根据所述配置信息配置所述子接口。
  3. 如权利要求1或2所述的方法，其特征在于，所述子接口与所述虚拟机中的容器绑定，所述容器通过所述子接口进行网络报文处理。
  4. 如权利要求3所述的方法，其特征在于，所述子接口的配置信息包括安全组规则，所述安全组规则用于对绑定所述子接口的所述容器的报文进行安全组处理。
  5. 如权利要求1至4任一项所述的方法，其特征在于，所述子接口的配置信息包括所述子接口的子网信息以及所述子接口的虚拟局域网标识VlanID。
  6. 如权利要求4或5所述的方法，其特征在于，所述确定所述虚拟机网口标识对应的虚拟机的网口，为所述网口设置子接口，并将所述子接口的信息提供给所述租户，包括：
    确定所述虚拟机网口标识对应的虚拟机所在的服务器；
    通知所述服务器的虚拟机管理器在所述虚拟机的所述网口下设置所述子接口。
  7. 如权利要求1至6任一项所述的方法，其特征在于，所述子接口的信息包括所述子接口的子接口标识UUID、所述子接口的私网地址和子网信息、所述子接口的媒体存取控制MAC地址以及所述子接口的虚拟局域网标识VlanID中的一者或任意组合。
  8. 如权利要求1至7任一项所述的方法，其特征在于，所述输入接口包括配置界面、应用程序编程接口API和输入模板。
  9. 一种网络设备，其特征在于，包括：
    接收模块，用于接收租户输入的虚拟机网口标识，所述虚拟机网口标识用于识别需要配置子接口的虚拟机的网口；
    处理模块，用于确定所述虚拟机网口标识对应的虚拟机的网口，为所述网口设置子接口，并将所述子接口的信息提供给所述租户。
  10. 如权利要求9所述的网络设备，其特征在于，
    所述接收模块，还用于接收所述租户输入的所述子接口的配置信息；
    所述处理模块，还用于根据所述配置信息配置所述子接口。
  11. 如权利要求9或10所述的网络设备，其特征在于，所述子接口与所述虚拟机中的容器绑定，所述容器通过所述子接口进行网络报文处理。
  12. 如权利要求11所述的网络设备，其特征在于，所述子接口的配置信息包括安全组规则，所述安全组规则用于对绑定所述子接口的所述容器的报文进行安全组处理。
  13. 如权利要求9至12任一项所述的网络设备，其特征在于，所述子接口的配置信息包括所述子接口的子网信息以及所述子接口的虚拟局域网标识VlanID。
  14. 如权利要求12或13所述的网络设备，其特征在于，所述处理模块，具体用于：
    确定所述虚拟机网口标识对应的虚拟机所在的服务器；
    通知所述服务器的虚拟机管理器在所述虚拟机的所述网口下设置所述子接口。
  15. 如权利要求9至14任一项所述的网络设备，其特征在于，所述子接口的信息包括所述子接口的子接口标识UUID、所述子接口的私网地址和子网信息、所述子接口的媒体存取控制MAC地址以及所述子接口的虚拟局域网标识VlanID中的一者或任意组合。
  16. 如权利要求9至15任一项所述的网络设备，其特征在于，所述输入接口包括配置界面、应用程序编程接口API和输入模板。
  17. 一种计算设备，其特征在于，所述计算设备包括存储器和处理器，所述处理器执行存储器存储的计算机指令，使得所述计算设备执行权利要求1-8任一项所述的方法。
  18. 一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，当所述计算机程序被处理器执行时，所述处理器执行权利要求1-8任一项所述的方法。
PCT/CN2021/119867 2020-09-25 2021-09-23 一种公有云的网络配置方法及相关设备 WO2022063170A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP21871539.9A EP4221103A4 (en) 2020-09-25 2021-09-23 PUBLIC CLOUD NETWORK CONFIGURATION METHOD AND RELATED DEVICE

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011029039.8 2020-09-25
CN202011029039.8A CN114338606B (zh) 2020-09-25 2020-09-25 一种公有云的网络配置方法及相关设备

Publications (1)

Publication Number Publication Date
WO2022063170A1 true WO2022063170A1 (zh) 2022-03-31

Family

ID=80844930

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/119867 WO2022063170A1 (zh) 2020-09-25 2021-09-23 一种公有云的网络配置方法及相关设备

Country Status (3)

Country Link
EP (1) EP4221103A4 (zh)
CN (1) CN114338606B (zh)
WO (1) WO2022063170A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114844855A (zh) * 2022-04-24 2022-08-02 京东科技信息技术有限公司 一种网络互通访问策略的生成方法和装置
CN116155890A (zh) * 2023-04-20 2023-05-23 杭州优云科技有限公司 分布式文件系统的实现方法及装置

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114567523B (zh) * 2022-04-22 2022-09-30 阿里巴巴（中国）有限公司 一种自定义vlan网络的方法、设备及存储介质
CN118075107A (zh) * 2022-11-14 2024-05-24 华为云计算技术有限公司 基于云计算技术的云服务部署方法及云管理平台

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106571992A (zh) * 2016-10-27 2017-04-19 深圳市深信服电子科技有限公司 虚拟专线建立方法及装置
CN108989110A (zh) * 2018-07-20 2018-12-11 浪潮电子信息产业股份有限公司 一种vpc网络模型的构建方法及其相关设备
CN109587281A (zh) * 2017-09-29 2019-04-05 华为技术有限公司 容器配置方法和计算节点
US20200036675A1 (en) * 2018-07-24 2020-01-30 Vmware, Inc. Migration of virtual machine located on its own network

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102833155B (zh) * 2012-08-03 2015-12-16 中兴通讯股份有限公司 在二层单板上实现三层通信的方法及装置
CN104518935B (zh) * 2013-09-27 2018-05-25 华为技术有限公司 实现虚拟网络通信的方法、装置和系统
US10148493B1 (en) * 2015-06-08 2018-12-04 Infoblox Inc. API gateway for network policy and configuration management with public cloud
US10063469B2 (en) * 2015-12-16 2018-08-28 Nicira, Inc. Forwarding element implementation for containers
CN107276783B (zh) * 2016-04-08 2022-05-20 中兴通讯股份有限公司 一种实现虚拟机统一管理及互通的方法、装置和系统
JP6513835B2 (ja) * 2016-11-09 2019-05-15 ホアウェイ・テクノロジーズ・カンパニー・リミテッド クラウドコンピューティングシステムにおけるパケット処理方法、ホスト、およびシステム
US10719369B1 (en) * 2017-06-01 2020-07-21 Amazon Technologies, Inc. Network interfaces for containers running on a virtual machine instance in a distributed computing environment
CN111031056B (zh) * 2019-12-20 2021-10-12 紫光云(南京)数字技术有限公司 一种在安全组中实现安全域功能的方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106571992A (zh) * 2016-10-27 2017-04-19 深圳市深信服电子科技有限公司 虚拟专线建立方法及装置
CN109587281A (zh) * 2017-09-29 2019-04-05 华为技术有限公司 容器配置方法和计算节点
CN108989110A (zh) * 2018-07-20 2018-12-11 浪潮电子信息产业股份有限公司 一种vpc网络模型的构建方法及其相关设备
US20200036675A1 (en) * 2018-07-24 2020-01-30 Vmware, Inc. Migration of virtual machine located on its own network

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4221103A4 *

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114844855A (zh) * 2022-04-24 2022-08-02 京东科技信息技术有限公司 一种网络互通访问策略的生成方法和装置
CN114844855B (zh) * 2022-04-24 2024-05-17 京东科技信息技术有限公司 一种网络互通访问策略的生成方法和装置
CN116155890A (zh) * 2023-04-20 2023-05-23 杭州优云科技有限公司 分布式文件系统的实现方法及装置
CN116155890B (zh) * 2023-04-20 2023-08-15 杭州优云科技有限公司 分布式文件系统的实现方法及装置

Also Published As

Publication number Publication date
CN114338606B (zh) 2023-07-18
EP4221103A1 (en) 2023-08-02
EP4221103A4 (en) 2024-03-27
CN114338606A (zh) 2022-04-12

Similar Documents

Publication Publication Date Title
US11792126B2 (en) Configuring service load balancers with specified backend virtual networks
US10778532B2 (en) Overlay network movement operations
US11102079B2 (en) Cross-regional virtual network peering
US10708082B1 (en) Unified control plane for nested clusters in a virtualized computing infrastructure
US10728145B2 (en) Multiple virtual network interface support for virtual execution elements
CN110875848B (zh) 控制器和用于配置虚拟执行元件的虚拟网络接口的方法
US11888899B2 (en) Flow-based forwarding element configuration
WO2022063170A1 (zh) 一种公有云的网络配置方法及相关设备
US11743182B2 (en) Container networking interface for multiple types of interfaces
JP2020129800A (ja) 仮想ネットワークインタフェースオブジェクト
US9124536B2 (en) Managing data flows in overlay networks
US20230269215A1 (en) Dynamically learning media access control and internet protocol addresses
US20220334864A1 (en) Plurality of smart network interface cards on a single compute node
US11991077B2 (en) Data interfaces with isolation for containers deployed to compute nodes
US11700236B2 (en) Packet steering to a host-based firewall in virtualized environments
US20140130046A1 (en) Communication apparatus and configuration method
US10581730B2 (en) Packet processing using service chains
US20230079209A1 (en) Containerized routing protocol process for virtual private networks
US11595303B2 (en) Packet handling in software-defined net working (SDN) environments
US20150139037A1 (en) Configuration of transparent interconnection of lots of links (trill) protocol enabled device ports in edge virtual bridging (evb) networks
US11444836B1 (en) Multiple clusters managed by software-defined network (SDN) controller
CN117255019A (zh) 用于虚拟化计算基础设施的系统、方法及存储介质

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2021871539

Country of ref document: EP

Effective date: 20230425