Virtual machine management method and virtualization system

Abstract

The application provides a virtual machine management method and a virtualization system. The method comprises the following steps: when a cloud base platform in the virtualization system receives a virtual machine creation request, the cloud base platform determines target tenant information of a target virtual machine indicated by the virtual machine creation request, and determines a target host from at least one host based on the target tenant information; the cloud base platform allocates a target VLAN identifier to the target virtual machine, and creates a target VLAN sub-interface on a physical network card of the target host based on the target VLAN identifier; the cloud base platform creates a target virtual network interface on the target VLAN sub-interface, so that a data packet sent by the target virtual network interface supports carrying a VLAN label of the target VLAN sub-interface; and the cloud base platform creates the target virtual machine on the target host through the target virtual network interface, so that the target virtual network interface is bound to the target virtual machine. The embodiment of the application can conveniently create a virtual machine, and effectively reduces the complexity of network management.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a virtual machine management method and a virtualization system. Background Technology

[0002] Currently, in the current cloud computing environment, when creating virtual machines using QEMU (Quick Emulator, an open-source hardware virtualization software used to create and manage virtual machines), the common approach is to use a combination of TAP (Terminal Access Point, a virtual network interface operating at the data link layer for transmitting Ethernet frames between user space and the kernel network stack) + OVS (Open vSwitch, a production-grade open-source virtual switch used for network connectivity and traffic management in virtualized environments) bridge + OVN (Open Virtual Network, a network virtualization system based on OVS that provides logical switching, logical routing, ACLs (Access Control Lists), and other network abstraction functions for managing virtual networks). This requires additional configuration and management work in EVPN (Ethernet Virtual Private Network) environments, resulting in cumbersome operations and high network management complexity. Therefore, there is currently no satisfactory solution for conveniently creating virtual machines to effectively reduce network management complexity. Summary of the Invention

[0003] In view of this, embodiments of the present invention provide a virtual machine management method and a virtualization system to solve the problems of cumbersome operation caused by related technologies. That is, embodiments of the present invention can connect virtual machines to the physical network by creating VLAN sub-interfaces on the physical network card and creating virtual network interfaces on the VLAN sub-interfaces. This allows data packets sent from the virtual machine to automatically carry VLAN tags, so that the network traffic of the virtual machine can be directly forwarded to the physical network through the virtual network interface and the VLAN sub-interface without going through the processing of the OVS bridge and OVN controller. This allows for convenient creation of virtual machines and effectively reduces the complexity of network management.

[0004] According to one aspect of the present invention, a virtual machine management method is provided, the method being applied to a virtualization system located in an EVPN network, the virtualization system comprising a cloud platform and at least one host machine; the method comprising: When the cloud platform receives a virtual machine creation request, it determines the target tenant information of the target virtual machine indicated by the virtual machine creation request, and determines the target host from the at least one host based on the target tenant information. The cloud platform assigns a target VLAN identifier to the target virtual machine and creates a target VLAN sub-interface on the physical network card of the target host machine based on the target VLAN identifier. The cloud platform creates a target virtual network interface on the target VLAN sub-interface, so that the data packets sent by the target virtual network interface support carrying the VLAN tag of the target VLAN sub-interface; The cloud platform creates the target virtual machine on the target host machine through the target virtual network interface, so that the target virtual network interface is bound to the target virtual machine.

[0005] According to another aspect of the present invention, a virtualization system is provided, the virtualization system being located in an EVPN network, the virtualization system comprising a cloud platform and at least one host machine; the virtualization system includes: The cloud platform is used to determine the target tenant information of the target virtual machine indicated by the virtual machine creation request when it receives the virtual machine creation request, and to determine the target host from the at least one host based on the target tenant information. The cloud platform is also used to assign a target VLAN identifier to the target virtual machine and create a target VLAN sub-interface on the physical network card of the target host machine based on the target VLAN identifier. The cloud base platform is also used to create a target virtual network interface on the target VLAN sub-interface, so that the data packets sent by the target virtual network interface support carrying the VLAN tag of the target VLAN sub-interface; The cloud platform is also used to create the target virtual machine on the target host machine through the target virtual network interface, so that the target virtual network interface is bound to the target virtual machine.

[0006] According to another aspect of the present invention, a non-transitory computer-readable storage medium is provided storing computer instructions for causing a computer to perform the methods mentioned above.

[0007] This invention enables a cloud platform to determine the target tenant information of the virtual machine indicated in the virtual machine creation request when it receives such a request, and to identify the target host from at least one host based on the target tenant information. Then, the cloud platform can assign a target VLAN identifier to the target virtual machine and create a target VLAN sub-interface on the physical network interface card (NIC) of the target host based on the target VLAN identifier. Further, the cloud platform can create a target virtual network interface on the target VLAN sub-interface, so that data packets sent from the target virtual network interface support carrying the VLAN tag of the target VLAN sub-interface. Correspondingly, the cloud platform can create a target virtual machine on the target host through the target virtual network interface, thus binding the target virtual network interface to the target virtual machine. Therefore, this invention connects the virtual machine to the physical network by creating a VLAN sub-interface on the physical NIC and a virtual network interface on the VLAN sub-interface. This allows data packets sent from the virtual machine to automatically carry VLAN tags, enabling the virtual machine's network traffic to be directly forwarded to the physical network through the virtual network interface and VLAN sub-interface without processing by the OVS bridge and OVN controller. This facilitates the creation of virtual machines and effectively reduces network management complexity. Attached Figure Description

[0008] Further details, features, and advantages of the invention are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which: Figure 1 A flowchart illustrating a virtual machine management method according to an exemplary embodiment of the present invention is shown; Figure 2 A flowchart illustrating another virtual machine management method according to an exemplary embodiment of the present invention is shown; Figure 3 A flowchart illustrating yet another virtual machine management method according to an exemplary embodiment of the present invention is shown; Figure 4 A schematic diagram of a data packet transmission according to an exemplary embodiment of the present invention is shown; Figure 5 A flowchart illustrating another virtual machine management method according to an exemplary embodiment of the present invention is shown. Detailed Implementation

[0009] Embodiments of the present invention will now be described in more detail with reference to the accompanying drawings. While some embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the invention. It should be understood that the accompanying drawings and embodiments are for illustrative purposes only and are not intended to limit the scope of protection of the invention.

[0010] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0011] The term "comprising" and its variations as used herein are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the following description. It should be noted that the concepts of "first", "second", etc., mentioned in this invention are used only to distinguish different devices, modules, or units, and are not intended to limit the order of functions performed by these devices, modules, or units or their interdependencies.

[0012] It should be noted that the terms "a" and "a plurality of" used in this invention are illustrative rather than restrictive. Those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0013] The names of the messages or information exchanged between the multiple devices in the embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of these messages or information.

[0014] It should be noted that this embodiment of the invention provides a virtualization system, which may reside within an EVPN network. The virtualization system may include, but is not limited to, a cloud platform and at least one host machine, etc., and this embodiment of the invention does not limit this. Optionally, the cloud platform may also be simply referred to as a cloud base, which refers to a cloud computing infrastructure platform that provides basic resource services such as computing, storage, and networking. Correspondingly, a host machine can refer to a physical computer (i.e., an electronic device) running virtualization software, on which virtual machines run. The host machine can provide physical resources (such as CPU (Central Processing Unit), memory, storage, network, etc.), which can be allocated to virtual machines through virtualization technology. For example, QEMU / KVM (Kernel-based Virtual Machine) virtualization software can run on the host machine to create and manage virtual machines. Optionally, the cloud platform may include, but is not limited to: a control plane (which can be used to receive user requests, be responsible for global resource scheduling, and issue policy parameters to compute node agent components, etc.), and compute node agent components (which can run on each host machine, receive instructions from the control plane, and are the key bridge connecting the cloud platform and real hardware), etc. This embodiment of the invention does not limit this; based on this, the cloud platform can create virtual machines through the control plane and compute node agent components on each host machine in at least one host machine.

[0015] EVPN is a network technology used to provide Ethernet services over IP (Internet Protocol) / MPLS (Multiprotocol Label Switching) networks. It uses BGP (Border Gateway Protocol) to distribute MAC (Media Access Control) and IP address information, enabling Layer 2 and Layer 3 connectivity in large-scale data center networks. BGP, a path vector protocol used to exchange routing information between Autonomous Systems (AS), is a core routing protocol of the Internet used to transmit routing information between different networks. In EVPN, BGP is extended to distribute MAC and IP address information, enabling Layer 2 and Layer 3 network connectivity in large-scale data centers.

[0016] Based on this, the execution entity of the virtual machine management method provided in this embodiment of the invention can be a virtualization system. Optionally, a host machine can be an electronic device; wherein, the electronic device can be a terminal (i.e., a client) or a server. Accordingly, the terminal mentioned herein can include, but is not limited to, smartphones, tablets, laptops, desktop computers, etc. The server mentioned herein can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms, etc.

[0017] Based on the above description, this embodiment of the invention proposes a virtual machine management method. This virtual machine management method can be executed by the aforementioned virtualization system, that is, the virtual machine management method can be applied to a virtualization system, which can be located in an EVPN network. The virtualization system includes a cloud platform and at least one host machine. Figure 1 As shown, the virtual machine management method may include the following steps S101-S104: S101, when the cloud platform receives a virtual machine creation request, it determines the target tenant information of the target virtual machine indicated by the virtual machine creation request, and determines the target host from at least one host based on the target tenant information.

[0018] Optionally, users (such as tenants or administrators) can perform virtual machine creation operations on the control plane of the cloud platform. The cloud platform can then respond to this virtual machine creation operation through the control plane, thereby determining that a virtual machine creation instruction has been received. The virtual machine creation instruction can indicate the virtual machine creation information specified in the virtual machine creation operation, such as information set by the user. It should be noted that this embodiment of the invention does not limit the specific execution method of the virtual machine creation operation. Optionally, the virtual machine creation instruction information may include, but is not limited to, target tenant information. Target tenant information may include, but is not limited to, at least one of the following: tenant network indication information (which can be used to indicate the target tenant network to which the target virtual machine belongs) and tenant identifier (which can be used to indicate the target tenant to which the target virtual machine belongs), etc. This embodiment of the invention does not limit this. Based on this, the virtual machine creation instruction can request the creation of a target virtual machine, and the cloud platform can determine the target tenant information of the target virtual machine indicated by the virtual machine creation request, thereby determining the target tenant and / or target tenant network to which the target virtual machine belongs through the target tenant information.

[0019] Optionally, when determining the target host from at least one host based on the target tenant information, the target tenant to which the target virtual machine belongs can be determined based on the target tenant information, and the target host can be determined from at least one host based on the target tenant. For example, the cloud platform can determine the host resource pool bound to the target tenant, thereby determining the target host from the host resource pool bound to the target tenant, thus achieving the determination of the target host from at least one host based on the target tenant. For instance, the target host can be determined based on strategies such as load balancing, etc. It should be noted that the specific method for determining the target host in this embodiment of the invention is not limited; for example, it can be determined according to a load balancing strategy, or it can be randomly selected, etc.

[0020] Optionally, the cloud platform can perform the above-mentioned determination of the target tenant information of the target virtual machine indicated by the virtual machine creation request through the control plane, and determine the target host from at least one host based on the target tenant information.

[0021] S102, the cloud platform assigns a target VLAN identifier to the target virtual machine and creates a target VLAN sub-interface on the physical network card of the target host machine based on the target VLAN identifier.

[0022] Optionally, the cloud platform can assign a target VLAN (Virtual Local Area Network) identifier to the target virtual machine through the control plane; alternatively, it can assign a target VLAN identifier to the target virtual machine according to a preset VLAN identifier allocation policy, or it can determine a specific VLAN identifier to use as the target VLAN identifier, etc. Optionally, the preset VLAN identifier allocation policy can be set based on experience or according to actual needs; this embodiment of the invention does not limit this. Optionally, the VLAN identifier can be a VLAN ID (Virtual Local Area Network Identifier); in this embodiment of the invention, the VLAN ID can be used to identify the data packets of the virtual machine to facilitate the forwarding and isolation of data packets in the EVPN network. The VLAN ID can be a 12-bit identifier used to identify different virtual local area networks, ranging from 0 to 4095; the VLAN ID can be used to achieve isolation and communication of multiple logical networks on the same physical network. For example, when the VLAN identifier is a VLAN ID, the VLAN ID can be assigned using static or dynamic methods. For instance, static assignment allows the administrator or system to pre-specify the VLAN ID when the virtual machine is created, while dynamic assignment can automatically assign the VLAN ID according to a preset VLAN identifier allocation policy, and so on.

[0023] Optionally, the cloud platform can create the target VLAN sub-interface directly through the control plane, or it can create the target VLAN sub-interface through the computing node proxy component on the target host. This embodiment of the invention does not limit this. Optionally, the VLAN sub-interface is a virtual network interface created on the physical network card and can correspond to a specific VLAN ID. The VLAN sub-interface can automatically add or identify the corresponding VLAN tag for the data packets passing through it, thereby realizing network isolation and forwarding based on VLAN ID.

[0024] Optionally, the cloud platform can also determine the VLAN sub-interface name of the target VLAN sub-interface according to a preset VLAN sub-interface naming rule, thereby creating the target VLAN sub-interface on the target host's physical network card based on the physical network card name of the target host, the VLAN sub-interface name of the target VLAN sub-interface, and the target VLAN identifier. Optionally, the preset VLAN sub-interface naming rule can be set based on experience or according to actual needs; this embodiment of the invention does not limit this. Optionally, the VLAN sub-interface name of the target VLAN sub-interface can be determined through the control plane in the cloud platform or through the computing node proxy component on the target host; this embodiment of the invention does not limit this.

[0025] In one implementation, if the target VLAN sub-interface is created by the cloud platform through the compute node agent component on the target host, the cloud platform can send the VLAN sub-interface configuration policy (which may include the VLAN sub-interface creation requirements) corresponding to the target VLAN sub-interface to the compute node agent component (also referred to as the compute node agent) on the target host via the control plane. This allows the compute node agent component on the target host to create the target VLAN sub-interface on the target host's physical network interface card (NIC) based on the VLAN sub-interface configuration policy. In another implementation, the cloud platform can also send the overall virtual machine creation policy corresponding to the target virtual machine to the compute node agent component on the target host via the control plane. In this case, the compute node agent component on the target host can execute each step sequentially according to the overall virtual machine creation policy, such as sequentially creating the target VLAN sub-interface on the target host's physical NIC, creating the target virtual network interface on the target VLAN sub-interface, and creating the target virtual machine on the target host. The overall virtual machine creation policy corresponding to the target virtual machine may include, but is not limited to, the VLAN sub-interface configuration policy corresponding to the target VLAN sub-interface. Optionally, the VLAN sub-interface configuration strategy corresponding to the target VLAN sub-interface may include, but is not limited to, at least one of the following: the physical network card name of the target host's physical network card, the VLAN sub-interface name of the target VLAN sub-interface, and the target VLAN identifier, etc., and this embodiment of the invention does not limit this.

[0026] In an embodiment of the present invention, the cloud base platform can use the first Linux (an operating system) network configuration command (such as the ip link command, etc.) to create a target VLAN sub-interface on the physical network card. For example, the cloud base platform can use the first Linux network configuration command to create a target VLAN sub-interface on the physical network card of the target host through the computing node proxy component on the target host. Among them, ip link is the core command for managing network interfaces in the Linux system and can be used to create, delete, and configure network interfaces. Based on this, the first Linux network configuration command can be used to create a target VLAN sub-interface on the physical network card of the target host based on the physical network card name of the physical network card of the target host, the VLAN sub-interface name of the target VLAN sub-interface, and the target VLAN identifier. Exemplarily, taking the ip link command as an example for illustration, the command format of the first Linux network configuration command can be: ip link add link <physical network card name> name <VLAN sub-interface name> type vlan id <VLAN ID>. For example, the executable command "ip link add link eth0 name eth0.101 type vlan id 101" can be used to create a target VLAN sub-interface on the physical network card of the target host. Among them, eth0 is the physical network card name, eth0.101 is the VLAN sub-interface name (usually named in the form of "physical network card name.VLAN ID"), and 101 is the target VLAN identifier, etc. In this case, the target VLAN sub-interface will automatically add or identify the corresponding VLAN tag for the data packets passing through it, and the data packets sent from the target VLAN sub-interface will automatically carry the tag with the target VLAN identifier of 101.

[0027] Optionally, in other embodiments, the vconfig tool (a command-line tool) can also be used to create a VLAN sub-interface, and / or the VLAN ID can be dynamically set through the netlink interface (a standard kernel communication interface), etc.

[0028] S103. The cloud base platform creates a target virtual network interface on the target VLAN sub-interface so that the data packets sent from the target virtual network interface support carrying the VLAN tag of the target VLAN sub-interface.

[0029] The VLAN tag of the target VLAN sub-interface may include the target VLAN identifier, i.e., the VLAN identifier of the target VLAN sub-interface. Optionally, a virtual network interface may be a MACVTAP interface or a MACVLAN interface; this embodiment of the invention does not limit this. MACVTAP is a Linux kernel virtual network interface that allows virtual machines to directly connect to the physical network, identifying and forwarding data packets through MAC addresses and VLAN tags, providing the functionality of a TAP (Terminal Access Point) interface. In this embodiment, the MACVTAP interface can be created on a VLAN sub-interface, thereby automatically inheriting the VLAN tagging function; that is, data packets sent by the MACVTAP interface will automatically carry the corresponding VLAN tag. Correspondingly, MACVLAN is a Layer 2 virtual network technology implemented based on a physical network interface, allowing multiple virtual network interfaces with different MAC addresses to be configured on the same physical network card. Optionally, the virtual network interface may also be called a virtual machine virtual network interface, etc.

[0030] Optionally, the cloud platform can create a target virtual network interface directly on the target VLAN sub-interface via the control plane, or it can create a target virtual network interface on the target VLAN sub-interface via a compute node proxy component on the target host. This embodiment of the invention does not limit this approach. In one implementation, if the target virtual network interface is created on the target VLAN sub-interface via a compute node proxy component on the target host, the cloud platform can distribute the virtual network interface configuration policy corresponding to the target virtual network interface to the compute node proxy component on the target host via the control plane. This allows the compute node proxy component on the target host to create the target virtual network interface on the target VLAN sub-interface based on the virtual network interface configuration policy corresponding to the target virtual network interface. Optionally, the virtual network interface configuration policy corresponding to the target virtual network interface may include, but is not limited to, at least one of the following: the virtual network interface name of the target virtual network interface, the VLAN sub-interface name of the target VLAN sub-interface, the bound physical network card, the working mode, etc. This embodiment of the invention does not limit this approach. In another implementation, the overall virtual machine creation policy corresponding to the target virtual machine may also include the virtual network interface configuration policy corresponding to the target virtual network interface. In this case, the compute node agent component on the target host machine can create the target VLAN sub-interface on the physical network card of the target host machine, and then directly create the target virtual network interface on the target VLAN sub-interface, and so on.

[0031] Optionally, the cloud base platform may also determine the virtual network interface name of the target virtual network interface (such as the MACVTAP interface name of the target MACVTAP interface) according to a preset virtual network interface naming rule (such as a preset MACVTAP interface naming rule, etc.); optionally, the virtual network interface name of the target virtual network interface may be determined by the cloud base platform through the control plane or by a computing node proxy component on the target host, and the embodiments of the present invention do not limit this; that is to say, the cloud base platform may also determine the virtual network interface name of the target virtual network interface through the control plane according to the preset virtual network interface naming rule, or may determine the virtual network interface name of the target virtual network interface through the computing node proxy component on the target host according to the preset virtual network interface naming rule, and so on. Optionally, the preset virtual network interface naming rule may be set according to experience or according to actual requirements, and the embodiments of the present invention do not limit this.

[0032] Optionally, the cloud base platform may use a second Linux network configuration command (such as the ip link command) to create a target virtual network interface on the target VLAN sub-interface. For example, it may use the second Linux network configuration command to create a target virtual network interface on the target VLAN sub-interface based on the VLAN sub-interface name of the target VLAN sub-interface and the virtual network interface name of the target virtual network interface. Exemplarily, taking the second Linux network configuration command as the ip link command and a virtual network interface as a MACVTAP interface as an example for illustration, the command format of the second Linux network configuration command may be: ip link add link <VLAN sub-interface name> name <MACVTAP interface name> type macvtap mode bridge; for example, the second Linux network configuration command may be ip link add link eth0.101 name macvtap1 type macvtap mode bridge, where eth0.101 may be the VLAN sub-interface name of the target VLAN sub-interface, macvtap1 may be the MACVTAP interface name of the target MACVTAP interface, and mode bridge may indicate using the bridging mode (that is, the working mode is the bridging mode), and so on.

[0033] Based on this, the virtual network interface can work at the data link layer, can directly process Ethernet frames; and, created on the VLAN sub-interface, automatically inherits the VLAN tag function; in addition, it can directly forward the network traffic of the virtual machine to the physical network and carry the VLAN tag, and the VLAN tag may include a VLAN ID.

[0034] Optionally, the cloud platform can also bind the target virtual network interface to the target tenant network. For example, assuming the target virtual machine belongs to the target tenant's VNI (VXLAN Network Identifier) ​​1001 network, the cloud platform can create a virtual network interface bound to this VNI through the compute node agent component. This binds the target virtual network interface to the VNI 1001 network, thereby assigning the target virtual machine an IP address and / or MAC address from the VNI 1001 network, and so on. Here, VXLAN can stand for Virtual eXtensible Local Area Network.

[0035] S104, the cloud platform creates a target virtual machine on the target host machine through the target virtual network interface, so that the target virtual network interface is bound to the target virtual machine.

[0036] Optionally, the cloud platform can create a target virtual machine on the target host machine through the target virtual network interface via the compute node agent component on the target host machine. In other words, the compute node agent component on the target host machine can create the target virtual machine on the target host machine through the target virtual network interface. In one implementation, the cloud platform can send the virtual machine configuration policy corresponding to the target virtual machine to the compute node agent component on the target host machine through the control plane. The compute node agent component can then create the target virtual machine according to the virtual machine configuration policy. Optionally, the virtual machine configuration policy corresponding to the target virtual machine may include, but is not limited to, at least one of the following: the virtual network interface name of the target virtual network interface, virtual machine creation instruction information (such as creating a virtual machine), etc., which are not limited in this embodiment. In another implementation, the overall virtual machine creation policy corresponding to the target virtual machine may also include the virtual machine configuration policy corresponding to the target virtual machine, thereby enabling the compute node agent component on the target host machine to directly execute the creation of the target virtual machine on the target host machine after creating the target virtual network interface, etc. Based on this, the overall virtual machine creation strategy corresponding to the target virtual machine may include, but is not limited to, at least one of the following: VLAN sub-interface configuration strategy corresponding to the target VLAN sub-interface, virtual network interface configuration strategy corresponding to the target virtual network interface, and virtual machine configuration strategy corresponding to the target virtual machine, etc.; the embodiments of the present invention do not limit this.

[0037] In an embodiment of the present invention, a virtual network interface may be a MACVTAP interface, and then the target virtual network interface may be referred to as the target MACVTAP interface. Based on this, the cloud base platform can obtain the tap device path corresponding to the target virtual network interface, and obtain the MAC address of the target virtual network interface; and can determine the target file descriptor, and generate a QEMU command based on the tap device path corresponding to the target virtual network interface, the MAC address of the target virtual network interface, and the target file descriptor; wherein, the target file descriptor and the tap device path corresponding to the target virtual network interface support for associating the target file descriptor to the tap device corresponding to the target virtual network interface, and the MAC address of the target virtual network interface supports for configuring the MAC address of the target virtual machine to realize the creation and binding of the virtual network card of the target virtual machine. Based on this, the QEMU command can be executed on the target host to create the target virtual machine on the target host through the target virtual network interface. Optionally, the cloud base platform can execute the above operations of obtaining the tap device path corresponding to the target virtual network interface and obtaining the MAC address of the target virtual network interface through the computing node proxy component on the target host, and then execute the QEMU command on the target host to create the target virtual machine on the target host through the target virtual network interface, and so on.

[0038] Optionally, the computing node proxy component on the target host can obtain the tap device path corresponding to the target MACVTAP interface by reading the ifindex (interface index) of the target MACVTAP interface. For example, the method for obtaining the tap device path corresponding to a MACVTAP interface can be: / dev / tap$(cat / sys / class / net / <MACVTAP interface name> / ifindex); wherein, the tap device path corresponding to the target MACVTAP interface may refer to the path of the tap device corresponding to the target MACVTAP interface. Optionally, the MAC address of the target MACVTAP interface can be obtained by reading the address (media access control address) of the target MACVTAP interface. For example, the method for obtaining the MAC address of a MACVTAP interface can be: $(cat / sys / class / net / <MACVTAP interface name> / address), and so on.

[0039] Optionally, the target file descriptor (which can be represented as fd) is a non-negative integer identifier assigned by the kernel for each opened file / device. When the compute node agent component on the target host opens the tap device corresponding to the target MACVTAP interface, the kernel allocates an unused integer (such as 3) from the process's available fd pool as the target file descriptor, thus obtaining the target file descriptor and determining it. Alternatively, the QEMU -netdev parameter can be used to specify the tap type, and the target file descriptor can be associated with the tap device corresponding to the target MACVTAP interface, thereby associating the target MACVTAP interface.

[0040] Based on this, virtual machine network interface card (NIC) binding can be implemented in this embodiment of the invention. For example, the target MACVTAP interface can be used as the virtual NIC of the target virtual machine. The target MACVTAP interface can be specified using the `-netdev` parameter of QEMU, and the MAC address of the target virtual machine can be configured. The combination of the target virtual machine's MAC address and the target VLAN identifier uniquely identifies the target virtual machine in the EVPN network. For example, the QEMU commands used to create the target virtual machine may include, but are not limited to, the following command lines: / opt / qemu / bin / qemu-system-x86_64 \ -enable-kvm \ -name hsz-macvtap-test \ -cpu qemu64 \ -smp 2 \ -m 1024 \ -drive file= / home / hsz / images / b37dc6b4-ffe6-48bf-8990-dd568247ca1f.qcow2,if=virtio,format=qcow2 \ -netdev tap,id=net0,fd=3 3<> / dev / tap$(cat / sys / class / net / macvtap0 / ifindex) \ -device virtio-net-pci,netdev=net0,mac=$(cat / sys / class / net / macvtap0 / address) \ -nographic ... The command `-netdev tap,id=net0,fd=3 3<> / dev / tap$(cat / sys / class / net / macvtap0 / ifindex)` indicates that target file descriptor 3 is associated with the tap device corresponding to the target MACVTAP interface. The core purpose of associating the target file descriptor (fd) with the tap device corresponding to the target MACVTAP interface is to associate the QEMU virtual machine process on the target host machine with the tap device corresponding to the target MACVTAP interface. This makes the target file descriptor the sole kernel-level bridge for the QEMU process to operate on the tap device corresponding to the target MACVTAP interface, ultimately binding the network data link of the target virtual machine to the tap device corresponding to the target MACVTAP interface, and completing the transparent transmission of traffic from the target virtual machine to the target host machine's MACVTAP / EVPN network. In other words, the entire network forwarding link of the target virtual machine can be attached to the tap device corresponding to the target MACVTAP interface through the QEMU process, realizing the connection between the target virtual machine and the target host machine's network.

[0041] Correspondingly, the above `-device virtio-net-pci,netdev=net0,mac=$(cat / sys / class / net / macvtap0 / address)` can represent creating a virtio network interface device (virtio-net, a high-performance virtual network interface). This means creating a virtio network interface device using the MAC address of the target MACVTAP interface, thus using the virtio network interface device as the virtual network interface of the target virtual machine. This can also be described as using the MAC address of the target MACVTAP interface as the MAC address of the target virtual machine, thereby enabling the MAC address of the target MACVTAP interface to support the configuration of the target virtual machine's MAC address. Finally, the target virtual machine's MAC address is used to create the virtual network interface for binding. Optionally, when binding the virtual network interface card (NIC) of the target virtual machine, the NIC can be bound to the netdev network backend of the QEMU process (which is the core intermediate layer connecting the virtual machine's NIC and the host machine's network devices in QEMU virtualization). Then, the target MACVTAP interface can be associated with the tap device corresponding to the target MACVTAP interface, etc., to achieve the binding of the virtual NIC of the target virtual machine. Thus, the binding of the target virtual machine to the target MACVTAP interface can be achieved through the binding of the virtual NIC of the target virtual machine, and so on.

[0042] Based on this, when creating a virtual machine using QEMU via the compute node proxy component on the target host machine, the cloud platform can bind the MACVTAP interface in the manner described above. This binds the target MACVTAP interface to the target virtual machine, or in other words, the target virtual machine binds to the target MACVTAP interface. Consequently, the target MACVTAP interface becomes the exclusive network forwarding carrier for the target virtual machine on the target host machine side, forming a one-to-one hardware-level forwarding binding. This means that all inbound / outbound traffic on the target MACVTAP interface belongs only to the bound target virtual machine, and other virtual machines cannot occupy or share the forwarding resources of the target MACVTAP interface. The target host machine can also ensure this exclusivity through kernel mechanisms.

[0043] Optionally, in other embodiments, a virtual network interface can also be a MACVLAN interface, and the target virtual network interface can also be called the target MACVLAN interface. Based on this, the target MACVLAN interface can be added to a virtual bridge, and a target virtual machine can be created and its virtual network card connected to the virtual bridge, enabling the target virtual machine to communicate with the external network through the target MACVLAN interface, thereby realizing the creation of the target virtual machine on the target host through the target virtual network interface, and so on.

[0044] Optionally, after the target virtual machine is created, the target host machine can run the target virtual machine, such as... Figure 2 As shown.

[0045] Optionally, when the cloud platform detects a deletion command for the target virtual machine, it can also delete the target virtual machine. Alternatively, the cloud platform can detect the deletion command for the target virtual machine through the control plane, and upon detection, send the deletion command to the compute node agent component on the target host machine to delete the target virtual machine through the compute node agent component on the target host machine. Optionally, the cloud platform can determine that a deletion command for the target virtual machine has been detected when the user performs a deletion operation on the target virtual machine through the control plane; or, it can determine that a deletion command for the target virtual machine has been detected when the runtime of the target virtual machine reaches the total runtime of the target virtual machine, etc. This embodiment of the invention does not limit the specific execution method of the user performing the deletion operation.

[0046] Optionally, when the target virtual machine is deleted, the cloud platform also releases the target virtual network interface, the target VLAN sub-interface, and the target VLAN identifier. Optionally, it can also clean up the network configuration corresponding to the target virtual machine, such as the tap device corresponding to the target MACVTAP interface, local network rules based on interface names, etc.; this embodiment of the invention does not limit the specific content of the network configuration corresponding to the target virtual machine to be cleaned up. Optionally, the cloud platform can release the target virtual network interface, the target VLAN sub-interface, and the target VLAN identifier through the compute node proxy component on the target host machine; and / or clean up the network configuration corresponding to the target virtual machine, etc.

[0047] In summary, when a virtual network interface is a MACVTAP interface, this embodiment of the invention provides a virtual machine creation method based on MACVTAP + VLAN identifier, thereby providing a virtual machine management method based on MACVTAP + VLAN identifier to achieve the connection between the virtual machine and the physical network, as well as network isolation between virtual machines, through the MACVTAP interface and VLAN identifier; wherein, the virtual machine creation method included in the virtual machine management method can be applied to the cloud base platform in the virtualization system, and the virtualization system is located in the EVPN network, that is, the virtual machine creation method can be applied to the cloud base platform in the EVPN network environment.

[0048] This invention enables a cloud platform to determine the target tenant information of the virtual machine indicated in the virtual machine creation request when it receives such a request, and to identify the target host from at least one host based on the target tenant information. Then, the cloud platform can assign a target VLAN identifier to the target virtual machine and create a target VLAN sub-interface on the physical network interface card (NIC) of the target host based on the target VLAN identifier. Further, the cloud platform can create a target virtual network interface on the target VLAN sub-interface, so that data packets sent from the target virtual network interface support carrying the VLAN tag of the target VLAN sub-interface. Correspondingly, the cloud platform can create a target virtual machine on the target host through the target virtual network interface, thus binding the target virtual network interface to the target virtual machine. Therefore, this invention connects the virtual machine to the physical network by creating a VLAN sub-interface on the physical NIC and a virtual network interface on the VLAN sub-interface. This allows data packets sent from the virtual machine to automatically carry VLAN tags, enabling the virtual machine's network traffic to be directly forwarded to the physical network through the virtual network interface and VLAN sub-interface without processing by the OVS bridge and OVN controller. This facilitates the creation of virtual machines and effectively reduces network management complexity.

[0049] Based on the above description, this embodiment of the invention also proposes a more specific virtual machine management method. Accordingly, this virtual machine management method can be executed by the virtualization system mentioned above; please refer to [link to relevant documentation]. Figure 3 The virtual machine management method may include the following steps S301-S306: S301, when the cloud platform receives a virtual machine creation request, it determines the target tenant information of the target virtual machine indicated by the virtual machine creation request, and determines the target host from at least one host based on the target tenant information.

[0050] S302, the cloud platform assigns a target VLAN identifier to the target virtual machine and creates a target VLAN sub-interface on the physical network card of the target host machine based on the target VLAN identifier.

[0051] S303, the cloud platform creates a target virtual network interface on the target VLAN sub-interface so that data packets sent by the target virtual network interface can carry the VLAN tag of the target VLAN sub-interface.

[0052] S304, the cloud platform creates a target virtual machine on the target host machine through the target virtual network interface, so that the target virtual network interface is bound to the target virtual machine.

[0053] Optionally, the virtualization system may also include an EVPN network device; wherein, virtual machine data packets with different VLAN identifiers can be isolated in the EVPN network through VLAN tags, where one VLAN tag includes one VLAN identifier, and the EVPN network device supports traffic isolation based on VLAN identifiers. Based on this, embodiments of the present invention can ensure that virtual machines of different tenants or different networks cannot communicate directly unless explicitly permitted by routing policies, thereby achieving network isolation.

[0054] Optionally, the EVPN network device can be used to maintain a routing table, enabling the VTEP (VXLAN Tunnel Endpoint) switch to determine routing information based on the routing table in the EVPN network device, and so on. Based on this, communication is only possible when the routing policy indicated by the routing table in the EVPN network device allows virtual machines from different networks to communicate, thus achieving network isolation. Here, the VTEP is the edge device of the VXLAN network, responsible for the encapsulation and decapsulation of VXLAN packets; optionally, the VTEP switch can be a physical switch, a virtual switch, or a software implementation on a server, etc., and this embodiment of the invention does not limit this.

[0055] Optionally, in other embodiments, in addition to relying on the VLAN isolation mechanism of the EVPN network, ACL rules can be configured on the EVPN network device, or network segmentation technology can be used to achieve network isolation, etc.; the present invention does not limit this.

[0056] S305, when the target virtual machine sends the target data packet, it sends the target data packet through the target virtual network interface, so that the target data packet is tagged with the VLAN tag of the target VLAN sub-interface when it passes through the target VLAN sub-interface; wherein, a data packet sent by a virtual network interface will reach the physical network card through the VLAN sub-interface it belongs to.

[0057] Optionally, a VLAN tag may include a VLAN identifier, such as a VLAN ID. Optionally, a VLAN tag may also include, but is not limited to, at least one of the following: TPID (Tag Protocol Identifier), PCP (Priority Code Point), and whether it is droppable, etc.; the embodiments of the present invention do not limit this.

[0058] For example, such as Figure 4 As shown, taking virtual machine 0 as the target virtual machine and MACVTAP0 as the target virtual network interface as an example, the target data packet can be sent through MACVTAP0 and carry the VLAN tag of the target VLAN sub-interface; that is, when the target data packet passes through the target VLAN sub-interface (eth0.101 in the figure), the VLAN tag of the target VLAN sub-interface is automatically added, and then it enters the EVPN network through the physical network card (eth0 in the figure), etc.

[0059] Based on this, the VLAN identifier (such as VLAN ID) in the VLAN tag can be used to distinguish different virtual machines, realizing network identification at the virtual machine level.

[0060] Optionally, the virtualization system may also include at least one VTEP switch. In an EVPN network, the VTEP switch can perform VXLAN encapsulation according to the EVPN protocol to achieve Layer 2 network connections across data centers, and so on.

[0061] Optionally, the aforementioned target data packet may also be referred to as a target data frame, etc.

[0062] S306. The target data packet enters the EVPN network through the physical network card of the target host machine. After reaching the target VTEP switch, the target VTEP switch determines the virtual machine to which the target data packet belongs based on the VLAN tag carried by the target data packet, and determines the corresponding data packet to be sent based on the virtual machine to which the target data packet belongs, so as to forward the data packet to be sent.

[0063] Specifically, when the target VTEP switch determines the virtual machine to which the target data packet belongs based on the VLAN tag carried by the target data packet, it can identify the virtual machine to which the target data packet belongs based on the VLAN identifier in the VLAN tag carried by the target data packet, which can be the target virtual machine.

[0064] Optionally, when determining the data packet to be sent based on the virtual machine to which the target data packet belongs, if the destination device of the target data packet and the virtual machine to which the target data packet belongs belong to the same VTEP switch (i.e., the destination device of the target data packet also belongs to the target VTEP switch), the VLAN tag carried by the target data packet can be replaced with the VLAN tag of the VLAN sub-interface corresponding to the destination device to obtain the data packet to be sent corresponding to the target data packet. Optionally, the destination device of the target data packet can be a virtual machine, an external network, etc.; this embodiment of the invention does not limit this.

[0065] Optionally, when the destination device and the virtual machine to which the target data packet belongs do not belong to the same VTEP switch, the target data packet can be encapsulated using VXLAN to obtain a VXLAN data packet (also called an encapsulated VXLAN data packet), and this VXLAN data packet can be used as the data packet to be sent. For example, the target data packet can be encapsulated using the EVPN protocol; in this case, VXLAN encapsulation can encapsulate the target data packet in a UDP (User Datagram Protocol) data packet and add a VXLAN header and a UDP / IP header to form a VXLAN data packet, etc. Optionally, the VXLAN data packet can also carry the VLAN tag of the VLAN sub-interface corresponding to the destination device, thereby allowing the VLAN tag of the VLAN sub-interface corresponding to the destination device to replace the original VLAN tag carried by the target data packet. Alternatively, it may not carry the VLAN tag of the VLAN sub-interface corresponding to the destination device (in this case, the VTEP switch to which the destination device belongs can add the VLAN tag of the VLAN sub-interface corresponding to the destination device to the following decapsulated data packet), and this embodiment of the invention does not limit this. Optionally, the VXLAN data packet can also carry the IP address of the VTEP switch to which the destination device belongs, etc.

[0066] Therefore, in an EVPN network, VLAN tags can be used to distinguish different virtual machines, enabling network identification at the virtual machine level.

[0067] Optionally, when forwarding data packets, if the destination device and the virtual machine to which the target data packet belongs belong to the same VTEP switch, the data packet can be forwarded to the destination device. If the destination device and the virtual machine to which the target data packet belongs do not belong to the same VTEP switch, the data packet can be forwarded to the VTEP switch to which the destination device belongs, so that the VTEP switch to which the destination device belongs can determine the decapsulated data packet and send the decapsulated data packet to the destination device. Optionally, the decapsulated data packet may carry the VLAN tag of the VLAN sub-interface corresponding to the destination device. Optionally, the encapsulated VXLAN data packet may be transmitted to a remote VTEP switch via an IP network, such as by transmitting the encapsulated VXLAN data to the VTEP switch to which the destination device belongs via its IP address, etc.

[0068] Optionally, when determining the decapsulated data packet, the VTEP switch to which the destination device belongs can perform VXLAN decapsulation on the data packet to be sent (in this case, the VXLAN data packet) according to the EVPN protocol, thereby removing the VXLAN header and UDP / IP header, and restoring the original Ethernet frame carrying the VLAN tag, thus obtaining the decapsulated data packet. This decapsulated data packet may carry the VLAN tag of the VLAN sub-interface corresponding to the destination device, and so on. Furthermore, the VTEP switch to which the destination device belongs can send the decapsulated data packet to the destination device based on the MAC address and / or IP address of the destination device (i.e., the MAC address and / or IP address in the decapsulated data packet); that is, it can forward the decapsulated data packet to the destination device (such as the destination virtual machine or external network, etc.) based on the MAC address and / or destination IP address and the routing information learned through the BGP protocol. For example, the VTEP switch to which the destination device belongs can obtain the target routing information from the VTEP network device based on the MAC address and / or IP address of the destination device, and then forward the decapsulated data packet to the destination device according to the target routing information; or, the VTEP switch to which the destination device belongs can maintain its own routing table, and in this case, the target routing information can be determined through its own maintained routing table, etc.; the embodiments of the present invention do not limit this.

[0069] Based on this, embodiments of the present invention can achieve network isolation between virtual machines through the natural isolation of data packets with different VLAN identifiers in the EVPN network, without the need for additional OVN logical network configuration; furthermore, through the distinguishing role of VLAN identifiers and the VXLAN encapsulation / decapsulation mechanism, seamless integration of virtual machine networks and EVPN networks can be achieved, supporting virtual machine communication across data centers. For example, as... Figure 5 As shown, taking virtual machine A as the target virtual machine and virtual machine B as the destination device (i.e., the destination virtual machine is virtual machine B) as an example, the target data packet can reach the target VTEP switch through the target VLAN sub-interface, physical network card, etc., and complete VXLAN encapsulation. Then, after reaching the remote VTEP switch (i.e., the VTEP switch to which the destination device belongs), VXLAN decapsulation is completed so that the decapsulated data packet is sent to the destination virtual machine, so that virtual machine B can receive the data packet, and so on.

[0070] In summary, this invention enables direct connection between virtual machines and the physical network by creating VLAN sub-interfaces on the physical network card and then creating MACVTAP interfaces on those VLAN sub-interfaces. This effectively replaces the traditional TAP+OVN+OVS bridge approach, avoiding the need for OVS bridges and OVN controllers. Furthermore, VLAN tags can be automatically added to data packets via the VLAN sub-interfaces to identify virtual machine data packets, facilitating packet forwarding and isolation within the EVPN network. VXLAN encapsulation enables cross-datacenter virtual machine communication. Additionally, this invention fully leverages the characteristics of EVPN networks to simplify network management architecture. Specifically, the VLAN isolation and forwarding mechanisms of EVPN networks enable simplified network management. EVPN networks provide comprehensive MAC address learning, route distribution, and VLAN isolation functions. This invention utilizes these features to identify and manage virtual machine networks through a combination of VLAN identifiers and MAC addresses, avoiding the need to build an OVN logical network layer on top of the EVPN network. This simplifies the network architecture and reduces the complexity and maintenance costs of network management.

[0071] This invention enables a cloud platform to determine the target tenant information of the virtual machine indicated in the virtual machine creation request when it receives such a request, and to identify the target host from at least one host based on the target tenant information. Then, the cloud platform can assign a target VLAN identifier to the target virtual machine and create a target VLAN sub-interface on the physical network interface card (NIC) of the target host based on the target VLAN identifier. Based on this, the cloud platform can create a target virtual network interface on the target VLAN sub-interface, so that data packets sent by the target virtual network interface support carrying the VLAN tag of the target VLAN sub-interface. Correspondingly, the cloud platform can create a target virtual machine on the target host through the target virtual network interface, thus binding the target virtual network interface to the target virtual machine. Furthermore, when the target virtual machine sends target data packets, it can send the target data packets through the target virtual network interface, so that the target data packets are tagged with the VLAN tag of the target VLAN sub-interface when passing through it. A data packet sent by a virtual network interface will reach its physical NIC through the VLAN sub-interface it resides in. Based on this, the target data packet enters the EVPN network through the physical network card of the target host machine. After reaching the target VTEP switch, the target VTEP switch can determine the virtual machine to which the target data packet belongs based on the VLAN tag carried by the target data packet, and determine the corresponding data packet to be sent based on the virtual machine to which the target data packet belongs, so as to forward the data packet to be sent. It can be seen that the embodiments of the present invention can achieve seamless integration of virtual machine networks and EVPN networks through the distinguishing function of VLAN identifiers (such as VLAN IDs) in VLAN tags (which can distinguish virtual machines to determine the virtual machine to which the data packet belongs, such as whether the source virtual machine and the destination virtual machine come from the same host machine, etc.), and VXLAN encapsulation / decapsulation mechanism, supporting virtual machine communication across data centers.

[0072] Based on the description of the relevant embodiments of the above virtual machine management method, this embodiment of the invention also proposes a virtualization system, which is located in an EVPN network. The virtualization system includes a cloud platform and at least one host machine; the virtualization system includes: The cloud platform is used to determine the target tenant information of the target virtual machine indicated by the virtual machine creation request when it receives the virtual machine creation request, and to determine the target host from the at least one host based on the target tenant information. The cloud platform is also used to assign a target VLAN identifier to the target virtual machine and create a target VLAN sub-interface on the physical network card of the target host machine based on the target VLAN identifier. The cloud base platform is also used to create a target virtual network interface on the target VLAN sub-interface, so that the data packets sent by the target virtual network interface support carrying the VLAN tag of the target VLAN sub-interface; The cloud platform is also used to create the target virtual machine on the target host machine through the target virtual network interface, so that the target virtual network interface is bound to the target virtual machine.

[0073] In one implementation, when the cloud platform creates the target virtual machine on the target host machine through the target virtual network interface, it can specifically be used for: Obtain the tap device path corresponding to the target virtual network interface, and obtain the MAC address of the target virtual network interface; The target file descriptor is determined, and a QEMU command is generated based on the tap device path corresponding to the target virtual network interface, the MAC address of the target virtual network interface, and the target file descriptor. The target file descriptor and the tap device path corresponding to the target virtual network interface are used to associate the target file descriptor with the tap device corresponding to the target virtual network interface, and the MAC address of the target virtual network interface is used to configure the MAC address of the target virtual machine to achieve the creation and binding of the virtual network interface card of the target virtual machine. The QEMU command is executed on the target host machine to create the target virtual machine on the target host machine through the target virtual network interface.

[0074] In another embodiment, the virtualization system further includes at least one VTEP switch. The target virtual machine is used to send the target data packet through the target virtual network interface when sending the target data packet, so that the target data packet is tagged with the VLAN tag of the target VLAN sub-interface when it passes through the target VLAN sub-interface; wherein, a data packet sent by a virtual network interface will reach the physical network card through the VLAN sub-interface it belongs to; The target data packet enters the EVPN network through the physical network card of the target host machine. After reaching the target VTEP switch, the target VTEP switch determines the virtual machine to which the target data packet belongs based on the VLAN tag carried by the target data packet, and determines the data packet to be sent corresponding to the target data packet based on the virtual machine to which the target data packet belongs, so as to forward the data packet to be sent.

[0075] In another implementation, when the target VTEP switch determines the data packet to be sent corresponding to the target data packet based on the virtual machine to which the target data packet belongs, it can specifically be used for: When the destination device of the target data packet and the virtual machine to which the target data packet belongs belong to the same VTEP switch, the VLAN tag carried by the target data packet is replaced with the VLAN tag of the VLAN sub-interface corresponding to the destination device to obtain the data packet to be sent corresponding to the target data packet; When the destination device and the virtual machine to which the target data packet belongs do not belong to the same VTEP switch, the target data packet is encapsulated in VXLAN to obtain a VXLAN data packet, and the VXLAN data packet is used as the data packet to be sent.

[0076] In another implementation, when forwarding the data packet to be sent, the target VTEP switch may specifically be used to: When the destination device and the virtual machine to which the target data packet belongs belong to the same VTEP switch, the data packet to be sent is forwarded to the destination device; When the destination device and the virtual machine to which the target data packet belongs do not belong to the same VTEP switch, the data packet to be sent is forwarded to the VTEP switch to which the destination device belongs, so that the VTEP switch to which the destination device belongs can determine the decapsulated data packet and send the decapsulated data packet to the destination device.

[0077] In another implementation, when the target virtual machine is deleted, the cloud platform can also be used for: Release the target virtual network interface, the target VLAN sub-interface, and the target VLAN identifier; and / or, Clean up the network configuration corresponding to the target virtual machine.

[0078] In another embodiment, the virtualization system further includes an EVPN network device; In this system, virtual machine data packets with different VLAN identifiers are isolated in the EVPN network through VLAN tags. A VLAN tag includes a VLAN identifier, and the EVPN network device supports traffic isolation based on VLAN identifiers.

[0079] According to one embodiment of the present invention, each module in the virtualization system can be individually or entirely merged into one or more other modules, or some of the modules can be further divided into multiple functionally smaller modules. This achieves the same operation without affecting the technical effect of the embodiments of the present invention. In practical applications, the function of one module can also be implemented by multiple modules, or the function of multiple modules can be implemented by one module. In other embodiments of the present invention, the virtualization system may also include other modules. In practical applications, these functions can also be implemented with the assistance of other modules, and can be implemented collaboratively by multiple modules.

[0080] Based on the description of the method and system embodiments above, an exemplary embodiment of the present invention also provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor. The memory stores a computer program executable by the at least one processor, which, when executed by the at least one processor, causes the electronic device to perform a method according to an embodiment of the present invention.

[0081] An exemplary embodiment of the present invention also provides a non-transitory computer-readable storage medium storing a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform a method according to an embodiment of the present invention.

[0082] An exemplary embodiment of the present invention also provides a computer program product, including a computer program, wherein, when executed by a computer's processor, the computer program is used to cause the computer to perform a method according to an embodiment of the present invention.

[0083] Furthermore, it should be understood that the above-disclosed embodiments are merely preferred embodiments of the present invention and should not be construed as limiting the scope of the present invention. Therefore, any equivalent variations made in accordance with the claims of the present invention are still within the scope of the present invention.

Claims

1. A virtual machine management method, characterized in that, The method is applied to a virtualization system located in an EVPN network, the virtualization system comprising a cloud platform and at least one host machine; the method includes: When the cloud platform receives a virtual machine creation request, it determines the target tenant information of the target virtual machine indicated by the virtual machine creation request, and determines the target host from the at least one host based on the target tenant information. The cloud platform assigns a target VLAN identifier to the target virtual machine and creates a target VLAN sub-interface on the physical network card of the target host machine based on the target VLAN identifier. The cloud platform creates a target virtual network interface on the target VLAN sub-interface, so that the data packets sent by the target virtual network interface support carrying the VLAN tag of the target VLAN sub-interface; The cloud platform creates the target virtual machine on the target host machine through the target virtual network interface, so that the target virtual network interface is bound to the target virtual machine.

2. The method according to claim 1, characterized in that, A virtual network interface is a MACVTAP interface; the creation of the target virtual machine on the target host machine through the target virtual network interface includes: Obtain the tap device path corresponding to the target virtual network interface, and obtain the MAC address of the target virtual network interface; The target file descriptor is determined, and a QEMU command is generated based on the tap device path corresponding to the target virtual network interface, the MAC address of the target virtual network interface, and the target file descriptor. The target file descriptor and the tap device path corresponding to the target virtual network interface are used to associate the target file descriptor with the tap device corresponding to the target virtual network interface, and the MAC address of the target virtual network interface is used to configure the MAC address of the target virtual machine to achieve the creation and binding of the virtual network interface card of the target virtual machine. The QEMU command is executed on the target host machine to create the target virtual machine on the target host machine through the target virtual network interface.

3. The method according to claim 1 or 2, characterized in that, The virtualization system further includes at least one VTEP switch, and the method further includes: When the target virtual machine sends the target data packet, it sends the target data packet through the target virtual network interface, so that the target data packet is tagged with the VLAN tag of the target VLAN sub-interface when it passes through the target VLAN sub-interface; wherein, a data packet sent by a virtual network interface will reach the physical network card through the VLAN sub-interface it belongs to; The target data packet enters the EVPN network through the physical network card of the target host machine. After reaching the target VTEP switch, the target VTEP switch determines the virtual machine to which the target data packet belongs based on the VLAN tag carried by the target data packet, and determines the data packet to be sent corresponding to the target data packet based on the virtual machine to which the target data packet belongs, so as to forward the data packet to be sent.

4. The method according to claim 3, characterized in that, The step of determining the data packet to be sent corresponding to the target data packet based on the virtual machine to which the target data packet belongs includes: When the destination device of the target data packet and the virtual machine to which the target data packet belongs belong to the same VTEP switch, the VLAN tag carried by the target data packet is replaced with the VLAN tag of the VLAN sub-interface corresponding to the destination device to obtain the data packet to be sent corresponding to the target data packet; When the destination device and the virtual machine to which the target data packet belongs do not belong to the same VTEP switch, the target data packet is encapsulated in VXLAN to obtain a VXLAN data packet, and the VXLAN data packet is used as the data packet to be sent.

5. The method according to claim 4, characterized in that, The forwarding of the data packet to be sent includes: When the destination device and the virtual machine to which the target data packet belongs belong to the same VTEP switch, the data packet to be sent is forwarded to the destination device; When the destination device and the virtual machine to which the target data packet belongs do not belong to the same VTEP switch, the data packet to be sent is forwarded to the VTEP switch to which the destination device belongs, so that the VTEP switch to which the destination device belongs can determine the decapsulated data packet and send the decapsulated data packet to the destination device.

6. The method according to claim 1 or 2, characterized in that, The method further includes: When the target virtual machine is deleted, the cloud platform releases the target virtual network interface, the target VLAN sub-interface, and the target VLAN identifier; and / or, Clean up the network configuration corresponding to the target virtual machine.

7. The method according to claim 1 or 2, characterized in that, The virtualization system also includes EVPN network equipment; In this system, virtual machine data packets with different VLAN identifiers are isolated in the EVPN network through VLAN tags. A VLAN tag includes a VLAN identifier, and the EVPN network device supports traffic isolation based on VLAN identifiers.

8. A virtualization system, characterized in that, The virtualization system resides within an EVPN network and includes a cloud platform and at least one host machine; the virtualization system includes: The cloud platform is used to determine the target tenant information of the target virtual machine indicated by the virtual machine creation request when it receives the virtual machine creation request, and to determine the target host from the at least one host based on the target tenant information. The cloud platform is also used to assign a target VLAN identifier to the target virtual machine and create a target VLAN sub-interface on the physical network card of the target host machine based on the target VLAN identifier. The cloud base platform is also used to create a target virtual network interface on the target VLAN sub-interface, so that the data packets sent by the target virtual network interface support carrying the VLAN tag of the target VLAN sub-interface; The cloud platform is also used to create the target virtual machine on the target host machine through the target virtual network interface, so that the target virtual network interface is bound to the target virtual machine.

9. The virtualization system according to claim 8, characterized in that, When the cloud platform creates the target virtual machine on the target host machine through the target virtual network interface, it is specifically used for: Obtain the tap device path corresponding to the target virtual network interface, and obtain the MAC address of the target virtual network interface; The target file descriptor is determined, and a QEMU command is generated based on the tap device path corresponding to the target virtual network interface, the MAC address of the target virtual network interface, and the target file descriptor. The target file descriptor and the tap device path corresponding to the target virtual network interface are used to associate the target file descriptor with the tap device corresponding to the target virtual network interface, and the MAC address of the target virtual network interface is used to configure the MAC address of the target virtual machine to achieve the creation and binding of the virtual network interface card of the target virtual machine. The QEMU command is executed on the target host machine to create the target virtual machine on the target host machine through the target virtual network interface.

10. The virtualization system according to claim 8 or 9, characterized in that, The virtualization system also includes at least one VTEP switch. The target virtual machine is used to send the target data packet through the target virtual network interface when sending the target data packet, so that the target data packet is tagged with the VLAN tag of the target VLAN sub-interface when it passes through the target VLAN sub-interface; wherein, a data packet sent by a virtual network interface will reach the physical network card through the VLAN sub-interface it belongs to; The target data packet enters the EVPN network through the physical network card of the target host machine. After reaching the target VTEP switch, the target VTEP switch determines the virtual machine to which the target data packet belongs based on the VLAN tag carried by the target data packet, and determines the data packet to be sent corresponding to the target data packet based on the virtual machine to which the target data packet belongs, so as to forward the data packet to be sent.

Images