Container network isolation control system, method, electronic device and storage medium

Abstract

This application discloses a container network isolation control system, method, electronic device, and storage medium. The container network isolation control system includes a central control node and edge nodes. Each edge node is equipped with an edge node control container, and each edge node is equipped with at least two Pods. One of the Pods runs the edge node control container, and the other Pods run at least one service container. The central control node is used to obtain network configuration policies and, for each network configuration policy, distributes the network configuration policy to the edge node control container on the edge node to which the corresponding first target service belongs. The edge nodes are used to parse the first target service corresponding to the received network configuration policy through the edge node control container running on them, and distribute the network configuration policy to the Pod network namespace corresponding to the first target service, so as to execute the network configuration policy in the Pod network namespace.

Description

Technical Field

[0001] This application relates to the field of network communication technology, and in particular to network isolation control systems, methods, electronic devices and storage media for containers. Background Technology

[0002] With the development of cloud-native technologies, container services based on Kubernetes are becoming increasingly widespread. Kubernetes is a distributed architecture solution based on container technology. Essentially, it's a cluster of servers where various services can be deployed. Deploying services involves running individual containers within the cluster, running specific business applications within these containers. Networking in a container environment is more complex than in a regular network, making network isolation and network policy configuration within container clusters more intricate. Traditional container network isolation solutions include two approaches: one is to control all containers by issuing global network configuration policies to the container host; the other is to issue unified ACL (Access Control List) policies using SDN (Software Defined Network) tools such as OVS (Open vSwitch). Both methods require issuing numerous rules, resulting in low maintainability. Another approach is to inject containers into the network namespace of each Pod for network isolation. However, this method involves starting additional containers and altering the internal container structure of the Pod, leading to high modification costs and wasted computing resources. Summary of the Invention

[0003] To address the issues of low policy maintainability and wasted computing resources due to container injection in existing container network isolation schemes, embodiments of this application provide a container network isolation control system, method, electronic device, and storage medium.

[0004] In a first aspect, embodiments of this application provide a network isolation control system for containers, including a central control node and edge nodes. Each edge node is equipped with an edge node control container, and each edge node has at least two Pods. One of the Pods runs the edge node control container, and the other Pods run at least one service container, wherein:

[0005] The central control node is used to obtain network configuration policies and, for each network configuration policy, distribute the network configuration policy to the edge node control container on the edge node to which the corresponding first target service belongs.

[0006] The edge node is used to parse the first target service corresponding to the network configuration policy received by the edge node control container running on it, and to distribute the network configuration policy to the Pod network namespace corresponding to the first target service, so as to execute the network configuration policy in the Pod network namespace corresponding to the first target service.

[0007] In one possible implementation, the edge node is specifically used to control the container running on it to determine the first Pod network namespace identifier corresponding to the first target service based on the correspondence between the stored service identifier and the Pod network namespace identifier, and to distribute the network configuration policy to the Pod network namespace corresponding to the first Pod network namespace identifier, so as to execute the network configuration policy in the Pod network namespace corresponding to the first Pod network namespace identifier.

[0008] In one possible implementation, the central control node is further configured to, if it is determined that any network configuration policy is updated, send a policy update indication message to the edge node control container on the edge node to which the second target service corresponding to the updated network configuration policy belongs, the policy update indication message carrying the updated network configuration policy.

[0009] The edge node is further configured to parse the received updated network configuration policy corresponding to the second target service through the edge node control container running on it, determine the second Pod network namespace identifier corresponding to the second target service identifier according to the correspondence between the service identifier and the Pod network namespace identifier, and send the updated network configuration policy to the Pod network namespace corresponding to the second Pod network namespace identifier for policy update.

[0010] In one possible implementation, the central control node is further configured to replace the previous network configuration policy with the updated network configuration policy if it is determined that any of the network configuration policies has been updated.

[0011] In one possible implementation, the central control node is further configured to, if it is determined that the resource attributes of the service container in the Pod of any edge node are updated, distribute the current network configuration policy corresponding to the service in the service container of the Pod of any edge node to the edge node control container on the arbitrary edge node.

[0012] The arbitrary edge node is used to control the container running on it to distribute the received current network configuration policy to the Pod network namespace to which the service container whose resource attributes have been updated belongs, and to perform corresponding processing on the service container whose resource attributes have been updated according to the current network configuration policy.

[0013] In one possible implementation, the edge node is further configured to use the edge node control container running on it to detect, at a preset time period, whether the current execution policy of each Pod network namespace on the edge node is consistent with the network configuration policy currently stored by the central control node. If it is determined that they are inconsistent, the execution policy of the corresponding Pod network namespace is modified according to the network configuration policy currently stored by the central control node.

[0014] Secondly, embodiments of this application provide a container network isolation control method implemented on the central control node side, applied to the container network isolation control system described in embodiments of this application. The container network isolation control system includes a central control node and edge nodes. Each edge node is equipped with an edge node control container, and each edge node is equipped with at least two Pods. One Pod runs the edge node control container, and the other Pods run at least one service container. The method includes:

[0015] The central control node acquires the network configuration policy;

[0016] For each network configuration policy, the network configuration policy is sent to the edge node control container on the edge node to which the corresponding first target service belongs, so that the edge node control container parses the first target service corresponding to the received network configuration policy, and sends the network configuration policy to the Pod network namespace corresponding to the first target service, so as to execute the network configuration policy in the Pod network namespace corresponding to the first target service.

[0017] In one possible implementation, the method further includes:

[0018] If any network configuration policy is determined to be updated, a policy update indication message is sent to the edge node control container on the edge node to which the second target service corresponding to the updated network configuration policy belongs. The policy update indication message carries the updated network configuration policy, so that the edge node control container parses the received second target service corresponding to the updated network configuration policy and distributes the updated network configuration policy to the Pod network namespace corresponding to the second target service for policy update.

[0019] In one possible implementation, the method further includes:

[0020] If it is determined that any of the network configuration policies will be updated, the updated network configuration policy will replace the previous network configuration policy.

[0021] In one possible implementation, the method further includes:

[0022] If it is determined that the resource attributes of a service container in a Pod of any edge node are updated, the current network configuration policy corresponding to the service container in the Pod of that edge node is sent to the edge node control container on that edge node. This allows the edge node control container on that edge node to send the received current network configuration policy to the network namespace of the Pod to which the resource attributes of the service container that has been updated to be processed according to the current network configuration policy.

[0023] Thirdly, embodiments of this application provide a container network isolation control device implemented on the central control node side, applied to the container network isolation control system described in embodiments of this application. The container network isolation control system includes a central control node and edge nodes. Each edge node is equipped with an edge node control container, and each edge node is equipped with at least two Pods. One Pod runs the edge node control container, and the other Pods run at least one service container. The device includes:

[0024] The acquisition unit is used to acquire network configuration policies.

[0025] The publishing unit is used to distribute the network configuration policy to the edge node control container on the edge node to which the corresponding first target service belongs for each network configuration policy, so that the edge node control container parses the first target service corresponding to the received network configuration policy and distributes the network configuration policy to the Pod network namespace corresponding to the first target service, so as to execute the network configuration policy in the Pod network namespace corresponding to the first target service.

[0026] In one possible implementation, the publishing unit is further configured to, if it is determined that any network configuration policy is updated, send a policy update indication message to the edge node control container on the edge node to which the second target service corresponding to the updated network configuration policy belongs. The policy update indication message carries the updated network configuration policy, so that the edge node control container parses the received second target service corresponding to the updated network configuration policy and distributes the updated network configuration policy to the Pod network namespace corresponding to the second target service for policy update.

[0027] In one possible implementation, the device further includes:

[0028] The update unit is configured to replace the previous network configuration policy with the updated network configuration policy if it is determined that any of the network configuration policies will be updated.

[0029] In one possible implementation, the publishing unit is further configured to, if it is determined that the resource attributes of the service container in the Pod of any edge node are updated, distribute the current network configuration policy corresponding to the service in the Pod of any edge node to the edge node control container on the arbitrary edge node, so that the edge node control container on the arbitrary edge node distributes the received current network configuration policy to the Pod network namespace to which the service container whose resource attributes have been updated belongs, and performs corresponding processing on the service container whose resource attributes have been updated according to the current network configuration policy.

[0030] Fourthly, this application provides a container network isolation control method implemented at the edge node side, applied to the container network isolation control system described in this application. The container network isolation control system includes a central control node and edge nodes. Each edge node is equipped with an edge node control container, and each edge node is equipped with at least two Pods. One of the Pods runs the edge node control container, and the other Pods run at least one service container. The method includes:

[0031] An edge node control container running on an edge node receives a network configuration policy issued by the central control node, wherein the edge node is the edge node to which the first target service corresponding to the network configuration policy belongs.

[0032] Parse the first target service corresponding to the network configuration policy;

[0033] The network configuration policy is distributed to the Pod network namespace corresponding to the first target service, so as to execute the network configuration policy in the Pod network namespace corresponding to the first target service.

[0034] In one possible implementation, the network configuration policy is distributed to the Pod network namespace corresponding to the first target service, so as to execute the network configuration policy in the Pod network namespace corresponding to the first target service, specifically including:

[0035] The first Pod network namespace identifier corresponding to the first target service is determined based on the correspondence between the stored service identifier and the Pod network namespace identifier.

[0036] The network configuration policy is distributed to the Pod network namespace corresponding to the first Pod network namespace identifier, so that the network configuration policy is executed in the Pod network namespace corresponding to the first Pod network namespace identifier.

[0037] In one possible implementation, the method further includes:

[0038] The central control node sends a policy update indication message, which is sent by the central control node to the edge node control container running on the edge node when the central control node determines that the network configuration policy corresponding to the second target service on the edge node has been updated. The policy update indication message carries the updated network configuration policy.

[0039] Parse the second target service corresponding to the updated network configuration policy;

[0040] The updated network configuration policy is distributed to the Pod network namespace corresponding to the second target service for policy update.

[0041] In one possible implementation, the updated network configuration policy is distributed to the Pod network namespace corresponding to the second target service for policy update, specifically including:

[0042] The second Pod network namespace identifier corresponding to the second target service identifier is determined based on the correspondence between the service identifier and the Pod network namespace identifier.

[0043] The updated network configuration policy is distributed to the Pod network namespace corresponding to the second Pod network namespace identifier for policy update.

[0044] In one possible implementation, the method further includes:

[0045] The central control node receives the current network configuration policy, which is issued by the central control node to the edge control container of the edge node when it determines that the resource attributes of the service container in the Pod of the edge node have been updated.

[0046] The current network configuration policy is distributed to the Pod network namespace of the service container whose resource attributes have been updated, and the service container whose resource attributes have been updated is processed accordingly according to the current network configuration policy.

[0047] In one possible implementation, the method further includes:

[0048] The system checks whether the current execution policy of each Pod network namespace on the edge node is consistent with the network configuration policy currently stored in the central control node according to a preset time period.

[0049] If a mismatch is determined, the execution policy of the corresponding Pod network namespace is modified according to the network configuration policy currently stored in the central control node.

[0050] Fifthly, this application provides a container network isolation control device implemented at the edge node side, applied to the container network isolation control system described in this application. The container network isolation control system includes a central control node and edge nodes. Each edge node is equipped with an edge node control container, and each edge node is equipped with at least two Pods. One of the Pods runs the edge node control container, and the other Pods run at least one service container. The device includes:

[0051] The receiving unit is configured to receive the network configuration policy issued by the central control node through the edge node control container running on the edge node, wherein the edge node is the edge node to which the first target service corresponding to the network configuration policy belongs.

[0052] The parsing unit is used to parse the first target service corresponding to the network configuration policy;

[0053] The distribution unit is used to distribute the network configuration policy to the Pod network namespace corresponding to the first target service, so as to execute the network configuration policy in the Pod network namespace corresponding to the first target service.

[0054] In one possible implementation, the issuing unit is specifically configured to determine the first Pod network namespace identifier corresponding to the first target service based on the correspondence between the stored service identifier and the Pod network namespace identifier; and to issue the network configuration policy to the Pod network namespace corresponding to the first Pod network namespace identifier, so as to execute the network configuration policy in the Pod network namespace corresponding to the first Pod network namespace identifier.

[0055] In one possible implementation, the receiving unit is further configured to receive a policy update indication message sent by the central control node. The policy update indication message is sent by the central control node to the edge node control container running on the edge node when it determines that the network configuration policy corresponding to the second target service on the edge node has been updated. The policy update indication message carries the updated network configuration policy.

[0056] The parsing unit is also used to parse the second target service corresponding to the updated network configuration policy;

[0057] The distribution unit is further configured to distribute the updated network configuration policy to the Pod network namespace corresponding to the second target service for policy update.

[0058] In one possible implementation, the issuing unit is specifically configured to determine the second Pod network namespace identifier corresponding to the second target service identifier based on the correspondence between the service identifier and the Pod network namespace identifier; and to issue the updated network configuration policy to the Pod network namespace corresponding to the second Pod network namespace identifier for policy update.

[0059] In one possible implementation, the receiving unit is further configured to receive a current network configuration policy issued by the central control node, wherein the current network configuration policy is issued by the central control node to the edge control container of the edge node when the central control node determines that it has detected an update of the resource attributes of the service container in the Pod of the edge node.

[0060] The distribution unit is further configured to distribute the current network configuration policy to the Pod network namespace to which the service container whose resource attributes have been updated belongs, and perform corresponding processing on the service container whose resource attributes have been updated according to the current network configuration policy.

[0061] In one possible implementation, the device further includes:

[0062] The detection unit is used to detect, according to a preset time period, whether the current execution policy of each Pod network namespace on the edge node is consistent with the network configuration policy currently stored by the central control node;

[0063] The modification unit is used to modify the execution policy of the corresponding Pod network namespace according to the network configuration policy currently stored by the central control node if the detection unit determines that there is a mismatch.

[0064] In a sixth aspect, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the network isolation control method for containers described in this application.

[0065] In a seventh aspect, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the network isolation control method for containers described in this application.

[0066] The beneficial effects of the embodiments of this application are as follows:

[0067] The container network isolation control system provided in this application includes a central control node and edge nodes. Each edge node is equipped with an edge node control container, and each edge node is equipped with at least two Pods. One of the Pods runs the edge node control container, and the other Pods run at least one service container. The central control node is used to obtain network configuration policies. For each network configuration policy, the central control node distributes the network configuration policy to the edge node control container on the edge node to which the corresponding first target service belongs. The edge node is used to parse the first target service corresponding to the received network configuration policy through the edge node control container running on it, and distribute the network configuration policy to the Pod network namespace corresponding to the first target service, so as to execute the network configuration policy in the Pod network namespace corresponding to the first target service. In the container network isolation control system provided in this application embodiment, an edge node control container is set up on each edge node. The central control node distributes each network configuration policy to the edge node control container of the edge node to which the first target service of the corresponding network configuration policy belongs. The edge node control container parses the first target service corresponding to the network configuration policy and distributes the network configuration policy to the Pod network namespace corresponding to the first target service. The execution of the network configuration policy is directly controlled independently in the corresponding Pod network namespace, realizing the isolation of container networks in Pods. In this way, the network configuration policy is operated directly on the Pod network namespace. It is not necessary to inject containers into each Pod network namespace, avoiding the modification of the service container structure in the Pod and saving computing resources. The central control node also does not need to distribute global network configuration policies to all edge nodes, improving the maintainability of the policy and reducing the modification and dependence on the host namespace rules.

[0068] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0069] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0070] Figure 1 This is a schematic diagram of the network isolation control system for containers provided in an embodiment of this application;

[0071] Figure 2A schematic diagram illustrating the implementation process of the network isolation control method implemented on the central control node side as provided in the embodiments of this application;

[0072] Figure 3 A schematic diagram of the network isolation control device implemented on the central control node side as provided in the embodiments of this application;

[0073] Figure 4 A schematic diagram illustrating the implementation process of the network isolation control method for containers implemented on the edge node side as provided in this application embodiment;

[0074] Figure 5 A schematic diagram of the structure of a network isolation control device for a container implemented on the edge node side as provided in an embodiment of this application;

[0075] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0076] To address the problems in the background art, embodiments of this application provide a network isolation control system, method, electronic device, and storage medium for containers.

[0077] The preferred embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit this application. Furthermore, the embodiments and features in the embodiments of this application can be combined with each other without conflict.

[0078] In this document, it is important to understand that the technical terms used in this application refer to:

[0079] 1. Pod: Kubernetes abstracts container technology further, the most important aspect of which is the introduction of the Pod concept. The smallest control unit in Kubernetes is the Pod, not the container. Containers must be run within Pods. A Pod can be simply considered an extension of a container. From a network perspective, a Pod meets the following conditions:

[0080] (1) Each Pod has a unique IP address, and all Pods are in a flat network space that can be directly connected.

[0081] (2) At least one container can run within a Pod, and all containers within the same Pod share the same network namespace. All containers within the same Pod share a port and can be accessed directly via localhost+port.

[0082] Kubernetes defines the basic requirements for a cluster network:

[0083] Any two Pods can communicate directly without explicit NAT address translation; any cluster node can communicate directly with any Pod without explicit address translation, and vice versa; any Pod sees its own IP address as the same as others see it, without going through address translation in between.

[0084] 2. Pod network namespace: Used to isolate the runtime environment of Pods.

[0085] 3. Injected Container: An isolated component container that runs additionally in the Pod network namespace.

[0086] like Figure 1 The diagram shows the structure of the container network isolation control system provided in this embodiment. The container network isolation control system may include a central control node 11 and edge nodes 12. The container network isolation control system in this embodiment can build a cluster network based on Kubernetes, and the API Server (Application Programming Interface Service) is responsible for communication between various functional modules of the cluster. The central control node 11 can be one server or multiple servers. The container network isolation control system in this embodiment includes at least one edge node 12. Each edge node 12 is equipped with an edge node control container. Each edge node 12 is equipped with at least two Pods. The edge node control container can run on one of the Pods, and at least one business container can run on the other Pods. A group of business containers in each Pod running a business container can run the same business application. For example, the business containers in Pod-web1 in edge node 1 (Node1) run Web application 1, the business containers in Pod-web2 run Web application 2, the business containers in Pod-web1 in edge node 2 (Node2) run Web application 1, and the business containers in Pod-web3 run Web application 3. The central control node 11 may include a monitoring module (Watcher), a policy database, a policy API, and a publishing module. Among these:

[0087] The central control node 11 is used to obtain network configuration policies and, for each network configuration policy, distribute the network configuration policy to the edge node control container on the edge node to which the corresponding first target service belongs.

[0088] In practical implementation, after the cluster is established, the central control node 11 creates a container information database. It can obtain container resource information running in Pods on each edge node 12 through the control API (i.e., API Server). Containers include edge node control containers and service containers. Container resource information may include, but is not limited to, the following: container ID, container IP, edge node information to which the container belongs, and service information running on the service containers. The service information may be service identification information, i.e., the mapping between service container IDs and service identifiers. Container resource information also includes the mapping between the service container ID and the network namespace identifier of its Pod. For a Pod running a service container, the ID of any of its service containers can be used as the network namespace identifier for that Pod. The central control node 11 stores the obtained container resource information in the container information database.

[0089] The central control node 11 creates a monitoring module, namely Pod-Watcher. The monitoring module is used to monitor changes in container resources of each edge node 12 in real time, such as adding containers, deleting containers, and modifying container IPs. If changes in container resources are detected, they are synchronously modified in the container information database.

[0090] Central control node 11 creates a policy database to store acquired network configuration policies. When a network configuration policy is updated, it is synchronously updated in the policy database. The network configuration policies can be, but are not limited to, the following: routing policies (iptables rules) and netfilter policies (i.e., firewall network filtering policies). These network configuration policies can be used for network isolation of containers running on edge node 12.

[0091] During real-time processing, the central control node 11 can receive network configuration policies sent by the client through the set policy interface. For each network configuration policy, it parses the target service corresponding to the network configuration policy (which can be referred to as the first target service), finds the edge node 12 to which the service container corresponding to the first target service belongs from the container information database, and publishes the network configuration policy to the edge node control container on the edge node 12 to which the first target service belongs through the publishing module.

[0092] In this way, the central control node 11 only needs to distribute the network configuration policy corresponding to the service to the edge node 12 to which the service belongs, without distributing the global network configuration policy to all edge nodes 12, which can effectively improve the maintainability of the policy.

[0093] Edge node 12 is used to control the container running on it to parse the received network configuration policy corresponding to the first target service, and to distribute the network configuration policy to the Pod network namespace corresponding to the first target service, so as to execute the network configuration policy in the Pod network namespace corresponding to the first target service.

[0094] In practice, after the edge node control container in edge node 12 starts, it establishes a connection with the service containers in edge node 12 in memory. It pre-obtains the mapping between service container IDs and service identifiers, as well as the mapping between service container IDs and their respective Pod network namespace identifiers. This allows it to obtain the mapping between service identifiers, Pod network namespace identifiers, and service container IDs, and stores this mapping in a cache. If the edge node control container needs to operate on the Pod network namespace (such as issuing network configuration policies), it can directly operate on the corresponding Pod network namespace through the " / Proc / pid / ns / net" file handle and configure the corresponding network configuration policy through "netlink".

[0095] Edge node 12 is specifically used to control the container running on it to determine the first Pod network namespace identifier corresponding to the first target service based on the correspondence between the stored service identifier and the Pod network namespace identifier, and to distribute the network configuration policy to the Pod network namespace corresponding to the first Pod network namespace identifier, so as to execute the network configuration policy in the Pod network namespace corresponding to the first Pod network namespace identifier.

[0096] Specifically, after receiving the network policy issued by the central control node 11, the edge node control container in edge node 12 parses out the corresponding first target service from the network configuration policy. Then, the edge node control container looks up the Pod network namespace identifier (which can be denoted as the first Pod network namespace identifier) ​​corresponding to the first target service from the cached correspondence between service identifier and Pod network namespace identifier. The edge node control container then issues the network configuration policy to the Pod network namespace corresponding to the first Pod network namespace identifier and executes the network configuration policy in the Pod network namespace corresponding to the first Pod network namespace identifier.

[0097] In one possible implementation, the central control node 11 is further configured to send a policy update indication message to the edge node control container on the edge node to which the second target service corresponding to the updated network configuration policy belongs if it is determined that any network configuration policy is updated. The policy update indication message carries the updated network configuration policy.

[0098] In specific implementation, if the central control node 11 receives an updated network configuration policy from the client for any cached network configuration policy, it parses out the corresponding second target service from the updated network configuration policy, and then searches the container information database for the edge node 12 to which the service container corresponding to the second target service belongs. The central control node 11 carries the network configuration policy in the policy update instruction message and sends the policy update instruction message to the edge node control container on the edge node 12 to which the corresponding second target service belongs through the publishing module.

[0099] The central control node is also used to replace the previous network configuration policy with the updated network configuration policy if it is determined that any network configuration policy has been updated.

[0100] Edge node 12 is also used to control the container running on it to parse the second target service corresponding to the updated network configuration policy received, determine the second Pod network namespace identifier corresponding to the second target service identifier according to the correspondence between the service identifier and the Pod network namespace identifier, and send the updated network configuration policy to the Pod network namespace corresponding to the second Pod network namespace identifier for policy update.

[0101] In practice, after receiving the policy update instruction message from the central control node 11, the edge node control container running on edge node 12 extracts the updated network configuration policy from the policy update instruction message, parses the corresponding second target service from the updated network configuration policy, and then looks up the Pod network namespace identifier (which can be denoted as the second Pod network namespace identifier) ​​corresponding to the second target service from the cached correspondence between service identifier and Pod network namespace identifier. The edge node control container then sends the updated network configuration policy to the Pod network namespace corresponding to the second Pod network namespace identifier, and executes the updated network configuration policy in the Pod network namespace corresponding to the second Pod network namespace identifier.

[0102] In one possible implementation, the central control node 11 is further configured to, if it is determined that an update of the resource attributes of the service container in the Pod of any edge node 12 is detected, distribute the current network configuration policy corresponding to the service container in the Pod of any edge node 12 to the edge node control container on the any edge node 12.

[0103] In practice, if the central control node 11 detects that the resource attributes of the business container in the Pod of any edge node 12 have been updated, such as the deletion, addition, or modification of the business container's IP address, it will search the policy database for the current network configuration policy corresponding to the business container in the Pod of that edge node 12, and then distribute the current network configuration policy to the edge node control container on that edge node 12 through the publishing module.

[0104] Any edge node 12 is used to control the container running on it to distribute the received current network configuration policy to the Pod network namespace to which the business container whose resource attributes have been updated belongs, and to perform corresponding processing on the business container whose resource attributes have been updated according to the current network configuration policy.

[0105] In practice, after the edge node control container on any edge node 12 receives the current network configuration policy sent by the central control node 11, the edge node control container parses the corresponding service from the network configuration policy, that is, the service corresponding to the service container whose resource attributes have been updated. Then, the edge node control container looks up the Pod network namespace identifier corresponding to the service container whose resource attributes have been updated from the cached correspondence between service identifier and Pod network namespace identifier. The edge node control container then sends the current network configuration policy to the Pod network namespace corresponding to the Pod network namespace identifier and performs the corresponding processing on the service container whose resource attributes have been updated according to the current network configuration policy.

[0106] In one possible implementation, the edge node 12 is further configured to detect, through the edge node control container running thereon, whether the current execution policy of each Pod network namespace on the edge node 12 is consistent with the network configuration policy currently stored by the central control node 11 according to a preset time period. If it is determined that they are inconsistent, the execution policy of the corresponding Pod network namespace is modified according to the network configuration policy currently stored by the central control node 11.

[0107] In practice, the edge node control container running on edge node 12 can also detect, at a preset time period, whether the current execution policy of each Pod network namespace contained on edge node 12 is consistent with the network configuration policy corresponding to the business of each Pod network namespace currently stored in central control node 11. If the current execution policy of any Pod network namespace is inconsistent with the network configuration policy corresponding to the business of that Pod network namespace currently stored in central control node 11, the edge node control container will modify the current execution policy of that Pod network namespace to the network configuration policy corresponding to the business of that Pod network namespace currently stored in central control node 11. This ensures the consistency between the current execution policy of the Pod network namespace and the network configuration policy corresponding to the business of that Pod network namespace stored in central control node 11, and improves the accuracy of container running network rules.

[0108] In the container network isolation control system provided in this application embodiment, an edge node control container is set up on each edge node. The central control node distributes each network configuration policy to the edge node control container of the edge node to which the first target service of the corresponding network configuration policy belongs. The edge node control container parses the first target service corresponding to the network configuration policy and distributes the network configuration policy to the Pod network namespace corresponding to the first target service. The execution of the network configuration policy is directly controlled independently in the corresponding Pod network namespace, realizing the isolation of container networks in Pods. In this way, the network configuration policy is operated directly on the Pod network namespace. It is not necessary to inject containers into each Pod network namespace, avoiding the modification of the service container structure in the Pod and saving computing resources. The central control node also does not need to distribute global network configuration policies to all edge nodes, improving the maintainability of the policy and reducing the modification and dependence on the host namespace rules.

[0109] Based on the same inventive concept, this application also provides a container network isolation control method implemented on the central control node side. Since the principle of the above container network isolation control method is similar to that of the container network isolation control system, the implementation of the above method can refer to the implementation of the system, and repeated parts will not be described again.

[0110] like Figure 2The diagram illustrates the implementation flow of a container network isolation control method implemented on the central control node side according to an embodiment of this application. Applied to the container network isolation control system described in this embodiment, the container network isolation control system includes a central control node and edge nodes. Each edge node is equipped with an edge node control container, and each edge node has at least two Pods. One Pod runs the edge node control container, and the other Pods run at least one service container. The method includes:

[0111] S21. The central control node obtains the network configuration policy.

[0112] S22. For each network configuration policy, the network configuration policy is sent to the edge node control container on the edge node to which the corresponding first target service belongs, so that the edge node control container can parse the first target service corresponding to the received network configuration policy and send the network configuration policy to the Pod network namespace corresponding to the first target service, so as to execute the network configuration policy in the Pod network namespace corresponding to the first target service.

[0113] In one possible implementation, the method further includes:

[0114] If any network configuration policy is determined to be updated, a policy update indication message is sent to the edge node control container on the edge node to which the second target service corresponding to the updated network configuration policy belongs. The policy update indication message carries the updated network configuration policy, so that the edge node control container parses the received second target service corresponding to the updated network configuration policy and distributes the updated network configuration policy to the Pod network namespace corresponding to the second target service for policy update.

[0115] In one possible implementation, the method further includes:

[0116] If it is determined that any of the network configuration policies will be updated, the updated network configuration policy will replace the previous network configuration policy.

[0117] In one possible implementation, the method further includes:

[0118] If it is determined that the resource attributes of a service container in a Pod of any edge node are updated, the current network configuration policy corresponding to the service container in the Pod of that edge node is sent to the edge node control container on that edge node. This allows the edge node control container on that edge node to send the received current network configuration policy to the network namespace of the Pod to which the resource attributes of the service container that has been updated to be processed according to the current network configuration policy.

[0119] Based on the same inventive concept, this application also provides a container network isolation control device implemented on the central control node side. Since the principle of the above-mentioned container network isolation control device in solving the problem is similar to that of the container network isolation control system, the implementation of the above-mentioned device can refer to the implementation of the system, and the repeated parts will not be described again.

[0120] like Figure 3 The diagram shown is a structural schematic of a container network isolation control device implemented on the central control node side according to an embodiment of this application. Applied to the container network isolation control system described in this embodiment, the container network isolation control system includes a central control node and edge nodes. Each edge node is equipped with an edge node control container, and each edge node has at least two Pods. One Pod runs the edge node control container, and the other Pods run at least one service container. The device includes:

[0121] Acquisition unit 31 is used to acquire network configuration policies;

[0122] The publishing unit 32 is used to distribute the network configuration policy to the edge node control container on the edge node to which the corresponding first target service belongs for each network configuration policy, so that the edge node control container parses the first target service corresponding to the received network configuration policy and distributes the network configuration policy to the Pod network namespace corresponding to the first target service, so as to execute the network configuration policy in the Pod network namespace corresponding to the first target service.

[0123] In one possible implementation, the publishing unit 32 is further configured to, if it is determined that any network configuration policy is updated, send a policy update indication message to the edge node control container on the edge node to which the second target service corresponding to the updated network configuration policy belongs. The policy update indication message carries the updated network configuration policy, so that the edge node control container parses the received second target service corresponding to the updated network configuration policy and distributes the updated network configuration policy to the Pod network namespace corresponding to the second target service for policy update.

[0124] In one possible implementation, the device further includes:

[0125] The update unit is configured to replace the previous network configuration policy with the updated network configuration policy if it is determined that any of the network configuration policies will be updated.

[0126] In one possible implementation, the publishing unit 32 is further configured to, if it is determined that the resource attributes of the service container in the Pod of any edge node are updated, distribute the current network configuration policy corresponding to the service in the Pod of any edge node to the edge node control container on the arbitrary edge node, so that the edge node control container on the arbitrary edge node distributes the received current network configuration policy to the Pod network namespace to which the service container whose resource attributes have been updated belongs, and performs corresponding processing on the service container whose resource attributes have been updated according to the current network configuration policy.

[0127] Based on the same inventive concept, this application also provides a container network isolation control method implemented on the edge node side. Since the principle of the above container network isolation control method is similar to that of the container network isolation control system, the implementation of the above method can refer to the implementation of the system, and repeated parts will not be described again.

[0128] like Figure 4 The diagram illustrates the implementation flow of a container network isolation control method implemented on the edge node side according to an embodiment of this application. Applied to the container network isolation control system described in this embodiment, the container network isolation control system includes a central control node and edge nodes. Each edge node is equipped with an edge node control container, and each edge node has at least two Pods. One Pod runs the edge node control container, and the other Pods run at least one service container. The method includes:

[0129] S41. The edge node control container running on the edge node receives the network configuration policy issued by the central control node.

[0130] Among them, the edge node is the edge node to which the first target service corresponding to the network configuration policy belongs.

[0131] S42. Analyze the first target service corresponding to the network configuration policy.

[0132] S43. Distribute the network configuration policy to the Pod network namespace corresponding to the first target service, so as to execute the network configuration policy in the Pod network namespace corresponding to the first target service.

[0133] In one possible implementation, the network configuration policy is distributed to the Pod network namespace corresponding to the first target service, and the network configuration policy is executed in the Pod network namespace corresponding to the first target service, specifically including:

[0134] The first Pod network namespace identifier corresponding to the first target service is determined based on the correspondence between the stored service identifier and the Pod network namespace identifier.

[0135] The network configuration policy is distributed to the Pod network namespace corresponding to the first Pod network namespace identifier, so that the network configuration policy is executed in the Pod network namespace corresponding to the first Pod network namespace identifier.

[0136] In one possible implementation, the method further includes:

[0137] The central control node sends a policy update indication message, which is sent by the central control node to the edge node control container running on the edge node when the central control node determines that the network configuration policy corresponding to the second target service on the edge node has been updated. The policy update indication message carries the updated network configuration policy.

[0138] Parse the second target service corresponding to the updated network configuration policy;

[0139] The updated network configuration policy is distributed to the Pod network namespace corresponding to the second target service for policy update.

[0140] In one possible implementation, the updated network configuration policy is distributed to the Pod network namespace corresponding to the second target service for policy update, specifically including:

[0141] The second Pod network namespace identifier corresponding to the second target service identifier is determined based on the correspondence between the service identifier and the Pod network namespace identifier.

[0142] The updated network configuration policy is distributed to the Pod network namespace corresponding to the second Pod network namespace identifier for policy update.

[0143] In one possible implementation, the method further includes:

[0144] The central control node receives the current network configuration policy, which is issued by the central control node to the edge control container of the edge node when it determines that the resource attributes of the service container in the Pod of the edge node have been updated.

[0145] The current network configuration policy is distributed to the Pod network namespace of the service container whose resource attributes have been updated, and the service container whose resource attributes have been updated is processed accordingly according to the current network configuration policy.

[0146] In one possible implementation, the method further includes:

[0147] The system checks whether the current execution policy of each Pod network namespace on the edge node is consistent with the network configuration policy currently stored in the central control node according to a preset time period.

[0148] If a mismatch is determined, the execution policy of the corresponding Pod network namespace is modified according to the network configuration policy currently stored in the central control node.

[0149] Based on the same inventive concept, this application also provides a container network isolation control device implemented on the edge node side. Since the principle of the above-mentioned container network isolation control device in solving the problem is similar to that of the container network isolation control system, the implementation of the above-mentioned device can refer to the implementation of the system, and the repeated parts will not be described again.

[0150] like Figure 5 The diagram shown is a structural schematic of a container network isolation control device implemented on the edge node side according to an embodiment of this application. Applied to the container network isolation control system described in this embodiment, the container network isolation control system includes a central control node and edge nodes. Each edge node is equipped with an edge node control container, and each edge node has at least two Pods. One Pod runs the edge node control container, and the other Pods run at least one service container. The device includes:

[0151] The receiving unit 51 is used to receive the network configuration policy issued by the central control node through the edge node control container running on the edge node, wherein the edge node is the edge node to which the first target service corresponding to the network configuration policy belongs;

[0152] Parsing unit 52 is used to parse the first target service corresponding to the network configuration policy;

[0153] The distribution unit 53 is used to distribute the network configuration policy to the Pod network namespace corresponding to the first target service, so as to execute the network configuration policy in the Pod network namespace corresponding to the first target service.

[0154] In one possible implementation, the sending unit 53 is specifically used to determine the first Pod network namespace identifier corresponding to the first target service based on the correspondence between the stored service identifier and the Pod network namespace identifier; and to send the network configuration policy to the Pod network namespace corresponding to the first Pod network namespace identifier, so as to execute the network configuration policy in the Pod network namespace corresponding to the first Pod network namespace identifier.

[0155] In one possible implementation, the receiving unit 51 is further configured to receive a policy update indication message sent by the central control node. The policy update indication message is sent by the central control node to the edge node control container running on the edge node when it determines that the network configuration policy corresponding to the second target service on the edge node has been updated. The policy update indication message carries the updated network configuration policy.

[0156] The parsing unit 52 is also used to parse the second target service corresponding to the updated network configuration policy;

[0157] The distribution unit 53 is further configured to distribute the updated network configuration policy to the Pod network namespace corresponding to the second target service for policy update.

[0158] In one possible implementation, the distribution unit 53 is specifically used to determine the second Pod network namespace identifier corresponding to the second target service identifier based on the correspondence between the service identifier and the Pod network namespace identifier; and to distribute the updated network configuration policy to the Pod network namespace corresponding to the second Pod network namespace identifier for policy update.

[0159] In one possible implementation, the receiving unit 51 is further configured to receive the current network configuration policy issued by the central control node, wherein the current network configuration policy is issued by the central control node to the edge control container of the edge node when the central control node determines that it has detected an update of the resource attributes of the service container in the Pod of the edge node.

[0160] The distribution unit 53 is further configured to distribute the current network configuration policy to the Pod network namespace to which the service container whose resource attributes have been updated belongs, and perform corresponding processing on the service container whose resource attributes have been updated according to the current network configuration policy.

[0161] In one possible implementation, the device further includes:

[0162] The detection unit is used to detect, according to a preset time period, whether the current execution policy of each Pod network namespace on the edge node is consistent with the network configuration policy currently stored by the central control node;

[0163] The modification unit is used to modify the execution policy of the corresponding Pod network namespace according to the network configuration policy currently stored by the central control node if the detection unit determines that there is a mismatch.

[0164] Based on the same technical concept, this application also provides an electronic device 600, referring to... Figure 6 As shown, the electronic device 600 is used to implement the container network isolation control method described in the above-described method embodiments. The electronic device 600 in this embodiment may include: a memory 601, a processor 602, and a computer program stored in the memory and executable on the processor, such as an implementation program for the container network isolation control method. When the processor executes the computer program, it implements the steps in the above-described embodiments of the container network isolation control method, for example... Figure 2 The step S21 shown. Alternatively, when the processor executes the computer program, it implements the functions of each module / unit in the above-described device embodiments, such as 31.

[0165] This application embodiment does not limit the specific connection medium between the memory 601 and the processor 602. This application embodiment... Figure 6 The memory 601 and the processor 602 are connected via a bus 603, and the bus 603 is in Figure 6 The connections between other components are shown in bold and are for illustrative purposes only, not as limiting information. The bus 603 can be divided into address bus, data bus, control bus, etc. For ease of illustration, Figure 6 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0166] Memory 601 may be volatile memory, such as random-access memory (RAM); memory 601 may also be non-volatile memory, such as read-only memory, flash memory, hard disk drive (HDD), or solid-state drive (SSD); or memory 601 may be any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. Memory 601 may be a combination of the above-described memories.

[0167] Processor 602, used to implement such Figure 2 The above describes a method or implementation for network isolation control of containers implemented on the central control node side. Figure 4 This illustrates a method for controlling network isolation of containers implemented at the edge node side.

[0168] This application also provides a computer-readable storage medium storing computer-executable instructions required to execute the processor, including a program required to execute the processor.

[0169] In some possible implementations, various aspects of the container network isolation control method provided in this application can also be implemented as a program product comprising program code that, when the program product is run on an electronic device, causes the electronic device to perform the steps in the container network isolation control method according to various exemplary embodiments of this application described above.

[0170] Those skilled in the art will understand that embodiments of this application can be provided as systems, methods, apparatus, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0171] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (devices), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0172] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0173] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0174] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0175] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A network isolation control system for containers, characterized by, This includes a central control node and edge nodes. Each edge node has an edge node control container, and each edge node has at least two Pods. One Pod runs the edge node control container, and the other Pods run at least one business container. The central control node is used to obtain network configuration policies and, for each network configuration policy, distribute the network configuration policy to the edge node control container on the edge node to which the corresponding first target service belongs. The network configuration policy includes at least routing policies and firewall network filtering policies. The network configuration policy is used for network isolation of containers running in the edge node. The edge node is configured to parse the first target service corresponding to the received network configuration policy through its running edge node control container, determine the first Pod network namespace identifier corresponding to the first target service based on the stored correspondence between service identifiers and Pod network namespace identifiers, and distribute the network configuration policy to the Pod network namespace corresponding to the first Pod network namespace identifier, so as to execute the network configuration policy in the Pod network namespace corresponding to the first Pod network namespace identifier. The edge node control container directly operates on the Pod network namespace corresponding to the first Pod network namespace identifier through the " / Proc / pid / ns / net" file handle. The edge node control container is also configured to manage the network configuration policy distributed by the central control node. The central control node is also configured to send a policy update indication message to the edge node control container on the edge node to which the second target service corresponding to the updated network configuration policy belongs if it is determined that any network configuration policy is updated. The policy update indication message carries the updated network configuration policy. The edge node is further configured to parse the received updated network configuration policy corresponding to the second target service through the edge node control container running on it, determine the second Pod network namespace identifier corresponding to the second target service identifier according to the correspondence between the service identifier and the Pod network namespace identifier, and send the updated network configuration policy to the Pod network namespace corresponding to the second Pod network namespace identifier for policy update.

2. The system as described in claim 1, characterized in that, The central control node is further configured to replace the previous network configuration policy with the updated network configuration policy if it is determined that any of the network configuration policies has been updated.

3. The system as described in claim 2, characterized in that, The central control node is also used to, if it is determined that the resource attributes of the service container in the Pod of any edge node are updated, distribute the current network configuration policy corresponding to the service in the service container of the Pod of any edge node to the edge node control container on the edge node. The arbitrary edge node is used to control the container running on it to distribute the received current network configuration policy to the Pod network namespace to which the service container whose resource attributes have been updated belongs, and to perform corresponding processing on the service container whose resource attributes have been updated according to the current network configuration policy.

4. The system as described in claim 2, characterized in that, The edge node is also used to control the container running on it to detect, at a preset time period, whether the current execution policy of each Pod network namespace on the edge node is consistent with the network configuration policy currently stored by the central control node. If it is determined that they are inconsistent, the execution policy of the corresponding Pod network namespace is modified according to the network configuration policy currently stored by the central control node.

5. A network isolation control method of containers, characterized by, The method, applied to a container network isolation control system as described in any one of claims 1 to 4, wherein the container network isolation control system includes a central control node and edge nodes, each edge node is provided with an edge node control container, each edge node is provided with at least two Pods, one of which runs the edge node control container, and the other Pods run at least one service container, comprises: The central control node acquires the network configuration policy; For each network configuration policy, the network configuration policy is distributed to the edge node control container on the edge node to which the corresponding first target service belongs. The edge node control container parses the first target service corresponding to the received network configuration policy, determines the first Pod network namespace identifier corresponding to the first target service based on the stored correspondence between service identifier and Pod network namespace identifier, and distributes the network configuration policy to the Pod network namespace corresponding to the first Pod network namespace identifier. The network configuration policy is then executed in the Pod network namespace corresponding to the first Pod network namespace identifier. The network configuration policy includes at least routing policies and firewall network filtering policies, and is used for network isolation of containers running on the edge node. The edge node control container directly operates on the Pod network namespace corresponding to the first Pod network namespace identifier through the " / Proc / pid / ns / net" file handle. The edge node control container manages the network configuration policies distributed by the central control node. The method further includes: If any network configuration policy is determined to be updated, a policy update indication message is sent to the edge node control container on the edge node to which the second target service corresponding to the updated network configuration policy belongs. The policy update indication message carries the updated network configuration policy, so that the edge node control container parses the received second target service corresponding to the updated network configuration policy and distributes the updated network configuration policy to the Pod network namespace corresponding to the second target service for policy update.

6. A network isolation control method of containers, characterized by, The method, applied to a container network isolation control system as described in any one of claims 1 to 4, wherein the container network isolation control system includes a central control node and edge nodes, each edge node is provided with an edge node control container, each edge node is provided with at least two Pods, one of which runs the edge node control container, and the other Pods run at least one service container, comprises: An edge node control container running on an edge node receives a network configuration policy issued by the central control node. The edge node is the edge node to which the first target service corresponding to the network configuration policy belongs. The network configuration policy includes at least a routing policy and a firewall network filtering policy. The network configuration policy is used for network isolation of containers running on the edge node. Parse the first target service corresponding to the network configuration policy; The first Pod network namespace identifier corresponding to the first target service is determined based on the correspondence between the stored service identifier and the Pod network namespace identifier. The network configuration policy is distributed to the Pod network namespace corresponding to the first Pod network namespace identifier, so as to execute the network configuration policy in the Pod network namespace corresponding to the first Pod network namespace identifier. The edge node control container directly operates on the Pod network namespace corresponding to the first Pod network namespace identifier through the " / Proc / pid / ns / net" file handle. The edge node control container is used to manage the network configuration policy distributed by the central control node. The method further includes: The central control node sends a policy update indication message, which is sent by the central control node to the edge node control container running on the edge node when the central control node determines that the network configuration policy corresponding to the second target service on the edge node has been updated. The policy update indication message carries the updated network configuration policy. Parse the second target service corresponding to the updated network configuration policy; The updated network configuration policy is distributed to the Pod network namespace corresponding to the second target service for policy update.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the network isolation control method for containers as described in claim 5 or 6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the container network isolation control method as described in claim 5 or 6.

Images