A virtual machine migration method, device, equipment and medium

Abstract

The application discloses a virtual machine migration method, device, equipment and medium, and belongs to the technical field of servers. The method comprises the following steps: when OpenStack is required to perform a virtual machine migration operation, a target libvirt container image is acquired; a target computing node for deploying the target libvirt container image is specified in the OpenStack, and it is judged whether the target libvirt container image needs to perform the migration operation by using a national secret algorithm according to a global configuration file; if yes, a central certificate is generated according to the national secret algorithm, and a corresponding relationship between the target computing node and the central certificate is stored into a libvirt pod; a client certificate and a server certificate are generated according to the central certificate, and each certificate is stored into a specified directory, so as to deploy the target libvirt container image on the target computing node. By the method, the safety and reliability of the virtual machine in the migration process can be further ensured.

Description

Technical Field

[0001] This invention relates to the field of server technology, and in particular to a method, apparatus, device, and medium for migrating virtual machines. Background Technology

[0002] OpenStack is an open-source platform designed to provide software services for the construction and management of public and private clouds. Due to its stable performance and strong scalability, it has been widely used in various industries. Currently, OpenStack typically uses AES (Advanced Encryption Standard) or RSA encryption algorithms for virtual machine migration. However, AES encryption algorithms have short keys and slow processing speeds, while RSA encryption algorithms have low encryption and decryption efficiency and are only suitable for small amounts of data. This makes virtual machines vulnerable to powerful attacks from malicious actors during migration, resulting in significant security risks.

[0003] Therefore, how to further ensure the security and reliability of virtual machines during the migration process is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] The purpose of this invention is to provide a method, apparatus, device, and medium for migrating virtual machines, so as to further ensure the security and reliability of virtual machines during the migration process.

[0005] To address the aforementioned technical problems, this invention provides a virtual machine migration method, comprising:

[0006] When OpenStack needs to perform a virtual machine migration operation, it obtains the target libvirt container image; wherein, the target libvirt container image is a container image that supports Chinese cryptographic algorithms;

[0007] In the OpenStack environment, specify the target compute node for deploying the target libvirt container image, and determine whether the target libvirt container image needs to be migrated using the national cryptographic algorithm based on the global configuration file.

[0008] If so, a central certificate is generated according to the national cryptographic algorithm, and the correspondence between the target computing node and the central certificate is stored in the libvirt pod;

[0009] A client certificate and a server certificate are generated based on the central certificate, and the central certificate, the client certificate, and the server certificate are stored in a specified directory to deploy the target libvirt container image on the target computing node.

[0010] Preferably, the construction process of the target libvirt container image includes:

[0011] Select a container base image, and install the libvirt code and the Chinese cryptographic algorithm data package into the container base image to obtain the target libvirt container image.

[0012] Preferably, after the process of obtaining the target libvirt container image, the method further includes:

[0013] The target libvirt container image is stored in the OpenStack image repository.

[0014] Preferably, the process of generating a central certificate based on the national cryptographic algorithm and storing the correspondence between the target computing node and the central certificate in the libvirt pod includes:

[0015] If there are multiple target computing nodes, a libvirt job is started on any one of the target computing nodes, and a central certificate is generated according to the national cryptographic algorithm.

[0016] The central certificate is distributed to each compute node of the target compute node, and the correspondence between each compute node and the central certificate is stored in the libvirt pod.

[0017] Preferably, the process of generating a central certificate based on the national cryptographic algorithm includes:

[0018] A central certificate template is created based on the national cryptographic algorithm, and a central certificate private key is generated based on the central certificate template;

[0019] The central certificate is generated based on the central certificate private key.

[0020] Preferably, after determining whether the target libvirt container image needs to be migrated using the national cryptographic algorithm based on the global configuration file, the process further includes:

[0021] If not, then deploy the target libvirt container image directly on the target compute node.

[0022] Preferably, the process of specifying the target compute node for deploying the target libvirt container image in the OpenStack includes:

[0023] The inventory file is used to specify the target compute node in the OpenStack where the target libvirt container image will be deployed.

[0024] To address the aforementioned technical problems, the present invention also provides a virtual machine migration apparatus, comprising:

[0025] The image acquisition module is used to acquire the target libvirt container image when OpenStack needs to perform a virtual machine migration operation; wherein, the target libvirt container image is a container image that supports Chinese cryptographic algorithms;

[0026] The migration judgment module is used to specify the target compute node in the OpenStack where the target libvirt container image is deployed, and to determine whether the target libvirt container image needs to perform a migration operation using the national cryptographic algorithm based on the global configuration file.

[0027] The relational storage module is used to generate a central certificate according to the national cryptographic algorithm when the judgment result of the migration judgment module is yes, and to store the correspondence between the target computing node and the central certificate in libvirtpod;

[0028] The image deployment module is used to generate client certificates and server certificates based on the central certificate, and store the central certificate, the client certificate and the server certificate in a specified directory to deploy the target libvirt container image on the target computing node.

[0029] To address the aforementioned technical problems, the present invention also provides a virtual machine migration device, comprising:

[0030] Memory, used to store computer programs;

[0031] A processor for executing the computer program to implement the steps of a virtual machine migration method as disclosed above.

[0032] To address the aforementioned technical problems, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of a virtual machine migration method as disclosed above.

[0033] As can be seen, the virtual machine migration method provided by this invention involves pre-building a libvirt container image that supports Chinese cryptographic algorithms to obtain the target libvirt container image. When OpenStack needs to perform a virtual machine migration operation, it obtains the target libvirt container image and specifies the target compute node for deploying the target libvirt container image in OpenStack. Then, it determines whether the target libvirt container image needs to be migrated using Chinese cryptographic algorithms based on the global configuration file. If so, a central certificate is generated based on the Chinese cryptographic algorithms, and the correspondence between the target compute node and the central certificate is stored in the libvirt pod. Finally, client and server certificates are generated based on the central certificate, and the central, client, and server certificates are stored in a specified directory to deploy the target libvirt container image on the target compute node. Compared to existing technologies, the method provided by this invention enables OpenStack to support encryption and decryption operations using Chinese cryptographic algorithms when performing virtual machine migration operations. Since the security of Chinese cryptographic algorithms is far higher than that of AES and RSA encryption algorithms, this setup further ensures the security and reliability of the virtual machine during the migration process.

[0034] In addition, the present invention also provides a virtual machine migration apparatus, device and medium, which have the same beneficial effects as the virtual machine migration method described above. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0036] Figure 1 A flowchart illustrating a virtual machine migration method provided in an embodiment of the present invention;

[0037] Figure 2 This is a structural diagram of a virtual machine migration device provided in an embodiment of the present invention;

[0038] Figure 3 This is a structural diagram of a virtual machine migration device provided in an embodiment of the present invention. Detailed Implementation

[0039] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0040] The core of this invention is to provide a method, apparatus, device, and medium for migrating virtual machines, so as to further ensure the security and reliability of virtual machines during the migration process.

[0041] To enable those skilled in the art to better understand the solutions provided by the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0042] Please see Figure 1 , Figure 1 A flowchart of a virtual machine migration method provided in an embodiment of the present invention, the method comprising:

[0043] Step S11: When OpenStack needs to perform a virtual machine migration operation, it obtains the target libvirt container image; wherein, the target libvirt container image is a container image that supports the Chinese cryptographic algorithm;

[0044] Step S12: In OpenStack, specify the target compute node for deploying the target libvirt container image, and determine whether the target libvirt container image needs to be migrated using the national cryptographic algorithm based on the global configuration file;

[0045] Step S13: If yes, generate a central certificate according to the national cryptographic algorithm and store the correspondence between the target computing node and the central certificate in the libvirt pod;

[0046] Step S14: Generate client and server certificates based on the central certificate, and store the central certificate, client certificate and server certificate in the specified directory to deploy the target libvirt container image on the target compute node.

[0047] This embodiment provides a method for migrating virtual machines, which can further ensure the security and reliability of virtual machines during the migration process. Specifically, this method is described using the deployment program in OpenStack as the execution entity.

[0048] In this method, a target libvirt container image that supports the Chinese cryptographic algorithm needs to be built in advance. Specifically, the Chinese cryptographic algorithm data package needs to be installed in the libvirt container image in advance so that the target libvirt container image can be compatible with the Chinese cryptographic algorithm.

[0049] It should be noted that the national cryptographic algorithms, also known as the national commercial cryptographic algorithms, are cryptographic algorithm standards and application specifications recognized and published by the State Cryptography Administration. Some of these algorithms have become international standards. The national cryptographic algorithms include symmetric encryption algorithms, elliptic curve asymmetric encryption algorithms (ECDSA), and hash functions, specifically SM1, SM2, SM3, etc. These encryption algorithms all have a key length and block length of 128 bits and implement symmetric, asymmetric, and hash functions, respectively. Furthermore, since the national cryptographic algorithms are a set of data encryption processing algorithms independently developed and innovated by my country, using them can reduce reliance on foreign technologies for data encryption.

[0050] After creating the target libvirt container image that supports Chinese cryptographic algorithms, if OpenStack needs to perform virtual machine migration operations, it needs to obtain the target libvirt container image and specify the target compute node for deploying the target libvirt container image in OpenStack. The number of target compute nodes can be multiple or one, and should be set according to actual needs. There is no specific limitation here.

[0051] Once the target compute node for deploying the target libvirt container image is specified in OpenStack, the global configuration file is used to determine whether the target libvirt container image needs to undergo migration using Chinese cryptographic algorithms. This is understandable, as the global configuration file is the core of a program component, storing the installation conditions for the target libvirt container image and the installation paths of various running programs. Therefore, based on the information in the global configuration file, it can be determined whether OpenStack needs to use Chinese cryptographic algorithms to perform the migration operation when deploying the target libvirt container image.

[0052] In other words, although the global configuration file is the system's default configuration file, it can be adjusted and modified according to user-defined needs. Therefore, by parsing the information in the global configuration file, it is possible to determine whether a migration operation using Chinese cryptographic algorithms is required when deploying a target libvirt container image in OpenStack.

[0053] Specifically, if parsing the global configuration file determines that OpenStack needs to perform a migration operation using Chinese cryptographic algorithms when deploying the target libvirt container image, then the OpenStack deployment program will start the libvirt job and generate a central certificate based on the Chinese cryptographic algorithms. Simultaneously, it will store the mapping between the central certificate and the target compute node in the libvirt pod and initialize the libvirt pod.

[0054] Understandably, since both libvirt jobs and libvirt pods are applications within the Kubernetes container orchestration engine, and Kubernetes is an open-source platform for managing containerized applications across multiple hosts in a cloud platform, while libvirt pods within Kubernetes are primarily used for managing virtual machines or containers, storing the mapping between target compute nodes and central certificates in libvirt pods allows Kubernetes to be used to manage the target libvirt container image on the target compute node and enable the target libvirt container image to complete subsequent migration tasks.

[0055] When the mapping between the central certificate and the target compute node is stored in the libvirt pod, the OpenStack deployment program also generates client and server certificates based on the central certificate and stores them in a designated directory. This designated directory refers to the storage location of the AES and RSA encryption algorithms used by OpenStack during virtual machine migration in existing technologies. Essentially, storing the central, client, and server certificates in this directory replaces the existing AES and RSA encryption algorithm data packets with Chinese national cryptographic algorithm data packets. This allows OpenStack to directly access the relevant certificates, keys, and other information from the Chinese national cryptographic algorithm data packets during virtual machine migration from the designated directory and utilize the Chinese national cryptographic algorithm for the migration.

[0056] It is conceivable that, since the Chinese cryptographic algorithm is more secure than the AES and RSA encryption algorithms, and its encryption strength and computing performance are far superior to those of similar international encryption algorithms, OpenStack can further improve the security of virtual machine migration operations when using the Chinese cryptographic algorithm, thereby ensuring the overall reliability of virtual machines during the migration process.

[0057] As can be seen, in the virtual machine migration method provided in this embodiment, a libvirt container image supporting Chinese cryptographic algorithms is pre-built to obtain the target libvirt container image. When OpenStack needs to perform a virtual machine migration operation, it obtains the target libvirt container image and specifies the target compute node for deploying the target libvirt container image in OpenStack. Then, it determines whether the target libvirt container image needs to use Chinese cryptographic algorithms for migration based on the global configuration file. If so, a central certificate is generated according to the Chinese cryptographic algorithms, and the correspondence between the target compute node and the central certificate is stored in the libvirt pod. Finally, a client certificate and a server certificate are generated according to the central certificate, and the central certificate, client certificate, and server certificate are stored in a specified directory to deploy the target libvirt container image on the target compute node. Compared with the prior art, the method provided in this embodiment enables OpenStack to support encryption and decryption operations using Chinese cryptographic algorithms when performing virtual machine migration operations. Since the security of Chinese cryptographic algorithms is much higher than that of AES and RSA encryption algorithms, this setting can further ensure the security and reliability of virtual machines during the migration process.

[0058] Based on the above embodiments, this embodiment further explains and optimizes the technical solution. As a preferred implementation method, the construction process of the target libvirt container image includes:

[0059] Select a container base image, and install the libvirt code and the Chinese cryptographic algorithm data package into the container base image to obtain the target libvirt container image.

[0060] This embodiment describes in detail the construction process of the target libvirt container image. When building the target libvirt container image, the first step is to select a base container image; that is, to choose a container image as the foundation. Then, by customizing the relevant functions within this container image, a container image with the desired functionality can be obtained.

[0061] Specifically, when selecting the container base image, CentOS 8.2 is the preferred choice because it is the most widely used operating system in actual operation. This can improve the universality of the technical solution provided in this application in practical applications. Then, the libvirt code and the national cryptographic algorithm data package are installed in the container base image to obtain the target libvirt container image that supports the national cryptographic algorithm.

[0062] Based on the above embodiments, this embodiment further explains and optimizes the technical solution. As a preferred implementation, after the above step of obtaining the target libvirt container image, it further includes:

[0063] Store the target libvirt container image in the OpenStack image repository.

[0064] Specifically, in this embodiment, when the OpenStack deployment code obtains the target libvirt container image, it can also store the target libvirt container image in the OpenStack image repository. It's conceivable that, since the image repository is a cloud storage repository for hybrid cloud backups, it can be used to store backup data or other important data. Therefore, storing the target libvirt container image in the OpenStack image repository is equivalent to storing the target libvirt container image on the OpenStack local disk.

[0065] With this configuration, OpenStack can directly call the target libvirt container image from the OpenStack image repository during subsequent operations. This not only makes it convenient for OpenStack to call the target libvirt container image, but also saves a lot of network bandwidth.

[0066] Clearly, the technical solution provided in this embodiment makes the calling process of the target libvirt container image faster and more convenient.

[0067] Based on the above embodiments, this embodiment further explains and optimizes the technical solution. As a preferred implementation, the above steps: generating a central certificate according to the national cryptographic algorithm and storing the correspondence between the target computing node and the central certificate in the libvirt pod, include:

[0068] If there are multiple target computing nodes, start a libvirt job on any one of the target computing nodes and generate a central certificate according to the national cryptographic algorithm.

[0069] The central certificate is distributed to each compute node of the target compute node, and the mapping between each compute node and the central certificate is stored in the libvirt pod.

[0070] Understandably, in practical applications, to reduce the resource load on each compute node in OpenStack, the target libvirt container image is typically deployed across multiple compute nodes in OpenStack. Therefore, in this embodiment, the target libvirt container image is deployed across multiple compute nodes in OpenStack.

[0071] Furthermore, in this embodiment, to further reduce the overall resource overhead of OpenStack, a libvirt job is first started on any one of the target compute nodes, A. After the libvirt job is started on compute node A, a central certificate is generated on compute node A according to the national cryptographic algorithm. Then, compute node A distributes the generated central certificate to each compute node of the target compute node.

[0072] Once each compute node in the target compute node receives the central certificate sent by compute node A, the OpenStack deployment code will map and store the correspondence between each compute node and the central certificate in libvirtpod to establish the connection between each compute node and the national cryptographic algorithm, and facilitate the execution of subsequent processes.

[0073] Obviously, the technical solution provided in this embodiment can further improve the universality of the method provided in this application in practical applications.

[0074] Based on the above embodiments, this embodiment further explains and optimizes the technical solution. As a preferred implementation, the above step: the process of generating a central certificate according to the national cryptographic algorithm, includes:

[0075] A central certificate template is created based on the national cryptographic algorithm, and a central certificate private key is generated based on the central certificate template.

[0076] A central certificate is generated based on the central certificate's private key.

[0077] This embodiment details the process of generating the central certificate. Specifically, when generating the central certificate, a central certificate template is first created based on the national cryptographic algorithm. This template stores various construction parameters used in generating the central certificate, such as the certificate's validity period and key length. Next, a central certificate private key is generated based on the template, and then the central certificate is generated based on that private key.

[0078] Corresponding to the process of generating a central certificate, when generating a server certificate, it is first necessary to generate a server template based on the central certificate, then generate a server private key based on the server template, and finally generate a server certificate based on the server private key. Similarly, when generating a client certificate, it is first necessary to generate a client template based on the central certificate, then generate a client private key based on the client template, and finally generate a client certificate based on the client private key.

[0079] Clearly, the technical solution provided in this embodiment can guarantee the accuracy and reliability of the central certificate generation results.

[0080] Based on the above embodiments, this embodiment further explains and optimizes the technical solution. As a preferred implementation, after the above step of determining whether the target libvirt container image needs to perform a migration operation using the national cryptographic algorithm according to the global configuration file, it further includes:

[0081] If not, then deploy the target libvirt container image directly on the target compute node.

[0082] Understandably, since the global configuration file can be customized according to user needs, when it is determined from the global configuration file that the target libvirt container image does not need to perform migration operations using the national cryptographic algorithm, the target libvirt container image can be directly deployed on the target compute node.

[0083] In other words, based on user-defined needs, a switch can be added to the global configuration file to enable or disable virtual machine encrypted migration by modifying the relevant program code. If parsing the global configuration file determines that deploying the target libvirt container image on the target compute node in OpenStack does not require using the Chinese cryptographic algorithm for migration, then the target libvirt container image can be deployed directly on the target compute node. However, if parsing the global configuration file determines that deploying the target libvirt container image on the target compute node in OpenStack requires using the Chinese cryptographic algorithm for migration, then the central certificate, client certificate, and server certificate must be generated according to the above steps using the Chinese cryptographic algorithm. These certificates must then be stored in the specified directory before the target libvirt container image can be deployed on the target compute node.

[0084] Clearly, the technical solution provided in this embodiment can further reduce the resource overhead of OpenStack when performing migration operations.

[0085] Based on the above embodiments, this embodiment further explains and optimizes the technical solution. As a preferred implementation, the above step: specifying the target compute node for deploying the target libvirt container image in OpenStack includes:

[0086] In OpenStack, the inventory file specifies the target compute node for deploying the target libvirt container image.

[0087] Understandably, since the inventory file is a collection of manageable services in the automated operations and maintenance tool Ansible, system configuration, program deployment, or command execution can be processed directly or in batches through the inventory file. Therefore, when specifying the target compute node for deploying the target libvirt container image in OpenStack using the inventory file, the relevant instructions in the inventory file can be used to specify the target compute node for deploying the target libvirt container image in OpenStack, which can further improve the execution efficiency when selecting the target compute node.

[0088] The foregoing has described in detail various embodiments corresponding to the virtual machine migration method. Based on this, the present invention also discloses a virtual machine migration apparatus corresponding to the above-described method. Please refer to... Figure 2 , Figure 2 This is a structural diagram of a virtual machine migration device provided in an embodiment of the present invention. The device includes:

[0089] The image acquisition module 21 is used to acquire the target libvirt container image when OpenStack needs to perform virtual machine migration operations; wherein, the target libvirt container image is a container image that supports the national cryptographic algorithm;

[0090] The migration judgment module 22 is used to specify the target compute node for deploying the target libvirt container image in OpenStack, and to determine whether the target libvirt container image needs to perform a migration operation using the national cryptographic algorithm based on the global configuration file.

[0091] The relational storage module 23 is used to generate a central certificate according to the national cryptographic algorithm when the judgment result of the migration judgment module is yes, and to store the correspondence between the target computing node and the central certificate in the libvirt pod;

[0092] The image deployment module 24 is used to generate client and server certificates based on the central certificate, and store the central certificate, client certificate and server certificate in a specified directory to deploy the target libvirt container image on the target compute node.

[0093] Preferably, the image acquisition module 21 includes:

[0094] The image building unit is used to select a container base image and install the libvirt code and Chinese cryptographic algorithm data package into the container base image to obtain the target libvirt container image.

[0095] Preferably, the above-mentioned migration device further includes:

[0096] The image storage module is used to store the target libvirt container image to the OpenStack image repository after the process of obtaining the target libvirt container image.

[0097] Preferably, the relational storage module 23 includes:

[0098] The program startup unit is used to start a libvirt job on any one of the target computing nodes if there are multiple target computing nodes, and generate a central certificate according to the national cryptographic algorithm.

[0099] The relational storage unit distributes the central certificate to each compute node of the target compute node and stores the correspondence between each compute node and the central certificate in the libvirt pod.

[0100] Preferably, the image deployment module 24 includes:

[0101] The private key generation unit is used to create a central certificate template based on the national cryptographic algorithm and generate a central certificate private key based on the central certificate template.

[0102] The certificate generation unit is used to generate a central certificate based on the central certificate private key.

[0103] The aforementioned migration device also includes:

[0104] The image installation module is used to determine whether the target libvirt container image needs to be migrated using the national cryptographic algorithm based on the global configuration file. If the result of the migration judgment module 22 is no, the target libvirt container image is directly deployed on the target compute node.

[0105] Preferably, the migration judgment module 22 includes:

[0106] The node selection unit is used to specify the target compute node for deploying the target libvirt container image in OpenStack using the inventory file.

[0107] Since the embodiments of the device part correspond to the embodiments of the method part described above, please refer to the description of the embodiments of the method part for the embodiments of the device part, and they will not be repeated here.

[0108] The virtual machine migration apparatus provided in this embodiment of the invention has the beneficial effects of the virtual machine migration method disclosed above.

[0109] Please see Figure 3 , Figure 3 This is a structural diagram of a virtual machine migration device provided in an embodiment of the present invention. The device includes:

[0110] Memory 31 is used to store computer programs;

[0111] Processor 32 is configured to implement the steps of a virtual machine migration method as disclosed above when executing a computer program.

[0112] The virtual machine migration device provided in this embodiment may include, but is not limited to, tablet computers, laptop computers, or desktop computers.

[0113] The processor 32 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 32 may be implemented using at least one of the following hardware forms: Digital Signal Processor (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). The processor 32 may also include a main processor and a coprocessor. The main processor, also known as the Central Processing Unit (CPU), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 32 may integrate a Graphics Processing Unit (GPU), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 32 may also include an Artificial Intelligence (AI) processor, which handles computational operations related to machine learning.

[0114] The memory 31 may include one or more computer-readable storage media, which may be non-transitory. The memory 31 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In this embodiment, the memory 31 is used to store at least the following computer program 211, which, after being loaded and executed by the processor 32, is capable of implementing the relevant steps of virtual machine migration disclosed in any of the foregoing embodiments. In addition, the resources stored in the memory 31 may also include an operating system 212 and data 213, etc., and the storage method may be temporary storage or permanent storage. The operating system 212 may include Windows, Unix, Linux, etc. The data 213 may include, but is not limited to, data involved in virtual machine migration, etc.

[0115] In some embodiments, the virtual machine migration device may further include a display screen 23, an input / output interface 24, a communication interface 25, a power supply 26, and a communication bus 27.

[0116] Those skilled in the art will understand that Figure 3 The structure shown does not constitute a limitation on the virtual machine migration device and may include more or fewer components than illustrated.

[0117] The processor 32 implements the virtual machine migration method provided in any of the above embodiments by calling instructions stored in the memory 31.

[0118] For an introduction to the virtual machine migration device provided by the present invention, please refer to the above method embodiments. The present invention will not be described in detail here, but it has the same beneficial effects as the virtual machine migration method disclosed above.

[0119] Furthermore, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of a virtual machine migration method disclosed above.

[0120] It is understood that if the methods in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and executes all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0121] For an introduction to the computer-readable storage medium provided by the present invention, please refer to the above method embodiments. The present invention will not be described in detail here, but it has the same beneficial effects as the above-described virtual machine migration method.

[0122] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section. It should be noted that those skilled in the art can make various improvements and modifications to this invention without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this invention.

[0123] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0124] The present invention provides a detailed description of a virtual machine migration method, apparatus, device, and medium. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for migrating virtual machines, characterized in that, include: When OpenStack needs to perform a virtual machine migration operation, it obtains the target libvirt container image; wherein, the target libvirt container image is a container image that supports Chinese cryptographic algorithms; In the OpenStack environment, specify the target compute node for deploying the target libvirt container image, and determine whether the target libvirt container image needs to be migrated using the national cryptographic algorithm based on the global configuration file. If so, a central certificate is generated according to the national cryptographic algorithm, and the correspondence between the target computing node and the central certificate is stored in the libvirt pod; A client certificate and a server certificate are generated based on the central certificate, and the central certificate, the client certificate, and the server certificate are stored in a specified directory to deploy the target libvirt container image on the target computing node; The construction process of the target libvirt container image includes: Select a container base image, and install the libvirt code and the Chinese cryptographic algorithm data package into the container base image to obtain the target libvirt container image.

2. The migration method according to claim 1, characterized in that, After the process of obtaining the target libvirt container image, the following is also included: The target libvirt container image is stored in the OpenStack image repository.

3. The migration method according to claim 1, characterized in that, The process of generating a central certificate based on the national cryptographic algorithm and storing the correspondence between the target computing node and the central certificate in the libvirt pod includes: If there are multiple target computing nodes, a libvirt job is started on any one of the target computing nodes, and a central certificate is generated according to the national cryptographic algorithm. The central certificate is distributed to each compute node of the target compute node, and the correspondence between each compute node and the central certificate is stored in the libvirt pod.

4. The migration method according to claim 1, characterized in that, The process of generating a central certificate based on the national cryptographic algorithm includes: A central certificate template is created based on the national cryptographic algorithm, and a central certificate private key is generated based on the central certificate template; The central certificate is generated based on the central certificate private key.

5. The migration method according to claim 1, characterized in that, After determining whether the target libvirt container image needs to undergo migration using the national cryptographic algorithm based on the global configuration file, the process further includes: If not, then deploy the target libvirt container image directly on the target compute node.

6. The migration method according to any one of claims 1 to 5, characterized in that, The process of specifying the target compute node for deploying the target libvirt container image in the OpenStack includes: The inventory file is used to specify the target compute node in the OpenStack where the target libvirt container image will be deployed.

7. A virtual machine migration device, characterized in that, include: The image acquisition module is used to acquire the target libvirt container image when OpenStack needs to perform a virtual machine migration operation; wherein, the target libvirt container image is a container image that supports Chinese cryptographic algorithms; The migration judgment module is used to specify the target compute node in the OpenStack where the target libvirt container image is deployed, and to determine whether the target libvirt container image needs to perform a migration operation using the national cryptographic algorithm based on the global configuration file. The relational storage module is used to generate a central certificate according to the national cryptographic algorithm when the judgment result of the migration judgment module is yes, and to store the correspondence between the target computing node and the central certificate in the libvirt pod; The image deployment module is used to generate client certificates and server certificates based on the central certificate, and store the central certificate, the client certificate and the server certificate in a specified directory to deploy the target libvirt container image on the target computing node; The construction process of the target libvirt container image includes: Select a container base image, and install the libvirt code and the Chinese cryptographic algorithm data package into the container base image to obtain the target libvirt container image.

8. A virtual machine migration device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of a virtual machine migration method as described in any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of a virtual machine migration method as described in any one of claims 1 to 6.

Images