Cross-cluster network management policy deployment method, device, equipment and medium

Abstract

The application discloses a cross-cluster network management policy deployment method and device, equipment and medium, relates to the technical field of computers, and the method comprises the following steps: creating a custom resource in a target cluster based on a target service corresponding to a target component of any target cluster in a plurality of to-be-used clusters of a cluster set; the custom resource comprises the target service and a management policy for the target service; the management policy specifies components in the target cluster and other to-be-used clusters that can access the target component through the target service; synchronizing the custom resource in the target cluster to other to-be-used clusters through the target cluster and a control cluster in the cluster set; and obtaining the target service and the policy corresponding to each cluster that specifies components in each cluster that can access the target component through the target service based on the custom resource through other to-be-used clusters and the target cluster. The application can deploy a cross-cluster network management policy to manage cross-cluster access.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, device, and medium for deploying cross-cluster network management strategies. Background Technology

[0002] Currently, the network capabilities of Kubernetes (k8s) are mainly reflected in two aspects: connectivity, ensuring that pods can communicate with each other, and isolation, considering business requirements such as security and traffic limits. However, by default, the network of a k8s cluster has no restrictions; all pods (components) in the cluster can communicate with each other, which does not meet the security requirements of some businesses. Furthermore, this is even more unacceptable in multi-tenant scenarios. Therefore, a method is needed to restrict the cluster network, which is where NetworkPolicy comes in. At this point, the network policy can only manage the network isolation of a single cluster, that is, the network isolation within the cluster where the pod resides.

[0003] Multi-cloud refers to the ability to establish communication between various cloud types, enabling cross-cloud interconnection and unified application management and distribution. With the rapid development of enterprise businesses, multi-cloud is gradually becoming the basic architecture for data center construction. Scenarios such as multi-region disaster recovery and active-active deployment, large-scale multi-cluster management, cross-cloud elasticity and migration are driving the rapid development of cloud-native multi-cloud related technologies. Therefore, how to efficiently manage multi-cloud is a current challenge and a pain point for enterprise development. Network strategies for managing multi-cloud are the problem this patent aims to solve.

[0004] To achieve cross-cluster communication in multi-cloud environments, many vendors have invested significant effort and developed corresponding products. When managing across clusters, Submariner can be used to implement cross-cluster network communication. However, in this case, the exported service is in a full mesh mode within the Submariner network architecture. For example, service1 in cluster 1 can be accessed by all components in the entire clusterset. But if service1 only needs to be accessible to certain clusters within the clusterset, or even just workloads within those clusters, current technology cannot achieve this.

[0005] In summary, how to deploy appropriate cross-cluster network management strategies to manage cross-cluster access is an urgent problem to be solved. Summary of the Invention

[0006] In view of this, the purpose of this invention is to provide a method, apparatus, device, and medium for deploying cross-cluster network management policies, capable of deploying appropriate cross-cluster network management policies to manage cross-cluster access. The specific solution is as follows:

[0007] Firstly, this application discloses a method for deploying cross-cluster network management strategies, including:

[0008] Based on the target service corresponding to the target component of any target cluster in a set of clusters to be used, a custom resource is created in the target cluster; the custom resource includes the target service and a management policy for the target service; the management policy specifies the components in the target cluster and other clusters to be used that can access the target component through the target service.

[0009] The custom resources in the target cluster are synchronized to the other clusters to be used via the target cluster and the control cluster in the cluster set.

[0010] Based on the custom resources, the other clusters to be used and the target cluster obtain the target service and the corresponding policies of their respective clusters that allow access to the target component through the target service.

[0011] Optionally, before creating custom resources in the target cluster, the target service corresponding to the target component of any target cluster in the cluster set further includes:

[0012] Distribute the target service corresponding to the target component of any one of the target clusters in the cluster set to be used.

[0013] Optionally, before creating custom resources in the target cluster, the target service corresponding to the target component of any target cluster in the cluster set further includes:

[0014] The cluster set is obtained by networking the several clusters to be used and the control cluster based on the submariner.

[0015] Optionally, synchronizing the custom resources in the target cluster to the other clusters to be used via the target cluster and the control cluster in the cluster set includes:

[0016] The custom resources are synchronized to the control cluster in the cluster set through the target cluster, and then synchronized to the other clusters to be used through the control cluster.

[0017] Optionally, the step of synchronizing the custom resource to the control cluster in the cluster set through the target cluster, and synchronizing the custom resource to the other clusters to be used through the control cluster, includes:

[0018] The custom resources are synchronized to the control cluster in the cluster set through the synchronization function of the cluster controller in the target cluster, and then synchronized to the other clusters to be used through the synchronization function of the cluster controller in the control cluster.

[0019] Optionally, the step of obtaining the target service and the corresponding strategies for each cluster that can access the target component through the target service based on the custom resources through the other clusters to be used and the target cluster includes:

[0020] The custom resource is identified by the network policy generator of the lighthouse-agent component in the other clusters to be used and the target cluster, and the target service and the policies corresponding to each cluster that allow access to the target component through the target service are obtained.

[0021] Optionally, the cross-cluster network management policy deployment method further includes:

[0022] If a new cluster is added to the cluster set, the custom resources are synchronized to the new cluster through the control cluster, and the new cluster obtains the policies of the respective clusters that allow access to the target component through the target service based on the custom resources.

[0023] Secondly, this application discloses a cross-cluster network management policy deployment device, comprising:

[0024] A custom resource creation module is used to create custom resources in a target cluster based on a target service corresponding to a target component of any target cluster in a cluster set. The custom resource includes the target service and a management policy for the target service. The management policy specifies the components in the target cluster and other clusters to be used that can access the target component through the target service.

[0025] The resource synchronization module is used to synchronize the custom resources in the target cluster to the other clusters to be used through the target cluster and the control cluster in the cluster set.

[0026] The policy acquisition module is used to acquire, based on the custom resources, the policies of the target service and the respective clusters that define the components in the respective clusters that can access the target component through the target service, using the other clusters to be used and the target cluster.

[0027] Thirdly, this application discloses an electronic device, including a processor and a memory; wherein, when the processor executes a computer program stored in the memory, it implements the aforementioned disclosed cross-cluster network management strategy deployment method.

[0028] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned cross-cluster network management strategy deployment method.

[0029] As can be seen, this application creates custom resources in a target cluster based on the target service corresponding to a target component of any target cluster in a cluster set. The custom resources include the target service and a management policy for the target service. The management policy specifies the components in the target cluster and other clusters to be used that can access the target component through the target service. The custom resources in the target cluster are synchronized to the other clusters to be used through the target cluster and the control cluster in the cluster set. Based on the custom resources, the other clusters to be used and the target cluster obtain the target service and the policies corresponding to their respective clusters that specify the access to the target component through the target service. Therefore, this application first sets custom resources and obtains the policies of the other clusters to be used and the target cluster based on the custom resources, thereby enabling the deployment of appropriate cross-cluster network management policies for each cluster in the cluster set to manage cross-cluster access. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0031] Figure 1 A flowchart of a cross-cluster network management strategy deployment method provided in this application;

[0032] Figure 2 This application provides a flowchart of a specific cross-cluster network management strategy deployment method;

[0033] Figure 3 This application provides a schematic diagram of a cross-cluster network management strategy deployment process;

[0034] Figure 4 A schematic diagram illustrating the deployment effect of a cross-cluster network management strategy provided in this application;

[0035] Figure 5 A structural diagram of a cross-cluster network management strategy deployment device provided in this application;

[0036] Figure 6 This is a schematic diagram of an electronic device structure provided in this application. Detailed Implementation

[0037] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0038] Currently, many vendors have invested significant effort and developed corresponding products to achieve cross-cluster communication in multi-cloud environments. When managing across clusters, Submariner can be used to implement cross-cluster network communication. However, the exported service in this case is a full mesh within the Submariner network architecture; that is, service1 in cluster 1 can be accessed by all components in the entire clusterset. But if service1 only needs to be accessible to certain clusters within the clusterset, or even just workloads within certain clusters, current technology cannot achieve this.

[0039] To overcome the above problems, this application provides a cross-cluster network management policy deployment scheme, which can deploy appropriate cross-cluster network management policies to manage cross-cluster access.

[0040] See Figure 1 As shown in the figure, this application discloses a method for deploying cross-cluster network management policies, the method including:

[0041] Step S11: Based on the target service corresponding to the target component of any target cluster in the cluster set, create a custom resource in the target cluster; the custom resource includes the target service and a management policy for the target service; the management policy specifies the components in the target cluster and other clusters to be used that can access the target component through the target service.

[0042] In this embodiment of the application, before creating custom resources in the target cluster, the target service corresponding to the target component of any target cluster in the cluster set further includes: networking the cluster set with the control cluster and the several clusters to be used based on the submariner.

[0043] In this embodiment, before creating custom resources in the target cluster, the target service corresponding to the target component of any target cluster in the cluster set further includes: distributing the target service corresponding to the target component of any target cluster in the cluster set. It should be noted that the distribution process specifically involves: exporting the service of the pod (component) that needs cross-cluster communication based on the submariner function. After the distribution process is completed, all workloads participating in the cluster in the entire clusterSet can access their corresponding pods through the service. However, the scenario where all components can access the service does not meet the target scenario. Therefore, it is necessary to manage cross-cluster network policies to specify which components can access the service and which cannot. In one specific embodiment, the target scenario is: a pod deployed in cluster1, whose corresponding service1, after being exported, should only be accessible by pod2 in the application space ns2 of cluster2 (excluding this cluster), while no component in other clusters within this clusterset should be able to access this service.

[0044] In this embodiment of the application, since the access to the component is performed through the corresponding service, a custom resource is created in the target cluster based on the target service corresponding to the target component of any target cluster in the cluster set. The custom resource includes the target service and a management policy for the target service. The management policy specifies the components in the target cluster and other clusters to be used that can access the target component through the target service.

[0045] It should be noted that the custom resource (CRD resource) is called clusterNetworkpolicy. The custom resource is defined to solve cross-cluster network policy. It contains all the information of the cross-cluster network, including the scope of application (in the above specific embodiment, it is service1 in ns1 of cluster1), that is, the target service, and the policy (in the above specific embodiment, it is: allow all components of cluster1 and pod2 in ns2 of cluster2 to access), that is, it specifies the management policy of the target cluster and other components in the target cluster that can access the target component through the target service.

[0046] Step S12: Synchronize the custom resources in the target cluster to the other clusters to be used through the target cluster and the control cluster in the cluster set.

[0047] In this embodiment of the application, the step of synchronizing the custom resources in the target cluster to the other clusters to be used through the target cluster and the control cluster in the cluster set includes: synchronizing the custom resources to the control cluster in the cluster set through the target cluster, and synchronizing the custom resources to the other clusters to be used through the control cluster.

[0048] In this embodiment of the application, the step of synchronizing the custom resource to the control cluster in the cluster set through the target cluster, and synchronizing the custom resource to the other clusters to be used through the control cluster, includes: synchronizing the custom resource to the control cluster in the cluster set through the synchronization function of the cluster controller in the target cluster, and synchronizing the custom resource to the other clusters to be used through the synchronization function of the cluster controller in the control cluster.

[0049] It should be noted that in the above specific embodiment, the broker (cluster controller) of cluster1 will synchronize the clusterNetworkPolicy to the broker cluster (control cluster) based on the sync method, and the control cluster will synchronize the clusterNetworkPolicy to other clusters of clusterSet based on the sync method.

[0050] Step S13: Based on the custom resources, obtain the target service and the corresponding policies of each cluster that allow access to the target component through the target service, using the other clusters to be used and the target cluster.

[0051] In this embodiment of the application, the custom resource is parsed by the other clusters to be used and the target cluster to obtain the target service and the policies of the respective clusters that define the components in the respective clusters that can access the target component through the target service.

[0052] In this embodiment, if a new cluster is added to the cluster set, the custom resources are synchronized to the new cluster through the control cluster. Based on the custom resources, the new cluster obtains the policies corresponding to the components in its respective cluster that allow access to the target component through the target service. It should be noted that when the control cluster detects the addition of a new cluster, it also pushes the CRD resource of the clusterNetworkPolicy to the newly added cluster. The lighthouse-agent component of the newly added cluster generates the networkPolicy corresponding to its cluster based on the information carried by the clusterNetworkPolicy. In this way, cluster-level restrictions on inter-component access are implemented for exported full mesh services, compensating for the lack of network isolation requirements in cross-cluster solutions.

[0053] It should be noted that at this time, each of the several clusters to be used has obtained the accessible components of its own cluster for the target service, and thus can determine whether it can use its own component to access the target component corresponding to the target service through the target service.

[0054] In summary, this application achieves access control over resources within a resource pool by configuring the scope of application and a whitelist (i.e., rules, or policies) of entry and exit rules for that scope. To extend the functionality of Kubernetes networkpolicy for cross-cluster network management, network policies are configured in the clusterset for services that communicate across clusters, i.e., the pods corresponding to services that are exported. A Kubernetes CRD resource for defining clusterNetworkPolicy carries cluster information, enabling the user's network policy to be identified and set within the clusterset.

[0055] As can be seen, this application creates custom resources in a target cluster based on the target service corresponding to a target component of any target cluster in a cluster set. The custom resources include the target service and a management policy for the target service. The management policy specifies the components in the target cluster and other clusters to be used that can access the target component through the target service. The custom resources in the target cluster are synchronized to the other clusters to be used through the target cluster and the control cluster in the cluster set. Based on the custom resources, the other clusters to be used and the target cluster obtain the target service and the policies corresponding to their respective clusters that specify the access to the target component through the target service. Therefore, this application first sets custom resources and obtains the policies of the other clusters to be used and the target cluster based on the custom resources, thereby enabling the deployment of appropriate cross-cluster network management policies for each cluster in the cluster set to manage cross-cluster access.

[0056] See Figure 2 As shown in the figure, this application discloses a specific method for deploying cross-cluster network management strategies, the method including:

[0057] Step S21: Based on the target service corresponding to the target component of any target cluster in the cluster set, create a custom resource in the target cluster; the custom resource includes the target service and a management policy for the target service; the management policy specifies the components in the target cluster and other clusters to be used that can access the target component through the target service.

[0058] For a more detailed description of the process of step S21, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0059] Step S22: Synchronize the custom resources in the target cluster to the other clusters to be used through the target cluster and the control cluster in the cluster set.

[0060] For a more detailed description of the process of step S22, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0061] Step S23: Identify the custom resource through the network policy generator of the lighthouse-agent component in the other clusters to be used and the target cluster, and obtain the target service and the policies corresponding to each cluster that specify the components in their respective clusters that can access the target component through the target service.

[0062] In this embodiment of the application, the creation of the clusterNetworkpolicy resource will trigger the list && watch mechanism of the lighthouse-agent components of the other clusters to be used and the target cluster, so as to parse out the network policy corresponding to the scope of each cluster (that is, all components of non-cluster2 cluster cannot access pod1, and pod2 in the application space ns2 in cluster2 can access pod1 in cluster1).

[0063] In this embodiment, if a new cluster is added to the cluster set, the custom resources are synchronized to the new cluster through the control cluster. Based on the custom resources, the new cluster obtains the policies corresponding to the components in its respective cluster that allow access to the target component through the target service. It should be noted that when the control cluster detects the addition of a new cluster, it also pushes the CRD resource of the clusterNetworkPolicy to the newly added cluster. The lighthouse-agent component of the newly added cluster generates the networkPolicy corresponding to its cluster based on the information carried by the clusterNetworkPolicy. In this way, cluster-level restrictions on inter-component access are implemented for exported full mesh services, compensating for the lack of network isolation requirements in cross-cluster solutions.

[0064] In summary, this application, to deploy a suitable cross-cluster network management strategy for managing cross-cluster access, performed the following operations: Under a submariner-based cross-cluster networking approach, a new `ClusterNetworkPolicy` CRD resource was created, and the broker's sync function was extended for inter-cluster synchronization and distribution. Simultaneously, the functionality of the `lighthouse-agent` component was extended to parse the rules of `ClusterNetworkPolicy` and generate a native Kubernetes network policy to restrict access between cluster-level components. Specifically: 1. Resolving network policy issues in cross-cluster scenarios; Currently, native Kubernetes network policies can only apply to components within the same cluster. When using cross-cluster networking, service access extends to different clusters. Since the native networking scheme is fullmesh, a `ClusterNetworkPolicy` resource is defined to achieve access control between clusters. 2. The broker synchronizes and pushes cross-cluster network policy information; the broker cluster receives ClusterNetworkPolicy information pushed by other clusters and synchronizes this resource information to other clusters in the clusterset; 3. The lighthouse-agent component parses and creates native network policy information; the functionality of the lighthouse-agent component is extended to parse the ClusterNetworkPolicy information and create native Kubernetes network policies. It should be noted that the main innovation of this application lies in extending native Kubernetes network policies to support cross-cluster network policies.

[0065] As can be seen, this application creates a custom resource in a target cluster based on a target service corresponding to a target component of any target cluster in a cluster set. The custom resource includes the target service and a management policy for the target service. The management policy specifies that components in the target cluster and other clusters to be used can access the target component through the target service. The custom resource in the target cluster is synchronized to the other clusters to be used through the target cluster and the control cluster in the cluster set. The custom resource is identified by the network policy generator of the lighthouse-agent component in the other clusters to be used and the target cluster, and the target service and the corresponding policies of each cluster specifying that components in their respective clusters can access the target component through the target service are obtained.

[0066] See Figure 3The diagram illustrates the deployment process of a cross-cluster network management strategy. The specific process is as follows: First, preparation work begins by deploying a clusterset. Using Submariner for networking, brokercluster, joincluster1, and joincluster2 are added to the clusterset. Brokercluster must be publicly accessible so that other clusters can access its API Server for metadata exchange. The services corresponding to the pods in joincluster1 are distributed using the `subctl export service` command. This allows joincluster2 to access the corresponding pods in cluster1 through the service. (Since the scenario where joincluster2 can access the corresponding pods in cluster1 through the service does not meet the current requirements, a strategy needs to be added to specify which pods in joincluster2 can access the corresponding pods in cluster1 through the service.)

[0067] The second step is to create a CRD resource (custom resource); create a clusterNetworkpolicy resource in cluster1, specifying its scope and rules; the specific procedure is as follows:

[0068]

[0069]

[0070] The scope of the application is the target service, specifically the service of pod1 in ns1 of joincluster1. The rule is that all components in joincluster1 and pod2 in ns2 of joincluster2 can access pod1 through the target service.

[0071] The third step involves generating the corresponding network policy in joincluster1. The network policy generator extends the functionality of the essential submariner component, lighthouse-agent, by identifying ClusterNetworkPolicy resources within the cluster, organizing their information, and creating native Kubernetes network policy resources applicable to the cluster based on the rules. This simplifies cross-cluster network policies to network policies applied to each cluster. Based on the network policy rules, iptables and other rules are created to add network whitelists.

[0072] Based on ClusterNetworkPolicy, two network policies are decomposed, namely the policy in joincluster1 and the policy in joincluster2; the policy of joincluster1 is as follows:

[0073]

[0074]

[0075] The strategies in Joincluster2 are as follows:

[0076]

[0077] Specifically, the Lighthouse-agent in joincluster1 detects the creation of the ClusterNetworkPolicy. On one hand, it uses the `broker.sync` method to call the broker API to synchronize this resource to the brokercluster cluster. This ensures that the brokercluster cluster contains the same ClusterNetworkPolicy resource created by the user as joincluster1. Detecting the existence of the joincluster2 cluster within the clusterset, the broker uses `broker.sync` to synchronize the ClusterNetworkPolicy resource to the joincluster2 cluster. The Lighthouse-agent component in joincluster2 detects the creation of the ClusterNetworkPolicy resource, resolves the corresponding network policy generated in its cluster, and creates it. This restricts access to services in cluster1 from joincluster2, allowing only pod2 in its ns2 application space to access it. Figure 2 This demonstrates the final effect of the cross-cluster network strategy, which means that within this clusterset, only all components of the joincluster1 cluster and pod2 in ns2 of joincluster2 are allowed to access it.

[0078] See Figure 4 The diagram shows the deployment effect of a cross-cluster network management strategy. At this time, only all components in joincluster1 and pod2 in ns2 of joincluster2 can access pod1 through the target service, while other pods cannot access it.

[0079] See Figure 5As shown in the figure, this application discloses a cross-cluster network management policy deployment device, including:

[0080] The custom resource creation module 11 is used to create a custom resource in the target cluster based on the target service corresponding to the target component of any target cluster in a set of clusters to be used; the custom resource includes the target service and a management policy for the target service; the management policy specifies the components in the target cluster and other clusters to be used that can access the target component through the target service.

[0081] Resource synchronization module 12 is used to synchronize the custom resources in the target cluster to the other clusters to be used through the target cluster and through the control cluster in the cluster set;

[0082] The policy acquisition module 13 is used to acquire, based on the custom resources, the target service and the policies of their respective clusters that specify the ability to access the target component through the target service, by using the other clusters to be used and the target cluster.

[0083] As can be seen, this application creates custom resources in a target cluster based on the target service corresponding to a target component of any target cluster in a cluster set. The custom resources include the target service and a management policy for the target service. The management policy specifies the components in the target cluster and other clusters to be used that can access the target component through the target service. The custom resources in the target cluster are synchronized to the other clusters to be used through the target cluster and the control cluster in the cluster set. Based on the custom resources, the other clusters to be used and the target cluster obtain the target service and the policies corresponding to their respective clusters that specify the access to the target component through the target service. Therefore, this application first sets custom resources and obtains the policies of the other clusters to be used and the target cluster based on the custom resources, thereby enabling the deployment of appropriate cross-cluster network management policies for each cluster in the cluster set to manage cross-cluster access.

[0084] In one specific embodiment, the cross-cluster network management policy deployment device further includes:

[0085] A distribution unit is used to distribute the target service corresponding to the target component of any one of the target clusters in the cluster set.

[0086] In one specific embodiment, the cross-cluster network management policy deployment device further includes:

[0087] The cluster set is obtained by networking the several clusters to be used and the control cluster based on the submariner.

[0088] In one specific embodiment, the resource synchronization module 12 may specifically include:

[0089] The resource synchronization submodule is used to synchronize the custom resource to the control cluster in the cluster set through the target cluster, and to synchronize the custom resource to the other clusters to be used through the control cluster.

[0090] In one specific embodiment, the resource synchronization submodule may specifically include:

[0091] The resource synchronization unit is used to synchronize the custom resource to the control cluster in the cluster set through the synchronization function of the cluster controller in the target cluster, and to synchronize the custom resource to the other clusters to be used through the synchronization function of the cluster controller in the control cluster.

[0092] In one specific embodiment, the strategy acquisition module 13 includes:

[0093] The policy acquisition unit is used to identify the custom resource through the network policy generator of the lighthouse-agent component in the other clusters to be used and the target cluster, and to acquire the target service and the policies corresponding to the respective clusters that specify the components in the respective clusters that can access the target component through the target service.

[0094] In one specific embodiment, the cross-cluster network management policy deployment device further includes:

[0095] The set adds a new module, which is used to synchronize the custom resources to the new cluster through the control cluster if a new cluster is added to the set, and to obtain the policies of the respective clusters that allow access to the target component through the target service based on the custom resources.

[0096] Furthermore, embodiments of this application also provide an electronic device. Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0097] Figure 6This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, an input / output interface 24, a communication interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the following steps:

[0098] Based on the target service corresponding to the target component of any target cluster in a set of clusters to be used, a custom resource is created in the target cluster; the custom resource includes the target service and a management policy for the target service; the management policy specifies the components in the target cluster and other clusters to be used that can access the target component through the target service.

[0099] The custom resources in the target cluster are synchronized to the other clusters to be used via the target cluster and the control cluster in the cluster set.

[0100] Based on the custom resources, the other clusters to be used and the target cluster obtain the target service and the corresponding policies of their respective clusters that allow access to the target component through the target service.

[0101] In some specific implementations, the target service corresponding to the target component of any target cluster in the cluster set can specifically implement the following steps before creating custom resources in the target cluster:

[0102] Distribute the target service corresponding to the target component of any one of the target clusters in the cluster set to be used.

[0103] In some specific implementations, the target service corresponding to the target component of any target cluster in the cluster set can specifically implement the following steps before creating custom resources in the target cluster:

[0104] The cluster set is obtained by networking the several clusters to be used and the control cluster based on the submariner.

[0105] In some specific implementations, synchronizing the custom resources in the target cluster to other clusters to be used via the target cluster and the control cluster in the cluster set can specifically achieve the following steps:

[0106] The custom resources are synchronized to the control cluster in the cluster set through the target cluster, and then synchronized to the other clusters to be used through the control cluster.

[0107] In some specific implementations, the step of synchronizing the custom resource to the control cluster in the cluster set through the target cluster, and then synchronizing the custom resource to the other clusters to be used through the control cluster, can specifically achieve the following steps:

[0108] The custom resources are synchronized to the control cluster in the cluster set through the synchronization function of the cluster controller in the target cluster, and then synchronized to the other clusters to be used through the synchronization function of the cluster controller in the control cluster.

[0109] In some specific implementations, the step of obtaining the target service and the corresponding policies of each cluster that can access the target component through the target service based on the custom resources of the other clusters to be used and the target cluster can be implemented in the following steps:

[0110] The custom resource is identified by the network policy generator of the lighthouse-agent component in the other clusters to be used and the target cluster, and the target service and the policies corresponding to each cluster that allow access to the target component through the target service are obtained.

[0111] In some specific implementations, the following steps may also be performed:

[0112] If a new cluster is added to the cluster set, the custom resources are synchronized to the new cluster through the control cluster, and the new cluster obtains the policies of the respective clusters that allow access to the target component through the target service based on the custom resources.

[0113] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 25 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 24 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0114] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The memory 22 can be a random access memory that can be used as running memory and a non-volatile memory used for external memory storage. The storage resources on it include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0115] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 on the source host and the computer program 222. The operating system 221 can be Windows, Unix, Linux, etc. In addition to the computer program that can be used to complete the cross-cluster network management policy deployment method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs that can be used to complete other specific tasks.

[0116] In this embodiment, the input / output interface 24 may include, but is not limited to, a USB interface, a hard disk read interface, a serial interface, a voice input interface, a fingerprint input interface, etc.

[0117] Furthermore, embodiments of this application also disclose a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned cross-cluster network management strategy deployment method.

[0118] For the specific steps of this method, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0119] The computer-readable storage medium referred to herein includes random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, magnetic disks, optical disks, or any other form of storage medium known in the art. When the computer program is executed by a processor, it implements the aforementioned cross-cluster network management strategy deployment method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0120] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the cross-cluster network management strategy deployment method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0121] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0122] The steps of the algorithm described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0123] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0124] The foregoing has provided a detailed description of a cross-cluster network management strategy deployment method, apparatus, device, and medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for deploying cross-cluster network management strategies, characterized in that, include: Based on the target service corresponding to the target component of any target cluster in a cluster set, create custom resources in the target cluster. The custom resource includes the target service and the management policy for the target service; The management policy specifies the components in the target cluster and other clusters to be used that can access the target component through the target service. The custom resources are synchronized to the control cluster in the cluster set through the target cluster, and then synchronized to the other clusters to be used through the control cluster; The custom resource is identified by the network policy generator of the lighthouse-agent component in the other clusters to be used and the target cluster, and the target service and the policies corresponding to each cluster that allow access to the target component through the target service are obtained. The step of synchronizing the custom resources to the control cluster in the cluster set through the target cluster, and synchronizing the custom resources to the other clusters to be used through the control cluster, includes: The custom resources are synchronized to the control cluster in the cluster set through the synchronization function of the cluster controller in the target cluster, and then synchronized to the other clusters to be used through the synchronization function of the cluster controller in the control cluster.

2. The cross-cluster network management strategy deployment method according to claim 1, characterized in that, The target service corresponding to the target component of any target cluster in a set of clusters to be used, before creating custom resources in the target cluster, further includes: Distribute the target service corresponding to the target component of any one of the target clusters in the cluster set to be used.

3. The cross-cluster network management strategy deployment method according to claim 1, characterized in that, The target service corresponding to the target component of any target cluster in a set of clusters to be used, before creating custom resources in the target cluster, further includes: The cluster set is obtained by networking the several clusters to be used and the control cluster based on the submariner.

4. The cross-cluster network management policy deployment method according to any one of claims 1 to 3, characterized in that, Also includes: If a new cluster is added to the cluster set, the custom resources are synchronized to the new cluster through the control cluster, and the new cluster obtains the policies of the respective clusters that allow access to the target component through the target service based on the custom resources.

5. A cross-cluster network management strategy deployment device, characterized in that, include: A custom resource creation module is used to create custom resources in a target cluster based on a target service corresponding to a target component of any target cluster in a cluster set; the custom resource includes the target service and a management strategy for the target service. The management policy specifies the components in the target cluster and other clusters to be used that can access the target component through the target service. The resource synchronization module is used to synchronize the custom resource to the control cluster in the cluster set through the target cluster, and to synchronize the custom resource to the other clusters to be used through the control cluster; The policy acquisition module is used to identify the custom resource through the network policy generator of the lighthouse-agent component in the other clusters to be used and the target cluster, and to obtain the target service and the policies of the respective clusters that define the components in the respective clusters that can access the target component through the target service. The resource synchronization unit is used to synchronize the custom resource to the control cluster in the cluster set through the synchronization function of the cluster controller in the target cluster, and to synchronize the custom resource to the other clusters to be used through the synchronization function of the cluster controller in the control cluster.

6. An electronic device, characterized in that, It includes a processor and a memory; wherein, when the processor executes a computer program stored in the memory, it implements the cross-cluster network management strategy deployment method as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, Used to store computer programs; wherein, when the computer programs are executed by a processor, they implement the cross-cluster network management strategy deployment method as described in any one of claims 1 to 4.

Images