An EIP control plane implementation method under a public cloud platform

Abstract

This invention provides a method for implementing the EIP control plane on a public cloud platform. When the network lacks the firewall and router equipment required for a hardware gateway, the system switches to a software gateway via the console to implement EIP functionality. When customers need to use hardware devices, the system switches back to a hardware gateway via the console. The advantages of this invention are: a method for implementing the EIP control plane on a public cloud platform that can handle various scenarios; when the network lacks the firewall and router equipment required for a hardware gateway, the console can switch to a software gateway to implement EIP functionality; and when customers need to use hardware devices, they can switch back to a hardware gateway at any time, achieving flexible control.

Description

Technical Field

[0001] This invention belongs to the field of SDN cloud networks, and in particular relates to a method for implementing the EIP control plane under a public cloud platform. Background Technology

[0002] Public cloud typically refers to cloud services provided by third-party providers to users. SDN cloud networks are an important component of public cloud. Elastic IP Address (EIP) is an independently purchased and held public IP address resource that can be bound to ECS instances of VPC type, SLB instances of VPC type, secondary elastic network interfaces of VPC type, NAT gateways, and high-availability virtual IPs. When an Elastic Public IP (IP) is bound to or unbound from a Virtual Machine (VM), a hard gateway will issue NAT rules under the firewall and bandwidth information under the egress router. The issued NAT rules will perform a bidirectional mapping between the public IP and the private IP on the VM's network interface card, enabling the VM to communicate with the public network. For a soft gateway, the entire network still adopts the Spine-Leaf network architecture. The VPC's egress requirements are met through the soft gateway, providing a single VPC with the ability to communicate with the Internet. Compared to a hard gateway, where all instances under a VPC access the public network through a firewall using NAT to convert to EIP, a soft gateway belongs to a VPC, achieving resource isolation. Instances under different VPCs do not affect each other's access to the public network. In addition, the soft gateway is implemented based on open-source NAT software, which is easy to expand and more flexible to use. Summary of the Invention

[0003] In view of this, the present invention aims to propose an EIP control plane implementation method under a public cloud platform, which can cope with various scenarios. When the network lacks the firewall and router devices required by the hardware gateway, the console can switch to the software gateway to implement the EIP function. When customers need to use hardware devices, they can also switch to the hardware gateway at any time, thus achieving flexible control.

[0004] To achieve the above objectives, the technical solution of the present invention is implemented as follows:

[0005] A method for implementing the EIP control plane on a public cloud platform allows switching to a software gateway via a console to implement EIP functionality when the network lacks the firewall and router equipment required for a hardware gateway. When customers need to use hardware devices, they can switch back to a hardware gateway via the console.

[0006] Furthermore, firstly, configure the switch for the soft gateway, which applies to this availability zone. When creating a VPC, if the switch is turned on, the VPC supports the soft gateway, and subsequent instances under the VPC will be bound to EIPs configured on the soft gateway instance of that VPC. If development is disabled, then EIPs bound to instances will be configured as hard gateways.

[0007] Furthermore, this includes the following steps:

[0008] S1. When an EIP is bound to an instance, determine whether the VPC to which the instance belongs supports a software gateway. If it does not support a software gateway, proceed to step S2; otherwise, proceed to step S3.

[0009] S2. If not supported, proceed directly with the process of issuing EIP through the hard gateway, issuing NAT mapping rules through the firewall device, and issuing rate limiting configurations through the router device.

[0010] S3. If supported, it is necessary to determine whether the soft gateway instance under the VPC exists.

[0011] Furthermore, step S3 includes the following cases:

[0012] A1. If a software gateway instance exists, NAT rules are directly issued in the software gateway instance to implement the mapping function between EIP and private network IP. Then, it is determined whether the issued rate limit is a rate limit imposed by the software gateway or a rate limit imposed by the router device.

[0013] A2. If the soft gateway instance does not exist, continue to check whether the soft gateway instance under the VPC is being created.

[0014] Furthermore, in A1, the following cases are included:

[0015] If rate limiting via a software gateway is supported, then the rate limiting configuration is issued on the software gateway.

[0016] If router device speed limiting is supported, then the speed limiting configuration is issued on the router device.

[0017] Furthermore, in A2, the following cases are included:

[0018] If the process is in progress, the relevant information of the EIP to be bound will be stored in the configuration data table, and the configuration will be sent back after the soft gateway instance is successfully created.

[0019] If not created, the orchestration and creation process of the soft gateway within the VPC is triggered, and the relevant information of the EIP to be bound is stored in the configuration data table. The configuration will be resent after the soft gateway instance is successfully created.

[0020] Furthermore, this solution discloses an electronic device, including a processor and a memory communicatively connected to the processor and used to store executable instructions of the processor, wherein the processor is used to execute an EIP control plane implementation method under a public cloud platform.

[0021] Furthermore, this solution discloses a server, including at least one processor and a memory communicatively connected to the processor. The memory stores instructions executable by the at least one processor, which are executed by the processor to cause the at least one processor to perform an EIP control plane implementation method under a public cloud platform.

[0022] Furthermore, this solution discloses a computer-readable storage medium storing a computer program, which, when executed by a processor, implements a method for implementing the EIP control plane under a public cloud platform.

[0023] Compared with existing technologies, the EIP control plane implementation method under a public cloud platform described in this invention has the following beneficial effects:

[0024] (1) The method for implementing the EIP control plane under a public cloud platform described in this invention is such that the soft gateway instance belongs to only one VPC, achieving resource isolation. Instances under different VPCs do not affect each other's access to the public network. The creation and deletion of soft gateway instances are relatively flexible. The creation of the soft gateway instance is triggered when the first instance under the VPC is bound to the EIP. The soft gateway instance is also deleted when the VPC is deleted.

[0025] (1) The method for implementing EIP control plane under public cloud platform described in this invention can cope with various scenarios. When the network lacks firewall and router devices required by the hard gateway, the console can switch to the soft gateway to implement EIP function. When customers need to use hardware devices, they can also switch to the hard gateway at any time, thus achieving flexible control. Attached Figure Description

[0026] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings:

[0027] Figure 1 This is a schematic diagram of an EIP control plane implementation method under a public cloud platform according to an embodiment of the present invention. Detailed Implementation

[0028] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0029] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0030] First, configure the soft gateway switch to apply to this availability zone. When creating a VPC, if the switch is enabled, the VPC will support the soft gateway. Subsequently, instances under the VPC will be bound to EIPs configured on the soft gateway instance of that VPC. If development is disabled, EIPs bound to instances will be configured on the hard gateway.

[0031] When an EIP is bound to an instance, it will determine whether the VPC to which the instance belongs supports a software gateway.

[0032] 1. If not supported, proceed directly with the process of issuing EIP through the hard gateway, issuing NAT mapping rules through the firewall device, and issuing rate limiting configurations through the router device;

[0033] 2. If supported, it is necessary to determine whether a software gateway instance exists under the VPC;

[0034] 2.1. If a software gateway instance exists, NAT rules are directly issued in the software gateway instance to implement the mapping function between EIP and private network IP. Then, it is determined whether the issued rate limit is a rate limit imposed by the software gateway or a rate limit imposed by the router device.

[0035] 2.1.1 If rate limiting via a software gateway is supported, the rate limiting configuration should be issued on the software gateway;

[0036] 2.1.2 If router device speed limiting is supported, the speed limiting configuration should be issued on the router device;

[0037] 2.2. If the soft gateway instance does not exist, continue to check whether the soft gateway instance under the VPC is being created;

[0038] 2.2.1. If the process is in progress, store the EIP information to be bound into the configuration data table, and resend the configuration after the soft gateway instance is successfully created.

[0039] 2.2.2. If not created, the orchestration and creation process of the soft gateway within the VPC is triggered, storing the EIP information to be bound into the configuration data table. Configuration is then reissued after the soft gateway instance is successfully created. Those skilled in the art will recognize that the units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention.

[0040] In the several embodiments provided in this application, it should be understood that the disclosed methods and systems can be implemented in other ways. For example, the division of units described above is merely a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. The aforementioned units may or may not be physically separated. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments of the present invention according to actual needs.

[0041] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.

[0042] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for implementing the EIP control plane on a public cloud platform, characterized in that: When the network lacks the firewall and router equipment required for a hardware gateway, switch to a software gateway via the console to implement the EIP function. When the customer needs to use hardware equipment, switch to a hardware gateway via the console. First, configure the switch for the soft gateway. This applies to availability zones. When creating a VPC, if the switch is turned on, the VPC will support the soft gateway. Subsequently, instances under the VPC will be bound to EIPs configured on the soft gateway instance of that VPC. If the switch is turned off, EIPs bound to instances will be configured on the hard gateway. The implementation method of EIP control plane on a public cloud platform includes the following steps: S1. When an EIP is bound to an instance, determine whether the VPC to which the instance belongs supports a software gateway. If it does not support a software gateway, proceed to step S2; otherwise, proceed to step S3. S2. If not supported, proceed directly with the process of issuing EIP through the hard gateway, issuing NAT mapping rules through the firewall device, and issuing rate limiting configurations through the router device. S3. If supported, it is necessary to determine whether the soft gateway instance under the VPC exists; Step S3 includes the following cases: A1. If a software gateway instance exists, NAT rules are directly issued in the software gateway instance to implement the mapping function between EIP and private network IP. Then, it is determined whether the issued rate limit is a rate limit imposed by the software gateway or a rate limit imposed by the router device. A2. If the soft gateway instance does not exist, continue to check whether the soft gateway instance under the VPC is being created; In A1, the following cases are included: If rate limiting via a software gateway is supported, then the rate limiting configuration is issued on the software gateway. If router device speed limiting is supported, then the speed limiting configuration is issued on the router device; In A2, the following cases are included: If the process is in progress, the EIP information to be bound will be stored in the configuration data table, and the configuration will be sent back after the soft gateway instance is successfully created. If not created, the orchestration and creation process of the soft gateway within the VPC is triggered, and the relevant information of the EIP to be bound is stored in the configuration data table. The configuration will be resent after the soft gateway instance is successfully created.

2. An electronic device, comprising a processor and a memory communicatively connected to the processor and used for storing processor-executable instructions, characterized in that: The processor is used to execute the EIP control plane implementation method under a public cloud platform as described in claim 1.

3. A server, characterized in that: It includes at least one processor and a memory communicatively connected to the processor, the memory storing instructions executable by the at least one processor, the instructions being executed by the processor to cause the at least one processor to perform the EIP control plane implementation method under a public cloud platform as described in claim 1.

4. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by the processor, it implements the EIP control plane implementation method under a public cloud platform as described in claim 1.

Images