Message transmission method, device, equipment and storage medium

Abstract

The disclosed embodiment discloses a message transmission method, apparatus, device and storage medium, wherein the method comprises: obtaining a forward message from a first management unit in a container orchestration engine; determining a forwarding path corresponding to the forward message based on a preset direct routing table entry and a bridge; wherein the forwarding path is determined by a network card in the container orchestration engine; forwarding the forward message to a second management unit in the container orchestration engine according to the forwarding path corresponding to the forward message; wherein the forward message is used for the container in the first management unit to interact with the container in the second management unit. The disclosed embodiment can help reduce the performance loss of message forwarding, reduce the delay of message forwarding and the occurrence of failures during the interaction process, etc.

Description

Technical Field

[0001] The present disclosure relates to, but is not limited to, the field of computer technology, and in particular to a message transmission method, apparatus, device, and storage medium. Background Art

[0002] The container orchestration engine (Kubernetes, K8s) is a lightweight and scalable open source platform for managing containerized applications and services. For the problem of accessing the virtual Internet Protocol address (VIP) by the management unit (Pod) in Kubernetes, the relevant technology can adopt the cloud native approach, by deploying the service discovery component (Kube-proxy) in the Kubernetes cluster and the interaction solution of the switch (Switch), to achieve the second-layer forwarding mode of the message, but it leads to problems such as redundant message forwarding, long forwarding path, and large delay. Summary of the invention

[0003] In view of this, the embodiments of the present disclosure at least provide a message transmission method, apparatus, device and storage medium.

[0004] The technical solution of the embodiment of the present disclosure is implemented as follows:

[0005] On the one hand, an embodiment of the present disclosure provides a message transmission method, including: obtaining a forward message from a first management unit in a container orchestration engine; determining a forwarding path corresponding to the forward message based on a preset direct routing table entry and a bridge; wherein the forwarding path is determined by a network card in the container orchestration engine; forwarding the forward message to a second management unit in the container orchestration engine according to the forwarding path corresponding to the forward message; wherein the forward message is used for the container in the first management unit to interact with the container in the second management unit.

[0006] On the other hand, an embodiment of the present disclosure provides a message transmission device, including: a first acquisition module, used to obtain a forward message from a first management unit in a container orchestration engine; a first determination module, used to determine a forwarding path corresponding to the forward message based on a preset direct routing table entry and a bridge; wherein the forwarding path is determined by a network card in the container orchestration engine; a first forwarding module, used to forward the forward message to a second management unit in the container orchestration engine according to the forwarding path corresponding to the forward message; wherein the forward message is used for the container in the first management unit to interact with the container in the second management unit.

[0007] On the other hand, an embodiment of the present disclosure provides a computer device, including a memory and a processor, wherein the memory stores a computer program executable on the processor, and the processor implements some or all of the steps in the above method when executing the program.

[0008] On the other hand, an embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, which implements part or all of the steps in the above method when executed by a processor.

[0009] On the other hand, an embodiment of the present disclosure provides a computer program, including computer-readable codes. When the computer-readable codes are executed in a computer device, a processor in the computer device executes some or all of the steps for implementing the above method.

[0010] On the other hand, an embodiment of the present disclosure provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and when the computer program is read and executed by a computer, it implements some or all of the steps in the above method.

[0011] In the related technology, the interaction scheme between Kube-proxy and the switch in the Kubernetes cluster is deployed to realize the Layer 2 forwarding mode of the message between two Pods. In the embodiment of the present disclosure, first, the forward message is obtained from the first management unit in the container orchestration engine; based on the preset direct routing table items and the bridge, the forwarding path corresponding to the forward message is determined; wherein the forwarding path is determined by the network card in the container orchestration engine; in this way, the forwarding path of the forward message can be quickly and accurately determined through the direct routing table items, and the default forwarding path can be adjusted; at the same time, since the determined forwarding path only involves multiple network cards, the forwarding path is simplified by removing the path for interacting with the switch; in this way, it is helpful to reduce the performance loss of message forwarding, reduce the delay of message forwarding and the situation of failure during the interaction process, etc. Then, according to the forwarding path corresponding to the forward message, the forward message can be quickly and accurately forwarded to the second management unit in the container orchestration engine, so as to realize the interaction between the container in the first management unit and the container in the second management unit.

[0012] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and are used to illustrate the technical solutions of the present disclosure together with the specification.

[0014] Figure 1A schematic diagram of the implementation flow of the first message transmission method provided in the embodiment of the present disclosure;

[0015] Figure 2 A schematic diagram of the implementation flow of the second message transmission method provided in the embodiment of the present disclosure;

[0016] Figure 3 A schematic diagram of the implementation flow of the third message transmission method provided in the embodiment of the present disclosure;

[0017] Figure 4 A schematic diagram of the implementation flow of the fourth message transmission method provided in the embodiment of the present disclosure;

[0018] Figure 5 A schematic diagram of the composition structure of the first forwarding path provided in an embodiment of the present disclosure;

[0019] Figure 6 A schematic diagram of the composition structure of the second forwarding path provided in an embodiment of the present disclosure;

[0020] Figure 7 A schematic diagram of implementing object creation provided by an embodiment of the present disclosure;

[0021] Figure 8 A schematic diagram of the structure of a message transmission device provided in an embodiment of the present disclosure;

[0022] Fig. 9 A hardware entity schematic diagram of a computer device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solutions and advantages of the present disclosure clearer, the technical solutions of the present disclosure are further elaborated in detail below in conjunction with the drawings and embodiments. The described embodiments should not be regarded as limiting the present disclosure. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present disclosure.

[0024] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or different subsets of all possible embodiments, and may be combined with each other without conflict. The terms "first / second / third" are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It is understood that "first / second / third" may be interchanged in a specific order or sequential order where permitted, so that the embodiments of the present disclosure described herein can be implemented in an order other than that illustrated or described herein.

[0025] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which the present disclosure belongs. The terms used herein are only for the purpose of describing the present disclosure and are not intended to limit the present disclosure.

[0026] The disclosed embodiment provides a message transmission method, which can be executed by a processor of a container orchestration engine Kubernetes, such as a container orchestration engine managed by a cloud server, etc. The container orchestration engine Kubernetes is a lightweight and scalable open source platform for managing containerized applications and services; Kubernetes can be used to automatically deploy and scale applications; in Kubernetes, the containers that make up the application are combined into a logical unit for easier management and discovery. Figure 1 A schematic diagram of the implementation flow of a message transmission method provided in an embodiment of the present disclosure, such as Figure 1 As shown, the method includes the following steps S101 to S103:

[0027] Step S101: Obtain a forward message from a first management unit in a container orchestration engine.

[0028] Here, the container orchestration engine can include multiple management units (Pods), and containers in different Pods can interact with each other through messages. Containers are a technology used to package the (compiled) code of applications and the dependencies required for runtime. Each container running in the container orchestration engine is repeatable. Standardization by including dependencies means that the same behavior can be obtained no matter where the container is run. Containers separate applications from the underlying host infrastructure, which makes deployment in different cloud or operating system (OS) environments easier. The container orchestration engine does not run containers directly, but is encapsulated by an abstract resource object Pod, which is the smallest scheduling unit in the container orchestration engine. Pods can encapsulate one or more containers. The same Pod shares the network namespace and storage resources, and containers can communicate directly through the local loopback interface, but they are isolated from each other in the namespace (such as Mount, User, and Pid, ​​etc.).

[0029] The first management unit may refer to any management unit in the container orchestration engine, which is not limited here. A forward message may refer to a message sent from the first management unit to other management units, which may also be referred to as traffic, etc.; the role of the forward message is not limited here, for example, the forward message may be used to call containers in other management units. For example: if the container in the first management unit needs to access a virtual Internet Protocol address, the first management unit may generate a forward message in response to the user's access operation to the corresponding virtual Internet Protocol address; wherein, the forward message may carry at least the Internet Protocol address of the first management unit, as well as the target Internet Protocol address, etc., and the target Internet Protocol address may be a virtual Internet Protocol address.

[0030] Step S102: determining a forwarding path corresponding to the forward message based on a preset direct routing table entry and a bridge.

[0031] Here, direct routing (DirectRouting) can be discovered by the link layer protocol, generally refers to the path to the network segment where the physical interface address of the router is located. The path information does not need to be maintained by the network administrator, nor does it need to be calculated by the router through a certain algorithm. As long as the interface is active (Active), the router will fill the routing information leading to the network segment into the routing table. Direct routing cannot enable the router to obtain routing information that is not directly connected to it. A direct routing table entry can refer to a storage structure for storing routing information of direct routing, such as a direct routing table entry includes: the destination address (Destination) is 10.30.230.16, the gateway address (Gateway) is 0.0.0.0, the subnet mask (Mask) of the destination address is 255.255.255.0, and the exit of the network path to the destination address (that is, from which exit can go to the destination address) (Iface) is a preset gateway (also called a network adapter), etc.

[0032] A bridge is an early two-port layer 2 network device. The two ports of the bridge each have an independent switching channel, and do not share a backplane bus, which can isolate the conflict domain. A bridge can be used to connect two or more local area networks. For example, a forward message can be sent from the first management unit to other management units through the first bridge.

[0033] The forwarding path may refer to the path that the forward message passes through when it is sent from the first management unit to other management units in the container orchestration engine. The forwarding path is determined by the network card in the container orchestration engine. For example, the first management unit sends the forward message to the first network card, the first network card sends the forward message to the second network card, the second network card sends the forward message to the third network card, and the third network card sends the forward message to other management units. Then the forwarding path may be from the first network card to the second network card to the third network card; wherein the first network card corresponds to the first management unit, the third network card corresponds to other management units, and each management unit may correspond to a network card. For example: the first network card and the third network card in the forwarding path are determined by the corresponding relationship in the direct routing table; the second network card in the forwarding path is determined by the preset forwarding rules and address table information in the bridge, which is used to determine the forwarding path of the forward message.

[0034] Step S103: forwarding the forward message to the second management unit in the container orchestration engine according to the forwarding path corresponding to the forward message.

[0035] Here, the forward message can be used for the container in the first management unit to interact with the container in the second management unit, for example, the forward message is used to access the running status of the container in the second management unit, etc. For example: the forwarding path is from the first network card to the second network card to the third network card, the first network card corresponds to the first management unit, and the third network card corresponds to other management units, then the forward message can be forwarded from the first management unit to the second network card through the first network card, and the forward message can be forwarded from the second network card to other management units through the third network card, etc., so as to enable the first management unit to access the virtual Internet Protocol address.

[0036] In the related art, by deploying the interaction scheme between Kube-proxy and the switch in the Kubernetes cluster, the Layer 2 forwarding mode of the message between two Pods is realized. In the embodiment of the present disclosure, first, by obtaining the forward message from the first management unit in the container orchestration engine; based on the preset direct routing table items and the bridge, the forwarding path corresponding to the forward message is determined; wherein the forwarding path is determined by the network card in the container orchestration engine; in this way, the forwarding path of the forward message can be quickly and accurately determined through the direct routing table items, and the default forwarding path can be adjusted; at the same time, since the determined forwarding path only involves multiple network cards, the forwarding path is simplified by removing the path for interacting with the switch; in this way, it is helpful to reduce the performance loss of message forwarding, reduce the delay of message forwarding and the situation of failure during the interaction process, etc. Then, according to the forwarding path corresponding to the forward message, the forward message can be quickly and accurately forwarded to the second management unit in the container orchestration engine, so as to realize the interaction between the container in the first management unit and the container in the second management unit.

[0037] In some embodiments, before implementing step S103, the method may further include the following steps S111 to S112:

[0038] Step S111, obtaining the Internet Protocol address of the first management unit, the local area network address of the first management unit, and the identifier of the input network card of the forward message.

[0039] Here, the Internet Protocol address (IP) is located in the network layer, and can provide information of various protocols to the transport layer, such as the Transmission Control Protocol, the User Datagram Protocol, etc., and can put the IP information packet to the link layer, and transmit it through various technologies such as Ethernet and token ring network to achieve interconnection between different networks. The container orchestration engine will assign an Internet Protocol address to each generated management unit, and store the Internet Protocol address and the corresponding relationship between the Internet Protocol address and the management unit in the preset storage space, so that the Internet Protocol address of the first management unit can be read in real time from the preset storage space; wherein, all containers in the management unit can share the Internet Protocol address of the management unit.

[0040] The local area network address (Media Access Control Address, MAC), also known as the physical address (Physical Address), is an address used to confirm the location of a network device. For example, the container orchestration engine can generate a local area network address query instruction to obtain the local area network address of each management unit. The input network card can refer to a network card connected to the first management unit. One end of the input network card can be added to the first management unit, and the other end of the input network card can be added to the bridge. The input network card can be used to forward forward messages to the bridge, etc.; wherein each network card can correspond to an identifier, and the corresponding network card can be read or called through the identifier, etc.; wherein each network card and the corresponding identifier can also be stored in a preset storage space, so that the identifier of the input network card can be read from the preset storage space in real time.

[0041] Step S112: Generate a static address resolution protocol table entry based on the Internet Protocol address of the first management unit, the local area network address of the first management unit, and the identifier of the input network card of the forward message.

[0042] Here, the static Address Resolution Protocol (ARP) table entry can be used to store the mapping relationship between the IP address and the corresponding MAC address. For example, the static ARP table entry may at least include: the Internet Protocol address (PodIP) of the first management unit, the LAN address (PodMAC) of the first management unit, the exit (Iface) of the network path to the destination address, and the state (State) is permanently bound (Permanent), etc. The static ARP table entry can limit the use of only the specified MAC address when communicating with the device with the specified IP address. At this time, the attack message cannot modify the mapping relationship between the IP address and the MAC address of this table entry, thereby protecting the normal communication between this device and the specified device.

[0043] In some embodiments, the above step S103 may include the following step S113:

[0044] Step S113: forwarding the forward message to the second management unit in the container orchestration engine based on the static address resolution protocol entry and according to the forwarding path corresponding to the forward message.

[0045] Here, the second management unit may refer to any management unit in the container orchestration engine except the first management unit, and the second management unit may receive the forward message; the second management unit may be located in the same working node (Node) as the first management node, or may be located in a different working node, etc., which is not limited here. Step S113 may include: forwarding the forward message from the management unit to the corresponding bridge, forwarding from the previous bridge to the current bridge, forwarding from the next bridge to the second management unit, etc. based on the mapping relationship between the IP address and the MAC address in the static ARP table entry.

[0046] In the disclosed embodiment, a static address resolution protocol table entry can be quickly and accurately generated through the Internet Protocol address of the first management unit, the local area network address of the first management unit, and the identifier of the input network card of the forward message, so that based on the static address resolution protocol table entry, the forward message can be accurately forwarded to the second management unit in the container orchestration engine according to the forwarding path corresponding to the forward message, which helps to reduce the forwarding path of the forward message, etc.

[0047] The present disclosure provides a message transmission method, such as Figure 2 As shown, the method includes the following steps S201 to S206:

[0048] Step S201 corresponds to the aforementioned step S101, and during implementation, reference may be made to the specific implementation of the aforementioned step S101; step S206 corresponds to the aforementioned step S103, and during implementation, reference may be made to the specific implementation of the aforementioned step S103.

[0049] Step S202, determining an input network card that matches the source address of the forward message.

[0050] Here, the input network card may refer to a network card connected to the first management unit, one end of the input network card may be added to the first management unit, the other end of the input network card may be added to the bridge, and the input network card may be used to forward the forward message to the bridge, etc. The corresponding relationship between the identifier of the management unit and the network card may be preset, and the corresponding relationship may be stored in a preset storage space, such as the first management unit corresponds to the first network card, the second management unit corresponds to the second network card, etc. Step S202 may include: parsing the forward message to obtain the source address of the forward message; determining the management unit (i.e., the first management unit) corresponding to the source address; based on the identifier of the first management unit and the corresponding relationship between the identifier of the management unit and the network card, determining the network card matching the first management unit, and determining the network card as the input network card.

[0051] Step S203: determining the output network card of the forward message based on the forwarding rule of the network bridge.

[0052] Here, the forwarding rules (Iptables) of the bridge can be understood as a firewall, which can filter the data packets of the message. The forwarding rules are composed of kernel state and user state. Kernel state: It is a part of the kernel, composed of data packet filtering tables, and is a kernel program that controls forwarding; User state: A program that can be operated by the user, which is passed to the kernel state by writing the rules of four tables and five chains, and implements custom filtering functions in sequence; the four tables and five chains can be input chains (Input), tracking tables (Raw), etc. The forwarding rules of the bridge can be pre-set in response to the user's association operations between different management units, such as forwarding the forward message of the first management unit to the second management unit, and forwarding the forward message of the third management unit to the fourth management unit, etc.

[0053] The output network card may refer to a network card connected to the second management unit, one end of the output network card may be added to the second management unit, the other end of the output network card may be added to the bridge, and the output network card may be used to forward the forward message from the bridge to the second management unit, etc. Step S203 may include: parsing the forward message to obtain the destination address of the forward message; determining the management unit (i.e., the second management unit) corresponding to the destination address; based on the identifier of the second management unit and the corresponding relationship between the identifier of the management unit and the network card, determining the network card matching the second management unit, and determining the network card as the output network card.

[0054] Step S204: determining at least one intermediate network card associated with the input network card and the output network card based on the forwarding table entry of the network bridge and the direct routing table entry.

[0055] Here, the intermediate network card may refer to a network card that associates an input network card and an output network card, such as a forward message can be sent from the input network card to the intermediate network card, and then from the intermediate network card to the output network card; wherein, the number of intermediate network cards is not limited here. The forwarding table item (Forward Database, FDB) is used to select a route for the second layer network of the switch. If the forwarding table item is static, and the switch is not allowed to change the forwarding table item arbitrarily and automatically, a fixed correspondence between the ports of certain network cards and certain MAC addresses can be achieved, and the client that is not within this corresponding range cannot receive the data packet from the switch, and the binding of the MAC address and the network card port can be achieved by using the static forwarding table item. For example: based on the correspondence between the MAC address and the network card port in the forwarding table item, it is determined that the outlet of the forward message in the input network card is the first intermediate network card, and then based on the information such as Iface preset in the direct routing table item, it is determined that the outlet of the forward message in the first intermediate network card is the second intermediate network card, etc.

[0056] Step S205: Determine the association order between the input network card, at least one of the intermediate network cards, and the output network card as a forwarding path corresponding to the forward message.

[0057] Here, the association order between network cards may refer to the order of network card connections in the forwarding path, such as the input network card in front, the intermediate network card in the middle, and the output network card in the back. The input network card corresponds to the first management unit, one end of the input network card is connected to the first management unit, the other end of the input network card is connected to one end of the intermediate network card, the other end of the intermediate network card is connected to the output network card, and the output network card corresponds to the second management unit. For example: the forwarding path corresponding to the forward message is from the input network card to the first intermediate network card to the second intermediate network card to the output network card, etc.

[0058] In the disclosed embodiment, the input network card can be accurately determined through the source address of the forward message, and then based on the forwarding rule of the bridge, the output network card of the forward message can be accurately determined; based on the forwarding table entries and direct routing table entries of the bridge, at least one intermediate network card associated with the input network card and the output network card is determined; and then the association order between the input network card, at least one intermediate network card and the output network card is determined as the forwarding path corresponding to the forward message, which helps to accurately and quickly obtain the forwarding path.

[0059] In some embodiments, at least one of the intermediate network cards includes a first intermediate network card in the network bridge and a second intermediate network card in the container orchestration engine, and the second intermediate network card is a physical network card; the above step S204 may include the following steps S2041 to S2043:

[0060] Step S2041: Determine the first intermediate network card based on the forwarding table entry of the network bridge.

[0061] Here, the first intermediate network card may refer to a network card connected to the input network card, and the second intermediate network card may refer to a network card connected to the output network card. For example, based on the correspondence between the MAC address and the network card port in the forwarding table, it can be determined that the outlet of the forward message in the input network card is the first intermediate network card, and then based on the information such as Iface preset in the direct routing table, it can be determined that the outlet of the forward message in the first intermediate network card is the second intermediate network card, etc.

[0062] Step S2042: Using the filtering rule of the network bridge, the source address of the forward message is replaced with the Internet Protocol address of the second intermediate network card to obtain a converted forward message.

[0063] Here, the filtering rule (Netfilter) may refer to a rule for filtering, converting, etc. a message. After the forward message is transmitted to the first intermediate network card, the forward message may be transmitted on the post-routing processing chain (POST_ROUTING chain) corresponding to the filtering rule to implement source address conversion (Snat) of the forward message, such as replacing the source address of the forward message with the Internet Protocol address of the second intermediate network card to obtain a converted forward message to change the default path of the forward message.

[0064] Step S2043: Determine the second intermediate network card that matches the converted forward message based on the direct routing table entry.

[0065] Here, the second intermediate network card may be determined based on information such as a destination address preset in the direct routing table entry and an exit of a network path to the destination address.

[0066] In the disclosed embodiment, the first intermediate network card is determined through the forwarding table entry of the network bridge; then, based on the direct routing table entry, the second intermediate network card matching the converted forward message can be quickly and accurately determined.

[0067] The present disclosure provides a message transmission method, such as Figure 3 As shown, the method includes the following steps S301 to S307:

[0068] Steps S301 to S303 correspond to the aforementioned steps S101 to S103 respectively, and during implementation, reference may be made to the specific implementation of the aforementioned steps S101 to S103.

[0069] Step S304: determining a connection tracking rule for the forward message based on the forwarding path corresponding to the forward message.

[0070] Here, connection tracking (CT) may refer to tracking and recording the status of each service or network card connection during the forwarding process of the forward message. The connection tracking rule corresponding to the forward message may be obtained by performing connection tracking on the forward message, and the connection tracking rule is used to record the result of connection tracking, such as the connection between the input network card and the first management unit, the connection between the first intermediate network card and the input network card, etc. The correspondence between the forward message and the connection tracking rule may be preset, and the correspondence may be stored in a preset storage space, so that the corresponding connection tracking rule may be determined in real time according to information such as the identifier of the forward message.

[0071] Step S305: Obtain a response message in response to the forward message from the second management unit.

[0072] Here, the second management unit generates a response message corresponding to the forward message in response to receiving the forward message. The response message may refer to a response to the forward message. For example, the forward message is used to represent the resource call request made by the first management unit to the second management unit. The response message may represent the response result of the second management unit to the resource call request. The response result may include approval of the call and disapproval of the call, etc.

[0073] Step S306: Determine the forwarding path corresponding to the response message based on the connection tracking rule of the forward message.

[0074] Here, the forwarding path of the forward message represented by the connection tracking rule can be inverted to obtain the forwarding path corresponding to the response message. For example, the forwarding path of the forward message represented by the connection tracking rule is from the input network card to the first intermediate network card to the second intermediate network card to the output network card, then the forwarding path of the response message can be from the output network card to the second intermediate network card to the first intermediate network card to the input network card.

[0075] Step S307: forward the response message to the first management unit according to the forwarding path corresponding to the response message.

[0076] Here, a corresponding static address resolution protocol table entry may be generated based on the forwarding path of the response message; based on the static address resolution protocol table entry, the response message may be forwarded to the first management unit according to the association order of the multiple network cards.

[0077] In the disclosed embodiment, the connection tracking rule of the forward message is determined by the forwarding path corresponding to the forward message, so that the forwarding path of the response message can be determined quickly and accurately, and then the response message can be forwarded to the first management unit quickly and accurately based on the forwarding path.

[0078] In some embodiments, after implementing step S306, the method may further include the following step S311:

[0079] Step S311, when forwarding the response message to the intermediate network card corresponding to the response message, using the filtering rule of the bridge, replace the target address of the response message with the Internet Protocol address of the first management unit to obtain a converted response message.

[0080] Here, for the response message, after the response message is transmitted to the second intermediate network card, the response message can be transmitted on the post-routing processing chain (POST_ROUTING chain) corresponding to the filtering rule to achieve the target address replacement of the response message, such as replacing the target address of the response message (also known as the destination address) with the Internet Protocol address of the first intermediate network card to obtain the converted response message, so as to change the default path of the response message and determine the network cards corresponding to the response message.

[0081] In some embodiments, the above step S307 may include the following step S12:

[0082] Step S312: forwarding the converted response message to the first management unit according to the forwarding path corresponding to the response message.

[0083] For example, the response message may be sent from the second management unit to the second intermediate network card, from the second intermediate network card to the first intermediate network card, from the first intermediate network card to the input network card, and then from the input network card to the first management unit.

[0084] In the disclosed embodiment, by forwarding the response message to the intermediate network card corresponding to the response message, the target address of the response message is replaced with the Internet Protocol address of the first management unit by utilizing the filtering rules of the bridge to obtain a converted response message, which helps to determine the next intermediate network card based on the converted response message to change the default path of the response message, etc.

[0085] The present disclosure provides a message transmission method, such as Figure 4 As shown, the method includes the following steps S401 to S406:

[0086] Steps S404 to S406 correspond to the aforementioned steps S101 to S103 respectively, and when being implemented, reference may be made to the specific implementation manners of the aforementioned steps S101 to S103.

[0087] Step S401: In response to the initialization of the first container network interface plug-in in the container orchestration engine, create the network bridge.

[0088] Here, the container network interface plug-in (Container Network Interface, CNI) is the application programming interface (Application Programming Interface, API) of the container network, which is a standard interface for calling network implementation in the container orchestration engine. The communication component (Kubelet) in the container orchestration engine calls different network plug-ins through this standard API to implement different network configuration methods. The CNI plug-in implements this interface, and the CNI plug-in can implement a series of CNI API interfaces. Among them, CNI plug-ins may include: Calico plug-in, Flannel plug-in, Terway plug-in, WeaveNet plug-in, Contiv plug-in, etc. The first container network interface plug-in may refer to a plug-in that can create a bridge, such as a Cniserver plug-in, etc., which is not limited here. For example: controlling the Cniserver plug-in through the Kubelet component to implement initial switching and create a bridge, etc.

[0089] Step S402: Create the first intermediate network card based on the second intermediate network card, and add the first intermediate network card to the network bridge.

[0090] Here, the second intermediate network card can be a physical network card, and the first intermediate network card can be a virtual network card; a virtual network card (also called a virtual network adapter) is a network adapter that simulates a network environment using software. The operating system comes with this network card. A physical network card is also called a physical address, hardware address or link address, which is written inside the hardware when produced by a network equipment manufacturer. When the second intermediate network card is determined, a first intermediate network card with a virtual Internet Protocol address can be created based on the second intermediate network card; one end of the first intermediate network card can be added to the bridge, and the other end can be added to the first management unit.

[0091] Step S403: Based on the communication component in the container orchestration engine, create the input network card of the forward message and the first management unit through the second container network interface plug-in in the container orchestration engine.

[0092] Here, the second container network interface plug-in may refer to a plug-in that can create the first management unit, such as a Cni plug-in. For example: the Kubelet component can be used to control the Cni plug-in to implement initial switching, and the input network card corresponding to the first management unit can be created first, and then the first management unit can be created; there is a corresponding relationship between the input network card and the output network card, and they can exist in pairs, one end of the input network card can be added to the bridge, and the other end can be added to the first management unit, etc. After the first management unit is created, the Internet Protocol address of the first management unit can be obtained, and based on the Internet Protocol address and physical address of the first management unit, a direct routing table entry, a static address resolution protocol table entry, etc. can be created for determining the forwarding path of the forward message and other processing.

[0093] In the disclosed embodiment, a network bridge is quickly created by responding to the initialization of a first container network interface plug-in in a container orchestration engine; a first intermediate network card is created based on a second intermediate network card, and the first intermediate network card is added to the network bridge; based on a communication component in the container orchestration engine, an input network card and a first management unit for a forward message are quickly and accurately created through the second container network interface plug-in in the container orchestration engine to realize the interaction of containers in different management units.

[0094] The following describes the application of the message transmission method provided by the embodiment of the present disclosure in an actual scenario. A K8s cluster is built based on an Internet Data Center (IDC) with a two-layer network that has not undergone a three-layer transformation to reduce the impact of problems such as long latency and high cost in the process of Pod accessing VIP.

[0095] In the related technology, in order to reduce the impact of long delays and high costs in the process of Pod accessing VIP, a network load balancer (LoadBalancer, LB) product can be deployed outside the K8s cluster. The message can be forwarded from the management unit in the K8s cluster to the network load balancer LB. Through the network load balancer LB, the conversion of VIP to the backend container (Backend) (the real IP address mounted behind the VIP) and traffic forwarding and other processing are realized; however, in this solution, VIP must be a valid network segment applied for from the basic network; at the same time, since the network load balancer LB is centralized, when the K8s cluster is large, the performance of the server in the network load balancer LB will become a bottleneck for message forwarding; in addition, the deployment of the network load balancer LB also requires additional servers, which increases costs.

[0096] In related technologies, cloud-native methods can also be used to implement the Layer 2 forwarding mode of messages by deploying the interaction solution between the service discovery component (Kube-proxy) and the switch (Switch) in the K8s cluster. However, this solution has problems such as message forwarding redundancy, long forwarding path, and large delay. Figure 5 As shown, the message forwarding path involves the interaction between the K8s cluster 501 and the switch (Switch) 502. The message forwarding path may include: the path for the Pod to access the VIP message flow direction, and the path for the Pod to access the VIP return message flow direction; wherein, a service (Sevier) can be set in the K8s cluster 501 to implement the load on the container based on the service; Sevier is an abstraction of application services, and provides load balancing and service discovery for applications through labels (Labels). Labels are labels that identify various objects in the K8s cluster; each Sevier will automatically A fixed virtual address (ClusterIP) (a virtual address accessible only within the K8s cluster) and a domain name or identifier in the Domain Name System (DNS) are automatically assigned. Other containers can access the service through this address or DNS without having to understand the operation of the backend container. For example, the clusterIP of Sevier in the K8s cluster 501 can be 10.0.32.52, the IP of the switch can be 10.30.230.1, and the MAC address can be 04:b0:e7:01:f7:c4, etc.

[0097] The path for the Pod to access the VIP message flow may include: obtaining a forward message from the management unit 5011 (i.e., the first management unit), transmitting the forward message to the network card (Veth1) 5012 (i.e., the input network card); then transmitting the forward message to the network card (Vlan100) 5014 (i.e., the first intermediate network card) in the bridge (Br-Vlan) 5013, and then transmitting the forward message to the forwarding function of the switch 502 through the network card (Eth0) 5015 (i.e., the second intermediate network card); using the forwarding function of the switch 502, the forward message is transmitted to the forwarding function of the switch 502. The forward message is forwarded to the network card (Eth1) 5016, which corresponds to the network card 5015 and can also be a physical network card; the forward message is then transmitted to the network card 5014, and the forward message is forwarded to the management unit 5108 (also the second management unit) through the network card (Veth2) 5017 (also the output network card); wherein, the IP of the management unit 5011 can be 10.30.230.16, the IP of the network card 5015 can be 12.1.1.6, the IP of the management unit 5108 can be 10.30.230.15, and so on.

[0098] In the forwarding process of the forward message, the forward message is sent from the management unit 5011. After the network card 5012 receives the forward message, it is forwarded in the bridge 5013. Since the forwarding rule (Iptables) is enabled in the bridge 5013, the forward message can be converted from VIP to the backend container according to the routing pre-processing chain (PRE_ROUTING chain) of the filtering rule (Netfilter). Then the forwarding table (FDB) under the bridge 5013 is queried to confirm that the outlet of the forward message is the network card 5014. ; Before the network card 5014 actually sends the forward message, the forward message can be transmitted according to the post-processing chain (POST_ROUTING chain) of Netfilter's routing selection to achieve source address translation (Snat); after the translation, the source address of the forward message can be replaced with the IP address of the network card (Eth0) 5015, and the destination address of the forward message can be replaced with the IP address of the management unit 5108; then the default routing table entry is queried to determine that the forward message can be sent from the network card (Eth0) 5015. For example: the destination address (Destination) in the default routing table entry is 0.0.0.0, the gateway address (Gateway) is 12.1.1.1, the subnet mask (Mask) of the destination address is 0.0.0.0, and the exit of the network path to the destination address (that is, from which exit the destination address can be reached) (Iface) is the network card (Eth0) 5015, etc.

[0099] After the forward message is forwarded to the switch 502, since the destination address of the forward message is the IP address of the management unit 5108, according to the second-layer forwarding rules, a tag (Tag) is added to the forward message, and the tagged forward message is forwarded to the network card (Eth1) 5016; the network card (Eth1) 5016 can enter the network card (Vlan100) 5014 in the bridge (Br-Vlan) 5013 according to the identifier of the virtual local area network (Virtual Local Area Network, Vlan) carried by the forward message, and execute the packet receiving processing flow; the forwarding table entry is queried again to obtain the network card (Veth2) 5017, and the forward message is forwarded to the management unit 5108 through the network card (Veth2) 5017.

[0100] The path of the return message flow for the Pod to access the VIP may include: the response message can be transmitted from the management unit 5108 to the network card 5017; then transmitted to the network card 5016 through the network card 5014, so that the forward message is forwarded to the switch 502; using the forwarding function of the switch 502, the response message is forwarded to the network card 5015; the forward message is forwarded to the network card 5012 through the network card 5014, so that the network card 5012 transmits the response message to the management unit 5011, etc.

[0101] During the forwarding process of the response message, the response message is sent from the management unit 5108. At this time, the destination address of the response message is the IP address of the network card (Eth0) 5015. According to the connection tracking rule established by the forward message, the destination address of the response message is modified to the IP address of the management unit 5011, and the source address of the response message is modified to the virtual Internet Protocol address (VIP). The default routing table entry is requeried to obtain the network card (Eth0) 5015, and the response message is sent from the network card (Eth0) 5015 to the switch 502. Among them, the connection tracking rules may include table entries in the access (Origin) direction, table entries in the response (Reply) direction, etc.; the table entries in the access direction may include the protocol type (Protonum, PROTO) as the Transmission Control Protocol (Transmission Control Protocol, TCP), the source address (Source, SRC) as 10.30.230.16, the destination address (Destination, DST) as 10.0.32.52, the source port (SoucePort, SPORT) as 58386, the destination port (DestinationPort, DPORT) as 9090, etc.; the table entries in the response direction may include PROTO as TCP, SRC as 10.30.230.15, DST as 12.1.1.6, SPORT as 9090, DPORT as 50120, etc.

[0102] After switch 502 receives the response message, it can determine that the destination address of the response message is the IP address of management unit 5011, and add the virtual LAN identifier to the response message according to the second-layer forwarding rules; the response message with the added identifier is forwarded to network card (Eth0) 5015, and based on the virtual LAN identifier and the forwarding table entry (FDB) under bridge 5013, the forward message is forwarded to network card 5012 through network card 5014, so that network card 5012 transmits the response message to management unit 5011, etc.

[0103] In the embodiment of the present disclosure, Figure 6 As shown, there is no interaction between the K8s cluster 601 and the switch 602, and the message forwarding path may include: the path for the Pod to access the VIP message flow direction, and the path for the Pod to access the VIP return message flow direction.

[0104] Regarding the path of the Pod access VIP message flow, when the container in the management unit 6011 accesses the VIP, the forward message is transmitted from the management unit 601 to the network card (Veth1) 6012 (that is, the input network card); after the network card (Veth1) 6012 receives the forward message, it is forwarded in the bridge (Br-Vlan) 6013. Since the forwarding rule (Iptables) is enabled in the bridge 6013, the forward message can be converted from VIP to the backend container according to the routing pre-processing chain (PRE_ROUTING chain) of the filtering rule (Netfilter); then the forwarding table (FDB) under the bridge 6013 is queried to confirm the exit of the forward message It is network card 6014; before network card 6014 actually sends the forward message, the forward message can be transmitted according to the post-processing chain (POST_ROUTING chain) of Netfilter's routing selection to achieve source address translation (Snat); after the conversion, the source address of the forward message can be replaced with the IP address of network card (Eth0) 6015; then the direct route table entry is queried to determine that the forward message can be sent from network card (Eth0) 5015 and directly reach network card (Veth2) 6017; among them, the query priority of the direct route table entry is higher than the query priority of the default route table entry. When the direct route table entry cannot be queried, the default route table entry can be queried. For example: the Destination of the first line in the direct routing table entry is 10.30.230.16, the Gateway is 0.0.0.0, the Mask is 255.255.255.0, and the Iface is the network card (Veth1) 6012, etc.; the Destination of the second line in the direct routing table entry is 10.30.230.15, the Gateway is 0.0.0.0, the Mask is 255.255.255.0, and the Iface is the network card (Veth2) 6017, etc.

[0105] For the path of the return message flow of the Pod accessing the VIP, the response message can be sent from the management unit 6108, and the destination address of the response message is the IP address of the network card (Eth0) 6015; according to the connection tracking rule established by the forward message, the destination address of the response message is modified to the IP address of the management unit 6011; the routing table item is queried again, and the direct connection routing table item is found at this time, instead of the default routing table item, and the response message can be directly forwarded to the management unit 6011 through the network card (Veth1) 6012 instead of forwarding it to the switch 602. Among them, the container in the first management unit and the container in the second management unit, or the Backend mounted behind the VIP, can be in the same computing node (working node), or in different computing nodes, etc.

[0106] Before forwarding a forward message or a response message, you can first create objects such as a management unit and a network card. Figure 7 As shown, in response to the initialization of the first container network interface plug-in (Cniserver plug-in) 701 in the container orchestration engine, a bridge (Br-Vlan) 702 can be created; based on the second intermediate network card (Eth0) 703, the first intermediate network card (Vlan100) 704 is created, and the first intermediate network card 704 is added to the bridge 702; wherein the first intermediate network card 704 is a virtual network card; based on the communication component (Kubelet) 705 in the container orchestration engine, through the second container network interface plug-in (Cni plug-in) 706 in the container orchestration engine, an input network card 707 and a first management unit 708 of a forward message are created.

[0107] In the disclosed embodiment, in the Layer 2 virtual LAN mode, when a management unit is created, on the computing node, the forwarding path of the message for the management unit to access the virtual LAN is optimized by adding additional direct routing table entries and static address resolution protocol table entries to other management units, thereby reducing performance loss during message transmission and reducing message forwarding delay.

[0108] Based on the foregoing embodiments, the embodiments of the present disclosure provide a message transmission device, which includes the units included and the modules included in the units, which can be implemented by a processor in a computer device; of course, it can also be implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP) or a field programmable gate array (FPGA), etc.

[0109] Figure 8 A schematic diagram of the structure of a message transmission device provided in an embodiment of the present disclosure is shown in FIG. Figure 8 As shown, the message transmission device 800 includes: a first acquisition module 810, a first determination module 820 and a first forwarding module 830, wherein:

[0110] The first acquisition module 810 is used to obtain a forward message from a first management unit in the container orchestration engine; the first determination module 820 is used to determine the forwarding path corresponding to the forward message based on a preset direct routing table entry and a bridge; wherein the forwarding path is determined by a network card in the container orchestration engine; the first forwarding module 830 is used to forward the forward message to the second management unit in the container orchestration engine according to the forwarding path corresponding to the forward message; wherein the forward message is used for the container in the first management unit to interact with the container in the second management unit.

[0111] In some embodiments, the first determination module is further used to: determine an input network card that matches the source address of the forward message; determine an output network card corresponding to the forward message based on the forwarding rule of the bridge; determine at least one intermediate network card associated with the input network card and the output network card based on the forwarding table entry of the bridge and the direct routing table entry; determine the association order between the input network card, at least one intermediate network card and the output network card as the forwarding path corresponding to the forward message; wherein the input network card corresponds to the first management unit, one end of the input network card is connected to the first management unit, the other end of the input network card is connected to one end of the intermediate network card, the other end of the intermediate network card is connected to the output network card, and the output network card corresponds to the second management unit.

[0112] In some embodiments, at least one of the intermediate network cards includes a first intermediate network card in the bridge and a second intermediate network card in the container orchestration engine, and the second intermediate network card is a physical network card; the first determination module is further used to: determine the first intermediate network card based on the forwarding table entry of the bridge; use the filtering rules of the bridge to replace the source address of the forward message with the Internet Protocol address of the second intermediate network card to obtain a converted forward message; based on the direct routing table entry, determine the second intermediate network card that matches the converted forward message.

[0113] In some embodiments, the device also includes: a second determination module, used to determine the connection tracking rule of the forward message based on the forwarding path corresponding to the forward message; a second acquisition module, used to obtain a response message in response to the forward message from the second management unit; a third determination module, used to determine the forwarding path corresponding to the response message based on the connection tracking rule of the forward message; and a second forwarding module, used to forward the response message to the first management unit according to the forwarding path corresponding to the response message.

[0114] In some embodiments, the device also includes: a replacement module, which is used to replace the target address of the response message with the Internet Protocol address of the first management unit by utilizing the filtering rules of the bridge when forwarding the response message to the intermediate network card corresponding to the response message, so as to obtain a converted response message; the second forwarding module is also used to: forward the converted response message to the first management unit according to the forwarding path corresponding to the response message.

[0115] In some embodiments, the device also includes: a third acquisition module, used to obtain the Internet Protocol address of the first management unit, the local area network address of the first management unit and the identifier of the input network card of the forward message; a generation module, used to generate a static address resolution protocol table entry based on the Internet Protocol address of the first management unit, the local area network address of the first management unit and the identifier of the input network card of the forward message; the first forwarding module is also used to: based on the static address resolution protocol table entry, forward the forward message to the second management unit in the container orchestration engine according to the forwarding path corresponding to the forward message.

[0116] In some embodiments, the device also includes: a first creation module, used to create the bridge in response to the initialization of the first container network interface plug-in in the container orchestration engine; a second creation module, used to create the first intermediate network card based on the second intermediate network card, and add the first intermediate network card to the bridge; wherein the first intermediate network card is a virtual network card; a third creation module, used to create the input network card of the forward message and the first management unit through the second container network interface plug-in in the container orchestration engine based on the communication component in the container orchestration engine.

[0117] The description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. In some embodiments, the functions or modules included in the device provided in the embodiments of the present disclosure can be used to execute the method described in the above method embodiment. For technical details not disclosed in the device embodiment of the present disclosure, please refer to the description of the method embodiment of the present disclosure for understanding.

[0118] It should be noted that in the embodiments of the present disclosure, if the above-mentioned message transmission method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present disclosure is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present disclosure. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM), a disk or an optical disk. In this way, the embodiments of the present disclosure are not limited to any specific hardware, software or firmware, or any combination of hardware, software, and firmware.

[0119] An embodiment of the present disclosure provides a computer device, including a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the processor executes the program, some or all of the steps in the above method are implemented.

[0120] The embodiment of the present disclosure provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, some or all of the steps in the above method are implemented. The computer-readable storage medium can be transient or non-transient.

[0121] An embodiment of the present disclosure provides a computer program, including a computer-readable code. When the computer-readable code is executed in a computer device, a processor in the computer device executes some or all of the steps for implementing the above method.

[0122] The present disclosure provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and when the computer program is read and executed by a computer, some or all of the steps in the above method are implemented. The computer program product can be implemented specifically by hardware, software or a combination thereof. In some embodiments, the computer program product is specifically embodied as a computer storage medium, and in other embodiments, the computer program product is specifically embodied as a software product, such as a software development kit (Software Development Kit, SDK), etc.

[0123] It should be noted here that the description of the various embodiments above tends to emphasize the differences between the various embodiments, and the same or similar aspects can be referenced to each other. The description of the above device, storage medium, computer program and computer program product embodiments is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the embodiments of the device, storage medium, computer program and computer program product disclosed in the present invention, please refer to the description of the method embodiment disclosed in the present invention for understanding.

[0124] It should be noted that Fig. 9 is a schematic diagram of a hardware entity of a computer device in an embodiment of the present disclosure, such as Fig. 9 As shown, the hardware entity of the computer device 900 includes: a processor 901, a communication interface 902 and a memory 903, wherein:

[0125] Processor 901 generally controls the overall operation of computer device 900 .

[0126] The communication interface 902 enables the computer device to communicate with other terminals or servers through a network.

[0127] The memory 903 is configured to store instructions and applications executable by the processor 901, and can also cache data to be processed or processed by the processor 901 and each module in the computer device 900 (for example, image data, audio data, voice communication data, and video communication data), which can be implemented by flash memory (FLASH) or random access memory (Random Access Memory, RAM). Data transmission between the processor 901, the communication interface 902 and the memory 903 can be carried out through the bus 904.

[0128] It should be understood that "one embodiment" or "an embodiment" mentioned throughout the specification means that specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present disclosure. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in the various embodiments of the present disclosure, the size of the serial numbers of the above-mentioned steps / processes does not mean the order of execution. The execution order of each step / process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present disclosure. The serial numbers of the embodiments of the present disclosure are for description only and do not represent the advantages and disadvantages of the embodiments.

[0129] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0130] In the several embodiments provided in the present disclosure, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored, or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0131] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0132] In addition, all functional units in the embodiments of the present disclosure may be integrated into one processing unit, or each unit may be separately configured as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0133] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM), magnetic disks or optical disks, and other media that can store program codes.

[0134] Alternatively, if the above-mentioned integrated unit of the present disclosure is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present disclosure can essentially or in other words, the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present disclosure. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0135] The methods disclosed in several method embodiments provided in the present disclosure can be arbitrarily combined without conflict to obtain new method embodiments.

[0136] If the embodiments of this disclosure involve personal information, the products using the embodiments of this disclosure have clearly informed the personal information processing rules and obtained the individual's voluntary consent before processing the personal information. If the embodiments of this disclosure involve sensitive personal information, the products using the embodiments of this disclosure have obtained the individual's separate consent before processing the sensitive personal information and meet the "explicit consent" requirement at the same time.

[0137] The above description is only an implementation mode of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present disclosure, which should be included in the protection scope of the present disclosure.

Claims

1. A message transmission method, characterized in that: include: Obtain a forward message from a first management unit in the container orchestration engine; Based on the preset direct routing table entry and the bridge, determine the forwarding path corresponding to the forward message; wherein the forwarding path is determined by the network card in the container orchestration engine; Forwarding the forward message to the second management unit in the container orchestration engine according to the forwarding path corresponding to the forward message; wherein the forward message is used for the container in the first management unit to interact with the container in the second management unit; Wherein, determining the forwarding path corresponding to the forward message based on the preset direct routing table entry and the bridge includes: Determine an input network card, an output network card, and at least one intermediate network card associated with the input network card and the output network card based on the direct routing table entry, the forwarding rule of the network bridge, and the forwarding table entry of the network bridge; The association order among the input network card, at least one of the intermediate network cards, and the output network card is determined as a forwarding path corresponding to the forward message.

2. The method according to claim 1, characterized in that The determining, based on the direct routing table entry, the forwarding rule of the bridge, and the forwarding table entry of the bridge, an input network card, an output network card, and at least one intermediate network card associated with the input network card and the output network card comprises: Determining the input network card that matches the source address of the forward message; Determine the output network card for the forward message based on the forwarding rule of the network bridge; Determine at least one of the intermediate network cards based on the forwarding table entries of the network bridge and the direct routing table entries; Among them, the input network card corresponds to the first management unit, one end of the input network card is connected to the first management unit, the other end of the input network card is connected to one end of the intermediate network card, the other end of the intermediate network card is connected to the output network card, and the output network card corresponds to the second management unit.

3. The method according to claim 2, characterized in that At least one of the intermediate network cards includes a first intermediate network card in the network bridge and a second intermediate network card in the container orchestration engine, wherein the second intermediate network card is a physical network card; The determining, based on the forwarding table entry of the bridge and the direct routing table entry, at least one intermediate network card associated with the input network card and the output network card comprises: Determining the first intermediate network card based on the forwarding table entry of the network bridge; Using the filtering rule of the network bridge, the source address of the forward message is replaced with the Internet Protocol address of the second intermediate network card to obtain a converted forward message; Based on the direct routing table entry, determine the second intermediate network card that matches the converted forward message.

4. The method according to claim 1, characterized in that: The method further comprises: Determining a connection tracking rule for the forward message based on the forwarding path corresponding to the forward message; Acquire a response message in response to the forward message from the second management unit; Determine the forwarding path corresponding to the response message based on the connection tracking rule of the forward message; Forward the response message to the first management unit according to the forwarding path corresponding to the response message.

5. The method according to claim 4, characterized in that The method further comprises: When forwarding the response message to the intermediate network card corresponding to the response message, using the filtering rule of the bridge, the target address of the response message is replaced with the Internet Protocol address of the first management unit to obtain a converted response message; The step of forwarding the response message to the first management unit according to the forwarding path corresponding to the response message includes: The converted response message is forwarded to the first management unit according to the forwarding path corresponding to the response message.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Obtaining the Internet Protocol address of the first management unit, the local area network address of the first management unit, and the identifier of the input network card of the forward message; Generate a static address resolution protocol table entry based on the Internet Protocol address of the first management unit, the local area network address of the first management unit, and the identifier of the input network card of the forward message; The forwarding the forward message to the second management unit in the container orchestration engine according to the forwarding path corresponding to the forward message includes: Based on the static address resolution protocol entry, the forward message is forwarded to the second management unit in the container orchestration engine according to the forwarding path corresponding to the forward message.

7. The method according to claim 3, characterized in that The method further comprises: In response to initialization of a first container network interface plug-in in the container orchestration engine, creating the network bridge; Creating the first intermediate network card based on the second intermediate network card, and adding the first intermediate network card to the network bridge; wherein the first intermediate network card is a virtual network card; Based on the communication component in the container orchestration engine, an input network card for the forward message and the first management unit are created through a second container network interface plug-in in the container orchestration engine.

8. A message transmission device, characterized in that: include: A first acquisition module, used to acquire a forward message from a first management unit in the container orchestration engine; A first determination module, configured to determine a forwarding path corresponding to the forward message based on a preset direct routing table entry and a bridge; wherein the forwarding path is determined by a network card in the container orchestration engine; A first forwarding module, configured to forward the forward message to a second management unit in the container orchestration engine according to a forwarding path corresponding to the forward message; wherein the forward message is used for the container in the first management unit to interact with the container in the second management unit; Wherein, determining the forwarding path corresponding to the forward message based on the preset direct routing table entry and the bridge includes: Determine an input network card, an output network card, and at least one intermediate network card associated with the input network card and the output network card based on the direct routing table entry, the forwarding rule of the network bridge, and the forwarding table entry of the network bridge; The association order among the input network card, at least one of the intermediate network cards, and the output network card is determined as a forwarding path corresponding to the forward message.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, wherein: When the processor executes the program, the steps in the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps in the method according to any one of claims 1 to 7 are implemented.

Images