A real source address communication method, device, electronic device and storage medium

Abstract

The present invention discloses a real source address communication method, device, electronic device and storage medium. The real source address communication method includes: obtaining an internal application access request based on a communication service of a load balancer; creating a virtual address object according to the internal application access request; and directly forwarding the internal application access request address to the internal application without converting it when a custom rule matching the virtual address object exists in a preset routing table. In an embodiment of the present invention, by obtaining an internal application access request and creating a virtual address object according to the internal application access request, and when a custom rule matching the virtual address object exists in a preset routing table, the internal application access request address is directly forwarded to the internal application without converting it, so that the access method of the client is not changed, and the internal application access request address can be directly forwarded to the internal application of the internal application cluster, thereby enabling the cluster to directly obtain the real source IP address of the client.

Description

Technical Field

[0001] The present invention relates to the field of computer application technology, and in particular to a real source address communication method, device, electronic equipment and storage medium. Background Art

[0002] Kubernetes is an open source application management platform for managing containerized applications on multiple hosts in a cloud platform. It supports automated deployment, large-scale scalability, and containerized application management. Kubernetes can expose internal application services to the outside world through a load balancer. External users can access applications in the cluster through the Internet Protocol (IP) address and the specified protocol and port number of the virtual network generated on a node.

[0003] External users can access applications within the Kubernetes cluster through a load balancer, but the implementation of the load balancer will perform source network address translation (SNAT) on the message in the destination address translation chain (PREROUTING) of iptables, resulting in the source IP address being converted during the access process to a node IP or an IP of the node where the virtual IP is located. When it finally reaches the application within the cluster, the source IP address viewed by the application is not the real client IP. Therefore, a real source address communication method that can view the real source IP has become an urgent problem to be solved. Summary of the invention

[0004] The present invention provides a real source address communication method, device, electronic device and storage medium, so as to achieve the access mode of the client without changing the client. When the client accesses the internal application of the cluster, the application in the cluster can directly obtain the real source IP address of the client.

[0005] According to one aspect of the present invention, a real source address communication method is provided, wherein the method comprises:

[0006] The communication service based on the load balancer obtains the internal application access request;

[0007] Create a virtual address object based on an internal application access request;

[0008] When a custom rule matching the virtual address object exists in the preset routing table, the access request to the internal application is directly forwarded to the internal application without address translation.

[0009] According to another aspect of the present invention, a real source address communication device is provided, wherein the device comprises:

[0010] A request acquisition module, used to acquire internal application access requests based on the communication service of the load balancer;

[0011] An object generation module, used for creating a virtual address object according to an internal application access request;

[0012] The request processing module is used to directly forward the access request address of the internal application to the internal application without translating the address when there is a custom rule matching the virtual address object in the preset routing table.

[0013] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by at least one processor. The computer program is executed by at least one processor so that the at least one processor can execute a real source address communication method according to any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement a real source address communication method according to any embodiment of the present invention when executed.

[0018] The technical solution of the embodiment of the present invention obtains internal application access requests through a communication service based on a load balancer, creates a virtual address object according to the internal application access request, and when a custom rule matching the virtual address object exists in a preset routing table, the internal application access request address is not converted and is directly forwarded to the internal application, thereby achieving an access method of the client without changing it. When the client accesses the internal application of the cluster and when a custom rule matching the virtual address object exists in the preset routing table, the internal application access request address can be directly forwarded to the application in the internal application cluster, thereby enabling the cluster to directly obtain the client's real source IP address.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 is a flow chart of a real source address communication method provided according to Embodiment 1 of the present invention;

[0022] Figure 2 is a flow chart of a real source address communication method provided according to Embodiment 2 of the present invention;

[0023] Figure 3 is a flow chart of a real source address communication method provided according to Embodiment 3 of the present invention;

[0024] Figure 4 This is a topological architecture diagram of real source address communication provided according to Embodiment 4 of the present invention;

[0025] Figure 5 is a schematic diagram of the structure of a real source address communication device provided according to Embodiment 5 of the present invention;

[0026] Figure 6 It is a structural schematic diagram of an electronic device for implementing a real source address communication method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] Embodiment 1

[0030] Figure 1 This is a flowchart of a real source address communication method provided according to the first embodiment of the present invention. This embodiment is applicable to the case of communicating through a real source address. The method can be executed by a real source address communication device. The real source address communication device can be implemented in the form of hardware and / or software. The real source address communication device can be configured in a Kubernetes cluster. Figure 1 As shown, the method includes:

[0031] S110. Obtain an internal application access request based on the communication service of the load balancer.

[0032] The load balancer can be used to distribute network requests to available servers in a server cluster, by managing incoming Web data traffic and increasing effective network bandwidth. An internal access request can refer to a request from an external client to access internal services, wherein an internal application access request can include an internal application access request address.

[0033] In the embodiment of the invention, according to the communication service of the load balancer, when an external client accesses an application in the cluster through the load balancer, the load balancer can receive an internal access request from the external client. In actual operation, the load balancer can receive the internal access request address of the external client and generate a protocol and port number corresponding to the node.

[0034] S120: Create a virtual address object according to the internal application access request.

[0035] The virtual address object may refer to an address object that is both reachable within the cluster's internal network and reachable externally, and is an object that can be used for internal communication within the cluster. The virtual address object may be generated based on an internal application access request.

[0036] In an embodiment of the invention, after obtaining an internal application access request, a virtual address object can be created according to the business access information. In actual operation, a virtual address object can be created according to the address of the internal application access request. In one embodiment, after the cluster monitors the event of creating a virtual address object, according to the virtual address information of the virtual address object, a Keepalived process can be configured and started on the current node to prevent single point failures, form a Keepalived cluster between multiple nodes, and generate a virtual IP address of the virtual address object in other nodes in the Keepalived cluster.

[0037] S130: When a custom rule matching the virtual address object exists in the preset routing table, the access request to the internal application is directly forwarded to the internal application without performing address translation.

[0038] The preset routing table may refer to a routing table that is preset and stored locally, and the custom rule may be a rule for disabling source address translation for a virtual address object.

[0039] In an embodiment of the invention, when a custom rule matching a virtual address object exists in a preset routing table, the access request to an internal application may be forwarded directly to the internal application without performing address translation. In actual operation, custom rules may be pre-configured. For example, the custom rule may be to create a virtual IP address, protocol, and port number that disables source address translation in the preset routing table, and to create a custom chain with the highest priority in the network address translation table in the preset routing table, and the rule content of the custom chain includes that when the access request to an internal application and the corresponding protocol and port number match the virtual IP address, protocol, and port number that disables source address translation, the access request to an internal application may be forwarded directly to the internal application without performing address translation. In other words, when the access request to an internal application and the corresponding protocol and port number match the virtual IP address, protocol, and port number that disables source address translation, the access address to the internal application may be forwarded directly to the internal application without performing source address translation.

[0040] In an embodiment of the present invention, an internal application access request is obtained through a communication service based on a load balancer, a virtual address object is created according to the internal application access request, and when a custom rule matching the virtual address object exists in a preset routing table, the internal application access request address is not converted and is directly forwarded to the internal application, thereby achieving an access method of the client without changing the internal application access request address, and the internal application access request address can be directly forwarded to the internal application of the internal application cluster, thereby enabling the cluster to directly obtain the client's real source IP address.

[0041] In one embodiment, it further includes:

[0042] Obtain the response information of the internal application and feed the response information back to the source address accessed by the internal application.

[0043] The reply information may refer to the reply information from within the cluster to the external client.

[0044] In the embodiment of the invention, the reply information of the internal application can be received, and the reply information can be fed back to the source address accessed by the internal application. In actual operation, the exit address of the exit custom resource of the internal application can be configured within the cluster, and the source address accessed by the internal application corresponding to the reply information can be extracted. When the exit address of the exit custom resource of the internal application matches the source address, the reply information is transmitted to the source address according to the exit custom resource.

[0045] In one embodiment, the reply information is fed back to the source address accessed by the internal application, including:

[0046] Extract the source address of the internal application access corresponding to the reply information;

[0047] When the egress address of the internally applied egress custom resource matches the source address, the reply information is transmitted to the source address according to the egress custom resource.

[0048] Among them, the egress custom resource (Egress Custom Resource Definition, Egress CRD) can be a custom egress resource. In actual operation, the corresponding egress custom resource can be created in the corresponding namespace (Namespace) through kube-apiserve. Among them, the egress custom resource includes the protocol (Egress Internet Protocol, Egress IP) field and the application (Applied To) field for interconnection between egress networks. The EgressIP field is configured as the virtual IP address of the virtual address object, and the Applied To field is configured as the Namespace and label (Label) of the process (Pod) running on the backend cluster corresponding to the accessed service (Service).

[0049] In an embodiment of the invention, an egress custom resource can be created in advance, the source address of the internal application access corresponding to the reply information can be queried, and the corresponding source address of the internal application access can be extracted. The egress address of the egress custom resource of the internal application is matched with the source address. When the egress address of the egress custom resource of the internal application matches the source address, the reply information can be transmitted to the source address according to the egress custom resource.

[0050] In one embodiment, transmitting the reply information to the source address according to the export custom resource includes at least one of the following:

[0051] In the non-encapsulation mode, the reply information is marked so that the reply information is fed back to the source address according to the policy routing of the egress custom resource;

[0052] In encapsulation mode, the reply information is transmitted to the source address through the tunnel according to the egress custom resource call;

[0053] In hybrid mode, if the source address is in the same large layer 2, the policy routing of the egress custom resource is used to feed back to the source address. If the source address is not in the same large layer 2, the egress custom resource is used to call the tunnel to transmit the reply information to the source address.

[0054] In an embodiment of the invention, different modes can be used to transmit reply information to the source address in different ways. When in the unencapsulated mode, it can be indicated that the current container network cross-node communication is implemented through node routing, and the reply information can be marked so that the reply information is fed back to the source address according to the policy routing of the export custom resource. In one embodiment, when the source address is matched to a port where the real source address function switch field is true, and the destination address is not the node IP and the service IP, the reply information can be marked, and the reply information can be fed back to the source address according to the policy routing of the export custom resource after marking. When in the encapsulated mode, it means that the current container network cross-node communication is implemented through the tunnel mode, and the reply information can be transmitted to the source address through the tunnel according to the export custom resource call. When in the hybrid mode, if it is in the large second layer with the source address, it can be fed back to the source address according to the policy routing of the export custom resource; if it is not in the same large second layer as the source address, the reply information can be transmitted to the source address through the tunnel according to the export custom resource call.

[0055] Embodiment 2

[0056] Figure 2 1 is a flow chart of a real source address communication method provided according to Embodiment 2 of the present invention. This embodiment is a further description of a real source address communication method based on the above embodiment. Figure 2 As shown, the method includes:

[0057] S210. Providing business access information of internal applications based on the internal business information exposure service.

[0058] The internal business information exposure service can be used to expose internal applications to the outside world, so that external clients can access applications within the cluster through business access information. Business access information can refer to information exposed by applications within the cluster. For example, the business access information can include virtual IP addresses, protocols, port numbers, and other information.

[0059] In the embodiment of the invention, the internal business information exposure service can provide business access information of internal applications. In actual operation, a corresponding load balancer can be created in the namespace, and the load balancer exposure service generates a corresponding virtual IP address, protocol and port number for the internal application to expose the business access information to the outside.

[0060] S220: Create a virtual address object according to the service access information.

[0061] In the embodiment of the invention, after the service access information is obtained, a virtual address object can be created according to the service access information. In actual operation, a virtual address object can be created according to the virtual IP address in the service access information.

[0062] S230: Create a custom rule for a virtual address object in a preset routing table.

[0063] The custom rule may be a rule for disabling source address translation for a virtual address object.

[0064] In an embodiment of the invention, a custom rule for a virtual address object may be created in a preset routing table so that the virtual address object disables source address translation. In one embodiment, a custom chain with the highest priority may be created so that service access information through the custom chain does not perform source address translation. In one embodiment, S230 includes:

[0065] S231. Create a first custom rule in a preset routing table according to the virtual address proxy, wherein the first custom rule includes service access information for disabling source address translation.

[0066] Among them, the virtual address agent can be deployed in the control node of the cluster to create a first custom rule for the current node; the first custom rule can include business access information that disables source address translation, which is used to determine whether the node disables source address translation.

[0067] In an embodiment of the invention, the virtual address proxy may create a first custom rule in a preset routing table, wherein the first custom rule may include service access information for disabling source address translation. In actual operation, the service access information corresponding to the virtual address object may be obtained, and the service access information corresponding to the virtual address object may be used as the service access information of the first custom rule to generate the first custom rule. Exemplarily, the service access information of the first custom rule may include the virtual address, protocol, and port number corresponding to the virtual address object.

[0068] S232. Create a first custom chain with the highest priority based on the network address translation table of the virtual address agent in the preset routing table, wherein the rule content of the first custom chain includes not performing source address translation when the target business access information matches the business access information of the first custom rule.

[0069] Among them, the Network Address Translation (NAT) table is a table that can convert internal private network addresses (IP addresses) into legal network IP addresses. Exemplarily, through source address translation, the source address of the data packet can be modified. The first custom chain can be a chain with the highest priority pre-configured by the business personnel. When the target business access information matches the business access information of the first custom rule, the source address translation may not be performed. Among them, the target business information may refer to the information corresponding to the target business, and the content of the target business information may include the target address, protocol, port number, etc.

[0070] In an embodiment of the invention, the virtual address agent can create a first custom chain with the highest priority in the network address conversion table in the preset routing table, which is used to bypass the network address conversion and not perform source address conversion when the target business access information matches the business access information of the first custom rule. In actual operation, the first custom chain can be created in the network address conversion table in the preset routing table, and the highest priority rule can be added to the chain responsible for network address switching in the network address conversion table to jump to the first custom chain, and a rule can be created in the first custom chain at the same time. When the target business access information of the first custom chain matches the business access information of the first custom rule, source address conversion is not performed. In one embodiment, the target business access information can be matched by extracting the port number and protocol in the business access information of the first custom rule. When the port number and protocol in the target business access information are the same as those in the business access information, it can be considered that the target business access information matches the business access information.

[0071] S240. Obtain an internal application access request based on the communication service of the load balancer.

[0072] S250: Create a virtual address object according to the internal application access request.

[0073] S260: When there is a custom rule matching the virtual address object in the preset routing table, the access request to the internal application is directly forwarded to the internal application without performing address translation.

[0074] An embodiment of the present invention provides business access information of internal applications through an internal business information exposure service, creates a virtual address object according to the business access information, creates a custom rule for the virtual address object in a preset routing table, and implements the creation of a custom rule for creating a virtual address object in the preset routing table. When the custom rule is met, source address conversion is not performed, thereby directly forwarding the internal application access request to the internal application without address conversion.

[0075] Embodiment 3

[0076] Figure 3 1 is a flow chart of a real source address communication method provided according to Embodiment 3 of the present invention. This embodiment is a further description of a real source address communication method based on the above embodiment. Figure 3 As shown, the method includes:

[0077] S310. Obtain an internal application access request based on the communication service of the load balancer.

[0078] S320: Create a virtual address object according to the internal application access request.

[0079] S330: Extract the real source address function switch field of the virtual address object.

[0080] Among them, the real source function switch field can be field information used to determine whether the virtual address object has enabled the real source address function.

[0081] In an embodiment of the invention, in order to confirm whether the real source address function is enabled for the virtual address object, the real source address function switch field information of the virtual address object can be searched, the real source function switch field of the virtual object can be extracted, and the real source function switch field corresponding to the virtual address object can be judged to be true or false.

[0082] S340: If the real source address function switch field is false, clear the service access information of the first custom rule in the preset routing table.

[0083] In an embodiment of the invention, when the real source address function switch field is false, it can be considered that the real source address function is not enabled for this virtual address object, and the business access information of the first custom rule corresponding to this virtual address object in the preset routing table can be searched, and the business access information of the first custom rule corresponding to the virtual address object can be cleared.

[0084] S350: If the real source address function switch field is true, extract the service access information of the virtual address object as the service access information of the first custom rule in the preset routing table.

[0085] In an embodiment of the present invention, when the real source address function switch field is true, it can be considered that the real source address function is turned on for this virtual address object, and the business access information corresponding to the virtual address object can be extracted as the business access information of the first custom rule in the preset routing table. Among them, the business access information of the virtual address object may include the virtual address, protocol and port number of the virtual address object, that is, the virtual address, protocol and port number of the virtual address object can be used as the business access information of the first custom rule in the preset routing table. In one embodiment, the form of the business access information of the first custom rule may include but is not limited to [virtual address, protocol, port number].

[0086] S360: When the business access information of the first custom rule matches the target business access information of the first custom chain, transmit the internal application access request to the internal application based on the container network interface.

[0087] Among them, the container network interface (CNI) can refer to the network used to connect the container network and open up the network connectivity between containers based on specific network technology.

[0088] In an embodiment of the invention, the target business access information of the first custom chain can be extracted to confirm whether the business access information of the first custom rule matches the target business access information of the first custom chain. In actual operation, the corresponding virtual address, protocol number and port number in the business access information of the first custom rule can be extracted, and the target business access information of the first custom chain can be queried to see whether the same target business access information exists. When there is business access information that is the same as the target business access information, it can be considered that the business access information of the first custom rule matches the target business access information of the first custom chain. When the business access information of the first custom rule matches the target business access information of the first custom chain, the internal application access request can be transmitted to the internal application based on the container network interface.

[0089] In an embodiment of the present invention, an internal application access request is obtained through a communication service based on a load balancer, a virtual address object is created according to the internal application access request, and a real source address function switch field of the virtual address object is extracted. If the real source address function switch field is false, the business access information of the first custom rule in the preset routing table is cleared; if the real source address function switch field is true, the business access information of the virtual address object is extracted as the business access information of the first custom rule in the preset routing table, so as to determine whether the business access information of the first custom rule is saved or deleted according to the true or false of the real source address function switch field. When the business access information of the first custom rule matches the target business access information of the first custom chain, the internal application access request is transmitted to the internal application based on the container network interface, so as to realize that the internal application access request is directly forwarded to the internal application without address conversion.

[0090] Embodiment 4

[0091] Figure 4 It is a topological architecture diagram of a real source address communication provided according to Example 4 of the present invention. The embodiment of the present invention is based on the above embodiment, taking the VIP object as the virtual address object, vip-agent as the virtual address agent, and disablesnat as the real source address function switch field as an example to further illustrate a real source address communication method.

[0092] Among them, VIP is a Kubernetes-based CRD resource that contains the following fields:

[0093] vips: can contain 1-N virtual IP addresses

[0094] disablesnat: Whether to enable the [real source IP] function

[0095] disablesnatrule: A list of protocol and port rules for which the real source IP function needs to be enabled. This feature supports enabling the real source IP function for multiple applications.

[0096] Egress is a Kubernetes-based CRD resource that contains the following fields:

[0097] ApplidTo: Resource selector, which can determine the Pods that need to configure Egress traffic redirection and Egress SNAT through a set of Label Selectors and Name space Selectors.

[0098] EgressIP: container traffic egress gateway (Egress Gateway) IP address.

[0099] Step 1: SNAT is prohibited for external access to specific services. That is, when the application is accessed externally through the service of the load balancer, the source IP is directly forwarded to the application without SNAT.

[0100] In the embodiment, the user creates a Service of the corresponding load balancer in the corresponding namespac through the client through kube-apiserver to expose the business within the cluster to the outside by specifying the [virtual IP address], [protocol] and [port].

[0101] Create a VIP object according to the virtual IP address, set the real source address function switch field (disablesnat) to true, and add the corresponding [protocol] and [port] to the disablesnatrule field. Among them, kube-apiserver is a community standard component and the access portal of Kubernetes cluster objects. You can operate various resources within the cluster by accessing this api, including Kubernetes standard objects, and you can also operate Kubernetes custom resource objects, that is, CRD resource objects.

[0102] After vip-agent is started, an ipset named DISABLE-SNAT-SLB of type "hash:ip,port" can be created in the current node. After vip-agent configures ipset, a custom chain named KUBE-KEEPALIVED-VIP-PREROUTE can be created in the NAT table of iptables, and a rule with the highest priority can be added in the destination address translation chain (PREROUTING) to jump to the custom chain. Create an iptables rule in the custom chain. The content of the rule is [destination address, protocol and port number]. When it matches the ipset content of DISABLE-SNAT-SLB, the Accept action is directly executed, bypassing the iptables rules of the Service itself, and no subsequent SNAT processing is performed. The final configured iptables rules are as follows:

[0103] -N KUBE-KEEPALIVED-VIP-PREROUTE

[0104] -I PREROUTING 1-j KUBE-KEEPALIVED-VIP-PREROUTE

[0105] -A KUBE-KEEPALIVED-VIP-PREROUTE-m set--match-set DISABLE-SNAT-SLBdst,dst-j ACCEPT

[0106] Among them, -N KUBE-KEEPALIVED-VIP-PREROUTE means creating a new custom chain; -IPREROUTING 1 means giving priority to matching at the first position of PREROUTING and entering KUBE-KEEPALIVED-VIP-PREROUTE for processing; -A KUBE-KEEPALIVED-VIP-PREROUTE can mean matching with the content in DISABLE-SNAT-SLB. If the match is successful, the access request to the internal application is forwarded directly to the internal application without address translation.

[0107] After vip-agent configures ipset and iptables rules, it can monitor VIP addition and deletion events through the monitoring mechanism (InformerFactory). When vip-agent monitors the VIP object creation event, it can configure and start the keepalived process on the current node based on the virtual IP address information of the VIP object, so that a keepalived cluster can be formed between multiple nodes, and the virtual IP address of the VIP object can be generated in the cluster. Among them, keepalived is a service software that ensures high availability of the cluster in cluster management. It is used to prevent single point failures and can generate a virtual IP address on the specified network card.

[0108] After starting the keepalived process, you can check whether the [real source IP] function is enabled in the VIP, that is, whether the real source address function switch field (disablesnat) is true or false. When disablesnat is false (false), the ipset content named DISABLE-SNAT-SLB is cleared; when disablesnat is true (true), vip-agent obtains the disables natrule field of the VIP, extracts the protocol and port fields in the disablesnatrule field of the VIP, and writes them and the [virtual IP address] of the VIP into the ipset named DISABLE-SNAT-SLB. The written format is [virtual IP, protocol: port]. If there are multiple [protocols and ports] in the disablesnatrule, they can be written into the ipset multiple times, such as [vip, protocol 1: port1], [vip, protocol2: port2]. At this point, the client accesses the internal services of the cluster again through the load balancer. The source address of the client no longer performs the SNAT action. According to the processing flow of CNI, it enters the internal application of the cluster with the real source IP address.

[0109] Step 2: Get the response information of the internal application and feed the response information back to the source address accessed by the internal application.

[0110] In an embodiment, the client can create a corresponding Egress CRD resource in the corresponding namespace through kube-apiserver, wherein the EgressIP segment is configured as the virtual IP address allocated above, and the AppliedTo field is configured as the Namespace and label (Label) of the backend Pod corresponding to the accessed Service. vector-cni can monitor export custom resources and Pod resources. When creating a new Egress CRD resource, vector-cni can parse the AppliedTo field in the Egress CRD resource, and find the corresponding Pod resource according to the label selector (Label Selector) and namespace selector (Namespace Selector) configured in the AppliedTo field, and can obtain the EgressIP information in the Egress CRD resource. Among them, vector-cni is a container network CNI plug-in that uses Open vSwitch as the network function virtualization implementation base and uses the programmable characteristics of OpenFlow to implement it. At the same time, it uses the programmable characteristics of the flow table to redirect traffic and implement the Egress Gateway function.

[0111] In one embodiment, after startup, vector-cni can also monitor network device events of this node. When an IP address is assigned or removed from a network device, vector-cni can process the event and record the latest IP address information of the network device on this node. The network device IP address event is sent to the egress controller (Egress Controller) in vector-cni for processing. When a virtual IP is configured on this node, the Egress Controller can receive a virtual IP addition event. The Egress Controller can parse the event and obtain the virtual IP address information. By matching the EgressIP in the created Egress CRD resource, if the virtual IP address matches the EgressIP, it can be considered that this node is an egress node with VIP as the EgressIP.

[0112] In one embodiment, vector-cni can also read the traffic mode (TrafficMode) configuration in the configuration map (ConfigMap) when it starts, and pass the parameters to the egress controller (EgressController). The EgressController can read the configuration to determine the deployment form of the current container network, and process it in three ways according to the deployment form.

[0113] In one embodiment, in the non-encapsulation mode, it means that the current container network cross-node communication is realized through node routing, and the vector-cni of the non-egress node (EgressNode) can obtain the Pod IP address information selected in the AppliedTo field in the configured Egress CRD resource. And filter the Pod IPs that are not on this node. Then configure the VECTOR-EGRESS-GATEWAY and VECTOR-EGRESS-DST-EXCLUDE ipset resources on the node, where VECTOR-EGRESS-GATEWAY configures the filtered Pod IP address information, and VECTOR-EGRESS-DST-EXCLUDE is used to store the Pod CIDR, Service CIDR and cluster Node IP address information in the current cluster. At the same time, configure the iptables rules to match the VECTOR-EGRESS-GATEWA Y content and match the content outside VECTOR-EGRESS-DST-EXCLUDE and set the Mark traffic tag. Such as:

[0114] -N VECTOR-EGRESS-GATEWAY

[0115] -I PREROUTING 1-j VECTOR-EGRESS-GATEWAY

[0116] -I VECTOR-EGRESS-GATEWAY 1-m set--match-set VECTOR-EGRESS-SOURCE src-m set! --match-set VECTOR-EGRESS-DST-EXCLUDE dst-j MARK --set-mark 0x5 / 0x5

[0117] Among them, when the matched source address is the port with the real source IP enabled (VECTOR-EGRESS-SOU RCE), and the destination address is not nodeIP and serviceIP (VECTOR-EGRESS-DST-EXCLUDE), this kind of message can be marked (--set-mark 0x5 / 0x5). After marking, the policy route can send these marked messages to the node where the VIP is located in the form of routing.

[0118] The vector-cni of the non-EgressNode node will then issue a policy route matching fwmark to redirect the traffic to the EgressNode. At the same time, the noSNAT iptables rule matching Mark is issued on this node to avoid SNAT in this section, which affects the subsequent traffic return process of the real source IP. The EgressNode node can also obtain the Pod IP address information selected in the AppliedTo field of the configured EgressCRD resource, and issue iptables rules to identify the traffic based on the Pod IP information, and at the same time issue SNAT rules to SNAT the traffic source IP address to the EgressIP address.

[0119] In one embodiment, in encapsulation mode, it means that the current container network cross-node communication is implemented through tunnel mode. The vector-cni of the EgressNode node can obtain the Pod IP address information selected by the AppliedTo field in the configured Egre ss CRD resource, and filter the Pod IP not on the node, and then configure the traffic forwarding rules on the specific OpenFlowPipeline Table to redirect the traffic of the Pod corresponding to the filtered Pod IP address to the EgressNode in a tunnel manner.

[0120] The EgressNode node can obtain the PodIP address information selected in the AppliedTo field of the configured Egress CRD resource. It matches the DST_TUN_IP address on a specific OpenFlow Pipeline Table and sets pkt-mark to mark the traffic that needs to be SNATed by Egress. Finally, it sends down the iptables rule that matches the Mark and sets SNAT, and SNATs the traffic source IP address to the EgressIP address.

[0121] In one embodiment, in hybrid mode, it indicates that the current container network cross-node communication may be implemented in tunnel mode or routing mode, and the communication module between nodes needs to be automatically detected for corresponding processing. The vector-cni of the non-EgressNode node will first obtain the Pod IP address information selected in the AppliedTo field of the configured Egress CRD resource, and filter the Pod IP on the non-node. At the same time, the Node information where the EgressIP is located is obtained to determine whether the EgressNode and the current node are in the same large second layer. If they are in the same large second layer, the policy routing of the export custom resource is fed back to the source address. If they are not in the same large second layer, the export custom resource calls the tunnel to transmit the reply information to the source address.

[0122] Embodiment 5

[0123] Figure 5 Schematic diagram of the structure of a real source address communication device provided according to Embodiment 5 of the present invention. Figure 5 As shown, the device includes: a request acquisition module 51, an object generation module 52 and a request processing module 53.

[0124] The request acquisition module 51 is used to acquire the internal application access request based on the communication service of the load balancer.

[0125] The object generation module 52 is used to create a virtual address object according to an internal application access request.

[0126] The request processing module 53 is used to directly forward the internal application access request to the internal application without performing address translation when there is a custom rule matching the virtual address object in the preset routing table.

[0127] In an embodiment of the present invention, a request acquisition module acquires an internal application access request through a communication service based on a load balancer, an object generation module creates a virtual address object according to the internal application access request, and a request processing module directly forwards the internal application access request address to the internal application without converting the internal application access request address when a custom rule matching the virtual address object exists in a preset routing table, thereby achieving an access method of the client without changing the access method of the client. The internal application access request address can be directly forwarded to the internal application of the internal application cluster, thereby enabling the cluster to directly obtain the client's real source IP address.

[0128] In one embodiment, a real source address communication device further includes:

[0129] The information exposure module is used to provide business access information of internal applications based on the internal business information exposure service.

[0130] The object creation module is used to create a virtual address object according to the business access information.

[0131] The rule creation module is used to create custom rules for virtual address objects in the preset routing table.

[0132] In one embodiment, the rule creation module includes:

[0133] The first rule creation unit is used to create a first custom rule in a preset routing table according to the virtual address proxy, wherein the first custom rule includes service access information for disabling source address translation.

[0134] A custom chain creation unit is used to create a first custom chain with the highest priority based on the network address translation table of the virtual address agent in the preset routing table, wherein the rule content of the first custom chain includes not performing source address translation when the target business access information matches the business access information of the first custom rule.

[0135] In one embodiment, the request processing module 53 includes:

[0136] The field extraction unit is used to extract the real source address function switch field of the virtual address object.

[0137] The first information processing unit is used to clear the service access information of the first custom rule in the preset routing table if the real source address function switch field is false.

[0138] The second information processing unit extracts the service access information of the virtual address object as the service access information of the first custom rule in the preset routing table if the real source address function switch field is true.

[0139] The request transmission unit is used to transmit the internal application access request to the internal application based on the container network interface when the business access information of the first custom rule matches the target business access information of the first custom chain.

[0140] In one embodiment, a real source address communication device further includes:

[0141] The information acquisition module is used to obtain the reply information of the internal application and feed the reply information back to the source address accessed by the internal application.

[0142] In one embodiment, the information acquisition module includes:

[0143] The source address extraction unit is used to extract the source address of the internal application access corresponding to the reply information.

[0144] The information transmission unit is used to transmit the reply information to the source address according to the egress custom resource when the egress address of the internal application matches the source address.

[0145] In one embodiment, the information transmission unit transmits the reply information to the source address according to the egress custom resource, including at least one of the following:

[0146] In the non-encapsulation mode, the reply information is marked so that the reply information is fed back to the source address according to the policy routing of the egress custom resource;

[0147] In encapsulation mode, the reply information is transmitted to the source address through the tunnel according to the egress custom resource call;

[0148] In hybrid mode, if the source address is in the same large layer 2, the policy routing of the egress custom resource is used to feed back to the source address. If the source address is not in the same large layer 2, the egress custom resource is used to call the tunnel to transmit the reply information to the source address.

[0149] A real source address communication device provided in an embodiment of the present invention can execute a real source address communication method provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0150] Embodiment 6

[0151] Figure 61 is a schematic diagram of the structure of an electronic device 10 that implements a real source address communication method of an embodiment of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0152] like Figure 6 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0153] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0154] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a real source address communication method.

[0155] In some embodiments, a real source address communication method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of a real source address communication method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform a real source address communication method in any other appropriate manner (e.g., by means of firmware).

[0156] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0157] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0158] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0159] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0160] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0161] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0162] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0163] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A real source address communication method, characterized in that: include: The communication service based on the load balancer obtains the internal application access request; Creating a virtual address object according to the internal application access request; In the case where a custom rule matching the virtual address object exists in the preset routing table, the access request address of the internal application is not translated and directly forwarded to the internal application; wherein the custom rule includes a first custom rule and a first custom chain; Wherein, when there is a custom rule matching the virtual address object in the preset routing table, directly forwarding the internal application access request to the internal application without performing address translation, includes: Extracting the real source address function switch field of the virtual address object; If the real source address function switch field is false, clearing the service access information of the first custom rule in the preset routing table; wherein the first custom rule includes service access information for disabling source address translation; If the real source address function switch field is true, extracting the service access information of the virtual address object as the service access information of the first custom rule in the preset routing table; When the business access information of the first custom rule matches the target business access information of the first custom chain, transmitting the internal application access request to the internal application based on the container network interface; Among them, the first custom chain is a custom chain with the highest priority created based on the network address translation table of the virtual address agent in the preset routing table, and the rule content of the first custom chain includes not performing source address conversion when the target business access information matches the business access information of the first custom rule.

2. The method according to claim 1, characterized in that: Before the load balancer-based communication service obtains the internal application access request, the method further includes: Providing business access information of the internal application based on the internal business information exposure service; Creating a virtual address object according to the service access information; The custom rule for creating the virtual address object in the preset routing table.

3. The method according to claim 2, characterized in that: The custom rule for creating the virtual address object in the preset routing table includes: Creating a first custom rule in the preset routing table according to the virtual address proxy; The virtual address agent creates a first custom chain with the highest priority based on the network address translation table in the preset routing table.

4. The method according to claim 1, characterized in that: Also includes: Acquire reply information of the internal application, and feed the reply information back to the source address accessed by the internal application.

5. The method according to claim 4, characterized in that: Feeding back the reply information to the source address accessed by the internal application includes: Extracting the source address accessed by the internal application corresponding to the reply information; When the egress address of the egress user-defined resource of the internal application matches the source address, the reply information is transmitted to the source address according to the egress user-defined resource.

6. The method according to claim 5, characterized in that: The transmitting of the reply information to the source address according to the export custom resource comprises at least one of the following: In the non-encapsulation mode, marking the reply information so that the reply information is fed back to the source address according to the policy routing of the egress custom resource; In encapsulation mode, the reply information is transmitted to the source address according to the egress custom resource calling tunnel; In hybrid mode, when the source address is in the same large layer 2, the policy routing of the export custom resource is used to feed back to the source address; when the source address is not in the same large layer 2, the reply information is transmitted to the source address through a tunnel called by the export custom resource.

7. A real source address communication device, characterized in that: The device comprises: A request acquisition module, used to acquire internal application access requests based on the communication service of the load balancer; An object generation module, used for creating a virtual address object according to the internal application access request; A request processing module, configured to directly forward the access request address of the internal application to the internal application without translating the access request address of the internal application when a custom rule matching the virtual address object exists in a preset routing table; wherein the custom rule includes a first custom rule and a first custom chain; Wherein, the request processing module includes: A field extraction unit, used for extracting a real source address function switch field of the virtual address object; A first information processing unit, configured to clear the service access information of the first custom rule in the preset routing table if the real source address function switch field is false; wherein the first custom rule includes service access information for disabling source address translation; A second information processing unit, configured to extract the service access information of the virtual address object as the service access information of the first custom rule in the preset routing table if the real source address function switch field is true; a request transmission unit, configured to transmit the internal application access request to the internal application based on a container network interface when the business access information of the first custom rule matches the target business access information of the first custom chain; Among them, the first custom chain is a custom chain with the highest priority created based on the network address translation table of the virtual address agent in the preset routing table, and the rule content of the first custom chain includes not performing source address conversion when the target business access information matches the business access information of the first custom rule.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method according to any one of claims 1 to 6 when executed.

Images