A method, system and medium for cross-host container network communication configuration

Abstract

The application discloses a cross-host container network communication configuration method and system and a medium, and the method comprises the following steps: an automation program in each host respectively completes Macvlan network configuration of a container according to a given configuration file; the automation program in each host enters a network namespace corresponding to the container, and adds corresponding iptables rules according to the given configuration file to realize east-west isolation control of the container network under the same Macvlan network. The application solves the problem that the steps of creating and configuring the container network are complicated, greatly reduces the operation complexity, improves the efficiency, and further provides a network isolation measure, so that the container network can be isolated in the east-west direction, and the safety of the container network is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of container network, and in particular to a cross-host container network communication configuration method, system and medium. BACKGROUND

[0002] Containers are a sandbox technology, the main purpose of which is to run applications in it, isolated from the outside world, and to facilitate the transfer of this sandbox to other host machines. Essentially, a container is a special process. Through the namespace (Namespace), control groups (Control groups), and chroot technology, resources, files, devices, states, and configurations are divided into an independent space. Container technology, as a cornerstone of cloud-native development, has become a technology trend in the field of cloud computing, and the technology iterates and updates quickly and is widely used. With the increasing application of containers in the field of cloud computing, cross-host container network communication becomes increasingly important. Docker provides two cross-host network solutions, Overlay network and Macvlan network, each with its own advantages, but also has certain limitations. Network Overlay automatically allocates IP addresses when containers are started, but requires a distributed database (such as Consul, Etcd, etc.) to save network information; Macvlan network does not use a distributed database, but requires users to assign IP addresses to containers. At the same time, the creation and management of the two network solutions require manual configuration by the user, and the operation is very complex. In addition, the two cross-host network solutions do not provide east-west isolation of container networks, that is, containers in the same Overlay network or Macvlan network cannot communicate with each other. In today's increasingly serious cloud security issues, this poses a not inconsiderable security risk. SUMMARY

[0003] The technical problem to be solved by the present application: In view of the above problems of the prior art, the present application provides a cross-host container network communication configuration method, system and medium, which solves the problem of complicated steps of creating and configuring container networks, greatly reduces the complexity of operation, improves the efficiency, and also provides network isolation measures, which can perform east-west isolation of container networks, and improves the security of container networks.

[0004] To solve the above technical problems, the technical scheme adopted by the present application is:

[0005] A cross-host container network communication configuration method, comprising:

[0006] S101, the automation program in each host respectively completes the Macvlan network configuration of the container according to the given configuration file;

[0007] S102, the automation program in each host enters the network namespace corresponding to the container, and adds corresponding iptables rules according to the given configuration file to realize the east-west isolation control of the container network under the same Macvlan network.

[0008] Further, the configuration file given in step S101 includes the ID of the container and the network segment information.

[0009] Further, the Macvlan network configuration of the container completed in step S101 includes configuring the automatic allocation of IP addresses for the ID of the corresponding container according to the network segment information in the given configuration file.

[0010] Further, the Macvlan network configuration of the container completed in step S101 includes:

[0011] S201, it is judged whether the container has joined the Macvlan network, if the Macvlan network has joined the Macvlan network, error information is displayed, and the process is ended and exited; otherwise, step S202 is jumped to;

[0012] S202, it is judged whether the Macvlan network to which the container wants to join exists, if the Macvlan network to which the container wants to join does not exist, step S203 is jumped to; otherwise, step S204 is jumped to;

[0013] S203, a physical network card is selected and a virtual network port is created, and the created virtual network port is bound to the created virtual network port;

[0014] S204, the container is joined to the Macvlan network, and the automatic allocation of IP addresses for the ID of the corresponding container is configured according to the network segment information in the given configuration file.

[0015] Further, the configuration file given in step S102 includes the ID of the container, the IP address and the packet processing strategy.

[0016] Further, step S101 further includes mounting the shared folder on the NFS server for sharing network configuration information to each host, and after the Macvlan network configuration of the container is completed in step S101, the Macvlan network configuration information is written into the mounted shared folder.

[0017] Further, after the corresponding iptables rules are added in step S102, the iptables rules are written into the mounted shared folder.

[0018] Further, before the mounting of the shared folder on the NFS server for sharing the network configuration information to each host, the method further comprises selecting a host as the NFS server, creating a shared folder on the NFS server for sharing the network configuration information, and modifying the NFS configuration file of the NFS server to add all hosts to the shared list of the NFS server so that each host can mount the shared folder on the NFS server for sharing the network configuration information.

[0019] The application further provides a container network communication configuration system across hosts, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute any of the container network communication configuration methods across hosts.

[0020] The application further provides a computer readable storage medium, wherein a computer program is stored in the computer readable storage medium, and the computer program is used for programming or configuring the microprocessor to execute any of the container network communication configuration methods across hosts. BRIEF DESCRIPTION OF DRAWINGS

[0021] Figure 1 The flowchart of the embodiment of the application.

[0022] Figure 2 The flowchart of completing the Macvlan network configuration of the container in the embodiment of the application.

[0023] Figure 3 The Macvlan network topology graph of east-west isolation in the embodiment of the application. DETAILED DESCRIPTION

[0024] The embodiment provides a container network communication configuration method across hosts, which comprises three parts of NFS deployment and configuration, cross-host Macvlan network configuration and network isolation management and control configuration. The experimental environment is a plurality of physical hosts, the operating system is kylin server v10, and the Docker version is 18.09. As shown in the figure, the method comprises the following steps. Figure 1 As shown in the figure, the method comprises the following steps.

[0025] S100, NFS deployment and configuration: deploying an NFS server and configuring a shared folder, and mounting the shared folder on the NFS server for sharing network configuration information to each host;

[0026] S101, cross-host Macvlan network configuration: the automation program in each host respectively completes the Macvlan network configuration of the container according to the given configuration file, in the embodiment, the automation program uses an automation script, the automation script simplifies the operation of network configuration, and solves the problem of manual allocation of IP addresses required by Macvlan, and realizes the allocation and management of IP addresses in the cross-host network environment;

[0027] S102, network isolation control configuration: the automation program in each host enters the network namespace corresponding to the container, and adds the corresponding iptables rule according to the given configuration file to realize the east-west isolation control of the container network in the same Macvlan network, and improves the security of the container network.

[0028] In the above steps, the main purpose of the NFS deployment and configuration part is to deploy the NFS server and configure the NFS shared folder, and to mount on all hosts. The cross-host Macvlan network configuration part mainly uses an automation configuration script to complete the creation of the container Macvlan network and automatically allocate IP addresses for the container, greatly simplifying the operation of Macvlan creation and use. The network isolation configuration mainly realizes the east-west access control between the same Macvlan network through an automation script, and improves the security of the container network.

[0029] The step S100 of the embodiment specifically includes the following steps:

[0030] S1001) Select any one of the plurality of hosts as an NFS server, create a folder on the NFS server as a shared folder for sharing network configuration information, modify the NFS configuration file of the NFS server, and add all hosts to the shared list of the NFS server, so that each host can mount the shared folder of the NFS server for sharing network configuration information;

[0031] S1002) Mount the shared folder of the NFS server on all hosts to save network information and isolation information subsequently, and avoid cross-host IP address conflict and other problems.

[0032] The configuration file given in the step S101 of the embodiment includes the ID of the container and the network segment information, so the completion of the Macvlan network configuration of the container includes automatically allocating IP addresses for the ID of the corresponding container according to the network segment information in the given configuration file, and the step S101 specifically includes the following steps:

[0033] S1011) Fill in the configuration document, and the configuration document needs to fill in the ID of the container that wants to join the Macvlan, and the network segment of the Macvlan, one network segment corresponds to one Macvlan;

[0034] S1012) performing an automation script to complete the deployment and configuration of the cross-host container network, and the automation script completes the Macvlan network configuration of the container as shown in Figure 2 , including:

[0035] First, detect the shared folder mounted by the current host, and set it as the storage target for saving the network information file, and then perform the following steps:

[0036] S201, judge whether the container has joined the Macvlan network, if the Macvlan network has joined the Macvlan network, display error information, end and exit; otherwise, jump to step S202;

[0037] S202, judge whether the Macvlan network to be joined by the container already exists, if the Macvlan network to be joined by the container does not exist, jump to step S203; otherwise, jump to step S204;

[0038] S203, select a physical network card and create a virtual network port, bind the created virtual network port to the created virtual network port when creating the Macvlan network; specifically, automatically select a network card on the host that meets the condition of creating a Macvlan network, then judge whether a new virtual network interface needs to be created according to the content of the configuration file, if needed, automatically create, then create a Macvlan type network in Docker and bind it with the virtual network interface;

[0039] S204, join the container to the Macvlan network, and configure the automatic allocation of IP addresses for the corresponding container ID according to the network segment information in the given configuration file, when the container is removed from this Macvlan, the IP address of the container will also be recycled and added to the IP address pool.

[0040] After the above operations are completed, the automation script records the virtual network interface, Macvlan name and container IP address and other information as Macvlan network configuration information in the shared folder mounted by the corresponding host, and the network configuration file records the IP address corresponding to each container ID, when a container is added or deleted from the macvlan network, the network configuration file will be automatically updated, ensuring that the IP allocation for containers in a multi-host environment will not conflict, and the corresponding IP can be reused after the container is deleted, to ensure that the IP address allocation of the cross-host Macvlan network does not conflict.

[0041] The configuration file given in step S102 of the embodiment includes the ID, IP address and management and control rules of the container, such as packet processing strategy. Step S102 specifically includes the following steps:

[0042] S1021) Fill in the configuration document, and fill in the container ID that needs to be controlled and the IP address that needs to be controlled and the corresponding control rules in the configuration document;

[0043] S1022) Execute the automation script to complete the container network east-west isolation control. The specific operation of the script is as follows:

[0044] The automation script will enter the network namespace corresponding to the container, add the corresponding iptables rule according to the configuration file, and write the iptables rule into the shared folder mounted by the corresponding host after adding the corresponding iptables rule, thereby completing the network isolation of different containers in the unified Macvlan.

[0045] The embodiment also provides a container network communication configuration system across hosts, which comprises a microprocessor and a memory connected with each other, characterized in that the microprocessor is programmed or configured to execute the container network communication configuration method across hosts provided in the embodiment.

[0046] The embodiment also provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is used for programming or configuring the microprocessor to execute the container network communication configuration method across hosts provided in the embodiment.

[0047] The application of the embodiment will be described in detail below in combination with the Macvlan network shown in the accompanying drawings: Figure 3

[0048] Firstly, the NFS deployment and configuration are performed based on step S100, specifically, any one of the plurality of hosts is selected as an NFS server, a folder is created on the host for sharing network configuration information, and then the created folder is mounted to all the hosts.

[0049] Then, the Macvlan network configuration across hosts is performed based on step S101, which comprises:

[0050] 1. Copy the script file of the automation script to the host to be configured, the path is / usr / network_isolation. Edit the configuration file under the host path / usr / network_isolation / config, fill in the container ID and the corresponding network segment information of the Macvlan to be added according to the example, take the container d1 (ID is 4a54474b2804) in the Figure 3 as an example, d1 is to be added to the macvlan with the network segment 172.16.10.0 / 24, the following information needs to be added in the configuration file:

[0051] ​4a54474b2804 172.16.10.0 / 24

[0052] 2. Execute the script and wait for the script to automatically complete the creation of the network, the container joins the Macvlan network, the container IP address allocation, etc.

[0053] Through the above configuration, different network segment containers (such as d1 and d4) are not in the same Macvlan, and cannot communicate with each other. Containers in the same network segment (such as d1 and d3) are in the same Macvlan, and can communicate with each other by default. In order to make up for the disadvantage that the original Macvlan network has nothing to isolate, the security of the container network is improved. Finally, based on step S102, network isolation control configuration is performed, including:

[0054] 1. Edit the configuration file under the host path / usr / network_isolation / config, fill in the container ID, the container IP address that needs to be isolated, and the policy rule according to the example, that is, the three information, and execute the script. Figure 3 Take d1 (container ID 4a54474b2804) in the above example as an example. In order to isolate the container d1 from the container d3 in the same network segment, the following information needs to be added to the configuration file:

[0055] 4a54474b2804 172.16.10.11DROP

[0056] 2. Execute the script and wait for the script to automatically complete the network isolation configuration, which is controlled through the iptables of the container network namespace.

[0057] In summary, the present scheme is based on the container Macvlan network, and uses scripts to realize the automatic configuration of the container network. From the identification of the physical network card, the virtual network card interface (such as Figure 3The creation of a virtual interface of the network card ens36 to the container Macvlan network, and the like can be automatically completed. In this way, the complexity of the Macvlan creation and configuration process is greatly reduced. Meanwhile, after the container joins the created Macvlan network, the automatic script also joins the container to the corresponding Macvlan and automatically allocates an IP address according to the configuration file. When the container is removed from the Macvlan, the automatically allocated IP address is also recycled, realizing the automatic allocation and management of the Macvlan network IP address. For the container that has joined the Macvlan, in the corresponding network namespace, the container is controlled in network by using iptables. The disadvantage that the original Macvlan network has no east-west isolation is made up, and the network security of the container is improved. Finally, for the cross-host environment, the synchronization of the network configuration information, IP address management and network isolation policy between the cross-hosts is realized by using NFS (Network File System), realizing the cross-host container network communication and network isolation configuration.

[0058] Compared with the prior art, the present scheme has the following advantages:

[0059] 1. The creation and configuration of macvlan are performed by using an automatic script. A user only needs to fill in a configuration file and execute the script to complete a series of operations from the creation of a virtual network interface to the joining of a container to a macvlan network and the allocation of an IP address.

[0060] 2. The IP address is automatically allocated and managed. The original macvlan network mode of Docker needs to manually allocate an IP address, and with the increase of the number of containers, the management of the IP address also becomes more complex. The automatic script of the present scheme automatically allocates an IP address for a container when the container joins a macvlan network, and recycles the allocated IP address and joins the IP address pool when the container is deleted, realizing the automatic management of the IP address.

[0061] 3. The east-west isolation control of the container network is realized by using iptables. The original cross-host network of Docker has no isolation mechanism, which has not small security risks. The present scheme uses iptables to control the access of the container network in the network namespace of the container, realizing the east-west isolation of the container network.

[0062] 4. The information synchronization of the cross-host network is realized by using NFS. When the container communicates in the cross-host network, the network information of multiple hosts needs to be synchronized, such as the network segment, the subnet mask and the IP address. However, Docker does not provide a related mechanism. The present scheme uses NFS to synchronize the network information between multiple hosts, solving the information synchronization problem of the cross-host container network in creation and configuration.

[0063] Those skilled in the art will appreciate that embodiments of the application can be readily used as software, hardware, or a combination of software and hardware. In a software embodiment, the methods can be tangibly embodied in a machine-readable storage medium having stored thereon instructions that can be used to program a processing system to perform the methods. The term "processor" should be interpreted broadly to encompass a complete processing system, including a central processing unit, a microprocessor, a microcomputer, a minicomputer, a mainframe computer, a computer functionally configured to process instructions, and so on. The term "software" should be interpreted to Figure 1 one or more functions specified in a flow or multiple flows and / or blocks Figure 1 one or more functions specified in a flow or multiple flows and / or blocks Figure 1 one or more functions specified in a flow or multiple flows and / or blocks Figure 1 one or more functions specified in a flow or multiple flows and / or blocks Figure 1 one or more functions specified in a flow or multiple flows and / or blocks Figure 1 one or more functions specified in a flow or multiple flows and / or blocks

[0064] The above description is only preferred embodiments of the present application, the protection scope of the present application is not limited to the above-mentioned embodiments, any technical scheme falling within the idea of the present application shall be considered as falling within the protection scope of the present application. It should be noted that, for ordinary skilled in the art, some improvements and refinements without departing from the principles of the present application, these improvements and refinements shall be considered as falling within the protection scope of the present application.

Claims

1. A method for configuring cross-host container network communication, characterized in that, The method comprises the following steps: S100, selecting a host as an NFS server, creating a shared folder for sharing network configuration information on the NFS server, and modifying the NFS configuration file of the NFS server to add all hosts to the shared list of the NFS server so that each host can mount the shared folder for sharing network configuration information on the NFS server; S101, an automation program in each host respectively completes Macvlan network configuration of a container according to a given configuration file, specifically, automatically assigning an IP address to the ID of the corresponding container according to the network segment information in the given configuration file, and then writing the Macvlan network configuration information into the mounted shared folder, the network configuration file records the IP address corresponding to each container ID, and the network configuration file is automatically updated when a container is added or deleted from the Macvlan network, ensuring that the IP addresses allocated to the containers in the multi-host environment do not conflict, and the corresponding IP address can be reused after the container is deleted, specifically, when the container is removed from the Macvlan network, the IP address of the container is also recycled and added to the IP address pool to ensure that the IP address allocation of the cross-host Macvlan network does not conflict; S102, the automation program in each host enters the network namespace corresponding to the container, and adds the corresponding iptables rule according to the given configuration file to realize the east-west isolation control of the container network under the same Macvlan network. The configuration file given in step S101 includes the ID of the container and the network segment information.

2. The method of claim 1, wherein, The Macvlan network configuration of the container in step S101 includes:

3. The method of claim 1, wherein, S201, determining whether the container has joined the Macvlan network, if the Macvlan network has joined the Macvlan network, displaying error information and ending and exiting; otherwise, jumping to step S202; S202, determining whether the Macvlan network to which the container is to be joined already exists, if the Macvlan network to which the container is to be joined does not exist, jumping to step S203; otherwise, jumping to step S204; S203, selecting a physical network card and creating a virtual network port, binding the created virtual network port to the created virtual network port on the Macvlan network; S204, joining the container to the Macvlan network, and automatically assigning an IP address to the ID of the corresponding container according to the network segment information in the given configuration file. The configuration file given in step S102 includes the ID of the container, the IP address, and the packet processing strategy.

4. The method of claim 1, wherein, After adding the corresponding iptables rule in step S102, the iptables rule is also written into the mounted shared folder.

5. The method of claim 1, wherein, The microprocessor is programmed or configured to perform the cross-host container network communication configuration method of any one of claims 1-5.

6. A cross-host container network communication configuration system comprising a microprocessor and a memory connected to each other, characterized by, The computer program is used for programming or configuring the microprocessor to perform the cross-host container network communication configuration method of any one of claims 1-5.

7. A computer-readable storage medium having stored therein a computer program, characterized in that, ​

Images