Method, device, equipment and medium for virtual machine to access cloud platform management network

Abstract

The application discloses a method, device and equipment for a virtual machine to access a cloud platform management network and a medium, the method comprising: creating a first virtual bridge interworking with a business network on a physical node of a cloud platform; creating a virtual management network interworking with a management network on the physical node based on the first virtual bridge; connecting a virtual machine on the physical node with the virtual management network and configuring a default route when the virtual machine accesses the management network, so that the virtual machine can access the management network based on the virtual management network. The method provided by the application enables the virtual machine to access the cloud platform management network without changing the physical isolation of the cloud platform management network and the business network.

Description

Technical Field

[0001] This invention relates to the field of cloud computing technology, and in particular to a method, apparatus, device, and medium for virtual machines to access a cloud platform management network. Background Technology

[0002] A cloud computing platform, also known as a cloud service, refers to a service that provides computing, networking, and storage capabilities based on hardware and software resources. With the development of cloud computing, various PaaS (Platform as a Service) services, such as container platforms and databases, have been deployed on cloud platforms. PaaS services have gradually become the main components of cloud platforms, and even many cloud platform control services are deployed as PaaS services. Typically, container platforms, databases, and other PaaS services are deployed on cloud platforms as virtual machines, communicating with the outside world through the business network bound to the virtual machines.

[0003] Due to cloud platform network security requirements, the business network bound to virtual machines (VMs) on a cloud platform is typically physically isolated from the cloud platform's management network. VMs cannot connect to or access the cloud platform, thus preventing them from directly operating it. Current methods to allow VMs to access the cloud platform connect the management network and the business network via physical switches or routers. However, this approach compromises the physical isolation between the cloud platform's business and management networks. Without IP-level restrictions, VMs and physical machines can communicate with each other, resulting in low security. Furthermore, the management and business networks share the same link and bandwidth, leading to mutual interference during operation and management.

[0004] Therefore, in order to address the above-mentioned technical problems, it is necessary to provide a new method, apparatus, device, and medium for virtual machines to access the cloud platform management network. Summary of the Invention

[0005] The purpose of this invention is to provide a method, apparatus, device, and medium for virtual machines to access the cloud platform management network, which enables virtual machines to access the cloud platform management network without changing the physical isolation between the cloud platform management network and the service network.

[0006] To achieve the above objectives, the technical solution provided by the present invention is as follows:

[0007] In a first aspect, the present invention provides a method for a virtual machine to access a cloud platform management network, comprising:

[0008] Create the first virtual bridge on the physical node of the cloud platform that communicates with the business network;

[0009] Based on the first virtual bridge, a virtual management network that communicates with the management network is created on the physical node;

[0010] Connect the virtual machine on the physical node to the virtual management network, and configure the default route when the virtual machine accesses the management network, so that the virtual machine can access the management network based on the virtual management network.

[0011] In one or more implementations, creating a first virtual bridge interconnected with the service network on a physical node of the cloud platform includes:

[0012] Create a first virtual bridge on the physical node of the cloud platform, and bind the physical network card of the physical node to the first virtual bridge.

[0013] In one or more embodiments, based on the first virtual bridge, a virtual management network interconnected with the management network is created on the physical node, including:

[0014] Based on the first virtual bridge, a virtual management network interface card with a preset VLAN ID is created on the physical node, enabling the virtual management network interface card to communicate with the physical management network physical interface card of the physical node.

[0015] In one or more embodiments, connecting the virtual machine on the physical node to the virtual management network includes:

[0016] Create a second virtual bridge on the physical node that is bridged to the first virtual bridge;

[0017] Bridge the virtual network interface card of the virtual machine on the physical node to the second virtual bridge;

[0018] Configure flow table rules on the first virtual bridge and the second virtual bridge to enable communication between the virtual management network interface card and the virtual network interface card of the virtual machine.

[0019] In one or more embodiments, the method further includes:

[0020] When the physical node has multiple virtual machines on different networks, different local VLAN tags are configured for the virtual network cards of each virtual machine on the second virtual bridge.

[0021] In one or more implementations, configuring a default route for the virtual machine to access the management network includes:

[0022] Configure IP addresses for the virtual network interface card (NIC) and the virtual management network interface card (NIC) of the virtual machine, and configure the default route for the virtual machine to access the management network to forward through the NIC.

[0023] In one or more embodiments, the method further includes:

[0024] Configure iptables filter rules for the physical node.

[0025] Secondly, the present invention provides an apparatus for a virtual machine to access a cloud platform management network, comprising:

[0026] The first creation module is used to create the first virtual bridge on the physical node that communicates with the service network;

[0027] The second creation module is used to create a virtual management network that communicates with the management network on the physical node based on the first virtual bridge;

[0028] The configuration module is used to connect the virtual machine on the physical node to the virtual management network and configure the default route when the virtual machine accesses the management network, so that the virtual machine can access the management network based on the virtual management network.

[0029] Thirdly, the present invention provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method for virtual machine access to cloud platform management network as described above.

[0030] Fourthly, the present invention provides a computer-readable medium carrying computer-executable instructions, which, when executed by a processor, are used to implement the method for virtual machine accessing cloud platform management network as described above.

[0031] Compared with existing technologies, the method for virtual machines to access the cloud platform management network provided by this invention can select a virtual local area network (VLAN) on the business network as a virtual management network without changing the physical isolation between the cloud platform management network and the business network. A network is then created based on the virtual management network, and an IP network segment is selected on the virtual management network as the network segment of the virtual management network. Flow table rules are configured on the virtual bridge on the cloud platform physical node, enabling virtual machines bound to the virtual management network and the cloud platform physical node to communicate through the Layer 2 of the virtual management network. Virtual machines bound to the virtual management network can then access the management network of the cloud platform physical node through the virtual management network. Simultaneously, iptables filter rules are configured on the cloud platform physical node to add security restrictions to the virtual machines in the virtual management network, thereby ensuring the network security of the cloud platform physical node. Attached Figure Description

[0032] Figure 1 This is a schematic diagram illustrating an implementation scenario of a method for a virtual machine to access a cloud platform management network according to an embodiment of the present invention.

[0033] Figure 2 This is a flowchart of a method for a virtual machine to access the cloud platform management network according to an embodiment of the present invention;

[0034] Figure 3 This is a cloud platform architecture diagram of a method for implementing virtual machine access to the cloud platform management network according to one embodiment of the present invention;

[0035] Figure 4 This is a structural block diagram of a device for virtual machines to access the cloud platform management network according to an embodiment of the present invention;

[0036] Figure 5 This is a structural block diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0037] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings, but it should be understood that the scope of protection of the present invention is not limited to the specific embodiments.

[0038] Unless otherwise expressly stated, throughout the specification and claims, the term "comprising" or its variations such as "including" or "comprises" shall be understood to include the stated elements or components without excluding other elements or other components.

[0039] To facilitate understanding of the technical solutions of this application, the technical terms that may appear in this invention will be explained in detail below.

[0040] Management network: This is the network used by the cloud platform to manage and monitor cloud resources. It is typically a dedicated, isolated network used to connect the cloud platform's management nodes, virtualized hosts, storage devices, network devices, and other management resources. The role of the management network is to provide a secure and reliable management channel for the cloud platform, ensuring that cloud platform administrators can manage and monitor cloud resources at any time.

[0041] Business network: This is the network used by the cloud platform to support customer services. It is typically a public network used to connect virtual machines, storage devices, network devices, and other business resources of the cloud platform for customer use. The purpose of the business network is to provide customers with a reliable network environment where they can run their applications and services. The business network can be used for communication between virtual machines and between virtual machines and computers outside the platform. Its physical structure consists of the business network interface cards (NICs) of each node and their connected Layer 2 physical links.

[0042] A virtual bridge is a network device used in virtual networks. It connects virtualized network devices such as virtual machines and containers to form a virtual local area network (LAN). Implemented as software within the operating system, a virtual bridge can simulate the function of a physical switch. A virtual bridge can act as a hub or switch in the physical network, forwarding data packets connected to different virtual network ports. Virtualized network devices such as virtual machines and containers can connect to the virtual ports of the virtual bridge and communicate with other virtualized network devices through it. Virtual bridges can also implement advanced network functions such as VLAN segmentation, traffic control, and security policies. A virtual bridge provides a secure and reliable network infrastructure for virtualized environments, allowing virtual machines and containers to communicate within an isolated virtual network environment while also communicating with external networks through the physical network. Common virtual bridges include `bridge` and `Open vSwitch` in the Linux kernel.

[0043] VLAN ID (Virtual Local Area Network Identifier): A VLAN is a numerical identifier used to identify a VLAN, typically represented by a 12-bit binary number or a 3-4 digit decimal number. A VLAN is a virtual local area network technology that divides a physical network into multiple logically independent virtual networks. Each virtual network is isolated from and does not interfere with others, thereby improving network security and manageability. The VLAN ID is the unique identifier used to identify different VLANs. Within a VLAN, each network device's port is configured to belong to a specific VLAN and assigned a corresponding VLAN ID. When a data packet arrives at the switch, the switch forwards it to the appropriate VLAN based on the packet's VLAN ID, thus achieving data isolation and management between VLANs. Devices in different VLANs can communicate through the switch's routing function or interconnect through VLAN trunk connections.

[0044] A VLAN tag is a marker used to identify the VLAN to which data belongs when transmitting data over a network. A VLAN tag is typically a four-byte marker containing the VLAN ID and other control information, such as priority. The VLAN tag is added to the header of the Ethernet frame; this frame with the VLAN tag is called a "tagged frame."

[0045] PVID (Port-based VLAN ID): This is a VLAN configuration method that assigns a different VLAN ID to each network port (i.e., switch port). With this configuration, the switch assigns ports to different VLANs based on the type of device connected or network requirements, thus achieving isolation and management of different devices or networks. Each port can only belong to one VLAN, meaning that if you need a port to connect to different VLANs simultaneously, you need to use multiple ports or other technologies (such as 802.1Q) for configuration.

[0046] Please refer to Figure 1 The diagram shown illustrates an exemplary implementation scenario of a method for a virtual machine to access a cloud platform management network according to an embodiment of the present invention. Figure 1 In the implementation scenario shown, a cloud platform 100 is deployed on the OpenStack cloud computing management platform, comprising a control node 101, a network node 102, a compute node 103, a compute node 104, a management network switch 105, and a service network switch 106. The control node 101, network node 103, compute node 103, and compute node 104 are connected to the management network switch 105 and the service network switch 106.

[0047] Specifically, the management network physical network cards of control node 101, network node 102, computing node 103 and computing node 104 are connected to management network switch 105, and the service network physical network cards of control node 101, network node 102, computing node 103 and computing node 104 are connected to service network switch 106 to build a cloud platform.

[0048] The method for virtual machines to access the cloud platform management network provided by this invention will be further explained below with reference to specific scenarios.

[0049] First, a first virtual bridge interconnecting with the service network switch 106 is created on control node 101, network node 102, compute node 103, and compute node 104. Second, based on this first virtual bridge, a virtual management network interconnecting with the management network switch 105 is created on control node 101, network node 102, compute node 103, and compute node 104. Finally, the virtual machines on compute nodes 103 and 104 are connected to the virtual management network, and a default route is configured for the virtual machines to access the management network, enabling the virtual machines to access the management network switch 105 via the virtual management network.

[0050] Please refer to Figure 2 The diagram shown is a flowchart of a method for a virtual machine to access a cloud platform management network according to an embodiment of the present invention. The method specifically includes the following steps:

[0051] S201: Create the first virtual bridge on the physical node of the cloud platform that communicates with the business network.

[0052] In one exemplary embodiment, creating a first virtual bridge that communicates with the service network on a physical node of the cloud platform specifically includes: creating a first virtual bridge on a physical node of the cloud platform and binding the physical network interface card of the service network of the physical node to the first virtual bridge.

[0053] It's important to note that a virtual bridge requires a unique name and the configuration of certain parameters, such as VLAN ID, MAC address, and IP address. These parameters must be determined before creating a virtual bridge. Virtual bridges are typically implemented as software within the operating system. Before creating a virtual bridge, you must first install the virtual bridge software. After installation, you can use the virtual bridge software to create a virtual bridge, specifying the name and parameters. This can be done using command-line tools or a graphical interface. After creating the virtual bridge, you can use the virtual bridge software to connect the physical network interface card (NIC) to the virtual bridge, enabling packet forwarding between the NIC and the virtual bridge.

[0054] The specific steps and commands for creating a virtual bridge may vary depending on the virtual bridge software. You can usually refer to the relevant user manual for guidance. Common virtual bridge software includes Bridge and Open vSwitch in the Linux kernel.

[0055] S202: Based on the first virtual bridge, create a virtual management network on the physical node that communicates with the management network.

[0056] In one exemplary embodiment, based on the first virtual bridge, a virtual management network that communicates with the management network is created on the physical node. Specifically, this includes: based on the first virtual bridge, creating a virtual management network interface card with a preset VLAN ID on the physical node, so that the virtual management network interface card communicates with the physical network interface card of the management network of the physical node.

[0057] It should be noted that when creating virtual management network interface cards (NICs) on each physical node of the cloud platform, the VLAN IDs of the NICs on each physical node must be consistent so that the NICs on each physical node can be in the same virtual local area network (VLAN).

[0058] S203: Connect the virtual machine on the physical node to the virtual management network, and configure the default route when the virtual machine accesses the management network, so that the virtual machine can access the management network based on the virtual management network.

[0059] In one exemplary embodiment, connecting the virtual machine on the physical node to the virtual management network specifically includes: creating a second virtual bridge on the physical node that is bridged to the first virtual bridge; bridging the virtual network interface card (NIC) of the virtual machine on the physical node to the second virtual bridge; and configuring flow table rules on the first virtual bridge and the second virtual bridge to enable the virtual management network NIC and the virtual NIC of the virtual machine to communicate with each other.

[0060] Specifically, when there are multiple virtual machines on different networks on the physical node, in order to achieve physical isolation of the virtual network cards of virtual machines on different networks, different local VLAN tags are configured for the virtual network cards of each virtual machine on the second virtual bridge.

[0061] In one exemplary embodiment, configuring the default route when the virtual machine accesses the management network specifically includes: configuring IP addresses for the virtual network interface card (NIC) of the virtual machine and the virtual management network interface card (NIC), and configuring the default route when the virtual machine accesses the management network to forward through the NIC.

[0062] In one exemplary embodiment, to enhance network security, iptablesfilter rules are configured for the physical node to only open ports permitted by the cloud platform to virtual machines bound to the virtual management network.

[0063] It's important to note that iptables is a firewall tool for Linux systems that filters and processes network traffic based on filtering rules. The `filter` table is the default table in iptables and is primarily used for filtering network traffic. An iptables filter rule is a set of rules defined in the `filter` table to filter and control the transmission of network traffic. Each rule includes a set of matching conditions and an action. If a data packet matches all the conditions in the rule, it will be processed according to the specified action. Common actions include accept, reject, drop, and redirect.

[0064] The method for virtual machines to access the cloud platform management network provided by the present invention will be further described below with reference to specific embodiments.

[0065] Please refer to Figure 3 The diagram shown illustrates a cloud platform architecture for a method of enabling virtual machines to access the cloud platform management network according to an embodiment of the present invention. The cloud platform includes a control node 310, a network node 320, a computing node 330, a computing node 340, a management network switch 350, and a service network switch 360.

[0066] Specifically, the management network physical interface card (NIC) eth311 of control node 310 is connected to management network switch 350, and its IP address is 10.21.1.41. The service network physical interface card eth312 is connected to service network switch 360. The management network physical interface card eth321 of network node 320 is connected to management network switch 350, and its IP address is 10.21.1.42. The service network physical interface card eth322 is connected to service network switch 360. The management network physical interface card eth331 of compute node 330 is connected to management network switch 350, and its IP address is 10.21.1.43. The service network physical interface card eth332 is connected to service network switch 360. The management network physical interface card eth341 of compute node 340 is connected to the management network switch 350. The IP address of the management network physical interface card eth341 is 10.21.1.43. The service network physical interface card eth342 is connected to the service network switch 360.

[0067] based on Figure 3 The specific steps for implementing the method for virtual machines to access the cloud platform management network provided by this invention on the cloud platform are as follows:

[0068] Step 1: Connect the management network physical NICs of all physical nodes of the cloud platform together through the management network switch and enable Layer 2 connectivity.

[0069] Specifically, the management network physical interface card (NIC) eth311 of control node 310, the management network physical interface card eth321 of network node 320, the management network physical interface card eth331 of compute node 330, and the management network physical interface card eth441 of compute node 340 are connected to the management network switch 350 via network cables. Simultaneously, the ports on the management network switch 350 connected to the management network physical NICs eth311, eth321, eth331, and eth341 are configured with the same PVID.

[0070] Step 2: Connect all physical network cards of the service network of the cloud platform through the service network switch, and configure the port of the service network switch connected to the physical network cards of the service network as a trunk port.

[0071] Specifically, the physical network interface card (NIC) eth312 of the control node 310, the physical network interface card eth322 of the network node 320, the physical network interface card eth332 of the computing node 330, and the physical network interface card eth342 of the computing node 40 are connected to the service network switch 360 via network cables. The ports of the service network switch 369 that connect to the physical network interface cards of each node are configured as trunk ports.

[0072] Step 3: Create the first virtual bridge on all physical nodes of the cloud platform, and bind the physical network interface card of each physical node to the corresponding first virtual bridge.

[0073] Specifically, a first virtual bridge brVlan313 is created on control node 310, and the physical network interface card eth311 of the service network is bound to brVlan313; a first virtual bridge brVlan323 is created on network node 320, and the physical network interface card eth322 of the service network is bound to brVlan323; a first virtual bridge brVlan333 is created on compute node 330, and the physical network interface card eth332 of the service network is bound to brVlan333; a first virtual bridge brVlan343 is created on compute node 340, and the physical network interface card eth342 of the service network is bound to brVlan343.

[0074] In this embodiment, the creation of the first virtual bridge and the binding of the service network physical network interface card to the first virtual bridge can be implemented through Open vSwitch. For example, the first virtual bridge can be created on Open vSwitch, and the service network physical network interface card can be bound to the first virtual bridge, specifically using the following commands:

[0075] oys-ysctl add-br brVlan

[0076] oys-ysctl add-port brVlan eth0

[0077] Step 4: Based on the first virtual bridge of each physical node, create a virtual management network card with a preset VLAN ID on the physical node.

[0078] Specifically, a virtual management network interface card (vlannet314) with VLAN ID 200 is created on the first virtual bridge brVlan313 of control node 310; a virtual management network interface card (vlannet324) with VLAN ID 200 is created on the first virtual bridge brVlan323 of network node 320; a virtual management network interface card (vlannet334) with VLAN ID 200 is created on the first virtual bridge brVlan333 of compute node 330; and a virtual management network interface card (vlannet344) with VLAN ID 200 is created on the first virtual bridge brVlan343 of compute node 340.

[0079] In this embodiment, creating a virtual management network interface card with VLAN ID 200 on the first virtual bridge of each node can be achieved using Open vSwitch. For example, creating an internal type virtual network interface card on the first virtual bridge of Open vSwitch and setting its VLAN ID to 200 can be done using the following command:

[0080] ovs-vsctl----may-exist add-port brVlan vlannet\

[0081] --set Interface vlannet type=internal\

[0082] --set Interface vlannet external-ids:iface-status=active\

[0083] --set Port vlannet tag=200

[0084] Step 5: Create a second virtual bridge on all computing nodes and establish a bridge with the first virtual bridge.

[0085] It should be noted that a second virtual bridge (bridge-integrate) is created on each compute node. The virtual network interface cards (NICs) of each compute node's virtual machines are bound to the corresponding second virtual bridge. Virtual NICs of virtual machines from different networks are isolated on the second virtual bridge using different local VLAN tags. To enable cross-node access for compute node virtual machines, a bridge needs to be established between the first virtual bridge and the first virtual bridge bound to the physical NIC of the service network.

[0086] Specifically, a second virtual bridge br-int335 is created on computing node 330 and bridged with the first virtual bridge brVlan333; a second virtual bridge br-int345 is created on computing node 340 and bridged with the first virtual bridge brVlan343.

[0087] In this embodiment, the operation of creating a second virtual bridge on the compute node and bridging it with the first virtual bridge can be implemented using Open vSwitch. For example, creating a second virtual bridge on Open vSwitch, and creating a patch-type virtual network interface on both the second and first virtual bridges, and designating each other as peers, can be achieved using the following commands:

[0088] ovs-vsctl----may-exist add-port brVlan patch-brVlan\

[0089] --set Interface patch-brVlan type=patch\

[0090] --set Interface patch-brVlan options:peer=patch-br-int

[0091] ovs-vsctl----may-exist add-port br-int patch-br-int\

[0092] --set Interface patch-br-int type=patch\

[0093] --set Interface patch-br-int options:peer=patch-brVlan

[0094] Step 6: Create a virtual machine on the compute node and bridge the virtual machine's virtual network card to the second virtual bridge.

[0095] It should be noted that the virtual network cards of the virtual machines on each compute node are all bridged to the second virtual bridge of the compute node. In order to achieve physical isolation between virtual network cards of virtual machines on different networks, virtual network cards of virtual machines on different networks are configured with different local VLAN tags on the second virtual bridge.

[0096] Specifically, a virtual machine VM336 is created on compute node 330, and the virtual network interface card (NIC) of VM336 is bridged to the second virtual bridge br-int335, with the local VLAN tag set to 1. Virtual machines VM346, 347, and 348 are created on compute node 340, and the virtual NICs of VM346 and VM347 are bridged to the second virtual bridge br-int345, with the local VLAN tag set to 1. The virtual NIC of VM348 is bridged to the second virtual bridge br-int345, with the local VLAN tag set to 2.

[0097] Step 7: Configure flow table rules on the first and second virtual bridges of the compute node to convert the local VLAN tag on the second virtual network card to the VLAN ID on the first virtual bridge.

[0098] Specifically, on the second virtual bridge br-int335 of computing node 330, VLAN 200 is configured to be converted to local VLAN tag 1, and the first virtual bridge brVlan333 is configured to be converted to local VLAN tag 1 to VLAN 200, so that the virtual network card with local VLAN tag 1 on the second virtual bridge br-int335 and the network card with VLAN ID 200 on the first virtual bridge brVlan333 can communicate with each other.

[0099] Configure the second virtual bridge br-int345 on compute node 340 to convert VLAN 200 to local VLAN tag 1 and VLAN 201 to local VLAN tag 2. Configure the first virtual bridge brVlan343 to convert local VLAN tag 1 to VLAN 200 and local VLAN tag 2 to VLAN 201. This will enable the virtual network interface card with local VLAN tag 1 on the second virtual bridge br-int345 to communicate with the network interface card with VLAN ID 200 on the first virtual bridge brVlan343, and the virtual network interface card with local VLAN tag 2 on the second virtual bridge br-int345 to communicate with the network interface card with VLAN ID 201 on the first virtual bridge brVlan343.

[0100] In the embodiment, the mutual conversion between the local VLAN tag on the second virtual network interface card on the computing node and the VLAN ID on the first virtual bridge can be achieved using Open vSwitch, specifically using the following command:

[0101] ovs-ofctl add-flow br-int"priority=3,in_port=2,dl_vlan=200

[0102] actions=mod_vlan_vid:1,NORMAL"

[0103] ovs-ofctl add-flow brVlan"priority=4,in_port=3,dl_vlan=1

[0104] actions=mod_vlan_vid:200,NORMAL"

[0105] Step 8: Configure IP addresses for the virtual management network interface card (VNIC) and virtual machine VNIC of each physical node, and configure the default route for virtual machines to access the management network to forward through the VNIC.

[0106] Specifically, the IP address of the virtual network interface card vlannet315 on the control node 310 is configured as 169.253.128.2; the IP address of the virtual network interface card vlannet324 on the network node 320 is configured as 169.253.128.3; the IP address of the virtual network interface card vlannet334 on the compute node 330 is configured as 169.253.128.4, and the IP address of the virtual network interface card of virtual machine VM336 is configured as 169.253.128.11; the IP address of the virtual network interface card vlannet344 on the compute node 340 is configured as 169.253.128.5, the IP address of the virtual network interface card of virtual machine VM346 is configured as 169.253.128.12, and the IP address of the virtual network interface card of virtual machine VM347 is configured as 169.253.128.13. Meanwhile, configure default routes on VM336, VM346, and VM347 to configure the default route for virtual machines to access the management network to be forwarded through the virtual management network interface card of the compute node.

[0107] It should be noted that since the local VLAN tag of virtual machine VM348 on the second virtual bridge br-int345 is 2, according to the aforementioned configured flow table rules, VM348 can only access the virtual LAN with VLAN ID 201, and cannot access the virtual management network with VLAN ID 200. That is, the local VLAN tag and flow table rules of the virtual machine on the second virtual bridge can be configured according to business needs to specify which virtual machines can access the virtual management network.

[0108] In this embodiment, the default route for a virtual machine bound to a virtual management network is configured as follows: When accessing the management network, the virtual machine is configured to use a default route forwarded through the virtual network interface card on the virtual management network. Taking a typical Linux virtual machine as an example, the following command is used to achieve this:

[0109] ip route add 169.253.128.0 / 24dev eth0

[0110] Step 9: Configure iptables filter rules for each physical node to only open ports allowed by the cloud platform to virtual machines bound to the virtual management network, thereby increasing network security.

[0111] Specifically, control node 310 is configured with iptables filter rules, allowing packets received on the vlannet314 interface to have a source IP address in the 169.253.128.0 / 24 network segment, a destination IP address of 10.21.1.41, a TCP protocol, and a destination port that is a port provided by the cloud platform (e.g., 35357, 8774, etc., the specific port varies depending on the cloud platform service). Network node 320 is configured with iptables filter rules, allowing packets received on the vlannet324 interface to have a source IP address in the 169.253.128.0 / 24 network segment, a destination IP address of 10.21.1.42, a TCP protocol, and a destination port that is a port provided by the cloud platform. Compute node 330 is configured with iptables filter rules so that packets received on the vlannet334 interface are only allowed to originate from the 169.253.128.0 / 24 network segment, have a destination IP of 10.21.1.43, use the TCP protocol, and have the destination port being the port provided by the cloud platform. Compute node 340 is configured with iptables filter rules so that packets received on the vlannet344 interface are only allowed to originate from the 169.253.128.0 / 24 network segment, have a destination IP of 10.21.1.44, use the TCP protocol, and have the destination port being the port provided by the cloud platform.

[0112] Taking control node 310 as an example, the specific command to enable the iptables filter on ports 35357 and 8774 is as follows:

[0113] iptables-A INPUT-s 169.253.128.0 / 18-d 10.21.1.41 / 32-i vlannet

[0114] -p tcp--dport 35357-j ACCEPT

[0115] iptables-A INPUT-s 169.253.128.0 / 18-d 10.21.1.41 / 32-i vlannet

[0116] -p tcp --dport 8774 -j ACCEPT

[0117] iptables-A INPUT-i vlannet-j DROP

[0118] After configuring the above iptables filte rules on control node 310, virtual machines bound to the virtual management network can only access the services of control node 310's management network TCP ports 35357 and 8774, ensuring network security.

[0119] After completing the aforementioned steps, the virtual machine bound to the virtual management network can access the various physical nodes of the cloud platform. The following explanation uses the virtual machine VM346 on compute node 340 accessing the management network (IP 10.21.1.41) of control node 310 as an example:

[0120] When virtual machine VM346 accesses the destination IP 10.21.1.41, it first sends an ARP broadcast message. This ARP broadcast message is set to local VLAN tag 1 on the second virtual bridge br-int345, and then forwarded to the first virtual bridge brVlan343. Because the first virtual bridge brVlan343 is configured with a flow table to translate local VLAN tag 1 to VLAN 200, the ARP broadcast message to the destination IP 10.21.1.41 will be broadcast in VLAN 200 format.

[0121] Both the virtual NIC vlannet344 and the physical NIC eth342 on compute node 340 will receive and forward the ARP broadcast packet with VLAN ID 200. Upon receiving the ARP broadcast packet with a destination IP of 10.21.1.41, the virtual management NIC vlannet344 on compute node 340 discards it after discovering it is not an IP address belonging to this node. The physical NIC eth342 on the service network, upon receiving the ARP broadcast packet with the destination IP of 10.21.1.41, forwards it to the service network switch 360. The ports on the service network switch 360 connecting to control node 310, network node 320, and compute node 330 are all trunk ports. Therefore, the physical NICs eth312 (service network) of control node 310, eth322 (service network) of network node 320, and eth332 (service network) of compute node 330 will all receive the ARP broadcast packet with VLAN ID 200.

[0122] Then, the packets are forwarded to the first virtual bridges brVlan313, brVlan323, and brVlan333 on each node. Since the VLAN IDs of the virtual management network interface cards vlannet314, vlannet324, and vlannet334 are all 200, they will all receive ARP broadcast packets with a destination IP of 10.21.1.41. This means that control node 310, network node 320, and compute node 330 will all receive ARP broadcast packets with a destination IP of 10.21.1.41. Only control node 310 discovers that its management network IP is 10.21.1.41, and therefore responds to virtual machine VM4346.

[0123] The source MAC address of the ARP reply packet is the MAC address of vlannet314. After virtual machine VM346 receives the ARP reply from IP 10.21.1.41, it records the MAC address of the destination IP 10.21.1.41 as the MAC address of vlannet314 in its ARP table. Subsequently, when virtual machine VM346 accesses the management IP 10.21.1.41, it directly sets the destination MAC address of the access packet to the MAC address of vlannet346. The control node 310 can then receive the access request from virtual machine VM346, thereby enabling the virtual machine to access the cloud platform management network.

[0124] In summary, the method for virtual machines to access the cloud platform management network provided by this invention can select a virtual local area network (VLAN) on the business network as the virtual management network without changing the physical isolation between the cloud platform management network and the business network. A network is then created based on the virtual management network, and an IP segment is selected on the virtual management network as the network segment of the virtual management network. Flow table rules are configured on the virtual bridge on the cloud platform physical node, enabling virtual machines bound to the virtual management network and the cloud platform physical node to communicate through the Layer 2 of the virtual management network. Virtual machines bound to the virtual management network can then access the management network of the cloud platform physical node through the virtual management network. Simultaneously, iptables filter rules are configured on the cloud platform physical node to add security restrictions to the virtual machines in the virtual management network, thereby ensuring the network security of the cloud platform physical node.

[0125] Please refer to Figure 4 As shown, based on the same inventive concept as the aforementioned method for virtual machines to access the cloud platform management network, the present invention provides a device 400 for virtual machines to access the cloud platform management network, which includes a first creation module 401, a second creation module 402 and a configuration module 403.

[0126] The first creation module 401 is used to create a first virtual bridge on the physical node that communicates with the service network. The second creation module 402 is used to create a virtual management network on the physical node that communicates with the management network, based on the first virtual bridge. The configuration module 403 is used to connect the virtual machine on the physical node to the virtual management network and configure the default route when the virtual machine accesses the management network, so that the virtual machine can access the management network based on the virtual management network.

[0127] Please refer to Figure 5 As shown, embodiments of the present invention also provide an electronic device 500, which includes at least one processor 501, a memory 502 (e.g., non-volatile memory), a main memory 503, and a communication interface 504, and the at least one processor 501, memory 502, main memory 503, and communication interface 504 are connected together via a bus 505. The at least one processor 501 is used to invoke at least one program instruction stored or encoded in the memory 502 to cause the at least one processor 501 to perform various operations and functions of the virtual machine access cloud platform management network method described in various embodiments of this specification.

[0128] In the embodiments of this specification, electronic device 500 may include, but is not limited to: personal computer, server computer, workstation, desktop computer, laptop computer, notebook computer, mobile electronic device, smartphone, tablet computer, cellular phone, personal digital assistant (PDA), handheld device, messaging device, wearable electronic device, consumer electronic device, etc.

[0129] This invention also provides a computer-readable medium carrying computer-executable instructions, which, when executed by a processor, can be used to implement various operations and functions of the virtual machine accessing the cloud platform management network described in the various embodiments of this specification.

[0130] The computer-readable medium in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0131] In this invention, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wireline, optical fiber, RF, etc., or any suitable combination thereof.

[0132] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0133] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus, systems, and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0134] The foregoing description of specific exemplary embodiments of the invention is for illustrative and explanatory purposes. These descriptions are not intended to limit the invention to the precise forms disclosed, and it will be apparent that many changes and variations can be made in accordance with the foregoing teachings. The exemplary embodiments were chosen and described in order to explain the specific principles of the invention and its practical application, thereby enabling those skilled in the art to implement and utilize various different exemplary embodiments of the invention, as well as various different choices and variations. The scope of the invention is intended to be defined by the claims and their equivalents.

Claims

1. A method for a virtual machine to access a cloud platform management network, characterized in that, The method comprises the following steps: creating a first virtual bridge interworking with a service network on a physical node of a cloud platform, and binding a service network physical network card of the physical node to the first virtual bridge; creating a virtual management network card of a preset VLAN ID on the physical node based on the first virtual bridge, and creating a virtual management network interworking with a management network on the physical node, so that the virtual management network cards on the physical nodes are in the same virtual local area network and interwork with management network physical network cards of the physical nodes; creating a second virtual bridge bridged with the first virtual bridge on the physical node, and bridging a virtual network card of a virtual machine on the physical node with the second virtual bridge; configuring a flow table rule on the first virtual bridge and the second virtual bridge, converting the preset VLAN ID and a local VLAN TAG assigned to the virtual machine, so that the virtual network card of the virtual machine bound with the local VLAN TAG and the virtual management network card are in layer 2 interworking, and different local VLAN TAGs are used to realize isolation of virtual machines of different networks; configuring the virtual network card of the virtual machine and the virtual management network card with an IP address located in the virtual management network segment, and configuring a default route of the virtual machine when accessing the management network as forwarding through the virtual management network card; configuring an iptables filter rule for the virtual management network card on the physical node, and only allowing a packet from the virtual management network segment, with a destination of a corresponding management network IP and a destination port of a cloud platform allowed port to pass through, so that the virtual machine can access the management network based on the virtual management network without changing the physical isolation of the management network and the service network.

2. An apparatus for a virtual machine to access a cloud platform management network, applied to the method for a virtual machine to access a cloud platform management network in claim 1, characterized in that, The method comprises the following steps: a first creating module configured to create a first virtual bridge interworking with a service network on a physical node; a second creating module configured to create a virtual management network interworking with a management network on the physical node based on the first virtual bridge; a configuration module configured to connect a virtual machine on the physical node with the virtual management network, and configure a default route of the virtual machine when accessing the management network, so that the virtual machine can access the management network based on the virtual management network.

3. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the program to realize the method for a virtual machine to access a management network of a cloud platform according to claim 1.

4. A computer readable medium characterized by The computer readable medium carries computer execution instructions, and the computer execution instructions are executed by the processor to realize the method for a virtual machine to access a management network of a cloud platform according to claim 1.

Images