An information processing method, apparatus, device, and storage medium

Abstract

The application discloses an information processing method, device and equipment and a storage medium. The electronic device comprises a container runtime interface, a first component, a first network model and a second network model. The first network model and the second network model cannot jointly act on the container runtime. The first interface corresponds to the first network model. The container runtime sends calling information to a first target network model. The calling information is used to call the first target network model. The first target network model is the first network model or the second network model. The first component intercepts the calling information and calls the first target network model based on the calling information. Network models that cannot jointly act can be fused.

Description

Technical Field

[0001] This application relates to the field of mobile communication technology, and to, but is not limited to, an information processing method, apparatus, device, and storage medium. Background Technology

[0002] There is a significant demand for containers in Network Functions Virtualization (NFV) and edge computing scenarios. Currently, container orchestration systems include the container orchestration engine Kubernetes, and container runtimes include the container engine Docker. Both Kubernetes and Docker have a large user base. Kubernetes uses the Container Network Interface (CNI) for its network model, while Docker uses the Container Network Model (CNM). However, CNI and CNM cannot work together, therefore, Kubernetes and Docker are incompatible. Summary of the Invention

[0003] This application provides an information processing method, apparatus, device, and storage medium that can integrate network models that cannot work together.

[0004] The technical solution of this application embodiment is implemented as follows:

[0005] This application provides an information processing method applied to an electronic device, the electronic device including: a Container Runtime Interface (CRI), a first component, a first network model, and a second network model; the first network model and the second network model cannot work together on the CRI; the method includes:

[0006] The CRI sends a call information to the first target network model, the call information being used to call the first target network model, the first target network model being either a first network model or a second network model;

[0007] The first component intercepts the call information and calls the first target network model based on the call information.

[0008] This application provides an information processing apparatus, which includes: a container runtime interface (CRI), a first component, a first network model, and a second network model; the first network model and the second network model cannot work together on the container engine.

[0009] The CRI is used to send invocation information to the target network model, the invocation information being used to invoke the target network model, the target network model being either the first network model or the second network model;

[0010] The first component is used to intercept the call information and call the first target network model based on the call information.

[0011] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the information processing method implemented by the above-described electronic device.

[0012] This application also provides a storage medium storing a computer program thereon, which, when executed by a processor, implements the information processing method implemented by the above-described electronic device.

[0013] The information processing method, apparatus, device, and storage medium provided in this application embodiment include an electronic device comprising: a CRI, a first component, a first network model, and a second network model; the first network model and the second network model cannot work together with the CRI; the CRI sends a call information to a first target network model, the call information being used to call the first target network model, the first target network model being either a first network model or a second network model; the first component intercepts the call information and calls the first target network model based on the call information; thereby, by having the first component simultaneously connect to the first network model and the second network model that cannot work together with the CRI, the first network model and the second network model become compatible, achieving the fusion of network models that cannot work together. Attached Figure Description

[0014] Figure 1 This is a schematic diagram of an optional structure of a wireless communication system provided in an embodiment of this application;

[0015] Figure 2 This is a schematic diagram of an optional structure of a wireless communication system provided in an embodiment of this application;

[0016] Figure 3A A schematic diagram of an optional structure of an electronic device provided in an embodiment of this application;

[0017] Figure 3B A schematic diagram of an optional structure of an electronic device provided in an embodiment of this application;

[0018] Figure 4 A schematic flowchart of an optional information processing method provided in an embodiment of this application;

[0019] Figure 5 A schematic diagram of an optional structure of an electronic device provided in an embodiment of this application;

[0020] Figure 6 This is a schematic diagram of the traffic transmission path provided in the embodiments of this application;

[0021] Figure 7A This is a schematic diagram illustrating the technical principle of Docker in bridge mode as provided in an embodiment of this application.

[0022] Figure 7B This is a schematic diagram illustrating the technical principle of Docker in host mode provided in an embodiment of this application;

[0023] Figure 8 A schematic diagram illustrating the technical principle of CNM provided in the embodiments of this application;

[0024] Figure 9 A schematic diagram illustrating the technical principle of CNI provided in the embodiments of this application;

[0025] Figure 10 A schematic diagram illustrating the access method of the CNI network plugin provided in this application embodiment;

[0026] Figure 11 This is a schematic diagram illustrating the technical principle of the information processing method provided in the embodiments of this application;

[0027] Figure 12 This is a schematic diagram of the traffic transmission path provided in the embodiments of this application;

[0028] Figure 13 This is a schematic diagram of the traffic transmission path provided in the embodiments of this application;

[0029] Figure 14 This is a schematic diagram of an optional structure of a communication device provided in an embodiment of this application. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the specific technical solutions of the application will be further described in detail below with reference to the accompanying drawings of the embodiments of this application. The following embodiments are used to illustrate this application, but are not intended to limit the scope of this application.

[0031] The embodiments of this application can provide information processing methods and devices, and storage media. In practical applications, the information processing method can be implemented in electronic devices, and the various functional entities in the electronic devices can be collaboratively implemented by the hardware resources of the electronic devices (such as terminal devices, servers), such as computing resources like processors, and communication resources (such as those used to support various communication methods such as optical cables and cellular networks).

[0032] Figure 1This is a schematic diagram illustrating an application scenario of an embodiment of this application. For example... Figure 1 As shown, the communication system 100 may include an electronic device 110 and a data network 120. The electronic device 110 and the data network 120 are capable of communicating.

[0033] like Figure 2 As shown, the electronic device 110 includes a virtual machine 201, and a container 202 can be set in the virtual machine 201. The container 202 can communicate with the data network 120 as an independent device across the electronic device 200.

[0034] To facilitate understanding of the technical solutions of the embodiments of this application, the technical solutions of this application are described in detail below through specific embodiments. The above-mentioned related technologies are optional solutions and can be arbitrarily combined with the technical solutions of the embodiments of this application, all of which fall within the protection scope of the embodiments of this application. The embodiments of this application include at least some of the following contents.

[0035] The information processing method provided in this application embodiment is applied to electronic devices, such as... Figure 3A As shown, the electronic device 300 includes: CRI301, a first component 302, a first network model 303, and a second network model 304; the first network model 303 and the second network model 304 cannot work together to function CRI301.

[0036] CRI301 is an abstract interface for container runtime operations, enabling interaction with the container runtime. Container orchestration engines like Kubernetes or Docker can use CRI to call different network plugins to achieve different network configurations.

[0037] The first component 302 can be understood as an isolation proxy component, which connects to CRI301 in the north and to the first network model 303 and the second network model 304 in the south, thus isolating the first network model 303 or the second network model 301 from CRI301.

[0038] The first and second network models are network models that cannot work together to affect CRI. The first and second network models can be either CNI or CNM, respectively. In one example, the first network model is CNI, and the second network model is CNM.

[0039] In this embodiment of the application, the first network model and the second network model can be either CNI or CNM, or other network models suitable for containers.

[0040] based on Figure 3A ,like Figure 3BAs shown, the first component 302 is provided with a first interface 3021 and a second interface 3022. The first interface 3021 corresponds to the first network model 303, and the second interface 3022 corresponds to the second network model 304. The first component 302 has the first interface 3021 and the second interface 3022 facing south. The first interface 3021 is used to connect to the first network model 303, and the second interface 3022 is used to connect to the second network model 304. This allows the first component to simultaneously connect to both the first network model 303 and the second network model 304, further enabling the first network model 303 and the second network model 304 to work together through the first component 302 to achieve CRI 301.

[0041] In practical applications, in addition to setting the first interface and the second interface, the first component can also set other interfaces to interface with other container-compatible network models besides the first network model and the second network model.

[0042] based on Figure 3A Or the system architecture shown in 3B, the information processing method provided in the embodiments of this application is as follows: Figure 4 As shown, it includes:

[0043] S401, The CRI sends a call message to the first target network model.

[0044] The invocation information is used to invoke the first target network model, which is either a first network model or a second network model.

[0045] When CRI invokes the first network model or the second network model, it attempts to send invocation information to the first network model or the second network model. Here, the purpose of CRI invoking the first network model or the second network model based on the invocation information may include at least one of the following: creating a container or deleting a container.

[0046] S402. The first component intercepts the call information and calls the first target network model based on the call information.

[0047] When CRI sends call information to the first target container model, the first component intercepts the call information sent by CRI and calls the first target network model based on the intercepted call information. Specifically, the first component can send the call information to the first target network model.

[0048] In this embodiment, after intercepting the call information sent by CRI, the first component parses the call information to determine whether the first target network model called by the call information is the first network model or the second network model. Taking CNI as the first network model and CNM as the second network model as an example, the first component identifies whether the intercepted call information calls CNI or CNM, and calls the determined network model based on the call information. For example, call information calling CNI will have a Kubernetes field identifier, while call information calling CNM will not have a Kubernetes field identifier. Therefore, the first component identifies whether the call information is used to call CNI or CNM by identifying whether the call information is used to call CNI or CNM. If the intercepted call information is used to call CNI, the first component can call CNI based on the intercepted call information; if the intercepted call information is used to call CNM, the first component can call CNM based on the intercepted call information. In this embodiment, the method by which the first component identifies the first target network model called by the call information is not limited.

[0049] In practical applications, in addition to calling the first target network model based on the calling information, the first component can also call another network model other than the first target network model in the first network model and the second network model.

[0050] The information processing method provided in this application can be applied to the following scenarios:

[0051] CRI interfaces with the first component, which in turn interfaces with CNI and CNM. The first component acts as a proxy for the CNI-CRI interface and also as a proxy for the CNM-CRI interface, transmitting information between CRI and CNI / CNM. This enables CRI to communicate with both CNI and CNM simultaneously, achieving compatibility between CNI and CNM. Consequently, CRI is compatible with the connection methods of both the Kubernetes and Docker communities.

[0052] In this embodiment, the electronic device includes: a Container Runtime Interface (CRI), a first component, a first network model, and a second network model. The first network model and the second network model cannot work together with the CRI. The first component has a first interface and a second interface, the first interface corresponding to the first network model and the second interface corresponding to the second network model. The CRI sends a call message to a first target network model, the call message being used to call the first target network model, which is either the first network model or the second network model. The first component intercepts the call message and calls the first target network model based on the call message. Thus, the first component transmits information between the CRI and the first or second network model, enabling the CRI to simultaneously transmit information with both the first and second network models.

[0053] In this embodiment, the first component can simultaneously interface with the first network model and the second network model, which cannot function simultaneously, without modifying the southbound interface of the CRI that interfaces with the first network model or the second network model, nor the northbound interface of the first network model or the northbound interface of the second network model. Thus, without modifying the CRI, the first network model, or the second network model, the CRI achieves compatibility with the first network model and the second network model.

[0054] In some embodiments, the information processing method provided in this application further includes the following steps:

[0055] When the CRI receives a container creation request, it creates a target container and configures the container configuration of the target container; the first component obtains the container configuration and sends the container configuration to at least one second target network model, so that the at least one second target network model creates network configuration information for the target container, and the at least one second target network model includes at least one of the first network model and the second network model.

[0056] When the Kubelet component creates / deletes a pod or container, it invokes the CRI (Configuration Request Invoke), which then calls the network model to build / delete the pod or container. A pod is a collection of one or more containers that participate in scheduling as a whole.

[0057] When CRI receives a request from kubelet to create a container, it creates the target container and configures it with container settings, including pod identifier (ID), container identifier, and namespace. After creating and configuring the target container, CRI attempts to send a network configuration creation request carrying invocation information to one of the first and second network models to request that one of them create network configuration information. At this point, the first component intercepts the network configuration creation request sent by CRI, retrieves the container configuration configured by CRI for the target container, and sends the container configuration to at least one second target network model, enabling the invoked second target network model to create network configuration information through the accessed network plugin.

[0058] At least one secondary objective network model includes the following cases:

[0059] Case 1, First network model;

[0060] Case 2, Second Network Model;

[0061] Case 3: First network model and second network model.

[0062] When at least one second target network model is Case 1 or Case 2, the first component calls a network model to create network configuration information and creates a set of network configuration information. The network configuration information created when calling the first network model is the first network configuration, and the network configuration information created when calling the second network model is the second network configuration information.

[0063] In the case where at least one of the second target network models is Case 3, the first component calls two networks to create network configuration information. At this time, two sets of network configuration information are created: first network configuration information and second network configuration information.

[0064] In this embodiment of the application, the network configuration information includes: IP address, port number, network rules, network topology information, etc.

[0065] Here, in the container creation scenario, the first target network model invoked by the first component based on the first information is the same as the second target network model used to send the container configuration. For example, if the first network model is CNI and the second network model is CNM, when creating the target container, the first component invokes CNI based on the invocation information and sends the container configuration to CNI; the first component invokes CNM based on the invocation information and sends the container configuration to CNM; the first component invokes both CNI and CNM based on the invocation information and sends the container configuration to both CNI and CNM.

[0066] Without the first component, the first or second network model can only act on the CRI alone. When creating a container, the container created by the CRI can only create network configuration information for the container through a fixed network model connected to the CRI. In this embodiment, the network model connected to the CRI through the first component includes the first network model and the second network model. At this time, network configuration information can be created for the created container through either the first network model or the second network model, or network configuration information can be created for a container that has not been created by either network model. This removes the limitation of the container's network configuration information to a fixed container network model connected to the CRI.

[0067] In some embodiments, for any second target network model, the second target network model may also perform the following processing: the second target network model creates network configuration information through the accessed target network plugin; the second target network model binds the network configuration information and the container configuration.

[0068] After receiving the container configuration, the second target network model sends a call request to the target network plugin it accesses, in order to call the target network plugin and create network configuration information through the called target network plugin.

[0069] Here, when the second target network model is CNM, the target network plugins accessed by CNM can be: IPvlan plugin, MACvlan plugin, etc. When the second target network model is CNI, the target network plugins accessed by CNI can be: virtual network device (veth) plugin, MACvlan plugin, IPvlan plugin, Open Virtual Switch (OVS) plugin, Flannel plugin, Calico plugin, etc.

[0070] After the target network plugin creates the network configuration information, it returns the network configuration information to the second target network model. The second target network model then binds the received network configuration information to the container configuration.

[0071] In this embodiment of the application, the second target network model binds the received network configuration information with the container configuration, inserts the IP address into the target container, and inserts the IP address into the namespace.

[0072] In this embodiment of the application, the first set of prices enables a container to have one or two network plugins, so that when the container is created, the target container can have one or two sets of network configuration information, be compatible with multiple network plugins, and set multiple different sets of network configuration information for a container, thereby connecting multiple network planes.

[0073] In this embodiment of the application, when at least one second target network model includes a first network model and a second network model, the IP address in the first network configuration information and the IP address in the second network configuration information can constitute a virtual interface pair (veth-pair), wherein the veth-pair is a pair of virtual device interfaces, wherein one end of the virtual device interface in the virtual interface pair is connected to the protocol stack, and the other end is connected to another virtual device interface.

[0074] In some embodiments, the second target network model directly interfaces with the target network plugin.

[0075] In some embodiments, the second target network model interfaces with the target network plugin through a second component. Specifically, one or both of the first and second network models interface with their respective network plugins through the second component.

[0076] In one example, such as Figure 5 As shown, the first network model 303 is connected to the network plugin 306 through the second component 305, and the second network model 304 is connected to the network plugin 308 through the second component 307. The network component 306 can be understood as the target network plugin corresponding to the first network model, and the network plugin 308 can be understood as the target network plugin corresponding to the second network model.

[0077] When the second target network model interfaces with the target network component through the second component, the second target network model creates network configuration information through the accessed target network plugin, including: the second target network model calling the second component; the second target network model receiving the network configuration information sent by the second component, wherein the network configuration information is created by the second component through the target network plugin.

[0078] Here, the second target network calls the second component. After the second target network model calls the second component, it calls the target network plugin. After the target network plugin is called by the second component, it creates network configuration information and sends the created network configuration information to the second component. The second component sends the network configuration information created by the target network plugin to the second target network model. At this time, the second target network model receives the network configuration information and binds the received network configuration information with the container configuration to complete the construction of the target container's network.

[0079] In this embodiment, the network model is not directly connected to the network plugin, but is connected through a second component. This allows different network models to transmit the network configuration information of the control panel, and the second component interacts with each network plugin to achieve real network allocation. This enables simultaneous implementation of network methods and interfaces that are compatible with both K8S and Docker.

[0080] In some embodiments, when the at least one second target network model includes the first network model and the second network model, the network type of the target network plugin corresponding to the first network model is a virtual network, and the network type of the target network plugin corresponding to the second network model is a physical network.

[0081] In this embodiment of the application, when the target container is configured in both the first network model and the second network model, the target container can be configured to be placed in two types of subnets by different network types of the target network plugin. One of them is a physical network, and the other is a physical network, i.e., a host network, thereby improving the security of the subnet.

[0082] When the target network plugin is a Layer 2 network plugin, its network type is a physical network, allowing the container to be placed on a Layer 2 physical network. When the target network plugin is a Layer 3 network plugin, its network type is a virtual network, allowing the container to be placed on a Layer 3 virtual network.

[0083] The method provided in this application embodiment can set up multiple network plugins for a container, and the set network plugins include two types of networks: virtual network and physical network, thereby placing a container under two subnets and improving network security through subnets.

[0084] In some embodiments, when the at least one second target network model includes the first network model and the second network model, the second component further performs the following processing:

[0085] Upon detecting traffic to the target container, the second component identifies the transmission direction and network type of the traffic; the second component then filters the traffic based on the transmission direction and network type.

[0086] Once the target container is created and its container configuration and network configuration information are bound together, and the target container is connected to two network planes, the target container interacts with the host machine (electronic device) through the interface between the second component, the network, and the host machine to communicate with the external network across the host machine.

[0087] When the target container sends traffic to the external network, the traffic is sent to the second component, which detects and filters the traffic. When the network sends traffic to the target container, the host machine's interface sends the traffic received from the external network to the network plugin, which then sends the traffic to the connected second component, which filters the detected traffic.

[0088] The traffic detected by the second component can be either traffic originating from the target container or traffic sent to the target container.

[0089] After detecting traffic to the target container, the second component identifies the traffic transmission direction and network type. The transmission direction indicates whether the traffic is inbound traffic sent from an external network to the container or outbound traffic sent from the target container to an external network. When the transmission direction is from an external network to the target container, the traffic is inbound traffic sent to the target container; when the transmission direction is from the target container to an external network, the traffic is outbound traffic originating from the target container.

[0090] In this embodiment, the source IP address and destination IP address of the traffic can be obtained. The source IP address is the IP address of the sender, and the destination IP address is the IP address of the destination. When the source IP address is the IP address of the target container, the traffic is the outgoing traffic from the target container; when the destination IP address is the IP address of the target container, the traffic is the incoming traffic sent to the target container.

[0091] In this embodiment of the application, when the target container communicates, the traffic it receives or sends is filtered by a second component instead of being transmitted directly, thereby improving the performance and security of the network.

[0092] In some embodiments of this application, the second component may identify the network type of the traffic in the following ways:

[0093] The second component obtains the first IP address of the traffic, which is created by the target network plugin; the second component determines the network type of the traffic based on the target network plugin that created the first IP address.

[0094] Here, the first IP address is the address created by the target network plugin. When the traffic is outgoing, the first IP address is the source IP address; when the traffic is incoming, the first IP address is the destination IP address.

[0095] In some embodiments, the second component determines the network type of the traffic based on the target network plugin that creates the first IP address, including: if the target network plugin belongs to a virtual network, the second component determines the network type of the traffic to be a virtual network; if the target network plugin belongs to a physical network, the second component determines the network type of the traffic to be a physical network.

[0096] After obtaining the IP address of the traffic, the second component determines the network type of the target network plugin for that IP address. The determined network plugin type is the network plugin type of the traffic.

[0097] In this embodiment of the application, network plugins for physical networks may include Layer 2 network plugins such as IPvlan plugins and MACvlan plugins, and network plugins for virtual networks may include Layer 3 network plugins such as Flannel plugins and Calico plugins.

[0098] In this embodiment of the application, the filtering method by which the second component filters the traffic based on the transmission direction and the network type includes at least one of the following:

[0099] Filtering Method 1: If the traffic is inbound traffic destined for the target container and the traffic belongs to a virtual network, the second component sends the traffic to the target container.

[0100] Filtering Method 2: If the traffic is inbound traffic destined for the target container and the traffic belongs to the physical network, the second component will discard the traffic.

[0101] Filtering Method 3: If the traffic is an outgoing traffic originating from the target container and the traffic belongs to a virtual network, the second component discards the traffic.

[0102] Filtering Method 4: If the traffic is outgoing traffic from the target container and the traffic belongs to the physical network, the second component sends the traffic to the target network plugin.

[0103] In this embodiment of the application, when the network type of the traffic detected by a second component is determined based on the network type of the target network plugin, for a second component, if the target container remains unchanged, the network type of the traffic it detects is either a virtual network or a physical network.

[0104] The second component discards outgoing traffic with a virtual network type and does not pass it to the target network plugin. It only passes incoming traffic with a virtual network type to the container, thereby performing security monitoring on the incoming traffic.

[0105] The second component forwards outbound traffic from physical networks, ensuring that the outbound traffic is sent out using the high-performance physical network. The second component discards outbound traffic from virtual networks, improving outbound traffic transmission performance without requiring monitoring.

[0106] In cases where at least one second target network model includes both a first network model and a second network model, such as Figure 6As shown, container 601 connects to second component 602 and second component 603. Second component 602 connects to first network plugin 604, and second component 603 connects to second network plugin 605. First network plugin 604 is a virtual network, and second network plugin 605 is a physical network. The container's data transmission paths include path 606 for inbound traffic and path 607 for outbound traffic. Paths 608 and 609 are not connected. When second component 602 receives traffic from first network plugin 604, it forwards the traffic to container 601. When second component 602 receives traffic from container 601, it discards the traffic. When second component 603 receives traffic from container 601, it forwards the traffic to container 601. When second component 603 receives traffic from second network plugin 605 from container 601, it discards the traffic.

[0107] In this embodiment, the second component prioritizes security for inbound traffic to prevent external network attacks, while prioritizing performance metrics such as bandwidth and latency for outbound traffic. It identifies whether traffic is inbound or outbound and controls the traffic path in a network to be unidirectional, thereby improving the balance between container security and performance and resolving the contradiction between network performance and security.

[0108] The information processing method provided in the embodiments of this application will be further described below.

[0109] Container network modes include the following four: (4 network modes are included)

[0110] 1) Bridge mode: Allocate a network namespace (namespace, IP address, etc.) for each container and connect Docker containers on a host to a virtual bridge;

[0111] 2) Host mode: Containers connected to the host network share the host's network stack, share a network namespace with the host, and use the host's IP and ports. There is almost no performance loss, and the performance is the best.

[0112] 3) Container mode: When creating a new container, a network namespace is specified and shared with an existing container. The new container does not create its own ports and IPs, but shares IPs, ports and other resources with a specified container. Except for network aspects, other resources remain isolated.

[0113] 4) None mode: The container only has an input / output (IO) loopback network and no other network cards, which is a completely closed network.

[0114] Containers can access external network connections. For example... Figure 7A As shown, in bridged mode, Docker container 701's interface 7011 communicates with the host machine 700's interface through virtual bridge 702 (docker0), allowing container 701 to communicate with the external network via virtual bridge docker0702. Specifically, when the Docker service (server) starts, it creates a virtual bridge 702 named docker0 on the host machine 700. Container 701, started on the host machine 700, connects to this virtual bridge 702. Virtual bridge 702 operates similarly to a physical switch, thus connecting all containers on the host machine 700 to a Layer 2 network via a switch. Next, IP addresses are assigned to the containers. Docker selects an IP address and subnet from its private IP network segment, different from the host machine's, and assigns it to docker0. Containers connected to docker0 then select an unused IP address from this subnet. In one example, Docker will use the 172.17.0.0 / 16 network segment and assign 172.17.42.1 / 16 to the docker0 bridge (used as a virtual network interface on the host machine), with the host machine's host address being 10.10.101.105 / 24.

[0115] like Figure 7B As shown, in host mode, container 701 shares the namespace and IP address of host machine 700. Container 701 and host machine 700 share the network stack of Docker host. The network configuration of container 701 is exactly the same as that of host machine 700. Container 701's interface 7011 communicates directly with the external network through the host machine's interface 703.

[0116] Docker network model under CNM, such as Figure 8 As shown, it consists of three components: Sandbox 801, Endpoint 802, and Backend Network 803.

[0117] Sandbox801: Located in container 800, it is the container network stack used to define the container's virtual network interface, routing table, DNS configuration, etc. It can be regarded as the Linux network type namespace itself.

[0118] Endpoint: Serves as the medium for connecting the sandbox to the network. A typical implementation is the virtual interface pair (Veth pair) technology (a paired interface inherent in Linux, used for connection).

[0119] Backend Network: The specific network implementation, which can be achieved through Linux bridges, VLANs, and other technologies. It is a set of endpoints that can communicate directly with each other.

[0120] Here, sandbox represents a container, network represents a network formed by network drivers outside the container, and endpoint connects the two.

[0121] CNM's interface comprises two parts: an IP address management (IPAM) plugin and a network plugin. The IPAM plugin is responsible for creating / deleting address pools and allocating network addresses, while the network plugin is responsible for creating / deleting networks and allocating or reclaiming IP addresses for containers. In fact, both plugins can implement all the interfaces. However, CRI uses different plugins in different situations, which introduces complexity.

[0122] The network model of a container under CNI is as follows: Figure 9 As shown, it includes: container runtime 901, CNI 902 and network plugin 903, wherein plugin 903 may include: veth plugin 9031, Macvlan plugin 9032, Ipvlan plugin 9033 and OVS plugin 9034.

[0123] A container allows for the independent access of one of multiple CNI-compliant network plugins, such as... Figure 9 CNI can integrate with various network plugins, such as veth, Macvlan, Ipvlan, and OVS, and can be added to multiple networks driven by different plugins. CNI can also connect to extended network plugins such as Flannel and Calico.

[0124] The CNI 902 specification is relatively concise, defining a simple contract between the container runtime and network plugins (903). This contract uses JSON syntax to define the inputs and outputs that the CNI plugin needs to provide, thereby shielding the complexity of the underlying network implementation and decoupling the network plugin implementation.

[0125] Each network has its own corresponding plugin and a unique name. Network configuration and deletion utilize the CNI interface; the CNI plugin needs to provide two commands: one to add the network interface to the specified network, and the other to remove it. These two commands are invoked when the container is created and destroyed, respectively.

[0126] To use CNI network plugins (such as the Macvlan plugin), kubelet needs to configure parameters associated with CNI, using CNI to configure the network for each Pod. Kubelet is the main service on the worker nodes, periodically receiving new or modified Pod specifications from the kube-apiserver component and ensuring that Pods and their containers run under the expected specifications. This component also acts as a monitoring component for the worker nodes, reporting the host's operational status to the kube-apiserver. A Pod is a collection of one or more containers that participate in scheduling as a whole.

[0127] The use of CNI and CNM in related technologies has the following problems:

[0128] 1. Bridge mode using the Flannel plugin is the default plugin form in Kubernetes, but its performance is low;

[0129] 2. Using IPvlan / MACvlan plugins can improve performance, but since the MAC address of the service container will be directly exposed, there is a certain security risk.

[0130] 3. Native CNI can only support one type of network plugin and cannot support multiple network plugins simultaneously.

[0131] like Figure 10 As shown, Kubelet1001 connects to CRI1002, CRI1002 connects to CNI1003, and CNI1003 connects to a network plugin. The network plugin can be connected in three ways: Method 1, Method 2, and Method 3. In Method 1, CNI1003 connects to Flannel plugin 1041. In Method 2, CNI1003 connects to Ipvlan plugin 1042. In Method 3, CNI1003 connects to Calico plugin 1043. In other methods, CNI can only connect to one allowed plugin at a time.

[0132] 4. CNI and CNM cannot work together.

[0133] The information processing method provided in this application embodiment can achieve the following technical effects:

[0134] 1. Simultaneously compatible with multiple network plugins of CNM and CNI;

[0135] 2. It can set up multiple network cards inside a single container, connecting multiple network planes;

[0136] 3. It achieves a balance between performance, security, and cost;

[0137] 4. Without modifying the existing Docker and Kubernetes system, integrate previously independently deployed containers (such as Docker) into the Kubernetes system to reduce the difficulty of adaptation.

[0138] The differences between the technical principles of related technologies and the technical principles of the information processing method provided in the embodiments of this application are as follows: Figure 11 As shown, 111 represents the technical principle of related technologies, and 112 represents the technical principle of the information processing method provided in the embodiments of this application.

[0139] In section 111(a), the technical architecture of Kubernetes is shown, with kubelet1101, CRI1102, CNI1103 connected to the network plugin 1104, and CNI1103 connected to a network plugin. In section 111(b), the network plugin connection method in Docker is shown, with CRI1102, CNM1105 connected to the network plugin 1105, and CNM1104 connected to a network plugin 1106. Kubelet1101 is used to manage pods. Kubelet primarily obtains a set of pod descriptions (podSpecs) through the API server component and strives to ensure that pods run in the state described by the podSpecs. The API server provides the sole entry point for resource object operations; all other components must operate on resource data through its provided API.

[0140] The information processing in 111(a) includes: Kubelet1101 calls CRI1102 to create a Pod, schedules the resources of kubelet1101, CRI1102 creates a Pod ID and namespace, CRI1102 calls CNI1103 and associates the namespace and Pod ID to configure the created container to CNI1103, and CNI1103 configures network configuration information such as IP address, network filtering rules, and network topology through network plugins 1104 such as Flannel or Calico, and inserts the network configuration information into the container and namespace.

[0141] CRI1102 creates a container and configures it for CNI1103. CNI1103 obtains an IP address using network plugin 1104 and inserts the IP address into the pod and namespace.

[0142] 112 is the technical architecture of the container system for implementing the information processing method provided in the embodiments of this application:

[0143] ① A new “Network Automatic Separation Agent (Controller) 1106” is introduced between CRI1102 and CNI1103 / CNM1105. Controller 1106 intercepts information sent by CRI1102 to CNI1103 / CNM1105. Controller 1106 can also reorganize the communication path between CRI1102 and CNI1103 / CNM1105.

[0144] ② By achieving interface compatibility with both CNI1103 and CNM1105 network models, Controller1106 can simultaneously interface with both CNI1103 and CNM1105, making Controller1106 compatible with both the Kubernetes and Docker community network connection methods. This is achieved without modifying the southbound interface of Kubernetes CRI to CNI, or the northbound interface of CNI or CNM to CRI.

[0145] ③ Controller1106 strictly requires that there must be one virtual network implemented based on a virtual network plugin and another host network implemented based on a physical network plugin. If two virtual networks or two host networks are detected, an error message will be returned. The virtual network is an overlay network, which is a Layer 3 network in the OSI network model, and the virtual network plugin is a Layer 3 network plugin. The physical network is an underlay network, which is a Layer 2 network in the OSI network model, and the physical network plugin is a Layer 2 network plugin. The virtual network has high security.

[0146] ④CNI1103 / CNM1105 does not directly connect to the network plugin; it requires the intermediary of a proxy device (worker) 1107 / worker1108. The functions of worker1107 / worker1108 include:

[0147] Function 1: Connecting the CNI1103 and CNM1105 interfaces to transmit network configuration information from the control plane;

[0148] Function 2: It actually interacts with various network plugins to achieve real network allocation, and can simultaneously implement network methods and interfaces that are compatible with both Kubernetes and Docker.

[0149] Function 3: To achieve customized isolation of network outbound and inbound traffic, so as to achieve a balance between security requirements and performance.

[0150] ⑤ Since containers have relatively basic networking capabilities and no concept of subnets, Controller1106 will record them as subnets and prioritize placing containers under the same user in two subnets. One subnet is a "virtual network" and the other is a "host network" to improve security through subnets.

[0151] It should be noted that the technical architecture shown in 112 adds Controller1106, worker1107, and worker1108 compared to the technical architecture shown in 111. Among them, Controller1106 is involved in network allocation management and plugins, but does not participate in traffic forwarding in actual operation, while worker1107 and worker1108 participate in traffic forwarding.

[0152] Based on the technical architecture shown in 112, the container creation process includes: Kubelet calling CRI to create a Pod; CRI creating a Pod ID and namespace; CRI's call to CNI being intercepted by the controller; the controller obtaining the namespace and Pod ID; the controller calling CNI and CNM, and sending the namespace and Pod ID to CNI / CNM; CNI / CNM associating with workers; workers configuring network configuration information such as IP address, network rules, and network topology through network plugins such as Flannel or Calico; workers recognizing the network configuration information and sending it to CNI / CNM; and CNI / CNM inserting the network configuration information into the container and namespace.

[0153] 7) The agent device worker identifies network IP addresses, network rules, network topology, etc.

[0154] In the information processing method provided in this application embodiment, the worker supports the following settings:

[0155] ①The worker function can be configured to be disabled or turned off. When the worker function is disabled, there is no difference in traffic transmission between CNI / CNM and network plugins whether or not a worker is present.

[0156] ② When the worker function is enabled, the worker function implemented by the worker is as follows:

[0157] Identify whether the traffic is inbound. If it is inbound, security needs to be a top priority to prevent external network attacks. It needs to be converted to a virtual network IP address.

[0158] Identify whether the traffic is outgoing. If it is outgoing, you need to focus on performance indicators such as bandwidth and latency. Since the packets are sent from the container, there is no need to worry about security issues, so you can use the highest performance host network (IPvlan, MACvlan, etc.).

[0159] The implementation principle of worker is as follows Figure 12 and Figure 13 As shown, where, Figure 12 For worker-permitted paths, Figure 13 For paths that are prohibited by the worker, in such cases Figure 12 and Figure 13 In the host machine 1201, container 1202 is configured with veth pairs: veth0 and veth1. The IP of veth0 is 172.16.0.10 and the port number is 24. The IP of veth1 is 172.16.0.100 and the port number is 16. veth0 in container 1202 is connected to Flannel plugin 1205 through worker 1203. veth1 in container 1202 is connected to IPvlan plugin 1206 through worker 1204. Flannel plugin 1205 and IPvlan plugin 1206 are connected to network port 1207 of host machine 1201. The IP address of network port 1207 is 192.168.0.10 and the port number is 16. Container 1302 on host machine 1301 is configured with veth pairs: veth0 and veth1. The IP of veth0 is 172.16.0.20 and the port number is 24. The IP of veth1 is 172.16.0.200 and the port number is 16. veth0 in container 1302 is connected to Calico plugin 1305 through worker 1303. veth1 in container 1302 is connected to MACvlan plugin 1306 through worker 1304. Calico plugin 1305 and MACvlan plugin 1306 are connected to network port 1307 on host machine 1301. The IP address of network port 1307 is 192.168.0.20 and the port number is 16.

[0160] Container 1202 interacts with system 1208 across host 1201, and container 1302 interacts with system 1208 across host 1301.

[0161] exist Figure 12In this configuration, worker 1203 allows inbound traffic from system 1208 to container 1202 to pass through (i.e., receives inbound traffic), and worker 1303 allows inbound traffic from system 1208 to container 1302 to pass through (i.e., receives inbound traffic). Worker 1204 allows outbound traffic from container 1202 to system 1208 to pass through (i.e., transparently transmits outbound traffic), and worker 1304 allows outbound traffic from container 1302 to system 1208 to pass through (i.e., transparently transmits outbound traffic).

[0162] exist Figure 13 In the configuration, worker1203 does not allow outgoing traffic from container 1202 to system 1208 to pass through, and worker1303 does not allow outgoing traffic from container 1302 to system 1208 to pass through. worker1204 does not allow incoming traffic from system 1208 to container 1202 to pass through, and worker1304 does not allow incoming traffic from system 1208 to container 1302 to pass through.

[0163] Among them, woker1203 and woker1303 are located in the virtual network, while woker1204 and woker1304 are located in the virtual physical network.

[0164] This application provides an information processing device, such as... Figure 3A As shown, it includes:

[0165] CRI301, first component 302, first network model 303, and second network model 304; the first network model 303 and the second network model 304 cannot work together with CRI301; among them.

[0166] CRI301 is used to send a call information to a target network model, the call information being used to call the target network model, the target network model being a first network model 303 or a second network model 304;

[0167] The first component 302 is used to intercept the call information and call the first target network model based on the call information.

[0168] In some embodiments,

[0169] CRI301 is also used to create a target container and configure the container configuration of the target container upon receiving a container creation request;

[0170] The first component 302 is further configured to obtain the container configuration and send the container configuration to at least one second target network model, such that the at least one second target network model creates network configuration information for the target container, wherein the at least one second target network model includes at least one of the first network model and the second network model.

[0171] In some embodiments, the second target network model is used to create network configuration information through the accessed target network plugin, and bind the network configuration information to the container configuration.

[0172] In some embodiments, the information processing apparatus further includes: a second component,

[0173] The second target network model is further configured to: invoke the second component and receive the network configuration information sent by the second component, wherein the network configuration information is created by the second component through the target network plugin.

[0174] In some embodiments, when the at least one second target network model includes the first network model and the second network model, the network type of the target network plugin corresponding to the first network model is a virtual network, and the network type of the target network plugin corresponding to the second network model is a physical network.

[0175] In some embodiments, the second component is further configured to:

[0176] When the at least one second target network model includes the first network model and the second network model, upon detecting traffic to the target container, the transmission direction and network type of the traffic are identified;

[0177] The traffic is filtered according to the transmission direction and the network type.

[0178] In some embodiments, the second component is further configured to:

[0179] If the target network plugin belongs to a virtual network, the network type of the traffic is determined to be a virtual network;

[0180] If the target network plugin belongs to a physical network, the network type of the traffic is determined to be a physical network.

[0181] In some embodiments, the second component is further configured to:

[0182] If the traffic is inbound traffic destined for the target container and the traffic belongs to a virtual network, then the traffic is sent to the target container.

[0183] If the traffic is inbound traffic destined for the target container and the traffic belongs to the physical network, the traffic is discarded.

[0184] If the traffic is outgoing traffic originating from the target container and the traffic belongs to a virtual network, the traffic is discarded.

[0185] If the traffic is outgoing traffic originating from the target container and the traffic belongs to the physical network, the traffic is sent to the target network plugin.

[0186] The descriptions of the above device embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0187] It should be noted that, in the embodiments of this application, if the above-described information processing method is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the related technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0188] Correspondingly, this application provides an electronic device including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor executes the program, it implements the steps in the information processing method provided in the above embodiments.

[0189] Correspondingly, embodiments of this application provide a storage medium, namely a computer-readable storage medium, on which a computer program is stored, which, when executed by a processor, implements the information processing method provided in the above embodiments.

[0190] It should be noted that the descriptions of the storage medium and device embodiments above are similar to the descriptions of the method embodiments above, and have similar beneficial effects. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0191] It should be noted that, Figure 14 This is a schematic diagram of a hardware entity of an electronic device according to an embodiment of this application, such as... Figure 14As shown, the electronic device 1400 includes: a processor 1401, at least one communication bus 1402, a user interface 1403, at least one external communication interface 1404, and a memory 1405. The communication bus 1402 is configured to enable communication between these components. The user interface 1403 may include a display screen, and the external communication interface 1404 may include standard wired and wireless interfaces.

[0192] The memory 1405 is configured to store instructions and applications executable by the processor 1401, and can also cache data to be processed or already processed by the processor 1401 and various modules in the electronic device (e.g., image data, audio data, voice communication data and video communication data), which can be implemented by flash memory or random access memory (RAM).

[0193] It should be understood that the phrase "one embodiment" or "an embodiment" throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of this application. Therefore, "in one embodiment" or "in some embodiments" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above-described processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above-described embodiments are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0194] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0195] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0196] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0197] In addition, each functional unit in the various embodiments of this application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0198] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, read-only memory (ROM), magnetic disks, or optical disks.

[0199] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0200] The above description is merely an embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An information processing method, characterized in that, The method is applied to an electronic device, which includes: a Container Runtime Interface (CRI), a first component, a first network model, and a second network model; the first network model and the second network model cannot work together on the CRI, and either the first network model or the second network model can work independently on the CRI; the first component interfaces with the CRI to the north and with both the first network model and the second network model to the south; the method includes: The CRI sends a call information to the first target network model, the call information being used to call the first target network model, the first target network model being either a first network model or a second network model; The first component intercepts the call information and calls the first target network model based on the call information.

2. The method according to claim 1, characterized in that, The method further includes: Upon receiving a container creation request, the CRI creates the target container and configures the container configuration of the target container. The first component obtains the container configuration and sends the container configuration to at least one second target network model, such that the at least one second target network model creates network configuration information for the target container, wherein the at least one second target network model includes at least one of the first network model and the second network model.

3. The method according to claim 2, characterized in that, The method further includes: The second target network model creates network configuration information through the accessed target network plugin; The second target network model binds the network configuration information and the container configuration.

4. The method according to claim 3, characterized in that, The second target network model creates network configuration information through the accessed target network plugin, including: The second target network model calls the second component; The second target network model receives the network configuration information sent by the second component, wherein the network configuration information is created by the second component through the target network plugin.

5. The method according to claim 3 or 4, characterized in that, When the at least one second target network model includes the first network model and the second network model, the network type of the target network plugin corresponding to the first network model is a virtual network, and the network type of the target network plugin corresponding to the second network model is a physical network.

6. The method according to claim 4, characterized in that, When the at least one second target network model includes both the first network model and the second network model, the method further includes: Upon detecting traffic to the target container, the second component identifies the transmission direction and network type of the traffic; The second component filters the traffic based on the transmission direction and the network type.

7. The method according to claim 6, characterized in that, The second component identifies the network type of the traffic, including: The second component obtains the first IP address of the traffic, which is created by the target network plugin; The second component determines the network type of the traffic based on the target network plugin that creates the first IP address.

8. The method according to claim 6, characterized in that, The second component filters the traffic based on the transmission direction and the network type, including: If the traffic is inbound traffic destined for the target container and the traffic belongs to a virtual network, the second component sends the traffic to the target container. If the traffic is inbound traffic destined for the target container and the traffic belongs to the physical network, the second component will discard the traffic; If the traffic is outgoing traffic from the target container and the traffic belongs to a virtual network, the second component discards the traffic; If the traffic is outbound traffic originating from the target container and the traffic belongs to the physical network, the second component sends the traffic to the target network plugin.

9. An information processing device, characterized in that, The device includes: a container runtime interface (CRI), a first component, a first network model, and a second network model; the first network model and the second network model cannot work together with the container engine; the first network model or the second network model can work independently with the CRI; the first component interfaces with the CRI in the north and with the first network model and the second network model in the south. The CRI is used to send invocation information to the first target network model, the invocation information being used to invoke the first target network model, the first target network model being either the first network model or the second network model; The first component is used to intercept the call information and call the first target network model based on the call information.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the information processing method according to any one of claims 1 to 8.

11. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the information processing method according to any one of claims 1 to 8.

Images