Virtual machine cluster and container cluster two-layer network intercommunication system

Abstract

The application relates to a virtual machine cluster and container cluster two-layer network intercommunication system, which comprises a virtual machine module, a container module, a first conversion gateway and a second conversion gateway. The virtual machine module comprises a virtual machine, a tenant network and a two-layer switch, and the container module comprises a container cluster. The two-layer switch is used for responding to a traffic intercommunication request of the virtual machine, acquiring a tenant network where the virtual machine is located, and acquiring a VLAN identifier corresponding to the tenant network, so that the traffic carries the VLAN identifier. The first conversion gateway is used for encapsulating the traffic carrying the VLAN identifier into traffic carrying a VxLAN identifier according to the VLAN identifier, and acquiring a target container cluster corresponding to the VxLAN identifier, so as to send the traffic to the second conversion gateway connected with the target container cluster. The second conversion gateway is used for decapsulating the traffic carrying the VxLAN identifier into the traffic carrying the VLAN identifier based on the VxLAN identifier, and sending the traffic carrying the VLAN identifier to the target container cluster.

Description

Technical Field

[0001] This application relates to the field of network communication technology, and in particular to a Layer 2 network interconnection system for virtual machine clusters and container clusters. Background Technology

[0002] With the development of network information technology, cloud computing and cloud services have become the most sought-after virtualization technologies. Cloud computing infrastructure includes two main categories: virtual machine clusters and container clusters. The mainstream management platform for virtual machine clusters is OpenStack, while the mainstream management platform for container clusters is Kubernetes.

[0003] In existing technologies, to achieve network interoperability between OpenStack and Kubernetes, it is not only necessary for the OpenStack network server Neutron to provide communication services for Kubernetes, increasing the coupling between Neutron and Kubernetes, but also for the network modules of both to adopt the same network technology.

[0004] However, the above method can only achieve interoperability between three-layer networks. It is not applicable to existing OpenStack clusters and Kubernetes clusters, let alone to OpenStack clusters and Kubernetes clusters that have chosen different network technologies. Summary of the Invention

[0005] This application provides a Layer 2 network interconnection system between virtual machine clusters and container clusters to solve the problem of difficulty in achieving Layer 2 network interconnection between OpenStack clusters and Kubernetes clusters in the prior art.

[0006] Firstly, this application provides a Layer 2 network interconnection system between a virtual machine cluster and a container cluster, comprising:

[0007] The virtual machine module includes a virtual machine module, a container module, a first conversion gateway, and a second conversion gateway. The virtual machine module includes virtual machines, a tenant network, and a Layer 2 switch. The container module includes a container cluster.

[0008] The Layer 2 switch is used to respond to the virtual machine's traffic communication request, obtain the tenant network where the virtual machine is located, and obtain the VLAN identifier corresponding to the tenant network, so that the traffic carries the VLAN identifier;

[0009] The first conversion gateway is configured to encapsulate traffic carrying the VLAN identifier into traffic carrying the VxLAN identifier according to the VLAN identifier, and obtain the target container cluster corresponding to the VxLAN identifier, so as to send the traffic to the second conversion gateway connected to the target container cluster.

[0010] The second conversion gateway is configured to, based on the VxLAN identifier, decapsulate the traffic carrying the VxLAN identifier into traffic carrying the VLAN identifier, and send the traffic carrying the VLAN identifier to the target container cluster.

[0011] In a possible implementation, the container module further includes a Layer 2 load balancer, which is specifically configured to:

[0012] receive the traffic carrying the VLAN identifier sent by the second conversion gateway;

[0013] obtain a target node corresponding to the VLAN identifier in the target container cluster;

[0014] forward the traffic carrying the VLAN identifier to the target node.

[0015] In a possible implementation, the Layer 2 load balancer is specifically configured to:

[0016] obtain a Layer 2 virtual IP address bound to the VLAN identifier;

[0017] based on the Layer 2 virtual IP address, allow the traffic carrying the VLAN identifier to pass through, and forward the traffic carrying the VLAN identifier to the target node.

[0018] In a possible implementation, the Layer 2 load balancer is further configured to:

[0019] if the Layer 2 virtual IP address bound to the VLAN identifier is not obtained, discard the traffic carrying the VLAN identifier.

[0020] In a possible implementation, the container module further includes a Layer 3 load balancer, which is specifically configured to:

[0021] receive the traffic carrying the VLAN identifier sent by the target node, and distribute the traffic carrying the VLAN identifier to a pod container under the target node.

[0022] In a possible implementation, the tenant network connects the Layer 2 switch through a trunk port.

[0023] In a possible implementation, the Layer 2 switch is specifically configured to:

[0024] obtain a VLAN identifier carried by the traffic;

[0025] based on the VLAN identifier, allow the traffic carrying the VLAN identifier to pass through.

[0026] In a possible implementation, the second layer switch is specifically used for:

[0027] If the VALN identifier carried by the traffic is not acquired, the traffic is discarded.

[0028] In a possible implementation, the system further includes a network orchestration module, configured to configure the VALN identifier on the network card of the tenant network, the first conversion gateway, the second conversion gateway and the target node.

[0029] In a possible implementation, the network orchestration module is further configured to configure, on the first conversion gateway, a mapping relationship between the VALN identifier and the VxALN identifier and a corresponding relationship between the VxLAN identifier and the container cluster.

[0030] configure the mapping relationship between the VALN identifier and the VxALN identifier on the second conversion gateway;

[0031] configure the binding relationship between the VLAN identifier and the second layer virtual IP address on the second layer load balancer.

[0032] The virtual machine cluster and container cluster second layer network intercommunication system provided in the application includes a virtual machine module, a container module, a first conversion gateway and a second conversion gateway, the virtual machine module includes a virtual machine, a tenant network and a second layer switch, the container module includes a container cluster; the second layer switch is configured to acquire the tenant network where the virtual machine is located and the VLAN identifier corresponding to the tenant network in response to a traffic intercommunication request of the virtual machine, so that the traffic carries the VLAN identifier; the first conversion gateway is configured to encapsulate the traffic carrying the VLAN identifier into traffic carrying the VxLAN identifier according to the VLAN identifier, and acquire the target container cluster corresponding to the VxLAN identifier, so as to send the traffic to the second conversion gateway connected with the target container cluster; and the second conversion gateway is configured to decapsulate the traffic carrying the VxLAN identifier into traffic carrying the VLAN identifier based on the VxLAN identifier, and send the traffic carrying the VLAN identifier to the target container cluster.

[0033] The technical solution of the application establishes a full-mesh large Layer 2 link through the first conversion gateway and the second conversion gateway, and the service traffic of the virtual machine module can access the corresponding large Layer 2 network through the VLAN, and the VLAN to VxLAN mapping is performed on the first conversion gateway and the second conversion gateway, and then the target container cluster is sent, thereby providing basic network support for the service cross-region intercommunication and isolation between the OpenStack cluster and the Kubernets cluster. As can be seen, the Layer 2 network intercommunication system provided by the application realizes the functions of intercommunication between the virtual machine in the OpenStack cluster and the service in the Kubernets cluster through the VLAN technology of the Layer 2 network, and also realizes the network traffic isolation between different tenants of the OpenStack network and the Kubernets network. BRIEF DESCRIPTION OF DRAWINGS

[0034] The accompanying drawings, which are incorporated herein and constitute part of the specification, illustrate embodiments consistent with the application and, together with the description, serve to explain the principles of the application.

[0035] Figure 1 A structural schematic diagram of a virtual machine cluster and container cluster Layer 2 network intercommunication system embodiment one provided by the application;

[0036] Figure 2 A structural schematic diagram of a virtual machine cluster and container cluster Layer 2 network intercommunication system embodiment two provided by the application;

[0037] Figure 3 A structural schematic diagram of a virtual machine cluster and container cluster Layer 2 network intercommunication system embodiment three provided by the application.

[0038] Through the above-described drawings, the specific embodiments of the application have been shown, and more detailed descriptions will be given hereinafter. These drawings and textual descriptions are not intended to limit the scope of the concept of the application in any way, but to illustrate the concept of the application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0039] In order to make the purposes, technical solutions and advantages of the application more clear, the technical solutions in the application will be described clearly and completely below in combination with the drawings in the application. Obviously, the described embodiments are only some of the embodiments of the application, rather than all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without any creative work fall within the scope of protection of the application.

[0040] The terms "pre-set", "first", "second", "third" and the like in the description and claims of the application and the above figures, if any, are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the use of these terms herein is merely for distinguishing between like objects and not necessarily for describing a particular sequential or chronological order, unless explicitly indicated as such.

[0041] In the embodiments of the present application, the words "exemplary" and "for example" are used to mean serving as an example, instance, or illustration, at 5 2 least. Any implementation described herein as "exemplary" or as an "example" is not necessarily to be construed as preferred or advantageous over other implementations. Rather, use of the words "exemplary" or "example" is intended to present concepts in a concrete manner.

[0042] In recent years, with the development of cloud computing and cloud services, virtual machine-based and container-based are two typical server virtualization technologies in the field of cloud computing. Cloud architecture is often a multi-tenant architecture, and multiple customers will share a single physical network. Therefore, in addition to providing basic network connection capabilities, the cloud also needs to provide network isolation capabilities between tenants.

[0043] OpenStack is an open source cloud computing management platform project composed of several main components to complete specific work. OpenStack supports almost all types of cloud environments, and the project goal is to provide a cloud computing management platform that is easy to implement, scalable, rich, and standardized. OpenStack provides an infrastructure as a service (IaaS) solution through various complementary services, and each service provides an API for integration.

[0044] OpenStack is an open source project that aims to provide software for the construction and management of public and private clouds. Its community has more than 130 companies and 1350 developers, and these organizations and individuals use OpenStack as a general front end for infrastructure as a service (IaaS) resources. The primary task of the OpenStack project is to simplify the deployment process of the cloud and bring good scalability. This article hopes to provide the necessary guidance information to help you set up and manage your own public cloud or private cloud using the OpenStack front end.

[0045] OpenStack cloud computing platform, help service and enterprise internal implementation similar to Amazon EC2 and S3 cloud infrastructure services (Infrastructure as a Service, IaaS). OpenStack contains two main modules: Nova and Swift, the former is the virtual server deployment and business computing module developed by NASA; the latter is the distributed cloud storage module developed by Rackspace, both can be used together, also can be separated alone.

[0046] OpenStack as the mainstream management platform of virtual machine cluster, through the Neutron project to provide virtual network and service to meet the requirements of multi-tenant on the physical network environment. Network virtualization capabilities provided by Neutron include: (1) two layer to seven layer network virtualization: L2 (virtual switch), L3 (virtual Router and LB), L4-7 (virtual Firewall) etc.; (2) network connectivity: two layer network and three layer network; (3) tenant isolation. In order to meet the tenant isolation, OpenStack provides VPC network, VPC (Virtual Private Cloud) is the public cloud on the custom logical isolation network space, tenants can customize segment division, IP address and routing strategy, etc., and through the security group and network ACL to realize multi-layer security protection, also can be connected with external network through VPN or leased line VPC. VPC can be based on including GRE, VxLAN in various technologies to achieve.

[0047] Kubernetes as the mainstream management platform of container cluster is an open source, used to manage the containerized application on multiple hosts in cloud platform, the goal of Kubernetes is to make the deployment of containerized application simple and efficient, Kubernetes provides a mechanism for application deployment, planning, updating, maintenance. The traditional application deployment method is through plug-in or script to install application, the disadvantage of this is that the running, configuration, management, all the life cycle of the application will be bound to the current operating system, this is not conducive to the upgrade and rollback of the application operation, of course, also can be through the creation of virtual machine to achieve some functions, but virtual machine is very heavy and the steps are complicated, not conducive to portability.

[0048] The new way is achieved by deploying containers, each container is isolated from each other, each container has its own file system, and the processes between containers do not affect each other, and can distinguish computing resources. Compared with virtual machines, containers can be quickly deployed, and since containers are decoupled from underlying facilities and machine file systems, they can be migrated between different clouds and different versions of operating systems. Containers occupy less resources and are deployed quickly, and each application can be packaged into a container image, and the one-to-one relationship between each application and container also gives containers greater advantages. Using containers can create container images for applications in the build or release stage, because each application does not need to be combined with the rest of the application stack, nor does it depend on the production environment infrastructure, which provides a consistent environment from research and development to testing and production. Similarly, containers are lighter and more transparent than virtual machines, which makes them easier to monitor and manage.

[0049] Kubernetes has many network plugins, such as Flannel, Calico, Weave, Multus, etc. CNI means container network interface, which is a standard design, and different Kubernetes network plugins support CNI. However, the commonly used network plugin Flannel and Calico of Kubernetes are three-layer network plugins, which cannot provide two-layer network isolation capability between tenants.

[0050] Therefore, in order to realize the application intercommunication between the OpenStack cluster and the Kubernetes cluster, the prior art has specific requirements for the network modules of OpenStack and Kubernetes, requires that the network modules of both use the same network technology, needs to map between the network models of both, and realizes the three-layer network intercommunication of both. Secondly, the prior art needs the service provided by the OpenStack network server to realize the load balancing and communication of the container network, which increases the coupling between the OpenStack network server and the container network.

[0051] Therefore, the prior art is not applicable to the OpenStack cluster and the Kubernetes cluster that have been built, and is not applicable to the intercommunication between the OpenStack cluster and the Kubernetes cluster that have selected different network technologies.

[0052] To solve the above problems, the application provides a two-layer network intercommunication system suitable for virtual machine clusters and container clusters. A full mesh large two-layer link is established through a first conversion gateway and a second conversion gateway. When virtual machines need to intercommunicate with container nodes, a two-layer switch carries the VLAN identifier of the tenant network where the virtual machine is located on the traffic from the virtual machine, and realizes the isolation of the tenant network through different VLAN identifiers. When the traffic is transmitted to the first conversion gateway, a VxLAN identifier is encapsulated on the outer layer of the VLAN identifier to obtain a unique target container cluster corresponding to the VxLAN identifier, and the traffic is transmitted to the second conversion gateway connected to the target container cluster. The second conversion gateway strips the outer VxLAN identifier to obtain traffic carrying the VLAN identifier, so that the traffic can be sent to a target node in the target container cluster which also has the VLAN identifier.

[0053] Full interconnection mode (full mesh) is actually a form of network connection, that is, all nodes are directly connected and do not transfer traffic through third-party nodes.

[0054] Virtual local area network (VLAN) is a group of logical devices and users, which are not limited by physical location and can be organized according to functions, departments and applications. Communication between them is as if they are in the same network segment, hence the name virtual local area network. VLAN can provide logical topology and access control for almost any information integration system architecture in the local area network, and realize mutual interference sharing with other information systems sharing physical network links. VLAN can provide a virtual network topology architecture that conforms to the business structure and implement access control functions for information services and sub-services, as well as between information services. Compared with traditional local area network technology, VLAN technology is more flexible, which has the following advantages: the management overhead of network device movement, addition and modification is reduced; broadcast activity can be controlled; and the security of the network can be improved.

[0055] VLAN, as the current mainstream network isolation technology, has only 12 bits in the standard definition, so the number of available VLANs is only 4096. For public clouds or other large virtualization cloud computing services, the number of tenants is tens of thousands or even more. The isolation capability of VLAN cannot meet the requirements.

[0056] VxLAN is a network virtualization technology that can improve the expansion problem of large cloud computing when deployed, which is an extension of VLAN. VXLAN is a powerful tool that can extend Layer 2 through Layer 3 networks. It can solve the portability limitations of VMS (Virtual Memory System) by encapsulating traffic and extending it to third-layer gateways, allowing it to access servers on external IP subnets.

[0057] The full name of VxLAN is Virtual Extensible Local Area Network, simply put, VxLAN is an extended VLAN, and its header has a 24-bit ID segment, which means that there are 16 million unique virtual network segments to solve the problem of insufficient virtual networks in large cloud computing data centers. VxLAN can make multiple networks of a physical switch connected through a three-layer straight line by encapsulating and forwarding Layer 2 packets.

[0058] Layer 2 switches work in Layer 2 (Data Link Layer) of the OSI model, hence the name Layer 2 switch. Layer 2 switching technology has been relatively mature, and Layer 2 switches belong to data link layer devices that can recognize MAC address information in data frames, forward them according to MAC addresses, and record these MAC addresses and corresponding ports in an address table in their internal address table.

[0059] Gateway is an indispensable part of modern communication technology, which serves as a bridge between different networks such as the Internet and local area networks, making communication between different networks more convenient and efficient. As a network device in computer networks, the main function of the gateway is to connect communication between different networks. It can convert the protocol format of one network into a protocol format that another network can recognize, realizing data transmission between different networks. Gateways also have routing selection, security detection, data filtering and other functions.

[0060] According to different functions, gateways can be divided into three types: routing gateways, application gateways and conversion gateways. Routing gateways are mainly used to implement data packet routing, supporting static routing and dynamic routing and other routing protocols. Application gateways are mainly used for application layer protocol conversion, implementing conversion between HTTP, SMTP, FTP and other application protocols. Conversion gateway is a gateway that converts different network protocols, its main function is to convert the format of the data packet to a format that the target network can recognize.

[0061] The gateway works by receiving a data packet in one protocol format, converting the data format, and then forwarding the data packet to another network. The gateway is usually placed at the edge of a network and is connected to different networks. When a data packet is sent in the source network, it will first be sent to the gateway. The gateway will parse the data packet in the protocol format, and then build a protocol format suitable for the destination network, and send it to the destination network.

[0062] Load balancing is built on the existing network structure, providing a cheap, effective and transparent method to expand the network device and server bandwidth, increase throughput, enhance network data processing capacity, improve network flexibility and availability.

[0063] Two-layer load balancing, also known as data link layer load balancing, the main implementation is PPP binding and link aggregation technology. The load balancing server provides a virtual IP to the outside, and different machines in the cluster use the same IP address, but the MAC addresses of the machines are different. When the load balancing server receives a request, it forwards the request to the target machine by rewriting the target MAC address of the packet to achieve load balancing.

[0064] Three-layer load balancing is also network layer load balancing, which requires network layer protocols such as OSPF protocol, RIP protocol, etc. Similar to two-layer load balancing, the load balancer still provides a virtual IP to the outside, but different machines in the cluster use different IP addresses. When the load balancing server receives a request, it forwards the request to different real servers according to different load balancing algorithms through IP.

[0065] The technical solutions of the present application and how the technical solutions of the present application solve the above technical problems will be described in detail below with specific examples. The following specific examples can be implemented independently, or can be combined with each other, and the same or similar concepts or processes may not be described in detail in some examples.

[0066] Exemplary, Figure 1 The structure of the virtual machine cluster and container cluster two-layer network intercommunication system embodiment provided by the embodiment of the present application is shown in Figure Figure 1 As shown in the figure (two virtual machines are taken as examples), the two-layer network intercommunication system 100 in this embodiment includes a virtual machine module 110, a first conversion gateway 120, a second conversion gateway 130, and a container module 140. The virtual machine module 110 includes a virtual machine 111, a tenant network 112, and a two-layer switch 113. The container module 140 includes a container cluster 141.

[0067] The second layer switch 113 is configured to acquire a tenant network to which the virtual machine 111 belongs and acquire a VLAN identifier corresponding to the tenant network 112 in response to a traffic intercommunication request of the virtual machine 111, so that the traffic carries the VLAN identifier, for example, carries VLAN 100 on the traffic from a virtual machine 111, and is distinguished from the traffic of other virtual machines 111.

[0068] The first conversion gateway 120 is configured to encapsulate the traffic carrying the VLAN identifier into traffic carrying a VxLAN identifier according to the VLAN identifier, and acquire a target container cluster 141 corresponding to the VxLAN identifier, so as to send the traffic to a second conversion gateway 130 connected to the target container cluster 141, for example, VLAN 100 corresponds to VxLAN 200, when the traffic from the virtual machine 111 carries VLAN 100 and is transmitted to the first conversion gateway 120, the first conversion gateway 120 encapsulates VxLAN 200 on the outer layer of the traffic.

[0069] The second conversion gateway 130 is configured to decapsulate the traffic carrying the VxLAN identifier into traffic carrying the VLAN identifier based on the VxLAN identifier, and send the traffic carrying the VLAN identifier to the target container cluster 141, for example, the second conversion gateway 130 peels off the VxLAN 200 on the outer layer of the traffic, and then transmits the traffic carrying the VLAN 100 to the target container cluster 141.

[0070] The second conversion gateway 130 is configured to decapsulate the traffic carrying the VxLAN identifier into traffic carrying the VLAN identifier based on the VxLAN identifier, and send the traffic carrying the VLAN identifier to the target container cluster 141, for example, the second conversion gateway 130 peels off the VxLAN 200 on the outer layer of the traffic, and then transmits the traffic carrying the VLAN 100 to the target container cluster 141.

[0071] In the embodiment of the application, the service traffic of the virtual machine module realizes network traffic isolation between different tenants through the VLAN identifier, when the traffic carrying the VLAN identifier is transmitted to the first conversion gateway, the first conversion gateway encapsulates the VxLAN identifier on the outer layer of the VLAN identifier, and then obtains a unique target container cluster corresponding to the VxLAN identifier, and then transmits the traffic to the second conversion gateway connected to the target container cluster, and the second conversion gateway peels off the VxLAN identifier on the outer layer and restores the traffic carrying the VLAN identifier, so that the traffic can be sent to a target node in the target container cluster which also has the VLAN identifier, and network traffic isolation between container nodes in the Kubernets cluster is realized.

[0072] Exemplarily, Figure 2 The structure schematic diagram of the second virtual machine cluster and container cluster two-layer network intercommunication system embodiment provided in the embodiment of the application is as follows, Figure 2As shown (two virtual machines, one container node and two pod containers are taken as examples), the second embodiment of the layer 2 network interconnection system 200 includes a virtual machine module 210, a first conversion gateway 220, a second conversion gateway 230 and a container module 240. The virtual machine module 210 includes a virtual machine 211, a tenant network 212 and a layer 2 switch 213. The container module 240 includes a container cluster 241. Based on the first embodiment, the container module 240 further includes a layer 2 load balancer 242, a layer 3 load balancer 243, a node 244 and a pod container 245.

[0073] The layer 2 load balancer 242 is specifically configured to receive the traffic carrying the VLAN identifier sent by the second conversion gateway 230, obtain a target node 244 corresponding to the VLAN identifier in the target container cluster 241, and forward the traffic carrying the VLAN identifier to the target node 244.

[0074] The layer 2 load balancer 242 is further specifically configured to obtain a layer 2 virtual IP address bound to the VLAN identifier, allow the traffic carrying the VLAN identifier to pass based on the layer 2 virtual IP address, and forward the traffic carrying the VLAN identifier to the target node 244.

[0075] The layer 2 load balancer 242 is further configured to discard the traffic carrying the VLAN identifier if the layer 2 virtual IP address bound to the VLAN identifier is not obtained.

[0076] In the specific implementation process, the layer 2 load balancer 242 allocates a layer 2 virtual IP address, such as 172.66.1.100, to the Service of the Kubernets container cluster 241, and the layer 2 virtual IP address of the Service is bound to the node 244 with a specified VLAN identifier, and the service is exposed externally. When the layer 2 load balancer 242 receives a traffic interconnection request, the traffic is filtered according to the VLAN identifier bound to the layer 2 virtual IP address, only the traffic with the same VLAN identifier is allowed to pass, and other traffic is discarded. An example of the binding configuration of the layer 2 load balancer 242 is as follows:

[0077] config:

[0078] address-pools:

[0079] -name:default

[0080] protocol:layer2

[0081] addresses:

[0082] -172.66.6.240-172.66.6.250

[0083] node-selectors:

[0084] -match-labels:

[0085] vlan:vlan100

[0086] address-pools:

[0087] -name:default

[0088] protocol:layer2

[0089] addresses:

[0090] -172.66.7.240-172.66.6.250

[0091] node-selectors:

[0092] -match-labels:

[0093] vlan:vlan101

[0094] According to the binding relationship between the VLAN identifier and the layer 2 virtual IP address in the configuration, the layer 2 load balancer 242 only allows traffic identified as VLAN 100 to pass for requests to addresses in the address pool 172.66.6.240-172.66.6.250. Only traffic labeled VLAN 101 is allowed to pass for requests to addresses in the address pool 172.66.7.240-172.66.7.250.

[0095] The layer 3 load balancer 243 is specifically configured to: receive traffic carrying a VLAN identifier sent by the target node 244, and distribute the traffic carrying the VLAN identifier to the pod container 245 under the target node 244.

[0096] The application in the container cluster 241 uses the layer 2 load balancer 242 as a load balancer of the Service network of the layer 3 load balancer 243. For example, the layer 2 load balancer 242 forwards a request to the node 244 Node 1. The Node 1 node 244 performs network traffic filtering according to the corresponding VLAN identifier. Since the network traffic sent from the OpenStack compute node has a VLAN identifier of VLAN 100, which is the same as the VLAN identifier on the Node 1 node 244, the node 244 Node 1 receives the network traffic.

[0097] Deploy a Layer 3 load balancer 243 on node 244 of container cluster 241 as a proxy for the Service of container cluster 241. Expose the Cluster IP (Layer 2 virtual IP address) of the Service to the Layer 2 load balancer 242 to provide load balancing and reverse proxy services for the pod container 245 behind the Service, and forward external requests to the pod container 245.

[0098] A Node is a service node in a Kubernetes cluster architecture that runs pods; it's also called an agent or minion. A Node is the unit of operation in a Kubernetes cluster, used to host the execution of assigned pods; it's the host machine for running pods. A Pod runs on a Node and is a combination of several related containers. A pod can contain one or more related containers. Although a pod can hold multiple containers, in practice, only one container typically runs for ease of management. A Pod is the smallest unit for creation, scheduling, and management in a Kubernetes cluster. Containers within a Pod run on the same host machine, use the same network namespace, IP address, and port, and can communicate with each other via localhost.

[0099] Based on the above embodiment 1, the tenant network 212 is connected to the Layer 2 switch 213 through the trunk port.

[0100] The Layer 2 switch 213 is specifically used for: obtaining the VLAN identifier carried by traffic; and allowing traffic carrying the VLAN identifier to pass through based on the VLAN identifier.

[0101] The Layer 2 switch 213 is also specifically used to discard traffic if the VALN identifier carried by the traffic is not obtained.

[0102] Typical Layer 2 ports on a switch come in three common types: access, trunk, and hybrid. Access ports are generally used for PC or server access, and data packets passing through this port do not carry VLAN tags. Trunk ports allow data packets from multiple VLANs to pass through. Hybrid ports, depending on user needs, can VLAN tag and de-tag data packets passing through this port.

[0103] The data packet passing through the trunk port must carry the VLAN identifier. In the trunk port in direction, the switch receives the data packet, and first judges whether the VLAN identifier is carried. If not, the data packet is discarded; if yes, the data packet is forwarded according to the corresponding VLAN. In the trunk port out direction, the switch forwards the data packet with the VLAN identifier without change. The data packet without the VLAN identifier cannot be forwarded from the trunk port. Therefore, in the embodiment, the tenant network is connected to the layer 2 switch through the trunk port, so as to ensure that the flow carries the VLAN identifier before and after passing through the layer 2 switch.

[0104] In the embodiment, the existence of the trunk port ensures that the flow carries the VLAN identifier before entering the first conversion gateway, so as to ensure the smooth development of the subsequent process. By setting the layer 2 load balancer and the layer 3 load balancer, the load in the container cluster can be balanced, and the flow of the virtual machine can be smoothly transmitted to the pod container under the corresponding node, so as to realize the application intercommunication at the basic level.

[0105] Exemplarily, Figure 3 The structure schematic diagram of the virtual machine cluster and the container cluster layer 2 network intercommunication system embodiment three provided by the embodiment of the application is shown in Figure 3 As shown in the figure, the layer 2 network intercommunication system 300 further includes a network orchestration module 350 on the basis of the embodiment two.

[0106] The network orchestration module 350 is configured to configure the VLAN on the network card of the computing node (the tenant network 312) where the virtual machine 311 is located. Exemplarily, the VLAN identifier is set to VLAN100.

[0107] In a possible implementation, the layer 2 switch 313 is interconnected with the network card of the first conversion gateway 320. The network orchestration module 350 configures the VLAN on the network card of the first conversion gateway 320, and the VLAN identifier configured on the network card of the computing node where the virtual machine 311 is located is the same, that is, VLAN100, so as to realize the layer 2 flow isolation through the VLAN identifier. The network orchestration module 350 configures the mapping relationship between the VLAN and the VxLAN on the first conversion gateway, and maps the VLAN identifier and the VxLAN identifier. Exemplarily, VLAN100 is mapped to VxLAN200. The first conversion gateway 320 encapsulates the tenant network using the VLAN to send the VLAN information in one tenant network to another tenant network, so as to realize the layer 2 communication between the hosts of different tenant networks.

[0108] In one possible implementation, the network orchestration module 350 configures a VLAN identifier on the network card of the second conversion gateway 330 connected to the Kubernets network, which is the same as the VLAN identifier configured on the network card of the computing node where the virtual machine 311 is located, i.e., VLAN 100. The second conversion gateway 330 is connected to a Layer 2 load balancer 342 in the Kubernets, and the Layer 2 load balancer 342 binds a Layer 2 virtual IP address of a service in the Kubernets to a node 344 that needs to interwork with the virtual machine 311 in the OpenStack. The network orchestration module 350 configures a VLAN on the network card of the node 344, and the VLAN identifier is the same as the VLAN identifier configured on the network card of the OpenStack computing node, so as to realize the Layer 2 network interworking between the virtual machine 311 in the OpenStack and the node 344 in the Kubernets, and realize the Layer 2 traffic isolation through the VLAN identifier.

[0109] The application in the Kubernets cluster uses the Layer 2 load balancer 342 as the load balancer of the Service network of the Layer 3 load balancer 343. For example, the Layer 2 load balancer 342 forwards the request to the Node1 node 344. The network orchestration module 350 configures the VLAN identifier as VLAN 100 on the network card of the Node1, and the network card of the Node1 node 344 filters the network traffic according to the configured VLAN identifier. Since the network traffic sent from the OpenStack computing node has the VLAN identifier as VLAN 100, which is the same as the VLAN identifier configured on the network card of the Node1 node 344, the Node1 node 344 receives the network traffic.

[0110] The Layer 3 load balancer 343 is deployed on the node 344 in the Kubernets as a proxy of the Service in the Kubernets, exposes the Cluster IP of the service to the Layer 2 load balancer 342, and provides load balancing and reverse proxy services for the pod container 345 in the backend of the Service, and forwards the external request to the pod container 345.

[0111] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the application being indicated by the following claims.

Claims

1. A Layer 2 network interconnection system between a virtual machine cluster and a container cluster, characterized in that, include: The virtual machine module includes a container module, a first conversion gateway, a second conversion gateway, and a network orchestration module. The virtual machine module includes virtual machines, tenant networks, and Layer 2 switches. The container module includes a container cluster and a Layer 2 load balancer. The Layer 2 switch is used to respond to the virtual machine's traffic communication request, obtain the tenant network where the virtual machine is located, and obtain the VLAN identifier corresponding to the tenant network, so that the traffic carries the VLAN identifier; The first conversion gateway is used to encapsulate traffic carrying the VLAN identifier into traffic carrying the VxLAN identifier according to the VLAN identifier and VxLAN identifier mapping relationship preset by the network orchestration module, obtain the target container cluster corresponding to the VxLAN identifier, and send the traffic to the second conversion gateway connected to the target container cluster. The second conversion gateway is used to decapsulate traffic carrying the VxLAN identifier into traffic carrying the VLAN identifier based on the VxLAN identifier, and send the traffic carrying the VLAN identifier to the Layer 2 load balancer. The Layer 2 load balancer is specifically used for: receiving traffic carrying the VLAN identifier sent by the second conversion gateway; obtaining the target node in the target container cluster corresponding to the VLAN identifier; and forwarding the traffic carrying the VLAN identifier to the target node.

2. The system according to claim 1, characterized in that, The Layer 2 load balancer is specifically used for: Obtain the Layer 2 virtual IP address bound to the VLAN identifier; Based on the Layer 2 virtual IP address, traffic carrying the VLAN identifier is allowed to pass through, and traffic carrying the VLAN identifier is forwarded to the target node.

3. The system according to claim 2, characterized in that, The Layer 2 load balancer is also used for: If the Layer 2 virtual IP address bound to the VLAN identifier is not obtained, the traffic carrying the VLAN identifier is discarded.

4. The system according to claim 2, characterized in that, The container module also includes a three-layer load balancer, which is specifically used for: Receive traffic carrying the VLAN identifier sent by the target node, and distribute the traffic carrying the VLAN identifier to the pod container under the target node.

5. The system according to claim 1, characterized in that, The tenant network is connected to the Layer 2 switch via a trunk port.

6. The system according to claim 5, characterized in that, The Layer 2 switch is specifically used for: Obtain the VLAN identifier carried by the traffic; Based on the VLAN identifier, traffic carrying the VLAN identifier is allowed to pass.

7. The system according to claim 6, characterized in that, The Layer 2 switch is specifically used for: If the VALN identifier carried by the traffic is not obtained, the traffic is discarded.

8. The system according to claim 1, characterized in that, The system also includes a network orchestration module, which is used to configure VALN identifiers on the network interface cards of the tenant network, the first conversion gateway, the second conversion gateway, and the target node.

9. The system according to claim 1, characterized in that, The network orchestration module is also used to configure the mapping relationship between VALN identifiers and VxALN identifiers, as well as the correspondence between VxLAN identifiers and container clusters, in the first conversion gateway. Configure the mapping relationship between VALN identifiers and VxALN identifiers on the second conversion gateway; Configure the VLAN identifier and the binding relationship between the Layer 2 load balancer and the Layer 2 virtual IP address.

Images