Bare metal tenant isolation method, device, equipment and medium

Abstract

The present application discloses a bare metal tenant isolation method, apparatus, device and medium, relating to the field of cloud computing technology. By configuring the bare metal service network card as a port aggregation interface during bare metal deployment, the network card interface supports the passage of multiple virtual local area network (VLAN) tagged packets; at the same time, based on the QinQ VLAN in VLAN encapsulation mode, the port is configured as a virtual local area network (VLAN) stacking type, with the outer VLAN being the VLAN number of the cloud platform and the inner VLAN being encapsulated by the bare metal service itself. Therefore, when multiple tenants use different virtual local area networks to create cloud physical machines and configure them as port aggregation interfaces, the QinQ outer VLANs configured on the ports after bare metal deployment are different, thus avoiding conflicts between the port aggregation interfaces among tenants and achieving isolation of the port aggregation interfaces among multiple tenants.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to a bare metal tenant isolation method, apparatus, device, and medium. Background Art

[0002] Bare metal is a physical server without an operating system installed, shared by multiple virtual machines. Cloud platforms offer users dedicated computing resources dedicated to an entire machine, offering zero performance loss, high performance, and low latency, making it suitable for scenarios like high-performance computing and critical databases. The business network deployed on bare metal instances supports traditional virtual local area networks (VLANs), virtual extensible local area networks (VXLANs), and Generic Network Virtualization Encapsulation (Geneve).

[0003] Currently, traditional VLAN-based networks are widely used in private clouds. After deployment, bare metal switches are configured with the VLAN number corresponding to the service network and the interface type is set to access. With this switch configuration, the access port only supports receiving untagged packets. However, in bare metal virtualization scenarios, multiple tenants can apply for multiple bare metal switches on the cloud platform. This switch configuration cannot support VLAN network isolation for multiple tenants, hindering tenants' use of the cloud platform.

[0004] In view of the above problems, how to achieve multi-tenant VLAN network isolation in bare metal virtualization scenarios is an urgent problem to be solved by technical personnel in this field. Summary of the Invention

[0005] The purpose of this application is to provide a bare metal tenant isolation method, device, equipment and medium to achieve multi-tenant VLAN network isolation in a bare metal virtualization scenario.

[0006] To solve the above technical problems, this application provides a bare metal tenant isolation method, including:

[0007] During bare metal deployment, the computing service calls the network service interface to query the tenant network type and bare metal network card type; wherein the bare metal network card type includes an access interface and a port aggregation interface;

[0008] If the tenant network type is a virtual local area network and the bare metal network card type is a port aggregation interface, add the bare metal network card type to the binding profile attributes of the network service interface;

[0009] Determining, by a general switch driver, whether a key-value element of the port aggregation interface exists in the binding configuration file attributes;

[0010] If so, the target command set of the switch plug-in is called and sent to the bare metal service network card to configure the port of the bare metal service network card connected to the switch as a virtual local area network stacking type.

[0011] On the one hand, before querying the tenant network type and bare metal network card type through the computing service calling the network service interface, the method further includes:

[0012] Expand the instance creation interface of the computing service;

[0013] The bare metal network card type is set based on the create instance interface.

[0014] On the other hand, adding the bare metal network card type to the binding profile attributes of the network service interface includes:

[0015] Calling the update interface of the network service to add the bare metal network card type to the binding profile attribute of the network service interface.

[0016] On the other hand, before the target command set of calling the switch plug-in is sent to the bare metal service network card, the method further includes:

[0017] adding the target command set to the switch plug-in;

[0018] The target command set includes interface port information, interface link type information, tunnel information, virtual local area network interface default value information and segment identification number.

[0019] On the other hand, if it is determined through the universal switch driver that the key-value element of the port aggregation interface does not exist in the binding configuration file attributes, the method further includes:

[0020] The port insertion network command set of the switch plug-in is called and sent to the bare metal service network card to connect the bare metal to the switch.

[0021] On the other hand, if the tenant network type is not the virtual local area network, or the bare metal network card type is not the port aggregation interface, the method further includes:

[0022] Skip the step of adding the bare metal network card type to the binding profile attributes of the network service interface, and proceed to the step of determining whether the key value element of the port aggregation interface exists in the binding profile attributes through a universal switch driver.

[0023] On the other hand, after the bare metal is connected to the switch, the method further includes:

[0024] Output a prompt message indicating that the bare metal has been connected to the switch.

[0025] To solve the above technical problems, the present application also provides a bare metal tenant isolation device, comprising:

[0026] A query module is used to query the tenant network type and bare metal network card type by calling the network service interface through the computing service during the bare metal deployment process; wherein the bare metal network card type includes an access interface and a port aggregation interface;

[0027] An adding module, configured to add the bare metal network card type to the binding profile attribute of the network service interface if the tenant network type is a virtual local area network and the bare metal network card type is a port aggregation interface;

[0028] A judgment module, configured to judge whether a key value element of the port aggregation interface exists in the binding configuration file attributes through a universal switch driver; if so, triggering a calling module;

[0029] The calling module is used to call the target command set of the switch plug-in and send it to the bare metal service network card to configure the port of the bare metal service network card connected to the switch as a virtual local area network stacking type.

[0030] To solve the above technical problems, the present application also provides a bare metal tenant isolation device, including:

[0031] memory for storing computer programs;

[0032] A processor is used to implement the steps of the above-mentioned bare metal tenant isolation method when executing the computer program.

[0033] In order to solve the above technical problems, the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned bare metal tenant isolation method are implemented.

[0034] The bare metal tenant isolation method provided in the present application queries the tenant network type and bare metal network card type through the computing service calling the network service interface during the bare metal deployment process; wherein the bare metal network card type includes an access interface and a port aggregation interface; if the tenant network type is a virtual LAN and the bare metal network card type is a port aggregation interface, the bare metal network card type is added to the binding profile attribute of the network service interface; the general switch driver is used to determine whether there is a key-value element of the port aggregation interface in the binding profile attribute; if so, the target command set of the switch plug-in is called and sent to the bare metal business network card to configure the port connected to the switch on the bare metal business network card as a virtual LAN stacking type. Therefore, we can see that the above solution configures the bare metal service network card as a port aggregation interface during the bare metal deployment process, so that the network card interface supports the passage of multiple virtual LAN tagged packets; at the same time, based on the QinQ VLAN in VLAN encapsulation mode, the port is configured as the virtual LAN stacking type, the outer VLAN is the VLAN number of the cloud platform, and the inner VLAN is encapsulated by the bare metal service itself. Therefore, when multiple tenants use different virtual LANs to create cloud physical machines and configure them as port aggregation interfaces, the QinQ outer VLANs configured on the ports after bare metal deployment are different, avoiding port aggregation interface conflicts between tenants and achieving isolation of port aggregation interfaces between multiple tenants.

[0035] In addition, the embodiments of the present application also provide a bare metal tenant isolation device, equipment and medium, with the same effect as above. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0037] Figure 1 A schematic diagram of a multi-tenant bare metal application provided in an embodiment of the present application;

[0038] Figure 2 A flowchart of a bare metal tenant isolation method provided in an embodiment of the present application;

[0039] Figure 3 A schematic diagram of the bare metal deployment process provided in an embodiment of the present application;

[0040] Figure 4 A schematic diagram of a bare metal tenant isolation device provided in an embodiment of the present application;

[0041] Figure 5 A schematic diagram of a bare metal tenant isolation device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0043] The core of this application is to provide a bare metal tenant isolation method, device, equipment and medium to achieve multi-tenant VLAN network isolation in a bare metal virtualization scenario.

[0044] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0045] OpenStack is currently the largest open source cloud computing infrastructure project. Its Bare Metal Service (Ironic) project is responsible for the lifecycle management of bare metal nodes. A bare metal can be registered as an Ironic Node, which is the mapping object of the bare metal in Ironic. The Bare Metal Service uses the Intelligent Platform Management Interface (IPMI) protocol to manage power on and off, and configures boot devices in the Basic Input Output System (BIOS). This allows the bare metal to be booted using the Preboot eXecution Environment (PXE) or locally.

[0046] In specific implementation, after the bare metal is registered into the Bare Metal Service by the administrator, the Bare Metal Service can perform inspection operations on the bare metal to collect hardware information, including the Central Processing Unit (CPU), memory, disk, and network card connection information (the switch port information connected to each bare metal network port, that is, the switch host name and port number). After collection, the bare metal can be set to an available state for users to create bare metal instance deployment systems.

[0047] Currently, the service network for bare metal instances supports traditional VLAN, VXLAN, and Geneve networks. Traditional VLAN networks are widely used in private clouds. After deployment, the bare metal uplink port is configured with the VLAN number corresponding to the service network and the interface type is an access interface. In this switch configuration, because the switch interface only supports receiving UNTAG packets on the access interface, the bare metal service network interface card can only send UNTAG packets. Bare metal virtualization scenarios are not supported, which require multi-tenant VLAN network isolation.

[0048] Figure 1 This is a schematic diagram of a multi-tenant application for bare metal provided in this application embodiment. Figure 1 As shown, tenant A and tenant B have applied for 3 bare metal machines on the cloud platform respectively. To deploy an OpenStack cluster based on bare metal, it is necessary to use the bare metal as a computing node and create some virtual machines on the bare metal. The virtual machines use VLAN type networks, and the virtual machine messages under different VLAN networks will have different VLAN tags when they leave the bare metal service interface. The bare metal service interface needs to open the VLAN type network range customized by tenant A and tenant B, and the VLAN ranges under the two tenants may overlap, so they need to be isolated. In view of the above problems, the embodiment of the present application provides a bare metal tenant isolation method to achieve multi-tenant VLAN network isolation in a bare metal virtualization scenario. It can be understood that the method provided by the embodiment of the present application is applied to the application scenario of bare metal deployment.

[0049] Figure 2 This is a flowchart of a bare metal tenant isolation method provided in an embodiment of the present application. Figure 2 As shown, the method includes:

[0050] S10: During the bare metal deployment process, the computing service calls the network service interface to query the tenant network type and bare metal network card type.

[0051] Bare metal network card types include access interfaces and port aggregation interfaces.

[0052] Figure 3 This is a schematic diagram of the bare metal deployment process provided in this application embodiment. Figure 3As shown in the figure, during bare metal deployment, the user specifies the flavor ID and VLAN network ID to call the Compute service (Nova) to create an instance. The OpenStack Compute service, Nova, is responsible for scheduling and lifecycle management of host instances across the entire cloud platform. When the Compute service, Nova, receives the creation request, it selects a bare metal Ironic node that matches the specified flavor from the available bare metal managed by the Bare Metal service, Ironic.

[0053] Furthermore, the Compute service Nova calls the Network service (Neutron) interface to create an interface (port) for the user-specified tenant VLAN network. Network service Neutron receives the request and creates an outbound port, randomly assigning an Internet Protocol (IP) and Message Authentication Code (MAC) address.

[0054] It should be noted that in this embodiment, the interaction process between the computing service Nova and the network service Neutron is optimized: when the computing service Nova calls the network service Neutron to allocate a port for the user's selected network, the computing service Nova first calls the network service Neutron interface to query the tenant network type and bare metal network card type. Among them, the bare metal network card type includes access interface (Access) and port aggregation interface (Trunk). Access and Trunk are concepts in the standard switch field and are the types of switch ports. Access type switch ports only support the passage of UNTAG messages; Trunk type switch ports support the passage of multiple messages with VLAN tags.

[0055] In addition, to set the type for the bare metal interface, in specific implementation, it is necessary to extend the Create Instance interface (Instance) of the Compute service Nova and set the bare metal network card type (baremetal_nic_type) based on the Create Instance interface. This parameter can specify whether the bare metal interface type is Access or Trunk. The default is Access.

[0056] S11: If the tenant network type is VLAN and the bare metal network card type is a trunk interface, add the bare metal network card type to the binding profile properties of the network service interface.

[0057] Furthermore, if the tenant network type is a virtual local area network (VLAN) and the bare metal network card type baremetal_nic_type is a port aggregation interface (Trunk), add the bare metal network card type "bm_nic_type"="trunk" to the binding profile attribute binding:profile of the network service interface port.

[0058] In some embodiments, the bare metal network card type is added to the binding profile attributes of the network service interface, specifically by calling the update port of the network service Neutron to add the bare metal network card type to the binding profile attributes of the network service interface. In addition, in some embodiments, if the tenant network type is not a virtual local area network (VLAN) or the bare metal network card type is not a port trunking interface, step S11 is skipped and the process proceeds directly to step S12.

[0059] S12: Determine, through the universal switch driver, whether there is a key-value element of the port aggregation interface in the binding configuration file attributes; if so, proceed to step S13.

[0060] like Figure 3 As shown in the figure, after the Compute service Nova calls the network service interface to create the interface port of the user-specified tenant VLAN network, the Compute service Nova calls the Bare Metal service Ironic interface to trigger the Bare Metal service Ironic to install and deploy the system on the selected bare metal.

[0061] Specifically, the bare metal service Ironic first calls the network service Neutron to create an interface and create a port for deploying the network; then it calls the update interface to set the binding:host_id attribute of this port to the universally unique identifier (Universally Unique Identifier, UUID) of the Ironic Node, and updates the network card connection information collected during the inspection phase to the binding profile (binding_profile) field of this port.

[0062] When processing this binding update, Networking Neutron uses the generic switch driver to perform the binding operation. It connects to the switch specified in the connection information via Secure Shell (SSH) and configures the switch port in the connection information to the VLAN segment number of the VLAN network to which the interface port belongs. Note that this step switches the bare metal service NIC to the deployment network. Furthermore, the generic switch driver, a Layer 2 driver for Networking Neutron in the OpenStack community, is used to connect to generic Ethernet switches and distribute bare metal interface port configurations during bare metal deployments.

[0063] Note that in this embodiment, the optimized universal switch driver can be set to QinQ mode when binding bare metal ports. QinQ stands for stacked virtual local area networks, also known as stacked VLANs or double VLANs. Derived from the IEEE 802.1ad standard, it is a technology for expanding the VLAN space. It encapsulates a user's private network VLAN tag within a public network VLAN tag, allowing packets to traverse the carrier's backbone network with two VLAN tags.

[0064] Specifically, in the bind_port method of the generic switch driver generic swtich, it is determined whether there is a key-value element (key, value) of the port aggregation interface "bm_nic_type"="trunk" in the binding profile attribute binding:profile of the port. If so, the process proceeds to S13.

[0065] S13: Invoke the target command set of the switch plug-in and send it to the bare metal service network card to configure the port connected to the switch on the bare metal service network card as a virtual local area network stacking type.

[0066] In specific implementations, when the generic switch driver's bind_port method determines that the binding:profile attribute of the interface port contains a key-value element (key, value) with the port trunk interface "bm_nic_type" = "trunk", the switch plugin invokes the target command set and sends it to the bare metal service network interface card (BMI) to configure the port connected to the switch as a VLAN stacking type (QinQ). It's important to note that bind_port is a method that ML2 drivers inheriting from Network Services Neutron must implement; when this method is set in the binding;host_id attribute of a port, Network Services Neutron calls the bind_port method of each driver to perform the binding.

[0067] Specifically, a target command set needs to be added to the switch plug-in, specifically "PLUG_PORT_TO_QINQ_NETWORK." In some embodiments, the target command set includes interface port information, interface link type information, tunnel information, virtual local area network interface default value information, and segmentation identification number, specifically "interface{port}", "port link-type dot1q-tunnel", and "port default vlan{segmentation_id}."

[0068] In addition, in some embodiments, if it is determined through the generic switch driver generic swtich that the key-value element (key, value) of the trunk interface "bm_nic_type"="trunk" does not exist in the binding profile attribute binding:profile, the following may also be included:

[0069] S14: The switch plug-in invokes the port insertion network command set and sends it to the bare metal service network interface card (NIC) to connect the bare metal to the switch. The port insertion network command set is "PLUG_PORT_TO_NETWORK." After the bare metal is connected to the switch, a prompt message is displayed to inform the user that the bare metal has been connected to the switch.

[0070] This completes the process of optimizing the generic switch driver for QinQ mode when binding bare metal ports. The bare metal service Ironic then writes the PXE system image to the physical disk. After the disk write is complete, the Bare Metal service Ironic deletes the deployment network interface and updates the Neutronport network service interface for the tenant network, which is a VLAN type created by the Compute service Nova. This interface also writes the bare metal service network port connection information to the binding details. At this point, the network service Neutron uses the generic switch driver to switch the bare metal service network port to the tenant network's VLAN, completing the bare metal deployment.

[0071] In this embodiment, during the bare metal deployment process, the computing service calls the network service interface to query the tenant network type and the bare metal network card type; wherein, the bare metal network card type includes an access interface and a port aggregation interface; if the tenant network type is a virtual LAN and the bare metal network card type is a port aggregation interface, the bare metal network card type is added to the binding profile attribute of the network service interface; the general switch driver is used to determine whether there is a key value element of the port aggregation interface in the binding profile attribute; if so, the target command set of the switch plug-in is called and sent to the bare metal business network card to configure the port connected to the switch on the bare metal business network card as a virtual LAN stacking type. Therefore, we can see that the above solution configures the bare metal service network card as a port aggregation interface during the bare metal deployment process, so that the network card interface supports the passage of multiple virtual LAN tagged packets; at the same time, based on the QinQ VLAN in VLAN encapsulation mode, the port is configured as the virtual LAN stacking type, the outer VLAN is the VLAN number of the cloud platform, and the inner VLAN is encapsulated by the bare metal service itself. Therefore, when multiple tenants use different virtual LANs to create cloud physical machines and configure them as port aggregation interfaces, the QinQ outer VLANs configured on the ports after bare metal deployment are different, avoiding port aggregation interface conflicts between tenants and achieving isolation of port aggregation interfaces between multiple tenants.

[0072] In the above embodiments, the bare metal tenant isolation method is described in detail, and the present application also provides corresponding embodiments of the bare metal tenant isolation device.

[0073] Figure 4 This is a schematic diagram of a bare metal tenant isolation device provided in an embodiment of the present application. Figure 4 As shown, the bare metal tenant isolation unit includes:

[0074] The query module 10 is used to query the tenant network type and bare metal network card type by calling the network service interface through the computing service during the bare metal deployment process; wherein the bare metal network card type includes the access interface and the port aggregation interface.

[0075] The adding module 11 is configured to add the bare metal network card type to the binding profile attribute of the network service interface if the tenant network type is a virtual local area network and the bare metal network card type is a port aggregation interface.

[0076] The judgment module 12 is used to judge whether there is a key value element of the port aggregation interface in the binding configuration file attribute through the general switch driver; if so, trigger the calling module.

[0077] The calling module 13 is configured to call the target command set of the switch plug-in and send it to the bare metal service network card to configure the port of the bare metal service network card connected to the switch as a virtual local area network stacking type.

[0078] As a preferred embodiment, the present invention further comprises:

[0079] Extension module, used to extend the instance creation interface of computing services;

[0080] The settings module is used to set the bare metal network card type based on the instance creation interface.

[0081] As a preferred embodiment, the adding module includes:

[0082] The network card type adding module is used to call the update interface of the network service to add the bare metal network card type to the binding configuration file properties of the network service interface.

[0083] As a preferred embodiment, the present invention further comprises:

[0084] The command set adding module is used to add the target command set to the switch plug-in;

[0085] The target command set includes interface port information, interface link type information, tunnel information, virtual local area network interface default value information and segment identification number.

[0086] As a preferred embodiment, the present invention further comprises:

[0087] The sending module is used to call the port insertion network command set of the switch plug-in and send it to the bare metal service network card to connect the bare metal to the switch if it is determined through the general switch driver that the key value element of the port aggregation interface does not exist in the binding configuration file attribute.

[0088] As a preferred embodiment, the present invention further comprises:

[0089] The switching module is used to skip the step of adding the bare metal network card type to the binding profile attributes of the network service interface if the tenant network type is not a virtual LAN, or the bare metal network card type is not a port aggregation interface, and enter the step of determining whether there is a key value element of the port aggregation interface in the binding profile attributes through the general switch driver.

[0090] As a preferred embodiment, the present invention further comprises:

[0091] The output module is used to output a prompt message indicating that the bare metal device has been connected to the switch after the bare metal device is connected to the switch.

[0092] In this embodiment, the bare metal tenant isolation device includes a query module, an adding module, a judgment module and a calling module. The bare metal tenant isolation device can implement all the steps of the above-mentioned bare metal tenant isolation method when running. During the bare metal deployment process, the network service interface is called by the computing service to query the tenant network type and the bare metal network card type; wherein, the bare metal network card type includes an access interface and a port aggregation interface; if the tenant network type is a virtual LAN and the bare metal network card type is a port aggregation interface, the bare metal network card type is added to the binding profile attribute of the network service interface; the general switch driver is used to determine whether there is a key value element of the port aggregation interface in the binding profile attribute; if so, the target command set of the switch plug-in is called and sent to the bare metal business network card to configure the port connected to the switch on the bare metal business network card as a virtual LAN stacking type. Therefore, we can see that the above solution configures the bare metal service network card as a port aggregation interface during the bare metal deployment process, so that the network card interface supports the passage of multiple virtual LAN tagged packets; at the same time, based on the QinQ VLAN in VLAN encapsulation mode, the port is configured as the virtual LAN stacking type, the outer VLAN is the VLAN number of the cloud platform, and the inner VLAN is encapsulated by the bare metal service itself. Therefore, when multiple tenants use different virtual LANs to create cloud physical machines and configure them as port aggregation interfaces, the QinQ outer VLANs configured on the ports after bare metal deployment are different, avoiding port aggregation interface conflicts between tenants and achieving isolation of port aggregation interfaces between multiple tenants.

[0093] Figure 5 This is a schematic diagram of a bare metal tenant isolation device provided in an embodiment of the present application. Figure 5 As shown, the bare metal tenant isolation device includes:

[0094] The memory 20 is used to store computer programs.

[0095] The processor 21 is used to implement the steps of the bare metal tenant isolation method mentioned in the above embodiment when executing the computer program.

[0096] The bare metal tenant isolation device provided in this embodiment may include but is not limited to a smartphone, a tablet computer, a laptop computer, or a desktop computer.

[0097] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one hardware form of a digital signal processor (DSP), a field programmable gate array (FPGA), and a programmable logic array (PLA). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a graphics processing unit (GPU), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an artificial intelligence (AI) processor, which is used to process computing operations related to machine learning.

[0098] The memory 20 may include one or more computer-readable storage media, which may be non-transitory. The memory 20 may also include high-speed random access memory, and non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 20 is at least used to store the following computer program 201, wherein, after the computer program is loaded and executed by the processor 21, it can implement the relevant steps of the bare metal tenant isolation method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 20 may also include an operating system 202 and data 203, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 202 may include Windows, Unix, Linux, etc. The data 203 may include but is not limited to data involved in the bare metal tenant isolation method.

[0099] In some embodiments, the bare metal tenant isolation device may also include a display screen 22, an input and output interface 23, a communication interface 24, a power supply 25 and a communication bus 26.

[0100] Those skilled in the art will understand that Figure 5 The structure shown in does not constitute a limitation of the bare metal tenant isolation device and may include more or fewer components than shown.

[0101] In this embodiment, the bare metal tenant isolation device includes a memory and a processor. The memory is used to store computer programs. The processor is used to implement the steps of the bare metal tenant isolation method mentioned in the above embodiment when executing the computer program. During the bare metal deployment process, the network service interface is called by the computing service to query the tenant network type and the bare metal network card type; wherein, the bare metal network card type includes an access interface and a port aggregation interface; if the tenant network type is a virtual LAN and the bare metal network card type is a port aggregation interface, the bare metal network card type is added to the binding profile attribute of the network service interface; the general switch driver is used to determine whether there is a key value element of the port aggregation interface in the binding profile attribute; if so, the target command set of the switch plug-in is called and sent to the bare metal business network card to configure the port connected to the switch on the bare metal business network card as a virtual LAN stacking type. Therefore, we can see that the above solution configures the bare metal service network card as a port aggregation interface during the bare metal deployment process, so that the network card interface supports the passage of multiple virtual LAN tagged packets; at the same time, based on the QinQ VLAN in VLAN encapsulation mode, the port is configured as the virtual LAN stacking type, the outer VLAN is the VLAN number of the cloud platform, and the inner VLAN is encapsulated by the bare metal service itself. Therefore, when multiple tenants use different virtual LANs to create cloud physical machines and configure them as port aggregation interfaces, the QinQ outer VLANs configured on the ports after bare metal deployment are different, avoiding port aggregation interface conflicts between tenants and achieving isolation of port aggregation interfaces between multiple tenants.

[0102] Finally, the present application also provides an embodiment corresponding to a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps described in the above method embodiment.

[0103] It is understandable that if the method in the above embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and executes all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0104] In this embodiment, a computer program is stored on a computer-readable storage medium, and when the computer program is executed by a processor, the steps described in the above method embodiment are implemented. During the bare metal deployment process, the computing service calls the network service interface to query the tenant network type and the bare metal network card type; wherein the bare metal network card type includes an access interface and a port aggregation interface; if the tenant network type is a virtual local area network (VLAN) and the bare metal network card type is a port aggregation interface, the bare metal network card type is added to the binding profile attributes of the network service interface; the general switch driver is used to determine whether there is a key value element of the port aggregation interface in the binding profile attributes; if so, the target command set of the switch plug-in is called and sent to the bare metal business network card to configure the port connected to the switch on the bare metal business network card to the virtual local area network stacking type. Therefore, we can see that the above solution configures the bare metal service network card as a port aggregation interface during the bare metal deployment process, so that the network card interface supports the passage of multiple virtual LAN tagged packets; at the same time, based on the QinQ VLAN in VLAN encapsulation mode, the port is configured as the virtual LAN stacking type, the outer VLAN is the VLAN number of the cloud platform, and the inner VLAN is encapsulated by the bare metal service itself. Therefore, when multiple tenants use different virtual LANs to create cloud physical machines and configure them as port aggregation interfaces, the QinQ outer VLANs configured on the ports after bare metal deployment are different, avoiding port aggregation interface conflicts between tenants and achieving isolation of port aggregation interfaces between multiple tenants.

[0105] The above is a detailed introduction to a bare metal tenant isolation method, device, equipment and medium provided by the present application. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of this application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of this application.

[0106] It should also be noted that, in this specification, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

Claims

1. A bare metal tenant isolation method, characterized in that: include: During bare metal deployment, the computing service calls the network service interface to query the tenant network type and bare metal network card type; wherein the bare metal network card type includes an access interface and a port aggregation interface; If the tenant network type is a virtual local area network and the bare metal network card type is a port aggregation interface, add the bare metal network card type to the binding profile attributes of the network service interface; Determining, by a general switch driver, whether a key-value element of the port aggregation interface exists in the binding configuration file attributes; If so, the target command set of the switch plug-in is called and sent to the bare metal service network card to configure the port of the bare metal service network card connected to the switch as a virtual local area network stacking type.

2. The bare metal tenant isolation method according to claim 1, characterized in that: Before calling the network service interface through the computing service to query the tenant network type and bare metal network card type, the method further includes: Expand the instance creation interface of the computing service; The bare metal network card type is set based on the create instance interface.

3. The bare metal tenant isolation method according to claim 1, characterized in that: Adding the bare metal network card type to the binding profile attributes of the network service interface includes: Calling the update interface of the network service to add the bare metal network card type to the binding profile attribute of the network service interface.

4. The bare metal tenant isolation method according to claim 1, characterized in that: Before the target command set for calling the switch plug-in is sent to the bare metal service network card, the method further includes: adding the target command set to the switch plug-in; The target command set includes interface port information, interface link type information, tunnel information, virtual local area network interface default value information and segment identification number.

5. The bare metal tenant isolation method according to claim 1, characterized in that: If it is determined through the universal switch driver that the key value element of the port aggregation interface does not exist in the binding configuration file attributes, the method further includes: The port insertion network command set of the switch plug-in is called and sent to the bare metal service network card to connect the bare metal to the switch.

6. The bare metal tenant isolation method according to claim 5, characterized in that: If the tenant network type is not the virtual local area network, or the bare metal network card type is not the port aggregation interface, the method further includes: Skip the step of adding the bare metal network card type to the binding profile attributes of the network service interface, and proceed to the step of determining whether the key value element of the port aggregation interface exists in the binding profile attributes through a universal switch driver.

7. The bare metal tenant isolation method according to claim 5, characterized in that: After the bare metal is connected to the switch, the method further includes: Output a prompt message indicating that the bare metal has been connected to the switch.

8. A bare metal tenant isolation device, characterized in that: include: A query module is used to query the tenant network type and bare metal network card type by calling the network service interface through the computing service during the bare metal deployment process; wherein the bare metal network card type includes an access interface and a port aggregation interface; An adding module, configured to add the bare metal network card type to the binding profile attribute of the network service interface if the tenant network type is a virtual local area network and the bare metal network card type is a port aggregation interface; A judgment module, configured to judge whether a key value element of the port aggregation interface exists in the binding configuration file attributes through a universal switch driver; if so, triggering a calling module; The calling module is used to call the target command set of the switch plug-in and send it to the bare metal service network card to configure the port of the bare metal service network card connected to the switch as a virtual local area network stacking type.

9. A bare metal tenant isolation device, characterized in that: include: memory for storing computer programs; A processor, configured to implement the steps of the bare metal tenant isolation method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the bare metal tenant isolation method according to any one of claims 1 to 7.

Images