Network system, network working node, network management and control, and network isolation method

Abstract

This invention provides a network system, a network worker node, network management and control, and a network isolation method. The network system includes: a container network server interface deployed within the network worker node; the container network server interface is used to: create a corresponding identifier for the container when a container is created within the network worker node, request network management to create a virtual network interface card (NIC) corresponding to the container, and send a virtual port creation request generated based on the virtual NIC and identifier to network management; the first communication port of the virtual NIC is associated with the main namespace of the network system's operating system, and the second communication port of the virtual NIC is associated with the container's namespace; network management is used to create virtual ports according to the virtual port creation request, assign IP addresses to the virtual ports, and feed back the IP addresses to the container network server interface; and a virtual infrastructure network is used to process network data based on the identifier information and IP address of the virtual NIC. This invention can achieve network security isolation.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network system, network worker nodes, network management and control, and network isolation method. Background Technology

[0002] Cloud computing is an internet-based computing approach that allows shared hardware and software resources and information to be provided to computers and other devices on demand. Kubernetes (K8S) is an open-source technology used to manage containerized applications across multiple hosts in a cloud platform. Widely used in cloud computing environments, it is a key technology in the cloud-native field.

[0003] Currently, when multiple tenants share a Kubernetes cluster, secure network isolation cannot be achieved. Summary of the Invention

[0004] This invention provides a network system, network worker nodes, network management and control, and network isolation method to solve the problem that Kubernetes clusters cannot achieve secure network isolation.

[0005] To solve the above problems, the present invention is implemented as follows:

[0006] In a first aspect, embodiments of the present invention provide a network system, the network system comprising: a container network server interface, network management and control, and a virtual infrastructure network;

[0007] The container network server interface is deployed within the network worker node. The container network server interface is used to: create a corresponding identifier for the container when a container is created within the network worker node, request the network management to create a virtual network interface card (NIC) corresponding to the container, and send a virtual port creation request generated based on the virtual NIC and the identifier to the network management. The virtual NIC and the identifier are in one-to-one correspondence. The first communication port of the virtual NIC is associated with the main namespace of the operating system of the network system, and the second communication port of the virtual NIC is associated with the namespace of the container.

[0008] The network management is used to create a virtual port according to the virtual port creation request, assign an IP address to the virtual port, and feed back the IP address to the container network server interface;

[0009] The virtual infrastructure network is used to process network data based on the identification information and IP address of the virtual network interface card.

[0010] Secondly, embodiments of the present invention provide a network working node, including:

[0011] The network worker node is equipped with a container network server interface and at least one container. When the container is created within the network worker node, the container network server interface is used to create a corresponding identifier for the container, request the network management system to create a corresponding virtual network interface card (NIC), and send a virtual port creation request generated based on the virtual NIC and the identifier to the network management system. The virtual NIC and the identifier are in one-to-one correspondence. The first communication port of the virtual NIC is associated with the main namespace of the operating system of the network system, and the second communication port of the virtual NIC is associated with the namespace of the container.

[0012] Thirdly, embodiments of the present invention provide a network management system, which is used to: create a virtual network interface corresponding to the container after receiving an instruction to create a virtual network interface sent by a container network server interface, wherein the instruction to create a virtual network interface is generated by the container network server interface when creating the container, and to feed back the information of the virtual network interface to the container network server interface;

[0013] The system receives a virtual port creation request sent by the container network server interface, creates a virtual port according to the virtual port creation request, assigns an IP address to the virtual port, and feeds back the IP address to the container network server interface. The virtual port creation request is generated by the container network server interface based on the container's virtual network interface card and identifier.

[0014] Fourthly, embodiments of the present invention provide a network isolation method, the network isolation method comprising:

[0015] When a container is created within the network worker node, the container network server interface creates a corresponding identifier for the container and requests the network management system in the network system to create a corresponding virtual network interface card.

[0016] The container network server interface will generate a virtual port creation request based on the virtual network interface card and the identifier and send it to the network management system. The virtual network interface card and the identifier are in one-to-one correspondence. One end of the virtual network interface card is located in the main namespace of the operating system of the network system, and the other end is located in the namespace of the corresponding container.

[0017] The network management system creates a virtual port based on the virtual port creation request, assigns an IP address to the virtual port, and then sends the IP address back to the container network server interface.

[0018] The virtual basic network processes network data based on the identification information and IP address of the virtual network interface card.

[0019] Fifthly, embodiments of the present invention also provide a readable storage medium for storing a program, which, when executed by a processor, implements the steps of the method described in the fourth aspect above.

[0020] This invention deploys a container network server interface within a network worker node. When a container is created within the network worker node, the container network server interface creates a corresponding identifier for the container and requests the network management system to create a virtual network interface card (NIC) corresponding to the container. This generates a dedicated communication channel for the container. The container network server interface generates a virtual port creation request based on the virtual NIC and the identifier and sends it to the network management system. The virtual NIC and the identifier are in one-to-one correspondence. The first communication port of the virtual NIC is associated with the main namespace of the network system's operating system, and the second communication port of the virtual NIC is associated with the container's namespace. Then, the network management system creates a virtual port according to the virtual port creation request, assigns an IP address to the virtual port, and feeds back the IP address to the container network server interface. In this way, the virtual infrastructure network processes network data based on the identifier information and IP address of the virtual NIC. Since each container has a corresponding identifier and virtual NIC, network data can be distinguished during network data processing, thereby identifying the corresponding container and achieving secure isolation of each container network. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a schematic diagram of the structure of a communication system to which embodiments of the present invention can be applied;

[0023] Figure 2 This is one of the schematic diagrams of the network system architecture provided in the embodiments of the present invention;

[0024] Figure 3 This is one of the schematic diagrams of the network system architecture provided in the embodiments of the present invention;

[0025] Figure 4 This is a schematic diagram of the virtual network card creation process provided in an embodiment of the present invention;

[0026] Figure 5 This is one of the schematic diagrams of the flow of multi-tenant shared data provided in the embodiments of the present invention;

[0027] Figure 6 This is one of the schematic diagrams of the flow of multi-tenant shared data provided in the embodiments of the present invention;

[0028] Figure 7This is one of the schematic diagrams of the network worker node provided in the embodiments of the present invention;

[0029] Figure 8 This is a flowchart illustrating the network security isolation method provided in this invention. Detailed Implementation

[0030] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0031] In the embodiments of this invention, the terms "first," "second," etc., are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products, or devices. Additionally, the use of "and / or" in this invention indicates at least one of the connected objects, such as A and / or B and / or C, representing seven possibilities: including A alone, B alone, C alone, both A and B present, both B and C present, both A and C present, and A, B, and C present.

[0032] Please see Figure 1 , Figure 1 This is a structural diagram of a communication system to which embodiments of the present invention can be applied, such as... Figure 1 As shown, it includes a network system 100 and multiple smart devices 200. The network system 100 includes a k8s cluster consisting of multiple network worker nodes 10.

[0033] In this context, multiple network worker nodes 10 belong to a k8s cluster, and each network worker node 10 includes at least one container POD. Each smart device 200, as a tenant, can communicate with one or more containers in any network worker node 10. In other words, multiple smart devices 200, as tenants, can share multiple network worker nodes 10 in the k8s cluster.

[0034] Both the network working node 10 and the smart device 200 can be devices capable of accessing the internet and storing data, such as mobile phones, tablet computers, laptop computers, personal digital assistants (PDAs), mobile internet devices (MIDs), or wearable devices. The network system provided in this embodiment of the invention will be described below.

[0035] See Figure 2 , Figure 2 This is one of the schematic diagrams of the network system architecture provided in the embodiments of the present invention.

[0036] like Figure 2 As shown, the network system 100 may include: a container network server interface 11, network management 20, and a virtual infrastructure network 30;

[0037] The container network server interface 11 is deployed within the network worker node 10. The container network server interface 11 is used to: when creating a container 12 within the network worker node 10, create a corresponding identifier (VID) for the container 12, request the network management system 20 to create a virtual network interface card (VID) corresponding to the container 12, and send a virtual port creation request generated based on the VID and the identifier to the network management system 20. The VID and the identifier are one-to-one. The first communication port of the VID is associated with the main namespace of the operating system of the network system, and the second communication port of the VID is associated with the namespace of the container.

[0038] Specifically, users can create container PODs in network worker nodes 10 (K8S nodes) through the Kubernetes platform, ensuring that each network worker node 10 has at least one container POD. During container creation, the container network server interface 11 creates a corresponding identifier (VID) for the container and requests the network management system 20 to create a virtual network interface card (VNIC) corresponding to the container. After creating the VNIC, the network management system 20 feeds back the VNIC information to the container network server interface 11, thus completing the creation of the VNIC. It should be noted that the VNIC and the identifier are in one-to-one correspondence; one or more containers share a set of VNICs and identifiers. The first communication port of the VNIC is associated with the main namespace of the network system's operating system, and the second communication port is associated with the container's namespace. That is, one end of the VNIC is placed in the main namespace of the network system's operating system, and the other end is placed in the container's namespace, thus establishing a communication channel between the network worker node's master controller and the containers within the network worker node.

[0039] After the virtual network interface card is created, the container network server interface 11 will generate a virtual port creation request based on the virtual network interface card and its identifier and send it to the network management 20.

[0040] Network control 20 is used to create a virtual port according to the virtual port creation request, assign an IP address to the virtual port, and feed back the IP address to the container network server interface 11.

[0041] Specifically, after receiving a creation request to create a virtual port, the network management system 20 creates a virtual port according to the virtual port creation request, assigns an IP address to the virtual port, and feeds back the IP address to the container network server interface 11.

[0042] The virtual basic network 30 is used to process network data based on the identification information and IP address of the virtual network card.

[0043] After creating a virtual network interface card (NIC) and assigning it an IP address, you can use the NIC's identification information and IP address to process network data. This processing can include sending data from inside the container to external terminals, or having external terminals send their data to the container.

[0044] This invention deploys a container network server interface within a network worker node. When a container is created within the network worker node, the container network server interface creates a corresponding identifier for the container and requests the network management system to create a virtual network interface card (NIC) corresponding to the container. This generates a dedicated communication channel for the container. The container network server interface generates a virtual port creation request based on the virtual NIC and the identifier and sends it to the network management system. The virtual NIC and the identifier are in one-to-one correspondence. The first communication port of the virtual NIC is associated with the main namespace of the network system's operating system, and the second communication port of the virtual NIC is associated with the container's namespace. Then, the network management system creates a virtual port according to the virtual port creation request, assigns an IP address to the virtual port, and feeds back the IP address to the container network server interface. In this way, the virtual infrastructure network processes network data based on the identifier information and IP address of the virtual NIC. Since each container has a corresponding identifier and virtual NIC, network data can be distinguished during network data processing, thereby identifying the corresponding container and achieving secure isolation of each container network.

[0045] Optionally, in some embodiments, the container network server interface is used to: when the container is created, the container network server interface sends a virtual network interface card creation request to the network management system through the data server of the network system;

[0046] The network control is used to create a corresponding virtual network interface card (NIC) according to the virtual NIC creation request, and to feed back the information of the virtual NIC to the container network server interface.

[0047] The container network server interface is used to: write the network IP address and identifier of the virtual network interface card into the virtual network interface card of the container, so as to complete the creation of the virtual network interface card.

[0048] Specifically, such as Figure 3 As shown, the network system includes: network worker nodes 10, network management 20, and virtual infrastructure network 30, as well as a Kubernetes platform manager (Kubernetes master).

[0049] Container network server interface 11 is the Tianchi Container Network Interface (TCNI), deployed on the Kubernetes node. It can request Tianchi network management to create virtual network interfaces (veth-pairs). One end of the virtual network interface (veth) houses the operating system's main namespace (the same namespace as the physical network interface), and the other end houses the container's POD namespace. When creating a virtual network interface, TCNI assigns a VID (VLAN ID; different virtual network interfaces on different nodes have different VIDs, but can have the same VID). TCNI maintains the mapping between virtual network interfaces and VIDs locally. Based on the specified network, subnet, and VID, TCNI sends a request to the Tianchi network management service to create a port (virtual port, a virtual network interface within the VPC). Tianchi network assigns an IP address to the port and returns the IP address to TCNI.

[0050] Correspondingly, network control 20 is used to: allocate the physical network address and the network IP address of the virtual network card according to the creation request of the virtual network card.

[0051] Tianchi Network Control (hereinafter referred to as VPC control, or VPC-C for short; Tianchi API server provides VPC-C capability opening services; Tianchi Cache provides data caching services; Tianchi API server and Tianchi Cache together constitute VPC-C) is the management and scheduling system of SDN network. It is responsible for allocating ports (including IPs within VPCs), binding the VID passed from TCNI to the ports, and sending the port information containing the VID to the virtual infrastructure network.

[0052] Virtual Network 30 (vNET) is responsible for the translation of cloud host IP addresses, traffic control, and the generation and distribution of flow tables within the VPC. Specifically, it includes:

[0053] 1. Receive port information from VPC-C, construct a flow table, and populate the flow table with VID information;

[0054] 2. Data is sent from the cloud host with the VID, but the VID is removed when it is sent from vNET to the physical network card;

[0055] 3. Data received from the physical network card does not contain the VID, but the VID is carried when it is sent from vNET to the cloud host.

[0056] Alternatively, in some embodiments, such as Figure 4 As shown, the network control 20 is used for:

[0057] The information of the virtual network card is written into the cache memory to generate a default routing table for the container.

[0058] The container network server interface is also used to: send corresponding event information to the virtual infrastructure network after writing the information of the virtual network card into the cache memory;

[0059] The virtual infrastructure network reads the information of the virtual network card from the cache memory according to the event information, and establishes a mapping relationship between the read virtual network card information and the virtual network card of the network working node.

[0060] Specifically, when Kubernetes creates a container POD, TCNI initiates a virtual network interface card (VNIC) creation request (create_fix_ip) to the VPC-C capability exposure service Tianchi API server through the Kubernetes metadata server proxy, and passes the virtual network interface card information of the Kubernetes node to VPC-C. At the same time, TCNI generates a VID for the virtual network interface card of the container POD. After receiving the request, the Tianchi API server (the Vnet manager) completes the creation of the virtual network interface card (including allocating the virtual network interface card VPC IP address, such as 192.168.100.4 in the figure, and the virtual network interface card physical network address, such as 172.10.111.23 in the figure. The physical network address can only be internally routed in the data).

[0061] The Tianchi API server returns the virtual network interface information to TCNI and simultaneously writes it to the Tianchi Cache. TCNI writes IP address and other information to the container POD's virtual network interface, generates a default routing table for the container POD, and modifies the Kubernetes node's network interface (eth0 in the diagram) to trunk (allowing multiple VLAN data packets to enter the network interface) when creating the first container POD. The container POD's network interface is a sub-interface of the Kubernetes node's network interface. After writing cached data, the Tianchi Cache sends an event to the Tianchi vNET. The Tianchi Agent (a component in vNET that specifically handles cache layer events and data interaction) reads the container POD's virtual network interface information from the Tianchi Cache and writes it to the vNET. (The Tianchi Agent that receives the event sent by the container POD virtual network interface is the same as the vNET Agent where the K8S node is located. This information is obtained through the K8S node virtual network interface information in process a.) and associates and maps the virtual network interface information (vport) of the container POD with the virtual network interface information (vport) of the K8S node. That is, the virtual network interface of the K8S node in the vNET layer and the virtual network interface of the container POD use the same virtualization channel to realize the communication between the vNET and the K8S node network interface.

[0062] The Tianchi Agent processes the virtual network interface card (NIC) information in the Tianchi Cache, and vNET creates a vport (virtual port, used to mount on a virtual switch to complete data transmission between the virtual switch and the Kubernetes node NIC) for the virtual NIC. It then associates the vport with the vport of the Kubernetes node NIC and issues flow table forwarding rules to guide the flow of data into and out of the container POD.

[0063] Optionally, in some embodiments, the virtual infrastructure network 30 is further configured to: upon receiving first data sent by the container, remove the container's identifier from the first data based on preset flow table forwarding rules, and encapsulate it according to the routing and network tunnel of the device receiving the data.

[0064] The virtual infrastructure network 30 is further configured to: upon receiving second data sent from the outside, remove tunnel information from the second data based on a preset flow table forwarding rule, add the identifier of the target container to the second data, and send the second data with the identifier of the target container added to it to the corresponding target container through the virtual network card.

[0065] Specifically, such as Figure 5As shown, VPC-C assigns a fixed IP address (hereinafter referred to as Fix-IP) within the tenant VPC to the container virtual network interface card (NIC), and TCNI assigns a VID to the container virtual network interface card. This means that the container POD addresses of different tenant VPCs on the K8S node may overlap (e.g., ...). Figure 5 (POD4 and POD5 in the example), but the virtual network interface VID of container PODs will not be repeated on the same K8S node (TCNI maintains all VIDs on the K8S node to ensure no conflict, so a maximum of 4095 container PODs can be created on the same node. In this embodiment, the VID is a 12-bit integer number, representing the range 0 to 4095. 0 is reserved for the K8S node virtual network interface. In specific implementations, the number of different types of VIDs can be different).

[0066] During the creation of the container POD virtual network interface, Tianchi vNET issues basic flow table forwarding rules to the virtual network interface. When data is sent out from within the container POD, the container POD virtual network interface adds VID information to the packet (taking POD5 as an example in the figure, VID=5 is added to the packet). The packet passes through the virtual network interface and the virtual switch vport (there is a direct connection between the two) to reach vNET. vNET's flow table forwarding rules match the VID (5) and source IP (192.168.100.4) in the packet. After a match, the VID information in the packet is removed, and routing and Vxlan tunnel encapsulation are performed based on the destination IP according to the virtual switch logic.

[0067] When data flows into the container POD, the packet first arrives at vNET and is matched against the flow table forwarding rules. The matching conditions are VNI (Virtual network Identifier, which uniquely identifies a VPC network, example 100005 in the diagram) and the destination IP of the inner layer packet (inner-dip = 192.168.100.4). If a match is found, the packet tunnel information (unwrap vxlan) is removed, and VID information (vlan tag vid = 5) is added to the packet. Then, the packet is sent to POD5 through vport and virtual network card.

[0068] In this way, data is securely isolated between the container POD and vNET through VID, achieving multi-tenant network isolation.

[0069] Optionally, in some embodiments, the container network server interface 11 is further configured to: when the container is destroyed, invoke the network management system to delete the virtual network interface card information of the container in the virtual infrastructure network.

[0070] Specifically, when a container POD is destroyed, the container network server interface 11 calls the TianchiAPI server in network management 20 to delete the virtual interface and complete the cleanup of vNET side resources.

[0071] Alternatively, in some embodiments, such as Figure 6 As shown, in address lifecycle management, VPC-C assigns a fixed IP address (hereinafter referred to as dummyIP) to the container virtual network interface card. TCNI does not write the dummyIP to the container POD virtual network interface card (it is not visible to the tenant). It only processes the dummyIP in VPC-C and writes it into the basic attributes of the container POD (used by the K8S master service for querying; from the perspective of the K8S master, only the dummyIP of the container POD can be seen).

[0072] The Kubernetes master can be deployed in a data center physical network or as a standalone service in a VPC. When deployed in a VPC (distinguished from the tenant's VPC, i.e., the Kubernetes master service and the container POD belong to different VPCs), the master and POD communicate with each other, but traditional cloud computing technologies cannot resolve POD address conflicts. In this case, the master and POD communicate using dummy IPs (when the master service is deployed in a VPC, the virtual network interface card of the cloud host has a dummy IP attribute value, which needs to be exposed to the master. The difference from a regular tenant VPC is that a regular tenant cannot know its own dummy IP attribute because when a POD actively initiates a master service request, such as for DNS, it needs to obtain the corresponding dummy IP). When the Kubernetes master service is deployed in a data center physical network, the business model is essentially an interoperability between services within the VPC and services on the physical network. This case combines the two forms to provide flexible interoperability.

[0073] During the creation of the container POD virtual network interface, Tianchi vNET issues basic flow table forwarding rules to the virtual network interface. When data is sent out from within the container POD, the container POD virtual network interface adds VID information to the packet (taking POD5 as an example in the diagram, VID=5 is added to the packet). The packet passes through the virtual network interface and the virtual switch vport (there is a direct connection between the two, which is not within the scope of this solution) to reach vNET. vNET's flow table forwarding rules match the VID (5), source IP (192.168.100.4), and destination IP (172.10.0.0 / 16) in the packet. After a match, the VID information in the packet is removed (untag), the source IP address of the packet is converted into a dummy IP (172.10.111.30), and routing and Vxlan tunnel encapsulation are performed based on the destination IP according to the virtual switch logic.

[0074] When data flows into the container POD, the packet first arrives at vNET and is matched against the flow table forwarding rules. The matching conditions are VNI (Virtual network Identifier, which uniquely identifies a VPC network, example 100005 in the diagram) and the destination IP of the inner layer packet (inner-dip = 172.10.111.30). If a match is found, the packet tunnel information is removed (unwrap vxlan), the packet destination IP is modified (192.168.100.4), and VID information (vlan tag vid = 5) is added to the packet. Then, the packet is sent to POD5 through vport and virtual network card.

[0075] During processes c and d, the message will pass through vNET via a gateway service of the Tianchi network (this gateway provides the ability to interconnect the cloud VPC network and the data center physical network, but is not discussed in this case) to complete the physical network routing between dummy IPs.

[0076] It should be noted that the various optional implementation methods described in the embodiments of the present invention can be combined with each other or implemented individually without conflict, and the embodiments of the present invention do not limit this.

[0077] See Figure 7 , Figure 7 This is one of the structural diagrams of a network working node provided in an embodiment of the present invention. For example... Figure 7 As shown, this embodiment provides a network worker node (K8S node), which is equipped with a container network server interface 11 and at least one container 12. The container network server interface is used to create a corresponding identifier for the container when the container is created in the network worker node, request the network management to create a corresponding virtual network interface card, and send a virtual port creation request generated according to the virtual network interface card and the identifier to the network management. The virtual network interface card and the identifier are in one-to-one correspondence. The first communication port of the virtual network interface card is associated with the main namespace of the operating system of the network system, and the second communication port of the virtual network interface card is associated with the namespace of the container.

[0078] In some embodiments, the network worker node is further configured to: when creating the container, the container network server interface sends a virtual network interface card (NIC) creation request to the network management system through the network system's data server, the NIC creation request being used to request the network management system to create a corresponding virtual NIC, and to feed back the information of the virtual NIC to the container network server interface;

[0079] The network IP address and identifier of the virtual network card are written into the virtual network card of the container to complete the creation of the virtual network card.

[0080] In some embodiments, the container network server interface 11 is further configured to: after writing the information of the virtual network interface card into a cache memory, send corresponding event information to the virtual infrastructure network; the event information is used to request the virtual infrastructure network to read the information of the virtual network interface card from the cache memory according to the event information, and to establish a mapping relationship between the read information of the virtual network interface card and the virtual network interface card of the network worker node.

[0081] The network worker nodes can implement the various processes described in the above embodiments of the present invention and achieve the same beneficial effects. To avoid repetition, they will not be described again here.

[0082] This invention also provides a network management system, which is used to: create a virtual network interface card (NIC) corresponding to the container after receiving an instruction to create a virtual NIC from a container network server interface, wherein the instruction to create a virtual NIC is generated by the container network server interface when creating the container, and the virtual NIC information is fed back to the container network server interface.

[0083] The system receives a virtual port creation request sent by the container network server interface, creates a virtual port according to the virtual port creation request, assigns an IP address to the virtual port, and feeds back the IP address to the container network server interface. The virtual port creation request is generated by the container network server interface based on the container's virtual network interface card and identifier.

[0084] In some embodiments, the network control is used to create a corresponding virtual network interface card (NIC) according to the creation request of the virtual NIC, and to feed back the information of the virtual NIC to the container network server interface, so as to request the container network server interface to write the network IP address and identifier of the virtual NIC into the virtual NIC of the container, so as to complete the creation of the virtual NIC.

[0085] In some embodiments, the network control is used to: allocate the physical network address and the network IP address of the virtual network interface card according to the creation request of the virtual network interface card.

[0086] In some embodiments, the network management is used for:

[0087] The information of the virtual network card is written into the cache memory to generate a default routing table for the container.

[0088] Network management can implement the various processes described in the above embodiments of the present invention and achieve the same beneficial effects. To avoid repetition, it will not be described again here.

[0089] See Figure 8 This invention also provides a network isolation method, the network isolation method comprising:

[0090] Step 810: When creating a container within the network worker node, the container network server interface creates a corresponding identifier for the container and requests the network management system in the network system to create a corresponding virtual network interface card.

[0091] Step 820: The container network server interface will generate a virtual port creation request based on the virtual network interface card and the identifier and send it to the network management system. The virtual network interface card and the identifier are in one-to-one correspondence. The first communication port of the virtual network interface card is associated with the main namespace of the operating system of the network system, and the second communication port of the virtual network interface card is associated with the namespace of the container.

[0092] Step 830: The network management system creates a virtual port according to the virtual port creation request, assigns an IP address to the virtual port, and feeds back the IP address to the container network server interface.

[0093] Step 840: The virtual basic network processes network data based on the identification information and IP address of the virtual network card.

[0094] In some embodiments, step 810 specifically includes: when creating the container, the container network server interface sends a virtual network card creation request to the network management system through the data server of the network system;

[0095] The network control is used to create a corresponding virtual network interface card (NIC) according to the virtual NIC creation request, and to feed back the information of the virtual NIC to the container network server interface.

[0096] The container network server interface is used to: write the network IP address and identifier of the virtual network interface card into the virtual network interface card of the container, so as to complete the creation of the virtual network interface card.

[0097] In some embodiments, step 830 specifically includes:

[0098] The network management system allocates the physical network address and the network IP address of the virtual network interface card (NIC) based on the creation request of the virtual NIC.

[0099] In some embodiments, the method further includes:

[0100] The network management system writes the information of the virtual network card into a cache memory to generate a default routing table for the container.

[0101] In some embodiments, the method further includes:

[0102] After writing the information of the virtual network card into the cache memory, the container network server interface sends the corresponding event information to the virtual infrastructure network.

[0103] The virtual infrastructure network reads the information of the virtual network card from the cache memory according to the event information, and establishes a mapping relationship between the read virtual network card information and the virtual network card of the network working node.

[0104] In some embodiments, step 840 further includes:

[0105] Upon receiving the first data sent by the container, the virtual infrastructure network removes the container's identifier from the first data based on preset flow table forwarding rules and encapsulates it according to the routing and network tunnel of the device receiving the data.

[0106] In some embodiments, step 840 further includes:

[0107] Upon receiving the second data sent from the outside, the virtual infrastructure network removes the tunnel information from the second data based on the preset flow table forwarding rules, adds the identifier of the target container to the second data, and sends the second data with the identifier of the target container added to it to the corresponding target container through the virtual network card.

[0108] In some embodiments, the method further includes: when the container is destroyed, the container network server interface calls the network management system to delete the virtual network interface card information of the container in the virtual infrastructure network.

[0109] The network isolation method can implement the various processes of the above embodiments of the present invention and achieve the same beneficial effects. To avoid repetition, it will not be described again here.

[0110] This invention also provides a readable storage medium for storing a program that, when executed by a processor, implements the steps in the network isolation method described above.

[0111] When program 4021 is executed by processor 401, it can achieve the following: Figure 8 Any steps in the corresponding method embodiments and the achievement of the same beneficial effects will not be repeated here.

[0112] Those skilled in the art will understand that all or part of the steps of the methods described in the above embodiments can be implemented by hardware related to program instructions, and the program can be stored in a readable medium. The present invention also provides a readable storage medium storing a computer program, which, when executed by a processor, can implement the above-described methods. Figure 2 Any step in the corresponding method embodiment can achieve the same technical effect, and will not be repeated here to avoid repetition.

[0113] The storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0114] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A network system, characterized in that, The network system includes: container network server interface, network management and control, and virtual infrastructure network; The container network server interface is deployed within the network worker node. When a container is created within the network worker node, the container network server interface is used to: create a corresponding identifier for the container; request the network management system to create a virtual network interface card (NIC) corresponding to the container; and send a virtual port creation request generated based on the virtual NIC and identifier to the network management system. The virtual NIC and the identifier are in one-to-one correspondence, and one or more containers possess a set of virtual NICs and identifiers. The first communication port of the virtual NIC is associated with the main namespace of the network system's operating system, and the second communication port of the virtual NIC is associated with the container's namespace. The network management is used to create a virtual port according to the virtual port creation request, assign an IP address to the virtual port, and feed back the IP address to the container network server interface; The virtual infrastructure network is used to process network data based on the identification information and IP address of the virtual network interface card; The network control is used for: The information of the virtual network card is written into the cache memory to generate a default routing table for the container; The container network server interface is also used to: send corresponding event information to the virtual infrastructure network after writing the information of the virtual network card into the cache memory; The virtual infrastructure network reads the information of the virtual network card from the cache memory according to the event information, and establishes a mapping relationship between the read virtual network card information and the virtual network card of the network working node.

2. The network system according to claim 1, characterized in that, The container network server interface is used to: when the container is created, the container network server interface sends a virtual network interface creation request to the network management system through the data server of the network system; The network control is used to create a corresponding virtual network interface card (NIC) according to the virtual NIC creation request, and to feed back the information of the virtual NIC to the container network server interface. The container network server interface is used to: write the network IP address and identifier of the virtual network interface card into the virtual network interface card of the container, so as to complete the creation of the virtual network interface card.

3. The network system according to claim 2, characterized in that, The network control is used to: allocate the physical network address and the network IP address of the virtual network card according to the creation request of the virtual network card.

4. The network system according to claim 1, characterized in that, The virtual infrastructure network is further configured to: upon receiving the first data sent by the container, remove the container's identifier from the first data based on a preset flow table forwarding rule, and encapsulate it according to the routing and network tunnel of the device receiving the data.

5. The network system according to claim 1, characterized in that, The virtual infrastructure network is further configured to: upon receiving second data sent from the outside, remove tunnel information from the second data based on a preset flow table forwarding rule, add the identifier of the target container to the second data, and send the second data with the identifier of the target container added to it to the corresponding target container through the virtual network card.

6. The network system according to any one of claims 1-5, characterized in that, The container network server interface is also used to: when the container is destroyed, call the network management system to delete the virtual network interface card information of the container in the virtual infrastructure network.

7. A network worker node, characterized in that, The network worker node is equipped with a container network server interface and at least one container. The container network server interface is used to create a corresponding identifier for the container when the container is created within the network worker node, request the network management system to create a corresponding virtual network interface card (NIC), and send a virtual port creation request generated based on the virtual NIC and the identifier to the network management system. The virtual NIC and the identifier are in one-to-one correspondence, and one or more containers have a set of virtual NICs and identifiers. The first communication port of the virtual NIC is associated with the main namespace of the network system's operating system, and the second communication port of the virtual NIC is associated with the container's namespace. The container network server interface is further configured to: after writing the information of the virtual network interface card into the cache memory, send corresponding event information to the virtual infrastructure network; the event information is used to request the virtual infrastructure network to read the information of the virtual network interface card from the cache memory according to the event information, and establish a mapping relationship between the read information of the virtual network interface card and the virtual network interface card of the network worker node.

8. The network working node according to claim 7, characterized in that, The network worker node is further configured to: when creating the container, the container network server interface sends a virtual network interface card creation request to the network management system through the network system's data server, the virtual network interface card creation request is used to request the network management system to create a corresponding virtual network interface card, and feed back the information of the virtual network interface card to the container network server interface; The network IP address and identifier of the virtual network card are written into the virtual network card of the container to complete the creation of the virtual network card.

9. A network control system, characterized in that, The network management is configured to: upon receiving an instruction from the container network server interface to create a virtual network interface, create a virtual network interface corresponding to the container; the instruction to create a virtual network interface is generated by the container network server interface when creating the container, and the virtual network interface information is fed back to the container network server interface; one or more containers have a set of virtual network interfaces and identifiers; the identifier is a corresponding identifier created by the container network server interface for the container when creating the container within the network worker node; the virtual network interface and the identifier are in one-to-one correspondence; Receive a virtual port creation request sent by the container network server interface, create a virtual port according to the virtual port creation request, and assign an IP address to the virtual port; The IP address is then fed back to the container network server interface, and the virtual port creation request is generated by the container network server interface based on the container's virtual network interface card and identifier. The network control is used for: The information of the virtual network card is written into the cache memory to generate a default routing table for the container.

10. The network control according to claim 9, characterized in that, The network control is used to create a corresponding virtual network interface card (NIC) according to the creation request of the virtual NIC, and to feed back the information of the virtual NIC to the container network server interface, so as to request the container network server interface to write the network IP address and identifier of the virtual NIC into the virtual NIC of the container, so as to complete the creation of the virtual NIC.

11. The network control according to claim 10, characterized in that, The network control is used to: allocate the physical network address and the network IP address of the virtual network card according to the creation request of the virtual network card.

12. A network isolation method, characterized in that, The network isolation method includes: When a container is created within a network worker node, the container network server interface creates a corresponding identifier for the container and requests the network management system in the network system to create a corresponding virtual network interface card. The container network server interface will generate a virtual port creation request based on the virtual network interface card and the identifier and send it to the network management system. The virtual network interface card and the identifier are in one-to-one correspondence. One or more containers have a set of virtual network interface cards and identifiers. The first communication port of the virtual network interface card is associated with the main namespace of the operating system of the network system, and the second communication port of the virtual network interface card is associated with the namespace of the container. The network management system creates a virtual port based on the virtual port creation request, assigns an IP address to the virtual port, and then sends the IP address back to the container network server interface. The virtual infrastructure network processes network data based on the identification information and IP address of the virtual network interface card (NIC). The network control is used to write the information of the virtual network card into a cache memory to generate a default routing table for the container; The container network server interface is also used to send corresponding event information to the virtual infrastructure network after writing the information of the virtual network card into the cache memory; The virtual infrastructure network reads the information of the virtual network card from the cache memory according to the event information, and establishes a mapping relationship between the read virtual network card information and the virtual network card of the network working node.

13. A readable storage medium for storing a program, characterized in that, When the program is executed by the processor, it implements the steps in the network isolation method as described in claim 12.

Images