A method and system for configuring a VPC multi-availability zone isolated FIP network

Abstract

The present application relates to computer network technical field, specifically for a kind of configuration VPC multi-availability zone isolation FIP network method and system, comprising the following steps: in product configuration file, the FIP network name corresponding to VPC multi-availability zone is configured;Tenant logs in console interface, click to create virtual machine private network, select the availability zone of VPC, create VPC under two availability zones;Tenant logs in console interface, check virtual private network list;Tenant logs in console interface, create elastic network card;Beneficial effect is: the configuration VPC multi-availability zone isolation FIP network method and system proposed in the present application, when VPC is created in virtual private network console, availability zone is selected, and the corresponding FIP network is obtained according to availability zone.The subnet availability zone under VPC is consistent with the selected VPC availability zone by default.Different FIP networks in different availability zones are realized by configuring different FIP networks under VPC multi-availability zone, and cloud resources in the same availability zone can be interconnected through FIP network.

Description

Technical Field

[0001] This invention relates to the field of computer network technology, specifically to a method and system for configuring a VPC multi-availability zone isolated FIP network. Background Technology

[0002] Currently, various industries are gradually integrating their business systems through cloud computing platforms. For security reasons, they can all use VPC technology for secure isolation on the network. VPC stands for Virtual Private Cloud. VPC technology allows tenants to have a logically isolated area in the cloud from other tenants and use various cloud resources in this area. Tenants can have complete control over the virtual network in the cloud.

[0003] In existing technologies, there is usually only one FIP network within a region by default, and cloud resources can communicate with each other through the FIP network. To achieve FIP network isolation for cloud resources within a region, a VPC needs to be created with a specified availability zone. The corresponding FIP network is then obtained based on the availability zone. Cloud resources configured in the same availability zone can communicate with each other through the FIP network, while cloud resources in different availability zones can achieve FIP network isolation. Therefore, this invention provides a method for configuring a VPC with multi-availability zone isolated FIP networks. Summary of the Invention

[0004] The purpose of this invention is to provide a method and system for configuring a VPC multi-availability zone isolated FIP network to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a method for configuring a VPC multi-availability zone isolated FIP network, the method comprising the following steps:

[0006] Configure the FIP network name corresponding to the VPC multi-availability zone in the product configuration file;

[0007] Tenants log in to the console interface, click "Create Virtual Private Network", select the availability zone to which the VPC belongs, and create VPCs under the two availability zones respectively;

[0008] Tenants can log in to the console interface to view the list of virtual private networks;

[0009] Tenants log in to the console interface and create an elastic network interface card;

[0010] Tenants log in to the console interface and create cloud hosts corresponding to the two VPCs respectively;

[0011] Configure the FIP network segments corresponding to multiple availability zones.

[0012] Preferably, the FIP network name configured in the product configuration file for the VPC multi-availability zone includes:

[0013] The FIP network is a VLAN network pre-planned by operations and maintenance, with VLAN numbers 3151 and 3152. Two VLAN networks, vlan3151 and vlan3152, are created on OpenStack. vlan3151 and vlan3152 belong to two different availability zones, and the VLANs are configured on the switches.

[0014] Preferably, the tenant logs into the console interface, clicks "Create Virtual Private Network," selects the availability zone to which the VPC belongs, and creates VPCs under both availability zones, including:

[0015] When creating a VPC, subnet information is filled in, and a subnet is created under that VPC. The backend receives the availability zone from the frontend, retrieves the corresponding FIP network from the configuration file based on the availability zone, sets the availability zone information when creating the network and routes, and stores the availability zone corresponding to the VPC in the database. The subnet availability zone and the VPC availability zone must be consistent. If the availability zone configured in the console is inconsistent with the availability zone configured in OpenStack, an error message will be displayed indicating that the availability zone information is configured incorrectly, and the creation of the VPC will not be allowed.

[0016] Preferably, tenants can log in to the console interface to view the list of Virtual Private Networks, including:

[0017] The Virtual Private Network (VPC) interface displays the availability zone information corresponding to the VPC. The availability zone displayed in the subnet interface is consistent with the VPC availability zone. The availability zone information displayed on the OpenStack network and router is consistent with the availability zone transmitted from the front end.

[0018] Preferably, when a tenant logs into the console interface and creates an elastic network interface card, the process includes:

[0019] The network interface card (NIC) table does not store availability zone information. When an elastic NIC is bound to an elastic public IP address, the network information to which the NIC belongs is first queried. Based on the availability zone to which the network belongs, the corresponding FIP network is queried, a floating IP address is created, and a binding relationship is established with the elastic NIC.

[0020] Preferably, tenants log in to the console interface and create cloud hosts corresponding to two VPCs, including:

[0021] When two cloud servers are created in a VPC within the same availability zone and each is bound to an Elastic IP address, they can communicate with each other via the FIP network. However, when two cloud servers are created in VPCs within different availability zones and each is bound to an Elastic IP address, they cannot communicate with each other via the FIP network.

[0022] Preferably, the FIP network segments configured for multiple availability zones include:

[0023] When creating a VPC, obtain the FIP network segment based on the availability zone. When creating a network ACL, add a rule to allow all FIP networks to enter and another rule to deny FIP network segments to enter and exit. Within the same availability zone, FIP networks are isolated by configuring network ACLs. Configure the switch to enable or disable the function of isolating FIP networks within the same availability zone according to user needs.

[0024] A system for configuring a VPC multi-availability zone isolated FIP network, the system consisting of a northbound interface module, a database, a virtual private network module, and an elastic network interface module;

[0025] The northbound interface module is used to provide REST APIs to enable tenants to create VPC isolated FIP networks in designated availability zones.

[0026] The database module is used to store relevant tenant, virtual private network, subnet, and elastic network interface card information;

[0027] The Virtual Private Network module is used to manage VPCs and subnets, providing administrators with the ability to manage VPCs and subnets;

[0028] The Elastic Network Interface Card (ENCIC) management module is used to manage ENCs.

[0029] Compared with the prior art, the beneficial effects of the present invention are:

[0030] This invention proposes a method and system for configuring isolated FIP networks across multiple availability zones in a VPC. When creating a VPC in the Virtual Private Network console, an availability zone is selected, and the corresponding FIP network is obtained based on that availability zone. The subnet availability zone under the VPC is consistent with the selected VPC availability zone by default. By configuring different FIP ​​networks under multiple availability zones in a VPC, FIP network isolation is achieved, allowing cloud resources in the same availability zone to communicate with each other via the FIP network. Attached Figure Description

[0031] Figure 1 This is a flowchart of the method of the present invention;

[0032] Figure 2 This is a diagram illustrating the architecture of the present invention.

[0033] Figure 3 This is a schematic diagram illustrating the implementation principle of the present invention. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of the present invention clear and complete, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only some, not all, embodiments of the present invention, and are merely illustrative of the embodiments of the present invention. They are not intended to limit the embodiments of the present invention. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0035] Example 1

[0036] Please see Figure 1 This invention provides a technical solution: a method for configuring a VPC multi-availability zone isolated FIP network, the method comprising the following steps:

[0037] (1) Configure the FIP network name corresponding to the VPC multi-availability zone in the product configuration file. The FIP network is a VLAN network planned in advance by the operation and maintenance (e.g., VLAN number 3151 and 3152). Two VLAN networks vlan3151 and vlan3152 need to be created on OpenStack. vlan3151 and vlan3152 belong to two different availability zones, and the VLAN is configured on the switch.

[0038] (2) After logging into the console, the tenant clicks "Create Virtual Private Network," selects the availability zone to which the VPC belongs, and creates VPCs under both availability zones. When creating a VPC, the tenant fills in the subnet information and creates a subnet under that VPC. At this time, the backend receives the availability zone from the frontend and retrieves the corresponding FIP network from the configuration file based on the availability zone. When creating the network and routing, the availability zone information is set and the availability zone corresponding to the VPC is stored in the database. The subnet availability zone and the VPC availability zone must be consistent. If the availability zone configured in the console is inconsistent with the availability zone configured in OpenStack, an error message will be displayed indicating that the availability zone information is configured incorrectly, and VPC creation will not be allowed.

[0039] (3) When a tenant logs into the console and views the list of Virtual Private Networks (VPCs), the VPC interface will display the availability zone information corresponding to the VPC. The availability zone displayed in the subnet interface is consistent with the VPC availability zone. The availability zone information displayed on the OpenStack network and router is consistent with the availability zone transmitted from the front end.

[0040] (4) When a tenant logs into the console interface and creates an elastic network interface, the network interface table does not store availability zone information. When an elastic network interface is bound to an elastic public IP, the network information to which the network interface belongs will be queried first, and the corresponding FIP network will be queried according to the availability zone to which the network belongs. A floating IP will be created and a binding relationship will be established with the elastic network interface.

[0041] (5) Tenants log in to the console interface and create cloud hosts corresponding to two VPCs respectively. When two cloud hosts are created in the same availability zone and bound to elastic public IPs respectively, these two cloud hosts can communicate with each other through the FIP network. When two cloud hosts are created in different availability zones and bound to elastic public IPs respectively, they cannot communicate with each other through the FIP network. This realizes the scenario of configuring VPCs with isolated FIP networks in multiple availability zones, ensuring that some cloud resources in the same region can communicate with each other, and realizing resource access permission control in multiple availability zones.

[0042] (6) To isolate FIP networks between VPCs within the same availability zone using network ACLs, you need to configure FIP network segments corresponding to multiple availability zones. When creating a VPC, obtain the FIP network segment based on the availability zone. When creating the network ACL, add a rule to both the inbound and outbound rules to allow all FIP networks, and then add another rule to both the inbound and outbound rules to deny the FIP network segment. At this point, FIP networks within the same availability zone can be isolated using network ACLs. This function has a toggle configuration; users can set whether to enable the function of isolating FIP networks within the same availability zone using network ACLs according to their needs.

[0043] Example 2

[0044] See attached document Figure 2 Based on Example 1, a system for configuring a VPC multi-availability zone isolated FIP network is proposed, including the following modules: 1) Northbound interface module; 2) Database; 3) Virtual Private Network module; 4) Elastic NIC module.

[0045] The northbound interface module is mainly used to provide REST APIs to enable tenants to create isolated VPC FIP networks within a specified availability zone. For example, it provides tenant ID, network segment CIDR, and region to enable functions such as creating networks, creating subnets, deleting subnets, deleting virtual private networks, creating elastic network interfaces (NICs), deleting elastic NICs, and binding and unbinding elastic public IPs to NICs.

[0046] The database module stores information related to tenants, virtual private networks (VPNs), subnets, and elastic network interface cards (NICs). All information created by tenants through the VPN and NIC modules is stored in the database.

[0047] The Virtual Private Network (VPC) module is primarily used to manage VPCs and subnets, providing administrators with functions for managing VPCs and subnets, including creating VPCs, creating subnets, deleting subnets, deleting VPCs, viewing subnet details, viewing network lists, and viewing subnet lists. After the backend API retrieves the availability zone specified from the frontend interface, it queries the availability zone information on OpenStack to determine if the configured availability zone information is correct. If the availability zone is configured correctly, VPC creation can be successful; if the availability zone is misconfigured, it will indicate that the availability zone does not exist in OpenStack and VPC creation cannot be performed. When creating networks and routers on OpenStack, the availability zone is specified; when creating a router, the external gateway is specified as the FIP network corresponding to the availability zone. The database stores the availability zone field when storing VPC and subnet information, and the availability zones in the VPC table and subnet table are consistent. The Virtual Private Network (VPC) list and subnet list display the availability zone field.

[0048] The Elastic Network Interface (ENI) management module is used to manage ENIs, including querying the ENI list, viewing ENI details, creating ENIs, deleting ENIs, updating ENI names, binding ENIs to cloud hosts, unbinding ENIs to cloud hosts, binding ENIs to public IP addresses, and unbinding ENIs to public IP addresses. When a tenant creates a cloud host, it calls the ENI interface. This interface checks whether the network and subnet belong to the current tenant, verifies the correctness of the information, and stores the ENI information after successful verification, but does not store the availability zone field. When binding an ENI to a public IP address, it queries the availability zone information through the VPC, obtains the FIP network name corresponding to the availability zone from the configuration file, calls the OpenStack interface to create a floating IP address and bind it to the ENI. If the FIP network exists on OpenStack and the availability zone of the FIP network is consistent with the VPC availability zone, the binding of the ENI to the public IP address is successful. If the FIP network does not exist or the availability zone of the FIP network is inconsistent with the VPC availability zone, the binding of the ENI to the public IP address fails.

[0049] After adopting the configuration VPC multi-availability zone isolated FIP network scheme of the present invention, the access permissions of cloud hosts in the same zone to the FIP network can be controlled, ensuring the network security between cloud hosts, realizing FIP network interconnection between some cloud hosts, and the operation is simple and quick.

[0050] This solution configures VPC multi-availability zone isolated FIP networks without relying on a single physical hardware device, allowing for flexible management and configuration. The FIP networks corresponding to the VPC multi-availability zones can be configured according to needs, dynamically added or removed, and offer high security.

[0051] Example 3

[0052] The following is in conjunction with the appendix Figure 3The present invention will be further described with reference to specific implementation methods, taking the configuration of a VPC multi-availability zone isolated FIP network as an example:

[0053] Prerequisites:

[0054] On the product side, enable VPC multiple availability zones, plan two FIP networks floating1 and floating2 and configure them on the switch, and configure two availability zones az1 and az2 on OpenStack and the product side.

[0055] 1. Configure the FIP network corresponding to the VPC multi-availability zone in the product configuration file.

[0056] 2. Call the northbound interface to select availability zone az1 under tenant a and create network1. network1 has a subnet1. Under tenant b, select availability zone az2 and create network2. network2 has a subnet2. Under tenant c, select availability zone az1 and create network3. network3 has a subnet3. Query the virtual private network list and subnet list to display availability zone information.

[0057] 3. The northbound interface management module first writes network, subject, and port into the database.

[0058] 4. The Elastic Network Interface Card (ENCIC) management module creates an ENC and binds it to the cloud host.

[0059] 5. Create cloud hosts corresponding to the virtual private network and verify the network connectivity between the cloud hosts. Pinging the floating IP within the cloud hosts of tenant a and tenant b will not result in communication, while pinging the floating IP within the cloud hosts of tenant a and tenant c will result in communication.

[0060] At this point, the configuration of the VPC multi-availability zone isolated FIP network is complete.

[0061] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for configuring a VPC multi-availability zone isolated FIP network, the method comprising: The method comprises the following steps: ​ Configure the FIP network name corresponding to the VPC multi-availability zone in the product configuration file; The tenant logs in to the console interface, clicks to create a virtual machine private network, selects the availability zone to which the VPC belongs, and creates VPCs under two availability zones; The tenant logs in to the console interface and views a virtual private network list; The tenant logs in to the console interface and creates an elastic network card; The tenant logs in to the console interface and creates two cloud hosts corresponding to the two VPCs respectively; Configure the FIP network segment corresponding to the multi-availability zone; The tenant logs in to the console interface, clicks to create a virtual machine private network, selects the availability zone to which the VPC belongs, and creates VPCs under two availability zones, which comprises: When creating a VPC, a subnet is created under the VPC, the backend receives the availability zone transmitted by the front end, the corresponding FIP network is obtained from the configuration file according to the availability zone, the availability zone information is set when creating the network and the route, and the VPC corresponding availability zone, subnet availability zone and VPC availability zone are stored in the database; If the availability zone configured in the console is inconsistent with the availability zone configured in OpenStack, it is prompted that the availability zone information is configured incorrectly, and the VPC is not allowed to be created; The tenant logs in to the console interface and creates an elastic network card, which comprises: The availability zone information is not stored in the network card table, when the elastic network card is bound to the elastic public IP, the network information to which the network card belongs is queried first, the corresponding FIP network is queried according to the availability zone to which the network belongs, the floating IP is created and the binding relationship between the elastic network card and the floating IP is established; The tenant logs in to the console interface and creates two cloud hosts corresponding to the two VPCs respectively, which comprises: Two cloud hosts are created by selecting VPCs in the same availability zone and are bound to elastic public IPs respectively, and the two cloud hosts can intercommunicate through the FIP network; When two cloud hosts are created by selecting VPCs in different availability zones and are bound to elastic public IPs respectively, the two cloud hosts cannot intercommunicate through the FIP network; Configuring the FIP network segment corresponding to the multi-availability zone comprises: When creating a VPC, the FIP network segment is obtained according to the availability zone, when creating a network ACL, an all-passing rule is added to the ingress rule and the egress rule, and a rule rejecting the FIP network segment is added to the ingress rule and the egress rule, the FIP networks are isolated in the same availability zone through the configuration of the network ACL, a switch is set, and whether to start the function of isolating the FIP networks in the same availability zone through the network ACL is set according to the user demand.

2. The method for configuring VPC multi-availability zone isolated FIP network according to claim 1, characterized in that: Configuring the FIP network name corresponding to the VPC multi-availability zone in the product configuration file comprises: The FIP network is a VLAN network planned in advance for operation and maintenance, the VLAN numbers are 3151 and 3152, two VLAN networks vlan3151 and vlan3152 are created on OpenStack, vlan3151 and vlan3152 belong to two different availability zones, and the VLANs are configured on the switch.

3. The method for configuring VPC multi-availability zone isolated FIP network according to claim 1, characterized in that: The tenant logs in to the console interface and views a virtual private network list, which comprises: The virtual private network interface displays the availability zone information corresponding to the VPC, the availability zone displayed in the subnet interface is consistent with the VPC availability zone, and the availability zone information displayed on the OpenStack network and router is consistent with the availability zone transmitted by the front end.

Images