Cluster-based network isolation method, device, equipment and storage medium

Abstract

The disclosed embodiments relate to a cluster-based network isolation method, apparatus, device and storage medium. Among them, the cluster-based network isolation method includes: in response to the application creation operation, creating an application and determining the application identification; based on the application identification, adding a label to the cluster processing object related to the application; the cluster processing object is a resource object to establish a communication relationship with the target processing unit where the application is deployed; based on the application identification, calling the executable program segment to generate the first network isolation configuration information adapted to the application; based on the first network isolation configuration information, establishing a first communication channel between at least part of the cluster processing objects, and setting the communication state of the first communication channel to an open state; the first communication channel includes channels in the inlet and / or outlet directions. According to the disclosed embodiments, it is possible to create an adaptive network isolation strategy for the application, thereby realizing the network isolation of the application.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a cluster-based network isolation method, device, equipment and storage medium. Background Art

[0002] With the development of cloud platform technology, many tenants run model-related businesses through cloud platforms. Relevant customers can use the models / services published by tenants on the cloud platform. However, when multiple customers use the services, the cloud platform needs to implement service isolation and data isolation between different customers to ensure security and performance.

[0003] Currently, in order to achieve network isolation between customers, a virtual private network environment is usually created for each customer. However, with the increase in the number of models provided by many tenants and the increase in the number of services used by customers, providing a virtual private network environment is not convenient, consumes huge resources, and is costly. Summary of the invention

[0004] In order to solve the above technical problems, the embodiments of the present disclosure provide a cluster-based network isolation method, apparatus, device and storage medium.

[0005] In a first aspect, an embodiment of the present disclosure provides a cluster-based network isolation method, the method comprising:

[0006] In response to the application creation operation, create the application and determine the application identifier;

[0007] Based on the application identifier, adding a tag to a cluster processing object related to the application; wherein the cluster processing object is a resource object to establish a communication relationship with a target processing unit where the application is deployed;

[0008] Based on the application identifier, calling the executable program segment to generate first network isolation configuration information adapted to the application; wherein the executable program segment includes a predefined program for generating network isolation configuration information using the application identifier;

[0009] Based on the first network isolation configuration information, a first communication channel is established between at least some of the cluster processing objects, and the communication state of the first communication channel is set to an open state; wherein the first communication channel includes a communication channel in the inlet direction and / or a communication channel in the outlet direction.

[0010] Optionally, the method further includes:

[0011] Determine the second network isolation configuration information corresponding to the target cluster where the application is deployed, and determine the second communication channel between the target cluster and other clusters, and between resource objects within the target cluster based on the second network isolation configuration information; wherein the communication state of the second communication channel is the open state or the closed state;

[0012] After establishing a first communication channel between at least part of the cluster processing objects based on the first network isolation configuration information and setting the communication state of the communication channel to an open state, the method further includes:

[0013] The first communication channel and the second communication channel are combined, and a target communication channel and a communication state of the target communication channel are determined.

[0014] Optionally, determining the communication state of the target communication channel includes:

[0015] For the target communication channel repeated in the first communication channel and the second communication channel, if the communication state of the corresponding first communication channel or the communication state of the corresponding second communication channel is the open state, setting the communication state of the corresponding target communication channel to the open state;

[0016] For the target communication channel that is overlapped by the first communication channel and the second communication channel, if the communication state of the corresponding first communication channel and the communication state of the corresponding second communication channel are both closed, the communication state of the corresponding target communication channel is set to the closed state.

[0017] Optionally, establishing a first communication channel between at least some of the cluster processing objects based on the first network isolation configuration information includes:

[0018] If the cluster processing object includes a plurality of the target processing units in the target namespace in the target cluster where the application is deployed, the first communication channel is established between the target processing units based on the first network isolation configuration information.

[0019] Optionally, after establishing the first communication channel between the target processing units based on the first network isolation configuration information, the method further includes:

[0020] If the cluster processing object also includes other namespaces in the target cluster, establishing the first communication channel between the target processing unit and the other namespaces based on the first network isolation configuration information;

[0021] Alternatively, if the cluster processing object also includes other processing units in the other namespaces, the first communication channel between the target processing unit and the other namespaces and the other processing units is established based on the first network isolation configuration information.

[0022] Optionally, after establishing the first communication channel between the target processing units based on the first network isolation configuration information, the method further includes:

[0023] If the cluster processing object also includes other clusters, the first communication channel between the target processing unit and the other clusters is established based on the first network isolation configuration information.

[0024] Optionally, after establishing a first communication channel between at least some of the cluster processing objects based on the first network isolation configuration information, and setting the communication state of the first communication channel to an open state, the method further includes:

[0025] In response to the destruction operation of the application, the first network isolation configuration information is deleted.

[0026] Optionally, the executable program segment includes a script file or a configuration file containing the executable program.

[0027] Optionally, the application is an application that performs related data processing based on the generative model, or the application is an application that performs model training based on the generative model.

[0028] In a second aspect, an embodiment of the present disclosure further provides a cluster-based network isolation device, the device comprising:

[0029] A creating unit, used to create an application program in response to an application program creation operation, and determine an application program identifier;

[0030] An adding unit, configured to add a tag to a cluster processing object related to the application based on the application identifier; wherein the cluster processing object is a resource object to establish a communication relationship with a target processing unit where the application is deployed;

[0031] A configuration information generating unit, configured to call an executable program segment based on the application identifier to generate first network isolation configuration information adapted to the application; wherein the executable program segment includes a predefined program for generating network isolation configuration information using the application identifier;

[0032] A communication channel establishing unit is used to establish a first communication channel between at least some of the cluster processing objects based on the first network isolation configuration information, and set the communication state of the first communication channel to an open state; wherein the first communication channel includes a communication channel in the input direction and / or a communication channel in the output direction.

[0033] In a third aspect, an embodiment of the present disclosure further provides an electronic device, the electronic device comprising:

[0034] processor;

[0035] A memory for storing executable instructions;

[0036] The processor is used to read executable instructions from the memory and execute the executable instructions to implement the cluster-based network isolation method described in any embodiment of the present disclosure.

[0037] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the processor implements the cluster-based network isolation method described in any embodiment of the present disclosure.

[0038] In a fifth aspect, an embodiment of the present disclosure further provides a computer program product, which is used to execute the cluster-based network isolation method described in any embodiment of the present disclosure.

[0039] The cluster-based network isolation method of the embodiment of the present disclosure includes: in response to the creation operation of an application, creating an application and determining the application identifier; based on the application identifier, adding a label to the cluster processing object related to the application; the cluster processing object is a resource object that is to establish a communication relationship with the target processing unit where the application is deployed; based on the application identifier, calling an executable program segment to generate first network isolation configuration information adapted to the application; the executable program segment includes a predefined program that uses the application identifier to generate network isolation configuration information; based on the first network isolation configuration information, establishing a first communication channel between at least some of the cluster processing objects, and setting the communication state of the first communication channel to an open state; the first communication channel includes a communication channel in the inlet direction and / or a communication channel in the outlet direction, and can create a dynamic network isolation strategy for each application, realize network isolation between different applications, and effectively reduce resource consumption and costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0041] Figure 1 A schematic diagram of the structure of a static network isolation strategy provided by some embodiments of the present disclosure;

[0042] Figure 2 A schematic diagram of a flow chart of a cluster-based network isolation method provided in some embodiments of the present disclosure;

[0043] Figure 3 A schematic diagram of a flow chart of a cluster-based network isolation method provided in some embodiments of the present disclosure;

[0044] Figure 4 A schematic diagram of a flow chart of a cluster-based network isolation method provided in some embodiments of the present disclosure;

[0045] Figure 5 A schematic diagram of the structure of a dynamic network isolation strategy provided by some embodiments of the present disclosure;

[0046] Figure 6 A schematic diagram of the structure of a cluster-based network isolation device provided in some embodiments of the present disclosure;

[0047] Figure 7 A schematic diagram of the structure of an electronic device provided for some embodiments of the present disclosure. DETAILED DESCRIPTION

[0048] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0049] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0050] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0051] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0052] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0053] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0054] In the related art, many tenants rent clouds to run model-related businesses. Usually, model-related tasks can be divided into model reasoning tasks and model training tasks, for example, model training tasks are to adjust model accuracy, etc. There are three aspects involved in network isolation, including cloud service providers, model suppliers (hereinafter referred to as tenants) and customers (such as enterprises), among which cloud service providers refer to entities that provide cloud services to serve different model suppliers, model suppliers refer to entities that own various models and use cloud service providers to build reasoning-related services / tasks, and customers refer to entities that run cloud services and applications provided by model suppliers, and customers have security requirements for model suppliers and cloud service providers, that is, to achieve network isolation between different customers, including service isolation and resource isolation.

[0055] When customers use services, they hope that the processing units or clusters running applications can be isolated. A simple way to achieve network isolation is to create a virtual private network environment for users. However, model providers will only provide models to cloud service providers, and cloud service providers will build services based on the models. Therefore, as the number of models or services increases, it is not convenient and costly to provide a dedicated network environment for each model. In addition, many applications may be deployed in the same network environment, and many applications use different models. Even if the services corresponding to the same model are deployed in the same network environment, there will still be network isolation requirements for services used by different customers. In addition, setting up different network environments to provide model services for different model providers is not only inflexible, but also consumes more resources. When different models in different network environments are used by different customers, it is still difficult to achieve network isolation between different customers.

[0056] Based on this, a static network isolation strategy (hereinafter referred to as static strategy) is proposed. The application is containerized, and the scheduling is implemented based on the processing unit of the cluster. A processing unit can include many containers. In this case, a static strategy can be pre-set for each processing unit to solve the network isolation problem of the processing unit. Specifically, the static strategy can be set when the cluster is built and basically does not change. However, when using static strategies to solve the network isolation of processing units deployed in a single network environment, especially for east-west network flows, static strategies have the following limitations: only processing units in the same namespace can communicate with each other, processing units without task relationships cannot communicate with each other, and only applications deployed in processing units with special labels can communicate with each other. Although static strategies can solve many situations, customers will create new applications at any time, and some applications will not be deployed in a single processing unit. In this case, on the one hand, the application will be restricted by the static strategy, and on the other hand, there is also a situation where the static strategy does not involve the processing unit, and network isolation cannot be achieved.

[0057] For example, see Figure 1 , Figure 1 A schematic diagram of a static network isolation strategy provided by an embodiment of the present disclosure is shown in FIG. Figure 1 As shown, the processing unit where the application is deployed can establish communication relationships with all resource objects outside the cluster, within the namespace, and within the cluster. That is, the static policy cannot establish a communication relationship for a certain resource object, and the communication status in one direction of the ingress direction and / or egress direction outside the cluster, within the namespace, and within the cluster is the same, which is either closed or open. The communication status cannot be set separately, such as Figure 1As shown, the communication status between the processing unit and the outside of the cluster, within the namespace, and within the cluster in the ingress direction and the egress direction are all in the open state, wherein the solid arrow indicates the open state.

[0058] Based on the above situation, the embodiment of the present disclosure provides a cluster-based network isolation method, which adds an application identifier to the cluster processing object, the cluster processing object is a resource object to establish a communication relationship with the target processing unit, the target processing unit is deployed with an application, and the target processing unit and the cluster processing object or the target processing unit and part of the cluster processing object can be in the same virtual private cloud network environment, or the cluster processing object and the target processing object are in different virtual private cloud network environments, and then the first network isolation configuration information adapted to the application is dynamically generated based on the application identifier, the configuration information represents the resource object that can communicate with the target processing unit, and also isolates other resource objects from the target processing unit, and also realizes network isolation between applications in which the target processing unit and the cluster processing object are in the same network environment, and there is no need to set up a dedicated network environment for the application, thereby reducing resource consumption. It is specifically described in detail through at least one of the following embodiments.

[0059] The cluster-based network isolation method provided by the embodiment of the present disclosure can be applied to the network isolation scenario between different customers in the same network environment. The method can be performed by a cluster-based network isolation device, which can be implemented by software and / or hardware, and the device can be integrated in an electronic device. Among them, the electronic device can include but is not limited to mobile terminals such as smart phones, laptops, digital broadcast receivers, personal digital assistants (Personal Digital Assistant, PDA), tablet computers (Tablet Personal Computer, Tablet PC), PMP (portable multimedia player), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), wearable devices, etc., and fixed terminals such as digital televisions, desktop computers, smart home devices, etc.

[0060] Figure 2 FIG. 1 is a flow chart of a cluster-based network isolation method provided by an embodiment of the present disclosure. Figure 2 As shown, the cluster-based network isolation method may include the following steps:

[0061] S201. In response to an application creation operation, create an application and determine an application identifier.

[0062] Understandably, a possible application scenario is that many tenants build language models on the cloud platform, and the cloud platform provides the function of running the language model to implement related tasks, which refer to model reasoning tasks and model training tasks, etc. Different customers create applications based on the language model on the cloud platform, and the application can be understood as a workload or service instance. In this scenario, the cluster-based network isolation method can be executed by a related automation tool / platform / cluster system or a related plug-in with the function of creating and managing network isolation policies. The following embodiment takes the cluster system executing this method as an example for detailed description.

[0063] It can be understood that in response to the application creation operation, the application is created. During the dynamic creation process, a unique application identifier (app-id) is assigned to the application and the application identifier is determined. The application is deployed / created in the target processing unit. The specific creation method is not limited. The target processing unit (pod) is the smallest unit that can be created and managed in the cluster system. The application can be deployed on multiple target processing units.

[0064] The application is an application that performs relevant data processing based on a generative model, or the application is an application that performs model training based on a generative model.

[0065] It is understandable that the application can be an application that performs related data processing based on the generative model. Related data processing refers to reasoning and application processing based on the generative model. The application can also be an application that performs model training based on the generative model, that is, an application that trains the generative model using different training data sets. Other tasks based on the generative model are not limited. The application can also be created based on other models, which is not limited here.

[0066] S202: Add a tag to a cluster processing object related to the application based on the application identifier.

[0067] The cluster processing object is a resource object that is to establish a communication relationship with a target processing unit where the application is deployed.

[0068] It is understandable that, based on the above S201, after the application identifier is determined, the cluster processing objects related to the application are labeled. The specific labeling method is not limited and can be implemented through the functions provided in the cluster system. Among them, the cluster processing object refers to the resource object that needs to establish a communication relationship with the target processing unit. The cluster processing object can also be in the same virtual private cloud (Virtual Private Cloud, VPC) network environment as the target processing unit. The virtual private cloud is a logically isolated virtual network environment built for users, which is configured and managed by users independently. For example, some cluster processing objects are in the same VPC network environment as some target processing units, or the cluster processing objects and the target processing units are in different VPC network environments, or some cluster processing objects are in the same VPC network environment as the target processing unit, and the network environment conditions of the cluster processing units and the target processing units are not limited. It can be understood that the following embodiments are explained by taking the cluster processing object and the target processing unit in the same VPC network environment as an example. Multiple clusters can be deployed in the same VPC network environment, each cluster contains many pods, the same application can be deployed on at least one pod, and a cluster can contain multiple namespaces. A namespace is an isolated space for a customer. Based on this, the cluster processing object in the same VPC network environment as the target processing unit includes the target cluster, target namespace and target processing unit where the application is deployed, as well as other clusters, other namespaces and other processing units, etc. Other processing units and the target processing unit can interact with upstream and downstream data.

[0069] S203. Based on the application identifier, call the executable program segment to generate first network isolation configuration information adapted to the application.

[0070] Among them, the executable program segment includes a predefined program that generates network isolation configuration information using an application identifier.

[0071] The executable program segment includes a script file or a configuration file containing an executable program.

[0072] It is understandable that, based on the above S202, after adding an application identifier to the cluster processing object related to the application, all cluster processing objects to which the identifier has been added can be searched based on the application identifier. Subsequently, based on the application identifier, the executable program segment is called to generate the first network isolation configuration information adapted to the application. The executable program segment includes a predefined program that generates network isolation configuration information using the application identifier. The executable program segment defines the communicative logic between all cluster processing objects with the same application identifier. Specifically, the executable program segment includes a name setting statement (for setting the application identifier), a specification setting statement, an entry setting statement, and an exit setting statement, etc. The entry setting statement and the exit setting statement are used to set the communication nodes of the upstream and downstream resource objects. The executable program segment that implements other functions is not limited here and can be set according to the needs. Among them, the executable program segment can be in the form of a script file, a configuration file containing an executable program, etc., and other implementation forms are not limited. The first network isolation configuration information can be understood as a dynamic network isolation strategy (hereinafter referred to as dynamic strategy) specially configured for the application, which specifies the resource objects that can communicate with the target processing unit, so as to facilitate the application to communicate with the resource objects (cluster processing objects) that are in the same or different network environments and are allowed to communicate, while isolating other resource objects that are not allowed to communicate. Among them, the first network isolation configuration information includes the entry node and exit node that communicate with the cluster processing object corresponding to the application. The entry node / exit node can be a pod carrying app-id in the same namespace in this cluster, or a pod in other namespaces or other namespaces in this cluster carrying app-id, or other clusters or other resource objects carrying app-id outside this cluster.

[0073] S204: Based on the first network isolation configuration information, establish a first communication channel between at least some of the cluster processing objects, and set the communication state of the first communication channel to an open state.

[0074] The first communication channel includes a communication channel in an inlet direction and / or a communication channel in an outlet direction.

[0075] It is understandable that, based on the above S203, based on the first network communication configuration information, a first communication channel is established between at least some of the cluster processing objects, that is, the first network communication configuration is applied and made effective to establish the first communication channel between the cluster processing objects. For example, a configuration command can be generated based on the first network communication configuration information, and the configuration command is executed to establish the first communication channel. The communication state of the first communication channel is set to an open state, and network communication can be achieved between the cluster processing objects. The communication state also includes a closed state, and resource objects in the closed state cannot communicate with each other. It is understandable that in the process of establishing the first communication channel between the cluster processing objects, the communication channel can also be established based on the pre-set priority of each cluster processing object. The cluster processing object with a high priority can establish the communication channel first, and the cluster processing object with a low priority can establish the communication channel later to ensure that important data is communicated first.

[0076] Optionally, after establishing a first communication channel between at least some of the cluster processing objects based on the first network isolation configuration information and setting the communication state of the first communication channel to an open state, the method further includes:

[0077] In response to a destruction operation of the application, the first network isolation configuration information is deleted.

[0078] It is understandable that for custom resources (applications) with a longer usage cycle, a more stable static policy (the second network isolation configuration information described below) can be used. For custom resources with a shorter usage cycle, a dynamic policy (the first network isolation configuration information described above) can be created when the custom resource is generated, and when the custom resource is exited / destroyed, the dynamic policy configured for the custom resource is deleted to ensure that there are no redundant dynamic policies in the VPC network environment, which not only saves storage space, but also avoids the use of incorrect configuration policies and improves the accuracy of network isolation.

[0079] The cluster-based network isolation method provided by the embodiment of the present disclosure adds a unique application identifier assigned to the application to a cluster processing object when creating an application. The cluster processing object refers to a resource object that needs to establish a communication relationship with a target processing unit, wherein the cluster processing object may include a pod that has no task relationship with the target processing unit, and may also include a pod that is not in the same namespace as the target processing unit. There may also be a pod that is in the same cluster as the target processing unit. By performing network isolation configuration on the cluster processing objects to which the same application identifier is added, a dynamic policy adapted to the application is generated, and a communication channel between the target processing unit and different pods, namespaces, and clusters is established, thereby realizing network isolation in complex situations such as having different business requirements, and realizing isolation between different applications in the same VPC network environment, thereby reducing resource consumption and costs.

[0080] Based on the above embodiments, Figure 3 A flow chart of another cluster-based network isolation method provided in an embodiment of the present disclosure, specifically including the following steps: Figure 3 The following steps are shown:

[0081] S301. Determine second network isolation configuration information corresponding to a target cluster where an application is deployed, and determine a second communication channel between the target cluster and other clusters and between resource objects within the target cluster based on the second network isolation configuration information.

[0082] The communication status of the second communication channel is an open state or a closed state.

[0083] It is understandable that the second network isolation configuration information corresponding to the target cluster where the application is deployed is obtained. The application is deployed on the target processing unit, and the target cluster includes the target processing unit. Therefore, the application can also be understood as being deployed on the target cluster. The second network isolation configuration information can be understood as a static policy, which is generated when the target cluster is created and will hardly change during the existence of the target cluster. It can also be generated immediately after the target cluster is created, and may also be currently generated according to business needs. The second network isolation configuration information can be directly read from the corresponding storage space. After determining the second network isolation configuration information, the second communication channel between the target cluster and other clusters and between the resource objects within the target cluster is determined based on the second network isolation configuration information, wherein the communication status of the second communication channel is an open state or a closed state, and the communication status of the second communication channel between the target cluster and other clusters and between the resource objects within the target cluster specified by the static policy is the same, that is, it is impossible to independently set the communication status of a communication channel for a certain resource object to be an open state or a closed state. For example, the communication status of the communication channel between the target cluster and other clusters is either an open state or a closed state, and it is impossible to open only the communication channel between the target cluster and one other cluster and close the communication channel between the target cluster and other clusters.

[0084] S302: Based on the first network isolation configuration information, establish a first communication channel between at least some of the cluster processing objects, and set the communication state of the communication channel to an open state.

[0085] It can be understood that there is no limitation on the order of establishing the first communication channel based on the dynamic policy and establishing the second communication channel based on the static policy. The second communication channel can be established after the first communication channel is established, or the second communication channel can be established all the time before performing operations such as creating an application, generating a dynamic policy, and establishing the first communication channel.

[0086] S303: Merge the first communication channel and the second communication channel, and determine the target communication channel and the communication status of the target communication channel.

[0087] It is understandable that, based on the above S301 and S302, the first communication channel and the second communication channel are merged, or the first communication channel and the second communication channel are directly intersected to determine the target communication channel and the communication status of the target communication channel, that is, the final network isolation strategy is determined according to the static strategy located in the cluster and the generated dynamic strategy, and the final communication status of the target communication channel is determined according to the final network isolation strategy. The target communication channel may be at least one repeated communication channel of the first communication channel and the second communication channel. The target communication channel may be established in the first VPC network environment where the target processing unit is located. If the cluster processing object and the target processing unit are not in the same VPC network environment, and the cluster processing object is in the second VPC network environment, the target communication channel may also be established in the first VPC network environment and the second VPC network environment.

[0088] Optionally, the above-mentioned determination of the communication status of the target communication channel may be specifically implemented through the following steps:

[0089] For a target communication channel where the first communication channel and the second communication channel overlap, if the communication status of the corresponding first communication channel or the communication status of the corresponding second communication channel is in the open state, the communication status of the corresponding target communication channel is set to the open state; for a target communication channel where the first communication channel and the second communication channel overlap, if the communication status of the corresponding first communication channel and the communication status of the corresponding second communication channel are both in the closed state, the communication status of the corresponding target communication channel is set to the closed state.

[0090] It is understandable that the target communication channels repeated in the first communication channel and the second communication channel are determined, and the number of target communication channels is not limited. The target communication channel can be a communication channel between the target cluster and other clusters, or a communication channel between resource objects within the target cluster. For the target communication channel, if any of the communication states of the corresponding first communication channel or the communication state of the corresponding second communication channel is in an open state, the communication state of the target communication channel is set to an open state, that is, for the target communication channel, if any of the static policy and the dynamic policy stipulates that its communication state is in an open state, the communication state of the target communication channel is determined to be in an open state. If the communication state of the corresponding first communication channel and the communication state of the corresponding second communication channel are both in a closed state, the communication state of the target communication channel is set to a closed state, that is, for the target communication channel, if both the static policy and the dynamic policy stipulate that its communication state is in a closed state, the communication state of the target communication channel is determined to be in a closed state. If there is no duplicate communication channel between the first communication channel and the second communication channel, the communication state of the non-duplicate communication channel is determined according to the communication state of the corresponding channel (the first communication channel or the second communication channel) or the communication state specified by the configuration policy (static policy or dynamic policy).

[0091] Understandably, the communication status of the target communication channel can also be determined according to the priority / importance of each repeated communication channel. For example, if the target communication channel is a newly-built communication channel and the real-time performance of the newly-built communication channel is high, the communication status of the newly-built communication channel is used as the final communication status of the target communication channel; if it is considered that the communication status determined by the static strategy is more accurate, the communication status determined by the static strategy is used as the final communication status. Other ways of comprehensively considering the static strategy and the dynamic strategy to determine the communication status are not described in detail here.

[0092] The cluster-based network isolation method provided by the embodiment of the present disclosure, for a certain communication channel, if both the static policy and the dynamic policy specify its communication status, sets a communication status determination logic that comprehensively considers the static policy and the dynamic policy to meet the final confirmation of the communication status of the communication channel under different application requirements, thereby making the implementation of network isolation more flexible and accurate.

[0093] Based on the above embodiments, Figure 4 A flow chart of another cluster-based network isolation method provided by an embodiment of the present disclosure, optionally, based on the first network isolation configuration information, establishing a first communication channel between at least some of the cluster processing objects, specifically including the following steps: Figure 4 The following steps are shown:

[0094] S401. If the cluster processing object includes multiple target processing units in a target namespace in a target cluster where an application is deployed, a first communication channel is established between the target processing units based on first network isolation configuration information.

[0095] It can be understood that if the cluster processing object includes multiple target processing units, the multiple target processing units are in the target namespace in the target cluster, that is, the multiple target processing units belong to the same cluster and the same namespace. In this case, a first communication channel is established between each of the multiple target processing units based on the first network isolation configuration information, that is, mutual communication between the target proxy units in the same namespace is realized.

[0096] Optionally, if the cluster processing object includes other processing units in the target namespace in the target cluster where the application is deployed, a first communication channel is established between the target processing unit and the other processing units based on the first network isolation configuration information.

[0097] It can be understood that if the cluster processing object includes other processing units, the other processing units refer to pods on which applications are not deployed, and the other processing units and the target processing units on which applications are deployed are in the target namespace in the target cluster, that is, the other processing units and the target processing units belong to the same cluster and the same namespace. In this case, a first communication channel is established between the target processing unit and the other processing units based on the first network isolation configuration information, that is, mutual communication between pods in the same namespace is realized.

[0098] S402. If the cluster processing object also includes other namespaces in the target cluster, a first communication channel is established between the target processing unit and the other namespaces based on the first network isolation configuration information; or, if the cluster processing object also includes other processing units in other namespaces, a first communication channel is established between the target processing unit and the other namespaces and other processing units based on the first network isolation configuration information.

[0099] It is understandable that, based on the above S401, if the cluster processing object also includes other namespaces in the target cluster, that is, the resource object to establish a communication relationship with the target processing unit is other namespaces in the same cluster, in this case, based on the first network isolation configuration information, a first communication channel is established between the target processing unit and the other namespaces. Specifically, a communication channel can be established between each target processing unit or a certain target processing unit and other namespaces, and the other namespaces do not include pods in which applications are deployed. Alternatively, if the cluster processing object also includes other processing units in other namespaces, that is, the resource object to establish a communication relationship with the target processing unit is other processing units in other namespaces in the same cluster, and the other processing unit is at least one pod in other namespaces in which no application is deployed, in this case, based on the first network isolation configuration information, a first communication channel is established between the target processing unit and other namespaces and other processing units.

[0100] S403: If the cluster processing object also includes other clusters, a first communication channel is established between the target processing unit and the other clusters based on the first network isolation configuration information.

[0101] It can be understood that, based on the above S401, if the cluster processing object also includes other clusters, that is, the resource object to be communicated with the target processing unit is other clusters, and each namespace in the other cluster does not include the pod where the application is deployed, in this case, based on the first network isolation configuration information, a first communication channel is established between the target processing unit and the other clusters.

[0102] For example, see Figure 5 , Figure 5 A schematic diagram of a structure for network isolation using a dynamic strategy provided by an embodiment of the present disclosure, such as Figure 5 As shown, the types of resource objects (cluster processing objects) to be communicated with the target processing unit include other clusters, other namespaces within the target cluster, other processing units in other namespaces within the target cluster, multiple target processing units in the target namespace within the target cluster, and other processing units in the target namespace within the target cluster, and the target processing unit can be set to establish a communication channel in the inlet direction and / or a communication channel in the outlet direction with cluster processing objects of different types, such as Figure 5As shown, a communication channel 1 is established between the target processing unit 1 and the target processing unit 2 in the target namespace in the target cluster in the inlet direction, that is, the communication state of the communication channel 1 is set to the open state, and the communication channel 2 between the target processing unit 1 and other processing units 3 in the target namespace in the target cluster in the inlet direction is closed, that is, the communication state of the communication channel 2 is set to the closed state, thereby achieving network isolation between the target processing unit 1 and other processing units 3. Figure 5 As shown, a communication channel 3 is established between the target processing unit 1 and the target processing unit 4 in the target namespace in the target cluster in the egress direction, that is, the communication state of the communication channel 3 is set to the open state, and a communication channel 4 is established between the target processing unit 1 and other clusters in the egress direction, that is, the communication state of the communication channel 4 is set to the open state. Figure 5 As shown, other communication relationships are not described in detail, wherein a communication channel in a closed state is represented by a dotted arrow, and a communication channel in an open state is represented by a solid arrow.

[0103] The cluster-based network isolation method provided by the embodiment of the present disclosure realizes the network isolation and establishment of communication channels between the target processing unit and various types of resource objects such as other clusters, other processing units, other namespaces, and between the target processing units in the same VPC network environment through a dynamic policy generated based on the application identifier, thereby effectively reducing resource loss, ensuring the feasibility and security of service isolation and data isolation between different customers, and effectively improving the user experience.

[0104] The following is an embodiment of a cluster-based network isolation device provided in an embodiment of the present invention. The device and the cluster-based network isolation method of the above-mentioned embodiments belong to the same inventive concept. For details not described in detail in the embodiment of the cluster-based network isolation device, please refer to the embodiment of the above-mentioned cluster-based network isolation method.

[0105] Figure 6 FIG. 1 is a schematic diagram showing a structure of a cluster-based network isolation device provided by an embodiment of the present disclosure. Figure 6 As shown, the cluster-based network isolation device 600 may include a creation unit 601, an adding unit 602, a configuration information generation unit 603 and a communication channel establishment unit 604, wherein:

[0106] A creating unit 601, configured to create an application in response to an application creation operation, and determine an application identifier;

[0107] An adding unit 602 is used to add a tag to a cluster processing object related to the application based on the application identifier; wherein the cluster processing object is a resource object to establish a communication relationship with a target processing unit where the application is deployed;

[0108] The configuration information generating unit 603 is used to call the executable program segment based on the application identifier to generate the first network isolation configuration information adapted to the application; wherein the executable program segment includes a predefined program for generating the network isolation configuration information using the application identifier;

[0109] The communication channel establishing unit 604 is used to establish a first communication channel between at least some of the cluster processing objects based on the first network isolation configuration information, and set the communication state of the first communication channel to an open state; wherein the first communication channel includes a communication channel in the inlet direction and / or a communication channel in the outlet direction.

[0110] Optionally, the cluster-based network isolation device 600 is further used for:

[0111] Determine the second network isolation configuration information corresponding to the target cluster where the application is deployed, and determine the second communication channel between the target cluster and other clusters, and between resource objects within the target cluster based on the second network isolation configuration information; wherein the communication state of the second communication channel is an open state or a closed state;

[0112] After establishing a first communication channel between at least some of the cluster processing objects based on the first network isolation configuration information and setting the communication state of the communication channel to an open state, the method further includes:

[0113] The first communication channel and the second communication channel are merged, and a target communication channel and a communication state of the target communication channel are determined.

[0114] Optionally, the cluster-based network isolation device 600 is further used for:

[0115] For a target communication channel that is repeated in the first communication channel and the second communication channel, if the communication state of the corresponding first communication channel or the communication state of the corresponding second communication channel is in an open state, the communication state of the corresponding target communication channel is set to an open state;

[0116] For a target communication channel where the first communication channel and the second communication channel overlap, if the communication status of the corresponding first communication channel and the communication status of the corresponding second communication channel are both closed, the communication status of the corresponding target communication channel is set to closed.

[0117] Optionally, the communication channel establishing unit 604 is used to:

[0118] If the cluster processing object includes multiple target processing units in a target namespace in a target cluster where the application is deployed, a first communication channel is established between the target processing units based on the first network isolation configuration information.

[0119] Optionally, the communication channel establishing unit 604 is used to:

[0120] If the cluster processing object also includes other namespaces in the target cluster, then establishing a first communication channel between the target processing unit and the other namespaces based on the first network isolation configuration information;

[0121] Alternatively, if the cluster processing object also includes other processing units in other namespaces, a first communication channel is established between the target processing unit and other namespaces and other processing units based on the first network isolation configuration information.

[0122] Optionally, the communication channel establishing unit 604 is used to:

[0123] If the cluster processing object also includes other clusters, a first communication channel is established between the target processing unit and the other clusters based on the first network isolation configuration information.

[0124] Optionally, the cluster-based network isolation device 600 is further used for:

[0125] In response to a destruction operation of the application, the first network isolation configuration information is deleted.

[0126] The executable program segment includes a script file or a configuration file containing an executable program.

[0127] The application is an application that performs relevant data processing based on a generative model, or the application is an application that performs model training based on a generative model.

[0128] The cluster-based network isolation device provided in the embodiment of the present invention can execute the cluster-based network isolation method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0129] It is worth noting that in the above-mentioned embodiment of the cluster-based network isolation device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific name of each functional unit is only for the convenience of distinguishing each other, and is not used to limit the scope of protection of the present disclosure.

[0130] The present disclosure also provides an electronic device, which may include a processor and a memory, wherein the memory may be used to store executable instructions. The processor may be used to read the executable instructions from the memory and execute the executable instructions to implement the cluster-based network isolation method in the above embodiment.

[0131] Figure 7 A schematic structural diagram of an electronic device provided by an embodiment of the present disclosure is shown.

[0132] like Figure 7 As shown, the electronic device 700 may include a processing device 701 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage device 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the electronic device 700 are also stored. The processing device 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output interface (I / O interface) 705 is also connected to the bus 704.

[0133] Typically, the following devices may be connected to the I / O interface 705: an input device 706 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 707 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 708 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 709. The communication device 709 may allow the electronic device 700 to communicate with other devices wirelessly or by wire to exchange data.

[0134] It should be noted that Figure 7 The electronic device 700 shown is only an example and should not limit the functions and scope of use of the embodiments of the present disclosure. Figure 7 The electronic device 700 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0135] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 709, or installed from the storage device 708, or installed from the ROM 702. When the computer program is executed by the processing device 701, the above-mentioned functions defined in the cluster-based network isolation method of any embodiment of the present disclosure are executed.

[0136] An embodiment of the present disclosure further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the processor implements the cluster-based network isolation method in any embodiment of the present disclosure.

[0137] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0138] In some embodiments, the client and server may communicate using any currently known or future developed network protocol such as HTTP, and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0139] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0140] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device executes the steps of the cluster-based network isolation method described in any embodiment of the present disclosure.

[0141] In embodiments of the present disclosure, computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on a user's computer, partially on a user's computer, as a separate software package, partially on a user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0142] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the equipment, method and computer program product according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0143] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0144] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0145] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0146] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0147] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A cluster-based network isolation method, characterized in that: include: In response to the application creation operation, create the application and determine the application identifier; Based on the application identifier, adding a tag to a cluster processing object related to the application; wherein the cluster processing object is a resource object to establish a communication relationship with a target processing unit where the application is deployed; Based on the application identifier, calling the executable program segment to generate first network isolation configuration information adapted to the application; wherein the executable program segment includes a predefined program for generating network isolation configuration information using the application identifier; Based on the first network isolation configuration information, establish a first communication channel between at least some of the cluster processing objects, and set the communication state of the first communication channel to an open state; wherein the first communication channel includes a communication channel in an inlet direction and / or a communication channel in an outlet direction; Wherein, establishing a first communication channel between at least some of the cluster processing objects based on the first network isolation configuration information includes: If the cluster processing object includes a plurality of the target processing units in the target namespace in the target cluster where the application is deployed, the first communication channel is established between the target processing units based on the first network isolation configuration information.

2. The method according to claim 1, characterized in that The method further comprises: Determine the second network isolation configuration information corresponding to the target cluster where the application is deployed, and determine the second communication channel between the target cluster and other clusters, and between resource objects within the target cluster based on the second network isolation configuration information; wherein the communication state of the second communication channel is the open state or the closed state; After establishing a first communication channel between at least part of the cluster processing objects based on the first network isolation configuration information and setting the communication state of the communication channel to an open state, the method further includes: The first communication channel and the second communication channel are combined, and a target communication channel and a communication state of the target communication channel are determined.

3. The method according to claim 2, characterized in that Determining a communication state of the target communication channel includes: For the target communication channel that is overlapped by the first communication channel and the second communication channel, if the communication state of the corresponding first communication channel or the communication state of the corresponding second communication channel is the open state, setting the communication state of the corresponding target communication channel to the open state; For the target communication channel that is overlapped by the first communication channel and the second communication channel, if the communication state of the corresponding first communication channel and the communication state of the corresponding second communication channel are both closed, the communication state of the corresponding target communication channel is set to the closed state.

4. The method according to claim 1, characterized in that: After establishing the first communication channel between the target processing units based on the first network isolation configuration information, the method further includes: If the cluster processing object also includes other namespaces in the target cluster, establishing the first communication channel between the target processing unit and the other namespaces based on the first network isolation configuration information; Alternatively, if the cluster processing object also includes other processing units in the other namespaces, the first communication channel between the target processing unit and the other namespaces and the other processing units is established based on the first network isolation configuration information.

5. The method according to claim 1, characterized in that After establishing the first communication channel between the target processing units based on the first network isolation configuration information, the method further includes: If the cluster processing object also includes other clusters, the first communication channel between the target processing unit and the other clusters is established based on the first network isolation configuration information.

6. The method according to any one of claims 1 to 5, characterized in that: After establishing a first communication channel between at least part of the cluster processing objects based on the first network isolation configuration information and setting the communication state of the first communication channel to an open state, the method further includes: In response to the destruction operation of the application, the first network isolation configuration information is deleted.

7. The method according to any one of claims 1 to 5, characterized in that: The executable program segment includes a script file or a configuration file containing an executable program.

8. The method according to any one of claims 1 to 5, characterized in that: The application is an application that performs relevant data processing based on a generative model, or the application is an application that performs model training based on the generative model.

9. A cluster-based network isolation device, characterized in that: include: A creating unit, used to create an application program in response to an application program creation operation, and determine an application program identifier; An adding unit, configured to add a tag to a cluster processing object related to the application based on the application identifier; wherein the cluster processing object is a resource object to establish a communication relationship with a target processing unit where the application is deployed; A configuration information generating unit, configured to call an executable program segment based on the application identifier to generate first network isolation configuration information adapted to the application; wherein the executable program segment includes a predefined program for generating network isolation configuration information using the application identifier; A communication channel establishing unit, configured to establish a first communication channel between at least some of the cluster processing objects based on the first network isolation configuration information, and set the communication state of the first communication channel to an open state; wherein the first communication channel includes a communication channel in an inlet direction and / or a communication channel in an outlet direction; Wherein, the communication channel establishing unit is specifically used for: If the cluster processing object includes a plurality of the target processing units in the target namespace in the target cluster where the application is deployed, the first communication channel is established between the target processing units based on the first network isolation configuration information.

10. An electronic device, characterized in that: include: processor; A memory for storing executable instructions; The processor is used to read the executable instructions from the memory and execute the executable instructions to implement the cluster-based network isolation method described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by the processor, the processor implements the cluster-based network isolation method described in any one of claims 1 to 8.

Images