System and method for realizing Kubernetes cluster multi-tenant network isolation based on neutron

Abstract

The invention relates to the technical field of cloud computing and computer networks, in particular to a system and method for achieving Kubernetes cluster multi-tenant network isolation based on Neutron, and the system comprises a controller assembly which is responsible for managing and coordinating the communication between Kubernetes and Neutron, obtaining the state and change of network related resources in a cluster in real time by monitoring a Kubernetes API endpoint, and sending the state and change of the network related resources to a server; the mapping relation from the Kubernetes model to the Neutron model is maintained, so that the consistency and the reliability of network configuration are ensured; the CNI drive program component is responsible for binding the Kubernetes Pod with a Neutron network, so as to ensure the network isolation and the implementation of a security policy; the method has the beneficial effects that on the basis of meeting the cross-host communication of the kubernetes cluster, the problem of multi-tenant network isolation which cannot be met by the existing CNI in the original kubernetes ecology is effectively solved. The tenant can flexibly define the IP segment of the tenant Pods, and does not need to consider the IP overlapping problem with other tenants. And the tenant can flexibly define a Pod network strategy and whether external access or mutual access is provided or not.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud computing and computer network, and in particular to a system and method for implementing multi-tenant network isolation of a Kubernetes cluster based on Neutron. Background Art

[0002] All Pods in a native Kubernetes cluster are in a directly connected flat network and can be directly accessed through IP. Although network isolation can be achieved through namespace and networkpolicy, this isolation is limited. Tenants cannot set up the network individually but use a unified system configuration, resulting in all tenants sharing the same IP segment, DNS, routing, etc., and IP cannot overlap. In addition, native Kubernetes only provides network policy rules, but does not implement networkpolicy.

[0003] Therefore, there is an urgent need for a tenant network isolation method that can achieve complete network isolation between tenants and enable each tenant to independently plan and configure the network, as well as flexible management of the IP segments of the tenant network and overlapping IP segments between multiple tenants. Summary of the invention

[0004] The purpose of the present invention is to provide a system and method for implementing multi-tenant network isolation of a Kubernetes cluster based on Neutron, so as to solve the problems raised in the above background technology.

[0005] To achieve the above object, the present invention provides the following technical solution: a system for implementing multi-tenant network isolation of a Kubernetes cluster based on Neutron, the system comprising:

[0006] The controller component is responsible for managing and coordinating the communication between Kubernetes and Neutron. It obtains the status and changes of network-related resources in the cluster in real time by monitoring the Kubernetes API endpoints, and maintains the mapping relationship between the Kubernetes model and the Neutron model to ensure the consistency and reliability of the network configuration.

[0007] The CNI driver component is responsible for binding the Kubernetes Pod to the Neutron network to ensure network isolation and security policy enforcement.

[0008] Preferably, the controller component further includes: a high availability support function to ensure that in the event of a failure in a certain node of the system, the controller can still maintain the normal operation of the system and will not affect the stability of the entire network due to a single point failure.

[0009] Preferably, the CNI driver component further includes: fine speed limit and network interconnection functions, using the capabilities provided by OpenvSwitch to achieve precise speed limit on the network port in the Pod, and allowing tenants to use the network resources of the OpenStack virtual machine to achieve network interconnection and mutual access between the virtual machines and Pods in the tenant.

[0010] Preferably, the system also includes Neutron and CNI drivers to solve the problem of insufficient network isolation in native Kubernetes clusters, achieve network isolation and security assurance between multiple tenants, allow tenants to flexibly define the network policies and configurations of their Pods, and achieve personalized management and configuration of network resources.

[0011] Preferably, the controller component is also responsible for keeping the Neutron details required by the CNI driver updated in real time by updating the annotations and / or custom resource definitions CRDs of the Kubernetes resource endpoints, thereby ensuring the consistency and reliability of the network configuration.

[0012] A method for implementing multi-tenant network isolation of a Kubernetes cluster based on Neutron, the method comprising:

[0013] The controller component is used to manage and coordinate the communication between Kubernetes and Neutron. The status and changes of network-related resources in the cluster are obtained by real-time monitoring of the Kubernetes API endpoint, and the mapping relationship between the Kubernetes model and the Neutron model is maintained to ensure the synchronization and consistency of the network configuration between the two.

[0014] Preferably, it also includes: binding the Kubernetes Pod to the Neutron network through the CNI driver to ensure network isolation and security between the Pods, so that the Pods of different tenants can run safely in the same cluster without interfering with each other, and at the same time realize flexible management of Neutron resources, including networks and security groups.

[0015] Preferably, it also includes: using the fine speed limit function of the CNI driver to accurately limit the speed of the network port in the Pod, so that the tenant can adjust and manage the network bandwidth according to demand, and realize network interconnection and mutual access between the virtual machines in the tenant and the Pod through the network resources of the OpenStack virtual machine.

[0016] Preferably, by introducing Neutron and CNI drivers, the problem of insufficient network isolation in native Kubernetes clusters is solved, network isolation and security assurance between multiple tenants are achieved, and tenants are allowed to flexibly define the network policies and configurations of their Pods without being restricted by the unified configuration of the system.

[0017] Preferably, the controller component supports a high availability HA mode, so that even if a controller node fails, the system still operates normally and the stability of the entire network is not affected by a single point of failure, thereby ensuring the stability and reliability of the system.

[0018] Compared with the prior art, the present invention has the following beneficial effects:

[0019] The system and method for realizing multi-tenant network isolation of Kubernetes cluster based on neutron proposed in the present invention effectively solve the problem of multi-tenant network isolation that cannot be satisfied by the existing CNI in the native Kubernetes ecosystem, on the basis of satisfying the cross-host communication of the Kubernetes cluster. Tenants can flexibly define the IP segments of tenant Pods without considering the IP overlap with other tenants. Tenants can flexibly define the network policy of Pods and whether to provide external access or mutual access. Tenants can use the precise speed limit of the network bandwidth of the network port in Pods provided by Openvswitch. Tenants can also use the network resources of openstack virtual machines to achieve network intercommunication and mutual access between virtual machines and Pods within the tenant. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a diagram of the system component architecture of the present invention;

[0021] Figure 2 This is a schematic diagram of the multi-tenant network isolation Pods topology of the present invention. DETAILED DESCRIPTION

[0022] In order to make the purpose and technical solution of the present invention clearly and completely described, and the advantages more clearly understood, the embodiments of the present invention are further described in detail with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are part of the embodiments of the present invention, rather than all of the embodiments, and are only used to explain the embodiments of the present invention, and are not used to limit the embodiments of the present invention. All other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] For example, see Figure 1 to Figure 2 The present invention provides a technical solution: a system for implementing multi-tenant network isolation of a Kubernetes cluster based on Neutron, the system comprising:

[0024] 1. Controller

[0025] The controller is the core component of the entire system, which is responsible for managing the communication and coordination between Kubernetes and Neutron. Its main functions include:

[0026] -Kubernetes API monitoring and synchronization: The controller monitors the Kubernetes API endpoints to obtain the status and changes of various network-related resources in the cluster in real time. Once a new Pod is created or deleted, the controller immediately responds and updates the network configuration in Neutron to ensure synchronization between the two.

[0027] -Model mapping and persistence maintenance: The controller is responsible for maintaining the mapping relationship between the Kubernetes model and the Neutron model and ensuring the persistence of this mapping. By updating the annotations and / or custom resource definitions (CRDs) of Kubernetes resource endpoints, the controller keeps the Neutron details required by the CNI driver updated in real time, thereby ensuring the consistency and reliability of the network configuration.

[0028] -High availability support: To ensure the stability and reliability of the system, the controller supports high availability (HA) mode. Even if a controller node fails, the system can still operate normally, and the stability of the entire network will not be affected by a single point of failure.

[0029] 2. CNI Driver

[0030] The CNI driver is another key component that is responsible for binding Kubernetes Pods to Neutron networks and ensuring network isolation and security policy enforcement. Its main functions include:

[0031] -Pod binding and network isolation: The CNI driver is responsible for binding the Kubernetes Pod to the Neutron network on the worker node. By binding the Pod to the corresponding Neutron port, network isolation and security between Pods are ensured, so that Pods of different tenants can run safely in the same cluster without interfering with each other.

[0032] - Resource management and event processing: The CNI driver processes Pod events by interacting with the Kubernetes event processor interface class and adjusts the Neutron network configuration accordingly. By using various resource management drivers, flexible management of Neutron resources is achieved, including networks, security groups, etc.

[0033] - Fine-grained speed limit and network interconnection: Using the functions provided by OpenvSwitch, the CNI driver implements precise speed limit for the network port in the Pod, allowing tenants to adjust and manage network bandwidth according to demand. At the same time, tenants can use the network resources of OpenStack virtual machines to achieve network interconnection and mutual access between virtual machines and Pods within the tenant.

[0034] 3. Technical solution advantages

[0035] The technical solution of the present invention has the following advantages and beneficial effects:

[0036] -Multi-tenant network isolation: By introducing Neutron and CNI drivers, the problem of insufficient network isolation in native Kubernetes clusters is solved, and network isolation and security assurance between multiple tenants are achieved.

[0037] -Flexible network management: Tenants can flexibly define the network policies and configurations of their Pods without being restricted by the unified configuration of the system, thus achieving personalized management and configuration of network resources.

[0038] -Precise speed limit and network interconnection: Through the fine speed limit function of the CNI driver and the flexible use of Neutron network resources, precise adjustment and management of network bandwidth are achieved, while the interconnection and mutual access of network resources inside and outside the tenant are realized.

[0039] -System stability and reliability: The high availability support of the controller ensures the stability and reliability of the system. Even if a certain node fails, the system can still operate normally, and the stability of the entire network will not be affected by a single point of failure.

[0040] Through the implementation of this technical solution, we have effectively improved the network security, flexibility, and management efficiency of the Kubernetes cluster, and provided a more stable and reliable network infrastructure support for the deployment and operation of containerized applications.

[0041] Embodiment 2, refer to the attached Figure 2On the basis of Example 1, it is proposed that: the network resources between tenant VPC1 and tenant VPC2 are strongly isolated by VXLAN. All Pods under VPC can belong to the same network segment or different network segments, which can be flexibly defined according to user needs. The CIDR of Pods of VPC1 can also overlap with the CIDR of Pods of VPC2. All traffic from VPC1 to VPC2 is unreachable, and network isolation between tenants is achieved. For traffic that needs to be accessed between different tenants, access to the Internet or other VPCs can be achieved by binding FloatingIP. Because the underlying layer uses a mature, flexible and powerful Openvswitch network, it also better supports the security control of network ports on Pods, such as the application of ACL, and the application of port speed limit Qos, which can be flexibly applied to their own Pods according to user needs.

[0042] Embodiment 3, based on Embodiment 2, proposes: a method for implementing multi-tenant network isolation of a Kubernetes cluster based on Neutron, the method comprising:

[0043] The controller component is used to manage and coordinate the communication between Kubernetes and Neutron. The status and changes of network-related resources in the cluster are obtained by real-time monitoring of the Kubernetes API endpoint, and the mapping relationship between the Kubernetes model and the Neutron model is maintained to ensure the synchronization and consistency of the network configuration between the two.

[0044] It also includes: binding Kubernetes Pods to Neutron networks through CNI drivers to ensure network isolation and security between Pods, so that Pods of different tenants can run safely in the same cluster without interfering with each other, while achieving flexible management of Neutron resources, including networks and security groups.

[0045] It also includes: using the fine-grained speed limit function of the CNI driver to accurately limit the speed of the network port within the Pod, allowing tenants to adjust and manage network bandwidth according to demand, and achieving network interconnection and mutual access between virtual machines and Pods within the tenant through the network resources of the OpenStack virtual machine.

[0046] By introducing Neutron and CNI drivers, the problem of insufficient network isolation in native Kubernetes clusters is solved, network isolation and security assurance between multiple tenants are achieved, and tenants are allowed to flexibly define the network policies and configurations of their Pods without being restricted by the unified configuration of the system.

[0047] The controller component supports high availability HA mode. Even if a controller node fails, the system will still operate normally and the stability of the entire network will not be affected by a single point of failure, thus ensuring the stability and reliability of the system.

[0048] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A system for implementing multi-tenant network isolation in a Kubernetes cluster based on Neutron, characterized by: The system comprises: The controller component is responsible for managing and coordinating the communication between Kubernetes and Neutron. It obtains the status and changes of network-related resources in the cluster in real time by monitoring the Kubernetes API endpoints, and maintains the mapping relationship between the Kubernetes model and the Neutron model to ensure the consistency and reliability of the network configuration. The CNI driver component is responsible for binding the Kubernetes Pod to the Neutron network to ensure network isolation and security policy enforcement.

2. According to claim 1, a system for implementing multi-tenant network isolation of Kubernetes cluster based on neutron is characterized in that: The controller component further includes: high availability support function, which ensures that in the event of a failure in a certain node of the system, the controller can still maintain the normal operation of the system and will not affect the stability of the entire network due to a single point of failure.

3. According to claim 1, a system for implementing multi-tenant network isolation of Kubernetes cluster based on neutron is characterized in that: The CNI driver component further includes: fine-grained rate limiting and network interconnection functions, which use the capabilities provided by OpenvSwitch to achieve precise rate limiting of network ports within the Pod, and allow tenants to use the network resources of the OpenStack virtual machine to achieve network interconnection and mutual access between the virtual machines and Pods within the tenant.

4. According to claim 1, a system for implementing multi-tenant network isolation of Kubernetes cluster based on neutron is characterized in that: The system also includes Neutron and CNI drivers to solve the problem of insufficient network isolation in native Kubernetes clusters, achieve network isolation and security between multiple tenants, allow tenants to flexibly define the network policies and configurations of their Pods, and achieve personalized management and configuration of network resources.

5. According to claim 1, a system for implementing multi-tenant network isolation of Kubernetes cluster based on neutron is characterized in that: The controller component is also responsible for keeping the Neutron details required by the CNI driver up to date by updating annotations and / or custom resource definitions (CRDs) for Kubernetes resource endpoints, thereby ensuring consistent and reliable network configuration.

6. A method for implementing multi-tenant network isolation of a Kubernetes cluster based on Neutron in a system for implementing multi-tenant network isolation of a Kubernetes cluster based on Neutron according to any one of claims 1 to 5, characterized in that: The method comprises: The controller component is used to manage and coordinate the communication between Kubernetes and Neutron. The status and changes of network-related resources in the cluster are obtained by real-time monitoring of the Kubernetes API endpoint, and the mapping relationship between the Kubernetes model and the Neutron model is maintained to ensure the synchronization and consistency of the network configuration between the two.

7. According to claim 6, a method for implementing multi-tenant network isolation of a Kubernetes cluster based on neutron is characterized in that: Also includes: The Kubernetes Pod is bound to the Neutron network through the CNI driver to ensure network isolation and security between Pods, so that Pods of different tenants can run safely in the same cluster without interfering with each other, and at the same time achieve flexible management of Neutron resources, including networks and security groups.

8. According to claim 7, a method for implementing multi-tenant network isolation of a Kubernetes cluster based on neutron is characterized in that: Also includes: By using the fine-grained rate limiting function of the CNI driver, the network ports in the Pod can be accurately limited, allowing tenants to adjust and manage network bandwidth according to their needs, and achieve network interconnection and mutual access between the VMs and Pods within the tenant through the network resources of the OpenStack VM.

9. According to claim 8, a method for implementing multi-tenant network isolation of a Kubernetes cluster based on neutron is characterized in that: By introducing Neutron and CNI drivers, the problem of insufficient network isolation in native Kubernetes clusters is solved, network isolation and security assurance between multiple tenants are achieved, and tenants are allowed to flexibly define the network policies and configurations of their Pods without being restricted by the unified configuration of the system.

10. According to claim 6, a method for implementing multi-tenant network isolation of a Kubernetes cluster based on neutron is characterized in that: The controller component supports high availability HA mode. Even if a controller node fails, the system will still operate normally and the stability of the entire network will not be affected by a single point of failure, thus ensuring the stability and reliability of the system.

Images