Cloud edge collaboration-based network traffic mirroring derivation method and system

Abstract

The embodiment of the application provides a network flow mirror export method and system based on cloud edge cooperation. Wherein, the method uses Kube-ovn network plug-in to export network flow mirror of containers and virtual machines, and uses multiple ways to manage network flow mirror of containers and virtual machines. In addition to the existing virtual network card on the physical machine as the target address of network flow mirror export, the physical network card on the physical machine and the second Pod and the second virtual machine are added as the target address of network flow mirror export, and the network flow mirror export is realized based on the Kube-ovn network plug-in and the above target address. Through the above technical scheme, in the cloud edge cooperation environment, multiple ways of flow mirror management of containers and virtual machines can be realized, thereby improving the security of network flow monitoring and troubleshooting.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a network traffic mirror export method and system based on cloud edge collaboration. BACKGROUND

[0002] With the development of big data and artificial intelligence, network traffic mirror emerges as the times require, which is usually used in network management and security field, and can help network administrators and security experts to understand and optimize network performance and detect potential security threats.

[0003] At present, the traditional network traffic mirror export is realized by the following steps: taking the virtual network card on the physical machine as the target address of traffic mirror export, and directly capturing the traffic packet of the virtual network card to analyze the network traffic data of the pod and the virtual machine.

[0004] However, the traditional network traffic mirror export can only take the virtual network card on the physical machine as the target address of traffic mirror export, and cannot realize the multi-mode management of containers and virtual machines, thereby causing low security of network traffic monitoring and troubleshooting. SUMMARY

[0005] The network traffic mirror export method and system based on cloud edge collaboration provided by the embodiments of the present application can improve the security of network traffic monitoring and troubleshooting.

[0006] In a first aspect, the embodiments of the present application provide a network traffic mirror export method based on cloud edge collaboration, which comprises:

[0007] using a Kube-ovn network plug-in to take a first pod and a first virtual machine as the source of network traffic mirror, wherein the Kube-ovn network plug-in can perform mirror export on the network traffic;

[0008] determining a target address of the network traffic mirror export, wherein the target address comprises at least one of a virtual network card on a physical machine, a physical network card on the physical machine, a second pod and a second virtual machine, the second pod being different from the first pod, and the second virtual machine being different from the first virtual machine;

[0009] based on the Kube-ovn network plug-in and the target address, performing mirror export of the network traffic from the first pod and the first virtual machine to the target address;

[0010] Preferably,

[0011] the using the Kube-ovn network plug-in to take the first pod and the first virtual machine as the source of network traffic mirror comprises:

[0012] When the first Pod is the source of the network traffic mirror, the corresponding ownerReference resource is determined using the first Pod;

[0013] A first tag is added to the target body template and the first pod to generate a first target type. The target body includes at least one of Deployment, StatefulSet and DaemonSet resources. The Deployment, StatefulSet and DaemonSet resources can generate the first pod. The first target type is used to reflect the type of the first pod.

[0014] When the first virtual machine is the source of the network traffic mirroring, the corresponding VirtualMachine and VirtualMachineInstance resources are determined using the first virtual machine;

[0015] A second tag is added to the template of the VirtualMachine and VirtualMachineInstance resources and the second pod to generate a second target type. The second pod is determined by the label of the vm, and the second target type is used to reflect the type of the second pod.

[0016] Integrate and package the functions of the first target type and the second target type;

[0017] Preferably,

[0018] Determining the target address for the network traffic mirroring includes:

[0019] When the target address exported by the network traffic mirror is the virtual network interface card on the physical machine, the source of the network traffic mirror is exported to the first target virtual network interface card of each physical node;

[0020] Obtain the traffic data packets of the first target virtual network interface card, and process the network traffic data of the first pod and the first virtual machine;

[0021] Preferably,

[0022] When the target address exported by the network traffic mirror is the physical network card on the physical machine, determine the name of the physical network card exported by the network traffic mirror;

[0023] Determine the first Kube-ovn-cni pod corresponding to the node where the physical network interface card is located;

[0024] Remotely connect to the pod of the first Kube-ovn-cni;

[0025] Execute the command to configure the mirror in OVS, and set the physical network card as the output port of the mirror network card;

[0026] Preferably,

[0027] When the target address exported by the network traffic mirror is the second Pod, determine the name of the second Pod to be exported;

[0028] Determine the second Kube-ovn-cni pod corresponding to the node where the second pod is located;

[0029] Remotely connect to the second Kube-ovn-cni pod;

[0030] Use container tool commands to determine the container ID corresponding to the node where the second pod is located;

[0031] The second target virtual network interface is determined using the IP address command, wherein the second target virtual network interface contains the target number of bits of the container ID, and the target number of bits is the first 5 bits;

[0032] The second target virtual network interface card is used as the location for exporting the network traffic mirror;

[0033] Execute the command to configure the mirror in OVS, and set the second target virtual network card as the output port of the mirror network card;

[0034] Preferably,

[0035] When the target address exported by the network traffic mirroring is the second virtual machine, determine the name of the second virtual machine to be exported;

[0036] Determine the third Kube-ovn-cni pod corresponding to the node where the second virtual machine is located;

[0037] Remotely connect to the third Kube-ovn-cni pod;

[0038] The container tool command is used to determine the container ID corresponding to the node where the second virtual machine is located;

[0039] The third target virtual network interface is determined by the IP address command, wherein the third target virtual network interface includes the target number of the container ID and underscores;

[0040] The third target virtual network interface card is used as the location for exporting the network traffic mirror;

[0041] Execute the command to configure the mirror in OVS, and set the third target virtual network card as the output of the mirror network card;

[0042] Preferably,

[0043] After the location where the second target virtual network interface card is exported as the network traffic mirror, the method further includes:

[0044] The location information of the second target virtual network interface card is stored in the resources of the second Kube-ovn-cni pod;

[0045] Preferably,

[0046] After setting the third target virtual network interface card as the location for exporting the network traffic mirror, the method further includes:

[0047] The location information of the third target virtual network interface card is stored in the resources of the third Kube-ovn-cni pod;

[0048] Preferably,

[0049] Before using the Kube-ovn network plugin to use the first Pod and the first virtual machine as the source of network traffic mirroring, the following is further included:

[0050] When the controller of the Kube-ovn network plugin detects that traffic mirroring needs to be enabled, it adds select_src_port as a column;

[0051] When the controller of the Kube-ovn network plugin detects that traffic mirroring is turned off, the column containing select_src_port is deleted.

[0052] Secondly, embodiments of the present invention provide a network traffic mirroring export system based on cloud-edge collaboration, the system comprising:

[0053] The configuration module is used to use the Kube-ovn network plugin to use the first Pod and the first virtual machine as the source of network traffic mirroring, wherein the Kube-ovn network plugin is capable of mirroring and exporting the network traffic;

[0054] The determination module is used to determine the target address exported by the network traffic mirroring, wherein the target address includes at least one of: a virtual network interface card on a physical machine, a physical network interface card on a physical machine, a second Pod and a second virtual machine, wherein the second Pod is different from the first Pod, and the second virtual machine is different from the first virtual machine;

[0055] The processing module is used to export the network traffic image from the first Pod and the first virtual machine to the target address based on the Kube-ovn network plugin and the target address;

[0056] Preferably,

[0057] The setting module is also used to perform:

[0058] When the first Pod is the source of the network traffic mirror, the corresponding ownerReference resource is determined using the first Pod;

[0059] A first tag is added to the target body template and the first pod to generate a first target type. The target body includes at least one of Deployment, StatefulSet and DaemonSet resources. The Deployment, StatefulSet and DaemonSet resources can generate the first pod. The first target type is used to reflect the type of the first pod.

[0060] When the first virtual machine is the source of the network traffic mirroring, the corresponding VirtualMachine and VirtualMachineInstance resources are determined using the first virtual machine;

[0061] A second tag is added to the template of the VirtualMachine and VirtualMachineInstance resources and the second pod to generate a second target type. The second pod is determined by the label of the vm, and the second target type is used to reflect the type of the second pod.

[0062] Integrate and package the functions of the first target type and the second target type;

[0063] Preferably,

[0064] The determining module is also used to perform:

[0065] When the target address exported by the network traffic mirror is the virtual network interface card on the physical machine, the source of the network traffic mirror is exported to the first target virtual network interface card of each physical node;

[0066] Obtain the traffic data packets of the first target virtual network interface card, and process the network traffic data of the first pod and the first virtual machine;

[0067] Preferably,

[0068] When the target address exported by the network traffic mirror is the physical network card on the physical machine, determine the name of the physical network card exported by the network traffic mirror;

[0069] Determine the first Kube-ovn-cni pod corresponding to the node where the physical network interface card is located;

[0070] Remotely connect to the pod of the first Kube-ovn-cni;

[0071] Execute the command to configure the mirror in OVS, and set the physical network card as the output port of the mirror network card;

[0072] Preferably,

[0073] When the target address exported by the network traffic mirror is the second Pod, determine the name of the second Pod to be exported;

[0074] Determine the second Kube-ovn-cni pod corresponding to the node where the second pod is located;

[0075] Remotely connect to the second Kube-ovn-cni pod;

[0076] Use container tool commands to determine the container ID corresponding to the node where the second pod is located;

[0077] The second target virtual network interface is determined using the IP address command, wherein the second target virtual network interface contains the target number of bits of the container ID, and the target number of bits is the first 5 bits;

[0078] The second target virtual network interface card is used as the location for exporting the network traffic mirror;

[0079] Execute the command to configure the mirror in OVS, and set the second target virtual network card as the output port of the mirror network card;

[0080] Preferably,

[0081] When the target address exported by the network traffic mirroring is the second virtual machine, determine the name of the second virtual machine to be exported;

[0082] Determine the third Kube-ovn-cni pod corresponding to the node where the second virtual machine is located;

[0083] Remotely connect to the third Kube-ovn-cni pod;

[0084] The container tool command is used to determine the container ID corresponding to the node where the second virtual machine is located;

[0085] The IP address command is used to determine the third target virtual network interface card, wherein the third...

[0086] The target virtual network interface card includes the target number of bits and underscores in the container ID;

[0087] The third target virtual network interface card is used as the location for exporting the network traffic mirror;

[0088] Execute the command to configure the mirror in OVS, and set the third target virtual network card as the output of the mirror network card;

[0089] Preferably,

[0090] The determining module is also used to perform:

[0091] The location information of the second target virtual network interface card is stored in the resources of the second Kube-ovn-cni pod;

[0092] Preferably,

[0093] After setting the third target virtual network interface card as the location for exporting the network traffic mirror, the method further includes:

[0094] The location information of the third target virtual network interface card is stored in the resources of the third Kube-ovn-cni pod;

[0095] Preferably,

[0096] Prior to the setting module, a listening module is further included;

[0097] The monitoring module is used to perform:

[0098] When the controller of the Kube-ovn network plugin detects that traffic mirroring needs to be enabled, it adds select_src_port as a column;

[0099] When the controller of the Kube-ovn network plugin detects that traffic mirroring is turned off, the column containing select_src_port is deleted.

[0100] Thirdly, embodiments of the present invention provide a network traffic mirroring export system based on cloud-edge collaboration, comprising: at least one memory and at least one processor;

[0101] The at least one memory is used to store a machine-readable program;

[0102] The at least one processor is configured to invoke the machine-readable program to perform the method according to any one of the first aspects of the claim.

[0103] Fourthly, embodiments of the present invention provide a computer-readable medium storing computer instructions, which, when executed by a processor, cause the processor to perform any of the methods described in the first aspect.

[0104] This invention provides a method for exporting network traffic mirroring based on cloud-edge collaboration. Network management in a cloud-edge collaborative environment faces challenges, including rapid fault location and handling. It requires the ability to forward customer network data packets to a target address for location and troubleshooting through traffic mirroring. Therefore, the Kube-ovn network plugin can be used to export network traffic mirroring for containers and virtual machines, employing multiple methods for network traffic mirroring management. In addition to using the virtual network interface card (NIC) on the physical machine as the target address for network traffic mirroring, this invention adds the physical NIC on the physical machine, as well as a second Pod and a second virtual machine, as target addresses for network traffic mirroring. Network traffic mirroring is then implemented based on the Kube-ovn network plugin and these target addresses. By adopting this technical solution, multi-method traffic mirroring management for containers and virtual machines can be achieved in a cloud-edge collaborative environment, thereby improving the security of network traffic monitoring and troubleshooting. Attached Figure Description

[0105] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0106] Figure 1 This is a flowchart of a network traffic mirroring export method based on cloud-edge collaboration provided in an embodiment of the present invention;

[0107] Figure 2 This is a flowchart of another method for exporting network traffic mirroring based on cloud-edge collaboration provided in an embodiment of the present invention;

[0108] Figure 3 This is a schematic diagram of a network traffic mirroring and export system based on cloud-edge collaboration provided in an embodiment of the present invention;

[0109] Figure 4 This is a schematic diagram of another cloud-edge collaborative network traffic mirroring export system provided in an embodiment of the present invention. Detailed Implementation

[0110] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0111] like Figure 1 As shown in the figure, this embodiment of the invention provides a method for exporting network traffic mirroring based on cloud-edge collaboration, which may include the following steps:

[0112] Step 101: Use the Kube-ovn network plugin to make the first Pod and the first virtual machine the source of network traffic mirroring. The Kube-ovn network plugin can export network traffic mirroring.

[0113] Step 102: Determine the target address for network traffic mirroring, wherein the target address includes at least one of the following: a virtual network interface card on a physical machine, a physical network interface card on a physical machine, a second Pod, and a second virtual machine. The second Pod is different from the first Pod, and the second virtual machine is different from the first virtual machine.

[0114] Step 103: Based on the Kube-ovn network plugin and the target address, mirror and export the network traffic from the first Pod and the first virtual machine to the target address.

[0115] This invention provides a method for exporting network traffic mirroring based on cloud-edge collaboration. Network management in a cloud-edge collaborative environment faces challenges, including rapid fault location and handling. It requires the ability to forward customer network data packets to a target address for location and troubleshooting through traffic mirroring. Therefore, the Kube-ovn network plugin can be used to export network traffic mirroring for containers and virtual machines, employing multiple methods for managing network traffic mirroring for containers and virtual machines. In addition to using the virtual network interface card (NIC) on the physical machine as the target address for network traffic mirroring, this invention adds the physical NIC on the physical machine, as well as a second Pod and a second virtual machine, as target addresses for network traffic mirroring. Network traffic mirroring is then implemented based on the Kube-ovn network plugin and these target addresses. By adopting this technical solution, multiple methods of traffic mirroring management for containers and virtual machines can be achieved in a cloud-edge collaborative environment, thereby improving the security of network traffic monitoring and troubleshooting.

[0116] To ensure the network traffic mirroring function remains effective, in one embodiment of the present invention, step 101 in the above embodiment, which uses the Kube-ovn network plugin to use the first Pod and the first virtual machine as the source of network traffic mirroring, includes:

[0117] When the first Pod is the source of the network traffic mirror, the corresponding ownerReference resource is determined using the first Pod;

[0118] A first tag is added to the target body template and the first pod to generate a first target type. The target body includes at least one of Deployment, StatefulSet and DaemonSet resources. The Deployment, StatefulSet and DaemonSet resources can generate the first pod. The first target type is used to reflect the type of the first pod.

[0119] When the first virtual machine is the source of the network traffic mirroring, the corresponding VirtualMachine and VirtualMachineInstance resources are determined using the first virtual machine;

[0120] A second tag is added to the template of the VirtualMachine and VirtualMachineInstance resources and the second pod to generate a second target type. The second pod is determined by the label of the vm, and the second target type is used to reflect the type of the second pod.

[0121] The functions of the first target type and the second target type are integrated and packaged.

[0122] In this embodiment of the invention, the Kube-ovn network plugin itself supports using pods as sources of network traffic mirroring. However, the existing method involves tagging the corresponding pod with a label like "subnet.namespace.ovn.kubernetes.io / mirror"="true". The Kube-ovn controller can then listen for this and set up an OVS mirror on the node where the pod resides, adding the pod's corresponding network interface to the mirror's src_port, thereby enabling the pod to function as a source of network traffic mirroring. However, this logic cannot be implemented in many scenarios. For example, for pods that are not running independently, they may be generated from resources such as Deployment, StatefulSet, or DaemonSet. If a label is directly added to the pod, although it may be effective temporarily, once the pod is deleted and restarted, the newly generated pod will not have the label, and Kube-ovn will then shut down its traffic mirroring source. In addition, virtual machines are also generated from VirtualMachine and VirtualMachineInstance resources, and require special processing through the backend API interface to remain effective. Therefore, through the above modifications, even if a non-standalone pod is deleted and restarted, Kube-ovn will not shut down its traffic mirroring source. Pods generated by resources such as Deployment, StatefulSet, or DaemonSet can achieve temporary effectiveness and remain effective after restart.

[0123] To achieve multi-mode network traffic mirroring export, in one embodiment of the present invention, the step 102 in the above embodiment, determining the target address for the network traffic mirroring export, includes:

[0124] When the target address exported by the network traffic mirror is the virtual network interface card on the physical machine, the source of the network traffic mirror is exported to the first target virtual network interface card of each physical node;

[0125] Obtain the traffic data packets of the first target virtual network interface card, and process the network traffic data of the first pod and the first virtual machine.

[0126] In order to export network traffic to a physical network interface card (NIC), in one embodiment of the present invention, determining the target address for the network traffic mirroring export in step 102 of the above embodiment includes:

[0127] When the target address exported by the network traffic mirror is the physical network card on the physical machine, determine the name of the physical network card exported by the network traffic mirror;

[0128] Determine the first Kube-ovn-cni pod corresponding to the node where the physical network interface card is located;

[0129] Remotely connect to the pod of the first Kube-ovn-cni;

[0130] Execute the command to configure the mirror in OVS, and set the physical network card as the output port of the mirror network card.

[0131] In order to export network traffic to other Pods, in one embodiment of the present invention, determining the target address for the network traffic mirroring export in step 102 of the above embodiment includes:

[0132] When the target address exported by the network traffic mirror is the second Pod, determine the name of the second Pod to be exported;

[0133] Determine the second Kube-ovn-cni pod corresponding to the node where the second pod is located;

[0134] Remotely connect to the second Kube-ovn-cni pod;

[0135] Use container tool commands to determine the container ID corresponding to the node where the second pod is located;

[0136] The second target virtual network interface is determined using the IP address command, wherein the second target virtual network interface contains the target number of bits of the container ID, and the target number of bits is the first 5 bits;

[0137] The second target virtual network interface card is used as the location for exporting the network traffic mirror;

[0138] Execute the command to configure the mirror in OVS, and set the second target virtual network card as the output port of the mirror network card.

[0139] In order to export network traffic to other virtual machines, in one embodiment of the present invention, the step 102 in the above embodiment, which involves determining the target address for the network traffic mirroring export, includes:

[0140] When the target address exported by the network traffic mirroring is the second virtual machine, determine the name of the second virtual machine to be exported;

[0141] Determine the third Kube-ovn-cni pod corresponding to the node where the second virtual machine is located;

[0142] Remotely connect to the third Kube-ovn-cni pod;

[0143] The container tool command is used to determine the container ID corresponding to the node where the second virtual machine is located;

[0144] The third target virtual network interface is determined by the IP address command, wherein the third target virtual network interface includes the target number of the container ID and underscores;

[0145] The third target virtual network interface card is used as the location for exporting the network traffic mirror;

[0146] Execute the command to configure the mirror in OVS, and set the third target virtual network card as the output of the mirror network card.

[0147] In this embodiment of the invention, Kube-ovn itself supports using the virtual network interface card (NIC) on the physical machine as the target address for network traffic mirroring. By default, it will export the network traffic mirroring source of the first Pod and the first virtual machine to the virtual NIC mirror0 on each physical node. The scenario in which the default virtual NIC is used is generally when the user can directly log in to the physical machine and directly capture the traffic packets of the mirror0 NIC to analyze the network data of the first Pod and the first virtual machine.

[0148] To enable multi-method network traffic mirroring export, an existing physical network interface card (NIC) on the physical machine can be used as the target address for network traffic mirroring export. This feature is typically used when users do not directly log into the physical machine, but instead connect their terminal laptop to the physical machine's network port via an Ethernet cable. Users can then directly capture the exported network traffic mirror packets on their laptop using tools such as Wireshark. However, this feature is not natively supported by Kube-ovn, so the above modification is necessary.

[0149] In addition, other pods or virtual machines can be used as target addresses for traffic mirroring. This feature is useful when users cannot access physical machines but can access container pods or virtual machines. Therefore, network traffic can be mirrored and exported to other pods or virtual machines, allowing users to centrally capture and analyze traffic data within these pods or virtual machines. This method is not supported by Kube-ovn and requires modification. Hence, the above modification process was designed to achieve multi-method network traffic mirroring export.

[0150] To extend the export location, in one embodiment of the present invention, after the location where the second target virtual network interface card is exported as the network traffic mirror in the above embodiment, the method further includes:

[0151] The location information of the second target virtual network card is stored in the resources of the second Kube-ovn-cni pod.

[0152] In order to export network traffic to a physical network interface card (NIC), in one embodiment of the present invention, after setting the third target virtual NIC as the location for exporting the network traffic mirror, the embodiment further includes:

[0153] The location information of the third target virtual network card is stored in the resources of the third Kube-ovn-cni pod.

[0154] In this embodiment of the invention, the original startup logic of Kube-ovn only supports one virtual network interface mode, mirror0. Therefore, the export location will be changed to the virtual network interface mirror0 every time it restarts. Since we have expanded the export location to two target addresses for network traffic mirroring, the corresponding logic needs to be modified. Therefore, after setting the export location each time, the information can be stored in the resources that the Kube-ovn-cni pod can obtain, such as ConfigMap or mounted files. In this way, when Kube-ovn restarts, the information is read first and then re-initialized according to the information data.

[0155] In order to mirror all the sending and receiving traffic from the source of network traffic export, in one embodiment of the present invention, before step 101 of using the Kube-ovn network plugin to use the first Pod and the first virtual machine as the source of network traffic mirroring, the following is further included:

[0156] When the controller of the Kube-ovn network plugin detects that traffic mirroring needs to be enabled, it adds select_src_port as a column;

[0157] When the controller of the Kube-ovn network plugin detects that traffic mirroring is turned off, the column containing select_src_port is deleted.

[0158] In this embodiment of the invention, Kube-ovn's default traffic export source only includes dstPort, meaning that only received traffic is mirrored and exported. If the traffic is actively sent, it will not be exported. For traffic analysis, this may miss key information. Therefore, it is also necessary to export the traffic of srcPort. The specific modification logic is that when it is detected that the source needs to be mirrored, the original select_dst_port is changed to add a select_src_port column; similarly, when the traffic mirroring logic is turned off, it is also necessary to delete it accordingly.

[0159] like Figure 2As shown, to more clearly illustrate the technical solution and advantages of the present invention, the following provides a detailed description of a network traffic mirroring export method based on cloud-edge collaboration, which may include the following steps:

[0160] Step 201: When the Kube-ovn network plugin controller detects that traffic mirroring is about to be enabled, add select_src_port as a column; when the Kube-ovn network plugin controller detects that traffic mirroring is disabled, delete the column containing select_src_port.

[0161] Specifically, the Kube-ovn network plugin is an open-source plugin for Kubernetes clusters, designed to provide a simple, high-performance, and scalable way to manage network policies within the cluster to meet the needs of modern cloud-native applications.

[0162] Step 202: When the first Pod is the source of network traffic mirroring, use the first Pod to determine the corresponding ownerReference resource;

[0163] Step 203: Add a first tag to the target body template and the first pod to generate the first target type. The target body includes at least one of Deployment, StatefulSet and DaemonSet resources. Deployment, StatefulSet and DaemonSet resources can generate the first pod. The first target type is used to reflect the type of the first pod.

[0164] Step 204: When the first virtual machine is the source of network traffic mirroring, use the first virtual machine to determine the corresponding VirtualMachine and VirtualMachineInstance resources;

[0165] Step 205: Add a second label to the template of VirtualMachine and VirtualMachineInstance resources and the second pod to generate a second target type. The second pod is determined by the label of the vm, and the second target type is used to reflect the type of the second pod.

[0166] Step 206: Integrate and package the functions of the first target type and the second target type;

[0167] Step 207: When the target address of the network traffic mirroring is the virtual network interface card on the physical machine, export the source of the network traffic mirroring to the first target virtual network interface card of each physical node;

[0168] Step 208: Obtain the traffic data packets of the first target virtual network interface card, and process the network traffic data of the first pod and the first virtual machine;

[0169] Step 209: When the target address for network traffic mirroring is the physical network card on the physical machine, determine the name of the physical network card for which network traffic mirroring is exported;

[0170] Step 210: Determine the first Kube-ovn-cni pod corresponding to the node where the physical network card is located, remotely connect to the first Kube-ovn-cni pod, execute the OVS configuration mirror command, and use the physical network card as the output of the mirror network card;

[0171] Step 211: When the target address for exporting network traffic mirroring is the second Pod, determine the name of the second Pod to be exported;

[0172] Step 212: Determine the second Kube-ovn-cni pod corresponding to the node where the second pod is located, and remotely connect to the second Kube-ovn-cni pod;

[0173] For example, you can connect remotely using a method similar to kubectl exec.

[0174] Step 213: Use container tool commands to determine the container ID corresponding to the node where the second pod is located, use the Ipaddress command to determine the second target virtual network interface, and use the second target virtual network interface as the location for exporting network traffic mirroring. The second target virtual network interface contains the target number of bits of the container ID, and the target number of bits is the first 5.

[0175] Step 214: Store the location information of the second target virtual network interface into the resources of the second Kube-ovn-cni pod, execute the command to configure the mirror in OVS, and set the second target virtual network interface as the output of the mirror network interface;

[0176] Specifically, when executing commands to configure output, it is necessary to query the existing srcPort and dstPort in advance, and keep srcPort and dstPort unchanged when executing commands;

[0177] Step 215: When the target address for network traffic mirroring is the second virtual machine, determine the name of the second virtual machine to be exported;

[0178] Step 216: Determine the third Kube-ovn-cni pod corresponding to the node where the second virtual machine is located, and remotely connect to the third Kube-ovn-cni pod;

[0179] Step 217: Use container tool commands to determine the container ID corresponding to the node where the second virtual machine is located, and use the Ipaddress command to determine the third target virtual network interface card, wherein the third target virtual network interface card includes the target number of bits of the container ID and the underscores;

[0180] Step 218: Use the third target virtual network interface as the location for network traffic mirroring, store the location information of the third target virtual network interface in the resources of the third Kube-ovn-cni pod, execute the command to configure the mirror in OVS, and use the third target virtual network interface as the output end of the mirror network interface.

[0181] Specifically, in the original boot logic of Kube-ovn, because it only supported one virtual network card mode, mirror0, the export location would be changed back to the virtual network card mirror0 every time it restarted. Now that two export locations have been expanded, the corresponding logic needs to be modified.

[0182] Step 219: Based on the Kube-ovn network plugin and the target address, mirror and export the network traffic from the first Pod and the first virtual machine to the target address.

[0183] like Figure 3 As shown, this embodiment of the invention provides a network traffic mirroring and export system based on cloud-edge collaboration. The system includes:

[0184] The configuration module 301 is used to use the Kube-ovn network plugin to use the first Pod and the first virtual machine as the source of network traffic mirroring, wherein the Kube-ovn network plugin is capable of mirroring and exporting the network traffic;

[0185] The determining module 302 is used to determine the target address exported by the network traffic mirroring, wherein the target address includes at least one of: a virtual network interface card on a physical machine, a physical network interface card on a physical machine, a second Pod and a second virtual machine, wherein the second Pod is different from the first Pod, and the second virtual machine is different from the first virtual machine;

[0186] Processing module 303 is used to export the network traffic image from the first Pod and the first virtual machine to the target address based on the Kube-ovn network plugin and the target address.

[0187] based on Figure 3 The network traffic mirroring and export system based on cloud-edge collaboration shown above, wherein the determining module 302 in the above embodiment is further configured to perform:

[0188] When the target address exported by the network traffic mirror is the virtual network interface card on the physical machine, the source of the network traffic mirror is exported to the first target virtual network interface card of each physical node;

[0189] Obtain the traffic data packets of the first target virtual network interface card, and process the network traffic data of the first pod and the first virtual machine;

[0190] based on Figure 3 The network traffic mirroring and export system based on cloud-edge collaboration shown above, wherein the determining module 302 in the above embodiment is further configured to perform:

[0191] When the target address exported by the network traffic mirror is the physical network card on the physical machine, determine the name of the physical network card exported by the network traffic mirror;

[0192] Determine the first Kube-ovn-cni pod corresponding to the node where the physical network interface card is located;

[0193] Remotely connect to the pod of the first Kube-ovn-cni;

[0194] Execute the command to configure the mirror in OVS, and set the physical network card as the output port of the mirror network card.

[0195] based on Figure 3 The network traffic mirroring and export system based on cloud-edge collaboration shown above, wherein the determining module 302 in the above embodiment is further configured to perform:

[0196] When the target address exported by the network traffic mirror is the second Pod, determine the name of the second Pod to be exported;

[0197] Determine the second Kube-ovn-cni pod corresponding to the node where the second pod is located;

[0198] Remotely connect to the second Kube-ovn-cni pod;

[0199] Use container tool commands to determine the container ID corresponding to the node where the second pod is located;

[0200] The second target virtual network interface is determined using the IP address command, wherein the second target virtual network interface contains the target number of bits of the container ID, and the target number of bits is the first 5 bits;

[0201] The second target virtual network interface card is used as the location for exporting the network traffic mirror;

[0202] Execute the command to configure the mirror in OVS, and set the second target virtual network card as the output port of the mirror network card.

[0203] based on Figure 3 The network traffic mirroring and export system based on cloud-edge collaboration shown above, wherein the determining module 302 in the above embodiment is further configured to perform:

[0204] When the target address exported by the network traffic mirroring is the second virtual machine, determine the name of the second virtual machine to be exported;

[0205] Determine the third Kube-ovn-cni pod corresponding to the node where the second virtual machine is located;

[0206] Remotely connect to the third Kube-ovn-cni pod;

[0207] The container tool command is used to determine the container ID corresponding to the node where the second virtual machine is located;

[0208] The third target virtual network interface is determined by the IP address command, wherein the third target virtual network interface includes the target number of the container ID and underscores;

[0209] The third target virtual network interface card is used as the location for exporting the network traffic mirror;

[0210] Execute the command to configure the mirror in OVS, and set the third target virtual network card as the output of the mirror network card.

[0211] based on Figure 3 The network traffic mirroring and export system based on cloud-edge collaboration shown above, wherein the determining module 302 in the above embodiment is further configured to perform:

[0212] The location information of the second target virtual network card is stored in the resources of the second Kube-ovn-cni pod.

[0213] based on Figure 3 The network traffic mirroring and export system based on cloud-edge collaboration shown above, wherein the determining module 302 in the above embodiment is further configured to perform:

[0214] The location information of the third target virtual network card is stored in the resources of the third Kube-ovn-cni pod.

[0215] based on Figure 3 The system shown is a cloud-edge collaborative network traffic mirroring and export system, such as... Figure 4 As shown, prior to the setting module, a listening module 304 is further included;

[0216] The monitoring module 304 is used to perform:

[0217] When the controller of the Kube-ovn network plugin detects that traffic mirroring needs to be enabled, it adds select_src_port as a column;

[0218] When the controller of the Kube-ovn network plugin detects that traffic mirroring is turned off, the column containing select_src_port is deleted.

[0219] It is understood that the structures illustrated in the embodiments of the present invention do not constitute a specific limitation on a report merging device. In other embodiments of the present invention, a report merging device may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0220] The information interaction and execution process between the various units in the above-mentioned device are based on the same concept as the method embodiment of the present invention, and the specific details can be found in the description of the method embodiment of the present invention, and will not be repeated here.

[0221] This invention also provides a network traffic mirroring and export system based on cloud-edge collaboration, comprising: at least one memory and at least one processor;

[0222] At least one memory for storing machine-readable programs;

[0223] At least one processor is configured to invoke a machine-readable program to execute a cloud-edge collaborative network traffic mirroring export method according to any embodiment of the present invention.

[0224] This invention also provides a computer-readable medium storing computer instructions, which, when executed by a processor, cause the processor to perform a network traffic mirroring and export method based on cloud-edge collaboration according to any embodiment of this invention.

[0225] Specifically, a system or apparatus equipped with a storage medium may be provided, on which software program code implementing the functions of any of the embodiments described above is stored, and the computer (or CPU or MPU) of the system or apparatus may read and execute the program code stored in the storage medium.

[0226] In this case, the program code read from the storage medium can itself implement the function of any of the above embodiments, and therefore the program code and the storage medium storing the program code constitute part of the present invention.

[0227] Examples of storage media used to provide program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, program code can be downloaded from a server computer via a communication network.

[0228] Furthermore, it should be clear that not only can the program code read by the computer be executed, but also the operating system or other components operating on the computer can be instructed based on the program code to perform some or all of the actual operations, thereby realizing the function of any of the embodiments described above.

[0229] Furthermore, it is understood that the program code read from the storage medium is written to the memory set in the expansion board inserted into the computer or to the memory set in the expansion unit connected to the computer. Then, based on the instructions of the program code, the CPU or other components installed on the expansion board or expansion unit execute some and all of the actual operations, thereby realizing the function of any of the embodiments described above.

[0230] The various embodiments of the present invention have at least the following beneficial effects:

[0231] 1. This invention provides a method for exporting network traffic mirroring based on cloud-edge collaboration. Network management in a cloud-edge collaborative environment faces challenges, including rapid fault location and handling. It requires the ability to forward customer network data packets to a target address for location and investigation via traffic mirroring. Therefore, the Kube-ovn network plugin can be used to export network traffic mirroring for containers and virtual machines, employing multiple methods for network traffic mirroring management. In addition to using the virtual network interface card (NIC) on the physical machine as the target address for network traffic mirroring, this invention adds the physical NIC on the physical machine, as well as a second Pod and a second virtual machine, as target addresses for network traffic mirroring. Network traffic mirroring is then implemented based on the Kube-ovn network plugin and these target addresses. By adopting this technical solution, multiple methods of traffic mirroring management for containers and virtual machines can be achieved in a cloud-edge collaborative environment, thereby improving the security of network traffic monitoring and investigation.

[0232] 2. In this embodiment of the invention, the Kube-ovn network plugin itself supports using pods as sources of network traffic mirroring. However, the existing method involves tagging the corresponding pod with a label like "subnet.namespace.ovn.kubernetes.io / mirror"="true". The Kube-ovn controller can then listen for this and set up an OVS mirror on the node where the pod resides, adding the pod's corresponding network interface to the mirror's src_port, thereby enabling the pod to function as a source of network traffic mirroring. However, this logic cannot be implemented in many scenarios. For example, for pods that are not running independently, they may be generated from resources such as Deployment, StatefulSet, or DaemonSet. If a label is directly added to the pod, although it may be effective temporarily, once the pod is deleted and restarted, the newly generated pod will not have the label, and Kube-ovn will then shut down its traffic mirroring source. In addition, virtual machines are also generated from VirtualMachine and VirtualMachineInstance resources, and require special processing through the backend API interface to remain effective. Therefore, through the above modifications, even if a non-standalone pod is deleted and restarted, Kube-ovn will not shut down its traffic mirroring source. Pods generated by resources such as Deployment, StatefulSet, or DaemonSet can achieve temporary effectiveness and remain effective after restart.

[0233] 3. In this embodiment of the invention, to achieve multi-method network traffic mirroring export, an existing physical network interface card (NIC) on the physical machine can be used as the target address for network traffic mirroring export. This function is typically used when users do not directly log in to the physical machine, but instead connect their terminal laptop to the physical machine's network port via a network cable. Users can then directly capture the exported network traffic image packets on their laptops using tools such as Wireshark. However, this function is not supported by Kube-ovn itself, so it needs to be modified as described above. Alternatively, other pods or virtual machines can be used as the target address for traffic mirroring export. This function is used when users cannot access the physical machine but can access container pods or virtual machines. Therefore, network traffic can be mirrored and exported to other pods or virtual machines, allowing users to then access these pods or virtual machines to centrally capture and analyze traffic data. This method is also not supported by Kube-ovn and requires modification; therefore, the above modification process was designed to achieve multi-method network traffic mirroring export.

[0234] It should be noted that not all steps and modules in the above processes and system structure diagrams are mandatory; some steps or modules can be omitted as needed. The execution order of each step is not fixed and can be adjusted as required. The system structure described in the above embodiments can be a physical structure or a logical structure. That is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or they may be jointly implemented by certain components in multiple independent devices.

[0235] In the above embodiments, the hardware units can be implemented mechanically or electrically. For example, a hardware unit may include permanent dedicated circuitry or logic (such as a dedicated processor, FPGA, or ASIC) to perform the corresponding operation. The hardware unit may also include programmable logic or circuitry (such as a general-purpose processor or other programmable processor), which can be temporarily configured by software to perform the corresponding operation. The specific implementation method (mechanical, dedicated permanent circuitry, or temporarily configured circuitry) can be determined based on cost and time considerations.

[0236] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for cloud edge collaboration based network traffic mirroring export, characterized in that, The method comprises: using a Kube-ovn network plug-in to set the first Pod and the first virtual machine as sources of network traffic mirroring, wherein the Kube-ovn network plug-in can mirror export the network traffic; determining a target address of the network traffic mirror export, wherein the target address comprises a physical network card on a physical machine; when the target address of the network traffic mirror export is the physical network card on the physical machine, determining the name of the physical network card of the network traffic mirror export; determining a first Kube-ovn-cni pod corresponding to the node where the physical network card is located; remotely connecting to the first Kube-ovn-cni pod; executing an ovs configuration mirror command to set the physical network card as an output end of a mirror network card; based on the Kube-ovn network plug-in and the target address, mirror exporting the network traffic from the first Pod and the first virtual machine to the target address; wherein the use of the Kube-ovn network plug-in to set the first Pod and the first virtual machine as sources of network traffic mirroring comprises: when the first Pod is the source of network traffic mirroring, determining the corresponding ownerReference resource using the first pod; adding a first label to the target subject template template and the first pod to generate a first target type, wherein the target subject comprises at least one of a Deployment, a StatefulSet and a DaemonSet resource, the Deployment, the StatefulSet and the DaemonSet resource can generate the first Pod, and the first target type is used to reflect the type of the first pod; when the first virtual machine is the source of network traffic mirroring, determining the corresponding VirtualMachine and VirtualMachineInstance resources using the first virtual machine; adding a second label to the template template of the VirtualMachine and the VirtualMachineInstance resources and a second pod to generate a second target type, wherein the second pod is determined by the label of the vm, and the second target type is used to reflect the type of the second pod; functionally integrating and packaging the first target type and the second target type.

2. The method of claim 1, wherein, The target address further comprises at least one of a virtual network card on a physical machine, a second Pod and a second virtual machine, the second Pod being different from the first Pod, and the second virtual machine being different from the first virtual machine; the determination of the target address of the network traffic mirror export comprises: when the target address of the network traffic mirror export is the virtual network card on the physical machine, mirror exporting the source of the network traffic to the first target virtual network card of each physical node; Obtaining the traffic data packet of the first target virtual network card, processing the network traffic data of the first pod and the first virtual machine; And / or, When the target address of the network traffic mirroring derivation is the second pod, determining the name of the second pod to be derived; Determining the second Kube-ovn-cni pod corresponding to the node where the second pod is located; Remote connection to the second Kube-ovn-cni pod; Determine the container Id corresponding to the node where the second pod is located through the container tool command; Determine the second target virtual network card through the Ip address command, wherein the second target virtual network card contains the target number of the container Id, and the target number is the first 5; Take the second target virtual network card as the location of the network traffic mirroring derivation; Execute the command of ovs configuration mirror, and take the second target virtual network card as the output end of mirror card; And / or, When the target address of the network traffic mirroring derivation is the second virtual machine, determine the name of the second virtual machine to be derived; Determine the third Kube-ovn-cni pod corresponding to the node where the second virtual machine is located; Remote connection to the third Kube-ovn-cni pod; Determine the container Id corresponding to the node where the second virtual machine is located through the container tool command; Determine the third target virtual network card through the Ip address command, wherein the third Target virtual network card includes the target number of container Id and underscore; Take the third target virtual network card as the location of the network traffic mirroring derivation; Execute the command of ovs configuration mirror, and take the third target virtual network card as the output end of mirror card.

3. The method of claim 2, wherein, After taking the second target virtual network card as the location of the network traffic mirroring derivation, further comprising: Store the location information of the second target virtual network card into the resource of the second Kube-ovn-cni pod; And / or, After taking the third target virtual network card as the location of the network traffic mirroring derivation, further comprising: Store the location information of the third target virtual network card into the resource of the third Kube-ovn-cni pod; And / or, Before taking the first pod and the first virtual machine as the source of network traffic mirroring by using the Kube-ovn network plug-in, further comprising: When the controller of the Kube-ovn network plug-in listens to the start of traffic mirroring, add select_src_port as column; When the controller of the Kube-ovn network plug-in listens to the closing of traffic mirroring, delete the column where the select_src_port is located.

4. A cloud edge collaboration based network traffic mirroring export system, characterized in that, The system comprises: The setting module is configured to use a Kube-ovn network plug-in to set the first Pod and the first virtual machine as a source of network traffic mirroring, wherein the Kube-ovn network plug-in can perform mirror export on the network traffic; The determining module is configured to determine a target address of the network traffic mirror export, wherein the target address includes a physical network card on a physical machine; when the target address of the network traffic mirror export is the physical network card on the physical machine, determine the name of the physical network card of the network traffic mirror export; determine a first Kube-ovn-cni pod corresponding to a node where the physical network card is located; remotely connect to the first Kube-ovn-cni pod; and execute an ovs configuration mirror command to set the physical network card as an output end of a mirror network card. The processing module is configured to use the Kube-ovn network plug-in and the target address to export the network traffic from the first Pod and the first virtual machine to the target address. The setting module is further configured to perform: When the first Pod is the source of the network traffic mirror, use the first pod to determine a corresponding ownerReference resource; Add a first label to a target subject template template and the first pod to generate a first target type, wherein the target subject includes at least one of a Deployment, a StatefulSet, and a DaemonSet resource, the Deployment, the StatefulSet, and the DaemonSet resource can generate the first Pod, and the first target type is used to reflect the type of the first pod; When the first virtual machine is the source of the network traffic mirror, use the first virtual machine to determine corresponding VirtualMachine and VirtualMachineInstance resources; Add a second label to a template template of the VirtualMachine and the VirtualMachineInstance resources and a second pod to generate a second target type, wherein the second pod is determined by a label of the vm, and the second target type is used to reflect the type of the second pod; Integrate and package the functions of the first target type and the second target type.

5. The system of claim 4, wherein, The target address includes at least one of a virtual network card on a physical machine, a second Pod, and a second virtual machine, the second Pod is different from the first Pod, and the second virtual machine is different from the first virtual machine; The determining module is further configured to perform: When the target address of the network traffic mirror export is the virtual network card on the physical machine, export the source of the network traffic mirror to the first target virtual network card of each physical node. Obtaining the traffic data packet of the first target virtual network card, processing the network traffic data of the first pod and the first virtual machine; And / or, When the target address of the network traffic mirroring derivation is the second pod, determining the name of the second pod to be derived; Determining the second Kube-ovn-cni pod corresponding to the node where the second pod is located; Remote connection to the second Kube-ovn-cni pod; Determine the container Id corresponding to the node where the second pod is located through the container tool command; Determine the second target virtual network card through the Ip address command, wherein the second target virtual network card contains the target number of bits of the container Id, and the target number of bits is the first 5; The second target virtual network card is used as the position of the network traffic mirroring derivation; Execute the command of ovs configuration mirror, and take the second target virtual network card as the output end of the mirror network card; And / or, When the target address of the network traffic mirroring derivation is the second virtual machine, determining the name of the second virtual machine to be derived; Determining the third Kube-ovn-cni pod corresponding to the node where the second virtual machine is located; Remote connection to the third Kube-ovn-cni pod; Determine the container Id corresponding to the node where the second virtual machine is located through the container tool command; Determine the third target virtual network card through the Ip address command, wherein the third Target virtual network card includes the target number of bits of the container Id and the underscore; The third target virtual network card is used as the position of the network traffic mirroring derivation; Execute the command of ovs configuration mirror, and take the third target virtual network card as the output end of the mirror network card.

6. The system of claim 5, wherein The determination module is further configured to: Store the position information of the second target virtual network card into the resource of the second Kube-ovn-cni pod; And / or, After taking the third target virtual network card as the position of the network traffic mirroring derivation, further comprising: Store the position information of the third target virtual network card into the resource of the third Kube-ovn-cni pod; And / or, Before the setting module, further comprising a listening module; The listening module is configured to: When the controller of the Kube-ovn network plug-in listens to the traffic mirroring to be started, add select_src_port as a column; When the controller of the Kube-ovn network plug-in listens to the traffic mirroring to be closed, delete the column where the select_src_port is located. 7.A cloud-edge collaboration based network traffic mirroring exporting system, characterized in that, Comprise: At least one memory and at least one processor; The at least one memory is configured to store a machine readable program; The at least one processor is configured to call the machine readable program and execute the method of any one of claims 1 to 3. The computer readable medium stores 8. A computer readable medium characterized by ​ computer instructions that, when executed by a processor, cause the processor to perform the rights The method of any one of claims 1 to 3.

Images