Session maintenance method, device, computer equipment and medium in k8s cluster

Abstract

The present application relates to a method, device, computer equipment and medium for maintaining a session in a k8s cluster. The aforementioned method is applied to a node in a k8s cluster, the k8s cluster creates a service, the node creates a first mapping table, the first mapping table is used to store the mapping relationship between the source IP and the container unit IP, and the preset position of the node kernel is mounted with an ebpf program. The aforementioned method includes: responding to the transmission instruction of the target data packet, running the ebpf program to intercept the target data packet before the target data packet enters the kernel network protocol stack, the target data packet is a data packet with the service IP set for session maintenance as the destination IP, parsing the target data packet to obtain the source IP, querying the first mapping table according to the source IP to obtain the container unit IP; sending the target data packet to the corresponding container unit according to the container unit IP. The use of this method can realize the session maintenance function before the data packet enters the kernel network protocol stack, thereby improving the forwarding efficiency.

Description

Technical Field

[0001] The present application relates to the field of cluster technology, and in particular to a method, device, computer equipment and medium for maintaining a session in a k8s cluster. Background Art

[0002] In k8s (Kubernetes), a service is an abstraction that defines access rules for a group of containers. By default, the load balancing mechanism of the service does not support session persistence, that is, each request to the service may be distributed to a different container, and the user's session status cannot be maintained. However, in some cases, it is very important to implement session persistence, especially for stateful applications. Session persistence ensures that users can be routed to the same container when accessing the same service, maintaining session continuity.

[0003] In traditional technology, you can create a service that specifies session persistence. When you create a service that specifies session persistence, kube-proxy sets specific iptables or ipvs rules based on the specific information of the service to achieve session persistence.

[0004] However, both iptables and ipvs work in the kernel network protocol stack, and the lengthy data traffic path for session maintenance causes unnecessary network delays, thus affecting the forwarding efficiency of data packets. Summary of the invention

[0005] Based on this, it is necessary to provide a method, device, computer equipment and medium for session maintenance in a k8s cluster that can implement the session maintenance function before the data packet enters the kernel network protocol stack and maximize the forwarding efficiency in response to the above technical problems.

[0006] In a first aspect, a session maintenance method in a k8s cluster is provided, the method is applied to a node in a k8s cluster, the k8s cluster is created with a service, the node is created with a first mapping table, the first mapping table is used to store a mapping relationship between a source IP and a container unit IP, and an ebpf program is mounted at a preset location of the node kernel, the method comprising:

[0007] In response to a transmission instruction of a target data packet, an ebpf program is run to intercept the target data packet before the target data packet enters the kernel network protocol stack, wherein the target data packet is a data packet with a service IP for which session persistence is set as a destination IP;

[0008] Parse the target data packet to obtain the source IP corresponding to the target data packet;

[0009] According to the source IP corresponding to the target data packet, the first mapping table is searched to obtain the container unit IP corresponding to the target data packet;

[0010] The target data packet is sent to the corresponding container unit according to the container unit IP corresponding to the target data packet, so as to maintain the session.

[0011] In one embodiment, the preset location includes a socket layer and / or a fast data path mount point.

[0012] In one embodiment, running an ebpf program to intercept target data before the target data packet enters a kernel network protocol stack includes:

[0013] When a node initiates east-west access through a service, it runs the ebpf program mounted at the socket layer to intercept the target data before the target data packet enters the kernel network protocol stack.

[0014] In one embodiment, running an ebpf program to intercept target data before the target data packet enters a kernel network protocol stack includes:

[0015] When an external client of the k8s cluster initiates a north-south access, the ebpf program mounted on the fast data path mount point is run to intercept the target data before the target data packet enters the kernel network protocol stack.

[0016] In one of the embodiments, the node also creates a second mapping table, and the session maintenance method in the k8s cluster further includes:

[0017] Run the ebpf program to monitor resource creation events in the k8s cluster;

[0018] When monitoring that a service with session persistence is created, parse out the container unit IP corresponding to the service;

[0019] The mapping relationship between the service IP for which session persistence is set and the container unit IP corresponding to the service is stored in the second mapping table.

[0020] In one embodiment, the session maintenance method in the k8s cluster further includes:

[0021] When monitoring that the current service is created, obtain the configuration file of the current service;

[0022] When it is determined according to the configuration file that the current service is configured to maintain the session through the client IP, the current service is determined to be a service for which session maintenance is set.

[0023] In one embodiment, parsing the target data packet to obtain the source IP corresponding to the target data packet includes:

[0024] Parse the target data packet to obtain the source IP and destination IP corresponding to the target data packet;

[0025] The session persistence method in the k8s cluster also includes:

[0026] When there is no data record corresponding to the target data packet in the first mapping table, the second mapping table is queried according to the destination IP corresponding to the target data packet to obtain the container unit IP corresponding to the target data packet, and the container unit IP corresponding to the target data packet is written into the first mapping table.

[0027] In one embodiment, the session maintenance method in the k8s cluster further includes:

[0028] The user state portion of the ebpf program is run to create the first mapping table and the second mapping table.

[0029] In one embodiment, in response to a transmission instruction of a target data packet, running an ebpf program to intercept the target data packet before the target data packet enters a kernel network protocol stack includes:

[0030] Run the kernel-mode portion of the ebpf program to intercept target data before it enters the kernel network protocol stack.

[0031] In one embodiment, the session maintenance method in the k8s cluster further includes:

[0032] When a service for which session retention is set is deleted, the corresponding data in the second mapping table is cleared.

[0033] In one embodiment, the first mapping table is used to store the mapping relationship between the source IP, the source port and the container unit IP, and parse the target data packet to obtain the source IP corresponding to the target data packet, including:

[0034] Parse the target data packet to obtain the source IP and source port corresponding to the target data packet;

[0035] Querying the first mapping table according to the source IP corresponding to the target data packet to obtain the container unit IP corresponding to the target data packet includes:

[0036] The first mapping table is queried according to the source IP and source port corresponding to the target data packet to obtain the container unit IP corresponding to the target data packet.

[0037] In one embodiment, querying the second mapping table according to the destination IP corresponding to the target data packet to obtain the container unit IP corresponding to the target data packet includes:

[0038] When a plurality of corresponding container unit IPs are obtained by querying the second mapping table, a container unit IP is randomly obtained from the plurality of container unit IPs to obtain the container unit IP corresponding to the target data packet.

[0039] In a second aspect, a session maintenance device in a k8s cluster is provided, the device is applied to a node in the k8s cluster, the k8s cluster creates a service, the node creates a first mapping table, the first mapping table is used to store a mapping relationship between a source IP and a container unit IP, and an ebpf program is mounted at a preset location of the node kernel, and the device includes:

[0040] An interception module, for responding to a transmission instruction of a target data packet, running an ebpf program to intercept a target data packet before the target data packet enters a kernel network protocol stack, wherein the target data packet is a data packet with a service IP for which session persistence is set as a destination IP;

[0041] The parsing module is used to parse the target data packet and obtain the source IP corresponding to the target data packet;

[0042] A query module, used to query the first mapping table according to the source IP corresponding to the target data packet, and obtain the container unit IP corresponding to the target data packet;

[0043] The sending module is used to send the target data packet to the corresponding container unit according to the container unit IP corresponding to the target data packet, so as to maintain the session.

[0044] In a third aspect, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the session maintenance method in the k8s cluster provided in any embodiment of the first aspect are implemented.

[0045] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored, characterized in that when the computer program is executed by a processor, the steps of the session maintenance method in the k8s cluster provided in any embodiment of the first aspect are implemented.

[0046] In a fifth aspect, a computer program product is provided, comprising a computer program, characterized in that when the computer program is executed by a processor, the steps of the session maintenance method in the k8s cluster provided in any embodiment of the first aspect are implemented.

[0047] The session maintenance method, device, computer equipment and medium in the above-mentioned k8s cluster can pre-create an eBPF program, and mount the eBPF program at a preset position of the node kernel in the k8s cluster, and further run the eBPF program to intercept the target data packet before the target data packet enters the kernel network protocol stack, further parse the target data packet, obtain the corresponding source IP, query the pre-created first mapping table according to the source IP, obtain the corresponding container unit IP, and then send the target data packet to the corresponding container unit according to the container unit IP, thereby achieving session maintenance. However, in the traditional technology, when achieving session maintenance, it is necessary to set specific iptables or ipvs rules according to the specific information of the service through the kube-proxy process to achieve session maintenance, but whether it is iptables or ipvs, they all work in the kernel network protocol stack, and the lengthy data flow path causes unnecessary network delays. The present application can intercept the target data packet before it reaches the kernel network protocol stack, and obtain the corresponding container unit IP by querying the first mapping table, thereby achieving the completion of the session maintenance function before the target data packet enters the kernel network protocol stack, and maximizing the forwarding efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A schematic diagram of a process for maintaining a session in a k8s cluster in one embodiment;

[0049] Figure 2 A flow chart of a method for maintaining a session in a k8s cluster in another embodiment;

[0050] Figure 3 It is a structural block diagram of a session holding device in a k8s cluster in an embodiment;

[0051] Figure 4 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0053] In the first aspect, Figure 1 As shown, a method for maintaining a session in a k8s cluster is provided. The method is applied to a node in a k8s cluster. The k8s cluster is created with a service. The node is created with a first mapping table. The first mapping table is used to store a mapping relationship between a source IP and a container unit IP. An ebpf program is mounted at a preset location of the node kernel. The method includes:

[0054] Step S11, in response to the transmission instruction of the target data packet, the ebpf program is run to intercept the target data packet before the target data packet enters the kernel network protocol stack, the target data packet is a data packet with the service IP for which session persistence is set as the destination IP.

[0055] Among them, kubernetes (k8s): the most widely used open source container orchestration architecture for container cloud platforms, which can realize automatic scheduling, expansion, fault recovery, etc. of containers. Specifically, k8s includes multiple nodes, each of which is equipped with a container unit.

[0056] A container unit is the smallest management unit of Kubernetes scheduling, which can be a pod, consisting of one or more containers that share process, network and other namespaces.

[0057] Service refers to a service resource in a k8s cluster, where the service here can be a service service. Service is a resource in k8s, through which a specific set of container units can be accessed, and load balancing function is provided. This application can create a set of container units for a specific business through k8s, and provide external services through service.

[0058] The first mapping table is used to store the mapping relationship between the source IP and the container unit IP, the source IP refers to the source IP of the data packet, and the container unit refers to the backend container unit corresponding to the service.

[0059] The ebpf (Extended Berkeley Packet Filter) program is a user-written program that can run in the Linux kernel. It is essentially a virtual machine running in kernel state, which allows users to load and run custom programs in the kernel. Users and the kernel can exchange data on demand and manage the kernel's behavior at any time.

[0060] ‌The kernel network protocol stack‌ refers to a series of protocols and related data structures used to handle network communications in the Linux kernel. It involves multiple layers, from the physical layer to the application layer, and each layer has its specific functions and responsibilities.

[0061] The target data packet can be a data packet transmitted between nodes within the cluster, or a data packet accessing the cluster from the outside.

[0062] A service with session persistence is one that is configured to support session persistence when the service resource is created. Session persistence refers to a mechanism on the load balancer that can identify the relevance of the interaction process between the client and the server, and ensure that a series of related access requests are allocated to one machine while performing load balancing. The purpose of session persistence in a k8s cluster is to ensure that users can be routed to the same container unit when accessing the same service, maintaining session continuity.

[0063] The destination IP of the target data packet refers to the IP address of the recipient of the target data packet.

[0064] Specifically, the present application pre-mounts the ebpf program to a preset position of the node kernel, so that the ebpf program can intercept and process the target data packet before it reaches the kernel network protocol stack. Among them, the present application will filter out the data packets, and only intercept the target data packets that meet the requirements. Specifically, the present application will filter according to the destination IP of the data packet. When the destination IP of the data packet is a service IP with session retention set, the data packet is determined to be a target data packet, and then it is intercepted and parsed.

[0065] Step S12, parse the target data packet to obtain the source IP corresponding to the target data packet.

[0066] The source IP corresponding to the target data packet refers to the IP address of the sender of the target data packet.

[0067] Specifically, the present application parses the data packet to obtain information such as the source IP, source port, destination IP, and destination port corresponding to the target data packet.

[0068] Step S13: query the first mapping table according to the source IP corresponding to the target data packet to obtain the container unit IP corresponding to the target data packet.

[0069] The first mapping table stores the mapping relationship between each source IP and the container unit IP. Specifically, the first mapping table stores the corresponding relationship between the client and the actual service container unit, where the key is the source IP and the value is the container unit IP.

[0070] The present application can use the source IP corresponding to the target data packet as a key to query the first mapping table and obtain the corresponding container unit IP.

[0071] Step S14: sending the target data packet to the corresponding container unit according to the container unit IP corresponding to the target data packet, so as to maintain the session.

[0072] Among them, the present application can ensure that the user can be routed to the same container unit when accessing the same service through the first mapping table, thereby maintaining the continuity of the session.

[0073] At the same time, the present application can intercept the target data packet before it reaches the kernel network protocol stack by mounting the ebpf program at a preset location, and parse the target data packet before it reaches the kernel network protocol stack to obtain the corresponding source IP, query the first mapping table according to the corresponding source IP to obtain the corresponding container unit IP, complete the conversion from the service IP to the backend container unit IP, shorten the path of data traffic, and improve data forwarding efficiency.

[0074] In one embodiment, the preset location includes a socket layer and / or a fast data path mount point.

[0075] Among them, the socket layer is the intermediate software abstraction layer for communication between the application layer and the TCP / IP protocol family. By mounting the ebpf program to the socket layer, socket-level redirection can be achieved, that is, during network communication, data packets can be processed directly through the ebpf program instead of passing through the traditional kernel network protocol stack. This method can be used to optimize network communication performance, implement network security policies, or monitor and analyze network communications. Specifically, after the ebpf program is mounted to the socket layer using a specific program type (such as BPF_PROG_TYPE_SOCKET_FILTER), socket-level network events can be intercepted and processed. For example, data can be filtered, modified, or redirected when it is sent or received, thereby realizing various application scenarios.

[0076] ‌ eXpress Data Path (XDP) is located at the bottom of the Linux kernel network stack. It is a kernel bypass technology based on eBPF. It is located before the kernel network protocol stack and has the ability to redirect data packets to the application layer by bypassing the kernel network protocol stack. This design enables the fast data path to process data packets before they reach the kernel network protocol stack, thereby avoiding the additional overhead caused by kernel internal processing and achieving high-performance network data processing.

[0077] In traditional technology, when a client accesses a specific business through a service, the access traffic may be routed to any backend container unit corresponding to the service. However, there are many usage scenarios that require the same client's requests to always be assigned to the same server for processing, that is, session persistence. In the native k8s service, session persistence can be achieved by specifying sessionAffinity as ClientIP (client IP). When a service with session persistence is created, the kube-proxy process on the node sets specific iptables or ipvs rules based on the specific information of the service to achieve session persistence. However, both iptables and ipvs work in the kernel protocol stack, resulting in a lengthy data traffic path and unnecessary network delays. Among them, iptables is a packet filtering system in the Linux operating system kernel, which can implement operations such as receiving, forwarding, and deleting data packets according to specific matching conditions. ipvs is the fourth layer of the Linux kernel network protocol stack, providing load balancing capabilities.

[0078] In this application, the ebpf program is used. The ebpf program is a user-written program that can run in the Linux kernel. The application is mounted on the kernel path through programming and triggered by events. This application mounts the ebpf program on the socket layer and / or fast data path mount point of the node, which can implement the session maintenance function before the data packet enters the kernel network protocol stack, and can directly complete the selection of the backend container unit in the kernel state, avoiding the data packet from entering the lengthy kernel network protocol stack, and maximizing the forwarding efficiency.

[0079] Please refer to Figure 2 , Figure 2 A schematic diagram of a transmission path of a target data packet in an embodiment. Figure 2 The figure shows the IP conversion position in the traditional technology (i.e., the position where the service IP is converted into the backend container unit IP) and the IP conversion position in the present application. Specifically, in the traditional technology, the IP conversion position is located at the nat INPUT position, while in the present application, the IP conversion position is located at the fast data path mount point, and the position for entering the kernel network protocol stack is located at the alloc_skb position. It can be seen that the present application realizes the conversion of the service IP into the backend container unit IP before the target data packet reaches the kernel network protocol stack, that is, according to the service IP corresponding to the target data packet, it is converted into the container unit IP corresponding to the target data packet, thereby realizing session maintenance.

[0080] In one of the embodiments, an ebpf program is run to intercept target data before the target data packet enters the kernel network protocol stack, including: when a node initiates east-west access through a service, an ebpf program mounted on the socket layer is run to intercept target data before the target data packet enters the kernel network protocol stack.

[0081] Among them, east-west access refers to the communication between services within the kubernetes cluster, that is, the communication between services within the cluster. This communication mode occurs within the cluster, and services communicate through services, using the service's virtual IP address and DNS (Domain Name System) name for load balancing and request distribution.

[0082] Specifically, when a node initiates east-west access through a service, it triggers the running of the ebpf program mounted on the socket layer. By running the ebpf program mounted on the socket layer, the target data packet can be intercepted before entering the kernel network protocol stack.

[0083] In one of the embodiments, an ebpf program is run to intercept target data before the target data packet enters the kernel network protocol stack, including: when an external client of the k8s cluster initiates a north-south access, an ebpf program mounted on a fast data path mount point is run to intercept the target data before the target data packet enters the kernel network protocol stack.

[0084] Among them, north-south access mainly involves traffic from outside the cluster to inside the cluster, that is, when a client wants to access services deployed in a Kubernetes cluster, it needs to expose the services in the cluster. The management of north-south traffic involves exposing services within the cluster to external access, which may involve network configurations such as port mapping and load balancing to ensure that external clients can access services within the cluster through specific IP addresses and ports.

[0085] In short, east-west traffic focuses on communication between services within the cluster, while north-south traffic focuses on exposing services within the cluster to external access so that external clients can access these services.

[0086] When an external client of the k8s cluster initiates north-south access, it triggers the ebpf program mounted on the fast data path mount point to run. By running the ebpf program mounted on the fast data path mount point, the target data packet can be intercepted before entering the kernel network protocol stack.

[0087] Please refer to Figure 2 , Figure 2In one embodiment, a flow chart of a session maintenance method in a k8s cluster is shown. Figure 2 In the k8s cluster, the session persistence methods can include:

[0088] Initialization operation, specifically, listens to the API Server and creates two ebpf mapping tables, namely the first mapping table and the second mapping table, creates a service with session persistence enabled, parses the detailed information of the backend container unit corresponding to the service, and writes the correspondence between the service and the container unit into the second mapping table.

[0089] When the service is accessed from within the cluster, the ebpf program mounted on the socket layer is triggered to intercept and process the target data packet. When the service is accessed from outside the cluster, the ebpf program mounted on the fast data path is triggered to intercept and process the target data packet.

[0090] After the target data packet is queried in the first mapping table, when the corresponding container unit IP is not found in the first mapping table, the second mapping table is queried to obtain the corresponding container unit IP, and the returned result is written into the first mapping table. When the service is deleted, the corresponding data records in the two mapping tables are cleared.

[0091] In one of the embodiments, the node also creates a second mapping table, and the method further includes:

[0092] Run the ebpf program to monitor resource creation events in the k8s cluster. When it is monitored that a service with session persistence is created, parse the container unit IP corresponding to the service, and store the mapping relationship between the service IP with session persistence and the container unit IP corresponding to the service in the second mapping table.

[0093] Specifically, the first mapping table and the second mapping table are pre-created on each node of the present application. The first mapping table is used to store the mapping relationship between the source end of the data request and the actual service container unit, and the second mapping table is used to store the mapping relationship between the service and the backend container unit. Specifically, the first mapping table is used to store the mapping relationship between the source IP of the data request and the actual service container unit IP. The second mapping table is used to store the mapping relationship between the service IP and the backend container unit IP. Among them, the first mapping table can be named a session mapping table, and the second mapping table can be named an endpoint mapping table.

[0094] In the present application, resource creation events in the k8s cluster can be monitored. When resource creation is monitored, information about the created resource is obtained. When the created resource is a service, it is further determined whether the service is set for session persistence. When the created service is set for session persistence, information about the backend container unit corresponding to the service, such as the container unit IP, is parsed, and the mapping relationship between the service IP for which session persistence is set and the container unit IP corresponding to the service is stored in the second mapping table.

[0095] The beneficial effect of this embodiment is that the present application utilizes the creation event of the monitoring service, and when it is monitored that the service has set the session persistence function, it parses the backend container unit information corresponding to the service, and writes the correspondence between the service that sets the session persistence and the container unit into the second mapping table for subsequent query.

[0096] In one of the embodiments, the session maintenance method in the k8s cluster also includes: when monitoring that the current service is created, obtaining the configuration file of the current service, and when it is determined according to the configuration file that the current service is configured to maintain the session through the client IP, determining that the current service is a service with session maintenance set.

[0097] Among them, the present application can obtain the value of the sessionAffinity field in the configuration file of the current service. When the value of the sessionAffinity field is set to the client IP, it is determined that the current service is a service for which session persistence is set.

[0098] The sessionAffinity field is part of the service resource and is used to define the session affinity policy of the service. The optional values ​​of the sessionAffinity field are:

[0099] None (default): Indicates that session affinity is not used.

[0100] ClientIP: Indicates that the session is maintained through the client's IP address.

[0101] The beneficial effect of this embodiment is that when monitoring resource creation, the application can obtain the configuration file of the created resource, and determine whether the created service has session persistence set up through the specified configuration items of the configuration file, thereby intercepting and processing the data packet whose destination IP is the service IP set up with session persistence.

[0102] In one of the embodiments, parsing a target data packet to obtain a source IP corresponding to the target data packet includes: parsing the target data packet to obtain a source IP and a destination IP corresponding to the target data packet; when a data record corresponding to the target data packet does not exist in a first mapping table, querying a second mapping table according to the destination IP corresponding to the target data packet to obtain a container unit IP corresponding to the target data packet, and writing the container unit IP corresponding to the target data packet into the first mapping table.

[0103] In the present application, when a data packet is received, the first mapping table is first queried according to the source IP of the data packet. When the first mapping table has a corresponding data record, the corresponding container unit IP is obtained. When the corresponding container unit IP cannot be found in the first mapping table, it means that it is the first access. At this time, the second mapping table is queried with the destination IP corresponding to the target data packet as the key to obtain the corresponding container unit IP, so as to send the target data packet to the corresponding container unit. At the same time, the container unit IP corresponding to the target data packet is written into the first mapping table.

[0104] The beneficial effect of this embodiment is that by creating the first mapping table and the second mapping table, the container unit corresponding to the target data packet is queried, thereby realizing IP conversion from the service to the backend container unit.

[0105] In one of the embodiments, the session maintenance method in the k8s cluster also includes: running the user state part of the ebpf program to create a first mapping table and a second mapping table.

[0106] Among them, the user-mode part of the ebpf program is mainly responsible for interacting with the kernel through the bpf system call to complete tasks such as loading, event mounting, mapping creation and updating of the ebpf program.

[0107] In one of the embodiments, in response to a transmission instruction of a target data packet, an ebpf program is run to intercept the target data packet before the target data packet enters the kernel network protocol stack, including: running a kernel state portion of the ebpf program to intercept the target data packet before the target data packet enters the kernel network protocol stack.

[0108] The ebpf program is mainly composed of two parts: kernel state part and user state part. The kernel state part contains the actual logic of the ebpf program, while the user state part is responsible for loading, running and monitoring the kernel state program.

[0109] In one of the embodiments, the session maintenance method in the k8s cluster further includes: when a service for which session maintenance is set is deleted, clearing the corresponding data in the second mapping table.

[0110] When the service for which session persistence is set is deleted, the data record corresponding to the service for which session persistence is set in the second mapping table is cleared.

[0111] In one of the embodiments, the first mapping table is used to store the mapping relationship between the source IP, the source port and the container unit IP, and the target data packet is parsed to obtain the source IP corresponding to the target data packet, including: parsing the target data packet to obtain the source IP and source port corresponding to the target data packet, querying the first mapping table according to the source IP corresponding to the target data packet to obtain the container unit IP corresponding to the target data packet, including: querying the first mapping table according to the source IP and source port corresponding to the target data packet to obtain the container unit IP corresponding to the target data packet.

[0112] The first mapping table stores the mapping relationship between the source IP and source port combination fields and the container unit IP. For example, if a service with session persistence is 10.233.1.1 and has two backend container units, with IPs of 1.1.1.1 and 1.1.1.2, the corresponding record content of the service in the second mapping table is as follows:

[0113] {“10.233.1.1”: [“1.1.1.1”, “1.1.1.2”]}

[0114] Among them, "10.233.1.1" is the service IP, and ["1.1.1.1", "1.1.1.2"] is the array of container unit IPs corresponding to the service.

[0115] For another example, if the source IP is 192.168.1.1 and the source port is 1234, and if the IP and port have initiated access to the service with the IP of 10.233.1.1, the records in the first mapping table are as follows:

[0116] {“192.168.1.1:1234”:“1.1.1.2”}

[0117] Among them, "192.168.1.1:1234" is the combination field of source IP and source port, and "1.1.1.2" is the container unit IP.

[0118] If the client of the source IP source port subsequently initiates access to the service with IP 10.233.1.1 again, the selection of the backend container unit can be completed directly in the kernel state, avoiding the data from entering the lengthy kernel network protocol stack and improving forwarding efficiency.

[0119] In one of the embodiments, querying the second mapping table according to the destination IP corresponding to the target data packet to obtain the container unit IP corresponding to the target data packet includes: when querying the second mapping table to obtain multiple corresponding container unit IPs, randomly obtaining a container unit IP from the multiple container unit IPs to obtain the container unit IP corresponding to the target data packet.

[0120] For example, when the corresponding record content in the second mapping table is as follows:

[0121] {“10.233.1.1”: [“1.1.1.1”, “1.1.1.2”]}

[0122] According to "10.233.1.1", the corresponding container unit IPs include "1.1.1.1" and "1.1.1.2", and one is randomly selected as the corresponding container unit IP and recorded. Subsequently, data packets are sent using the container unit IP.

[0123] In the second aspect, Figure 3 As shown, a session maintenance device in a k8s cluster is provided, and the device is applied to a node in the k8s cluster. The k8s cluster creates a service, and the node creates a first mapping table. The first mapping table is used to store the mapping relationship between the source IP and the container unit IP. The preset position of the node kernel is mounted with an ebpf program. The device includes: an interception module 41, which is used to respond to the transmission instruction of the target data packet and run the ebpf program to intercept the target data packet before the target data packet enters the kernel network protocol stack. The target data packet is a data packet with a service IP for setting session maintenance as the destination IP. A parsing module 42 is used to parse the target data packet to obtain the source IP corresponding to the target data packet. A query module 43 is used to query the first mapping table according to the source IP corresponding to the target data packet to obtain the container unit IP corresponding to the target data packet. A sending module 44 is used to send the target data packet to the corresponding container unit according to the container unit IP corresponding to the target data packet to perform session maintenance.

[0124] In one embodiment, the preset location includes a socket layer and / or a fast data path mount point.

[0125] In one embodiment, when a node initiates east-west access through a service, the interception module 41 can run an ebpf program mounted on the socket layer to intercept target data before the target data packet enters the kernel network protocol stack.

[0126] In one embodiment, when an external client of the k8s cluster initiates a north-south access, the interception module 41 can run the ebpf program mounted on the fast data path mount point to intercept the target data before the target data packet enters the kernel network protocol stack.

[0127] In one of the embodiments, the node also creates a second mapping table, and the interception module 41 can also run the ebpf program to monitor resource creation events in the k8s cluster. When it is monitored that a service with session persistence is created, the container unit IP corresponding to the service is parsed, and the mapping relationship between the service IP with session persistence and the container unit IP corresponding to the service is stored in the second mapping table.

[0128] In one embodiment, the interception module 41 can also obtain the configuration file of the current service when monitoring the creation of the current service, and when it is determined according to the configuration file that the current service is configured to maintain the session through the client IP, determine that the current service is a service with session maintenance set.

[0129] In one embodiment, the parsing module 42 parses the target data packet to obtain the source IP and destination IP corresponding to the target data packet. When the data record corresponding to the target data packet does not exist in the first mapping table, the second mapping table is queried according to the destination IP corresponding to the target data packet to obtain the container unit IP corresponding to the target data packet, and the container unit IP corresponding to the target data packet is written into the first mapping table.

[0130] In one of the embodiments, the interception module 41 may also run the user mode portion of the ebpf program to create the first mapping table and the second mapping table.

[0131] In one embodiment, the interception module 41 may run the kernel state portion of the ebpf program to intercept the target data packet before the target data packet enters the kernel network protocol stack.

[0132] In one embodiment, the sending module 44 may clear the corresponding data in the second mapping table when deleting the service for which the session persistence is set.

[0133] In one of the embodiments, the first mapping table is used to store the mapping relationship between the source IP, the source port and the container unit IP. The parsing module 42 parses the target data packet to obtain the source IP and the source port corresponding to the target data packet. The parsing module 42 can query the first mapping table according to the source IP and the source port corresponding to the target data packet to obtain the container unit IP corresponding to the target data packet.

[0134] In one embodiment, when the parsing module 42 queries the second mapping table to obtain multiple corresponding container unit IPs, it can randomly obtain a container unit IP from the multiple container unit IPs to obtain the container unit IP corresponding to the target data packet.

[0135] In a third aspect, a computer device is provided, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the session maintenance method in the k8s cluster provided in any embodiment of the first aspect of the present disclosure are implemented.

[0136] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 4 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a session retention method in a k8s cluster is implemented.

[0137] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of a session maintenance method in a k8s cluster provided in any embodiment of the present disclosure in the first aspect.

[0138] The computer readable storage medium may be Figure 4 A computer-readable storage medium in the computer device shown.

[0139] In a fifth aspect, a computer program product is provided, the computer program product comprising computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computing device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computing device executes the steps of the method for maintaining a session in a k8s cluster provided in any embodiment of the first aspect above.

[0140] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the above-mentioned computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0141] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0142] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for maintaining a session in a k8s cluster, characterized in that: The method is applied to a node in a k8s cluster, the k8s cluster is created with a service, the node is created with a first mapping table, the first mapping table is used to store a mapping relationship between a source IP and a container unit IP, an ebpf program is mounted at a preset location of the node kernel, and the method includes: In response to a transmission instruction of a target data packet, the ebpf program is run to intercept the target data packet before the target data packet enters the kernel network protocol stack, wherein the target data packet is a data packet with a service IP for which session persistence is set as a destination IP; Parse the target data packet to obtain the source IP address corresponding to the target data packet; According to the source IP corresponding to the target data packet, the first mapping table is searched to obtain the container unit IP corresponding to the target data packet; Sending the target data packet to the corresponding container unit according to the container unit IP corresponding to the target data packet to maintain the session; The node also creates a second mapping table, and the method further includes: Run the ebpf program to monitor resource creation events in the k8s cluster; When monitoring that a service with session persistence is created, parse out the container unit IP corresponding to the service; The mapping relationship between the service IP for which session persistence is set and the container unit IP corresponding to the service is stored in the second mapping table.

2. The method according to claim 1, characterized in that The preset location includes a socket layer and / or a fast data path mount point.

3. The method according to claim 2, characterized in that The running of the ebpf program to intercept the target data before the target data packet enters the kernel network protocol stack includes: When the node initiates east-west access through the service, the ebpf program mounted on the socket layer is run to intercept the target data before the target data packet enters the kernel network protocol stack.

4. The method according to claim 2, characterized in that: The running of the ebpf program to intercept the target data before the target data packet enters the kernel network protocol stack includes: When an external client of the k8s cluster initiates a north-south access, the ebpf program mounted on the fast data path mount point is run to intercept the target data before the target data packet enters the kernel network protocol stack.

5. The method according to claim 1, characterized in that The method further comprises: When monitoring that the current service is created, obtain the configuration file of the current service; When it is determined according to the configuration file that the current service is configured to maintain the session through the client IP, the current service is determined to be a service for which session maintenance is set.

6. The method according to claim 1, characterized in that The step of parsing the target data packet to obtain a source IP address corresponding to the target data packet includes: Parse the target data packet to obtain the source IP and destination IP corresponding to the target data packet; The method further comprises: When there is no data record corresponding to the target data packet in the first mapping table, the second mapping table is queried according to the destination IP corresponding to the target data packet to obtain the container unit IP corresponding to the target data packet, and the container unit IP corresponding to the target data packet is written into the first mapping table.

7. The method according to claim 1, characterized in that The method further comprises: A user state portion of the ebpf program is run to create the first mapping table and the second mapping table.

8. The method according to claim 1, characterized in that The step of running the ebpf program in response to the transmission instruction of the target data packet to intercept the target data packet before the target data packet enters the kernel network protocol stack comprises: The kernel state portion of the ebpf program is run to intercept the target data packet before the target data packet enters the kernel network protocol stack.

9. The method according to claim 1, characterized in that: The method further comprises: When the service for which session persistence is set is deleted, the corresponding data in the second mapping table is cleared.

10. The method according to claim 1, characterized in that The first mapping table is used to store the mapping relationship between the source IP, the source port and the container unit IP, and the target data packet is parsed to obtain the source IP corresponding to the target data packet, including: Parse the target data packet to obtain the source IP and source port corresponding to the target data packet; The querying the first mapping table according to the source IP corresponding to the target data packet to obtain the container unit IP corresponding to the target data packet includes: The first mapping table is queried according to the source IP and source port corresponding to the target data packet to obtain the container unit IP corresponding to the target data packet.

11. The method according to claim 3, characterized in that The querying the second mapping table according to the destination IP corresponding to the target data packet to obtain the container unit IP corresponding to the target data packet includes: When a plurality of corresponding container unit IPs are obtained by querying the second mapping table, a container unit IP is randomly obtained from the plurality of container unit IPs to obtain the container unit IP corresponding to the target data packet.

12. A session maintenance device in a k8s cluster, characterized in that: The device is applied to a node in a k8s cluster, the k8s cluster creates a service, the node creates a first mapping table, the first mapping table is used to store a mapping relationship between a source IP and a container unit IP, an ebpf program is mounted at a preset position of the node kernel, and the device includes: An interception module, configured to run the ebpf program in response to a transmission instruction of a target data packet, so as to intercept the target data packet before the target data packet enters the kernel network protocol stack, wherein the target data packet is a data packet with a service IP for which session persistence is set as a destination IP; A parsing module, used to parse the target data packet to obtain a source IP corresponding to the target data packet; A query module, configured to query the first mapping table according to the source IP corresponding to the target data packet, and obtain the container unit IP corresponding to the target data packet; A sending module is used to send the target data packet to the corresponding container unit according to the container unit IP corresponding to the target data packet to maintain the session. The node also creates a second mapping table. The sending module is also used to run the ebpf program to monitor resource creation events in the k8s cluster. When it is monitored that a service with session maintenance is created, the container unit IP corresponding to the service is parsed, and the mapping relationship between the service IP with session maintenance and the container unit IP corresponding to the service is stored in the second mapping table.

13. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 11 are implemented.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

Images