Gateway rule configuration and flow control method and device

Abstract

The invention provides a gateway rule configuration and flow control method and device, and relates to the technical field of computers. The gateway rule configuration method comprises the following steps: after a configuration request of a gateway rule is monitored, allocating a unique virtual IP address to a domain name of an accessible service indicated by the configuration request; setting a routing rule based on a virtual IP address for a working node in the container arrangement system; and setting a conversion rule between the virtual IP address and the real IP address of the accessible service for the forwarding gateway node. Through the method, the gateway rule configuration process based on the domain name can be automatically realized, the control accuracy of the flow data of the container group is improved, and the gateway rule maintenance cost required by updating the IP address of the service is reduced.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a gateway rule configuration and traffic control method and device. Background Art

[0002] The network model in the container orchestration system (such as Kubernetes) is usually divided into an overlay network model and an underlay network model. When the overlay network model is used, the container group (Pod) usually accesses the external network through the IP address of the host machine.

[0003] In cloud scenarios where security and traffic control are required, gateway rules such as selection rules (or release rules) are often set for the traffic of container groups. For example, traffic from a specified container group and sent to a specified destination IP address is released.

[0004] In the related technology, whether it is the host node in the Kubernetes cluster or the gateway node, gateway rules are configured for the IP address of the Internet service. After the container group (Pod) initiates an Internet access request, the host where the Pod is located forwards the allowed Pod traffic to the gateway node according to the configured rules, and the gateway node releases the allowed Pod traffic according to the configured rules. Summary of the invention

[0005] The present invention provides a gateway rule configuration and traffic control method and device.

[0006] According to a first aspect of the present disclosure, a gateway rule configuration method is provided, comprising: after monitoring a configuration request for a gateway rule, allocating a unique virtual IP address to a domain name of an accessible service indicated by the configuration request, wherein the accessible service is a service located outside a container orchestration system; setting a routing rule based on the virtual IP address for N within the container orchestration system, wherein the routing rule is used to indicate a forwarding gateway node corresponding to container group traffic data whose destination IP address is the virtual IP address; and setting a conversion rule between the virtual IP address and a real IP address of the accessible service for the forwarding gateway node, wherein the conversion rule is used to convert the destination IP address of the container group traffic data into the real IP address.

[0007] In some embodiments, the gateway rule configuration method further includes: saving the relationship between the domain name of the accessible service and the virtual IP address to a domain name resolution service module of the container orchestration system.

[0008] In some embodiments, the setting of routing rules based on the virtual IP address includes: updating the first custom resource object of the working node according to the virtual IP address; and configuring routing rules based on the virtual IP address according to the updated first custom resource object.

[0009] In some embodiments, setting the conversion rules between the virtual IP address and the real IP address of the accessible service includes: updating the second custom resource object of the forwarding gateway node according to the virtual IP address of the accessible service; and configuring the conversion rules according to the updated second custom resource object.

[0010] In some embodiments, updating the second custom resource object of the forwarding gateway node according to the virtual IP address includes: updating the virtual IP address to the second custom resource object when the second custom resource object contains the real IP address of the accessible service.

[0011] In some embodiments, updating the second custom resource object of the forwarding gateway node according to the virtual IP address also includes: when the second custom resource object does not contain the real IP address of the accessible service, querying the domain name resolution service module in the Internet according to the domain name of the accessible service to obtain the real IP address of the accessible service; updating the real IP address of the accessible service and the virtual IP address to the second custom resource object.

[0012] In some embodiments, the gateway rule configuration method further includes: after setting the conversion rule, periodically querying a domain name resolution service module in the Internet according to the domain name of the accessible service, and updating the conversion rule according to the query result.

[0013] In some embodiments, the gateway rule configuration method further includes: setting a traffic gating rule for the forwarding gateway node, wherein the traffic gating rule is used to filter traffic data of the container group received by the forwarding gateway node.

[0014] In some embodiments, the configuration request carries information of a container group that is allowed to be released, and setting a traffic gating rule for the forwarding gateway node includes: updating a second custom resource object on the forwarding gateway node according to the information of the container group that is allowed to be released; and configuring the traffic gating rule according to the updated second custom resource object.

[0015] According to a second aspect of the present disclosure, a traffic control method is provided, comprising: after a container group receives traffic data for accessing an external service, resolving the domain name of the external service to obtain a unique virtual IP address of the external service in the container orchestration system; routing the traffic data to a forwarding gateway node according to a routing rule that matches the virtual IP address; and converting the IP address of the destination end of the traffic data from the virtual IP address to a real IP address of the external service according to a conversion rule that matches the virtual IP address, so as to send the traffic data to the external service.

[0016] In some embodiments, the conversion of the destination IP address of the traffic data from the virtual IP address to the real IP address of the external service is performed when the traffic data complies with the traffic gating rules on the forwarding gateway node.

[0017] In some embodiments, the traffic control method further includes: when the traffic data does not comply with the traffic gating rules on the forwarding gateway node, performing packet loss processing on the traffic data.

[0018] In some embodiments, the traffic control method further includes: in the absence of a routing rule matching the virtual IP address, performing packet loss processing on the traffic data.

[0019] According to a third aspect of the present disclosure, a gateway rule configuration device is provided, comprising: a module for executing the gateway rule configuration method as described above.

[0020] In some embodiments, the module is generated based on a cloud-native approach.

[0021] According to a fourth aspect of the present disclosure, a flow control device is provided, comprising: a module for executing the flow control method as described above.

[0022] According to a fifth aspect of the present disclosure, an electronic device is provided, comprising: a memory; and a processor coupled to the memory, the processor being configured to execute the gateway rule configuration method as described above, or the traffic control method as described above, based on instructions stored in the memory.

[0023] According to a sixth aspect of the present disclosure, a computer-readable storage medium is provided, on which computer program instructions are stored. When the instructions are executed by a processor, the gateway rule configuration method as described in any one of claims 1 to 7, or the traffic control method as described above is implemented.

[0024] According to a seventh aspect of the present disclosure, a computer program product is provided, on which computer program instructions are stored, and when the instructions are executed by a processor, the gateway rule configuration method as described above, or the traffic control method as described above is implemented.

[0025] Other features and advantages of the present disclosure will become apparent from the following detailed description of exemplary embodiments of the present disclosure with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings, which constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0027] Figure 1 is a flowchart of a gateway rule configuration method according to some embodiments of the present disclosure;

[0028] Figure 2 is a flow chart of a flow control method according to some embodiments of the present disclosure;

[0029] Figure 3 is a flow chart of a flow control method according to other embodiments of the present disclosure;

[0030] Figure 4 is a flow chart of a flow control method according to some further embodiments of the present disclosure;

[0031] Figure 5 is a schematic diagram of the structure of a gateway rule configuration device according to some embodiments of the present disclosure;

[0032] Figure 6 is a schematic diagram of the structure of a flow control device according to some embodiments of the present disclosure;

[0033] Figure 7 is a schematic diagram of the structure of an electronic device according to some embodiments of the present disclosure;

[0034] Figure 8 It is a schematic diagram of the structure of a gateway system according to some embodiments of the present disclosure.

[0035] The present disclosure can be more clearly understood from the following detailed description with reference to the accompanying drawings. DETAILED DESCRIPTION

[0036] Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that the relative arrangement of components and steps, numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present disclosure unless otherwise specifically stated.

[0037] At the same time, it should be understood that for the convenience of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship.

[0038] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present disclosure, its application, or uses.

[0039] Technologies, methods, and apparatus known to ordinary technicians in the relevant field may not be discussed in detail, but where appropriate, such technologies, methods, and apparatus should be considered part of the authorization specification.

[0040] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limiting. Therefore, other examples of the exemplary embodiments may have different values.

[0041] It should be noted that like reference numerals and letters refer to similar items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0042] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0043] The inventors of the present disclosure have found that there are the following two problems in configuring gateway rules for IP addresses in the related art. First, the application services in the business Pod all access the domain name of the service when accessing Internet services. When the host machine or gateway manages the traffic data of the Pod, it is necessary to first resolve the domain name of the service into an IP address through the domain name resolution service, and then determine whether the IP address hits the configured rules. Since the same domain name may correspond to many IP addresses, it is difficult for us to obtain all the IP addresses corresponding to the domain name and set gating rules for all IP addresses. This results in the resolution result of a domain name that should have been released may not hit the gating rule, resulting in access failure. Second, in actual application scenarios, the service provider has the need to update the IP address corresponding to the domain name. After the service provider updates the IP address corresponding to the domain name, the IP address in the gating rule also needs to be updated. However, due to the high update cost, it cannot meet the IP address update scenario.

[0044] In view of this, the present disclosure proposes a gateway rule configuration and traffic control method and device, which can automatically implement the domain name-based gateway rule configuration process, improve the control accuracy of the traffic data of the container group, alleviate the problem of the container group accessing the service failure caused by the inconsistency between the domain name resolution result of the service that the container group wants to access and the IP address corresponding to the same domain name in the gateway rule, and reduce the gateway rule maintenance cost required for updating the IP address of the service.

[0045] Figure 1is a flow chart of a gateway rule configuration method according to some embodiments of the present disclosure. Figure 1 As shown, the gateway rule configuration method includes steps S11 to S13.

[0046] Step S11: after monitoring the configuration request of the gateway rule, a unique virtual IP address is allocated to the domain name of the accessible service indicated by the configuration request.

[0047] The gateway rule configuration method may be executed by a gateway rule configuration device, wherein the gateway rule configuration device may be a device generated in a cloud-native manner within a container orchestration system.

[0048] The gateway rule configuration request carries the indication information of the domain name configured by the user, which indicates the domain name of the accessible service. Among them, the accessible service refers to the service that is allowed to be accessed outside the container orchestration system. In addition, the gateway rule configuration request may also carry the indication information of the container group, which indicates which container groups' traffic data are allowed to be released. For example, in the container orchestration system Kubernetes, the indication information of the container group allowed to be released may include one or more of the namespace (Namespace), container group selector (Pod Selector) or Classless Inter-Domain Routing (CIDR), so as to specify the container group allowed to be released based on these contents.

[0049] In some examples, the gateway rule configuration request is a gateway rule creation request. In these examples, step S11 includes: after monitoring the gateway rule creation request, a unique virtual IP address may be allocated to the domain name of the external service indicated by the request. The virtual IP address refers to the IP address allocated to the accessible service within the container orchestration system, which is different from the real IP address of the accessible service.

[0050] In other examples, the gateway rule configuration request is a gateway rule modification request. In these examples, step S11 includes: after monitoring the gateway rule modification request, a unique virtual IP address may be allocated to the domain name of the external service indicated by the request.

[0051] In some embodiments, the gateway rule configuration method further includes: before step S11, the user first initiates a gateway rule configuration request based on a cloud management system (Cloud Management System, CMS). In other words, the user configures the gateway rule based on the CMS. Then, the cloud management system sends the gateway rule configuration request initiated by the user to the gateway rule configuration device.

[0052] In some embodiments, the gateway rule configuration method further includes: after step S11, saving the relationship between the domain name of the accessible service and the virtual IP address to a domain name resolution service module of the container orchestration system.

[0053] For example, in the container orchestration system Kubernetes, the relationship between the domain name of the accessible service and the virtual IP address can be saved in the central domain name resolution service (CoreDNS).

[0054] In some embodiments of the present disclosure, by saving the relationship between the domain name of the accessible service and the virtual IP address, it is convenient to provide a domain name resolution service for the Pod after the Pod initiates a domain name resolution request.

[0055] Step S12: Setting routing rules based on the virtual IP address for the working nodes in the container orchestration system.

[0056] The routing rule is used to indicate the forwarding gateway node corresponding to the container group traffic data whose destination IP address is the above virtual IP address.

[0057] Routing rules can be expressed in a variety of forms. For example, routing rules can be in the form of the virtual IP address of the destination + the IP address of the gateway node. In this example, assuming that the virtual IP address of the accessible service is 1.0.0.6, the configured routing rule can be: route the traffic data with the destination IP address of 1.0.0.6 to gateway 1. For another example, routing rules can be in the form of the virtual IP address of the destination + the IP address of the gateway node. In this example, assuming that the virtual IP address of the accessible service is 1.0.0.6 and the IP address of gateway 1 is 114.114.112.110, the configured routing rule can be: route the traffic data with the destination IP address of 1.0.0.6 to the gateway with an IP address of 114.114.112.110.

[0058] Step S12 can be implemented in a variety of ways. The following is an explanation in conjunction with an exemplary embodiment. In some examples, step S12 includes: a1, updating the first custom resource object on the working node according to the virtual IP address; a2, configuring the routing rules based on the virtual IP address according to the updated first custom resource object. Among them, the first custom resource object is pre-defined in the container orchestration system. The first custom resource object can be used to store a set of domain names that can access services, and a set of virtual IP addresses that can access services. By setting the first custom resource object on the working node, it is convenient for the working node to update the routing rules in a timely manner according to the object.

[0059] Among them, step a1 may specifically include: first determine whether the first custom resource object on the working node already contains the virtual IP address; if it does not contain the virtual IP address, first save the virtual IP address to the first custom resource object, and then execute step a2; if it already contains the virtual IP address, execute step a2. In addition, in specific implementation, step a1 may also adopt other implementation methods.

[0060] Among them, step a2 may specifically include: first determining whether the working node already contains a routing rule based on the virtual IP address; if it already contains a routing rule based on the virtual IP address, ending step a2; if it does not contain a routing rule based on the virtual IP address, adding a routing rule based on the virtual IP address. In addition, in specific implementation, step a2 may also adopt other implementation methods.

[0061] Step S13: For the forwarding gateway node, a conversion rule between the virtual IP address and the real IP address for accessing the service is set.

[0062] The conversion rule is used to convert the IP address of the destination end of the flow data of the container group from the virtual IP address of the accessible service to the real IP address of the accessible service.

[0063] The conversion rule can be expressed in various forms. For example, the conversion rule can be in the form of the virtual IP address of the destination + the real IP address of the destination. In this example, assuming that the virtual IP address of the accessible service is 1.0.0.6 and the real IP address of the accessible service is 112.10.111.10, the configured conversion rule can be: 1.0.0.6→112.10.111.10.

[0064] Step S13 can be implemented in a variety of ways, which are described below in conjunction with an exemplary embodiment. In some examples, step S13 includes: b1, updating the second custom resource object of the forwarding gateway node according to the virtual IP address of the accessible service; b2, configuring the conversion rule according to the updated second custom resource object. Among them, the second custom resource object is pre-defined in the container orchestration system. The second custom resource object can be used to store a set of real IP addresses of accessible services and a set of virtual IP addresses of accessible services. In addition, the second custom resource object can also be used to store a set of information about Pods that are allowed to be released. By setting the second custom resource object on the gateway node, it is convenient for the gateway node to update the conversion rules in a timely manner according to the object.

[0065] Wherein, step b1 may specifically include: when the second custom resource object includes the real IP address of the accessible service, updating the virtual IP address of the accessible service to the second custom resource object.

[0066] Alternatively, step b1 may specifically include: when the second custom resource object does not contain the real IP address of the accessible service, querying the domain name resolution service module in the Internet according to the domain name of the accessible service to obtain the real IP address of the accessible service; and updating the real IP address and virtual IP address of the accessible service to the second custom resource object.

[0067] Wherein, step b2 may specifically include: configuring a conversion rule according to the real IP address of the accessible service and the virtual IP address of the accessible service in the second custom resource object.

[0068] In some embodiments, the gateway rule configuration method further includes: after setting the conversion rule, periodically querying the domain name resolution service module (or domain name resolution server) in the Internet according to the domain name of the accessible service, and updating the conversion rule according to the query result. In addition, the domain name resolution service module in the Internet can also be periodically queried, and the second custom resource object can be updated according to the query result.

[0069] In some embodiments of the present disclosure, by periodically querying the domain name resolution service in the Internet, it is convenient to update the conversion rules in the gateway node in a timely manner, thereby alleviating the problem of Pod access failure to external services due to the update of the IP address of the external service.

[0070] In some embodiments, the gateway rule configuration method further includes: setting a traffic gating rule for the forwarding gateway node, the traffic gating rule being used to filter the traffic data of the container group received by the forwarding gateway node. The traffic gating rule can be used to indicate which pods' traffic data are allowed to be released, and / or to indicate which external services' traffic is allowed to be released.

[0071] In the above embodiment, the traffic gating rules can be set according to the following exemplary manner: c1, when the configuration request carries the information of the container group allowed to be released, the second custom resource object is updated according to the information of the container group allowed to be released; c2, the traffic gating rules are configured according to the second custom resource object.

[0072] Among them, step c1 may specifically include: first determine whether the second custom resource object already contains the information of the Pod configured this time; if the second custom resource object does not contain the information of the Pod configured this time, save the information of the Pod configured this time to the second custom resource object, and then execute step c2; if the second custom resource object already contains the information of the Pod configured this time, execute step c2. In addition, in the specific implementation, step c1 can also adopt other implementation methods. In some embodiments of the present disclosure, by setting a second custom resource object containing the information of the Pod allowed to be released on the gateway node, it is convenient for the gateway node to update the traffic gating rules in a timely manner according to the object.

[0073] Among them, step c2 may specifically include: first determining whether the gateway node already contains the traffic gating rule configured by the user this time; if the gateway node does not contain the traffic gating rule configured by the user this time, then adding the traffic gating rule configured this time to the gateway node; if the traffic gating rule configured this time is already contained, then ending. In addition, in specific implementation, step c2 may also adopt other implementation methods.

[0074] In the disclosed embodiment, the configuration efficiency is improved by implementing the domain name-based gateway rule configuration process in a cloud-native manner. Furthermore, by allocating a unique virtual IP address to the accessible service during the configuration process, and setting routing rules and conversion rules based on the virtual IP address, the accuracy of the control of the flow data of the container group can be improved, and the problem of the container group failing to access the service due to the inconsistency between the domain name resolution result of the service that the container group wants to access and the IP address corresponding to the same domain name in the gateway rule can be alleviated, and the gateway rule maintenance cost required for the update of the service IP address can be reduced.

[0075] Figure 2 FIG. 1 is a flow chart of a flow control method according to some embodiments of the present disclosure. Figure 2 As shown, the traffic control method includes steps S21 to S23.

[0076] Step S21: After the container group receives the traffic data for accessing the external service, the domain name of the external service is resolved to obtain a unique virtual IP address of the external service in the container orchestration system.

[0077] The flow control method can be executed by a flow control device, wherein the flow control device can be a device generated in a cloud-native manner within a container orchestration system.

[0078] In the container orchestration system, after the application in the container group (Pod) initiates a request for an external service, these requests or traffic data will be sent to the container group first. The container group sends a domain name resolution request to the domain name resolution service module (such as CoreDNS) of the container orchestration system. After receiving the domain name resolution request, the domain name resolution service module resolves the domain name of the external service to obtain the virtual IP address of the external service.

[0079] Step S22: Routing the traffic data to the forwarding gateway node according to the routing rule matching the virtual IP address.

[0080] In some examples, in step S22, the working node where the container group is located determines whether there is a routing rule matching the virtual IP address locally. If there is a routing rule matching the virtual IP address, the traffic data is routed to the forwarding gateway node according to the routing rule; if not, the traffic data is dropped.

[0081] Step S23: According to the conversion rule matching the virtual IP address, the IP address of the destination of the flow data is converted to send the flow data to the external service.

[0082] In some examples, in step S23, the forwarding gateway node converts the IP address of the destination of the traffic data from the virtual IP address of the external service to the real IP address of the external service according to the conversion rule, so as to send the traffic data to the external service.

[0083] In the disclosed embodiment, through the above process, the control accuracy of the flow data of the container group can be improved, the problem of the container group failing to access the service due to the inconsistency between the domain name resolution result of the service that the container group wants to access and the IP address corresponding to the same domain name in the gateway rule can be alleviated, and the gateway rule maintenance cost required for updating the IP address of the service can be reduced.

[0084] Figure 3 FIG. 1 is a flow chart of a flow control method according to other embodiments of the present disclosure. Figure 3 As shown, the traffic control method includes steps S31 to S39.

[0085] Step S31: The container group receives traffic data for accessing external services.

[0086] In the container orchestration system, application services in the container group can initiate access requests to external services. Usually, application services initiate access requests to external services in the form of domain names. Subsequently, the container group can receive access requests or traffic data initiated by the application services.

[0087] Step S32: The container group sends a domain name resolution request to the domain name resolution service.

[0088] In some examples, the container group sends a domain name resolution request carrying an external service domain name to a central server (Core DNS).

[0089] Step S33: The domain name resolution service resolves the domain name of the external service to obtain a virtual IP address.

[0090] Step S34: The working node determines whether there is a routing rule matching the virtual IP address.

[0091] In some examples, the working node determines whether there is a matching routing rule in the following manner: the IP address obtained by the analysis in step S33 is compared with the IP address in the local existing routing rule. If there is a routing rule containing the IP address obtained by the analysis, the routing rule is used as the routing rule matching the virtual IP address; otherwise, it is determined that there is no routing rule matching the virtual IP address.

[0092] If it is determined in step S34 that there is a routing rule matching the virtual IP address, step S35 is executed; otherwise, step S39 is executed.

[0093] Step S35: The working node routes the traffic data to the gateway node according to the matching routing rules.

[0094] Step S36: The gateway node determines whether the traffic data complies with the traffic gating rules.

[0095] In some examples, the gateway node determines whether the traffic data complies with the traffic gating rules in the following manner: comparing the information of the source container group of the traffic data (such as the IP address of the container group) with the container group information in the traffic gating rules; if there is a traffic gating rule that contains the source container group information, it indicates that the traffic data complies with (or hits) the traffic gating rule; otherwise, it indicates that the traffic data does not comply with the traffic gating rules.

[0096] If the traffic data meets the traffic gating rule, execute step S37; otherwise, execute step S39.

[0097] Step S37: The gateway node converts the destination IP address of the traffic data according to the conversion rule matching the virtual IP address.

[0098] The gateway node converts the destination IP address of the received traffic data from the virtual IP address of the external service to the real IP address of the external service. In addition, the gateway node also converts the source IP address of the received traffic data from the IP address of the container group to the IP address of the gateway.

[0099] Step S38: The gateway node sends the traffic data to the external service.

[0100] Step S39: Packet loss.

[0101] In step S39, when the working node determines that there is no routing rule matching the virtual IP address of the external service, the working node performs packet loss processing on the traffic data. In step S39, when the forwarding gateway node determines that the traffic data does not meet the traffic gating rule, the forwarding gateway node performs packet loss processing on the traffic data.

[0102] In the embodiments of the present disclosure, the above process can accurately and reliably control the traffic data of the container group accessing the external service, thereby solving the problems existing in the related technology.

[0103] Figure 4 FIG. 1 is a flow chart of a flow control method according to some other embodiments of the present disclosure. Figure 4 As shown, the traffic control method does not include steps 41 to 47.

[0104] Step 41: The container group sends a domain name resolution request for the domain name www.abc.com to the central DNS.

[0105] For example, when an application in a container group wants to access an external service with a domain name of www.abc.com, it initiates an access request based on the domain name. After receiving the access request, the container group sends a resolution request to the central DNS. The central DNS is a domain name resolution service in the container orchestration system.

[0106] Step 42: The central DNS resolves the domain name www.abc.com of the external service into the virtual IP address 6.0.0.6.

[0107] Step 43: Working node 1 sends the request with the destination being the Internet service to gateway 1 according to the routing rule.

[0108] After receiving the domain name resolution result of the external service (i.e. the virtual IP address 6.0.0.6 of the external service), worker node 1 sends the container group's request for the Internet service to gateway 1 according to the routing rule matching the virtual IP address. The source IP address of the request is the IP address of the container group (specifically 172.16.0.2), the destination IP address of the request is the virtual IP address of the Internet service (specifically 6.0.0.6), and the port number is 80.

[0109] Step 44: Gateway 1 converts the destination IP address of the request and converts the source IP address.

[0110] Gateway 1 converts the destination IP address of the request received from worker node 1 according to the conversion rule that matches the virtual IP address of the Internet service. Specifically, the destination IP address of the request is converted from the virtual IP address 6.0.0.6 of the Internet service to the real IP address 112.84.222.27 of the Internet service. In addition, gateway 1 converts the source IP address of the request from the IP address 172.16.0.2 of the container group to the IP address 110.114.114.100 of gateway 1.

[0111] Step 45: Gateway 1 sends the request with the destination being the Internet service to the Internet service.

[0112] Step 46: The Internet service sends a response with the destination being the gateway to Gateway 1.

[0113] Step 47: Gateway 1 sends a response with the destination being the container group to worker node 1.

[0114] After receiving the response from the Internet service, Gateway 1 changes the source IP address of the response from the real IP address 112.84.222.27 of the Internet service to the virtual IP address 6.0.0.6 of the Internet service, and changes the destination IP address of the response from the IP address of Gateway 1 to the IP address of the container group.

[0115] In the embodiments of the present disclosure, the above process can accurately and reliably control the traffic data of the container group accessing the external service, thereby solving the problems existing in the related technology.

[0116] Figure 5 is a schematic diagram of the structure of a gateway rule configuration device according to some embodiments of the present disclosure. Figure 5 As shown, the gateway rule configuration device 50 is used to execute the gateway rule configuration method as described above, and includes a DNS control module 51 , a first rule management module 52 and a second rule management module 53 .

[0117] The DNS control module 51 is configured to allocate a unique virtual IP address to the domain name of the accessible service indicated by the configuration request after monitoring the configuration request of the gateway rule. The accessible service is a service that is located outside the container orchestration system and is allowed to be accessed.

[0118] The first rule management module 52 is configured to set a routing rule based on the virtual IP address for the working node in the container orchestration system, wherein the routing rule is used to indicate the forwarding gateway node corresponding to the container group traffic data whose destination IP address is the virtual IP address.

[0119] The second rule management module 53 is configured to set a conversion rule between the virtual IP address and the real IP address of the accessible service for the forwarding gateway node, wherein the conversion rule is used to convert the IP address of the destination of the container group flow data into the real IP address of the accessible service.

[0120] In the disclosed embodiment, the above device can automatically implement the domain name-based gateway rule configuration process, improve the control accuracy of the flow data of the container group, and reduce the gateway rule maintenance cost required for the IP address update of the service.

[0121] Figure 6 is a schematic diagram of the structure of a flow control device according to some embodiments of the present disclosure. Figure 6 As shown, the traffic control device 60 is used to execute the traffic control method as described above, including a domain name resolution service module 61, a first rule management module 62, and a second rule management module 63.

[0122] The domain name resolution service module 61 is configured to resolve the domain name of the external service after the container group receives the traffic data for accessing the external service, so as to obtain the unique virtual IP address of the external service in the container orchestration system.

[0123] The first rule management module 62 is configured to route the traffic data to the forwarding gateway node according to the routing rule matching the virtual IP address.

[0124] The second rule management module 63 is configured to convert the IP address of the destination of the traffic data from the virtual IP address to the real IP address of the external service according to the conversion rule matching the virtual IP address, so as to send the traffic data to the external service.

[0125] In the embodiments of the present disclosure, the above device can accurately and reliably control the traffic data of the container group accessing the external service, solving the problems existing in the related technology.

[0126] Figure 7 is a schematic diagram of the structure of an electronic device according to some embodiments of the present disclosure. Figure 7 As shown, the electronic device 70 includes a memory 71 and a processor 72 coupled to the memory 71. The memory 71 is used to store instructions for executing the gateway rule configuration method or the traffic control method corresponding to the embodiment. The processor 72 is configured to execute the gateway rule configuration method or the traffic control method in any of the embodiments of the present disclosure based on the instructions stored in the memory 71.

[0127] Figure 8 is a schematic diagram of the structure of a gateway system according to some embodiments of the present disclosure. Figure 8As shown, the gateway system includes an API service 82 , a DNS controller 83 , a central DNS 84 , a first rule manager 85 , and a second rule manager 86 .

[0128] The API service 82 is a component in Kubernetes that provides interfaces for adding, deleting, modifying, and checking various resource objects, as well as monitoring (watching). It is the data bus and data center of the entire system. In the disclosed embodiment, the API service 82 provides an interface for configuring domain-based gateway rules and an interface for monitoring configuration information of domain-based gateway rules.

[0129] The DNS controller 83 is mainly used to allocate a virtual IP address to a domain name after monitoring the addition or modification of a domain name-based gateway rule, save the virtual IP address to the pre-created first custom resource object and the second custom resource object, and save the relationship between the domain name and the virtual IP address to the central DNS 84. Among them, the first custom resource object is located on the working node, and the second custom resource object is located on the gateway node. These two resource objects are used to describe an access flow from a Pod to an actual business, which may specifically include at least one of the information of the Pod that is allowed to be released and the information of the external service that is allowed to be accessed.

[0130] The central DNS 84 is a component in Kubernetes, which is mainly used to provide domain name resolution services for the cluster.

[0131] The first rule manager 85 is deployed on the working node, and is mainly used to manage the gateway rules (such as routing rules) on the working node, and to control the forwarding of traffic data of the container group on the working node according to the gateway rules.

[0132] The second rule manager 86 is deployed on the gateway node, and is mainly used to manage the gateway rules (such as traffic gating rules, address conversion rules, etc.) on the gateway node, and to control the forwarding of traffic data according to the gateway rules.

[0133] The following is an explanation of the process of configuring gateway rules based on the gateway system. Specifically, the process may include steps 91 to 97.

[0134] Step 91 : The user configures a domain name-based gateway rule (referred to as a domain name rule) through the cloud management system 81 , and the cloud management system 81 submits a domain name rule configuration request by calling the API service 82 .

[0135] The configuration request may carry indication information of the Pods that are allowed to be released and indication information of the external services (i.e., accessible services) that are allowed to be accessed.

[0136] Step 92: After the DNS controller 83 monitors the domain name rule configuration request through the API service 82, it allocates a virtual IP address for the domain name of the accessible service indicated by the configuration request.

[0137] In this step, the DNS controller 83 can allocate a unique virtual IP address to the domain name of the accessible service through its own IP address management (IPAM) function. In the container orchestration system, the DNS controller 83 allocates different virtual IP addresses to different accessible services.

[0138] Step 93: The DNS controller 83 sets the virtual IP address to the first custom resource object and the second custom resource object by calling the API service 82.

[0139] In this step, the DNS controller 83 updates information such as the virtual IP address of the accessible service into the first custom resource object and the second custom resource object.

[0140] Step 94 : The DNS controller 83 saves the relationship between the virtual IP address and the domain name in the central DNS 84 .

[0141] Step 95: After monitoring the update of the first custom resource object through the API service 82, the first rule manager 85 sets the gateway rule on the working node according to the updated first custom resource object.

[0142] Among them, the gateway rules on the working node include routing rules based on the virtual IP address. In this step, the first rule manager 85 obtains the virtual IP address of the accessible service from the updated first custom resource object, and then sets the routing rules for the virtual IP address of the accessible service. For example, assuming that the virtual IP address of the accessible service is 1.0.0.6, the configured routing rules may be: route the traffic data with the destination IP address of 1.0.0.6 to gateway 1. Among them, the gateway information in the routing rules can also be specified by the user through the CMS. In addition, the gateway rules on the working node may also include traffic gating rules. Among them, the traffic gating rules can be used to specify which pods' traffic is allowed to be released, and / or, which external services' traffic is allowed to be released as the destination, and so on.

[0143] Step 96: After monitoring the update of the second custom resource object through the API service 82, the second rule manager 86 sets the gateway rule on the gateway node according to the updated second custom resource object.

[0144] In some examples, the gateway rule on the gateway node includes a conversion rule based on the virtual IP address. In this example, the second rule manager 86 obtains the virtual IP address of the accessible service and the real IP address of the accessible service from the updated second custom resource object, and then sets the conversion rule between the virtual IP address and the real IP address of the accessible service.

[0145] In other examples, the gateway rules on the gateway node may include not only conversion rules but also traffic gating rules. The traffic gating rules may be used to specify which pods' traffic is allowed to pass, and / or which external services' traffic is allowed to pass, etc. In these examples, in addition to setting conversion rules according to the updated second custom resource object, the second rule manager 86 also sets traffic gating rules according to the updated second custom resource object.

[0146] Step 97: The second rule manager 86 periodically sends a request to the Internet DNS 88 to resolve the domain name set into an IP address set through the Internet DNS 88.

[0147] In some examples, a timer 87 is set for the second rule manager 86 on the gateway node to regularly detect the Internet DNS 88. Then, the domain name resolution result of the accessible service obtained through the Internet DNS is compared with the real IP address of the accessible service in the second custom resource object. If the two are inconsistent, the real IP address of the accessible service in the second custom resource object is updated.

[0148] In the disclosed embodiment, by mainly executing steps 91 to 97 by the gateway system, the following technical effects can be achieved: 1. The domain name-based gateway rule configuration process is automatically implemented in a cloud-native manner, thereby improving the configuration efficiency of the gateway rules; 2. By allocating a unique virtual IP address to the domain name of the accessible service and configuring routing rules and conversion rules based on the virtual IP address, the accuracy of traffic control can be improved, and the gateway rule maintenance cost caused by the update of the real IP address of the accessible service can be reduced, thereby alleviating the problems in the related technology of the failure of the container group to access the service and the high gateway rule maintenance cost caused by the inconsistency between the domain name resolution result of the service that the container group wants to access and the IP address corresponding to the same domain name in the gateway rule; 3. By periodically requesting the DNS in the Internet, the real IP address information of the accessible service in the gateway node and the corresponding conversion rules can be updated in time, thereby alleviating the problems that may be caused by the change of the real IP address of the accessible service.

[0149] Here, various aspects of the present disclosure are described with reference to flowcharts and / or block diagrams of methods, devices, and computer program products according to embodiments of the present disclosure. It should be understood that each frame of the flowchart and / or block diagram and the combination of frames can be implemented by computer-readable program instructions.

[0150] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable device to produce a machine, so that the processor executes the instructions to produce means for implementing the functions specified in one or more blocks in the flowchart and / or block diagram.

[0151] These computer-readable program instructions may also be stored in a computer-readable memory, which cause the computer to work in a specific manner to produce an article of manufacture, including instructions for implementing the functions specified in one or more blocks in the flowchart and / or block diagram.

[0152] The present disclosure can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects.

[0153] Through the gateway rule configuration and traffic control method and device in the above embodiments, the control accuracy of the traffic data of the container group can be improved, and the gateway rule maintenance cost required for the IP address update of the service can be reduced.

[0154] So far, the gateway rule configuration and traffic control method and device according to the present disclosure have been described in detail. In order to avoid obscuring the concept of the present disclosure, some details known in the art are not described. Based on the above description, those skilled in the art can fully understand how to implement the technical solution disclosed here.

Claims

1. A gateway rule configuration method, comprising: After monitoring a configuration request of a gateway rule, a unique virtual IP address is allocated to a domain name of an accessible service indicated by the configuration request, where the accessible service is a service outside the container orchestration system; For the working nodes in the container orchestration system, a routing rule based on the virtual IP address is set, wherein the routing rule is used to indicate a forwarding gateway node corresponding to the container group traffic data whose destination IP address is the virtual IP address; For the forwarding gateway node, a conversion rule between the virtual IP address and the real IP address of the accessible service is set, wherein the conversion rule is used to convert the IP address of the destination end of the container group traffic data into the real IP address.

2. The gateway rule configuration method according to claim 1, further comprising: The relationship between the domain name of the accessible service and the virtual IP address is saved in a domain name resolution service module of the container orchestration system.

3. The gateway rule configuration method according to claim 1, wherein: The setting of the routing rule based on the virtual IP address includes: According to the virtual IP address, update the first custom resource object of the working node; According to the updated first custom resource object, a routing rule based on the virtual IP address is configured.

4. The gateway rule configuration method according to claim 1, wherein: The conversion rule between the virtual IP address and the real IP address of the accessible service is set as follows: According to the virtual IP address, updating the second custom resource object of the forwarding gateway node; The conversion rule is configured according to the updated second user-defined resource object.

5. The gateway rule configuration method according to claim 4, wherein: The updating of the second custom resource object of the forwarding gateway node according to the virtual IP address comprises: In the case where the second custom resource object includes the real IP address of the accessible service, the virtual IP address is updated to the second custom resource object.

6. The gateway rule configuration method according to claim 5, wherein: The updating of the second custom resource object of the forwarding gateway node according to the virtual IP address further includes: In the case where the second custom resource object does not include the real IP address of the accessible service, querying a domain name resolution service module in the Internet according to the domain name of the accessible service to obtain the real IP address of the accessible service; The real IP address of the accessible service and the virtual IP address are updated to the second custom resource object.

7. The gateway rule configuration method according to claim 6, further comprising: After the conversion rule is set, the domain name resolution service module in the Internet is periodically queried according to the domain name of the accessible service, and the conversion rule is updated according to the query result.

8. The gateway rule configuration method according to claim 1, further comprising: A traffic gating rule is set for the forwarding gateway node, where the traffic gating rule is used to filter traffic data of the container group received by the forwarding gateway node.

9. The gateway rule configuration method according to claim 8, wherein: The configuration request carries information of a container group that is allowed to be released, and the setting of a traffic gating rule for the forwarding gateway node includes: According to the information of the container group allowed to be released, updating the second custom resource object on the forwarding gateway node; The traffic gating rule is configured according to the updated second custom resource object.

10. A flow control method, comprising: After the container group receives the traffic data for accessing the external service, the domain name of the external service is resolved to obtain a unique virtual IP address of the external service in the container orchestration system; Routing the traffic data to a forwarding gateway node according to a routing rule matching the virtual IP address; According to the conversion rule matching the virtual IP address, the IP address of the destination of the traffic data is converted from the virtual IP address to the real IP address of the external service, so as to send the traffic data to the external service.

11. The flow control method according to claim 10, wherein: The converting of the IP address of the destination end of the traffic data from the virtual IP address to the real IP address of the external service is performed when the traffic data complies with the traffic gating rule on the forwarding gateway node.

12. The flow control method according to claim 11, further comprising: When the traffic data does not comply with the traffic gating rule on the forwarding gateway node, packet loss processing is performed on the traffic data.

13. The flow control method according to claim 10, further comprising: In the case that there is no routing rule matching the virtual IP address, packet loss processing is performed on the traffic data.

14. A gateway rule configuration device, comprising: A module for executing the gateway rule configuration method as described in any one of claims 1 to 9.

15. The gateway rule configuration device according to claim 14, wherein: The module is generated based on a cloud-native approach.

16. A flow control device, comprising: A module for executing the traffic control method as described in any one of claims 10 to 13.

17. An electronic device comprising: Memory; as well as A processor coupled to the memory, the processor being configured to execute the gateway rule configuration method as described in any one of claims 1 to 9, or the traffic control method as described in any one of claims 10 to 13, based on instructions stored in the memory.

18. A computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, implement the gateway rule configuration method as described in any one of claims 1 to 9, or the traffic control method as described in any one of claims 10 to 13.

19. A computer program product having computer program instructions stored thereon, which, when executed by a processor, implement the gateway rule configuration method as described in any one of claims 1 to 9, or the traffic control method as described in any one of claims 10 to 13.

Images