Container management system, container management method, device, storage medium and product

Abstract

The invention discloses a container management system, the container management system comprises a software defined network controller, a main node and a computing node, a first data processor is configured on the main node, and a second data processor is configured on the computing node. Installing a software-defined network controller driver in the first data processor, and installing a container network interface plug-in and a software-defined network controller agent in the second data processor; after the container cluster is created, a first interface is installed in each data processor. The invention further discloses a container management method, electronic equipment, a computer readable storage medium and a computer program product.

Description

Technical Field

[0001] The present application relates to, but is not limited to, the field of communications, and in particular to a container management system, a container management method, an electronic device, a computer-readable storage medium, and a computer program product. Background Art

[0002] As cloud native technology continues to mature, container technology is increasingly being used in operators' data centers, providing container-based infrastructure for upper-layer services. At the same time, in order to improve the automation of data center network configuration, especially business network configuration, a software-defined network (SDN) solution based on the Overlay network was introduced, which organically combines the container layer and SDN, and realizes the network automation opening capability of containerized applications in the resource pool.

[0003] However, although the combination of containers and SDN has achieved the network automation activation of containerized applications in the cluster to a certain extent, customers can directly log in to access the Container Infrastructure Manager (CIM) and Container Infrastructure Engine (CIE) nodes to perform operations, making all software and hardware resources on the nodes visible to customers. In this way, there will be security risks in the resources on the nodes. Summary of the invention

[0004] The embodiments of the present application provide a container management system, a container management method, an electronic device, a computer-readable storage medium, and a computer program product, and provide a secure docking solution between a bare metal container cluster and an SDN based on data processor (DPU) offloading.

[0005] In a first aspect, an embodiment of the present application provides a container management system, the container management comprising: a software defined network controller, a master node, and a computing node;

[0006] The master node is configured with a first data processor, in which a software-defined network controller driver is configured; the computing node is configured with a second data processor, in which a container network interface plug-in and a software-defined network controller agent are configured; the software-defined network controller is respectively connected to the software-defined network controller driver in the first data processor and the software-defined network controller agent in the second data processor; a first interface is installed in each data processor.

[0007] In a second aspect, an embodiment of the present application provides a container management method, which is applied to a container management system, and the method includes:

[0008] In the process of creating a container cluster, a software-defined network controller driver is installed in a first data processor of a master node of the container management system, and a container network interface plug-in and a software-defined network controller agent are installed in a second data processor of a computing node of the container management system;

[0009] After the container cluster is created, a first interface is installed in each data processor.

[0010] According to a third aspect, an electronic device includes:

[0011] A memory for storing executable instructions;

[0012] The processor is used to implement the above container management method when executing the executable instructions stored in the memory.

[0013] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned container management method.

[0014] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which implements the above-mentioned container management method when executed by a processor.

[0015] This application unloads the SDNC driver in the master node, the CNI plug-in and the SDNC Agent in the computing node to the local OS of the DPU. The tenant OS cannot perceive the information of the SDN management network, nor can it obtain all the software and hardware resources on the node. While realizing the automatic activation and configuration of the container network, it avoids the security risk of exposing the management plane network to customers in related solutions, ensures the security of resources on the node, and realizes the secure connection between the bare metal container cluster and SDN. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 is a schematic structural diagram of a container management system provided in the related art;

[0017] Figure 2 is a schematic structural block diagram of a container management system provided in an embodiment of the present application;

[0018] Figure 3 is a schematic flow chart of a container management method provided in an embodiment of the present application;

[0019] Figure 4is a schematic structural diagram of another container management system provided in an embodiment of the present application;

[0020] Figure 5 It is a schematic structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0021] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Here, the "another" or "yet another" mentioned in the description of the drawings does not refer to a specific embodiment, and the various embodiments of the present application can be combined with each other without conflict.

[0022] It should be understood that the "embodiments of the present application" or "the aforementioned embodiments" mentioned throughout the specification mean that specific features, structures or characteristics related to the embodiments are included in at least one embodiment of the present application. Therefore, "in the embodiments of the present application" or "in the aforementioned embodiments" appearing throughout the specification may not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. In the various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. The above-mentioned sequence numbers of the embodiments of the present application are for description only and do not represent the advantages and disadvantages of the embodiments.

[0023] Before explaining this application, the solution of combining containers and SDN in the related art is described here:

[0024] The solution that combines containers and SDN is not only applicable to virtual machine container scenarios, but also to bare metal container scenarios. Figure 1 It is a schematic block diagram of a solution combining containers and SDN, which is applicable to bare metal container scenarios and provided by related technologies.

[0025] like Figure 1 As shown in the figure, the relevant solutions include Software Defined Network Controller (SDNC), Virtualized Infrastructure Manager (VIM), CIM and CIE. Among them, VIM is the virtual layer control management node; CIM is the container layer control node, such as the K8S master node (Kubernetes Master Node); CIE is the container layer computing node, the node that carries the Pod, such as the K8S worker node (Worker Node); SDNC together with SDNC Driver and SDNC Agent realizes the automatic configuration of the business network.

[0026] Specifically, a bare metal container cluster based on Kubernetes is created (the bare metal nodes of the container cluster are issued through the Ironic service provided by VIM), and the CIE nodes are deployed on the bare metal server. The CIM nodes can be deployed as virtual machines (Hypervisor) or bare metal.

[0027] A container network interface (CNI) plug-in is installed in each CIE node to assign IP addresses to containers, configure network routing, network isolation, and security policies, and implement communication between containers within the node and between containers within the node and the external network.

[0028] CNI, Kubectl, and Etcd are installed in the CIM node. Etcd is an open source distributed key-value storage system used to automate the deployment, expansion, and operation of containers.

[0029] The SDNC driver in Neutron, which provides virtual network services, is installed in the VIM node. The SDNC northbound is connected to the CIM through the SDNC driver. The SDNC agent software is installed in each CIE node. The SDNC southbound communicates with the CIE node through the SDN Agent. The VIM node also includes Nova, Cinder, etc. Among them, Nov is used to provide computing services and is responsible for the management of the computing instance life cycle, including generation, scheduling, and recycling. Cinder is used to provide block storage resources for computing instances and connect to the backend block storage resources.

[0030] It should be noted that the solution that combines containers and SDN cannot open or close the precise forwarding flow table on the corresponding CIE node for each container application. Instead, it opens all traffic in one or more network segments in units of clusters, etc., which poses a network security risk.

[0031] At the same time, in actual application scenarios, bare metal container clusters have multiple service modes. Among them, a common service mode is that customers rent the entire bare metal CIM and CIE nodes, that is, customers can directly log in to access CIM and CIE nodes to perform operations (for example, issuing bare metal container applications). At this time, all software and hardware resources on the bare metal nodes are visible to customers, including CNI plug-ins and SDNC Agent installed in the CIE nodes, which poses a resource security risk.

[0032] The SDNC in the resource pool communicates with the SDNC Agent on the CIE node through the southbound interface. The interconnection network between them belongs to the management plane network of the resource pool and should not be exposed to customers. However, under the current solution, customers can invade the management plane network that they communicate with SDNC through the SDN Agent installed on the CIE node, and then invade and attack the SDNC or other management plane components in the resource pool through the management network, posing serious security risks to the entire resource pool.

[0033] Figure 2 The present application provides a structural schematic diagram of a container management system, which includes: SDNC, a master node and a computing node; the master node is configured with a first data processor (Data Processing Unit, DPU), and the first DPU is configured with an SDNC Driver; the computing node is configured with a second DPU, and the second DPU is configured with a CNIPlugin and an SDNC Agent; the SDNC is respectively connected to the SDNC Driver in the first DPU and the SDN Agent in the second DPU; each DPU is installed with a first interface, that is, the first DPU is installed with a first interface, and the second DPU is installed with a first interface.

[0034] It should be noted that the first interface is configured to call SDNC Driver and / or CNIPlugin and / or SDNC Agent to manage the container.

[0035] Figure 3 The present application embodiment provides a flowchart of a container management method. Figure 3 The method shown is applied to Figure 2 The container management system shown, the method comprising:

[0036] Step 301: In the process of creating a container cluster, a software-defined network controller driver is installed in a first data processor of a master node of a container management system, and a container network interface plug-in and a software-defined network controller agent are installed in a second data processor of a computing node of the container management system.

[0037] In an embodiment of the present application, the master node may be a CIM node, that is, a control node of the container layer. During the creation of a bare metal container cluster, for the CIM node, the SDNC driver is automatically unloaded to the local operating system (OS) of the DPU configured on the master node.

[0038] In the embodiment of the present application, the computing node may be a CIE node, that is, a computing node of the container layer. During the creation of the bare metal container cluster, for the CIE node, the CNI and SDNC Agent are automatically uninstalled to the local OS of the DPU configured for the computing node. That is, when creating a bare metal container cluster, the SDNC driver is automatically installed in the DPU of the master node, and the CNI plug-in and SDNC Agent are automatically installed in the DPU of the computing node. At the same time, the CNI plug-in is no longer installed on the computing node.

[0039] In the embodiment of the present application, when synchronizing container network information to SDNC, CNI on the master node only needs to call the SDNC driver installed in the DPU local OS through the network interface mounted by DPU, without directly connecting to SDNC.

[0040] In an embodiment of the present application, a container runtime interface (Container Runtime Interface, CRI) plug-in on a computing node calls a CNI plug-in installed in a local OS of the DPU through a network interface mounted by the DPU to complete the creation or deletion of container network resources. The SDNC Agent continuously monitors changes in network devices (ports) (addition or deletion of ports). When a new port is added, network information such as an IP address needs to be obtained from the CNI plug-in.

[0041] In an embodiment of the present application, a master node and a computing node or a virtual machine are provided in a virtual machine container scenario.

[0042] In the embodiment of the present application, in the bare metal container scenario, the master node and the computing node are bare metal servers.

[0043] In the embodiment of the present application, the first data processor communicates with the bare metal server through a bus and interface standard (Peripheral Component Interface Express, PCI-e) channel. The second data processor communicates with the bare metal server through a PCI-e channel; that is, before the container cluster is created, the DPU is installed and configured on all bare metal servers, and the DPU communicates with the bare metal server through the PCI-e channel.

[0044] Step 302: After the container cluster is created, a first interface is installed in each data processor.

[0045] In the embodiment of the present application, the bare metal container cluster is installed, and the first DPU and the second DPU are installed with a first interface, which is mounted to the bare metal master node, i.e., the CIM node, and the computing node, i.e., the CIE node, through a standard interface for use.

[0046] Step 303: Call the software-defined network controller driver and / or the container network interface plug-in and / or the software-defined network controller agent through the first interface to manage the container.

[0047] In some embodiments, a forwarding flow table is configured for each container on a corresponding computing node.

[0048] This application proposes an enhanced technical solution based on DPU hardware offloading to achieve physical isolation between the customer tenant network and the resource pool management network (the network for communication between SDNC and SDNC Agent), avoiding the security risk of exposing the resource pool management plane network to customers. At the same time, it supports the configuration of accurate forwarding flow tables on the corresponding computing nodes for each container application.

[0049] In the embodiment of the present application, managing the container includes managing files in the container, managing the life cycle of the container service, and managing the resource pool in the container.

[0050] The embodiment of the present application discloses a container management method, which is applied to a container management system. The method includes: in the process of creating a container cluster, installing a software-defined network controller driver in the first data processor of the master node of the container management system, and installing a container network interface plug-in and a software-defined network controller agent in the second data processor of the computing node of the container management system; after the container cluster is created, a first interface is installed in each data processor; through the first interface, the software-defined network controller driver and / or the container network interface plug-in and / or the software-defined network controller agent are called to manage the container. That is to say, the present application uninstalls the SDNC driver in the master node, and the CNI plug-in and SDNC Agent in the computing node to the local OS of the DPU, and the tenant OS cannot perceive the information of the SDN management network, and cannot obtain all the software and hardware resources on the node. While realizing the automatic opening and configuration of the container network, it avoids the security risk of the management plane network being exposed to customers in the related solutions, ensures the security of the resources on the node, and realizes the secure docking of the bare metal container cluster with the SDN.

[0051] This application offloads the SDNC driver, SDNC Agent, and CNI plug-in to the DPU hardware, reducing the occupation of bare metal resources by the management plane software, releasing more computing resources to tenants, and improving resource utilization efficiency.

[0052] In some embodiments, step 303, calling a software-defined network controller driver and / or a container network interface plug-in and / or a software-defined network controller agent through a first interface to manage a container may be implemented through step A1, or through step A2, or through step A3, or through step A4:

[0053] Step A1: Call a container runtime interface plug-in in a local operating system of the second data processor through a first interface on the second data processor to create or delete container network resources.

[0054] Step A2: Call a software-defined network controller driver in a local operating system of the first data processor through a first interface on the first data processor to synchronize container network information to the software-defined network controller.

[0055] Step A3: Call the software-defined network controller agent in the local operating system of the second data processor through the first interface on the second data processor to monitor the number of containers on the computing node, or monitor the network device port of the container.

[0056] Here, when the software-defined network controller agent monitors the change in the number of containers on the computing node, it notifies the software-defined network controller to delete or send the relevant flow table.

[0057] Here, when the network device port of the container monitored by the software-defined network controller agent needs to be increased, the container network interface plug-in in the local operating system of the second data processor is called through the first interface mounted on the second data processor to obtain information related to the newly added port.

[0058] In the embodiment of the present application, through the linkage between the SDN Agent and the CNI plug-in, the changes in the container network (such as Pod migration, etc.) can be dynamically perceived, and the forwarding flow table can be accurately configured / deleted on the DPU of the corresponding CIE node in real time to avoid network security risks caused by the large-scale release of the forwarding flow table.

[0059] Below, taking the master node as a CIM node and the computing node as a CIE node as an example, the structure of the container management system provided by the present application in an actual application scenario will be described; the schematic structure diagram of the container management system is as follows Figure 4 shown.

[0060] like Figure 4 As shown, the container management system includes bare metal servers and SDNCs; one of the bare metal servers is a CIM node, and the other bare metal servers are CIE nodes. The bare metal server can also be a virtual machine;

[0061] Among them, DPU is installed and configured on CIM node and CIE node. CIM node is the main node of container layer, and the first DPU on CIM node is installed with SDNC Agent; at least one CNI, Kubectl, Etcd, application program interface (API) service (Server) is installed in CIM node. The first DPU is configured with the first interface, namely, virtual switch (open vswitch, OvS)-data plane development kit (Data Plan Develop Kit, DPDK), which is mounted to bare metal CIM node through virtio-net standard interface for use.

[0062] Among them, the CIE node is a container layer computing node that carries at least one Pod; Kubelet and Container Runtime Interface (CRI) Plugin are installed and configured in each CIE node. CNIPlugin and SDNC Agent are installed in the second DPU on the CIE node. The second DPU is configured with the first interface, namely OvSDPDK, which is mounted to the bare metal CIE node through the virtio-net standard interface. The container management system configures a forwarding flow table for each Pod on the corresponding CIE node.

[0063] It should be noted that before creating a bare metal container cluster based on Kubernetes, DPU should be installed and configured on all bare metal servers. DPU communicates with bare metal servers through PCI-e channels.

[0064] It should be noted that in the process of creating a bare metal container cluster based on Kubernetes, the SDNC Driver is installed in the first DPU, and the CNIPlugin and SDNC Agent are installed in the second DPU; that is, the SDNC Driver is automatically installed in the DPU of the CIM node, and the CNIPlugin and SDNC Agent are automatically installed in the DPU of the CIE node, and the CNI plug-in is no longer installed on the CIE node.

[0065] It should be noted that after creating a bare metal container cluster based on Kubernetes, the first interface is installed in each data processor, that is, the bare metal container cluster is installed, OvS-DPDK is installed in the DPU, and it is mounted to the bare metal CIM and CIE nodes through the virtio-net standard interface.

[0066] It should be noted that the CIM node is used to call the SDNC Driver in the local OS of the first DPU through the first interface on the first DPU to synchronize the container network information with the SDNC.

[0067] It should be noted that the CRI plug-in of the CIE node is used to call the CNIPlugin in the local OS of the second DPU through the first interface on the second DPU to create or delete container network resources.

[0068] It should be noted that the CIE node is also used to call the SDNC Agent in the local OS of the second DPU through the first interface on the second DPU to monitor the number of containers on the CIE node or monitor the network device port of the container.

[0069] It should be noted that SDNC is used when SDNC Agent monitors the change in the number of containers on the CIE node and receives a notification for instructing SDNC to delete or issue a related flow table.

[0070] It should be noted that the CIE node is also used when the network device port of the software-defined network controller agent monitoring container needs to be increased. Through the first interface mounted on the second DPU, the CNIPlugin in the local operating system of the second DPU is called to obtain information related to the newly added port.

[0071] Exemplarily, when a service Pod is migrated from one CIE node to another CIE node, the CNI on the CIM node calls the SDNC driver installed in the DPU local OS through the network interface mounted by the DPU, and sends a port update message to the SDNC.

[0072] When the service Pod is deleted on the source CIE node:

[0073] The CRI plug-in of Kubernetes calls the CNI plug-in installed in the local OS of the DPU through the network interface mounted by the DPU, deletes the container network resources (IP and other network information) of the Pod, and deletes the corresponding port from OvS-DPDK;

[0074] After the port of the Pod on OvS-DPDK is deleted, the SDNC Agent will observe the change and notify SDNC to delete the related forwarding flow table configuration.

[0075] After the service Pod is migrated to the destination CIE node:

[0076] The CRI plug-in of Kubernetes calls the CNI plug-in installed in the local OS of the DPU through the network interface mounted by the DPU to create container network resources and configuration for the Pod and connect to OvS-DPDK.

[0077] SDNC Agent will watch the new port added on OvS, obtain network information such as IP from CNIPlugin, and then notify SDNC to send forwarding flow table and other configurations to achieve communication between the Pod migrated from the target CIE node and the outside world.

[0078] The description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0079] It should be noted that in the embodiments of the present application, if the above-mentioned container management method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can be essentially or partly reflected in the form of a software product, which is stored in a storage medium and includes several instructions for a terminal device to execute all or part of the methods of each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM), a magnetic disk or an optical disk. In this way, the embodiments of the present application are not limited to any specific combination of hardware and software.

[0080] Based on the above embodiments, the embodiments of the present application provide an electronic device, which can implement Figure 3 In a container management method provided in a corresponding embodiment, referring to Figure 5 As shown, the electronic device 500 (electronic device 500 and Figure 2 The container management system in the embodiment corresponds to, or the electronic device 500 and Figure 4 The container management system in FIG. 5 ) includes: a processor 501, a memory 502, and a communication bus 503, wherein:

[0081] The communication bus 503 is used to implement the communication connection between the processor 501 and the memory 502 .

[0082] The processor 501 is used to execute the container management program stored in the memory 502 to implement the following steps:

[0083] In the process of creating a container cluster, a software-defined network controller driver is installed in a first data processor of a master node of the container management system, and a container network interface plug-in and a software-defined network controller agent are installed in a second data processor of a computing node of the container management system;

[0084] After the container cluster is created, a first interface is installed in each data processor;

[0085] Through the first interface, the software-defined network controller driver and / or the container network interface plug-in and / or the software-defined network controller agent are called to manage the container.

[0086] In other embodiments of the present application, the processor 501 is used to execute the container management program stored in the memory 502 to implement the following steps:

[0087] Through the first interface on the first data processor, a software defined network controller driver in the local operating system of the first data processor is called to synchronize container network information with the software defined network controller.

[0088] In other embodiments of the present application, the processor 501 is used to execute the container management program stored in the memory 502 to implement the following steps:

[0089] Through the first interface on the second data processor, a container runtime interface plug-in in the local operating system of the second data processor is called to create or delete container network resources.

[0090] In other embodiments of the present application, the processor 501 is used to execute the container management program stored in the memory 502 to implement the following steps:

[0091] Through the first interface on the second data processor, the software defined network controller agent in the local operating system of the second data processor is called to monitor the number of containers on the computing node or monitor the network device port of the container.

[0092] In other embodiments of the present application, the processor 501 is used to execute the container management program stored in the memory 502 to implement the following steps:

[0093] When the software-defined network controller agent monitors the change in the number of containers on the computing node, it notifies the software-defined network controller to delete or send the relevant flow table.

[0094] In other embodiments of the present application, the processor 501 is used to execute the container management program stored in the memory 502 to implement the following steps:

[0095] When the network device port of the container monitored by the software-defined network controller agent needs to be increased, the container network interface plug-in in the local operating system of the second data processor is called through the first interface mounted on the second data processor to obtain information related to the newly added port.

[0096] In other embodiments of the present application, the processor 501 is used to execute the container management program stored in the memory 502 to implement the following steps:

[0097] A forwarding flow table configured for each container on the corresponding compute node.

[0098] In other embodiments of the present application, the master node and the computing node are bare metal servers or virtual machines.

[0099] In other embodiments of the present application, the data processor communicates with the bare metal server through a bus and an interface standard channel.

[0100] It should be understood that the processor of the embodiment of the present application may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method embodiment can be completed by the hardware integrated logic circuit or software instructions in the processor. The above processor can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or the hardware and software modules in the decoding processor are combined and performed. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, and other mature storage media in the art. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0101] As an embodiment, the processor may include one or more general-purpose central processing units (CPUs). Each of these processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer execution instructions).

[0102] It can be understood that the memory in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a ROM, a programmable read-only memory (Programmable ROM, PROM), an erasable programmable read-only memory (Erasable PROM, EPROM), an electrically erasable programmable read-only memory (Electrically EPROM, EEPROM) or a flash memory. The volatile memory can be a random access memory (Random Access Memory, RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus random access memory (DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0103] Optionally, an embodiment of the present application further provides a computer program product, including a computer program, which can be executed by the processor 501 of the electronic device 500 to complete any of the aforementioned method steps.

[0104] The computer program product includes one or more computer instructions. When loading and executing the computer program instructions on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instruction can be stored in a computer-readable storage medium, or transmitted from a computer-readable storage medium to another computer-readable storage medium. For example, the computer instruction can be transmitted from a website site, a computer, a server, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server, or data center. The computer-readable storage medium can be any available medium that a computer can store or a data storage device such as a server, a data center, etc. that includes one or more available media integration. Available media can be magnetic media, (e.g., floppy disk, hard disk, tape), optical media (e.g., DVD), or semiconductor media (e.g., solid-state hard disk (SSD)), etc.

[0105] The embodiment of the present application provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the following. Figure 3 The implementation process of the container management method provided in the corresponding embodiment will not be repeated here.

[0106] It should be noted here that the description of the above storage medium and device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects as the method embodiments. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0107] Specific examples are used in this application to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core idea of ​​this application. At the same time, for general technical personnel in this field, according to the idea of ​​this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on this application.

[0108] It should be understood that the "one embodiment" or "an embodiment" or "an embodiment of the present application" or "the aforementioned embodiment" or "some embodiments" or "some implementation methods" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" or "an embodiment of the present application" or "the aforementioned embodiment" or "some embodiments" or "some implementation methods" appearing throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. The above-mentioned sequence numbers of the embodiments of the present application are only for description and do not represent the advantages and disadvantages of the embodiments.

[0109] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0110] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0111] In addition, all functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0112] The methods disclosed in several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0113] The features disclosed in several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0114] The features disclosed in several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0115] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks or optical disks.

[0116] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can essentially or in other words, the part that contributes to the relevant technology can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods of each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0117] It is worth noting that the drawings in the embodiments of the present application are only for illustrating the schematic positions of various components on the terminal device and do not represent the actual positions in the terminal device. The actual positions of various components or areas may be changed or offset accordingly according to actual conditions (for example, the structure of the terminal device), and the proportions of different parts of the terminal device in the drawings do not represent the actual proportions.

[0118] The above are only implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A container management system, characterized in that: The container management system includes: a software-defined network controller, a master node and a computing node; The master node is provided with a first data processor, and the first data processor is provided with a software defined network controller driver; The computing node is provided with a second data processor, wherein the second data processor is provided with a container network interface plug-in and a software defined network controller agent; The software defined network controller is respectively connected to the software defined network controller driver in the first data processor and the software defined network controller agent in the second data processor; A first interface is installed in each data processor.

2. A container management method, characterized in that: Applied to a container management system, the method comprises: In the process of creating a container cluster, a software-defined network controller driver is installed in a first data processor of a master node of the container management system, and a container network interface plug-in and a software-defined network controller agent are installed in a second data processor of a computing node of the container management system; After the container cluster is created, a first interface is installed in each data processor; The software-defined network controller driver and / or the container network interface plug-in and / or the software-defined network controller agent are called through the first interface to manage the container.

3. The method according to claim 2, characterized in that The calling of the software defined network controller driver and / or the container network interface plug-in and / or the software defined network controller agent through the first interface to manage the container includes: A software defined network controller driver in a local operating system of the first data processor is called through a first interface on the first data processor to synchronize container network information with the software defined network controller.

4. The method according to claim 2, characterized in that: The calling of the software defined network controller driver and / or the container network interface plug-in and / or the software defined network controller agent through the first interface to manage the container includes: Through the first interface on the second data processor, call the container runtime interface plug-in in the local operating system of the second data processor to create or delete container network resources.

5. The method according to claim 2, characterized in that: The calling of the software defined network controller driver and / or the container network interface plug-in and / or the software defined network controller agent through the first interface to manage the container includes: Through the first interface on the second data processor, a software-defined network controller agent in the local operating system of the second data processor is called to monitor the number of containers on the computing node, or monitor the network device port of the container.

6. The method according to claim 5, characterized in that The method further comprises: When the software-defined network controller agent monitors the change in the number of containers on the computing node, it notifies the software-defined network controller to delete or send the relevant flow table.

7. The method according to claim 5, characterized in that The method further comprises: When the network device port of the container monitored by the software-defined network controller agent needs to be increased, the container network interface plug-in in the local operating system of the second data processor is called through the first interface mounted on the second data processor to obtain information related to the newly added port.

8. The method according to claim 2, characterized in that: The method further comprises: A forwarding flow table configured for each container on the corresponding compute node.

9. The method according to claim 2, characterized in that: The master node and the computing node are bare metal servers or virtual machines.

10. The method according to claim 9, characterized in that The data processor communicates with the bare metal server through a bus and an interface standard channel.

11. An electronic device, characterized in that: The electronic device comprises: A memory for storing executable instructions; The processor is configured to implement the container management method according to any one of claims 2 to 10 when executing the executable instructions stored in the memory.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the container management method according to any one of claims 2 to 10.

13. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the container management method according to any one of claims 2 to 10.

Images