Container management system, container management method, device, storage medium, and product

Abstract

The application discloses a container management system, which comprises a software-defined network controller, a master node and a computing node, the master node is configured with a first data processor, and the computing node is configured with a second data processor, and the method comprises the following steps: in the process of creating a container cluster, installing a software-defined network controller driver in the first data processor, and installing a container network interface plug-in and a software-defined network controller agent in the second data processor; after the container cluster is created, a first interface is installed in each data processor. The application further discloses a container management method, an electronic device, a computer readable storage medium and a computer program product.

Description

Technical Field

[0001] This application relates to, but is not limited to, the field of communications, and particularly to a container management system, a container management method, an electronic device, a computer-readable storage medium, and a computer program product. Background Technology

[0002] With the continuous maturation of cloud-native technologies, container technology is being increasingly widely used in carrier data centers to provide container-based infrastructure for upper-layer services. Meanwhile, to improve the automation of data center network configuration, especially service network configuration, a Software Defined Network (SDN) solution based on overlay networks has been introduced. This organically combines the container layer and SDN, enabling automated network provisioning capabilities for containerized applications within resource pools.

[0003] However, while combining containers and SDN has enabled automated network provisioning for containerized applications in a cluster to some extent, customers can directly log in and access the Container Infrastructure Manager (CIM) and Container Infrastructure Engine (CIE) nodes to perform operations, making all software and hardware resources on the nodes visible to customers. This poses a security risk to the resources on the nodes. Summary of the Invention

[0004] This application provides a container management system, a container management method, an electronic device, a computer-readable storage medium, and a computer program product, and provides a secure interface solution for bare-metal container clusters and SDN based on Data Processing Unit (DPU) offloading.

[0005] In a first aspect, embodiments of this application provide a container management system, the container management including: a software-defined network controller, a master node, and a compute node;

[0006] The master node is configured with a first data processor, which in turn is configured with a software-defined network controller driver; the compute node is configured with a second data processor, which in turn is configured with a container network interface plugin and a software-defined network controller agent; the software-defined network controller is connected to the software-defined network controller driver in the first data processor and the software-defined network controller agent in the second data processor respectively; each data processor is equipped with a first interface.

[0007] Secondly, embodiments of this application provide a container management method applied to a container management system, the method comprising:

[0008] During the creation of the container cluster, a software-defined network controller driver is installed in the first data processor of the master node of the container management system, and a container network interface plugin and a software-defined network controller agent are installed in the second data processor of the compute node of the container management system.

[0009] After the container cluster is created, a first interface is installed in each data processor.

[0010] Thirdly, an electronic device includes:

[0011] Memory, used to store executable instructions;

[0012] The processor, when executing executable instructions stored in the memory, implements the container management method described above.

[0013] Fourthly, embodiments of this application provide a computer-readable storage medium storing one or more programs that can be executed by one or more processors to implement the container management method described above.

[0014] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the container management method described above.

[0015] This application offloads the SDNC driver in the master node, as well as the CNI plugin and SDNC Agent in the compute node, to the local OS of the DPU. The tenant OS cannot perceive the information of the SDN management network, nor can it obtain all the software and hardware resources on the node. While realizing the automated provisioning and configuration of the container network, it avoids the security risks of exposing the management plane network to customers, which exists in related solutions, and ensures the security of resources on the node, thus realizing the secure connection between the bare metal container cluster and SDN. Attached Figure Description

[0016] Figure 1 This is a schematic structural diagram of a container management system provided in related technologies;

[0017] Figure 2 This is a schematic structural block diagram of a container management system provided in an embodiment of this application;

[0018] Figure 3 This is a schematic flowchart of the container management method provided in the embodiments of this application;

[0019] Figure 4This is a schematic structural diagram of another container management system provided in an embodiment of this application;

[0020] Figure 5 This is a schematic structural diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0021] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Here, "another" or "yet another" mentioned in the description of the drawings does not refer to a specific embodiment. The various embodiments of this application can be combined with each other without conflict.

[0022] It should be understood that the phrases "embodiments of this application" or "foreign embodiments" throughout the specification mean that a specific feature, structure, or characteristic related to an embodiment is included in at least one embodiment of this application. Therefore, "embodiments of this application" or "in the foreign embodiments" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the various embodiments of this application, the sequence numbers of the above-described processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above-described embodiments are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0023] Before explaining this application, the following section describes solutions that combine containers and SDN in related technologies:

[0024] The solution combining containers and SDN is applicable not only to virtual machine container scenarios but also to bare metal container scenarios. Figure 1 This is a schematic diagram of a solution combining containers and SDN, provided by related technologies, suitable for bare-metal container scenarios.

[0025] like Figure 1 As shown, the relevant solutions include a Software Defined Network Controller (SDNC), a Virtualized Infrastructure Manager (VIM), a Compute Module Controller (CIM), and a Compute Module Controller (CIE). VIM is the virtualization layer control and management node; CIM is the container layer control node, such as a Kubernetes Master Node; CIE is the container layer compute node, the node that hosts Pods, such as a Kubernetes Worker Node; and SDNC, along with its SDNC Driver and SDNC Agent, enables automated configuration of the business network.

[0026] Specifically, a bare metal container cluster based on Kubernetes is created (the bare metal nodes of the container cluster are distributed through the Ironic service provided by VIM), and CIE nodes are deployed on bare metal servers. CIM nodes can be deployed as virtual machines (Hypervisors) or in bare metal form.

[0027] Each CIE node has a Container Network Interface (CNI) plugin installed. This plugin is used to assign IP addresses to containers, configure network routing, network isolation, and security policies, enabling communication between containers within the node and between containers within the node and the external network.

[0028] The CIM node installs CNI, Kubectl, and Etcd; Etcd is an open-source distributed key-value store system used to automate the deployment, scaling, and operation of containers.

[0029] The SDNC driver from Neutron, which provides virtual network services, is installed in the VIM nodes. SDNC communicates with CIM northbound via the SDNC driver. The SDNC agent software is installed in each CIE node, and SDNC communicates with CIE nodes southbound via the SDNCAgent. The VIM nodes also include Nova and Cinder; Nov provides computing services and is responsible for managing the lifecycle of compute instances, including creation, scheduling, and recycling. Cinder provides block storage resources for compute instances and interfaces with the backend block storage resources.

[0030] It should be noted that the solution combining containers and SDN cannot precisely enable or disable the forwarding flow table on the corresponding CIE node for each container application. Instead, it enables all traffic in one or more segments of the network on a cluster-by-cluster basis, which poses a network security risk.

[0031] Meanwhile, in practical applications, bare-metal container clusters offer various service models. One common model involves customers renting the entire bare-metal CIM and CIE nodes. This means customers can directly log in and access the CIM and CIE nodes to perform operations (e.g., deploying bare-metal container applications). In this case, all hardware and software resources on the bare-metal nodes are visible to the customer, including the CNI plugin and SDNC Agent installed on the CIE node, posing a potential resource security risk.

[0032] The SDNC in the resource pool communicates with the SDNC Agent on the CIE node through the southbound interface. The interconnection network between them belongs to the management plane network of the resource pool and should not be exposed to customers. However, under the current scheme, customers can intrude into the management plane network through the SDN Agent installed on the CIE node to communicate with the SDNC, and then intrude and attack the SDNC or other management plane components in the resource pool through the management network, which brings serious security risks to the entire resource pool.

[0033] Figure 2 This application provides a schematic diagram of the structure of a container management system, which includes: SDNC, a master node, and compute nodes; the master node is configured with a first data processing unit (DPU), and the first DPU is configured with an SDNC driver; the compute nodes are configured with a second DPU, and the second DPU is configured with a CNIPlugin and an SDNC agent; the SDNC is connected to the SDNC driver in the first DPU and the SDNC agent in the second DPU respectively; each DPU is equipped with a first interface, that is, the first DPU is equipped with a first interface and the second DPU is equipped with a first interface.

[0034] It should be noted that the first interface is configured to call the SDNC Driver and / or, CNIPlugin and / or, SDNC Agent, to manage the container.

[0035] Figure 3 This application provides a flowchart illustrating a container management method, as shown in the embodiments below. Figure 3 The method shown is applied to Figure 2 The container management system shown includes the following method:

[0036] Step 301: During the creation of the container cluster, install the software-defined network controller driver in the first data processor of the master node of the container management system, and install the container network interface plugin and the software-defined network controller agent in the second data processor of the compute node of the container management system.

[0037] In this embodiment of the application, the master node can be a CIM node, which is the control node of the container layer. During the creation of the bare metal container cluster, for the CIM node, the SDNC driver is automatically unloaded onto the local operating system (OS) of the DPU configured on the master node.

[0038] In this embodiment, the compute node can be a CIE node, i.e., a compute node at the container layer. During the creation of the bare metal container cluster, for the CIE node, the CNI and SDNC Agent are automatically offloaded to the local OS of the DPU configured on the compute node. That is, when creating a bare metal container cluster, the SDNC driver is automatically installed in the DPU of the master node, and the CNI plugin and SDNC Agent are automatically installed in the DPU of the compute nodes. At the same time, the CNI plugin is no longer installed on the compute nodes.

[0039] In this embodiment, when the CNI on the master node synchronizes container network information to the SDNC, it only needs to call the SDNC driver installed in the local OS of the DPU through the network interface mounted on the DPU, without directly interfacing with the SDNC.

[0040] In this embodiment, the Container Runtime Interface (CRI) plugin on the compute node calls the CNI plugin installed in the DPU's local OS through the network interface mounted on the DPU to complete the creation or deletion of container network resources. The SDNC Agent continuously monitors the changes in network devices (ports) (adding or deleting ports). When a new port is added, it needs to obtain network information such as IP address from the CNI plugin.

[0041] In this embodiment of the application, the master node and compute node or virtual machine are in the virtual machine container scenario.

[0042] In this embodiment of the application, the master node and compute node in the bare metal container scenario are bare metal servers.

[0043] In this embodiment, the first data processor communicates with the bare metal server via a Peripheral Component Interface Express (PCI-e) channel. The second data processor also communicates with the bare metal server via a PCI-e channel; that is, before the container cluster is created, the DPU is installed and configured on all bare metal servers, and the DPU communicates with the bare metal server via the PCI-e channel.

[0044] Step 302: After the container cluster is created, a first interface is installed in each data processor.

[0045] In this embodiment of the application, after the bare metal container cluster is installed, the first interface is installed in the first DPU and the second DPU, and is attached to the bare metal master node, namely the CIM node and the compute node, namely the CIE node, through the standard interface.

[0046] Step 303: Through the first interface, call the software-defined network controller driver and / or the container network interface plugin and / or the software-defined network controller agent to manage the container.

[0047] In some embodiments, a forwarding flow table is configured for each container on the corresponding compute node.

[0048] This application proposes an enhanced technical solution based on DPU hardware offloading to achieve physical isolation between the customer tenant network and the resource pool management network (the network for communication between SDNC and SDNC Agent), thus avoiding the security risks of exposing the resource pool management plane network to the customer. Simultaneously, it supports configuring precise forwarding flow tables for each container application on the corresponding compute node.

[0049] In this embodiment of the application, managing the container includes managing files in the container, managing the lifecycle of container services, and managing the resource pool in the container.

[0050] This application discloses a container management method applied to a container management system. The method includes: during the creation of a container cluster, installing a software-defined network controller (SDN) driver in the first data processor of the master node of the container management system, and installing a container network interface (CNI) plugin and a SDN agent in the second data processor of the compute node of the container management system; after the container cluster is created, installing a first interface in each data processor; and managing containers by calling the SDN driver and / or the CNI plugin and / or the SDN agent through the first interface. In other words, this application offloads the SDN driver in the master node, and the CNI plugin and SDN agent in the compute node, to the local OS of the DPU. The tenant OS cannot perceive the SDN management network information, nor can it access all the software and hardware resources on the node. While achieving automated container network provisioning and configuration, it avoids the security risks of exposing the management plane network to customers, ensuring the security of resources on the node, and realizing secure integration between the bare-metal container cluster and SDN.

[0051] This application offloads the SDNC driver, SDNC Agent, and CNI plugin to the DPU hardware, reducing the management plane software's occupation of bare metal resources, releasing more computing resources to tenants, and improving resource utilization efficiency.

[0052] In some embodiments, step 303, which involves calling the software-defined network controller driver and / or the container network interface plugin and / or the software-defined network controller agent through the first interface to manage the container, can be implemented through step A1, or through step A2, or through step A3, or through step A4.

[0053] Step A1: Through the first interface on the second data processor, call the container runtime interface plugin in the local operating system of the second data processor to create or delete container network resources.

[0054] Step A2: Through the first interface on the first data processor, call the software-defined network controller driver in the local operating system of the first data processor to synchronize container network information with the software-defined network controller.

[0055] Step A3: Through the first interface on the second data processor, call the software-defined network controller agent in the local operating system of the second data processor to monitor the number of containers on the compute node, or monitor the network device port of the container.

[0056] Here, when the software-defined network controller agent monitors changes in the number of containers on the compute node, it notifies the software-defined network controller to delete or distribute the relevant flow tables.

[0057] Here, when the software-defined network controller agent needs to add network device ports for the container, it calls the container network interface plugin in the local operating system of the second data processor through the first interface mounted on the second data processor to obtain information related to the new port.

[0058] In this embodiment, by linking the SDN Agent with the CNI plugin, changes in the container network (such as Pod migration) can be dynamically detected, and forwarding flow tables can be precisely configured / deleted on the DPU of the corresponding CIE node in real time, avoiding network security risks caused by allowing forwarding flow tables to be opened on a large scale.

[0059] The following example, using CIM nodes as the master node and CIE nodes as the compute nodes, illustrates the structure of the container management system provided in this application in a practical application scenario; a schematic structural diagram of the container management system is shown below. Figure 4 As shown.

[0060] like Figure 4 As shown, the container management system includes bare metal servers and SDNC; one bare metal server is a CIM node, and the others are CIE nodes. The bare metal server can also be a virtual machine.

[0061] DPUs are installed and configured on both the CIM and CIE nodes. The CIM node is the master node of the container layer, and the first DPU on the CIM node installs the SDNC Agent. At least one CNI, Kubectl, Etcd, and Application Programming Interface (API) service (Server) are installed on the CIM node. The first DPU is configured with the first interface, namely the Open VVS (OvS) Data Plane Development Kit (DPDK), which is mounted to the bare metal CIM node through the virtio-net standard interface.

[0062] The CIE node is a container layer compute node, hosting at least one Pod. Each CIE node has a Kubelet and a Container Runtime Interface (CRI) plugin installed and configured. The second DPU on the CIE node has a CNIP plugin and an SDNC agent installed. The second DPU is configured with the first interface, OvSDPDK, which is mounted to the bare-metal CIE node via the virtio-net standard interface. The container management system configures a forwarding flow table for each Pod on its corresponding CIE node.

[0063] It should be noted that before creating a Kubernetes-based bare metal container cluster, DPUs are installed and configured on all bare metal servers. The DPUs communicate with the bare metal servers via PCI-e channels.

[0064] It should be noted that during the creation of a bare metal container cluster based on Kubernetes, the SDNC Driver is installed in the first DPU, and the CNIPlugin and SDNC Agent are installed in the second DPU; that is, the SDNC Driver is automatically installed in the DPU of the CIM node, and the CNIPlugin and SDNC Agent are automatically installed in the DPU of the CIE node, while the CNI plugin is no longer installed on the CIE node.

[0065] It should be noted that after creating a bare metal container cluster based on Kubernetes, the first interface is installed in each data processor, which means the bare metal container cluster is installed. OvS-DPDK is installed in the DPU and is mounted to the bare metal CIM and CIE nodes through the virtio-net standard interface.

[0066] It should be noted that the CIM node is used to call the SDNC Driver in the local OS of the first DPU through the first interface on the first DPU to synchronize container network information with SDNC.

[0067] It should be noted that the CRI plugin of the CIE node is used to call the CNIPlugin in the local OS of the second DPU through the first interface on the second DPU to create or delete container network resources.

[0068] It should be noted that the CIE node is also used to call the SDNC Agent in the local OS of the second DPU through the first interface on the second DPU to monitor the number of containers on the CIE node or to monitor the network device ports of the containers.

[0069] It should be noted that SDNC is used when the SDNC Agent monitors changes in the number of containers on the CIE node and receives a notification instructing SDNC to delete or distribute relevant flow tables.

[0070] It should be noted that the CIE node is also used when the software-defined network controller agent needs to add network device ports to the container. It calls the CNIPlugin in the local operating system of the second DPU through the first interface mounted on the second DPU to obtain information related to the new port.

[0071] For example, when a business Pod migrates from one CIE node to another, the CNI on the CIM node calls the SDNC driver installed in the DPU's local OS through the network interface mounted on the DPU to send a port-update message to the SDNC.

[0072] When a business Pod is deleted from the source CIE node:

[0073] The Kubernetes CRI plugin calls the CNI plugin installed in the DPU's local OS through the network interface mounted by the DPU to delete the Pod's container network resources (IP and other network information) and remove the corresponding port from OvS-DPDK.

[0074] Once the port of a Pod on OvS-DPDK is deleted, the SDNC Agent will watch for the change and notify SDNC to delete the relevant forwarding flow table configuration.

[0075] After the business Pod is migrated to the destination CIE node:

[0076] The Kubernetes CRI plugin calls the CNI plugin installed in the DPU's local OS through the network interface mounted on the DPU to create container network resources and configurations for the Pod and connect to OvS-DPDK.

[0077] The SDNC Agent will watch for the addition of a new port on OvS and obtain network information such as IP from CNIPlugin. Then, it will notify SDNC to issue configurations such as forwarding flow tables to enable communication between the Pods migrated from the target CIE node and the outside world.

[0078] The descriptions of the above device embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0079] It should be noted that, in the embodiments of this application, if the above-described container management method is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the related technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a terminal device to execute all or part of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, mobile hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0080] Based on the foregoing embodiments, embodiments of this application provide an electronic device that can implement... Figure 3 In a corresponding embodiment of a container management method, referring to Figure 5 As shown, the electronic device 500 (electronic device 500 and...) Figure 2 The corresponding container management system, or electronic device 500 and Figure 4 The container management system (corresponding to this) includes: processor 501, memory 502, and communication bus 503, wherein:

[0081] The communication bus 503 is used to realize the communication connection between the processor 501 and the memory 502.

[0082] Processor 501 is used to execute the container management program stored in memory 502 to perform the following steps:

[0083] During the creation of the container cluster, the software-defined network controller driver is installed in the first data processor of the master node of the container management system, and the container network interface plugin and the software-defined network controller agent are installed in the second data processor of the compute node of the container management system.

[0084] After the container cluster is created, a first interface is installed in each data processor;

[0085] Through the first interface, the software-defined network controller driver and / or the container network interface plugin and / or the software-defined network controller agent are invoked to manage the container.

[0086] In other embodiments of this application, processor 501 is used to execute a container management program stored in memory 502 to perform the following steps:

[0087] The container network information is synchronized to the software-defined network controller by calling the software-defined network controller driver in the local operating system of the first data processor through the first interface on the first data processor.

[0088] In other embodiments of this application, processor 501 is used to execute a container management program stored in memory 502 to perform the following steps:

[0089] By using the first interface on the second data processor, the container runtime interface plugin in the local operating system of the second data processor is invoked to create or delete container network resources.

[0090] In other embodiments of this application, processor 501 is used to execute a container management program stored in memory 502 to perform the following steps:

[0091] The software-defined network controller agent in the local operating system of the second data processor is invoked through the first interface on the second data processor to monitor the number of containers on the compute node or to monitor the network device ports of the containers.

[0092] In other embodiments of this application, processor 501 is used to execute a container management program stored in memory 502 to perform the following steps:

[0093] When the software-defined network controller agent monitors changes in the number of containers on compute nodes, it notifies the software-defined network controller to delete or distribute the relevant flow tables.

[0094] In other embodiments of this application, processor 501 is used to execute a container management program stored in memory 502 to perform the following steps:

[0095] When the software-defined network controller agent needs to add network device ports for a container, it calls the container network interface plugin in the local operating system of the second data processor through the first interface mounted on the second data processor to obtain information related to the new port.

[0096] In other embodiments of this application, processor 501 is used to execute a container management program stored in memory 502 to perform the following steps:

[0097] Forwarding flow table configured for each container on the corresponding compute node.

[0098] In other embodiments of this application, the master node and the compute node are bare metal servers or virtual machines.

[0099] In other embodiments of this application, the data processor communicates with the bare metal server via a bus and interface standard channels.

[0100] It should be understood that the processor in the embodiments of this application may be an integrated circuit chip with signal processing capabilities. In implementation, the steps of the above method embodiments can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor described above can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0101] As one embodiment, the processor may include one or more general-purpose central processing units (CPUs). Each of these processors may be a single-core processor or a multi-core processor. Here, "processor" may refer to one or more devices, circuits, and / or processing cores used for processing data (e.g., executing instructions).

[0102] It is understood that the memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be ROM, Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), or flash memory. The volatile memory can be Random Access Memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DR RAM). It should be noted that the memory used in the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0103] Optionally, embodiments of this application also provide a computer program product, including a computer program that can be executed by the processor 501 of the electronic device 500 to perform any of the aforementioned method steps.

[0104] A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

[0105] Embodiments of this application provide a computer-readable storage medium storing one or more programs that can be executed by one or more processors to perform, as follows: Figure 3 The implementation process of the container management method provided in the corresponding embodiment will not be described in detail here.

[0106] It should be noted that the descriptions of the storage medium and device embodiments above are similar to the descriptions of the method embodiments above, and have similar beneficial effects. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0107] This application uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

[0108] It should be understood that the terms "an embodiment," "an embodiment," "an embodiment of this application," "the foregoing embodiment," "some embodiments," or "some implementations" mentioned throughout the specification mean that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of this application. Therefore, the phrases "an embodiment," "an embodiment," "an embodiment of this application," "the foregoing embodiment," "some embodiments," or "some implementations" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above embodiments of this application are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0109] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0110] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0111] In addition, each functional unit in the various embodiments of this application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0112] The methods disclosed in the several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0113] The features disclosed in the several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0114] The features disclosed in the several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method or device embodiments.

[0115] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0116] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0117] It is worth noting that the accompanying drawings in this application are only for illustrating the schematic positions of various devices on the terminal device and do not represent their actual positions in the terminal device. The actual positions of each device or area may be changed or shifted according to the actual situation (e.g., the structure of the terminal device). Furthermore, the proportions of different parts in the terminal device in the drawings do not represent the actual proportions.

[0118] The above are merely embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A container management system, characterized in that, The container management system includes: a software-defined network controller, a master node, and compute nodes; The master node is configured with a first data processor, and the first data processor's local operating system (OS) is configured with a software-defined network controller driver. The computing node is configured with a second data processor, and the local OS of the second data processor is configured with a container network interface plugin and a software-defined network controller agent. The software-defined network controller is connected to the software-defined network controller driver in the first data processor and the software-defined network controller agent in the second data processor. Each data processor is equipped with a first interface; the first interface is used to call the software-defined network controller driver and / or the container network interface plugin and / or the software-defined network controller agent to manage containers; the management of containers includes managing files in containers, managing the lifecycle of container services, and managing resource pools in containers.

2. A container management method, characterized in that, Applied to a container management system, the method includes: During the creation of the container cluster, a software-defined network controller driver is installed in the local operating system (OS) of the first data processor on the master node of the container management system, and a container network interface plugin and a software-defined network controller agent are installed in the local OS of the second data processor on the compute node of the container management system. After the container cluster is created, a first interface is installed in each data processor; Through the first interface, the software-defined network controller driver and / or the container network interface plugin and / or the software-defined network controller agent are invoked to manage containers; the management of containers includes managing files in containers, managing the lifecycle of container services, and managing resource pools in containers.

3. The method according to claim 2, characterized in that, The step of managing containers by calling the software-defined network controller driver and / or the container network interface plugin and / or the software-defined network controller agent through the first interface includes: The container network information is synchronized to the software-defined network controller by calling the software-defined network controller driver in the local operating system of the first data processor through the first interface on the first data processor.

4. The method according to claim 2, characterized in that, The step of managing containers by calling the software-defined network controller driver and / or the container network interface plugin and / or the software-defined network controller agent through the first interface includes: By using the first interface on the second data processor, the container runtime interface plugin in the local operating system of the second data processor is invoked to create or delete container network resources.

5. The method according to claim 2, characterized in that, The step of managing containers by calling the software-defined network controller driver and / or the container network interface plugin and / or the software-defined network controller agent through the first interface includes: The software-defined network controller agent in the local operating system of the second data processor is invoked through the first interface on the second data processor to monitor the number of containers on the compute node or to monitor the network device ports of the containers.

6. The method according to claim 5, characterized in that, The method further includes: When the software-defined network controller agent monitors changes in the number of containers on compute nodes, it notifies the software-defined network controller to delete or distribute the relevant flow tables.

7. The method according to claim 5, characterized in that, The method further includes: When the software-defined network controller agent needs to add network device ports for the container, it calls the container network interface plugin in the local operating system of the second data processor through the first interface mounted on the second data processor to obtain information related to the new port.

8. The method according to claim 2, characterized in that, The method further includes: Forwarding flow table configured for each container on the corresponding compute node.

9. The method according to claim 2, characterized in that, The master node and the compute node are bare metal servers or virtual machines.

10. The method according to claim 9, characterized in that, The data processor communicates with the bare metal server via a bus and interface standard channels.

11. An electronic device, characterized in that, The electronic device includes: Memory, used to store executable instructions; A processor, when executing executable instructions stored in the memory, implements the container management method according to any one of claims 2 to 10.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more programs that can be executed by one or more processors to implement the container management method as described in any one of claims 2 to 10.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the container management method according to any one of claims 2 to 10.

Images