Access relationship acquisition method and device, server and storage medium

Abstract

The invention discloses an access relation obtaining method and device, a server and a storage medium, and the access relation obtaining method comprises the steps: obtaining node access flow information reported by a target virtual machine node in a hyper-converged hci cluster, and taking the node access flow information as first access flow information; obtaining access flow information of pod in the k8s cluster node reported by the k8s cluster node as second access flow information; aggregating the first access flow information and the second access flow information to obtain an aggregation result; and determining an end-to-end access relationship of the pod in the k8s cluster node according to an aggregation result. According to the method, the first access flow information reported by the virtual machine node and the access flow information reported by the k8s cluster node are aggregated to obtain the pod end-to-end access relationship in the k8s cluster node, and the access flow information reported by the virtual machine node is aggregated by establishing the pod end-to-end access relationship in the k8s cluster node, so that the access flow information of the virtual machine node is obtained. And the interference caused by the access flow information reported by the virtual machine node is avoided.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and more specifically, to a method, device, server and storage medium for obtaining an access relationship. Background Art

[0002] In the related technology, application software (Kubernetes, k8s) cluster nodes are deployed in virtual machine nodes. The hyper-converged infrastructure (HCI) cluster provides virtual machine nodes as the working nodes (nodes) required by the k8s cluster nodes, and the k8s cluster nodes are deployed in the node nodes. The virtual machine nodes communicate with each other using virtual networks. The hci cluster not only uses the k8s cluster nodes to collect the access flow information of the pods in the k8s cluster nodes, but also uses the virtual machine nodes to collect the access flow information through the virtual network, and the access flow relationship collected by the virtual machine nodes will interfere with the determination of the access relationship of the pods in the k8s cluster nodes. Summary of the invention

[0003] In view of the above problems, the present application proposes a method, device, server and storage medium for obtaining access relations.

[0004] In a first aspect, an embodiment of the present application provides a method for obtaining an access relationship, the method comprising: obtaining node access flow information reported by a target virtual machine node in a hyper-converged HCI cluster as first access flow information, the first access flow information including access flow information generated through a virtual network when a scheduling unit pod in a k8s cluster node of an application software in the hci cluster is accessed, the target virtual machine node is other virtual machine nodes in the hci cluster except the k8s cluster node, and the virtual network is a network for communication between all virtual machine nodes in the hci cluster; obtaining access flow information of a pod in the k8s cluster node reported by the k8s cluster node as second access flow information; aggregating the first access flow information and the second access flow information to obtain an aggregation result; determining an end-to-end access relationship of the pod in the k8s cluster node according to the aggregation result, the end-to-end access relationship including at least one of an access relationship between the pod and a public network, between the pod and pods in other k8s cluster nodes in the hci cluster, and between the pod and other virtual machine nodes in the hci cluster.

[0005] In a second aspect, an embodiment of the present application provides an access relationship acquisition device, the device comprising: a first access flow information acquisition module, used to obtain node access flow information reported by a target virtual machine node in a hyper-converged HCI cluster, as the first access flow information, the first access flow information includes the access flow information generated through the virtual network when the scheduling unit pod in the application software K8S cluster node in the HCI cluster accesses, the target virtual machine node is the other virtual machine node in the HCI cluster except the K8S cluster node, and the virtual network is the network for all virtual machine nodes in the HCI cluster to communicate; a second access flow information acquisition module , used to obtain the access flow information of the pod in the k8s cluster node reported by the k8s cluster node as the second access flow information; an aggregation result acquisition module, used to aggregate the first access flow information and the second access flow information to obtain an aggregation result; an access relationship determination module, used to determine the end-to-end access relationship of the pod in the k8s cluster node according to the aggregation result, the end-to-end access relationship including at least one of the access relationship between the pod and the public network, the pod and pods in other k8s cluster nodes in the hci cluster, and the pod and other virtual machine nodes in the hci cluster.

[0006] In a third aspect, an embodiment of the present application provides a server, comprising: one or more processors; a memory; one or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the method for obtaining the access relationship provided in the first aspect above.

[0007] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a program code is stored. The program code can be called by a processor to execute the method for obtaining the access relationship provided in the first aspect.

[0008] The solution provided in the present application aggregates the first access flow information reported by the virtual machine node and the access flow information reported by the k8s cluster node to establish an association relationship between the virtual machine node and the k8s cluster node, and obtains the end-to-end access relationship of the pod in the k8s cluster node. By establishing the end-to-end access relationship of the pod in the k8s cluster node, the access flow information reported by the virtual machine node is aggregated, thereby avoiding the interference caused by the access flow information reported by the virtual machine node. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0010] Figure 1 A schematic diagram of access flow information in an HCI cluster in the related technology is shown.

[0011] Figure 2 A schematic diagram of a flow chart of a method for obtaining access relations provided in an embodiment of the present application is shown.

[0012] Figure 3 A flowchart of a method for obtaining access relations provided in another embodiment of the present application is shown.

[0013] Figure 4 A flowchart of a method for obtaining access relations provided in yet another embodiment of the present application is shown.

[0014] Figure 5 A schematic diagram of an application scenario provided by an embodiment of the present application is shown.

[0015] Figure 6 A structural block diagram of an access relationship acquisition device provided in an embodiment of the present application is shown.

[0016] Figure 7 A structural block diagram of a server provided in an embodiment of the present application for executing a method for acquiring an access relationship according to an embodiment of the present application is shown.

[0017] Figure 8 A storage medium provided by an embodiment of the present application and used to store or carry program codes for implementing a method for acquiring access relations according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0018] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0019] In the related technology, the access flow information within the k8s cluster node includes not only the access flow information between pods within the cluster node, but also the access flow information of pods accessing outside the k8s cluster node and outside the k8s cluster node accessing inside the k8s cluster node. For example, the access flow information of pods accessing virtual machine nodes within the hci cluster outside the k8s cluster node, the access flow information of pods accessing the public network outside the hci cluster, or the access flow information of virtual machine nodes within the hci cluster outside the k8s cluster node accessing pods within the k8s cluster node.

[0020] See also Figure 1 , Figure 1 A schematic diagram of access flow information in an HCI cluster in the related art is shown. Figure 1 In the example, the Internet Protocol address (IP) of pod1 is ip1, the ip of node A in the k8s cluster is NodeIP1, the ip of node B in the k8s cluster is NodeIP2 or the external ip corresponding to pod2 is NodeIP2, because access from outside the cluster to the cluster is obtained through the node listening port (nodeport) or the external ip of the load balancer (LB), the ip of virtual machine 1 is VMIP, and the public network ip is IP2.

[0021] In the access relationship 1 corresponding to pod1 accessing the public network, the message sent by pod1 is ip1 to IP2, which becomes NodeIP1 to IP2 when it is sent to node A of k8s cluster. The access flow information reported by node A of k8s cluster is pod1 accessing the public network. When the traffic passes through the virtual network, it becomes NodeIP1 to IP2, and the virtual machine node reports the access relationship of NodeIP1 to IP2. From this point of view, the access relationship reported by the virtual machine node is redundant, and the final end-to-end access relationship should be ip1 to IP2.

[0022] Access relationship 2 is the same as access relationship 1. When pod1 accesses virtual machine 1, the message sent by pod1 is from ip1 to VMIP. When it is sent to node A of k8s cluster, it becomes NodeIP1 to VMIP. The access flow information reported by node A of k8s cluster is pod1 accessing virtual machine 1. When the traffic passes through the virtual network, it is from NodeIP1 to VMIP. The virtual machine node reports the access relationship from NodeIP1 to VMIP. After the virtual machine node reports, it will cause access interference, resulting in an additional access relationship.

[0023] In the access relationship 3 corresponding to pod1 accessing pod2, NodeIP1 of k8s cluster A node will generate an access relationship from ip1 to NodeIP2, and an access relationship from NodeIP1 to NodeIP2 will be generated in the virtual network. An access relationship from NodeIP1 to pod2 will be generated on k8s cluster B node, and the service accessing NodeIP2 will be converted to accessing pod2. In this case, three access relationships will be displayed, and none of the three access relationships is end-to-end (pod1 to pod2). In access relationships 1 to 3, not only will the k8s cluster node report the access flow information, but the virtual machine node will also report the access flow information through the virtual network. The access flow information reported by the virtual machine node will interfere with the access flow information of the pod in the k8s cluster node.

[0024] Moreover, since the access flow information reported by the virtual machine node and the access flow information reported by the k8s cluster node are two independent access flow information, when a pod fails, it is necessary not only to troubleshoot the access flow information reported by the virtual machine node, but also to troubleshoot the access flow information reported by the k8s cluster node. Too much access flow information will affect the speed of fault determination.

[0025] In response to the problems in the background technology, the inventors proposed the access relationship acquisition method, device, server and storage medium provided in the embodiments of the present application. The first access flow information reported by the virtual machine node and the access flow information reported by the k8s cluster node are aggregated to establish the association relationship between the virtual machine node and the k8s cluster node, and the end-to-end access relationship of the pod in the k8s cluster node is obtained. By establishing the end-to-end access relationship of the pod in the k8s cluster node, the access flow information reported by the virtual machine node is aggregated, and the interference caused by the access flow information reported by the virtual machine node is avoided. Moreover, when a pod fails, there is no need to troubleshoot the access flow information reported by the virtual machine node and the access flow information reported by the k8s cluster node, which improves the efficiency of troubleshooting.

[0026] The following will describe in detail the access relationship acquisition method, device, server and storage medium provided in the embodiments of the present application in conjunction with the accompanying drawings.

[0027] See also Figure 1 , Figure 1 The flowchart of the method for obtaining access relations provided in the embodiment of the present application is shown. The method for obtaining access relations can be applied to Figure 6 The access relationship acquisition device 300 and the server 100 ( Figure 7 ).

[0028] The method for obtaining the access relationship may specifically include the following steps:

[0029] Step S110: Obtain node access flow information reported by the target virtual machine node in the hyper-converged HCI cluster as the first access flow information, wherein the first access flow information includes the access flow information generated through the virtual network when the scheduling unit pod in the application software k8s cluster node in the HCI cluster accesses, the target virtual machine node is the other virtual machine node in the HCI cluster except the k8s cluster node, and the virtual network is the network for communication among all virtual machine nodes in the HCI cluster.

[0030] Among them, the hyper-converged HCI cluster refers to the virtual computer system under the hyper-converged infrastructure (HCI). The HCI cluster combines multiple servers into a cluster with a unified storage pool across nodes to obtain the performance, capacity scalability and data availability required by the entire virtualization environment. The computing performance and storage space of the entire HCI cluster can be expanded by increasing the number of nodes in the cluster.

[0031] Application software k8s cluster refers to Kubernetes cluster, which is an open source system for automating the deployment, expansion and management of containerized applications. k8s cluster nodes are working nodes in the k8s cluster. In the k8s cluster nodes, there are multiple scheduling units pods. Pod is the smallest unit of the application in the k8s cluster node. Pod is a collection of one or more containers. Logically, pod can be regarded as a virtual machine.

[0032] In an embodiment of the present application, a virtual machine node is provided by an hci cluster as a node required by a k8s cluster, and a k8s cluster is deployed in the virtual machine node as a k8s cluster node of the k8s cluster. In addition to multiple k8s cluster nodes, an hci cluster also has multiple virtual machines to perform virtual machine work. The communication between the k8s cluster node and the virtual machine node in the hci cluster is a virtual network. When access is made between the pods of the k8s cluster nodes in the hci cluster, between the pods of the k8s cluster nodes and the virtual machine nodes, and between the pods of the k8s cluster nodes and the public network, all of them will pass through the virtual network, and the access flow information of the virtual network will be collected and reported by the virtual machine node.

[0033] In some implementations, the access flow information of accessing the virtual network is collected by the exporter of the virtual machine node and reported by the virtual machine node.

[0034] Step S120: Obtain the access flow information of the pod in the k8s cluster node reported by the k8s cluster node as the second access flow information.

[0035] In the present embodiment, the k8s cluster node includes one or more pods. When an access relationship is generated between the pods within the k8s cluster node, between the pods of different k8s cluster nodes, between the pods of the k8s cluster node and the virtual machine node, and between the pods of the k8s cluster node and the public network, the k8s cluster node will collect and report the access flow information of the pod.

[0036] In some implementations, the exporter of the k8s cluster node collects the access flow information of all pods in the k8s cluster node, and the exporter reports the access flow information.

[0037] Step S130: Aggregate the first access flow information and the second access flow information to obtain an aggregation result.

[0038] The aggregation method may be to extract the first access flow information and the second access flow information to obtain an aggregation result. The aggregation method may also be to integrate the first access flow information and the second access flow information to obtain an aggregation result. The aggregation method may also be to aggregate the first access flow information and the second access flow information for the relevant information of a certain pod to obtain an aggregation result. The aggregation method may be determined according to actual needs and is not specifically limited here.

[0039] In the embodiment of the present application, the first access flow information and the second access flow information are aggregated according to an aggregation method to obtain an aggregation result.

[0040] Step S140: Based on the aggregation result, determine the end-to-end access relationship of the pod in the k8s cluster node, and the end-to-end access relationship includes at least one of the access relationship between the pod and the public network, the pod and pods in other k8s cluster nodes in the hci cluster, and the pod and other virtual machine nodes in the hci cluster.

[0041] In an embodiment of the present application, according to the aggregation result, the source address and the destination address of the access relationship in the aggregation result are determined, and then an end-to-end access relationship of the pod in the k8s cluster node is established. The end-to-end access relationship can be between the pod and the public network, or between the pod and other k8s cluster nodes in the hci cluster, or between the pod and other virtual machine nodes in the hci cluster, or between the pod and the public network, the pod and other k8s cluster nodes in the hci cluster, and the pod and other virtual machine nodes in the hci cluster. At least one of the access relationships, the end-to-end access relationship is not specifically limited here.

[0042] Exemplarily, the pods in the k8s cluster node include pod1 and pod2, and the address corresponding to pod1 is podip1, and the address corresponding to pod2 is podip2. It is known that the public network address is pupip1, and the address corresponding to the virtual machine node is vmip1. The aggregation results include the aggregation results between podip1 and podip2, the aggregation results between podip1 and pupip1, and the aggregation results between podip2 and vmip1. In this way, the end-to-end access relationship between pod1 and pod2, the access relationship between pod1 and the public network, and the access relationship between pod2 and the virtual machine node are determined.

[0043] The solution provided in this embodiment aggregates the first access flow information reported by the virtual machine node and the access flow information reported by the k8s cluster node to establish an association relationship between the virtual machine node and the k8s cluster node, and obtains the end-to-end access relationship of the pod in the k8s cluster node. By establishing the end-to-end access relationship of the pod in the k8s cluster node, the access flow information reported by the virtual machine node is aggregated, and the interference caused by the access flow information reported by the virtual machine node is avoided. Moreover, when a pod fails, there is no need to troubleshoot the access flow information reported by the virtual machine node and the access flow information reported by the k8s cluster node, thereby improving the efficiency of troubleshooting.

[0044] The hci cluster includes a first pod in a first k8s cluster node and a second pod in a second k8s cluster node. Figure 3 , Figure 3 A flowchart of a method for obtaining access relations provided in another embodiment of the present application is shown.

[0045] Step S210: Obtain node access flow information reported by the target virtual machine node in the hyper-converged HCI cluster as the first access flow information, wherein the first access flow information includes the access flow information generated through the virtual network when the scheduling unit pod in the application software k8s cluster node in the HCI cluster accesses, the target virtual machine node is the other virtual machine node in the HCI cluster except the k8s cluster node, and the virtual network is the network for communication among all virtual machine nodes in the HCI cluster.

[0046] For step S210 , please refer to the detailed description of step S110 in the aforementioned embodiment, which will not be repeated here.

[0047] Step S220: Obtain the access flow information of the pod in the k8s cluster node reported by the k8s cluster node as the second access flow information.

[0048] In some implementations, before obtaining the access flow information of the pod in the k8s cluster node reported by the k8s cluster node as the second access flow information, it also includes: obtaining the five-tuple information corresponding to the first pod from the access flow information of the first pod through the k8s cluster node. If the five-tuple information indicates that the source address and / or destination address of the first pod is a converted address, a network label is set for the access flow information of the first pod through the k8s cluster node.

[0049] The five-tuple information includes the source Internet Protocol Address (IP) address, source port, destination IP address, destination port, and transport layer protocol. The source IP address refers to the IP address of the pod that sends the data packet. The source port refers to the port number on the pod that sends the data packet. The destination IP address refers to the IP address of the pod that receives the data packet. The destination port refers to the port number on the pod that receives the data packet. The transport layer protocol is a transport layer protocol used to send data packets. The transport layer protocol includes but is not limited to the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP).

[0050] Network labels include but are not limited to SNAT labels and DNAT labels. SNAT labels refer to Source Network Address Translation (SNAT), which is used to convert the source address of a data packet from an internal network from a private address to a public address so that the data packet can be correctly identified by the external network and routed back to the internal network. DNAT labels refer to Destination Network Address Translation (DNAT), which is used to convert the destination address of a data packet from an internal network from a private address to a public address so that the data packet can be correctly routed to the destination of the external network.

[0051] For example, a five-tuple information can be "192.168.1.1 10000 TCP 121.14.88.76 80", which means that a device with an IP address of 192.168.1.1 communicates with a device with an IP address of 121.14.88.76 and a port of 80 through port 10000 using the TCP protocol.

[0052] In an implementation manner of the present application, if the source address and / or destination address of the first pod is a converted address, the k8s cluster node where the first pod is located will determine the network label corresponding to the access flow information of the first pod according to the converted address, and set the corresponding network label for it.

[0053] In an optional implementation, when the source address and the destination address of the first pod are not converted addresses, there is no need to set a network label for the first pod, or the network label is set to empty. It should be noted that the first pod is any pod of any k8s cluster node in the hci cluster. For the setting of network labels of other pods of any k8s cluster node in the hci cluster, please refer to the setting of network labels of the first pod, which will not be repeated here.

[0054] Exemplarily, the five-tuple information is shown in the following table:

[0055] Source IP Source Port Destination IP Destination Port protocol Forward flow information SIP SPORT DIP DPORT PROTO Reverse flow information DIP DPORT SIP SPORT PROTO

[0056] Table 1

[0057] As shown in Table 1, the forward flow information and the reverse flow information in Table 1 are the same, so it is determined that the source address and the destination address in the access flow information have not been converted.

[0058] Source IP Source Port Destination IP Destination Port protocol Forward flow information SIP SPORT DIP DPORT PROTO Reverse flow information DIP DPORT SNATIP SNATPORT PROTO

[0059] Table 2

[0060] As shown in Table 2, it can be concluded from the reverse flow information that the destination IP and destination port in the reverse flow information are inconsistent with the source IP and source port in the forward flow information. It can be determined that the source IP in the access flow information has been converted. At this time, the SNAT label is set for the access flow information.

[0061] Source IP Source Port Destination IP Destination Port protocol Forward flow information SIP SPORT DIP DPORT PROTO Reverse flow information DNATIP DNATPORT SIP SPORT PROTO

[0062] Table 3

[0063] As shown in Table 3, it can be concluded from the reverse flow information that the source IP and source port are inconsistent with the destination IP and destination port in the forward flow information, then it is determined that the destination IP in the access flow information has been converted, and at this time, a dnat label is set for the access flow information.

[0064] Step S230: For the first pod and the second pod, if the first access flow information includes the node access flow information corresponding to the first pod and the node access flow information corresponding to the second pod, the target access flow information is deleted from the first access flow information, and the target access flow information includes the node access flow information of the first pod and the node access flow information of the second pod.

[0065] Step S240: Obtain access flow information corresponding to the first pod and access flow information corresponding to the second pod from the second access flow information and the first access flow information after deleting the first target access flow information, as an aggregation result for the first pod and the second pod.

[0066] Since the access flow information of the virtual machine node is redundant access flow information in the end-to-end access relationship, in the embodiment of the present application, it is first determined whether there is relevant access flow information of the first pod and the second pod in the first access flow information. If so, the access flow information of the first pod and the second pod in the first access flow information is deleted. And based on the first access flow information with the access flow information of the first pod and the second pod deleted, the second access flow information is aggregated, and the access flow information of the first pod and the second pod in the second access flow information is actually aggregated. In order to obtain the aggregation result for the first pod and the second pod, the influence of the access flow information between the first pod and the second pod in the virtual machine node on the aggregation result is eliminated, and the access flow information between the first pod and the second pod in the aggregation result is further reduced.

[0067] In some embodiments, the access flow information corresponding to the first pod and the access flow information corresponding to the second pod are obtained from the second access flow information and the first access flow information after deleting the first target access flow information as the aggregation result for the first pod and the second pod, including: obtaining the access flow information of the first pod and the access flow information of the second pod located in the second access flow information from the second access flow information and the first access flow information after deleting the first target access flow information; if the access flow information of the first pod and the access flow information of the second pod meet the preset matching conditions, determining the aggregation result for the first pod and the second pod according to the source address of the first pod in the access flow information of the first pod and the destination address of the second pod in the access flow information of the second pod.

[0068] Among them, the preset matching condition can be whether the source address and / or the destination address visited of the first pod and the second pod are consistent. The preset matching condition can also be whether the source address and / or the destination address visited of the first pod and the second pod are converted. The preset matching condition can be determined according to different requirements, and the preset matching condition is not specifically limited here.

[0069] In this embodiment, the first access flow information after deleting the first target access flow information does not contain the relevant access information of the first pod and the second pod, so the aggregation result is only related to the relevant access information of the first pod and the second pod in the second access flow information. When the access flow information of the first pod and the second pod in the second access flow information meets the preset matching condition, the aggregation result corresponding to the first pod and the second pod is determined according to the source address of the first pod and the destination address of the second pod.

[0070] Exemplarily, the source address of the first pod is pod1, and the destination address of the second pod is pod2. When the access flow information of the first pod and the second pod meets the preset matching condition, the aggregation result is pod1-pod2.

[0071] In a feasible implementation manner, the second access flow information includes a network label, and the network label is used to indicate whether the pod performs address conversion when accessing. If the access flow information of the first pod and the access flow information of the second pod meet the preset matching condition, then according to the source address of the first pod in the access flow information of the first pod and the destination address of the second pod in the access flow information of the second pod, determine the aggregation result for the first pod and the second pod, including: obtaining the network label corresponding to the first pod in the second flow information as the first network label; obtaining the network label corresponding to the second pod in the second flow information as the second network label; if the first network label The first network label and the second network label both represent that the pod has undergone address conversion when accessed, then based on the first network label, the source address of the access flow information of the first pod in the second access flow information is converted to obtain the first sub-access flow information; based on the second network label, the destination address of the access flow information of the second pod in the second access flow information is converted to obtain the second sub-access flow information; if the first sub-access flow information and the second sub-access flow information meet the preset matching condition, then according to the source address of the first pod in the first sub-access flow information and the destination address of the second pod in the second sub-access flow information, the aggregation result for the first pod and the second pod is determined.

[0072] In this embodiment, the first sub-access flow information corresponding to the first pod and the second sub-access flow information corresponding to the second pod are determined according to the network labels corresponding to the first pod and the second pod, and then the first sub-access flow information and the second sub-access flow information are aggregated to obtain the aggregation result for the first pod and the second pod.

[0073] Exemplarily, if the first network label is a snat label and the second network label is a dnat label, it is determined that the first sub-access flow information and the second sub-access flow information meet the preset matching condition. The source IP of the first sub-access flow information is used as the source address of the aggregation result, and the source port and transmission protocol of the first sub-access flow information are used as the source port and protocol of the aggregation result, the destination address of the second sub-access flow information is used as the destination address of the aggregation result, and the destination port number of the second sub-access flow information is used as the destination port number of the aggregation result. For example, the first sub-access flow information is flow1; the source address and source port number of the first sub-access flow information are host1ip:host1port; the destination address, destination port number and transmission protocol of the first sub-access flow information are host2ip:host2port,proto1, and the first network label is a snat label. The second sub-access flow information is flow2; the source address and source port number of the second sub-access flow information are host1ip:host1port, the destination address, destination port number and transmission protocol of the second sub-access flow information are host2ip:host2port,proto2, the second network label is the dnat label, and the aggregation result is host1ip:host1port-host2ip:host2port,proto1, that is, pod1:port1-pod2:port2,proto1.

[0074] In other implementations, the target access flow information also includes the access flow information of the source IP being the IP of the pod of the k8s cluster node, the access flow information of the destination IP being the IP of the pod of the k8s cluster node, and the access flow information of the destination IP, destination port, and protocol in the service list of the k8s cluster node. The target access flow information is not specifically limited here.

[0075] Step S250: Based on the aggregation result, determine the end-to-end access relationship of the pod in the k8s cluster node, wherein the end-to-end access relationship includes at least one of the access relationship between the pod and the public network, the pod and pods in other k8s cluster nodes in the hci cluster, and the pod and other virtual machine nodes in the hci cluster.

[0076] Please refer to the detailed description of step S140 in the above embodiment for step S250, which will not be repeated here.

[0077] The solution provided in this embodiment deletes the relevant access flow information of the pod in the first access flow information, and then aggregates the deleted first access flow information with the second access flow information. In fact, only the second access flow information is used for aggregation to obtain the end-to-end access relationship of the pod, thereby reducing the access interference caused by the first access flow information collected by the virtual machine node.

[0078] See also Figure 4 , Figure 4 A flow chart of a method for obtaining access relations provided by another embodiment of the present application is shown. Step S310: Obtain node access flow information reported by a target virtual machine node in a hyper-converged HCI cluster as first access flow information, wherein the first access flow information includes access flow information generated through a virtual network when a scheduling unit pod in an application software K8S cluster node in the HCI cluster accesses the target virtual machine node, the target virtual machine node is a virtual machine node other than the K8S cluster node in the HCI cluster, and the virtual network is a network for all virtual machine nodes in the HCI cluster to communicate.

[0079] For step S310, please refer to the detailed description of step S110 in the above embodiment, which will not be repeated here.

[0080] Step S320: Through the k8s cluster node, the original access flow information of the pod in the k8s cluster node and the access parameters corresponding to the original access flow information are collected, and the access parameters include the source address corresponding to each pod and the destination address of the access.

[0081] Among them, the original access flow information includes but is not limited to the access flow information between all pods in the k8s cluster node, the access flow information between the pods in the k8s cluster node and the pods of other k8s cluster nodes, the access flow information between the pods in the k8s cluster node and the target virtual machine node, and the access flow information between the pods in the k8s cluster node and the public network.

[0082] Furthermore, the access parameters include but are not limited to the five-tuple information corresponding to each pod, k8s service parameters, and podIP and other parameters. Among them, each pod five-tuple information includes the source address of the pod and the destination address accessed by the pod. PodIP is obtained through Classless Inter-Domain Routing (CIDR). CIDR is a technology for allocating IP addresses and performing routing. It eliminates the concepts of traditional Class A, Class B, and Class C addresses and subnet masks. K8s service parameters include parameters such as service IP, service protocol, and the port list of the pod involved in the service, making it easier to aggregate IP addresses converted by CIDR.

[0083] Step S330: through the k8s cluster node, according to the access parameters, determine the second access flow information from the original access flow information, and report the second access flow information.

[0084] In an embodiment of the present application, the original access flow information is screened by access parameters to determine the second access flow information that the k8s cluster node needs to report.

[0085] In some implementations, the access parameters corresponding to the original access flow information can be obtained through the connection tracking (Conntrack) of the k8s cluster node. Conntrack can identify information such as the source IP address, destination IP address, source port and destination port of the connection, and save this information in a connection tracking table.

[0086] Furthermore, the screening method can screen the original access flow information according to the source address of the pod, and can also screen the original access flow information according to the destination address accessed by the pod, or can screen in combination with the source address and the destination address, or can screen the original access flow information by comprehensively using the source address, the destination address, the k8s service parameters, and the nodeip table to obtain the second access flow information.

[0087] Exemplarily, the second access flow information is determined by filtering the original access flow information by combining the source address, destination address, k8s service parameters and nodeip table. Get the source address, destination address, k8s service parameters and nodeip table corresponding to the pod. First, determine whether the source address of the pod is the same as the destination address of the access based on the source address and destination address of the pod. If the same, it may be that the service or application inside the pod is trying to communicate with itself. It is also possible that the pod is listening to a specific port on the local interface. Or the network configuration or routing rule configuration is wrong, which causes the source address to be the same as the destination address. At this time, this type of access flow information is filtered out. Then use the k8s service parameters and nodeip table to further filter the filtered original access flow information. If the destination ip in the access flow information is not in the podip list and the service corresponding to the destination ip, protocol, and output port is not in the k8s service parameter list, or the destination ip is in the cluster nodeip list and is not the ip of this node, then report the source ip, source port, protocol number, destination ip, destination port, cluster identifier id, and k8s cluster node tag of the access flow information. If the source IP in the access flow information is not in the podip list, and the source IP is not the IP of this node, then report the source IP, source port, protocol number, reverse source IP, reverse source port, cluster ID, and k8s cluster tag of the access flow information source direction. According to the access flow information determined after screening, the second access flow information is obtained.

[0088] Step S340: Obtain the access flow information of the pod in the k8s cluster node reported by the k8s cluster node as the second access flow information.

[0089] For step S340, please refer to the detailed description of step S120 in the above embodiment, which will not be repeated here.

[0090] Step S350: Obtain access parameters corresponding to the second access flow information.

[0091] Step S360: Acquire access data flow information whose access parameters match preset parameter conditions from the second access flow information.

[0092] Step S370: Aggregate the first access flow information and the access data flow information to obtain the aggregation result.

[0093] Among them, the preset parameter condition can be whether the source address and / or destination address is converted, the preset parameter condition can also be whether the address corresponding to the pod in the second access flow information is in the nodeip table, the preset parameter condition can also be whether the service parameters of each pod in the second access flow information are in the k8s service parameter table, and the preset parameter condition can be limited according to actual needs, and the preset parameter condition is not limited here.

[0094] Exemplarily, taking the preset parameter conditions of network label, nodeip and k8s service parameters as an example, if the network label in the access flow information is empty, that is, it is neither a snat label nor a dnat label, it is directly stored in the database. Further determine the remaining access flow information. If the access flow information is a snat tag, check whether the destination ip of the pod is in the nodeip list or the destination ip, protocol, and destination port are in the service list. If none of them are in the service list, directly extract the five-tuple information in the access flow information and put it into the database. If the access flow information is a dnat tag, check whether the source address of the pod is in the nodeip list. If it is not in the nodeip list, it is a k8s cluster node accessed by the virtual machine node or a k8s cluster node accessed by the public network. Aggregation is not required, and the five-tuple in the flow information is directly extracted and put into the database. The access flow information that is not stored in the database is used as the access data flow information. Finally, aggregation is performed based on the first access flow information and the access data flow information to obtain the aggregation result.

[0095] Step S380: Based on the aggregation result, determine the end-to-end access relationship of the pod in the k8s cluster node, and the end-to-end access relationship includes at least one of the access relationship between the pod and the public network, the pod and pods in other k8s cluster nodes in the hci cluster, and the pod and other virtual machine nodes in the hci cluster.

[0096] For step S380, please refer to the detailed description of step S140 in the aforementioned embodiment, which will not be repeated here.

[0097] In the specific implementation process, after the k8s cluster node screens the collected access flow information to obtain the second access flow information, the k8s cluster node reports the second access flow information to the analyzer, and the analyzer also obtains the first access flow information reported by the virtual machine node. The analyzer aggregates the first access flow information and the second access flow information to obtain the end-to-end access relationship of the pod in the k8s cluster node. In the embodiment of the present application, a database is also used to store the aggregated access relationship and the access relationship that does not need to be aggregated. The access relationship that does not need to be aggregated includes the access flow information screened out in the k8s cluster node and the access flow information with the same source address and target address.

[0098] In the embodiment scheme of the present application, the access flow information collected by the k8s cluster node is screened according to the access parameters to obtain the second access flow information, and the second access flow information is reported. After the reporting, the second access flow information is further screened according to the preset parameter conditions, so that the access data flow information aggregated with the first access flow information is more accurate, and the access relationship obtained after the aggregation is more accurate. While reducing the access interference of the access flow information collected by the virtual machine node to the end-to-end access relationship of the pod in the k8s cluster node, the access relationship establishment is also improved.

[0099] Based on the above embodiments, please refer to Figure 5 , Figure 5 A schematic diagram of an application scenario provided by an embodiment of the present application is shown. Figure 5 In the example, user cluster 01 and user cluster 02 are k8s cluster nodes, where the pods in user cluster 01 are commodity services, and each pod corresponds to a different commodity service. The pods in user cluster 02 are user data services, and each pod corresponds to a different user data process. The access relationship acquisition method provided in the above embodiment is used to establish the end-to-end access relationship between user cluster 01 and user cluster 02, and between the user cluster and the public network. Figure 1 As shown, an end-to-end access relationship is established between the product list service and the user authentication service in the product service. When a fault occurs in the product list service and / or the user authentication service, the access relationship will not be established and displayed. At this time, the fault can be located based on the unestablished access relationship, thereby improving the speed of fault location. Figure 1 In the present invention, an access relationship between user cluster 01 and the public network and an access relationship between user cluster 02 and the public network are established, thereby realizing the interaction between user cluster 01 and user cluster 02 and the public network.

[0100] See also Figure 6, which shows a structural block diagram of an access relationship acquisition device 300 provided in an embodiment of the present application. The access relationship acquisition device 300 is applied to the server 100, and the access relationship acquisition device 300 includes: a first access flow information acquisition module 310, which is used to obtain the node access flow information reported by the target virtual machine node in the hyper-converged HCI cluster, as the first access flow information, the first access flow information includes the access flow information generated through the virtual network when the scheduling unit pod in the application software k8s cluster node in the HCI cluster accesses, the target virtual machine node is the other virtual machine node in the HCI cluster except the k8s cluster node, and the virtual network is the network for all virtual machine nodes in the HCI cluster to communicate; a second access flow information acquisition module 320, used to obtain the access flow information of the pod in the k8s cluster node reported by the k8s cluster node as the second access flow information; the aggregation result acquisition module 330, used to aggregate the first access flow information and the second access flow information to obtain an aggregation result; the access relationship determination module 340, used to determine the end-to-end access relationship of the pod in the k8s cluster node according to the aggregation result, the end-to-end access relationship including at least one of the access relationship between the pod and the public network, the pod and pods in other k8s cluster nodes in the hci cluster, and the pod and other virtual machine nodes in the hci cluster.

[0101] In some embodiments of the present application, the HCI cluster includes a first pod in a first K8s cluster node and a second pod in a second K8s cluster node, and the aggregation result acquisition module 330 includes: a deletion unit, for the first pod and the second pod, if the first access flow information includes node access flow information corresponding to the first pod and node access flow information corresponding to the second pod, then delete the target access flow information from the first access flow information, the target access flow information includes the node access flow information of the first pod and the node access flow information of the second pod; an aggregation unit, for obtaining the access flow information corresponding to the first pod and the access flow information corresponding to the second pod from the second access flow information and the first access flow information after deleting the first target access flow information, as the aggregation result for the first pod and the second pod.

[0102] In some embodiments of the present application, the aggregation unit includes: an access flow information acquisition subunit, which is used to obtain the access flow information of the first pod and the access flow information of the second pod located in the second access flow information and the first access flow information after deleting the first target access flow information; an aggregation result determination subunit, which is used to determine the aggregation result for the first pod and the second pod according to the source address of the first pod in the access flow information of the first pod and the destination address of the second pod in the access flow information of the second pod if the access flow information of the first pod and the access flow information of the second pod meet the preset matching conditions.

[0103] In some embodiments of the present application, the second access flow information includes a network label, and the network label is used to indicate whether the pod performs address conversion when accessed. The aggregation result determination subunit includes: a first network label acquisition component, which is used to obtain the network label corresponding to the first pod in the second flow information as the first network label; a second network label acquisition component, which is used to obtain the network label corresponding to the second pod in the second flow information as the second network label; a first sub-access flow information acquisition component, which is used to perform address conversion on the source address of the access flow information of the first pod in the second access flow information based on the first network label to obtain the first sub-access flow information if both the first network label and the second network label indicate that the pod performs address conversion when accessed; a second sub-access flow information acquisition component, which is used to perform address conversion on the destination address of the access flow information of the second pod in the second access flow information based on the second network label to obtain the second sub-access flow information; and an aggregation result determination component, which is used to determine the aggregation result for the first pod and the second pod according to the source address of the first pod in the first sub-access flow information and the destination address of the second pod in the second sub-access flow information if the first sub-access flow information and the second sub-access flow information meet the preset matching condition.

[0104] In some embodiments of the present application, the access relationship acquisition device 300 also includes: a five-tuple information acquisition module, which is used to obtain the five-tuple information corresponding to the first pod from the access flow information of the first pod through the k8s cluster node; a network label setting module, which is used to set a network label for the access flow information of the first pod through the k8s cluster node if the five-tuple information represents that the source address and / or destination address of the first pod is a converted address.

[0105] In some embodiments of the present application, the access relationship acquisition device 300 further includes: an access parameter acquisition module, which is used to acquire the access parameters corresponding to the second access flow information; and an access data flow information acquisition module, which is used to acquire the access data flow information whose access parameters match the preset parameter conditions from the second access flow information. The aggregation result acquisition module 330 further includes: an aggregation unit, which is used to aggregate the first access flow information and the access data flow information to obtain the aggregation result.

[0106] In some embodiments of the present application, the access relationship acquisition device 300 also includes: a collection module, which is used to collect the original access flow information of the pod in the k8s cluster node and the access parameters corresponding to the original access flow information through the k8s cluster node, and the access parameters include the source address corresponding to each pod and the destination address of the access; a reporting module, which is used to determine the second access flow information from the original access flow information according to the access parameters through the k8s cluster node, and report the second access flow information.

[0107] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and modules can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.

[0108] In several embodiments provided in the present application, the coupling between modules may be electrical, mechanical or other forms of coupling.

[0109] In addition, each functional module in each embodiment of the present application can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or software functional modules.

[0110] A structural block diagram of a server provided in an embodiment of the present application. Please refer to Figure 7 , which shows a structural block diagram of a server provided in an embodiment of the present application. The server 100 can be a server such as a computer, a server, etc. that can run an application. The server 100 in the present application may include one or more of the following components: a processor 101, a memory 102, and one or more applications, wherein the one or more applications may be stored in the memory 102 and configured to be executed by one or more processors 101, and the one or more programs are configured to execute the method described in the aforementioned method embodiment.

[0111] The processor 101 may include one or more processing cores. The processor 101 uses various interfaces and lines to connect various parts of the entire server 100, and executes various functions and processes data of the server 100 by running or executing instructions, programs, code sets or instruction sets stored in the memory 102, and calling data stored in the memory 102. Optionally, the processor 101 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 101 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 101, but may be implemented separately through a communication chip.

[0112] The memory 102 may include a random access memory (RAM) or a read-only memory (ROM). The memory 102 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 102 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc. The data storage area may also store data (such as a phone book, audio and video data, chat record data) created by the server 100 during use.

[0113] Please refer to Figure 8 , which shows a structural block diagram of a computer-readable storage medium provided in an embodiment of the present application. The computer-readable storage medium 200 stores program codes, which can be called by a processor to execute the method described in the above method embodiment.

[0114] The computer-readable storage medium 200 may be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk, or a ROM. Optionally, the computer-readable storage medium 200 includes a non-transitory computer-readable storage medium. The computer-readable storage medium 200 has storage space for program code 210 that performs any method steps of the above method. These program codes can be read from or written to one or more computer program products. The program code 210 can be compressed, for example, in an appropriate form.

[0115] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for obtaining an access relationship, characterized in that: The method comprises: Obtain node access flow information reported by a target virtual machine node in a hyper-converged HCI cluster as first access flow information, wherein the first access flow information includes access flow information generated through a virtual network when a scheduling unit pod in an application software K8S cluster node in the HCI cluster accesses the target virtual machine node, which is a virtual machine node other than the K8S cluster node in the HCI cluster, and the virtual network is a network for communication among all virtual machine nodes in the HCI cluster; Obtain access flow information of the pod in the k8s cluster node reported by the k8s cluster node as second access flow information; Aggregating the first access flow information and the second access flow information to obtain an aggregation result; According to the aggregation result, the end-to-end access relationship of the pod in the k8s cluster node is determined, and the end-to-end access relationship includes at least one of the access relationship between the pod and the public network, the pod and pods in other k8s cluster nodes in the hci cluster, and the pod and other virtual machine nodes in the hci cluster.

2. The method according to claim 1, characterized in that The hci cluster includes a first pod in a first k8s cluster node and a second pod in a second k8s cluster node, and the first access flow information and the second access flow information are aggregated to obtain an aggregation result, including: For the first pod and the second pod, if the first access flow information includes node access flow information corresponding to the first pod and node access flow information corresponding to the second pod, delete target access flow information from the first access flow information, where the target access flow information includes the node access flow information of the first pod and the node access flow information of the second pod; Access flow information corresponding to the first pod and access flow information corresponding to the second pod are obtained from the second access flow information and the first access flow information after the target access flow information is deleted, as an aggregation result for the first pod and the second pod.

3. The method according to claim 2, characterized in that The acquiring, from the second access flow information and the first access flow information after deleting the first target access flow information, access flow information corresponding to the first pod and access flow information corresponding to the second pod as an aggregation result for the first pod and the second pod, includes: Obtaining access flow information of the first pod and access flow information of the second pod in the second access flow information from the second access flow information and the first access flow information after deleting the target access flow information; If the access flow information of the first pod and the access flow information of the second pod meet the preset matching condition, the aggregation result for the first pod and the second pod is determined according to the source address of the first pod in the access flow information of the first pod and the destination address of the second pod in the access flow information of the second pod.

4. The method according to claim 3, characterized in that The second access flow information includes a network label, and the network label is used to indicate whether the pod performs address conversion when accessing. If the access flow information of the first pod and the access flow information of the second pod meet the preset matching condition, then according to the source address of the first pod in the access flow information of the first pod and the destination address of the second pod in the access flow information of the second pod, an aggregation result for the first pod and the second pod is determined, including: Obtain a network label corresponding to the first pod in the second flow information as a first network label; Obtain a network label corresponding to the second pod in the second flow information as a second network label; If both the first network label and the second network label indicate that the pod performs address translation when accessing, then based on the first network label, perform address translation on the source address of the access flow information of the first pod in the second access flow information to obtain first sub-access flow information; Based on the second network label, perform address translation on the destination address of the access flow information of the second pod in the second access flow information to obtain second sub-access flow information; If the first sub-access flow information and the second sub-access flow information meet the preset matching condition, an aggregation result for the first pod and the second pod is determined according to the source address of the first pod in the first sub-access flow information and the destination address of the second pod in the second sub-access flow information.

5. The method according to claim 4, characterized in that Before obtaining the access flow information of the pod in the k8s cluster node reported by the k8s cluster node as the second access flow information, the method further includes: Obtaining, through the k8s cluster node, five-tuple information corresponding to the first pod from the access flow information of the first pod; If the five-tuple information indicates that the source address and / or the destination address of the first pod is a converted address, a network label is set for the access flow information of the first pod through the k8s cluster node.

6. The method according to claim 1, characterized in that After obtaining the access flow information of the pod in the k8s cluster node reported by the k8s cluster node as the second access flow information, the method further includes: Obtaining access parameters corresponding to the second access flow information; Acquire access data flow information whose access parameters match preset parameter conditions from the second access flow information; The aggregating the first access flow information and the second access flow information to obtain an aggregation result includes: The first access flow information and the access data flow information are aggregated to obtain the aggregation result.

7. The method according to any one of claims 1 to 6, characterized in that: Before obtaining the access flow information of the pod in the k8s cluster node reported by the k8s cluster node as the second access flow information, the method further includes: Through the k8s cluster node, collect the original access flow information of the pod in the k8s cluster node and the access parameters corresponding to the original access flow information, wherein the access parameters include the source address corresponding to each pod and the destination address of the access; Through the k8s cluster node, according to the access parameters, the second access flow information is determined from the original access flow information, and the second access flow information is reported.

8. A device for obtaining access relations, characterized in that: The device comprises: A first access flow information acquisition module is used to obtain node access flow information reported by a target virtual machine node in a hyper-converged HCI cluster, as first access flow information, wherein the first access flow information includes access flow information generated through a virtual network when a scheduling unit pod in an application software K8S cluster node in the HCI cluster accesses the target virtual machine node, which is a virtual machine node other than the K8S cluster node in the HCI cluster, and the virtual network is a network for communication among all virtual machine nodes in the HCI cluster; A second access flow information acquisition module is used to obtain the access flow information of the pod in the k8s cluster node reported by the k8s cluster node as the second access flow information; an aggregation result acquisition module, configured to aggregate the first access flow information and the second access flow information to obtain an aggregation result; An access relationship determination module is used to determine the end-to-end access relationship of the pod in the k8s cluster node according to the aggregation result, and the end-to-end access relationship includes at least one of the access relationship between the pod and the public network, the pod and pods in other k8s cluster nodes in the hci cluster, and the pod and other virtual machine nodes in the hci cluster.

9. A server, characterized in that: The server comprises: one or more processors; Memory; One or more application programs, wherein the one or more application programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program codes, which can be called by a processor to execute the method according to any one of claims 1 to 7.

Images