A tenant isolation method, apparatus and related device

Abstract

The application relates to the technical field of intelligent computing centers, in particular to a tenant isolation method and device and related equipment. The method comprises the following steps: determining a target computing server allocated to a target tenant, and determining a tenant network segment allocated to the target tenant; based on the parameter network card number n of the target computing server, the tenant network segment is split into m server network segments, and one server network segment is allocated to each parameter network card of each target computing server connected to the same Leaf device, wherein m and n are positive integers, and m is greater than or equal to n; for each Leaf device, a logical virtual interface corresponding to the target tenant is respectively created on each Leaf device according to each physical downlink interface used for connecting each target computing server; and on each logical virtual interface, an access strategy for isolating the target tenant from other tenants is configured based on the tenant network segment.

Description

Technical Field

[0001] The present application relates to the technical field of intelligent computing centers, and in particular to a tenant isolation method, apparatus, and related equipment. Background Art

[0002] With the rapid development of artificial intelligence (AI) technology, leasing AI computing power has become an urgent need across various industries. For providers of computing power services using RoCE (RDMA over Converged Ethernet) networks, supporting tenant segmentation of computing resources has become a pressing issue.

[0003] Currently, to meet tenant isolation requirements, users can use ACL (Access Control Lists) rules to control traffic. However, in the case of computing servers with multiple network cards and multiple Internet Protocols (IPs), the large number of IP addresses brought by the tenants' multi-track networks will put enormous ACL pressure on the equipment, and the ACL rule configuration is also relatively cumbersome. Summary of the Invention

[0004] The present application provides a tenant isolation method, apparatus, and related equipment.

[0005] In a first aspect, the present application provides a tenant isolation method, the method comprising:

[0006] Determine a target computing server assigned to a target tenant, and determine a tenant network segment assigned to the target tenant;

[0007] Based on the number n of parameter network cards of the target computing server, split the tenant network segment into m server network segments, and allocate a server network segment to each parameter network card of each target computing server connected to the same Leaf device, where m and n are positive integers and m is greater than or equal to n;

[0008] For each Leaf device, create a logical virtual interface corresponding to the target tenant on each Leaf device based on the physical downlink interfaces used to access each target computing server;

[0009] On each logical virtual interface, an access policy for isolating the target tenant from other tenants is configured based on the tenant network segment.

[0010] Optionally, the steps of determining a target computing server allocated to a target tenant and determining a tenant network segment allocated to the target tenant include:

[0011] Receive target tenant information sent by the cloud, wherein the target tenant information includes the target tenant name, target computing server information allocated to the target tenant, and tenant network segment information allocated to the target tenant;

[0012] Based on the target tenant information, a target computing server and a tenant network segment allocated to the target tenant are determined.

[0013] Optionally, if the target tenant information does not include tenant network segment information allocated to the target tenant, the step of determining the tenant network segment allocated to the target tenant includes:

[0014] An available network segment that meets preset conditions is determined from a preset address pool, and the available network segment is allocated to the target tenant as a tenant network segment.

[0015] Optionally, the step of configuring, on each logical virtual interface, an access policy for isolating the target tenant from other tenants based on the tenant network segment includes:

[0016] Assign a VLAN ID to each logical virtual interface and use each logical virtual interface as the gateway interface of the corresponding server network segment;

[0017] Configure an ACL on each logical virtual interface that denies all traffic by default, and configure an ACL that allows traffic corresponding to the tenant network segment.

[0018] Optionally, the method further includes:

[0019] When a tenant is detected to be offline, the computing server and tenant network segment allocated to the tenant are reclaimed.

[0020] In a second aspect, the present application provides a tenant isolation device, comprising:

[0021] a determining unit, configured to determine a target computing server allocated to a target tenant, and determine a tenant network segment allocated to the target tenant;

[0022] a splitting unit, configured to split the tenant network segment into m server network segments based on the number n of parameter network cards of the target computing server, and allocate a server network segment to each parameter network card of each target computing server connected to the same Leaf device, where m and n are positive integers and m is greater than or equal to n;

[0023] A creating unit, configured to create, for each Leaf device, a logical virtual interface corresponding to the target tenant on each Leaf device according to each physical downlink interface used to access each target computing server;

[0024] A configuration unit is used to configure, on each logical virtual interface, an access policy for isolating the target tenant from other tenants based on the tenant network segment.

[0025] Optionally, when determining the target computing server allocated to the target tenant and determining the tenant network segment allocated to the target tenant, the determining unit is specifically configured to:

[0026] Receive target tenant information sent by the cloud, wherein the target tenant information includes the target tenant name, target computing server information allocated to the target tenant, and tenant network segment information allocated to the target tenant;

[0027] Based on the target tenant information, a target computing server and a tenant network segment allocated to the target tenant are determined.

[0028] Optionally, if the target tenant information does not include tenant network segment information allocated to the target tenant, when determining the tenant network segment allocated to the target tenant, the determining unit is specifically configured to:

[0029] An available network segment that meets preset conditions is determined from a preset address pool, and the available network segment is allocated to the target tenant as a tenant network segment.

[0030] Optionally, when configuring an access policy for isolating the target tenant from other tenants based on the tenant network segment on each logical virtual interface, the configuration unit is specifically configured to:

[0031] Assign a VLAN ID to each logical virtual interface and use each logical virtual interface as the gateway interface of the corresponding server network segment;

[0032] Configure an ACL on each logical virtual interface that denies all traffic by default, and configure an ACL that allows traffic corresponding to the tenant network segment.

[0033] Optionally, the device further comprises:

[0034] The recycling unit is used to recycle the computing server and tenant network segment allocated to the tenant when it is detected that a tenant is offline.

[0035] In a third aspect, an embodiment of the present application provides a tenant isolation device, the tenant isolation device comprising:

[0036] a memory for storing program instructions;

[0037] The processor is configured to call the program instructions stored in the memory and execute the steps of the method as described in any one of the first aspects above according to the obtained program instructions.

[0038] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the steps of the method described in any one of the above-mentioned first aspects.

[0039] In summary, the tenant isolation method provided in the embodiment of the present application determines the target computing server assigned to the target tenant, and determines the tenant network segment assigned to the target tenant; based on the number n of parameter network cards of the target computing server, the tenant network segment is split into m server network segments, and for each parameter network card of each target computing server connected to the same Leaf device, a server network segment is allocated, where m and n are positive integers and m is greater than or equal to n; for each Leaf device, according to each physical downstream interface used to access each target computing server, a logical virtual interface corresponding to the target tenant is created on each Leaf device; on each logical virtual interface, an access policy for isolating the target tenant from other tenants is configured based on the tenant network segment.

[0040] The tenant isolation method provided in the embodiment of the present application is adopted. By splitting and managing the tenant network segments and the service network segments, the ACL rule setting based on the network segment is realized under the premise of meeting multi-track networking. By using the tenant network segments for ACL traffic control, the ACL pressure on the access device is reduced when the tenant traffic is isolated, and the limitation of the tenant network specifications due to insufficient ACL capabilities of the device is avoided. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments of the present application or the description of the prior art. Obviously, the drawings described below are only some embodiments recorded in this application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings of the embodiments of the present application.

[0042] Figure 1 A schematic diagram of a network;

[0043] Figure 2 A detailed flowchart of a tenant isolation method provided in an embodiment of the present application;

[0044] Figure 3 A schematic diagram of a logical virtual interface and server network segment allocation provided in an embodiment of the present application;

[0045] Figure 4 A schematic diagram of the structure of a tenant isolation device provided in an embodiment of the present application;

[0046] Figure 5A hardware architecture schematic diagram of a tenant isolation device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] The terminology used in the description of the application herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in the description of the application and the appended claims, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It also will be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0048] It should be understood that although the terms first, second, third, etc. can be used herein to describe various information, these terms are not intended to denote a particular order or hierarchy. These terms are used only to distinguish one type of information from another. For example, a first information can be termed a second information, and similarly, a second information can be termed a first information, without departing from the scope of the present application. Furthermore, the word "if" can be interpreted to mean "when" or "upon" or "in response to determining" depending on the context.

[0049] At present, in the networking of the intelligence computing center, there is a communication demand between the same number of GPUs (Graphics Processing Units) of the computing servers, and the networking is required to be performed in a multi-track communication manner. Next, taking the downlink port of a Leaf device as 128 (128 server same number of network cards (same number of network cards access same number of GPUs) can be accessed), and the parameter network card of the server as 8 cards as an example, as shown in Figure 1 a Leaf (Leaf-1) accesses the first block network card of 128 servers (only the first block network card of 4 servers is shown in the figure), and the first block network card of 128 servers belongs to a same network segment 192.168.10.1 / 24 (network segment 1); a Leaf (Leaf-2) accesses the second block network card of 128 servers, and the second block network card of 128 servers belongs to a same network segment 192.168.20.1 / 24 (network segment 2) (only the second block network card of 4 servers is shown in the figure); a Leaf (Leaf-4) accesses the fourth block network card of 128 servers (only the fourth block network card of 4 servers is shown in the figure), and the fourth block network card of 128 servers belongs to a same network segment 192.168.40.1 / 24 (network segment 4).

[0050] When tenant isolation is performed under the above network configuration, when tenant 1 is assigned to server 1 (assuming the server is an 8-NIC server, NIC 1 of server 1 is connected to Leaf-1, NIC 2 is connected to Leaf-2, ..., NIC 8 is connected to Leaf-8), server 2 (NIC 1 of server 2 is connected to Leaf-1, NIC 2 is connected to Leaf-2, ..., NIC 8 is connected to Leaf-8), tenant 2 is assigned to server 3 (NIC 1 of server 3 is connected to Leaf-1, NIC 2 is connected to Leaf-2, ..., NIC 8 is connected to Leaf-8), server 4 (NIC 1 of server 4 is connected to Leaf-1, NIC 2 is connected to Leaf-2, ..., NIC 8 is connected to Leaf-8), If tenant 1 connects to Leaf-1, network card 2 connects to Leaf-2, and so on, network card 8 connects to Leaf-8), if you need to isolate tenant 1 and tenant 2, you need to configure several ACL rules on each leaf device for the network card IP address of each server connected to that leaf device. For example, for server 1's network card 1, you need to configure an ACL that allows access to server 2's network card 1, and configure ACKs that prohibit access to server 3's network card 1 and server 4's network card 1. Alternatively, you can configure an ACL that prohibits access to all IP addresses and simultaneously configure an ACL that allows access to server 2's network card 1. Even so, if tenant 1 is assigned a large number of computing servers, it is still necessary to configure a large number of ACLs for each network card IP address of each server, placing high demands on device ACL rules. The device ACL capacity becomes a limitation on the scale of a single tenant (number of computing servers). Manually configuring ACLs is also cumbersome, prone to configuration errors that can lead to service anomalies, and complex maintenance.

[0051] The embodiments of the present application provide a technology for dynamic network allocation management, which reduces configuration pressure, improves the tenant support specifications of the network, and provides users with operational convenience through the cooperation of the SE controller and the cloud side.

[0052] For example, see Figure 2 FIG. 1 is a detailed flow chart of a tenant isolation method provided in an embodiment of the present application, and the method includes the following steps:

[0053] Step 200: Determine a target computing server allocated to a target tenant, and determine a tenant network segment allocated to the target tenant.

[0054] It should be noted that the tenant isolation method provided in the embodiment of the present application can be applied to the controller of the computing network. The controller performs network planning based on the allocation of each computing server in the computing network to achieve isolation between tenants.

[0055] Specifically, in an embodiment of the present application, when determining the target computing server assigned to the target tenant and determining the tenant network segment assigned to the target tenant, a preferred implementation method is:

[0056] receiving target tenant information sent by the cloud, wherein the target tenant information comprises a target tenant name, target computing server information allocated to the target tenant, and tenant network segment information allocated to the target tenant; determining target computing servers and a tenant network segment allocated to the target tenant based on the target tenant information.

[0057] That is, when the administrator creates a tenant in the cloud, the administrator can determine the size of the computing resources required by the tenant (i.e., the number of required computing servers) based on the tenant requirements, and thus select target computing servers from idle computing servers to allocate to the newly created tenant. For example, it is determined that server 1 and server 2 are allocated to tenant A, and server 1 and server 2 each have 8 parameter network cards connected to a Leaf device, i.e., the total number of parameter network cards of server 1 and server 2 is 16. Then, based on the total number of parameter network cards, a network segment with a number of available IP addresses greater than or equal to the total number of parameter network cards can be allocated to tenant A as a tenant network segment (tenant network segment A) allocated to tenant A. The cloud sends the computing server (server 1 and server 2) information and the tenant network segment information allocated to the tenant to the controller in the tenant information, and the controller determines the computing servers and the tenant network segment allocated to tenant A based on the received tenant information.

[0058] In actual applications, the user can also not specify the tenant network segment of the newly created tenant, i.e., if the target tenant information does not include tenant network segment information allocated to the target tenant, then one preferred implementation manner for determining the tenant network segment allocated to the target tenant is as follows:

[0059] determining an available network segment that satisfies a preset condition from a preset address pool, and allocating the available network segment to the target tenant as a tenant network segment.

[0060] That is, the controller has a preset address pool including a plurality of network segments, and when it is determined that no tenant network segment is allocated to the target tenant in the cloud, the number of target computing servers allocated to the target tenant and the number of parameter network cards of each computing server can be determined according to the network topology information, the size of the tenant network segment required by the target tenant is determined, and thus an available network segment that satisfies a preset requirement is allocated to the target tenant from the address pool as a tenant network segment of the target tenant.

[0061] For example, the number of addresses required by tenant A is p, and the number of available addresses in the tenant network segment allocated to tenant A needs to be greater than or equal to p.

[0062] Step 210: based on the number n of parameter network cards of the target computing server, the tenant network segment is split into m server network segments, and one server network segment is allocated to each parameter network card of each target computing server connected to the same Leaf device.

[0063] In the embodiment of the present application, m and n are positive integers, and m is greater than or equal to n. The following description will be made using m=n as an example.

[0064] Specifically, after determining the target server assigned to the target tenant (in the embodiment of the present application, the number of parameter network cards of the target server connected to the Leaf is the same), the controller splits the tenant network segment into n server network segments according to the number n of parameter network cards of a target server.

[0065] For example, if n is 8, the network segment of tenant 1 is 192.168.1.0 / 24. The network segment of tenant 1 is split into 8 server network segments: each subnet mask is / 27, and each subnet contains 32 IP addresses.

[0066] Server network segment 1: 192.168.1.0 / 27 (gw: 192.168.1.30),

[0067] Address range: 192.168.1.0-192.168.1.31;

[0068] Server network segment 2: 192.168.1.32 / 27 (gw: 192.168.1.62),

[0069] Address range: 192.168.1.32-192.168.1.63;

[0070] Server network segment 3: 192.168.1.64 / 27 (gw: 192.168.1.94),

[0071] Address range: 192.168.1.64-192.168.1.95;

[0072] Server network segment 4: 192.168.1.96 / 27 (gw: 192.168.1.126),

[0073] Address range: 192.168.1.96-192.168.1.127;

[0074] Server network segment 5: 192.168.1.128 / 27 (gw: 192.168.1.158),

[0075] Address range: 192.168.1.128-192.168.1.159;

[0076] Server network segment 6: 192.168.1.160 / 27 (gw: 192.168.1.190),

[0077] Address range: 192.168.1.160-192.168.1.191;

[0078] Server network segment 7: 192.168.1.192 / 27 (gw: 192.168.1.222),

[0079] Address range: 192.168.1.192-192.168.1.223;

[0080] Server network segment 8: 192.168.1.224 / 27 (GW: 192.168.1.254)

[0081] Address range: 192.168.1.224-192.168.1.255.

[0082] Next, the controller assigns server network segment 1 to the first network card of Leaf-1 connected to the target computing servers (using Server 1 and Server 2 as an example), assigns server network segment 2 to the second network card of Leaf-2 connected to Server 1 and Server 2, and so on, and assigns server network segment 8 to the eighth network card of Leaf-8 connected to Server 1 and Server 2.

[0083] Step: 220: For each Leaf device, according to each physical downlink interface used to access each target computing server, a logical virtual interface corresponding to the target tenant is created on each Leaf device.

[0084] Based on the network topology, the controller determines the physical downlink port on Leaf-1 used to access Server 1 and Server 2 (the physical port on the same leaf for the same tenant (target tenant)). It then creates a logical virtual interface (e.g., a VLAN virtual interface) on Leaf-1 and adds the physical downlink ports used to access Server 1 and Server 2 to this VLAN virtual interface. Similarly, the controller determines the physical downlink ports on Leaf-2, ..., Leaf-8 used to access Server 1 and Server 2 (the physical ports on the same leaf for the same tenant (target tenant)). It then creates a logical virtual interface on each leaf.

[0085] For example, see Figure 3 As shown, a schematic diagram of a logical virtual interface and server network segment allocation provided in an embodiment of the present application is provided. Server 1 and server 2 are computing servers assigned to tenant A. The network card 1 of server 1 and server 2 is connected to Leaf-1. The physical downlink port on Leaf-1 used to access the network card of server 1 and server 2 constitutes a logical virtual interface 1. The server network segment 1 is allocated to the logical virtual interface 1 and the network card 1 of server 1 and server 2.

[0086] Step 230: On each logical virtual interface, configure an access policy for isolating the target tenant from other tenants based on the tenant network segment.

[0087] In the embodiment of the present application, when configuring an access policy for isolating the target tenant from other tenants based on the tenant network segment on each logical virtual interface, a preferred implementation method is as follows:

[0088] Assign a Vlan ID to each logical virtual interface and use each logical virtual interface as the gateway interface of the corresponding server network segment; configure an ACL on each logical virtual interface that denies all traffic by default, and configure an ACL that allows traffic corresponding to the tenant network segment.

[0089] In other words, after creating a VLAN interface, assign it a VLAN ID and use it as the gateway interface for the assigned server network segment, configuring a gateway address. The IP addresses of the network adapters of the target servers connected to this interface are other available IP addresses in the server network segment. At this point, you can configure an ACL on the VLAN interface to isolate the target tenant from other tenants.

[0090] For example, configure the following ACL rules on the VLAN interfaces corresponding to the target tenants on Leaf-1 through Leaf-8: 1. rule999denyall / / deny all traffic by default; 2. permitsourcetenantnetworks (192.168.1.0 / 24)destinationtenantnetworks (192.168.1.0 / 24) / / permit only intranet traffic within this tenant. This allows mutual access between the NICs of Server 1 and Server 2, restricts interaction between the NICs of Server 1 and Server 2 and servers of other tenants, and achieves tenant isolation.

[0091] Furthermore, in an embodiment of the present application, when it is detected that a tenant is offline, the computing server and tenant network segment allocated to the tenant are reclaimed.

[0092] Based on the same inventive concept as the above-mentioned embodiment, for example, refer to Figure 4 FIG. 1 is a schematic diagram of a structure of a tenant isolation device provided in an embodiment of the present application, the device comprising:

[0093] A determining unit 40 is configured to determine a target computing server allocated to a target tenant and determine a tenant network segment allocated to the target tenant;

[0094] A splitting unit 41 is configured to split the tenant network segment into m server network segments based on the number n of parameter network cards of the target computing server, and allocate a server network segment to each parameter network card of each target computing server connected to the same Leaf device, where m and n are positive integers and m is greater than or equal to n;

[0095] A creating unit 42 is configured to create, for each Leaf device, a logical virtual interface corresponding to the target tenant on each Leaf device according to each physical downlink interface used to access each target computing server;

[0096] The configuration unit 43 is configured to configure, on each logical virtual interface, an access policy for isolating the target tenant from other tenants based on the tenant network segment.

[0097] Optionally, when determining the target computing server allocated to the target tenant and determining the tenant network segment allocated to the target tenant, the determining unit 40 is specifically configured to:

[0098] Receive target tenant information sent by the cloud, wherein the target tenant information includes the target tenant name, target computing server information allocated to the target tenant, and tenant network segment information allocated to the target tenant;

[0099] Based on the target tenant information, a target computing server and a tenant network segment allocated to the target tenant are determined.

[0100] Optionally, if the target tenant information does not include tenant network segment information allocated to the target tenant, when determining the tenant network segment allocated to the target tenant, the determining unit 40 is specifically configured to:

[0101] An available network segment that meets preset conditions is determined from a preset address pool, and the available network segment is allocated to the target tenant as a tenant network segment.

[0102] Optionally, when configuring an access policy for isolating the target tenant from other tenants based on the tenant network segment on each logical virtual interface, the configuration unit 43 is specifically configured to:

[0103] Assign a VLAN ID to each logical virtual interface and use each logical virtual interface as the gateway interface of the corresponding server network segment;

[0104] Configure an ACL on each logical virtual interface that denies all traffic by default, and configure an ACL that allows traffic corresponding to the tenant network segment.

[0105] Optionally, the device further comprises:

[0106] The recycling unit is used to recycle the computing server and tenant network segment allocated to the tenant when it is detected that a tenant is offline.

[0107] The above units may be one or more integrated circuits configured to implement the above methods, such as one or more application-specific integrated circuits (ASICs), one or more digital signal processors (DSPs), or one or more field programmable gate arrays (FPGAs). For another example, when a unit is implemented by scheduling program code through a processing element, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call program code. For another example, these units may be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0108] Furthermore, the tenant isolation device provided in the embodiment of the present application, from the hardware level, the hardware architecture diagram of the tenant isolation device can be found in Figure 5 As shown, the tenant isolation device may include: a memory 50 and a processor 51,

[0109] The memory 50 is used to store program instructions. The processor 51 calls the program instructions stored in the memory 50 and executes the above method embodiment according to the obtained program instructions. The specific implementation method and technical effect are similar and will not be repeated here.

[0110] Optionally, the present application also provides a controller comprising at least one processing element (or chip) for executing the above method embodiment.

[0111] Optionally, the present application also provides a program product, such as a computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the above method embodiments.

[0112] Here, the machine-readable storage medium can be any electronic, magnetic, optical or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, the machine-readable storage medium can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state drive, any type of storage disk (such as CD, DVD, etc.), or similar storage media, or a combination thereof.

[0113] The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email transceiver, game console, tablet computer, wearable device, or any combination of these devices.

[0114] For the convenience of description, the above devices are described as being divided into various units according to their functions. Of course, when implementing this application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0115] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the embodiments of the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0116] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0117] Furthermore, these computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0118] These computer program instructions can also be loaded into a computer or other programmable data processing devices, so that a series of operation steps are performed on the computer or other programmable data processing devices to generate computer-implemented processes, thus the instructions executed on the computer or other programmable data processing devices provide processes for implementing the functions specified in the flow Figure 1 one flow or a plurality of flows and / or the functions specified in the flow Figure 1 one block or a plurality of blocks.

[0119] The above only describes the preferred embodiments of the present application and is not used to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of protection of the present application.

Claims

1. A tenant isolation method, characterized in that: A controller applied to computing networking; the method comprising: Determine a target computing server assigned to a target tenant, and determine a tenant network segment assigned to the target tenant; Based on the number n of parameter network cards of the target computing server, split the tenant network segment into m server network segments, and allocate a server network segment to each parameter network card of each target computing server connected to the same Leaf device, where m and n are positive integers and m is greater than or equal to n; For each Leaf device, create a logical virtual interface corresponding to the target tenant on each Leaf device based on the physical downlink interfaces used to access each target computing server; On each logical virtual interface, configuring an access policy for isolating the target tenant from other tenants based on the tenant network segment; The step of configuring, on each logical virtual interface, an access policy for isolating the target tenant from other tenants based on the tenant network segment includes: Assign a VLAN ID to each logical virtual interface and use each logical virtual interface as the gateway interface of the corresponding server network segment; Configure an ACL on each logical virtual interface that denies all traffic by default, and configure an ACL that allows traffic corresponding to the tenant network segment.

2. The method according to claim 1, wherein The steps of determining a target computing server allocated to a target tenant and determining a tenant network segment allocated to the target tenant include: Receive target tenant information sent by the cloud, wherein the target tenant information includes the target tenant name, target computing server information allocated to the target tenant, and tenant network segment information allocated to the target tenant; Based on the target tenant information, a target computing server and a tenant network segment allocated to the target tenant are determined.

3. The method according to claim 2, wherein If the target tenant information does not include tenant network segment information allocated to the target tenant, the step of determining the tenant network segment allocated to the target tenant includes: An available network segment that meets preset conditions is determined from a preset address pool, and the available network segment is allocated to the target tenant as a tenant network segment.

4. The method according to claim 1, wherein The method further comprises: When a tenant is detected to be offline, the computing server and tenant network segment allocated to the tenant are reclaimed.

5. A tenant isolation device, characterized in that: A controller for computing networking; the device comprises: a determining unit, configured to determine a target computing server allocated to a target tenant, and determine a tenant network segment allocated to the target tenant; a splitting unit, configured to split the tenant network segment into m server network segments based on the number n of parameter network cards of the target computing server, and allocate a server network segment to each parameter network card of each target computing server connected to the same Leaf device, where m and n are positive integers and m is greater than or equal to n; A creating unit, configured to create, for each Leaf device, a logical virtual interface corresponding to the target tenant on each Leaf device according to each physical downlink interface used to access each target computing server; a configuration unit, configured to configure, on each logical virtual interface, an access policy for isolating the target tenant from other tenants based on the tenant network segment; When configuring, on each logical virtual interface, an access policy for isolating the target tenant from other tenants based on the tenant network segment, the configuration unit is specifically configured to: Assign a VLAN ID to each logical virtual interface and use each logical virtual interface as the gateway interface of the corresponding server network segment; Configure an ACL on each logical virtual interface that denies all traffic by default, and configure an ACL that allows traffic corresponding to the tenant network segment.

6. The device according to claim 5, characterized in that When determining the target computing server allocated to the target tenant and determining the tenant network segment allocated to the target tenant, the determining unit is specifically configured to: Receive target tenant information sent by the cloud, wherein the target tenant information includes the target tenant name, target computing server information allocated to the target tenant, and tenant network segment information allocated to the target tenant; Based on the target tenant information, a target computing server and a tenant network segment allocated to the target tenant are determined.

7. A tenant isolation device, characterized in that: The tenant isolation device includes: a memory for storing program instructions; The processor is configured to call the program instructions stored in the memory, and execute the steps of the method according to any one of claims 1 to 4 according to the obtained program instructions.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the steps of the method according to any one of claims 1 to 4.

Images