Method and device for accessing external service and electronic equipment

Abstract

The invention discloses a method and device for accessing an external service and electronic equipment, and the method applied to a master node of a K8S cluster comprises the following steps: decapsulating a tunnel message from a slave node received from an IP tunnel, and obtaining an original access message for accessing the external service of the K8S cluster; replacing the source address of the original access message with the IP address of the main node, generating an external access message, and storing an address conversion record; wherein the IP address of the main node is an IP address which is authenticated by an external service and has access authority; and forwarding the external access message to an external service corresponding to the destination address. Under the condition of not depending on an external gateway, the method can be particularly applied to a scene with a large number of two-layer networking or a security-limited K8S cluster scene, it can be guaranteed that a unified IP address is used for accessing external services, and the security is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of microservice management, and in particular to a method, device and electronic device for accessing external services. Background Art

[0002] K8S (kubernetes) cluster is a microservice management framework, in which businesses can be deployed as microservices. The access between microservices uses the internal virtual network, and the microservices directly use the IP address of each physical node to access external services. At the same time, K8S is also an open source container orchestration platform designed for automated deployment, expansion and management of containerized applications. It is container-centric and simplifies the deployment and operation of complex applications in cloud environments through declarative configuration and powerful automation capabilities.

[0003] In the architecture system of the K8S cluster, the internal virtual network is used for access between internal microservices or for microservices to provide services to the outside world. Regardless of the network solution adopted, the main purpose is to open up mutual access between the internal virtual IP addresses of microservices and convert the source address into the node IP address when the microservice accesses external services.

[0004] Since the existing K8S cluster network infrastructure solution is mainly for Internet business to provide external services, and general enterprise-level applications have strict requirements on network source addresses due to security needs, the current network technology solution cannot be implemented. In other words, the existing K8S cluster does not take into account the security restrictions or access control of the external services being accessed, which are limited to specific authenticated IP addresses, so it cannot meet the network requirements under such complex and limited conditions. Summary of the invention

[0005] The purpose of the present invention is to overcome the deficiencies of the prior art and provide a method, device and electronic device for accessing external services.

[0006] The objective of the present invention is achieved through the following technical solutions:

[0007] A first aspect of the present invention provides a method for accessing an external service, which is applied to a master node of a K8S cluster, comprising:

[0008] Decapsulate the tunnel message received from the slave node through the IP tunnel to obtain the original access message for accessing the external service of the K8S cluster;

[0009] Replace the source address of the original access message with the IP address of the master node, generate an external access message, and save the address conversion record; wherein the IP address of the master node is the IP address with access rights authenticated by the external service;

[0010] Forward external access messages to the external service corresponding to the destination address.

[0011] Furthermore, the method further comprises:

[0012] Receive reply messages sent by external services;

[0013] According to the address conversion record, the destination address of the reply message is modified to the source address of the corresponding original access message and then forwarded to the slave node through routing.

[0014] A second aspect of the present invention provides a method for accessing an external service, which is applied to a slave node of a K8S cluster, and the method comprises:

[0015] A microservice in the slave node generates an original access message, where the source address of the original access message is the IP address of the microservice;

[0016] When the destination address of the original access message is an IP address outside the K8S cluster, the original access message is encapsulated as a tunnel message; wherein the source address of the tunnel message is the IP address of the slave node, and the destination address of the tunnel message is the IP address of the master node; the IP address of the master node is an IP address with access rights authenticated by an external service;

[0017] The tunnel message is forwarded to the master node via the IP tunnel.

[0018] Furthermore, the method further comprises:

[0019] When the destination address of the original access message is an IP address within the K8S cluster, the original access message is forwarded according to the destination address.

[0020] Furthermore, the IP address in the K8S cluster includes the IP address of the node in the K8S cluster and the IP address of the microservice in the node; the method further includes:

[0021] Monitor the IP addresses of all nodes in the K8S cluster and the IP addresses of the microservices in each node to obtain all IP addresses in the K8S cluster; and dynamically build a message forwarding strategy based on the changes in the monitored IP addresses, so that messages accessing the microservices in the K8S cluster are directly forwarded through the destination address, and messages accessing external services are forwarded through IP tunnels.

[0022] A third aspect of the present invention provides a device for accessing external services, which is applied to a master node of a K8S cluster, including:

[0023] The IIP tunnel decapsulation module is used to decapsulate the tunnel message received from the slave node through the IP tunnel to obtain the original access message for accessing the external service of the K8S cluster;

[0024] The external access message generation module is used to replace the source address of the original access message with the IP address of the master node, generate an external access message, and save the address conversion record; wherein the IP address of the master node is the IP address with access rights authenticated by the external service;

[0025] The external message forwarding module is used to forward the external access message to the external service corresponding to the destination address.

[0026] Furthermore, the device also includes an internal message forwarding module:

[0027] The external message forwarding module is also used to receive a reply message sent by an external service;

[0028] The internal message forwarding module is used to modify the destination address of the reply message to the corresponding source address of the original access message according to the address conversion record, and then forward it to the slave node through routing.

[0029] A fourth aspect of the present invention provides a device for accessing external services, which is applied to a K8S cluster slave node, including:

[0030] A microservice module, used to generate an original access message of the microservice to which it belongs, wherein the source address of the original access message is the IP address of the microservice to which it belongs;

[0031] An IP tunnel encapsulation module is used to encapsulate the original access message into a tunnel message when the destination address of the original access message is an IP address outside the K8S cluster; wherein the source address of the tunnel message is the IP address of the slave node, and the destination address of the tunnel message is the IP address of the master node; the IP address of the master node is an IP address with access rights authenticated by an external service;

[0032] The tunnel message forwarding module is used to forward the tunnel message to the master node through the IP tunnel.

[0033] Furthermore, the device also includes:

[0034] The original access message forwarding module is used to forward the original access message according to the destination address when the destination address of the original access message is an IP address within the K8S cluster.

[0035] Furthermore, the IP addresses within the K8S cluster include node IP addresses within the K8S cluster and microservice IP addresses within the K8S cluster; the device also includes an IP address monitoring module for monitoring the IP addresses of all nodes within the K8S cluster and the IP addresses of microservices in each node to obtain all IP addresses within the K8S cluster; and / or

[0036] The device also includes a virtual switch service module, which is used to monitor the IP addresses of all nodes in the K8S cluster and the IP addresses of microservices in each node to obtain all IP addresses in the K8S cluster; and dynamically adjust the message forwarding strategy according to the changes in the monitored IP addresses, so that the messages accessing the microservices in the K8S cluster are directly forwarded, and the messages accessing external services are forwarded through the IP tunnel.

[0037] According to a fifth aspect of the present invention, an electronic device is provided, comprising a memory and a processor, wherein the memory stores computer instructions executable on the processor, and when the processor executes the computer instructions, the processor executes the steps of the method described in the first aspect or the steps of the method described in the second aspect.

[0038] According to a sixth aspect of the present invention, there is provided a computer storage medium having computer instructions stored thereon, wherein when the computer instructions are executed, the steps of the method described in the first aspect or the steps of the method described in the second aspect are executed.

[0039] The beneficial effects of the present invention are:

[0040] In an exemplary embodiment of the present invention, it can be used without relying on an external gateway, especially in scenarios with a large number of Layer 2 networks or K8S cluster scenarios with security restrictions, to ensure that a unified IP address is used to access external services, thereby enhancing security. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 This is a schematic diagram of the basic network architecture of the K8S cluster in the prior art;

[0042] Figure 2 A schematic diagram of the network architecture of a K8S cluster provided in an exemplary embodiment of the present invention;

[0043] Figure 3 A flow chart of a method for accessing external services applied to a master node of a K8S cluster provided in an exemplary embodiment of the present invention;

[0044] Figure 4 A flow chart of a method for accessing external services from a slave node of a K8S cluster provided in an exemplary embodiment of the present invention;

[0045] Figure 5 A schematic diagram of a structure of a device for accessing external services applied to a master node of a K8S cluster provided in an exemplary embodiment of the present invention;

[0046] Figure 6 A schematic diagram of the structure of a device for accessing external services applied to a slave node of a K8S cluster provided in an exemplary embodiment of the present invention;

[0047] Figure 7 A general structural diagram of a K8S cluster node device for accessing external services provided in an exemplary embodiment of the present invention;

[0048] Figure 8 A schematic diagram of the structure of a slave node of a K8S cluster accessing an external service and a flow chart of external service data outbound processing provided in an exemplary embodiment of the present invention;

[0049] Fig. 9 A schematic diagram of the structure of a master node of a K8S cluster accessing external services and an external service data outbound processing flow provided in an exemplary embodiment of the present invention;

[0050] Fig.10 A schematic diagram of the structure of a master node of a K8S cluster accessing external services and a flow chart of external service data reception and processing provided in an exemplary embodiment of the present invention;

[0051] Fig.11 A schematic diagram of an electronic device provided in an exemplary embodiment of the present invention;

[0052] Fig.12 It is a schematic diagram of a computer storage medium provided in an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0053] The technical solution of the present invention is described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0054] See also Figure 1 , Figure 1The basic network architecture of the K8S cluster in the prior art is shown, with multiple physical nodes connected to external services (via gateways) (and to the main controller if necessary); each node contains at least one microservice as the smallest deployable object in Kubernetes, which is used to host container applications. These containers share the network and storage and are deployed together on the same node, and the microservices generate messages. When external services need to meet specific authenticated IP address access, the scenario that can be implemented by the prior art can only point the default gateway of all nodes to a specific gateway, and then the gateway forwards the message, but this solution also has a major defect, that is, the accessed service or device cannot use the same network segment as the gateway, otherwise the default gateway cannot take effect, resulting in the inability of the message to pass through the default gateway, and the ability to achieve a unified IP cannot be achieved.

[0055] See also Figure 2 , Figure 2 The network architecture of the exemplary embodiment described below is shown. Figure 1 Similarly, multiple physical nodes are connected to external services, and Figure 1 The difference is that the K8S cluster in the following exemplary embodiment is applied to application scenarios where external services need to meet specific authenticated IP address access. The nodes of the K8S cluster are divided into master nodes and slave nodes, which process different contents respectively to meet specific requirements. Among them, the master node has a specific authenticated IP address and forwards accordingly, and the slave node is used to implement message generation and other contents (the master node can also implement message generation). Specifically:

[0056] See also Figure 3 , Figure 3 A method for accessing an external service provided in an exemplary embodiment of the present invention is shown, which is applied to a master node of a K8S cluster, and the method includes:

[0057] Decapsulate the tunnel message received from the slave node through the IP tunnel to obtain the original access message for accessing the external service of the K8S cluster; replace the source address of the original access message with the IP address of the master node, generate an external access message, and save the address conversion record; among which, the IP address of the master node is the IP address with access rights authenticated by the external service; forward the external access message to the external service corresponding to the destination address.

[0058] It can be seen that this exemplary embodiment uses the technology of IP tunneling. IP tunneling is a technology of encapsulating an IP message in another IP message, which can enable a data message with a target IP address to be encapsulated and forwarded to another IP address. IP tunnels are generally established statically.

[0059] Specifically, in this exemplary embodiment, the master node is provided with an IP tunnel. When the IP tunnel of the master node receives a tunnel message from the slave node, the tunnel message is decapsulated to obtain the original access message for accessing the external service of the K8S cluster; then the master node replaces the source address of the original access message with the IP address of the master node to generate an external access message. The IP address of the master node is the IP address with access authority authenticated by the external service, and the address conversion record is saved; finally, the external access message is forwarded to the external service corresponding to the destination address.

[0060] It should be noted that the original access message here is the message that a microservice of the slave node needs to access the external service. However, due to the conditional restrictions of the external service (IP address), the slave node cannot forward the original access message to the external service. Therefore, in this exemplary embodiment, the slave node sends the tunnel message containing the original access message to the master node. The master node decapsulates the tunnel message to obtain the original access message, and then modifies the source node of the original access message to the IP address of the master node that meets the external service authentication requirements and forwards it (it can pass through the gateway without corresponding restrictions), and the external service can receive the corresponding original access message.

[0061] Therefore, in this exemplary embodiment, when applied in a large number of Layer 2 networking scenarios or K8S cluster scenarios with security restrictions, it can ensure that a unified IP address is used to access external services without relying on an external gateway, thereby enhancing security.

[0062] More preferably, in an exemplary embodiment, the method further comprises: receiving a reply message sent by an external service; and according to the address conversion record, modifying the destination address of the reply message to the source address of the corresponding original access message and then forwarding it to the slave node via routing.

[0063] Specifically, after successfully sending the original access message sent by the microservice of the slave node with the converted source IP address to the external service, it is still necessary to receive the reply message sent by the external service and forward it back to the original corresponding slave node. In this exemplary embodiment, when the master node receives the reply message sent by the external service, according to the address conversion record, the destination address of the reply message is modified to the source address of the corresponding original access message and then forwarded, and the slave node can receive the reply message at this time.

[0064] The same inventive concept as the above exemplary embodiment is shown in FIG. Figure 4 , Figure 4A method for accessing external services provided in an exemplary embodiment of the present invention is shown, which is applied to a slave node of a K8S cluster, and includes the following steps: a microservice in the slave node generates an original access message, and the source address of the original access message is the IP address of the microservice; when the destination address of the original access message is an IP address outside the K8S cluster, the original access message is encapsulated as a tunnel message; wherein the source address of the tunnel message is the IP address of the slave node, and the destination address of the tunnel message is the IP address of the master node; the IP address of the master node is an IP address with access rights authenticated by an external service; and the tunnel message is forwarded to the master node through an IP tunnel.

[0065] Specifically, in this exemplary embodiment, the microservice of the slave node first generates a corresponding original access message, which is the message that the slave node needs to send to the external service. However, due to the conditional restrictions of the external service (IP address), the slave node cannot forward the original access message (the source address is the slave node IP / Node IP, or the microservice IP / Service Cluster IP of the slave node) to the external service. Therefore, in this exemplary embodiment:

[0066] When the microservice of the slave node generates an original access message, it first determines whether the original access message is a message that needs to be sent to an external service. Specifically, it determines by the destination address of the original access message. If the destination address of the original access message is an IP address outside the K8S cluster, it can be known that the original access message is indeed a message that needs to be sent to an external service. At this time, the IP tunnel of the slave node encapsulates the original access message into a tunnel message. The source address of the tunnel message is the IP address of the slave node, and the destination address of the tunnel message is the master node IP address, and the master node IP address is an IP address with access rights authenticated by the external service; then the tunnel message is forwarded to the master node through the IP tunnel, and the master node can decapsulate and address convert the tunnel message before sending it to the external service.

[0067] Similarly, in this exemplary embodiment, when applied in a large number of Layer 2 networking scenarios or K8S cluster scenarios with security restrictions, it can ensure that a unified IP address is used to access external services without relying on an external gateway, thereby enhancing security.

[0068] More preferably, in an exemplary embodiment, the method further includes: when the destination address of the original access message is an IP address within the K8S cluster, forwarding the original access message according to the destination address.

[0069] Specifically, in this exemplary embodiment, as shown above, when the original access message is generated from the microservice of the node, it is first determined whether the original access message is a message that needs to be sent to an external service, specifically by the destination address of the original access message. If the destination address of the original access message is an IP address within the K8S cluster, it can be known that the original access message is a message sent from within the K8S cluster, and the original access message can be directly forwarded according to the destination address.

[0070] More preferably, in an exemplary embodiment, the IP address in the K8S cluster includes the IP address of the node in the K8S cluster and the IP address of the microservice in the node; the method further includes:

[0071] Monitor the IP addresses of all nodes in the K8S cluster and the IP addresses of the microservices in each node to obtain all IP addresses in the K8S cluster; and dynamically build a message forwarding strategy based on the changes in the monitored IP addresses, so that messages accessing the microservices in the K8S cluster are directly forwarded through the destination address, and messages accessing external services are forwarded through IP tunnels.

[0072] Specifically, in order to determine whether the original access message is a message that needs to be sent to an external service (i.e., by determining whether the destination address of the original access message is an IP address within the K8S cluster), the slave node needs to obtain the IP address within the K8S cluster. Therefore, in this exemplary embodiment, the "IP address within the K8S cluster" is first further defined, that is, it includes the node IP address within the K8S cluster and the microservice IP address within the K8S cluster, and at the same time, the method is further defined, that is, monitoring the node IP address within the K8S cluster and the microservice IP address within the K8S cluster.

[0073] The same inventive concept as the above exemplary embodiment is shown in FIG. Figure 5 , Figure 5 A device for accessing external services provided in an exemplary embodiment of the present invention is shown, which is applied to a master node of a K8S cluster, including:

[0074] The IP tunnel decapsulation module is used to decapsulate the tunnel message received from the slave node through the IP tunnel to obtain the original access message for accessing the external service of the K8S cluster;

[0075] The external access message generation module is used to replace the source address of the original access message with the IP address of the master node, generate an external access message, and save the address conversion record; wherein the IP address of the master node is the IP address with access rights authenticated by the external service;

[0076] The external message forwarding module is used to forward the external access message to the external service corresponding to the destination address.

[0077] It can be seen that this exemplary embodiment uses the technology of IP tunneling. IP tunneling is a technology that encapsulates an IP message in another IP message, which can enable a data message with a target IP address to be encapsulated and forwarded to another IP address. IP tunneling is mainly established statically.

[0078] Specifically, in this exemplary embodiment, the master node is provided with an IP tunnel decapsulation module. When the IP tunnel decapsulation module of the master node receives a tunnel message from the slave node, the IP tunnel module decapsulates the tunnel message to obtain the original access message; then the external access message generation module replaces the source address of the original access message with the master node IP address to generate an external access message. The master node IP address is the IP address with access rights authenticated by the external service, and the address conversion record is saved; finally, the external access message is forwarded to the external service corresponding to the destination address through the external message forwarding module.

[0079] It should be noted that the original access message here is the message that the microservice of the slave node needs to send to the external service. However, due to the conditional restrictions of the external service (IP address), the slave node cannot forward the original access message (the source address is the IP address of the slave node, or the IP address of the microservice of the slave node) to the external service. Therefore, in this exemplary embodiment, the slave node encapsulates the original access message into a tunnel message and sends it to the master node through the IP tunnel. The master node decapsulates the tunnel message through the IP tunnel decapsulation module to obtain the original access message. After that, the source node of the original access message is modified to the master node IP address that meets the external service authentication requirements through the external access message generation module, and then forwarded through the external message forwarding module (it can pass through the gateway without corresponding restrictions), and the external service can receive the corresponding original access message.

[0080] Therefore, in this exemplary embodiment, when applied in a large number of Layer 2 networking scenarios or K8S cluster scenarios with security restrictions, it can ensure that a unified IP address is used to access external services without relying on an external gateway, thereby enhancing security.

[0081] More preferably, in an exemplary embodiment, the device further includes an internal message forwarding module:

[0082] The external message forwarding module is also used to receive a reply message sent by an external service;

[0083] The internal message forwarding module is used to modify the destination address of the reply message to the corresponding source address of the original access message according to the address conversion record, and then forward it to the slave node through routing.

[0084] Specifically, after successfully sending the original access message information of the original non-authenticated IP address slave node to the external service, it is still necessary to receive the reply message sent by the external service and forward it back to the original corresponding slave node. In this exemplary embodiment, when the external message forwarding module of the master node receives the reply message sent by the external service, the internal message forwarding module modifies the destination address of the reply message to the source address of the corresponding original access message according to the address conversion record, and then forwards it to the slave node through routing. At this time, the slave node can receive the reply message.

[0085] The same inventive concept as the above exemplary embodiment is shown in FIG. Figure 6 , Figure 6 A device for accessing external services provided in an exemplary embodiment of the present invention is shown, which is applied to a K8S cluster slave node and includes:

[0086] The microservice module is used to generate an original access message of the microservice to which it belongs, wherein the source address of the original access message is the IP address of the microservice to which it belongs;

[0087] An IP tunnel encapsulation module is used to encapsulate the original access message into a tunnel message when the destination address of the original access message is an IP address outside the K8S cluster; wherein the source address of the tunnel message is the IP address of the slave node, and the destination address of the tunnel message is the IP address of the master node; the IP address of the master node is an IP address with access rights authenticated by an external service;

[0088] The tunnel message forwarding module is used to forward the tunnel message to the master node through the IP tunnel.

[0089] Specifically, in this exemplary embodiment, the original access message generation module of the slave node generates a corresponding original access message according to the microservice, and the original access message is the message that the slave node needs to send to the external service. However, due to the conditional restrictions of the external service (IP address), the slave node cannot forward the original access message to the external service. Therefore, in this exemplary embodiment:

[0090] When the microservice module in the slave node generates an original access message based on the microservice, it first determines whether the original access message is a message that needs to be sent to an external service. Specifically, it determines by the destination address of the original access message. If the destination address of the original access message is an IP address outside the K8S cluster, it can be known that the original access message is indeed a message that needs to be sent to an external service. At this time, the IP tunnel encapsulation module of the slave node encapsulates the original access message into a tunnel message. The source address of the tunnel message is the IP address of the slave node, and the destination address of the tunnel message is the IP address of the master node, and the IP address of the master node is an IP address with access rights authenticated by the external service; then the tunnel message forwarding module sends the tunnel message to the master node, and the master node can decapsulate and address convert the tunnel message and then send it to the external service.

[0091] Similarly, in this exemplary embodiment, when applied in a large number of Layer 2 networking scenarios or K8S cluster scenarios with security restrictions, it can ensure that a unified IP address is used to access external services without relying on an external gateway, thereby enhancing security.

[0092] More preferably, in an exemplary embodiment, the device further includes an original access message forwarding module, which is used to forward the original access message according to the destination address when the destination address of the original access message is an IP address within the K8S cluster; and / or

[0093] The device also includes a virtual switch service module, which is used to monitor the IP addresses of all nodes in the K8S cluster and the IP addresses of microservices in each node to obtain all IP addresses in the K8S cluster; and dynamically adjust the message forwarding strategy according to the changes in the monitored IP addresses, so that the messages accessing the microservices in the K8S cluster are directly forwarded, and the messages accessing external services are forwarded through the IP tunnel.

[0094] Specifically, in this exemplary embodiment, as shown above, when the original access message is generated from the microservice of the node, it is first determined whether the original access message is a message that needs to be sent to an external service, specifically by the destination address of the original access message. If the destination address of the original access message is an IP address within the K8S cluster, it can be known that the original access message is a message sent from within the K8S cluster, and the original access message forwarding module can directly forward the original access message according to the destination address.

[0095] Alternatively, the device also includes a virtual switch module, which is used to monitor the IP addresses of all nodes in the K8S cluster and the IP addresses of microservices in each node to obtain all IP addresses in the K8S cluster; and dynamically adjust the message forwarding strategy according to the changes in the monitored IP addresses, so that the messages accessing the microservices in the K8S cluster are directly forwarded, and the messages accessing external services are forwarded through the IP tunnel.

[0096] Specifically, in order to determine whether the original access message is a message that needs to be sent to an external service (i.e., by determining whether the destination address of the original access message is an IP address within the K8S cluster), the slave node needs to obtain the IP address within the K8S cluster. Therefore, in this exemplary embodiment, the "IP address within the K8S cluster" is first further defined, that is, it includes the node IP address within the K8S cluster and the microservice IP address within the K8S cluster, and at the same time, it is further defined, that is, the IP address monitoring module monitors the node IP address within the K8S cluster and the microservice IP address within the K8S cluster.

[0097] The same inventive concept as the above exemplary embodiment is shown in FIG. Figure 7 , Figure 7 The general structure of a K8S cluster slave node device for accessing external services provided in an exemplary embodiment of the present invention is shown, including a virtual switch service module, namely a vswitch (Virtual Switch) service module; it simulates the function of a physical switch, so that virtual machines (VMs) can communicate with each other and between virtual machines and physical networks. The virtual network ports corresponding to each microservice in the node, the physical network ports of the node itself, and the IP tunnel ports on the node are all added to the created vswitch. In an exemplary embodiment of the invention, it is necessary to configure a message forwarding strategy in the vSwitch: that is, for messages from the virtual network ports corresponding to the microservices, when it is identified that the destination IP address of the message is not an IP address in the K8S cluster, the message is forwarded to the tunnel port; the message accessing the microservices in the K8S cluster is directly forwarded according to the destination address.

[0098] When the microservice generates an original access message, it reaches the vswitch service through the corresponding virtual network port. Each microservice message is forwarded to the IP tunnel port through the vSwitch forwarding strategy. The physical network port of the node is used to exchange data with the outside of the node, such as data exchange with other nodes or external services. The IP tunnel is used to encapsulate the original access message to obtain the tunnel message, or to decapsulate the tunnel message to obtain the original access message. The source address replacement is completed by iptables NAT.

[0099] The general structure of the node device can be selected as a master node or a slave node according to actual conditions:

[0100] When the node is a slave node, the IP tunnel is used to encapsulate the original access message whose destination address is an IP address outside the K8S cluster into a tunnel message whose destination address is the IP address of the master node; when the node is a master node, the IP tunnel is used to decapsulate the received tunnel message to obtain the original access message, and further replace the source address of the original access message with the IP address of the master node through iptables NAT to generate an external access message;

[0101] When the node is a slave node, the physical network port is used to forward tunnel messages to the master node; when the node is a master node, the physical network port is used to receive tunnel messages sent by the slave node and also to forward external access messages to external services.

[0102] Figure 8 The structure and external service data outbound processing flow when the node is a slave node are shown. First, the microservice generates an original access message and sends it to the vswitch service through the virtual network port. The vswitch service determines whether the destination address of the original access message is an IP address outside the K8S cluster. If so, it is sent to the IP tunnel to encapsulate the original access message into a tunnel message. The source address of the tunnel message is the IP address of the slave node, and the destination address of the tunnel message is the IP address of the master node. Finally, the tunnel message is forwarded to the master node through the physical network port.

[0103] Fig. 9 The structure and external service data outbound processing flow when the node is the master node are shown. First, the physical network port receives the tunnel message sent from the slave node, decapsulates the received tunnel message through the IP tunnel to obtain the original access message, and then replaces the source address of the original access message with the master node IP address through iptables NAT to generate an external access message, and finally sends the external access message to the external service through the physical network port.

[0104] In addition, it should be noted that when the microservice of the master node generates an original access message, after converting the source IP address into the IP address of the master node, it can be sent directly to the external service through the physical network port.

[0105] More preferably, in an exemplary embodiment, for the physical network port, when the node is a slave node, the physical network port is also used to receive the reply message sent by the master node after the destination address is modified, that is, the reply message is directly reversed NATed by the kernel through iptables NAT, and the destination address of the reply message is modified to the source address of the corresponding original access message according to the address conversion record. When the node is a master node, the physical network port is also used to receive the reply message sent by the external service, and send the reply message after the destination address is modified to the slave node;

[0106] Specifically, based on the node structure in the above exemplary embodiment, the relevant restrictions when the external service replies to the information are further defined in this exemplary embodiment:

[0107] Fig.10 The structure and external service data receiving and processing flow when the node is the master node are shown. The physical network port receives the reply message sent by the external service. At this time, the reply message is directly reversed by the kernel according to the address conversion record by iptables NAT, and the destination address of the reply message is modified to the source address of the corresponding original access message. Then, the reply message with the modified destination address is sent to the slave node. For the slave node, the reply message with the modified destination address sent by the master node is received through the physical network port.

[0108] See also Fig.11 Another exemplary embodiment of the present invention provides an electronic device, comprising a memory and a processor, wherein the memory stores computer instructions that can be executed on the processor, and when the processor executes the computer instructions, the following is performed: Figure 3 The steps of the method, or Figure 4 The steps of the method.

[0109] See also Fig.12 Another exemplary embodiment of the present invention provides a computer storage medium having computer instructions stored thereon, wherein the computer instructions are executed as follows when executed: Figure 3 The steps of the method, or Figure 4 The steps of the method.

[0110] Obviously, the above embodiments are merely examples for clear explanation, and are not intended to limit the implementation methods. For ordinary technicians in the relevant field, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived from them are still within the protection scope of the invention.

Claims

1. A method for accessing an external service, characterized in that: Applied to the master node of the K8S cluster, the method includes: Decapsulate the tunnel message received from the slave node through the IP tunnel to obtain the original access message for accessing the external service of the K8S cluster; Replace the source address of the original access message with the IP address of the master node, generate an external access message, and save the address conversion record; wherein the IP address of the master node is the IP address with access rights authenticated by the external service; Forward external access messages to the external service corresponding to the destination address.

2. The method for accessing external services according to claim 1, characterized in that: The method further comprises: Receive reply messages sent by external services; According to the address conversion record, the destination address of the reply message is modified to the source address of the corresponding original access message and then forwarded to the slave node through routing.

3. A method for accessing an external service, characterized in that: Applied to a slave node of a K8S cluster, the method includes: A microservice in the slave node generates an original access message, where the source address of the original access message is the IP address of the microservice; When the destination address of the original access message is an IP address outside the K8S cluster, the original access message is encapsulated as a tunnel message; wherein the source address of the tunnel message is the IP address of the slave node, and the destination address of the tunnel message is the IP address of the master node; the IP address of the master node is an IP address with access rights authenticated by an external service; The tunnel message is forwarded to the master node via the IP tunnel.

4. The method for accessing external services according to claim 3, characterized in that: The method further comprises: When the destination address of the original access message is an IP address within the K8S cluster, the original access message is forwarded according to the destination address.

5. The method for accessing external services according to claim 3 or 4, characterized in that: The IP address in the K8S cluster includes the IP address of the node in the K8S cluster and the IP address of the microservice in the node; the method also includes: Monitor the IP addresses of all nodes in the K8S cluster and the IP addresses of the microservices in each node to obtain all IP addresses in the K8S cluster; and dynamically build a message forwarding strategy based on the changes in the monitored IP addresses, so that messages accessing the microservices in the K8S cluster are directly forwarded through the destination address, and messages accessing external services are forwarded through IP tunnels.

6. A device for accessing an external service, characterized in that: Applied to the master node of the K8S cluster, including: The IP tunnel decapsulation module is used to decapsulate the tunnel message received from the slave node through the IP tunnel to obtain the original access message for accessing the external service of the K8S cluster; The external access message generation module is used to replace the source address of the original access message with the IP address of the master node, generate an external access message, and save the address conversion record; wherein the IP address of the master node is the IP address with access rights authenticated by the external service; The external message forwarding module is used to forward the external access message to the external service corresponding to the destination address.

7. The K8S cluster master node device for accessing external services according to claim 6, characterized in that: The device also includes an internal message forwarding module: The external message forwarding module is also used to receive a reply message sent by an external service; The internal message forwarding module is used to modify the destination address of the reply message to the corresponding source address of the original access message according to the address conversion record, and then forward it to the slave node through routing.

8. A device for accessing an external service, characterized in that: Applied to K8S cluster slave nodes, including: A microservice module, used to generate an original access message of the microservice to which it belongs, wherein the source address of the original access message is the IP address of the microservice to which it belongs; An IP tunnel encapsulation module is used to encapsulate the original access message into a tunnel message when the destination address of the original access message is an IP address outside the K8S cluster; wherein the source address of the tunnel message is the IP address of the slave node, and the destination address of the tunnel message is the IP address of the master node; the IP address of the master node is an IP address with access rights authenticated by an external service; The tunnel message forwarding module is used to forward the tunnel message to the master node through the IP tunnel.

9. The K8S cluster slave node device for accessing external services according to claim 8, characterized in that: The device also includes an original access message forwarding module, which is used to forward the original access message according to the destination address when the destination address of the original access message is an IP address in the K8S cluster; and / or The device also includes a virtual switch service module, which is used to monitor the IP addresses of all nodes in the K8S cluster and the IP addresses of microservices in each node to obtain all IP addresses in the K8S cluster; And dynamically adjust the message forwarding strategy according to the changes of the monitored IP address, so that the messages accessing the microservices in the K8S cluster are directly forwarded, and the messages accessing external services are forwarded through the IP tunnel.

10. An electronic device comprising a memory and a processor, wherein the memory stores computer instructions that can be executed on the processor, wherein: When the processor executes the computer instructions, the steps of the method according to any one of claims 1 to 2 or the steps of the method according to any one of claims 3 to 5 are performed.

Images