Cloud load balancing security group automatic configuration method, system and device and storage medium

Abstract

The invention discloses a cloud load balancing security group automatic configuration method, system and device and a storage medium, and the method comprises the steps: responding to a back-end server adding operation instruction, searching a corresponding load balancing ID based on a preset balancing configuration rule, obtaining information of a back-end server to be added; obtaining an actual physical IP of a corresponding load balancing instance and a protocol and a port which are allowed to be released according to the load balancing ID, and obtaining a corresponding security group ID according to the information of the back-end server; and according to the obtained actual physical IP of the load balancing instance, the protocol allowed to be released and the port, performing automatic release configuration on the corresponding security group ID so as to realize security access of the to-be-added back-end server. According to the method, the security group of the back-end server can be automatically configured after the back-end server is added, so that the flow can be efficiently released, and automatic connection configuration of the back-end server and the cloud load balance is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of load balancing, and in particular to a method, system, device and storage medium for automatically configuring a cloud load balancing security group. Background Art

[0002] Cloud load balancing is a technology that distributes user access traffic to multiple servers according to a specific load balancing algorithm. It distributes requests from clients to servers in the backend server pool according to the balancing configuration rules by setting a virtual service address (Virtual IP Address, VIP), thereby improving the service capabilities and availability of the entire business system.

[0003] In the cloud load balancing application scenario, after the client accesses the virtual service address traffic and reaches the load balancing instance, the load policy on the load balancing instance uses its actual physical IP to perform address conversion and traffic distribution, that is, the actual physical IP of the load balancing instance is used as the source IP to reach the backend server. At this time, the backend server security group needs to open the actual physical IP of the load balancing instance to enable normal communication. The current load balancing backend communication method is that after the backend server is added, the user manually opens the physical IP of the load balancing instance in the security access component (security group) of the backend server to achieve communication. When the user creates different load balancing instances to implement different load balancing services, or adds different backend servers to the load balancing, the manual operation steps are cumbersome, which will lead to slow business implementation and bring great inconvenience to business users. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a cloud load balancing security group automatic configuration method, system, device and storage medium, so as to achieve the purpose of automatically configuring the back-end server security group, realizing efficient release of corresponding traffic, and enabling rapid business implementation.

[0005] In a first aspect, the present invention provides a method for automatically configuring a cloud load balancing security group, which includes: responding to a backend server addition operation instruction, searching for a corresponding load balancing ID based on a preset balancing configuration rule, and obtaining information of the backend server to be added; obtaining the actual physical IP of the corresponding load balancing instance and the protocols and ports allowed to be opened according to the load balancing ID, and obtaining its corresponding security group ID according to the information of the backend server; automatically opening the corresponding security group ID according to the actual physical IP of the obtained load balancing instance, the protocols and ports allowed to be opened, so as to achieve secure access to the backend server to be added.

[0006] In the second aspect, the present invention also provides a cloud load balancing security group automatic configuration system, which includes: a monitoring and acquisition unit, which is used to monitor service information. If the service information is an operation instruction to add a back-end server, then in response to the back-end server adding operation instruction, the corresponding load balancing ID is searched based on the preset balancing configuration rules, and the information of the back-end server to be added is obtained; a query and acquisition unit, which is used to obtain the actual physical IP of the corresponding load balancing instance and the protocols and ports allowed to be opened according to the load balancing ID, and obtain its corresponding security group ID according to the information of the back-end server; an access configuration unit, which is used to automatically configure the corresponding security group ID according to the actual physical IP of the obtained load balancing instance, the protocols and ports allowed to be opened, so as to achieve secure access to the back-end server to be added.

[0007] The present invention also provides a cloud load balancing security group automatic configuration system, which includes a control node, a computing node and a back-end server, wherein the control node includes a load balancer and a security group control plug-in; wherein the load balancer is used to listen to the back-end server adding operation instruction, and in response to the back-end server adding operation instruction, search for the corresponding load balancing ID based on the preset balancing configuration rules, and obtain the information of the back-end server to be added; the security group control plug-in is used to obtain the actual physical IP of the corresponding load balancing instance and the protocols and ports allowed to be released according to the load balancing ID, and obtain its corresponding security group ID according to the information of the back-end server, and write the security group rules consisting of the actual physical IP of the load balancing instance corresponding to the security group ID, the protocols and ports allowed to be released into the RDMA buffer; the back-end server automatically configures the corresponding security group ID according to the security group rules written into the RDMA buffer read by the computing node, so as to realize the automatic connection configuration of the back-end server and the load balancer.

[0008] In a third aspect, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned cloud load balancing security group automatic configuration method when executing the computer program.

[0009] In a fourth aspect, a computer-readable storage medium is provided, which stores a computer program. When the computer program is executed by a processor, the steps of the above-mentioned cloud load balancing security group automatic configuration method are implemented.

[0010] Compared with the prior art, the present invention responds to the backend server adding operation instruction and searches for the corresponding load balancing ID based on the preset balancing configuration rules, obtains the information of the backend server to be added, and obtains the actual physical IP of the corresponding load balancing instance and the protocols and ports allowed to be released according to the load balancing ID, obtains its corresponding security group ID according to the information of the backend server, and finally automatically configures the corresponding security group ID according to the actual physical IP of the obtained load balancing instance, the protocols and ports allowed to be released, so as to achieve the security access of the backend server to be added. It can be seen that in the present invention, the security group of the backend server can be automatically configured after each backend server is added, and the security access of the added backend server is achieved, so as to efficiently release the corresponding traffic, thereby realizing the automatic connection configuration of the backend server and the cloud load balancing, without manual configuration, and the business implementation is faster. At the same time, it can also avoid misoperation caused by human reasons, thereby improving the configuration security. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 A schematic diagram of an application environment of a method for automatically configuring a cloud load balancing security group in an embodiment of the present invention;

[0012] Figure 2 A schematic diagram of a process for automatically configuring a cloud load balancing security group according to a first embodiment of the present invention;

[0013] Figure 3 A schematic diagram of a sub-process of the cloud load balancing security group automatic configuration method provided by the first embodiment of the present invention;

[0014] Figure 4 A schematic diagram of a flow chart of a method for automatically configuring a cloud load balancing security group according to a second embodiment of the present invention;

[0015] Figure 5 A schematic block diagram of a cloud load balancing security group automatic configuration system provided by the first embodiment of the present invention;

[0016] Figure 6 A schematic block diagram of a cloud load balancing security group automatic configuration system provided by a second embodiment of the present invention;

[0017] Figure 7 A schematic diagram of the structure of a computer device in one embodiment of the present invention;

[0018] Figure 8 FIG. 4 is another schematic diagram of the structure of a computer device in one embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to enable those skilled in the art to more clearly understand the objectives, technical solutions and advantages of the present invention, the present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0020] The cloud load balancing security group automatic configuration method provided by the embodiment of the present invention can be applied in the following aspects: Figure 1 In an application environment, the client communicates with the server through a network. The server can receive a backend server adding operation instruction through the client, and in response to the backend server adding operation instruction, search for the corresponding load balancing ID based on the preset balancing configuration rules, and obtain the information of the backend server to be added; obtain the actual physical IP of the corresponding load balancing instance and the protocols and ports allowed to be released according to the load balancing ID, and obtain its corresponding security group ID according to the information of the backend server; finally, according to the actual physical IP of the obtained load balancing instance, the protocols and ports allowed to be released, the corresponding security group ID is automatically released and configured to achieve secure access to the backend server to be added. Among them, the client can be but is not limited to various personal computers, laptops, smart phones, tablets and portable wearable devices. The server can be implemented with an independent server or a server cluster consisting of multiple servers.

[0021] It should be noted that Figure 1 Only one client is shown in the figure. In actual operation, the server can exchange data with multiple clients. The present invention is described in detail below through specific embodiments.

[0022] See also Figure 2 As shown, Figure 2 A schematic diagram of a process flow of a cloud load balancing security group automatic configuration method provided in the first embodiment of the present invention. As shown in the figure, the method includes the following steps S110-S140:

[0023] S110 . In response to the backend server adding operation instruction, the corresponding load balancing ID is searched based on the preset balancing configuration rule, and the information of the backend server to be added is obtained.

[0024] In this step, when a backend server adding operation instruction is monitored, the backend server adding operation instruction is responded to and the information of the backend server to be added is parsed from the backend server adding operation instruction, and its corresponding load balancing ID is searched based on the preset balancing configuration rules.

[0025] This step in the present invention is a response operation when adding a backend server in cloud load balancing. It can be understood that before monitoring, cloud load balancing has pre-completed the creation of balancing configuration rules, listeners, backend server resource pools, health checks and other configurations.

[0026] In this embodiment, the information of the backend server includes the ID and IP of the backend server to be added.

[0027] S120. Obtain the actual physical IP address of the corresponding load balancing instance and the protocols and ports that are allowed to be opened according to the load balancing ID, and obtain the corresponding security group ID according to the information of the backend server.

[0028] In the present invention, the security group rules of the security group corresponding to the backend server to be added are obtained according to the load balancing ID and the information of the backend server to be added.

[0029] This step specifically includes: obtaining the backend server resource pool ID from the load balancing database according to the load balancing ID, and then obtaining the protocols and ports allowed to be opened according to the backend server resource pool ID; querying the corresponding load balancing instance from the load balancing database according to the load balancing ID, and obtaining its actual physical IP; and obtaining its port ID from the load balancing database according to the backend server ID and IP in the information of the backend server, and then querying and obtaining its bound security group ID according to the port ID.

[0030] In this embodiment, the load balancing database includes a load balancing data table, a back-end server resource pool data table, a back-end server data table, a port table and an instance data table, and the various table items in the database are associated, wherein the load balancing data table includes information such as a listener ID and a back-end server resource pool ID corresponding to the load balancing ID, each back-end server resource pool ID is associated with a back-end server resource pool data table, the back-end server resource pool data table includes protocol and port information allowed to be accessed by the back-end server, the back-end server data table includes a port ID and IP corresponding to the back-end server ID and IP, the port table includes information such as a security group ID and IP bound to the port ID, and the instance data table includes information such as a load balancing ID and the load balancing instance associated therewith and the actual physical IP of the load balancing instance. Then, based on the load balancing ID and the backend server ID and IP, the information required to configure the corresponding security group can be automatically queried from the different pre-stored associated tables in the load balancing database. That is, in this embodiment, the backend server resource pool ID can be obtained from the load balancing data table of the load balancing database according to the load balancing ID, and the corresponding allowed protocol and port can be obtained from the associated backend server resource pool data table according to the backend server resource pool ID. The corresponding load balancing instance can be queried in the instance data table of the load balancing database according to the load balancing ID to obtain its actual physical IP. The port ID corresponding to the backend server can be obtained from the backend server data table according to the backend server ID and IP, thereby obtaining the corresponding bound security group ID from the port table.

[0031] S130. Automatically configure the corresponding security group ID according to the actual physical IP of the acquired load balancing instance, the protocols and ports allowed to be opened, so as to achieve secure access to the backend server to be added.

[0032] like Figure 3 As shown, this step specifically includes:

[0033] S131, the actual physical IP address of the load balancing instance corresponding to the security group ID, the protocols and ports allowed to be opened are combined into its security group rules.

[0034] In this step, configure the security group rules of the corresponding security group ID by combining the actual physical IP address of the load balancing instance, the protocols and ports allowed to be opened.

[0035] S132. Write the security group ID and the corresponding security group rules into RDMA buffer.

[0036] In this step, the security group ID and the corresponding security group rules are written into the memory buffer. The RDMA hardware network card is informed to read the data through the work task, and the read data is sent to a specific RDMA buffer for storage to facilitate the subsequent use of the security group configuration.

[0037] S133, controlling the computing node to read the security group ID and the corresponding security group rules written in the RDMA buffer, thereby automatically enabling the security group ID according to the security group rules.

[0038] In this step, the control computing node reads the security group ID and the corresponding security group rules written in the RDMA buffer, and sends them to the security group corresponding to the backend server to be added, so that it can automatically open the configuration according to the security group rules to achieve secure access to the backend server to be added.

[0039] In the above-mentioned automated configuration process, RDMA (Remote Direct Memory Access) technology is used as the basis for service communication. By directly writing and reading data, a large amount of data copying in the traditional kernel protocol stack is bypassed, while CPU preemption can be avoided, which greatly improves the response efficiency and stability of automated security group configuration.

[0040] S140: monitor access traffic, and distribute the access traffic to corresponding backend servers according to a preset balancing configuration rule.

[0041] In the present invention, after completing the automatic connection configuration between the cloud load balancing and the back-end server to be added, the cloud load balancing implements the dynamic distribution of the flow data through the balancing configuration rules.

[0042] As can be seen from the above, in the present invention, after each addition of a backend server, the information required for configuring the corresponding security group can be automatically queried from the load balancing database according to the load balancing ID, the backend server ID and the IP to form a security group rule, thereby issuing the security group rule to automatically configure the security group of the backend server to be added, thereby achieving secure access to the backend server to be added, and efficiently releasing the corresponding traffic to achieve automatic connection configuration between the backend server and the cloud load balancing, without manual configuration, and faster business implementation. At the same time, it can also avoid misoperation caused by human factors, thereby improving configuration security. In addition, RDMA technology is used as the basis for service communication in the automated configuration process, and the transmission of security group rules is not affected by the system protocol stack and CPU, so the configuration response is more efficient and stable.

[0043] Reference Figure 4 , Figure 4 A schematic diagram of a process flow of a method for automatically configuring a cloud load balancing security group provided in the second embodiment of the present invention. As shown in the figure, the method includes the following steps S210-S280:

[0044] S210, monitor service information. If the monitored service information is an instruction to add an operation to a backend server, execute steps S220-S240 and step S280. If the monitored service information is load balancing instance failure information, execute steps S250-S280.

[0045] S220: In response to the backend server adding operation instruction, search for the corresponding load balancing ID based on the preset balancing configuration rule, and obtain the information of the backend server to be added.

[0046] This step is similar to step S110 and will not be described again here.

[0047] S230. Obtain the actual physical IP address of the corresponding load balancing instance and the protocols and ports allowed to be opened according to the load balancing ID, and obtain the corresponding security group ID according to the information of the backend server.

[0048] This step is similar to step S120 and will not be described again here.

[0049] S240. Automatically configure the corresponding security group ID according to the actual physical IP of the obtained load balancing instance, the protocols and ports allowed to be opened, so as to achieve secure access to the backend server to be added.

[0050] This step is similar to step S130 and will not be described again here.

[0051] S250. Obtain the actual physical IP address of the new load balancing instance and the protocols and ports that are allowed to be opened according to the load balancing ID corresponding to the load balancing instance.

[0052] In this step, a new backend server resource pool ID is obtained from the load balancing database according to the load balancing ID corresponding to the failed load balancing instance, and then a new protocol and port allowed to be opened are obtained according to the new backend server resource pool ID; a new load balancing instance is queried from the load balancing database according to the load balancing ID, and its actual physical IP is obtained. That is, when the load balancing instance fails, new configuration information is re-queried to form a new security group rule.

[0053] S260: Query the actual physical IP address of the failed load balancing instance, the corresponding protocol and port allowed to be opened, and the security group ID.

[0054] In this step, the old actual physical IP address and the protocols and ports allowed to be opened of the failed load balancing instance are queried, and the security group ID of the corresponding backend server is also queried to update the security group rules sent to the security group.

[0055] S270. Automatically configure the security group ID to be open according to the actual physical IP of the new load balancing instance and the protocols and ports that are allowed to be opened, and delete the actual physical IP of the failed load balancing instance and its corresponding protocols and ports that are allowed to be opened.

[0056] In this step, the new security group rules are used to automatically configure the security group ID to be open, and the old security group rules of the security group ID (including the actual physical IP corresponding to the failure and the protocols and ports allowed to be opened) are deleted to timely perceive the failure. In the event of a failure, not only can a new load balancing instance be automatically established, but the old security group rules can also be deleted. This prevents the backend server security group from being unable to open traffic due to the change of the actual physical IP after the new load balancing instance is established. That is, the cloud load balancing security group automatic configuration method of this embodiment can also timely perceive the changes in the load balancing instance to ensure the real-time flow of traffic after the failure.

[0057] S280: monitor access traffic, and distribute the access traffic to corresponding backend servers according to a preset balancing configuration rule.

[0058] This step is similar to step S140 and will not be described again here.

[0059] As can be seen from the above, this embodiment realizes that cloud load balancing automatically obtains and issues security group rules after adding a backend server, so as to realize automatic configuration of the security group of the backend server in cloud load balancing, without manual configuration, and when a failure occurs, it will automatically obtain new security group rules according to the load balancing ID corresponding to the failed load balancing instance, and query the old security group rules, so as to use the new security group rules to automatically open the configuration of the corresponding security group ID, and delete the old security group rules at the same time, so that the backend server can perceive and identify the changes of the load balancing instance in real time, and update the configuration of the corresponding backend server security group, so as to ensure the real-time flow of traffic after the failure, without waiting for the operation and maintenance to discover the failure and then manually configure; and the automatic configuration process in both cases relies on RDMA technology for message transmission, which has a faster response speed than the existing message monitoring mechanism commonly used in the industry.

[0060] Reference Figure 5 , Figure 5 The block diagram of the cloud load balancing security group automatic configuration system 300 provided in the first embodiment of the present invention is shown. Figure 5 As shown, the present invention provides a cloud load balancing security group automatic configuration system 300, which can be configured in a server. Figure 5 The cloud load balancing security group automatic configuration system 300 includes a monitoring acquisition unit 301, a query acquisition unit 302, an admission configuration unit 303 and a deletion unit 304.

[0061] The monitoring acquisition unit 301 is used to monitor service information. If the service information is an operation instruction to add a backend server, then in response to the backend server adding operation instruction, the corresponding load balancing ID is searched based on the preset balancing configuration rules, and the information of the backend server to be added is obtained; and if the service information is load balancing instance failure information, the actual physical IP of the new load balancing instance and the protocols and ports allowed to be opened are obtained according to the load balancing ID corresponding to the load balancing instance. In this embodiment, the information of the backend server includes the backend server ID and IP to be added; the monitoring acquisition unit 301 responds to the addition of backend servers in cloud load balancing and when cloud load balancing fails, and obtains corresponding information. It can be understood that before monitoring, cloud load balancing has pre-completed the creation of balancing configuration rules, listeners, backend server resource pools, health checks and other configurations.

[0062] The query acquisition unit 302 is used to obtain the actual physical IP of the corresponding load balancing instance and the protocols and ports that are allowed to be released according to the load balancing ID, and obtain its corresponding security group ID according to the information of the backend server. Specifically, the backend server resource pool ID is obtained from the load balancing database according to the load balancing ID, and then the protocols and ports that are allowed to be released are obtained according to the backend server resource pool ID; the corresponding load balancing instance is queried from the load balancing database according to the load balancing ID, and its actual physical IP is obtained; and the port ID is obtained from the load balancing database according to the backend server ID and IP in the information of the backend server, and then the security group ID bound to it is obtained by querying according to the port ID.

[0063] Furthermore, the query acquisition unit 302 is also used to query the actual physical IP of the failed load balancing instance, the corresponding protocols and ports allowed to be released, and the security group ID when the load balancing instance fails. That is, the old actual physical IP and the protocols and ports allowed to be released of the failed load balancing instance are queried from the load balancing database, and the security group ID of the corresponding backend server is also queried, so as to update the security group rules sent to the security group.

[0064] The access configuration unit 303 is used to automatically configure the corresponding security group ID according to the actual physical IP of the load balancing instance, the protocols and ports allowed to be released. In this embodiment, whether it is when adding a backend server or when a cloud balancing load fails, the access configuration unit 303 is used to automatically configure the corresponding security group ID according to the actual physical IP of the load balancing instance, the protocols and ports allowed to be released. Specifically, the access configuration unit 303 composes its security group rules with the actual physical IP of the load balancing instance corresponding to the security group ID, the protocols and ports allowed to be released, and writes the security group ID and the corresponding security group rules into the RDMAbuffer, so that the computing node can read the security group ID and the corresponding security group rules written in the RDMAbuffer, and automatically configure the security group ID according to the security group rules.

[0065] The deletion unit 304 is used to delete the actual physical IP of the failed load balancing instance and its corresponding protocols and ports that are allowed to be released. In the present invention, the new security group rules are used to automatically release the configuration of the security group ID, and the old security group rules of the security group ID are deleted at the same time, so that the backend server security group will not be unable to release traffic due to the change of the actual physical IP after the new load balancing instance is established, thereby ensuring the real-time flow of traffic after the failure.

[0066] In summary, the cloud load balancing security group automatic configuration system 300 of this embodiment can not only realize the automatic release configuration of its security group when adding a backend server, but also automatically update the security group rules of the security group corresponding to the failed load balancing instance when a cloud load balancing failure occurs, so as to realize automatic reconfiguration and ensure the automatic connection between the backend server and the cloud load balancing. The automatic configuration process relies on RDMA technology for message transmission, and the configuration response is more efficient and stable.

[0067] Reference Figure 6 , Figure 6 The following is a schematic block diagram of a cloud load balancing security group automatic configuration system 400 provided in accordance with the second embodiment of the present invention. Figure 6 As shown, the cloud load balancing security group automatic configuration system 400 of this embodiment includes a control node 401, a computing node 402 and at least one backend server 403, wherein the control node 401 includes a load balancer 4011 and a security group control plug-in 4012.

[0068] The load balancer 4011 is used to listen to the backend server add operation instruction, and in response to the backend server add operation instruction, search for the corresponding load balancing ID based on the preset balancing configuration rules, and obtain the information of the backend server to be added; the security group control plug-in 4012 is used to obtain the actual physical IP of the corresponding load balancing instance and the protocols and ports allowed to be released according to the load balancing ID, and obtain its corresponding security group ID according to the information of the backend server, and write the security group rules consisting of the actual physical IP of the load balancing instance corresponding to the security group ID, the protocols and ports allowed to be released into the RDMA buffer; the computing node 402 is used to read the security group ID and the corresponding security group rules written in the RDMA buffer, and send them to the security group of the backend server to be added; the backend server 403 automatically configures the corresponding security group ID to be released according to the security group rules written in the RDMA buffer read by the computing node 402, so as to realize the automatic connection configuration of the backend server 403 and the load balancer 4011.

[0069] It can be understood that the security group control plug-in 4012 is also used to obtain the actual physical IP of the new load balancing instance and the protocols and ports allowed to be released, that is, the new security group rules, according to the load balancing ID corresponding to the load balancing instance when the load balancer 4011 monitors the load balancing instance failure information, and query the actual physical IP of the failed load balancing instance, the corresponding protocols and ports allowed to be released, and the security group ID, that is, query the old security group rules, and write the new security group rules and the old security group rules into the RDMA buffer; the back-end server 403 automatically reconfigures the corresponding security group ID according to the new security group rules written into the RDMA buffer read by the computing node 402, and at the same time deletes the actual physical IP, protocols and ports allowed to be released corresponding to the security group ID before the failure according to the old security group rules, so as to realize the automatic and stable connection between the back-end server 403 and the load balancer 4011.

[0070] It should be noted that technical personnel in the relevant field can clearly understand that the specific implementation process of the above-mentioned cloud load balancing security group automatic configuration system and each unit or component can refer to the corresponding description in the aforementioned method embodiment. For the convenience and conciseness of the description, it will not be repeated here.

[0071] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 7 As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile and / or volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external client through a network connection. When the computer program is executed by the processor, the functions or steps on the server side of the cloud load balancing security group automatic configuration method are implemented.

[0072] In one embodiment, a computer device is provided. The computer device may be a client, and its internal structure diagram may be as follows: Figure 8As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external server through a network connection. When the computer program is executed by the processor, the functions or steps on the client side of the cloud load balancing security group automatic configuration method are implemented.

[0073] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0074] In response to the backend server adding operation instruction, the corresponding load balancing ID is searched based on the preset balancing configuration rule, and the information of the backend server to be added is obtained;

[0075] Obtain the actual physical IP address of the corresponding load balancing instance and the protocols and ports allowed to be opened according to the load balancing ID, and obtain the corresponding security group ID according to the information of the backend server;

[0076] According to the actual physical IP of the obtained load balancing instance, the protocols and ports allowed to be opened, the corresponding security group ID is automatically opened and configured to achieve secure access to the backend server to be added.

[0077] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0078] In response to the backend server adding operation instruction, the corresponding load balancing ID is searched based on the preset balancing configuration rule, and the information of the backend server to be added is obtained;

[0079] Obtain the actual physical IP address of the corresponding load balancing instance and the protocols and ports allowed to be opened according to the load balancing ID, and obtain the corresponding security group ID according to the information of the backend server;

[0080] According to the actual physical IP of the obtained load balancing instance, the protocols and ports allowed to be opened, the corresponding security group ID is automatically opened and configured to achieve secure access to the backend server to be added.

[0081] It should be noted that the above functions or steps that can be implemented by the computer-readable storage medium or computer device can refer to the relevant descriptions on the server side and the client side in the aforementioned method embodiment. To avoid repetition, they will not be described one by one here.

[0082] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0083] In the several embodiments provided by the present invention, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiment described in the first embodiment above is only illustrative. For example, the division of each unit is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0084] It should be further explained that in the above embodiments, the description of each embodiment has its own emphasis. For the parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. For the aforementioned method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described order of actions, because according to the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0085] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or substitutions within the technical scope disclosed by the present invention, and these modifications or substitutions should be included in the protection scope of the present invention.

Claims

1. A method for automatically configuring a cloud load balancing security group, characterized in that: include: In response to the backend server adding operation instruction, the corresponding load balancing ID is searched based on the preset balancing configuration rule, and the information of the backend server to be added is obtained; Obtain the actual physical IP address of the corresponding load balancing instance and the protocols and ports allowed to be opened according to the load balancing ID, and obtain the corresponding security group ID according to the information of the backend server; According to the actual physical IP of the obtained load balancing instance, the protocols and ports allowed to be opened, the corresponding security group ID is automatically opened and configured to achieve secure access to the backend server to be added.

2. The method for automatically configuring a cloud load balancing security group according to claim 1, wherein: The cloud load balancing security group automatic configuration method also includes: Monitor whether the load balancing instance fails. If the load balancing instance fails, obtain the actual physical IP address of the new load balancing instance and the protocols and ports allowed to be opened according to its corresponding load balancing ID. Query the actual physical IP address of the faulty load balancing instance, the corresponding protocols and ports allowed to be opened, and the security group ID; The security group ID is automatically configured to be open according to the actual physical IP of the new load balancing instance and the protocols and ports allowed to be opened, and the actual physical IP of the failed load balancing instance and its corresponding protocols and ports allowed to be opened are deleted.

3. The automatic configuration method of cloud load balancing security group according to claim 1 or 2, characterized in that: The automatic opening configuration of the corresponding security group ID according to the actual physical IP of the load balancing instance obtained, the protocol and port allowed to be opened, specifically includes: The actual physical IP address of the load balancing instance corresponding to the security group ID, the protocols and ports allowed to be opened, form its security group rules; Writing the security group ID and the corresponding security group rules into RDMAbuffer; The control computing node reads the security group ID and the corresponding security group rules written in the RDMA buffer so as to automatically open the configuration of the security group ID according to the security group rules.

4. The method for automatically configuring a cloud load balancing security group according to claim 1, wherein: The step of obtaining the actual physical IP address of the corresponding load balancing instance and the protocols and ports allowed to be opened according to the load balancing ID specifically includes: Obtaining a backend server resource pool ID from a load balancing database according to the load balancing ID, and then obtaining a protocol and port allowed to be opened according to the backend server resource pool ID; According to the load balancing ID, the corresponding load balancing instance is queried from the load balancing database, and its actual physical IP is obtained.

5. The method for automatically configuring a cloud load balancing security group according to claim 1, wherein: The obtaining the corresponding security group ID according to the information of the backend server specifically includes: The port ID of the backend server is obtained from the load balancing database according to the backend server ID and IP in the information of the backend server, and then the security group ID bound to the port ID is obtained according to the query of the port ID.

6. The method for automatically configuring a cloud load balancing security group according to claim 1, wherein: After implementing the secure access of the back-end server to be added, the method further includes: monitoring access traffic, and distributing the access traffic to the corresponding back-end server according to a preset balancing configuration rule.

7. A cloud load balancing security group automatic configuration system, characterized in that: include: A monitoring and obtaining unit, configured to monitor service information, and if the service information is a backend server adding operation instruction, then in response to the backend server adding operation instruction, search for a corresponding load balancing ID based on a preset balancing configuration rule, and obtain information of a backend server to be added; A query acquisition unit, used to acquire the actual physical IP address of the corresponding load balancing instance and the protocols and ports allowed to be opened according to the load balancing ID, and acquire the corresponding security group ID according to the information of the backend server; The access configuration unit is used to automatically configure the corresponding security group ID according to the actual physical IP of the load balancing instance obtained, the protocol allowed to be opened, and the port, so as to achieve secure access to the backend server to be added.

8. A cloud load balancing security group automatic configuration system, characterized in that: It includes a control node, a computing node and a backend server, wherein the control node includes a load balancer and a security group control plug-in; wherein, The load balancer is used to monitor the backend server adding operation instruction, respond to the backend server adding operation instruction, search for the corresponding load balancing ID based on the preset balancing configuration rule, and obtain the information of the backend server to be added; The security group control plug-in is used to obtain the actual physical IP of the corresponding load balancing instance and the protocols and ports allowed to be opened according to the load balancing ID, and obtain the corresponding security group ID according to the information of the backend server, and write the security group rules consisting of the actual physical IP of the load balancing instance corresponding to the security group ID, the protocols and ports allowed to be opened into the RDMA buffer; The backend server automatically configures the corresponding security group ID according to the security group rules written into the RDMA buffer read by the computing node, so as to realize the automatic connection configuration between the backend server and the load balancer.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the cloud load balancing security group automatic configuration method as described in any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method for automatically configuring a cloud load balancing security group as described in any one of claims 1 to 6 are implemented.

Images