Data packet processing method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a data packet processing method and device, electronic equipment and a storage medium, which are applied to an internal load balancing node of a service cluster, and the specific method comprises the following steps: receiving a request data packet forwarded by an external load balancing node of the service cluster through a service exposure port of the internal load balancing node, the request data packet is initiated by the client and sent to an external load balancing node; analyzing a header standard field of the request data packet to obtain address information of the client, and analyzing a header selectable field of the request data packet to obtain address information of an external load balancing node; forwarding the request data packet to the container instance, and obtaining a response data packet fed back by the container instance after processing the request data packet; address conversion processing is carried out on the response data packet, so that source address information of the response data packet is address information of the external load balancing node, and destination address information of the response data packet is address information of the client; and sending the converted response data packet to the client through the service exposure port.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of network communication technology, and in particular to a data packet processing method, device, electronic device and storage medium. Background Art

[0002] There are currently two types of networks for clusters built based on data centers: physical networks (underlay) and virtual networks (overlay). A physical network is composed of various physical devices connected by physical links. In a physical network, the network topology of the cluster is flat, the addresses within the cluster are visible to the outside, and the inside and outside of the cluster can communicate directly with each other. A virtual network is a virtual logical network built on top of a physical network using technologies such as tunnel encapsulation. Since the virtual network runs on top of the physical network and is encapsulated using tunnel technology, the addresses within the cluster are not visible to the outside, and the inside and outside of the cluster cannot communicate directly with each other.

[0003] In the process of implementing the present invention, the inventors found that if a cluster built with a virtual network is to be used for centralized load balancing, since the cluster cannot communicate directly with the outside world, an external load balancer is needed. Bidirectional data packet processing is required on the external load balancer, which introduces additional network delays and resource consumption. The processing capacity of the external load balancer will become a system bottleneck, resulting in poor performance. Summary of the invention

[0004] The embodiments of the present invention provide a data packet processing method, device, electronic device and storage medium, which can realize centralized load balancing in a cluster constructed by a virtual network by adopting a direct return mode without the need for external load balancing node packet return, thereby improving network performance.

[0005] In a first aspect, a data packet processing method provided by an embodiment of the present invention is applied to an internal load balancing node of a service cluster, wherein the internal load balancing node includes a service exposure port, and the data packet processing method includes:

[0006] Receive a request data packet forwarded by an external load balancing node of the service cluster through the service exposure port, wherein the request data packet is initiated by a client and sent to the external load balancing node;

[0007] Parsing the standard header field of the request data packet to obtain the address information of the client, and parsing the optional header field of the request data packet to obtain the address information of the external load balancing node;

[0008] Forwarding the request data packet to the mounted container instance, and obtaining a response data packet fed back by the container instance after processing the request data packet;

[0009] Performing address conversion processing on the response data packet so that the source address information of the response data packet is the address information of the external load balancing node, and the destination address information of the response data packet is the address information of the client;

[0010] The converted response data packet is sent to the client through the service exposure port.

[0011] In a second aspect, a data packet processing device provided by an embodiment of the present invention is applied to an internal load balancing node of a service cluster, wherein the internal load balancing node includes a service exposure port, and the data packet processing device includes:

[0012] A receiving module, configured to receive a request data packet forwarded by an external load balancing node of a service cluster through the service exposure port, wherein the request data packet is initiated by a client and sent to the external load balancing node;

[0013] A parsing module, used for parsing the standard header field of the request data packet to obtain the address information of the client, and parsing the optional header field of the request data packet to obtain the address information of the external load balancing node;

[0014] A transmission module, used to forward the request data packet to the mounted container instance, and obtain a response data packet fed back by the container instance after processing the request data packet;

[0015] An address conversion module, used to perform address conversion processing on the response data packet, so that the source address information of the response data packet is the address information of the external load balancing node, and the destination address information of the response data packet is the address information of the client;

[0016] The sending module is used to send the converted response data packet to the client through the service exposure port.

[0017] In a third aspect, an electronic device provided by an embodiment of the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and when the processor executes the program, a data packet processing method as in any embodiment of the present invention is implemented.

[0018] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, a data packet processing method as in any embodiment of the present invention is implemented.

[0019] In an embodiment of the present invention, the service provided by the container instance mounted on the node in the service cluster is exposed to the outside through a fixed port (i.e., a service exposure port) on the node in the cluster, and the service provided by the container instance mounted in the service cluster can be accessed from outside the cluster through the service exposure port; after receiving the external request data packet, the internal load balancing node will parse and obtain the original source address information and the original destination address information of the request data packet, the original source address information is the address information of the client, and the original destination address information is the address information of the external load balancing node, which can ensure the correctness of the response path; after the request data packet is forwarded within the cluster and the response data packet is processed by the container instance, the external load balancing node can be simulated to perform address conversion to ensure that the response data packet has the correct source address and destination address; the converted response data packet is sent to the client through the service exposure port, and the return packet bypasses the external load balancing node, reducing the dependence on the external load balancing node, avoiding the two-way processing burden of the external load balancing node, reducing network delay and resource consumption, and improving processing efficiency; the internal load balancing node directly processes the request data packet and transmits the response data packet back, reducing unnecessary network hops, optimizing the path, and further reducing delay. In a cluster constructed by a virtual network, the present invention allows each node to expose services through its service exposure port. Even if the internal network address is invisible, external requests can still be correctly forwarded to the container instance mounted on the node in the cluster for processing through service exposure port mapping. When the response data packet is returned, the internal load balancing node can correctly understand and plan the return packet path by parsing the client address information and the address information of the external load balancing node obtained when parsing the request data packet, and directly feed back the return packet to the client through the service exposure port. The return packet does not need to rely on an external load balancing node. Therefore, the solution provided by the embodiment of the present invention can be implemented in a cluster constructed by a virtual network, using a direct return mode that does not require the help of an external load balancing node to return the packet for centralized load balancing. The present invention decouples the load balancing strategy from the network type and utilizes the service exposure port, data packet header parsing technology and network address translation technology to achieve unified support for building clusters of physical networks and virtual networks. It is applicable to a variety of network types and allows service clusters of multiple different types of networks to share the same external load balancing node, thereby reducing the number of external load balancing nodes required, saving hardware resources, simplifying network topology and configuration, and reducing management complexity. The sharing of external load balancing nodes achieves centralized load balancing management and optimization, improves the consistency and reliability of the system, and reduces the difficulty and cost of operation and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solution of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 It is a flow chart of a data packet processing method provided by an embodiment of the present invention;

[0022] Figure 2 It is a schematic diagram of the architecture of the load balancing node of the cluster provided by an embodiment of the present invention;

[0023] Figure 3 is an example diagram of a data packet processing method provided by an embodiment of the present invention;

[0024] Figure 4 is a structural schematic diagram of a data packet processing device provided by an embodiment of the present invention;

[0025] Figure 5 It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Figure 1It is a flow chart of the data packet processing method provided by an embodiment of the present invention. The data packet processing method provided by an embodiment of the present invention can be applied to the scenario where a cluster constructed by a virtual network provides services to the outside, such as data query services, data download services, etc. The data packet processing method can be executed by the data packet processing device provided by an embodiment of the present invention, and the device can be implemented in software and / or hardware. In a specific embodiment, the device can be integrated into an electronic device, and the electronic device can be an internal load balancing node of a service cluster, specifically a computer, a server, etc. The following embodiment is explained by taking the example of integrating the data packet processing device into the internal load balancing node of the service cluster. The internal load balancing node can expose the services provided by the container instance mounted on the back end through the service exposure port, and the service exposure port can be a nodeport. See. Figure 1 The data packet processing method of this embodiment may include the following steps:

[0029] Step 101: Receive a request data packet forwarded by an external load balancing node of a service cluster through a service exposure port. The request data packet is initiated by a client and sent to the external load balancing node.

[0030] A service cluster can be a collection of service instances consisting of multiple container instance Pods in a container orchestration system. These instances can be copies of the same application, distributed on multiple nodes to achieve load balancing and high availability. An internal load balancing node, also known as a distributed load balancing node, is deployed inside a service cluster and is responsible for distributing traffic and requests between different nodes, machines or containers within the cluster, with the goal of achieving efficient resource utilization and load sharing within the cluster. In this embodiment, the internal load balancing node is responsible for distributing requests from the outside to the internally mounted container instances, and for feeding back the processing results of the internally mounted container instances on the requests. There can be one or more internal load balancing nodes, and multiple container instances can be mounted on each internal load balancing node. An external load balancing node, also known as a centralized load balancing node, is deployed outside a service cluster, for example, at the entrance of a cluster, and is responsible for distributing traffic and requests from the outside to each service cluster. There can also be one or more external load balancing nodes.

[0031] Specifically in this embodiment, the service cluster can be implemented using a virtual network Overlay. Since the address information of the container instance mounted on the node in the cluster is not visible to the outside in the virtual network, a service exposure port nodeport can be set on the internal load balancing node. The service exposure port is a port used to expose the services provided by the container instance in the cluster, so as to expose the services provided by the container instance mounted on the internal node to the outside through the service exposure port. The service exposure port provides services to the outside through a specific range of ports (e.g., 30000-32767) on the underlying physical network, so that external traffic can enter the cluster through this port.

[0032] The client can be a user's mobile phone, tablet computer, personal computer, etc. A request data packet refers to a network request initiated from the client, which is encapsulated into a data packet during the transmission process. The request data packet can be used to request to query the required data, download the required data, etc. The request data packet contains the request data (i.e. the specific content of the request) and the header field. The header field can include the standard header field and the optional header field. The standard header field is a necessary field defined in the communication protocol, which contains the basic information of the data message, such as the source address information (i.e. the source address and port number) and the destination address information (i.e. the destination address and port number), and is the key part to ensure that the communication can proceed. The optional header field is defined as an optional field in the protocol specification, which provides additional information or features so that more context or control information can be transmitted during the communication process.

[0033] Specifically in this embodiment, when the user corresponding to the client has a query demand, a download demand, etc., a request data packet can be initiated. At this time, the source address information carried in the standard field of the request data packet header is the address information of the client, that is, the Internet Protocol Address (IP) and port number port of the client, and the destination address information is the address information of the external load balancing node. After the external load balancing node receives the request data packet, it can query its own routing configuration information to determine the internal load balancing node to which the request data packet is to be forwarded, and perform a destination address translation (Destination Network Address Translation, DNAT) on the request data packet according to the determined internal load balancing node, that is, the target address information carried in the standard field of the request data packet header is converted from its own address information to the address information of the internal load balancing node, and the source address information of the request data packet is kept unchanged as the address information of the client. Since the internal load balancing node uses the service exposure port to expose the service to the outside, the address information of the internal load balancing node carried here can be the address information of the service exposure port on the internal load balancing node. In addition, the external load balancing node can also carry its own address information in the optional field of the header of the request data packet to facilitate the subsequent cluster to return the packet to the outside. The request data packet after address information conversion is forwarded to the internal load balancing node, and the internal load balancing node receives the request data packet forwarded by the external load balancing node through the service exposure port.

[0034] Step 102: parse the standard header field of the request data packet to obtain the address information of the client, and parse the optional header field of the request data packet to obtain the address information of the external load balancing node.

[0035] The address information of the client may include the IP address and port number of the client, and the address information of the external load balancing node may include the IP address and port number of the external load balancing node. At this time, the source address information carried by the standard field in the header of the request data packet is the address information of the client, and the destination address information is the address information of the service exposed port on the internal load balancing node. The internal load balancing node can save the address information of the client as the initial source address information of the request data packet, and save the address information of the external load balancing node as the initial destination address information of the request data packet, so as to facilitate subsequent packet return.

[0036] After parsing the header field of the request data packet, the internal load balancing node can learn the external transmission path of the request data packet, that is, the external transmission path is: client-external load balancing node-internal load balancing node.

[0037] Step 103: forward the request data packet to the mounted container instance, and obtain a response data packet fed back by the container instance after processing the request data packet.

[0038] The internal load balancing node can query its own routing configuration information to determine which mounted container instance to forward the request data packet to, and forward the request data packet to the corresponding container instance based on the determination result. Since the internal load balancing node has recorded the original source address information and the original destination address information of the request data packet, the optional header field of the request data packet is no longer useful, so the optional header field of the request data packet can be removed, and the request data packet after the optional header field is removed is sent to the container instance after address conversion.

[0039] At this point, the internal load balancing node learns the internal transmission path of the request data packet, that is, the internal transmission path is: internal load balancing node-container instance. The internal load balancing node can generate path tracking mapping information based on the external transmission path and the internal transmission path. The path tracking mapping information may include mapping information of the transmission path of the request data packet from the client to the container instance and mapping information of the transmission path of the response data packet from the container instance to the client.

[0040] Container instance is the most basic execution unit in the container technology solution. It packages the application and its dependencies together to provide a lightweight, isolated, easy-to-manage and efficient resource-utilizing operating environment. After receiving the request data packet, the container instance can perform corresponding operations or calculations on the request data packet, such as querying the database, executing calculation logic, etc., to provide corresponding services or data. The response data packet refers to the response generated by the service instance after processing the received request data packet. The response data packet includes the processing result, which may include the status code, response content and data, etc. The source address information carried by the standard field in the header of the response data packet can be the address information of the container instance, and the destination address information can be the address information of the service exposure port on the internal load balancing node.

[0041] Step 104: performing address translation processing on the response data packet so that the source address information of the response data packet is the address information of the external load balancing node, and the destination address information of the response data packet is the address information of the client.

[0042] The address translation strategy of the response data packet can be determined based on the generated path tracking mapping information. The address translation strategy may include source address translation and destination address translation. The source address information and destination address information of the response data packet are gradually converted according to the address translation strategy, so that the final source address information of the response data packet is the address information of the external load balancing node, and the final destination address information is the address information of the client.

[0043] Step 105: Send the converted response data packet to the client through the service exposure port.

[0044] Since the internal load balancing node has a service exposure port, which is visible to the outside of the cluster, after the response data packet is converted, the converted response data packet can be directly sent to the client using the service exposure port, thereby bypassing the external load balancing node. However, the source address information of the response data packet seen by the client is the address information of the external load balancing node, and the destination address information is the address information of the client. That is, for the client, it will think that the path of sending the packet and the path of returning the packet are completely opposite, and these paths are connected. Therefore, the request data packet can still be sent to the external load balancing node next time to obtain the required service or data.

[0045] In this embodiment, the service provided by the container instance mounted on the node in the service cluster is exposed to the outside through the fixed port (i.e., the service exposure port) on the node in the cluster, and the service provided by the container instance mounted in the service cluster can be accessed from outside the cluster through the service exposure port; after receiving the external request data packet, the internal load balancing node will parse and obtain the original source address information and the original destination address information of the request data packet, the original source address information is the address information of the client, and the original destination address information is the address information of the external load balancing node, which can ensure the correctness of the response path; after the request data packet is forwarded within the cluster and the response data packet is processed by the container instance, the external load balancing node can be simulated to perform address conversion to ensure that the response data packet has the correct source address and destination address; the converted response data packet is sent to the client through the service exposure port, bypassing the external load balancing node, reducing the dependence on the external load balancing node, avoiding the two-way processing burden of the external load balancing node, reducing network delay and resource consumption, and improving processing efficiency; the internal load balancing node directly processes the request data packet and transmits the response data packet back, reducing unnecessary network hops, optimizing the path, and further reducing delay. In a cluster constructed by a virtual network, the present invention allows each node to expose services through its service exposure port. Even if the internal network address is invisible, external requests can still be correctly forwarded to the container instance mounted on the node in the cluster for processing through service exposure port mapping. When the response data packet is returned, the internal load balancing node can correctly understand and plan the return packet path by parsing the client address information and the address information of the external load balancing node obtained when parsing the request data packet, and directly feed back the return packet to the client through the service exposure port. That is, the solution provided by the embodiment of the present invention can be implemented in a cluster constructed by a virtual network, using a direct return mode that does not require the help of an external load balancing node to return packets for centralized load balancing. The present invention decouples the load balancing strategy from the network type and utilizes the service exposure port, data packet header parsing technology and network address translation technology to achieve unified support for building clusters of physical networks and virtual networks. It is applicable to a variety of network types and allows clusters of multiple different types of networks to share the same external load balancing node, thereby reducing the number of external load balancing nodes required, saving hardware resources, simplifying network topology and configuration, and reducing management complexity. The sharing of external load balancing nodes achieves centralized load balancing management and optimization, improves the consistency and reliability of the system, and reduces the difficulty and cost of operation and maintenance.

[0046] Since there can be multiple internal load balancing nodes in a service cluster, when there are multiple internal load balancing nodes, the request data packets received by a certain internal load balancing node can be forwarded to the container instance mounted on itself for processing, or forwarded to the container instance mounted on other load balancing nodes for processing. The virtual local area network (VXLAN) where the container instance is located has a virtual tunnel endpoint (VXLAN Tunnel Endpoints, VTEP). The virtual tunnel endpoint expands the network scale and realizes cross-host communication between virtual machines by overlaying a virtual network on the traditional data center network. For easy distinction, the current internal load balancing node can be named the first load balancing node, and the other internal load balancing nodes can be named the second load balancing node. The virtual local area network where the container instance mounted on the first load balancing node is located has a first virtual tunnel endpoint, and the virtual local area network where the container instance mounted on the second load balancing node is located has a second virtual tunnel endpoint. If the container instance mounted on the first load balancing node and the container instance mounted on the second load balancing node are in the same virtual LAN, the first virtual tunnel endpoint and the second virtual tunnel endpoint can be the same; if the container instance mounted on the first load balancing node and the container instance mounted on the second load balancing node are not in the same virtual LAN, the first virtual tunnel endpoint and the second virtual tunnel endpoint will not be the same.

[0047] If the first load balancing node forwards the request data packet to the container instance mounted on itself for processing, the specific implementation process can be as follows:

[0048] After receiving the request data packet through the service exposure port, the first load balancing node can convert the destination address information carried in the header standard field of the request data packet from the address information of the service exposure port of the first load balancing node to the address information of the container instance mounted on the first load balancing node; convert the source address information carried in the header standard field of the request data packet from the address information of the client to the address information of the first virtual tunnel endpoint; and forward the converted request data packet to the container instance mounted on the first load balancing node. After the container instance processes the request data packet, it generates a response data packet.

[0049] The first load balancing node can convert the destination address information carried in the standard field of the header of the response data packet from the address information of the first virtual tunnel endpoint to the address information of the client; convert the source address information carried in the standard field of the header of the response data packet from the address information of the container instance mounted on the first load balancing node to the address information of the service exposure port of the first load balancing node; further, the source address information carried in the standard field of the header of the response data packet can be converted from the address information of the service exposure port of the first load balancing node to the address information of the external load balancing node. Ultimately, the source address information of the response data packet is the address information of the external load balancing node, and the destination address information of the response data packet is the address information of the client. The converted response data packet is sent to the client through the service exposure port.

[0050] If the first load balancing node forwards the request data packet to the container instance mounted by other internal load balancing nodes for processing, and the other internal load balancing node is the second load balancing node, the specific implementation process can be as follows:

[0051] Since packets are forwarded across nodes, VXLAN encapsulation is required for the packets.

[0052] After receiving the request data packet through the service exposure port, the first load balancing node can parse the request data packet to obtain the request data, and perform inner and outer encapsulation on the request data, i.e., VXLAN encapsulation; the inner encapsulation of the request data includes: encapsulating the inner source address information into the address information of the second virtual tunnel endpoint and the inner destination address information into the address information of the container instance mounted on the second load balancing node; the outer encapsulation of the request data includes: encapsulating the outer source address information into the address information of the service exposure port of the first load balancing node and the outer destination address information into the address information of the service exposure port of the second load balancing node; and forwarding the encapsulated request data to the container instance mounted on the second load balancing node. After the container instance decapsulates and processes the request data packet, a response data packet is generated.

[0053] The second load balancing node can parse the response data packet to obtain response data, and perform inner and outer encapsulation on the response data, wherein the outer encapsulation includes: encapsulating the outer source address information into the address information of the service exposure port of the second load balancing node and encapsulating the outer destination address information into the address information of the service exposure port of the first load balancing node, and the inner encapsulation includes: encapsulating the inner source address information into the address information of the container instance mounted by the second load balancing node and encapsulating the inner destination address information into the address information of the second virtual tunnel endpoint. The encapsulated response data packet is forwarded to the first load balancing node.

[0054] The first load balancing node can remove the outer encapsulation of the response data packet, convert the destination address information of the inner encapsulation of the response data packet from the address information of the second virtual tunnel endpoint to the address information of the client, and convert the source address information of the inner encapsulation of the response data packet from the address information of the container instance mounted by the second load balancing node to the address information of the service exposure port of the second load balancing node. Further, the first load balancing node can convert the source address information of the inner encapsulation of the response data packet from the address information of the service exposure port of the second load balancing node to the address information of the service exposure port of the first load balancing node; convert the source address information of the inner encapsulation of the response data packet from the address information of the service exposure port of the first load balancing node to the address information of the external load balancing node. Finally, the source address information of the response data packet is the address information of the external load balancing node, and the destination address information of the response data packet is the address information of the client. The first load balancing node sends the converted response data packet to the client through the service exposure port.

[0055] The following introduces the architecture of the load balancing node of the cluster. The cluster can be a cluster built by a virtual network, such as Figure 2 As shown, internal load balancing nodes and external load balancing nodes may be included.

[0056] There are two working modes for external load balancing nodes, Direct Server Return (DSR) and Full Network Address Translation (Full-NAT). In direct return mode, the return packet does not need to rely on an external load balancing node. The specific process may include: the client request first reaches the external load balancer, the external load balancer forwards the request to the backend server according to the configuration, and the backend server directly returns the response data packet to the client without passing through the external load balancer. In full address translation mode, the return packet needs to rely on an external load balancing node. The specific process may include: the client request reaches the external load balancer, the external load balancer converts the destination address information of the request packet into the address information of the backend server, and then sends the data packet to the backend server, the backend server sends the response data packet back to the external load balancer, the external load balancer converts the source address information of the response data packet back to the address information of the external load balancer, and finally the external load balancer sends the response data packet to the client.

[0057] Specifically in this embodiment, the external load balancing node can switch to the direct return mode under the trigger of the user operation. In the direct return mode, the external load balancing node can generate data forwarding rules according to the configured routing rules, and store the data forwarding rules in the service mapping information. The ingress flow control can mount a data packet filter program, and the data packet filter program is used to query the data forwarding rules stored in the service mapping information when processing the request data packet, so as to perform destination address conversion on the request data packet.

[0058] The internal load balancing node will also generate data forwarding rules based on the configured routing rules. Both the ingress traffic control and egress traffic control can mount packet filtering programs. The packet filtering program is used to query the data forwarding rules to process the packets transmitted internally and externally, including: translating the source address and destination address of the packets, generating path tracking mapping information based on the transmission path of the packets, etc.

[0059] The following example illustrates a method for processing a data packet provided by an embodiment of the present invention. Figure 3 As shown, it is assumed that the internal load balancing nodes of the service cluster include node 1 and node 2, node 1 mounts container instance 1 (i.e. pod1) and container instance 2 (i.e. pod2), node 2 mounts container instance 3 (i.e. pod3) and container instance 4 (i.e. pod4), and the client needs to access pod1 and pod3 to obtain services or data.

[0060] The address information of the client is A, the address information of the external load balancing node is B, the address information of the service exposure port of node 1 is C1, the address information of the virtual tunnel endpoint VTEP of the virtual LAN where pod1 is located is D1, the address information of pod1 is E1, the address information of the service exposure port of node 2 is C2, the address information of the virtual tunnel endpoint VTEP of the virtual LAN where pod3 is located is D2, and the address information of pod3 is E2.

[0061] The client initiates a request data packet, the source address information is A, the destination address information is B, that is, A->B. After the request data packet reaches the external load balancing node, the external load balancing node queries the data forwarding rules. Assume that the data forwarding rules of the external load balancing node are as shown in Table 1 below:

[0062] External LB address information protocol Destination address information B TCP C1

[0063] Table 1

[0064] The external load balancing node converts the destination address information of the request data packet from B to C1, that is, A->C1, and adds its own address information B to the optional field of the header of the request data packet and sends it to node 1.

[0065] After receiving the request data packet, node 1 can query its own data forwarding rules. Assume that the data forwarding rules of node 1 are as shown in Table 2 below:

[0066] The address information of the service exposure port of node 1 protocol Destination address information C1 TCP E1 C1 TCP E2

[0067] Table 2

[0068] Then node 1 can forward the request data packet to container instance 1 and container instance 3 respectively. When forwarding, the optional header field can be removed. When forwarding to container instance 1, the destination address information of the request data packet can be first converted from C1 to E1, that is, A->E1, and then the source address information of the request data packet can be converted from A to D1, that is, D1->E1. After the conversion, the request data packet is forwarded to container instance 1.

[0069] Node 1 may generate path tracking mapping information according to the forwarding path of the request data packet. The generated path tracking mapping information may be shown in Table 3 below:

[0070]

[0071]

[0072] Table 3

[0073] After container instance 1 processes the request data packet, it generates a response data packet. The source address information of the response data packet is E1, and the destination address information is D1, that is, E1->D1. Node 1 can query the path tracking mapping information, convert the destination address information of the response data packet from D1 to A, that is, E1->A, convert the source address information of the response data packet from E1 to C1, that is, C1->A, and finally convert the source address information of the response data packet from C1 to B, that is, B->A. After the conversion, node 1 sends the data packet to the client through its own service exposure port without passing through the external load balancing node.

[0074] When node 1 forwards the request data packet to container instance 3, due to cross-node forwarding, the request data packet needs to be VXLAN encapsulated. The inner address of the request data packet can be D2->E2, and the outer address can be C1->C2. After container instance 3 of node 2 processes the request data packet, it generates a response data packet. The response data packet return process can refer to the previous description and will not be repeated here.

[0075] Figure 4 is a schematic diagram of a structure of a data packet processing device provided in an embodiment of the present invention, and the device is suitable for executing a data packet processing method provided in an embodiment of the present invention, such as Figure 4 As shown, the device may specifically include:

[0076] The receiving module 401 is used to receive a request data packet forwarded by an external load balancing node of the service cluster through the service exposure port, wherein the request data packet is initiated by the client and sent to the external load balancing node;

[0077] A parsing module 402, configured to parse a standard header field of the request data packet to obtain address information of the client, and parse an optional header field of the request data packet to obtain address information of the external load balancing node;

[0078] The transmission module 403 is used to forward the request data packet to the mounted container instance, and obtain a response data packet fed back by the container instance after processing the request data packet;

[0079] The address conversion module 404 is used to perform address conversion processing on the response data packet so that the source address information of the response data packet is the address information of the external load balancing node, and the destination address information of the response data packet is the address information of the client;

[0080] The sending module 405 is used to send the converted response data packet to the client through the service exposure port.

[0081] In one embodiment, the transmission module 403 forwards the request data packet to the mounted container instance, including:

[0082] Removing the optional header field of the request data packet;

[0083] Forward the request data packet after removing the optional header fields to the container instance.

[0084] In one embodiment, the transmission module 403 forwards the request data packet to the mounted container instance, including:

[0085] The request data packet is forwarded to the container instance mounted on the internal load balancing node, and / or the request data packet is forwarded to the container instance mounted on other internal load balancing nodes.

[0086] In one embodiment, the virtual local area network where the container instance mounted on the internal load balancing node is located has a first virtual tunnel endpoint, and the transmission module 403 forwards the request data packet to the container instance mounted on the internal load balancing node, including:

[0087] Convert the destination address information carried in the standard field of the header of the request data packet from the address information of the service exposure port of the internal load balancing node to the address information of the container instance mounted on the internal load balancing node;

[0088] Convert the source address information carried in the standard field of the header of the request data packet from the address information of the client to the address information of the first virtual tunnel endpoint;

[0089] The converted request data packet is forwarded to the container instance mounted on the internal load balancing node.

[0090] In one embodiment, before performing address conversion processing on the response data packet, the address conversion module 404 is further configured to:

[0091] Convert the destination address information carried in the standard field of the header of the response data packet from the address information of the first virtual tunnel endpoint to the address information of the client;

[0092] The source address information carried in the standard field of the header of the response data packet is converted from the address information of the container instance mounted on the internal load balancing node to the address information of the service exposure port of the internal load balancing node.

[0093] In one embodiment, the other internal load balancing node also includes a service exposure port, the virtual local area network where the container instance mounted by the other internal load balancing node is located has a second virtual tunnel endpoint, and the transmission module 403 forwards the request data packet to the container instance mounted by the other internal load balancing node, including:

[0094] Parsing the request data packet to obtain request data, and performing inner and outer encapsulation on the request data; performing inner encapsulation on the request data includes: encapsulating the inner source address information into the address information of the second virtual tunnel endpoint and encapsulating the inner destination address information into the address information of the container instance mounted by the other internal load balancing node, and performing outer encapsulation on the request data includes: encapsulating the outer source address information into the address information of the service exposure port of the internal load balancing node and encapsulating the outer destination address information into the address information of the service exposure port of the other internal load balancing node;

[0095] The encapsulated request data is forwarded to the container instance mounted on the other internal load balancing node.

[0096] In one embodiment, before performing address conversion processing on the response data packet, the address conversion module 404 is further configured to:

[0097] Removing the outer encapsulation of the response data packet;

[0098] Convert the destination address information encapsulated in the inner layer of the response data packet from the address information of the second virtual tunnel endpoint to the address information of the client;

[0099] The source address information of the inner layer encapsulation of the response data is converted from the address information of the container instance mounted by the other internal load balancing node to the address information of the service exposure port of the other internal load balancing node.

[0100] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example for illustration. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the functional modules described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0101] The device of the embodiment of the present invention exposes the service provided by the container instance mounted on the node in the service cluster to the outside through the fixed port (i.e., the service exposure port) on the node in the cluster, and the service provided by the container instance mounted in the service cluster can be accessed from outside the cluster through the service exposure port; after receiving the external request data packet, the internal load balancing node will parse and obtain the original source address information and the original destination address information of the request data packet, the original source address information is the address information of the client, and the original destination address information is the address information of the external load balancing node, which can ensure the correctness of the response path; after the request data packet is forwarded within the cluster and the response data packet is processed by the container instance, the external load balancing node can be simulated to perform address conversion to ensure that the response data packet has the correct source address and destination address; the converted response data packet is sent to the client through the service exposure port, bypassing the external load balancing node, reducing the dependence on the external load balancing node, avoiding the two-way processing burden of the external load balancing node, reducing network delay and resource consumption, and improving processing efficiency; the internal load balancing node directly processes the request data packet and transmits the response data packet back, reducing unnecessary network hops, optimizing the path, and further reducing delay. In a cluster constructed by a virtual network, the present invention allows each node to expose services through its service exposure port. Even if the internal network address is invisible, external requests can still be correctly forwarded to the container instance mounted on the node in the cluster for processing through service exposure port mapping. When the response data packet is returned, the internal load balancing node can correctly understand and plan the return packet path by parsing the client address information and the address information of the external load balancing node obtained when parsing the request data packet, and directly feed back the return packet to the client through the service exposure port. That is, the solution provided by the embodiment of the present invention can be implemented in a cluster constructed by a virtual network, using a direct return mode that does not require the help of an external load balancing node to return packets for centralized load balancing. The present invention decouples the load balancing strategy from the network type and utilizes the service exposure port, data packet header parsing technology and network address translation technology to achieve unified support for building clusters of physical networks and virtual networks. It is applicable to a variety of network types and allows clusters of multiple different types of networks to share the same external load balancing node, thereby reducing the number of external load balancing nodes required, saving hardware resources, simplifying network topology and configuration, and reducing management complexity. The sharing of external load balancing nodes achieves centralized load balancing management and optimization, improves the consistency and reliability of the system, and reduces the difficulty and cost of operation and maintenance.

[0102] An embodiment of the present invention further provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the video processing method provided in any of the above embodiments when executing the program.

[0103] An embodiment of the present invention further provides a computer-readable medium on which a computer program is stored. When the program is executed by a processor, the data packet processing method provided by any of the above embodiments is implemented.

[0104] Reference below Figure 5 , which shows a schematic diagram of the structure of a computer system 500 of an electronic device suitable for implementing an embodiment of the present invention. Figure 5 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0105] like Figure 5 As shown, the computer system 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the computer system 500 are also stored. The CPU 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0106] The following components are connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, etc.; an output section 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage section 508 as needed.

[0107] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the central processing unit (CPU) 501, the above-mentioned functions defined in the system of the present invention are executed.

[0108] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0109] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0110] The modules and / or units involved in the embodiments of the present invention may be implemented in software or hardware. The modules and / or units described may also be arranged in a processor. For example, it may be described as follows: a processor includes a receiving module, a parsing module, a transmission module, an address conversion module, and a sending module. The names of these modules do not, in some cases, constitute limitations on the modules themselves.

[0111] As another aspect, the present invention further provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device includes:

[0112] Receive a request data packet forwarded by an external load balancing node of the service cluster through the service exposure port, wherein the request data packet is initiated by a client and sent to the external load balancing node; parse the standard field of the header of the request data packet to obtain the address information of the client, and parse the optional field of the header of the request data packet to obtain the address information of the external load balancing node; forward the request data packet to the mounted container instance, and obtain a response data packet fed back by the container instance after processing the request data packet; perform address conversion on the response data packet so that the source address information of the response data packet is the address information of the external load balancing node, and the destination address information of the response data packet is the address information of the client; and send the converted response data packet to the client through the service exposure port.

[0113] According to the technical solution of the embodiment of the present invention, the service provided by the container instance mounted on the node in the service cluster is exposed to the outside through the fixed port (i.e., the service exposure port) on the node in the cluster, and the service provided by the container instance mounted in the service cluster can be accessed from outside the cluster through the service exposure port; after receiving the external request data packet, the internal load balancing node will parse and obtain the original source address information and the original destination address information of the request data packet, the original source address information is the address information of the client, and the original destination address information is the address information of the external load balancing node, which can ensure the correctness of the response path; after the request data packet is forwarded within the cluster and the response data packet is processed by the container instance, the external load balancing node can be simulated to perform address conversion to ensure that the response data packet has the correct source address and destination address; the converted response data packet is sent to the client through the service exposure port, bypassing the external load balancing node, reducing the dependence on the external load balancing node, avoiding the two-way processing burden of the external load balancing node, reducing network delay and resource consumption, and improving processing efficiency; the internal load balancing node directly processes the request data packet and transmits the response data packet back, reducing unnecessary network hops, optimizing the path, and further reducing delay. In a cluster constructed by a virtual network, the present invention allows each node to expose services through its service exposure port. Even if the internal network address is invisible, external requests can still be correctly forwarded to the container instance mounted on the node in the cluster for processing through service exposure port mapping. When the response data packet is returned, the internal load balancing node can correctly understand and plan the return packet path by parsing the client address information and the address information of the external load balancing node obtained when parsing the request data packet, and directly feed back the return packet to the client through the service exposure port. That is, the solution provided by the embodiment of the present invention can be implemented in a cluster constructed by a virtual network, using a direct return mode that does not require the help of an external load balancing node to return packets for centralized load balancing. The present invention decouples the load balancing strategy from the network type and utilizes the service exposure port, data packet header parsing technology and network address translation technology to achieve unified support for building clusters of physical networks and virtual networks. It is applicable to a variety of network types and allows clusters of multiple different types of networks to share the same external load balancing node, thereby reducing the number of external load balancing nodes required, saving hardware resources, simplifying network topology and configuration, and reducing management complexity. The sharing of external load balancing nodes achieves centralized load balancing management and optimization, improves the consistency and reliability of the system, and reduces the difficulty and cost of operation and maintenance.

[0114] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0115] It should be noted that the collection, collection, updating, analysis, processing, use, transmission, storage and other aspects of user personal information involved in the technical solution of this disclosure are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken for user personal information to prevent illegal access to user personal information data and maintain the security of user personal information, network security and national security.

[0116] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A data packet processing method, applied to an internal load balancing node of a service cluster, characterized in that: The internal load balancing node includes a service exposure port, and the data packet processing method includes: Receive a request data packet forwarded by an external load balancing node of the service cluster through the service exposure port, wherein the request data packet is initiated by a client and sent to the external load balancing node; Parsing the standard header field of the request data packet to obtain the address information of the client, and parsing the optional header field of the request data packet to obtain the address information of the external load balancing node; Forwarding the request data packet to the mounted container instance, and obtaining a response data packet fed back by the container instance after processing the request data packet; Performing address conversion processing on the response data packet so that the source address information of the response data packet is the address information of the external load balancing node, and the destination address information of the response data packet is the address information of the client; The converted response data packet is sent to the client through the service exposure port.

2. The data packet processing method according to claim 1, characterized in that: Forwarding the request data packet to the mounted container instance, including: Removing the optional header field of the request data packet; Forward the request data packet after removing the optional header fields to the container instance.

3. The data packet processing method according to claim 1, characterized in that: Forwarding the request data packet to the mounted container instance, including: The request data packet is forwarded to the container instance mounted on the internal load balancing node, and / or the request data packet is forwarded to the container instance mounted on other internal load balancing nodes.

4. The data packet processing method according to claim 3, characterized in that: The virtual local area network where the container instance mounted on the internal load balancing node is located has a first virtual tunnel endpoint, and forwarding the request data packet to the container instance mounted on the internal load balancing node includes: Convert the destination address information carried in the standard field of the header of the request data packet from the address information of the service exposure port of the internal load balancing node to the address information of the container instance mounted on the internal load balancing node; Convert the source address information carried in the standard field of the header of the request data packet from the address information of the client to the address information of the first virtual tunnel endpoint; The converted request data packet is forwarded to the container instance mounted on the internal load balancing node.

5. The data packet processing method according to claim 4, characterized in that: Before performing address conversion processing on the response data packet, the method further includes: Convert the destination address information carried in the standard field of the header of the response data packet from the address information of the first virtual tunnel endpoint to the address information of the client; The source address information carried in the standard field of the header of the response data packet is converted from the address information of the container instance mounted on the internal load balancing node to the address information of the service exposure port of the internal load balancing node.

6. The data packet processing method according to claim 3, characterized in that: The other internal load balancing node also includes a service exposure port, the virtual local area network where the container instance mounted by the other internal load balancing node is located has a second virtual tunnel endpoint, and forwarding the request data packet to the container instance mounted by the other internal load balancing node includes: Parsing the request data packet to obtain request data, and performing inner and outer encapsulation on the request data; performing inner encapsulation on the request data includes: encapsulating the inner source address information into the address information of the second virtual tunnel endpoint and encapsulating the inner destination address information into the address information of the container instance mounted by the other internal load balancing node, and performing outer encapsulation on the request data includes: encapsulating the outer source address information into the address information of the service exposure port of the internal load balancing node and encapsulating the outer destination address information into the address information of the service exposure port of the other internal load balancing node; The encapsulated request data is forwarded to the container instance mounted on the other internal load balancing node.

7. The data packet processing method according to claim 6, characterized in that: Before performing address conversion processing on the response data packet, the method further includes: Removing the outer encapsulation of the response data packet; Convert the destination address information encapsulated in the inner layer of the response data packet from the address information of the second virtual tunnel endpoint to the address information of the client; The source address information of the inner layer encapsulation of the response data is converted from the address information of the container instance mounted by the other internal load balancing node to the address information of the service exposure port of the other internal load balancing node.

8. A data packet processing device, applied to an internal load balancing node of a service cluster, characterized in that: The internal load balancing node includes a service exposure port, and the data packet processing device includes: A receiving module, configured to receive a request data packet forwarded by an external load balancing node of a service cluster through the service exposure port, wherein the request data packet is initiated by a client and sent to the external load balancing node; A parsing module, used for parsing the standard header field of the request data packet to obtain the address information of the client, and parsing the optional header field of the request data packet to obtain the address information of the external load balancing node; A transmission module, used to forward the request data packet to the mounted container instance, and obtain a response data packet fed back by the container instance after processing the request data packet; An address conversion module, used to perform address conversion processing on the response data packet, so that the source address information of the response data packet is the address information of the external load balancing node, and the destination address information of the response data packet is the address information of the client; The sending module is used to send the converted response data packet to the client through the service exposure port.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the data packet processing method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the data packet processing method according to any one of claims 1 to 7 is implemented.

Images