Network access method and device, equipment and storage medium

Abstract

The invention relates to a network access method and device, equipment and a storage medium. The network access method is applied to a K8S cluster, the K8S cluster comprises a plurality of DPU nodes and a plurality of objects located in a VPC network, and the method comprises the steps that annotation information of an SVC service of the K8S cluster is set, external network access of the SVC service is started, and the annotation information is used for representing network configuration between the SVC service and the plurality of DPU nodes; the VPC network determines a target DPU node serving as a gateway exit in the plurality of DPU nodes so as to connect the target DPU node; and after the target DPU node obtains the access traffic sent by the target object in the plurality of objects through the VPC network, the access traffic is forwarded to the external network by utilizing the SVC service based on the annotation information. According to the method provided by the invention, the network access efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of network access technology, and in particular to a network access method, device, equipment and storage medium. Background Art

[0002] In recent years, as microservice technology continues to mature, managing containerized workloads and related services through Kubernetes clusters has gradually become the main application method. Kubernetes provides powerful container management capabilities, including automated deployment, expansion, and management of containerized applications. However, in actual applications, the interaction between the internal network of the Kubernetes cluster and the external network often faces the problem of low access efficiency. Summary of the invention

[0003] In order to solve the above technical problems, the embodiments of the present disclosure provide a network access method, apparatus, device and storage medium.

[0004] In a first aspect, an embodiment of the present disclosure provides a network access method, which is applied to a K8S cluster, wherein the K8S cluster includes multiple DPU nodes and multiple objects located in a VPC network, and the method includes:

[0005] Set annotation information of the SVC service of the K8S cluster, and enable external network access of the SVC service, wherein the annotation information is used to characterize the network configuration between the SVC service and the multiple DPU nodes;

[0006] The VPC network determines a target DPU node as a gateway exit among the multiple DPU nodes to connect to the target DPU node;

[0007] After the target DPU node obtains the access traffic sent by the target object among the multiple objects through the VPC network, the target DPU node forwards the access traffic to the external network using the SVC service based on the annotation information.

[0008] Optionally, the annotation information for setting the SVC service of the K8S cluster includes:

[0009] Deploy a network plug-in for a LoadBalancer type service on the multiple DPU nodes, where the LoadBalancer type service refers to a type of service under the SVC service of the K8S cluster;

[0010] The multiple DPU nodes on which the network plug-in is deployed are set as import and export nodes of the LoadBalancer type service through annotation information.

[0011] Optionally, enabling external network access of the SVC service includes:

[0012] At least one static IP address is set for the SVC service in the K8S cluster through the OVN network plug-in, so that the SVC service accesses the external network through the at least one static IP address.

[0013] Optionally, the VPC network determines a target DPU node as a gateway egress from among the multiple DPU nodes, including:

[0014] Obtain node numbers of the multiple DPU nodes, and calculate the weight of each DPU node according to the node number;

[0015] Determine at least one candidate DPU node whose weight is greater than a set weight, and determine a primary candidate DPU node and a backup candidate DPU node among the at least one candidate DPU node;

[0016] Use the normally operating master candidate DPU node as the target DPU node, or, when the master candidate DPU node is in abnormal operation, use the backup candidate DPU node as the target DPU node;

[0017] The target DPU node is used as the gateway exit of the VPC network.

[0018] Optionally, before the target DPU node obtains access traffic sent by the target object among the multiple objects through the VPC network, the method further includes:

[0019] A conversion routing table for the at least one static IP address is configured on an OVS bridge, the OVS bridge runs on the SoC of the target DPU node, and the conversion routing table configures conversion rules between the at least one static IP address and the IP addresses of the multiple objects.

[0020] Optionally, after the target DPU node obtains access traffic sent by the target object among the multiple objects through the VPC network, forwarding the access traffic to the external network by using the SVC service based on the annotation information includes:

[0021] After the target DPU node obtains the access traffic sent by the target object among the multiple objects through the VPC network, it converts the network segment where the target object is located into the target static IP address according to the conversion routing table, and forwards the access traffic to the SVC service based on the annotation information;

[0022] The SVC service forwards the access traffic to the external network via the target static IP address.

[0023] Optionally, after setting the annotation information of the SVC service of the K8S cluster, the method further includes:

[0024] A traffic receiving node is determined among the multiple DPU nodes according to the annotation information, and the traffic receiving node is used to receive the access traffic sent by the external network.

[0025] In a second aspect, an embodiment of the present disclosure provides a network access device, which is applied to a K8S cluster, wherein the K8S cluster includes multiple DPU nodes and multiple objects located in a VPC network, and the device includes:

[0026] A setting unit, used to set annotation information of the SVC service of the K8S cluster and enable external network access of the SVC service, wherein the annotation information is used to characterize the network configuration between the SVC service and the multiple DPU nodes;

[0027] A determining unit, configured for the VPC network to determine a target DPU node as a gateway exit among the plurality of DPU nodes, so as to connect to the target DPU node;

[0028] An access unit is used for the target DPU node to obtain the access traffic sent by the target object among the multiple objects through the VPC network, and then forward the access traffic to the external network using the SVC service based on the annotation information.

[0029] In a third aspect, an embodiment of the present disclosure provides an electronic device, including:

[0030] Memory;

[0031] Processor; and

[0032] Computer programs;

[0033] The computer program is stored in the memory and is configured to be executed by the processor to implement the network access method as described above.

[0034] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the network access method as described above when executed by a processor.

[0035] The network access method provided by the present disclosure is applied to a K8S cluster, and the K8S cluster includes multiple DPU nodes and multiple objects located in a VPC network, including: setting annotation information of the SVC service of the K8S cluster, and enabling external network access of the SVC service, wherein the annotation information is used to characterize the network configuration between the SVC service and multiple DPU nodes; the VPC network determines the target DPU node as the gateway exit among multiple DPU nodes to connect to the target DPU node; after the target DPU node obtains the access traffic sent by the target object among multiple objects through the VPC network, it forwards the access traffic to the external network using the SVC service based on the annotation information. The method provided by the present application uses the DPU node as a traffic receiving point by performing DPU node-related network configuration on the SVC service and the VPC network, making full use of the computing and network processing capabilities of the DPU node and improving network access efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0038] Figure 1 A flowchart of a network access method provided by an embodiment of the present disclosure;

[0039] Figure 2 A diagram of the K8S cluster network architecture provided for an embodiment of the present disclosure;

[0040] Figure 3 A schematic diagram of the structure of a network access device provided by an embodiment of the present disclosure;

[0041] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0042] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0043] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0044] Before explaining this application in detail, it is first necessary to explain the terms involved, including:

[0045] Kubernetes: Also known as K8s, it is a container orchestration and management system used to automatically deploy, scale, and manage containerized applications.

[0046] Pod: It is the smallest basic unit of deployment and management in a Kubernetes cluster.

[0047] DPU: Data Process Unit, is a data processing unit that integrates network card, central processing unit and hardware offload, and can perform various network traffic offloads.

[0048] OVN: Open Virtual Network, a system for supporting virtual network abstraction.

[0049] OVS: Open virtual switch is an open source multi-layer virtual switch.

[0050] CNI: Container Network Interface, which consists of a set of specifications and libraries for configuring network interfaces for Linux containers, and also includes plug-ins.

[0051] VPC: Virtual Private Cloud, virtual private cloud.

[0052] SVC: Service in Kubernetes: used to define a logical collection of Pods and provide a strategy to access the Pods. Service provides network abstraction so that different Pods can be accessed through fixed IP and DNS names.

[0053] DNS: Domain Name System, the domain name system is a service of the Internet, a distributed database that maps domain names and IP addresses to each other.

[0054] In response to the above technical problems, the embodiments of the present disclosure provide a network access method. In a network environment where K8S supports LoadBalancer type SVC services, the SVC service and VPC network are configured, and the DPU node is used as a traffic receiving node to achieve access interaction between the internal network and the external network, making full use of the computing and network processing capabilities of the DPU node and improving the network access effect. This is described in detail through one or more of the following embodiments.

[0055] The network access method provided by the embodiment of the present disclosure can be applied to the scenario where an object in a VPC network accesses an external network. The method can be performed by a network access device, which can be implemented by software and / or hardware, and the device can be integrated in an electronic device. Among them, the electronic device can include but is not limited to mobile terminals such as smart phones, laptops, digital broadcast receivers, personal digital assistants (PDAs), tablet computers (Tablet Personal Computers, Tablet PCs), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), wearable devices, etc., and fixed terminals such as digital televisions, desktop computers, smart home devices, etc.

[0056] Figure 1 A flow chart of a network access method provided in an embodiment of the present disclosure, wherein the network access method is applied to a K8S cluster, wherein the K8S cluster includes multiple DPU nodes, multiple objects and switches located in a VPC network.

[0057] For example, Figure 2 The K8S cluster network architecture diagram provided in the embodiment of the present disclosure includes a router, multiple DPU nodes and multiple objects located in the VPC network. The multiple DPU nodes include DPU1 and DPU2. DPU1 and DPU2 are connected to the external network through the router. The SVC service is deployed on the router. The SVC service is used to perform DPU node-related configuration. The VPC network can also configure multiple DPU nodes to establish connections. The multiple objects in the VPC network refer to nodes such as pods and vms. The VPC network is also divided into multiple subnets, each subnet corresponds to a network segment range, and multiple objects are located in different network segments, such as Figure 2 As shown, multiple subnets include subnet1 and subnet2, and the network segment where subnet1 is located includes pod and vm nodes.

[0058] The network access method specifically includes: Figure 1 The following steps are shown:

[0059] S101. Set annotation information of the SVC service of the K8S cluster and enable external network access to the SVC service.

[0060] The annotation information is used to characterize the network configuration between the SVC service and the multiple DPU nodes.

[0061] Understandably, the annotation information (annotations information) of the SVC service of the K8S cluster is set. The annotation information represents the network configuration between the SVC service and multiple DPU nodes, which can be specifically configured as the interface for external network access in the DPU node. And enable external network access for the SVC service, that is, support the SVC service to access the external network and support the SVC service to receive access from the external network.

[0062] Optionally, the annotation information of the SVC service of the K8S cluster can be set as follows:

[0063] A network plug-in for a LoadBalancer type service is deployed on the multiple DPU nodes, where the LoadBalancer type service refers to a type of service under the SVC service of the K8S cluster; and the multiple DPU nodes on which the network plug-in is deployed are set through annotation information as import and export nodes of the LoadBalancer type service.

[0064] It can be understood that a DPU node on which a network plug-in is to be deployed is selected on multiple DPU nodes. A network plug-in refers to a plug-in for a LoadBalancer type service. Alternatively, the DPU node on which the network plug-in is deployed is directly determined among multiple DPU nodes. A LoadBalancer type service refers to a certain type of SVC service, which can be specifically understood as a LoadBalancer type SVC service. The LoadBalancer type SVC service is used to map a service to an external load balancer so as to distribute incoming network traffic among all Pods of the service, that is, according to the principle of load balancing, the network traffic is distributed among multiple DPU nodes. Subsequently, annotation information is set according to the type of network plug-in. The principle for setting the annotation information is: at least one DPU node on which the network plug-in is deployed is used as an import and export node for a LoadBalancer type service, that is, a LoadBalancer type service can forward traffic through the DPU port.

[0065] Optionally, enabling external network access of the SVC service may be implemented through the following steps:

[0066] At least one static IP address is set for the SVC service in the K8S cluster through the OVN network plug-in, so that the SVC service accesses the external network through the at least one static IP address.

[0067] It is understandable that the SVC service can set virtual server rules on the router to allow the external network to access the internal network through a specific port. Specifically, at least one static IP address is set for the SVC service in the K8S cluster through the OVN network plug-in, so that the SVC service can access the external network through at least one static IP address, that is, at least one static IP address is allocated to the SVC service. Access to the SVC service must be based on at least one static IP address, that is, the DPU node and the external network can access the SVC service based on at least one static IP address. The way to enable external network access through the OVN plug-in is: ovn.Kubernetes.io / eip:120.96.1.14, where 120.96.1.14 is the static IP address assigned to the SVC service for accessing the external network. It is understandable that the number of static IP addresses allocated to the SVC service is not limited and can be determined according to user needs.

[0068] S102: The VPC network determines a target DPU node as a gateway exit among the multiple DPU nodes to connect to the target DPU node.

[0069] It is understandable that, based on the above S101, when the target object in the VPC network wants to access the external network, the VPC network of the K8S cluster can select multiple DPU nodes as gateway exits, that is, the VPC network can actively determine the target DPU node as the gateway exit to forward traffic through the target DPU node. The selection method of the target DPU node is explained in the following steps.

[0070] Optionally, the VPC network determines a target DPU node as a gateway egress among the multiple DPU nodes, which can be implemented by the following steps:

[0071] Determine the weight of each DPU node among the multiple DPU nodes; determine at least one candidate DPU node whose weight is greater than the set weight, and determine a primary candidate DPU node and a backup candidate DPU node among the at least one candidate DPU node; use the normally operating primary candidate DPU node as the target DPU node, or, when the primary candidate DPU node is in abnormal operation, use the backup candidate DPU node as the target DPU node; use the target DPU node as the gateway exit of the VPC network.

[0072] Optionally, the above determination of the weight of each DPU node among the multiple DPU nodes may be implemented by the following steps:

[0073] Node numbers of the multiple DPU nodes are obtained, and a weight of each DPU node is calculated according to the node number.

[0074] It can be understood that to determine the weight of each DPU node, a weight value can be set for each DPU node in advance, and the weight value of each DPU node can be calculated based on the node number set for each DPU node. For example, the weight of each DPU node can be calculated based on the node number and the dynamic coefficient assigned to each DPU node.

[0075] It is understandable that after determining the weight of each DPU node, at least one candidate DPU node with a weight greater than the set weight is determined in multiple DPU devices, and the set weight can be determined according to user needs. Then, a main candidate DPU node and at least one backup candidate DPU node are divided from at least one candidate DPU node. The division of the main and backup candidate DPU nodes can be determined according to the real-time load or the priority of the DPU node. The main candidate DPU node is usually the node with the highest weight or the best performance, and the backup candidate DPU node is used to enable when the main candidate DPU node fails. After distinguishing the main candidate DPU node and the backup candidate DPU node, the normally operating main candidate DPU node is used as the target DPU node, or, when the main candidate DPU node is in abnormal operation, the backup candidate DPU node is used as the target DPU node. Abnormal operation means that the DPU node cannot complete the traffic forwarding work. Subsequently, the target DPU node is used as the gateway exit of the VPC network, that is, the traffic flowing out of the VPC network will be processed and forwarded through the target DPU node. This configuration method can ensure efficient routing and optimized processing of network traffic.

[0076] S103: After the target DPU node obtains the access traffic sent by the target object among the multiple objects through the VPC network, it uses the SVC service to forward the access traffic to the external network based on the annotation information.

[0077] It is understandable that, based on the above S102, when the target object among multiple objects wants to access the external network, the access traffic is sent to the target DPU node through the VPC network. The access traffic can be HTTP requests, data transmission or other types of network communication traffic. The target DPU node is a node pre-selected by the VPC network for forwarding traffic, that is, the target DPU node is used as the traffic receiving node of the VPC network. After receiving the access traffic, the target DPU node uses the network interface configured in the annotation information to access the SVC service, and forwards the access traffic to the external network through the SVC service that has enabled external network access, thereby completing the target object's access to the external network.

[0078] Optionally, before the target DPU node obtains access traffic sent by the target object among the multiple objects through the VPC network, the method further includes:

[0079] A conversion routing table for the at least one static IP address is configured on an OVS bridge, the OVS bridge runs on the SoC of the target DPU node, and the conversion routing table configures conversion rules between the at least one static IP address and the IP addresses of the multiple objects.

[0080] It is understandable that before the target DPU node receives access traffic as a traffic receiving point, a conversion routing table for at least one static IP address is configured on the OVS bridge on the SoC of the target DPU node. The conversion routing table configures the conversion rules between at least one static IP address and the IP addresses of multiple objects, that is, the mapping rules between the static IP address and the IP address of each object are configured. A mapping rule can be configured for each static IP address. For example, Figure 2 As shown, there is a mapping rule between the static IP address (120.96.1.14:80) of the SVC service and the IP address (10.1.1.3:80) of POD1, that is, the conversion routing table configures the mapping rule between the IP address and port number of the target object accessible to the external network.

[0081] Optionally, after the target DPU node obtains the access traffic sent by the target object among the multiple objects through the VPC network, the target DPU node forwards the access traffic to the external network using the SVC service based on the annotation information, which can be specifically implemented through the following steps:

[0082] After the target DPU node obtains the access traffic sent by the target object among the multiple objects through the VPC network, the IP address of the target object is converted into a target static IP address according to the conversion routing table, and the access traffic is forwarded to the SVC service based on the annotation information; the SVC service forwards the access traffic to the external network through the target static IP address.

[0083] It can be understood that the target DPU node receives access traffic from the target object in multiple objects through the VPC network. Subsequently, the target DPU node converts the target IP address of the target object into a target static IP address according to the pre-configured conversion routing table, that is, converts the IP address of the internal network into a static IP address recognizable by the external network. After determining the target static IP address, the target DPU node uses annotation information (configuration information or other metadata about the SVC service) to forward the processed access traffic to the corresponding SVC service. After the SVC service receives the access traffic from the target DPU node, it forwards the access traffic to the external network through the target static IP address, completing the access of the target object in the VPC network to the external network.

[0084] It is understandable that after setting the annotation information of the SVC service of the K8S cluster, the method further includes:

[0085] A traffic receiving node is determined among the multiple DPU nodes according to the annotation information, and the traffic receiving node is used to receive the access traffic sent by the external network.

[0086] It is understandable that in the process of accessing the target object from the external network, the ovn-Kubernetes cni component determines the target DPU node as the traffic receiving node in multiple DPU node groups according to the annotation information, and the target DPU node is used to receive the access traffic from the external network. Subsequently, the target DPU node converts the target static IP address to the IP address of the target object through the conversion routing table, and then forwards the access traffic to the target object based on the IP address of the target object using the VPV network, completing the external network's access to the target object.

[0087] A network access method provided by an embodiment of the present disclosure sets annotation information of a LoadBalancer type SVC service supported by K8S, and enables access of the SVC service to an external network through ovn-Kubernetes, and sets a DPU node as a traffic receiving point in the annotation information and the configuration of the VPC network to fully utilize the network traffic offloading characteristics of the DPU network card, such as low latency and high throughput, to improve access efficiency between the internal network and the external network.

[0088] Figure 3 The network access device provided in the embodiment of the present disclosure can execute the processing flow provided in the network access method embodiment. The network access device 300 is applied to a K8S cluster, and the K8S cluster includes multiple DPU nodes and multiple objects located in a VPC network, such as Figure 3 As shown, the network access device 300 includes a setting unit 301, a determining unit 302 and an access unit 303, wherein:

[0089] A setting unit 301 is used to set annotation information of the SVC service of the K8S cluster and enable external network access of the SVC service, wherein the annotation information is used to characterize the network configuration between the SVC service and the multiple DPU nodes;

[0090] A determining unit 302 is configured for the VPC network to determine a target DPU node as a gateway egress among the multiple DPU nodes to connect to the target DPU node;

[0091] The access unit 303 is used for the target DPU node to obtain the access traffic sent by the target object among the multiple objects through the VPC network, and then forward the access traffic to the external network using the SVC service based on the annotation information.

[0092] Optionally, the setting unit 301 is used to:

[0093] Deploy a network plug-in for a LoadBalancer type service on the multiple DPU nodes, where the LoadBalancer type service refers to a type of service under the SVC service of the K8S cluster;

[0094] The multiple DPU nodes on which the network plug-in is deployed are set as import and export nodes of the LoadBalancer type service through annotation information.

[0095] Optionally, the setting unit 301 is used to:

[0096] At least one static IP address is set for the SVC service in the K8S cluster through the OVN network plug-in, so that the SVC service accesses the external network through the at least one static IP address.

[0097] Optionally, the determining unit 302 is configured to:

[0098] Obtain node numbers of the multiple DPU nodes, and calculate the weight of each DPU node according to the node number;

[0099] Determine at least one candidate DPU node whose weight is greater than a set weight, and determine a primary candidate DPU node and a backup candidate DPU node among the at least one candidate DPU node;

[0100] Use the normally operating master candidate DPU node as the target DPU node, or, when the master candidate DPU node is in abnormal operation, use the backup candidate DPU node as the target DPU node;

[0101] The target DPU node is used as the gateway exit of the VPC network.

[0102] Optionally, the network access device 300 is further used for:

[0103] A conversion routing table for the at least one static IP address is configured on an OVS bridge, the OVS bridge runs on the SoC of the target DPU node, and the conversion routing table configures conversion rules between the at least one static IP address and the IP addresses of the multiple objects.

[0104] Optionally, the access unit 303 is used to:

[0105] After the target DPU node obtains the access traffic sent by the target object among the multiple objects through the VPC network, it converts the network segment where the target object is located into the target static IP address according to the conversion routing table, and forwards the access traffic to the SVC service based on the annotation information;

[0106] The SVC service forwards the access traffic to the external network via the target static IP address.

[0107] Optionally, the network access device 300 is further used for:

[0108] A traffic receiving node is determined among the multiple DPU nodes according to the annotation information, and the traffic receiving node is used to receive the access traffic sent by the external network.

[0109] Figure 3 The network access device of the illustrated embodiment can be used to execute the technical solution of the above-mentioned method embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0110] Figure 4 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure. Figure 4, which shows a schematic diagram of the structure of an electronic device 400 suitable for implementing the embodiment of the present disclosure. The electronic device 400 in the embodiment of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle terminals (such as vehicle navigation terminals), wearable electronic devices, etc., and fixed terminals such as digital TVs, desktop computers, smart home devices, etc. Figure 4 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0111] like Figure 4 As shown, the electronic device 400 may include a processing device 401 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 402 or a program loaded from a storage device 408 to a random access memory (RAM) 403 to implement the network access method of the embodiment described in the present disclosure. In the RAM 403, various programs and data required for the operation of the electronic device 400 are also stored. The processing device 401, the ROM 402, and the RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0112] Typically, the following devices may be connected to the I / O interface 405: an input device 406 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 407 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 408 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 409. The communication device 409 may allow the electronic device 400 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 4 The electronic device 400 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0113] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart, thereby implementing the network access method as described above. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 409, or installed from the storage device 408, or installed from the ROM 402. When the computer program is executed by the processing device 401, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0114] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0115] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0116] The computer-readable medium may be included in the electronic device, or may exist independently without being installed in the electronic device.

[0117] Optionally, when the above one or more programs are executed by the electronic device, the electronic device may also execute other steps described in the above embodiments.

[0118] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0119] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0120] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit does not, in some cases, limit the unit itself.

[0121] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0122] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0123] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or gateway that includes a series of elements includes not only those elements, but also other elements that are not explicitly listed, or also includes elements inherent to such process, method, article or gateway. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or gateway that includes the elements.

[0124] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A network access method, characterized in that: Applied to a K8S cluster, the K8S cluster includes multiple DPU nodes and multiple objects located in a VPC network, the method includes: Set annotation information of the SVC service of the K8S cluster, and enable external network access of the SVC service, wherein the annotation information is used to characterize the network configuration between the SVC service and the multiple DPU nodes; The VPC network determines a target DPU node as a gateway exit among the multiple DPU nodes to connect to the target DPU node; After the target DPU node obtains the access traffic sent by the target object among the multiple objects through the VPC network, the target DPU node forwards the access traffic to the external network using the SVC service based on the annotation information.

2. The method according to claim 1, characterized in that The annotation information for setting the SVC service of the K8S cluster includes: Deploy a network plug-in for a LoadBalancer type service on the multiple DPU nodes, where the LoadBalancer type service refers to a type of service under the SVC service of the K8S cluster; The multiple DPU nodes on which the network plug-in is deployed are set as import and export nodes of the LoadBalancer type service through annotation information.

3. The method according to claim 1, characterized in that: The enabling of external network access of the SVC service includes: At least one static IP address is set for the SVC service in the K8S cluster through the OVN network plug-in, so that the SVC service accesses the external network through the at least one static IP address.

4. The method according to claim 1, characterized in that The VPC network determines a target DPU node as a gateway egress among the multiple DPU nodes, including: Obtain node numbers of the multiple DPU nodes, and calculate the weight of each DPU node according to the node number; Determine at least one candidate DPU node whose weight is greater than a set weight, and determine a primary candidate DPU node and a backup candidate DPU node among the at least one candidate DPU node; Use the normally operating master candidate DPU node as the target DPU node, or, when the master candidate DPU node is in abnormal operation, use the backup candidate DPU node as the target DPU node; The target DPU node is used as the gateway exit of the VPC network.

5. The method according to claim 3, characterized in that: Before the target DPU node obtains access traffic sent by the target object among the multiple objects through the VPC network, the method further includes: A conversion routing table for the at least one static IP address is configured on an OVS bridge, the OVS bridge runs on the SoC of the target DPU node, and the conversion routing table configures conversion rules between the at least one static IP address and the IP addresses of the multiple objects.

6. The method according to claim 5, characterized in that After the target DPU node obtains the access traffic sent by the target object among the multiple objects through the VPC network, forwarding the access traffic to the external network by using the SVC service based on the annotation information includes: After the target DPU node obtains the access traffic sent by the target object among the multiple objects through the VPC network, it converts the network segment where the target object is located into the target static IP address according to the conversion routing table, and forwards the access traffic to the SVC service based on the annotation information; The SVC service forwards the access traffic to the external network via the target static IP address.

7. The method according to claim 1, characterized in that After setting the annotation information of the SVC service of the K8S cluster, the method further includes: A traffic receiving node is determined among the multiple DPU nodes according to the annotation information, and the traffic receiving node is used to receive the access traffic sent by the external network.

8. A network access device, characterized in that: Applied to a K8S cluster, the K8S cluster includes multiple DPU nodes and multiple objects located in a VPC network, and the device includes: A setting unit, used to set annotation information of the SVC service of the K8S cluster and enable external network access of the SVC service, wherein the annotation information is used to characterize the network configuration between the SVC service and the multiple DPU nodes; A determining unit, configured for the VPC network to determine a target DPU node as a gateway exit among the plurality of DPU nodes, so as to connect to the target DPU node; An access unit is used for the target DPU node to obtain the access traffic sent by the target object among the multiple objects through the VPC network, and then forward the access traffic to the external network using the SVC service based on the annotation information.

9. An electronic device, characterized in that: include: Memory; processor; as well as Computer programs; The computer program is stored in the memory and is configured to be executed by the processor to implement the network access method as claimed in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the network access method according to any one of claims 1 to 7 are implemented.

Images