A network access method, apparatus, device, and storage medium

Abstract

The application relates to a network access method, device, equipment and storage medium. The network access method is applied to a K8S cluster, the K8S cluster comprises a plurality of DPU nodes and a plurality of objects located in a VPC network, and the method comprises the following steps: setting annotation information of an SVC service of the K8S cluster, and enabling external network access of the SVC service, wherein the annotation information is used for representing network configuration between the SVC service and the plurality of DPU nodes; the VPC network determines a target DPU node serving as a gateway outlet in the plurality of DPU nodes, so as to be connected to the target DPU node; after the target DPU node obtains access traffic sent by a target object in the plurality of objects through the VPC network, the target DPU node forwards the access traffic to an external network by using the SVC service based on the annotation information. The method provided in the application improves network access efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network access, and in particular to a network access method, device, equipment and storage medium. BACKGROUND

[0002] In recent years, with the continuous maturity of micro-service technology, Kubernetes cluster is gradually becoming a main application means for managing containerized workloads and related services. Kubernetes provides powerful container management capabilities, including automatic deployment, expansion and management of containerized applications. However, in actual application, the interaction between the internal network of the Kubernetes cluster and the external network often faces the problem of low access efficiency. SUMMARY

[0003] In order to solve the above technical problems, the present application provides a network access method, device, equipment and storage medium.

[0004] In a first aspect, the present application provides a network access method applied to a K8S cluster, the K8S cluster comprising a plurality of DPU nodes and a plurality of objects located in a VPC network, the method comprising:

[0005] setting annotation information of a SVC service of the K8S cluster, and enabling external network access of the SVC service, wherein the annotation information is used to represent network configuration between the SVC service and the plurality of DPU nodes;

[0006] determining a target DPU node as a gateway exit in the plurality of DPU nodes by the VPC network, to connect the target DPU node;

[0007] after the target DPU node obtains access traffic sent by a target object in the plurality of objects through the VPC network, forwarding the access traffic to the external network by the SVC service based on the annotation information.

[0008] Optionally, the setting of the annotation information of the SVC service of the K8S cluster comprises:

[0009] deploying a network plug-in for a LoadBalancer type service on the plurality of DPU nodes, the LoadBalancer type service being a type of service under the SVC service of the K8S cluster;

[0010] setting the plurality of DPU nodes on which the network plug-in is deployed as import and export nodes of the LoadBalancer type service through the annotation information.

[0011] Optionally, the opening of the external network access of the SVC service comprises:

[0012] At least one static IP address is set for the SVC service in the K8S cluster through an OVN network plug-in, so that the SVC service accesses the external network through the at least one static IP address.

[0013] Optionally, the VPC network determines a target DPU node as a gateway exit in the plurality of DPU nodes, comprising:

[0014] The node numbers of the plurality of DPU nodes are obtained, and the weights of each DPU node are calculated according to the node numbers;

[0015] At least one candidate DPU node with a weight greater than a set weight is determined, and a primary candidate DPU node and a backup candidate DPU node are determined in the at least one candidate DPU node;

[0016] The normally running primary candidate DPU node is taken as the target DPU node, or when the primary candidate DPU node is not normally running, the backup candidate DPU node is taken as the target DPU node;

[0017] The target DPU node is taken as the gateway exit of the VPC network.

[0018] Optionally, before the target DPU node obtains access traffic from a target object in the plurality of objects through the VPC network, the method further comprises:

[0019] A conversion routing table of the at least one static IP address is configured on an OVS bridge, the OVS bridge runs on a SoC of the target DPU node, and the conversion routing table configures a conversion rule between the at least one static IP address and the IP addresses of the plurality of objects.

[0020] Optionally, after the target DPU node obtains access traffic from a target object in the plurality of objects through the VPC network, the access traffic is forwarded to the external network by the SVC service based on the annotation information, comprising:

[0021] After the target DPU node obtains access traffic from a target object in the plurality of objects through the VPC network, the target object is converted into a target static IP address according to the conversion routing table, and the access traffic is forwarded to the SVC service based on the annotation information;

[0022] The SVC service forwards the access traffic to the external network through the target static IP address.

[0023] Optionally, after the setting the annotation information of the SVC service of the K8S cluster, the method further includes:

[0024] determining a traffic receiving node in the plurality of DPU nodes according to the annotation information, the traffic receiving node being configured to receive access traffic from the external network.

[0025] In a second aspect, the embodiments of the present disclosure provide a network access device, applied to a K8S cluster, the K8S cluster including a plurality of DPU nodes and a plurality of objects located in a VPC network, the device including:

[0026] a setting unit configured to set annotation information of a SVC service of the K8S cluster, and to start external network access of the SVC service, wherein the annotation information is configured to represent network configuration between the SVC service and the plurality of DPU nodes;

[0027] a determining unit configured to determine a target DPU node as a gateway exit in the plurality of DPU nodes according to the VPC network, so as to connect the target DPU node;

[0028] an access unit configured to, after the target DPU node obtains access traffic from a target object in the plurality of objects through the VPC network, forward the access traffic to the external network by using the SVC service based on the annotation information.

[0029] In a third aspect, the embodiments of the present disclosure provide an electronic device, including:

[0030] a memory;

[0031] a processor; and

[0032] a computer program;

[0033] wherein the computer program is stored in the memory and configured to be executed by the processor to implement the network access method as described above.

[0034] In a fourth aspect, the embodiments of the present disclosure provide a computer readable storage medium, having a computer program stored thereon, the computer program being executed by a processor to implement the steps of the network access method as described above.

[0035] The network access method provided by the present disclosure is applied to a K8S cluster, and the K8S cluster includes a plurality of DPU nodes and a plurality of objects located in a VPC network. The method includes the following steps: setting annotation information of an SVC service of the K8S cluster, and enabling external network access of the SVC service, wherein the annotation information is used to represent network configuration between the SVC service and the plurality of DPU nodes; the VPC network determines a target DPU node as a gateway exit in the plurality of DPU nodes, to connect the target DPU node; after the target DPU node obtains access traffic sent by a target object in the plurality of objects through the VPC network, the target DPU node forwards the access traffic to an external network by using the SVC service based on the annotation information. The method provided by the present disclosure fully utilizes the computing and network processing capabilities of the DPU nodes by performing DPU node-related network configuration on the SVC service and the VPC network, and takes the DPU nodes as traffic receiving points, thereby improving network access efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0036] The accompanying drawings, which are incorporated herein and form part of the specification, illustrate embodiments consistent with the present disclosure and, together with the description, further serve to explain the principles of the disclosure.

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, for those skilled in the art, other drawings can also be obtained based on these drawings without creative labor.

[0038] Figure 1 A flowchart of a network access method provided by an embodiment of the present disclosure;

[0039] Figure 2 A K8S cluster network architecture diagram provided by an embodiment of the present disclosure;

[0040] Figure 3 A structural diagram of a network access device provided by an embodiment of the present disclosure;

[0041] Figure 4 A structural diagram of an electronic device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, for those skilled in the art, other drawings can also be obtained based on these drawings without creative labor.

[0043] In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present disclosure. However, the present disclosure can be practiced without the specific details. In other instances, well-known methods, procedures, components, and circuits have not been described in detail since it is considered as known to those skilled in the art. The following description is intended to be illustrative, and not to be used to limit or define the present disclosure. One skilled in the related arts can readily devise many variations and modifications of the examples without departing from the scope of the present disclosure as defined by the following claims.

[0044] Before the detailed description of the present application is described, the proper nouns involved are explained first, including:

[0045] Kubernetes: also known as K8s, is a container orchestration and management system for automatically deploying, scaling and managing containerized applications.

[0046] pod: is the smallest basic unit of deployment and management in Kubernetes cluster.

[0047] DPU: Data Process Unit, is a data processing unit that integrates network card, central processor and hardware offload, which can perform various network traffic offload.

[0048] OVN: Open Virtual Network, is a system for supporting virtual network abstraction.

[0049] OVS: Open virtual switch, is an open source multi-layer virtual switch.

[0050] CNI: Container Network Interface, is a set of specifications and libraries for configuring the network interface of Linux containers, and also contains plugins.

[0051] VPC: Virtual Private Cloud.

[0052] SVC: Service in Kubernetes: used to define a logical collection of pods and provide a strategy to access the pods. Service provides network abstraction, so that different pods can be accessed through fixed IP and DNS name.

[0053] DNS: Domain Name System, is a service of the Internet, is a distributed database that maps domain names and IP addresses to each other.

[0054] To solve the above technical problems, the embodiment of the present disclosure provides a network access method. In a network environment in which K8S supports LoadBalancer type SVC service, the network access method performs network configuration on the SVC service and the VPC network, takes the DPU node as a traffic receiving node, and realizes access interaction between the internal network and the external network, thereby fully utilizing the computing and network processing capabilities of the DPU node and improving the network access effect. The network access method is described in detail through one or more embodiments.

[0055] The network access method provided by the embodiment of the present disclosure can be applied to a scenario in which an object located in a VPC network accesses an external network. The method can be performed by a network access device, which can be implemented in software and / or hardware, and can be integrated in an electronic device. The electronic device can include, but is not limited to, a mobile terminal such as a smartphone, a notebook computer, a digital broadcast receiver, a personal digital assistant (PDA), a tablet personal computer (Tablet PC), a PMP (portable multimedia player), a vehicle terminal (such as a vehicle navigation terminal), a wearable device, and the like, and a fixed terminal such as a digital television, a desktop computer, a smart home device, and the like.

[0056] Figure 1 The network access method provided by the embodiment of the present disclosure is shown in a flowchart. The network access method is applied to a K8S cluster, and the K8S cluster includes a plurality of DPU nodes, a plurality of objects located in a VPC network, and a switch.

[0057] For example, Figure 2 The K8S cluster network architecture provided by the embodiment of the present disclosure is shown in a diagram. The K8S cluster includes a router, a plurality of DPU nodes, and a plurality of objects located in a VPC network. The plurality of DPU nodes include DPU1 and DPU2, and DPU1 and DPU2 are connected to an external network through the router. The router is deployed with an SVC service, which is used for DPU node-related configuration. The VPC network can also configure the plurality of DPU nodes to establish a connection. The plurality of objects in the VPC network refer to nodes such as pods and vms. The VPC network is further divided into a plurality of subnets, each of which corresponds to a network segment range. The plurality of objects are located in different network segments, for example, Figure 2 As shown, the plurality of subnets include subnet1 and subnet2, and the subnet1 includes pod and vm nodes in a network segment.

[0058] The network access method specifically includes the following steps as shown in Figure 1

[0059] ​S101, set the annotation information of the SVC service of the K8S cluster, and enable the external network access of the SVC service.

[0060] The annotation information is used to represent the network configuration between the SVC service and the plurality of DPU nodes.

[0061] It can be understood that the annotation information (annotations information) of the SVC service of the K8S cluster is set, and the annotation information represents the network configuration between the SVC service and the plurality of DPU nodes, which can be specifically the interface in the DPU node for external network access. And the external network access of the SVC service is enabled, that is, the SVC service supports accessing the external network and receiving the access of the external network.

[0062] Optionally, the above setting of the annotation information of the SVC service of the K8S cluster can be implemented by the following steps:

[0063] Deploy a network plug-in for a LoadBalancer type service on the plurality of DPU nodes, the LoadBalancer type service refers to a type of service under the SVC service of the K8S cluster; and the plurality of DPU nodes on which the network plug-in is deployed are set as import and export nodes of the LoadBalancer type service through the annotation information.

[0064] It can be understood that the DPU nodes on which the network plug-in is to be deployed are selected from the plurality of DPU nodes, the network plug-in refers to a plug-in for a LoadBalancer type service, or the DPU nodes on which the network plug-in is deployed are directly determined from the plurality of DPU nodes, the LoadBalancer type service refers to a type of service of the SVC service, which can be specifically understood as a LoadBalancer type SVC service, the LoadBalancer type SVC service is used to map a service to an external load balancer, so as to distribute the incoming network traffic among all the Pods of the service, that is, according to the principle of load balancing, the network traffic is distributed among the plurality of DPU nodes. Then, the annotation information is set according to the type of the network plug-in, and the setting principle of the annotation information is that at least one DPU node on which the network plug-in is deployed is set as an import and export node of the LoadBalancer type service, that is, the LoadBalancer type service can perform traffic forwarding through the DPU port.

[0065] Optionally, the above enabling of the external network access of the SVC service can be implemented by the following steps:

[0066] set at least one static IP address for the SVC service in the K8S cluster through the OVN network plug-in, so that the SVC service accesses the external network through the at least one static IP address.

[0067] It can be understood that the SVC service can set a virtual server rule on the router to allow the external network to access the internal network through a specific port. Specifically, at least one static IP address is set for the SVC service in the K8S cluster through the OVN network plug-in, so that the SVC service accesses the external network through the at least one static IP address, that is, at least one static IP address is allocated to the SVC service, and access to the SVC service is based on the at least one static IP address, that is, the DPU node and the external network can access the SVC service based on the at least one static IP address. The way to enable external network access through the OVN plug-in is: ovn.Kubernetes.io / eip: 120.96.1.14, wherein 120.96.1.14 is a static IP address allocated to the SVC service for accessing the external network. It can be understood that the number of static IP addresses allocated to the SVC service is not limited and can be determined by the user as needed.

[0068] S102, the VPC network determines a target DPU node as a gateway exit in the plurality of DPU nodes to connect the target DPU node.

[0069] It can be understood that, based on the above S101, in the case that the target object located in the VPC network needs to access the external network, the VPC network of the K8S cluster can select a plurality of DPU nodes as a gateway exit, that is, the VPC network can actively determine a target DPU node as a gateway exit to perform traffic forwarding through the target DPU node. The selection of the target DPU node is described as follows.

[0070] Optionally, the VPC network determines a target DPU node as a gateway exit in the plurality of DPU nodes, which can be achieved by the following steps:

[0071] determining the weight of each DPU node in the plurality of DPU nodes; determining at least one candidate DPU node with a weight greater than a set weight, and determining a primary candidate DPU node and a backup candidate DPU node in the at least one candidate DPU node; taking the normally operating primary candidate DPU node as the target DPU node, or, when the primary candidate DPU node is not in normal operation, taking the backup candidate DPU node as the target DPU node; taking the target DPU node as the gateway exit of the VPC network.

[0072] Optionally, the weight of each DPU node in the plurality of DPU nodes can be determined by the following steps:

[0073] The node number of each DPU node is obtained, and the weight of each DPU node is calculated according to the node number.

[0074] It can be understood that the weight of each DPU node can be set in advance, or the weight of each DPU node can be calculated according to the node number set for each DPU node, for example, the weight of each DPU node can be calculated according to the node number and the dynamic coefficient assigned to each DPU node.

[0075] It can be understood that after determining the weight of each DPU node, at least one candidate DPU node with a weight greater than a set weight is determined in the plurality of DPU devices, and the set weight can be determined according to user demand. Subsequently, a primary candidate DPU node and at least one backup candidate DPU node are divided in the at least one candidate DPU node, and the division of the primary and backup candidate DPU nodes can be determined according to real-time load or priority of the DPU node. The primary candidate DPU node is usually the node with the highest weight or the best performance, and the backup candidate DPU node is used when the primary candidate DPU node fails. After distinguishing the primary candidate DPU node and the backup candidate DPU node, the normally operating primary candidate DPU node is taken as the target DPU node, or when the primary candidate DPU node is in abnormal operation, the backup candidate DPU node is taken as the target DPU node, and the abnormal operation means that the DPU node cannot complete the traffic forwarding work. Subsequently, the target DPU node is taken as the gateway exit of the VPC network, that is, the traffic flowing out of the VPC network will be processed and forwarded through the target DPU node. This configuration mode can ensure efficient routing and optimized processing of network traffic.

[0076] S103, after the target DPU node obtains the access traffic sent by the target object in the plurality of objects through the VPC network, the target DPU node forwards the access traffic to the external network based on the annotation information using the SVC service.

[0077] It can be understood that, on the basis of S102, when the target object in the plurality of objects needs to access the external network, the access traffic can be sent to the target DPU node through the VPC network, the access traffic can be an HTTP request, data transmission or other types of network communication traffic, and the target DPU node is a node selected in advance by the VPC network for forwarding traffic, that is, the target DPU node is used as a traffic receiving node of the VPC network. After the target DPU node receives the access traffic, the network interface configured in the annotation information is used to access the SVC service, and the access traffic is forwarded to the external network through the SVC service that has opened the external network access, so as to complete the access of the target object to the external network.

[0078] Optionally, before the target DPU node obtains the access traffic sent by the target object in the plurality of objects through the VPC network, the method further comprises:

[0079] A conversion routing table of the at least one static IP address is configured on the OVS bridge running on the SoC of the target DPU node, and the conversion routing table is configured with a conversion rule between the at least one static IP address and the IP address of the plurality of objects.

[0080] It can be understood that, before the target DPU node receives the access traffic as a traffic receiving point, a conversion routing table about at least one static IP address is configured on the OVS bridge on the SoC of the target DPU node, and the conversion routing table is configured with a conversion rule between the at least one static IP address and the IP address of the plurality of objects, that is, a mapping rule between the static IP address and the IP address of each object is configured, and a mapping rule can be configured for each static IP address. For example, as shown in Figure 2 It can be understood that, before the target DPU node receives the access traffic as a traffic receiving point, a conversion routing table about at least one static IP address is configured on the OVS bridge on the SoC of the target DPU node, and the conversion routing table is configured with a conversion rule between the at least one static IP address and the IP address of the plurality of objects, that is, a mapping rule between the static IP address and the IP address of each object is configured, and a mapping rule can be configured for each static IP address. For example, as shown in

[0081] Optionally, after the target DPU node obtains the access traffic sent by the target object in the plurality of objects through the VPC network, the access traffic is forwarded to the external network by the SVC service based on the annotation information, and the forwarding can be realized through the following steps:

[0082] The target DPU node obtains the access traffic from the target object in the plurality of objects through the VPC network, converts the IP address of the target object into a target static IP address according to the conversion routing table, and forwards the access traffic to the SVC service based on the annotation information; and the SVC service forwards the access traffic to the external network through the target static IP address.

[0083] It can be understood that the target DPU node receives the access traffic from the target object in the plurality of objects through the VPC network. Then, the target DPU node converts the target IP address of the target object into a target static IP address according to the pre-configured conversion routing table, that is, converts the IP address of the internal network into a static IP address recognizable by the external network. After determining the target static IP address, the target DPU node forwards the processed access traffic to the corresponding SVC service using the annotation information (configuration information or other metadata about the SVC service). After receiving the access traffic from the target DPU node, the SVC service forwards the access traffic to the external network through the target static IP address, completing the access of the target object in the VPC network to the external network.

[0084] It can be understood that after setting the annotation information of the SVC service of the K8S cluster, the method further comprises:

[0085] determining a traffic receiving node in the plurality of DPU nodes according to the annotation information, the traffic receiving node being used to receive the access traffic from the external network.

[0086] It can be understood that in the access process of the external network to the target object, the ovn-Kubernetes cni component determines the target DPU node as the traffic receiving node in the plurality of DPU node groups according to the annotation information, and the target DPU node is used to receive the access traffic from the external network. Then, the target DPU node converts the target static IP address into the IP address of the target object through the conversion routing table, and forwards the access traffic to the target object through the VPC network based on the IP address of the target object, completing the access of the external network to the target object.

[0087] The network access method provided by the embodiments of the present disclosure sets the annotation information of the K8S supported LoadBalancer type SVC service, and enables the access of the SVC service to the external network through the ovn-Kubernetes. The DPU node is set as the traffic receiving node in the annotation information and the configuration of the VPC network, so as to fully utilize the network traffic offloading characteristics of the DPU network card, such as low delay and high throughput, and improve the access efficiency between the internal network and the external network.

[0088] Figure 3 A structural schematic diagram of a network access device provided by an embodiment of the present disclosure is shown. The network access device provided by the embodiment of the present disclosure can execute the processing flow provided by the network access method embodiment. The network access device 300 is applied to a K8S cluster, and the K8S cluster includes a plurality of DPU nodes and a plurality of objects located in a VPC network, as shown in the figure. Figure 3 The network access device 300 includes a setting unit 301, a determination unit 302, and an access unit 303, wherein:

[0089] The setting unit 301 is configured to set annotation information of an SVC service of the K8S cluster, and enable external network access of the SVC service, wherein the annotation information is used to represent network configuration between the SVC service and the plurality of DPU nodes.

[0090] The determination unit 302 is configured to determine a target DPU node as a gateway exit in the plurality of DPU nodes in the VPC network, so as to connect the target DPU node.

[0091] The access unit 303 is configured to, after the target DPU node obtains access traffic sent by a target object in the plurality of objects through the VPC network, forward the access traffic to the external network by using the SVC service based on the annotation information.

[0092] Optionally, the setting unit 301 is configured to:

[0093] Deploy a network plug-in for a LoadBalancer type service on the plurality of DPU nodes, wherein the LoadBalancer type service refers to a type of service under the SVC service of the K8S cluster.

[0094] Set the plurality of DPU nodes on which the network plug-in is deployed as import and export nodes of the LoadBalancer type service through annotation information.

[0095] Optionally, the setting unit 301 is configured to:

[0096] Set at least one static IP address for the SVC service in the K8S cluster through an OVN network plug-in, so that the SVC service accesses the external network through the at least one static IP address.

[0097] Optionally, the determination unit 302 is configured to:

[0098] Obtain node numbers of the plurality of DPU nodes, and calculate weights of each DPU node according to the node numbers.

[0099] determine at least one candidate DPU node with a weight greater than the set weight, and determine a primary candidate DPU node and a backup candidate DPU node from the at least one candidate DPU node;

[0100] take the normally operating primary candidate DPU node as the target DPU node, or take the backup candidate DPU node as the target DPU node when the primary candidate DPU node is not normally operating;

[0101] take the target DPU node as the gateway exit of the VPC network.

[0102] Optionally, the network access device 300 is further configured to:

[0103] configure a conversion routing table of the at least one static IP address on an OVS bridge, the OVS bridge running on the SoC of the target DPU node, the conversion routing table configured with a conversion rule between the at least one static IP address and the IP addresses of the plurality of objects.

[0104] Optionally, the access unit 303 is configured to:

[0105] after the target DPU node obtains the access traffic sent by a target object in the plurality of objects through the VPC network, convert a network segment where the target object is located into a target static IP address according to the conversion routing table, and forward the access traffic to the SVC service based on the annotation information;

[0106] the SVC service forwards the access traffic to the external network through the target static IP address.

[0107] Optionally, the network access device 300 is further configured to:

[0108] determine a traffic receiving node from the plurality of DPU nodes according to the annotation information, the traffic receiving node configured to receive the access traffic sent by the external network.

[0109] Figure 3 The network access device of the illustrated embodiment can be used to execute the technical solutions of the above method embodiments, and the implementation principles and technical effects are similar, which will not be described here.

[0110] Figure 4 The structural schematic diagram of the electronic device provided by the embodiment of the present disclosure is provided. The following will be specifically referred to Figure 4The diagram illustrates a structural schematic suitable for implementing the electronic device 400 in the embodiments of this disclosure. The electronic device 400 in the embodiments of this disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), wearable electronic devices, etc., as well as fixed terminals such as digital TVs, desktop computers, smart home devices, etc. Figure 4 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0111] like Figure 4 As shown, the electronic device 400 may include a processing unit 401 (e.g., a central processing unit, a graphics processor, etc.) that can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 402 or a program loaded from a storage device 408 into a random access memory (RAM) 403 to implement the network access method as described in the embodiments of this disclosure. The RAM 403 also stores various programs and data required for the operation of the electronic device 400. The processing unit 401, ROM 402, and RAM 403 are interconnected via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0112] Typically, the following devices can be connected to I / O interface 405: input devices 406 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 407 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 408 including, for example, magnetic tapes, hard disks, etc.; and communication devices 409. Communication device 409 allows electronic device 400 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 4 An electronic device 400 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0113] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program in accordance with embodiments of the present disclosure. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for executing the methods illustrated by the flowcharts, thereby implementing the network access method as described above. In such embodiments, the computer program can be downloaded and installed from a network via the communication device 409, or installed from the storage device 408, or installed from the ROM 402. When the computer program is executed by the processing device 401, the above-mentioned functions defined in the methods of the embodiments of the present disclosure are performed.

[0114] It should be noted that the computer-readable medium described above in the present disclosure can be a computer-readable signal medium or a computer-readable storage medium or any combination thereof. The computer-readable storage medium, for example, can be, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any suitable combination thereof. More specific examples of the computer-readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, the computer-readable storage medium can be any tangible medium that contains or stores a program used or used in conjunction with an instruction execution system, apparatus, or device. In the present disclosure, the computer-readable signal medium can include a data signal carried in a baseband or as a part of a carrier wave, which carries computer-readable program code. Such a propagated data signal can take on many forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than the computer-readable storage medium that can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained in the computer-readable medium can be transmitted by any suitable medium, including but not limited to a wire, cable, optical fiber, RF (radio frequency), or the like, or any suitable combination thereof.

[0115] In some embodiments, the client, server, or other computing machines can communicate using any known or later developed form of computer-readable media, including but not limited to wireless media, wire-based media, optical-based media, and the like. In some embodiments, the client, server, or other computing machines can communicate using any current or later developed network protocol, such as the HyperText Transfer Protocol (HTTP), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), the Internet, and the like, as well as any current or later developed network.

[0116] The computer-readable medium described above can be included within the electronic device described above; or can exist separately from the electronic device, and not be assembled into the electronic device.

[0117] Optionally, when the one or more programs described above are executed by the electronic device, the electronic device can further perform other steps described in the embodiments above.

[0118] Computer program code for carrying out operations of the present disclosure can be written in any one or more of a number of programming languages or combinations of languages including an object-oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network ("LAN") or a wide area network ("WAN"), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0119] The computer program product of the first aspect can include one or more non-transitory computer-readable media storing instructions that, when executed, cause one or more processors to perform the operations of the first aspect. The computer program product of the first aspect can include a non-transitory computer-readable medium storing code that, when executed, causes a computer to perform operations for the first aspect.

[0120] The units described in the embodiments of the present disclosure can be implemented by software, or by hardware, or by a combination of software and hardware. In some cases, the names of the units do not constitute a limitation on the units themselves.

[0121] The functions described in this document can be implemented in part or in whole using one or more hardware logic components. For example, and without limitation, illustrative types of hardware logic components that can be used include Field-programmable Gate Arrays (FPGAs), Program-specific Integrated Circuits (ASICs), Program-specific Standard Products (ASSPs), System-on-a-chip systems (SOCs), Complex Programmable Logic Devices (CPLDs), etc.

[0122] In the context of the present disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fiber, portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0123] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or gateway that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or gateway. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or gateway that includes said element.

[0124] The above description is merely a specific embodiment of this disclosure, enabling those skilled in the art to understand or implement it. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A network access method, characterized by, The method is applied to a K8S cluster including a plurality of DPU nodes and a plurality of objects in a VPC network, and the method comprises: setting annotation information of an SVC service of the K8S cluster, and enabling external network access of the SVC service, wherein the annotation information is used to represent network configuration between the SVC service and the plurality of DPU nodes; determining a target DPU node as a gateway exit in the VPC network, to connect the target DPU node; after the target DPU node obtains access traffic from a target object in the plurality of objects through the VPC network, forwarding the access traffic to the external network by using the SVC service based on the annotation information.

2. The method of claim 1, wherein, The setting of the annotation information of the SVC service of the K8S cluster comprises: deploying a network plug-in for a LoadBalancer type service on the plurality of DPU nodes, wherein the LoadBalancer type service refers to a type of service under the SVC service of the K8S cluster; setting the plurality of DPU nodes on which the network plug-in is deployed as import and export nodes of the LoadBalancer type service through annotation information.

3. The method of claim 1, wherein, The enabling of the external network access of the SVC service comprises: setting at least one static IP address for the SVC service in the K8S cluster through an OVN network plug-in, so that the SVC service accesses the external network through the at least one static IP address.

4. The method of claim 1, wherein, The determining of the target DPU node as the gateway exit in the VPC network comprises: obtaining node numbers of the plurality of DPU nodes, and calculating weights of each DPU node according to the node numbers; determining at least one candidate DPU node with a weight greater than a set weight, and determining a primary candidate DPU node and a backup candidate DPU node in the at least one candidate DPU node; taking a normally running primary candidate DPU node as the target DPU node, or taking the backup candidate DPU node as the target DPU node when the primary candidate DPU node is not normally running; taking the target DPU node as the gateway exit of the VPC network.

5. The method of claim 3, wherein, Before the target DPU node obtains access traffic from a target object in the plurality of objects through the VPC network, the method further comprises: configuring a conversion routing table of the at least one static IP address on an OVS bridge, wherein the OVS bridge runs on a SoC of the target DPU node, and the conversion routing table is configured with a conversion rule between the at least one static IP address and IP addresses of the plurality of objects.

6. The method of claim 5, wherein, After the target DPU node obtains access traffic from a target object in the plurality of objects through the VPC network, forwarding the access traffic to the external network by using the SVC service based on the annotation information comprises: The target DPU node obtains access traffic issued by a target object in the plurality of objects through the VPC network, converts a network segment where the target object is located into a target static IP address according to the conversion routing table, and forwards the access traffic to the SVC service based on the annotation information; The SVC service forwards the access traffic to the external network through the target static IP address.

7. The method of claim 1, wherein, After the annotation information of the SVC service of the K8S cluster is set, the method further includes: Determining a traffic receiving node in the plurality of DPU nodes according to the annotation information, the traffic receiving node being used to receive access traffic issued by the external network.

8. A network access device, comprising: The device is applied to a K8S cluster, and the K8S cluster includes a plurality of DPU nodes and a plurality of objects located in a VPC network, and the device includes: A setting unit configured to set annotation information of an SVC service of the K8S cluster, and to start external network access of the SVC service, wherein the annotation information is used to represent network configuration between the SVC service and the plurality of DPU nodes; A determining unit configured to determine a target DPU node as a gateway exit in the plurality of DPU nodes by the VPC network, to connect the target DPU node; An access unit configured to, after the target DPU node obtains access traffic issued by a target object in the plurality of objects through the VPC network, forward the access traffic to the external network by the SVC service based on the annotation information.

9. An electronic device, comprising: comprise: a memory; a processor; and a computer program; wherein the computer program is stored in the memory and configured to be executed by the processor to implement the network access method according to any one of claims 1 to 7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the network access method according to any one of claims 1 to 7.

Images