Method for dynamically and automatically assembling network by federal peer-to-peer clusters in edge environment

Abstract

The invention provides a method for dynamically and automatically assembling a network by federated peer-to-peer clusters in an edge environment, which relates to the technical field of edge clusters and comprises the following steps: creating a unique identity identification certificate for each edge cluster; the local edge cluster and the remote edge cluster establish mutual authentication communication connection with the Kube-API service module of the peer-to-peer cluster through respective authentication management modules, and perform mutual peer-to-peer identity authentication according to identity certificates of the local edge cluster and the remote edge cluster; and after the peer-to-peer identity identification is successfully authenticated, the local edge cluster and the remote edge cluster create peer-to-peer cluster resources and VPN tunnel endpoint information between the local edge cluster and the remote edge cluster through respective network management control modules, establish a secure tunnel according to the peer-to-peer cluster resources and the VPN tunnel endpoint information, and perform synchronization and exchange of the peer-to-peer cluster resources by using the secure tunnel. According to the invention, automatic network authentication, assembly and cross-cluster services without manual intervention are provided, and the edge federated peer-to-peer cluster is dynamically formed.

Description

Technical Field

[0001] The present invention relates to the field of edge cluster technology, and in particular to a method for dynamically and automatically assembling a network of a federated peer cluster in an edge environment. Background Art

[0002] With the development of containerization technology and the widespread application of edge computing, users use a large number of containers to cluster, orchestrate and manage edge devices, thereby realizing cloud-edge collaboration and intelligent computing.

[0003] The existing edge federation cluster includes a master edge cluster and multiple slave edge clusters, and the multiple slave edge clusters are controlled by the master edge cluster. After the master edge cluster and the slave edge clusters are connected to the network, the master edge cluster manages cross-edge cluster tasks through resource distribution strategies and resource differentiation coverage configuration strategies.

[0004] However, the edge environment has diverse characteristics such as harsh environment and sudden situations. Therefore, it is very easy for abnormal situations such as edge cluster destruction, network disconnection and weak network to occur in the edge federation cluster. Abnormal situations will cause the edge cluster to lose connection, resulting in the inability to interconnect and schedule resources between the normal edge cluster and the disconnected edge cluster; especially when the network of the main edge cluster is abnormal, other slave edge clusters cannot work together; and each slave edge cluster is independent of each other, without strong connection, and the network may not be interoperable. If the main edge cluster is destroyed, the federation cluster will be unavailable as a whole, and there is a risk of single point failure.

[0005] In addition, since the networks of the slave edge clusters are not interoperable, in order to achieve network connectivity of the edge federation cluster, manual identity authentication is required to identify the identities of both parties, and switch the network master-slave relationship or configuration of the master edge cluster and the slave edge cluster to achieve cross-cluster network connectivity; and when the lost edge cluster network is restored, it is also necessary to manually configure the network for reassembly, and the lost edge cluster cannot automatically rejoin the federation cluster; not only does it have poor configuration flexibility and a complex and error-prone configuration process, it cannot meet the timeliness and mobility requirements of edge device collaboration in the field environment; it also lacks the ability to manage refined network traffic across clusters, and there are network isolation and security issues across clusters. Summary of the invention

[0006] The present invention provides a method for dynamically and automatically assembling a network of a federated peer cluster in an edge environment, which is used to solve the above-mentioned problems existing in the existing edge federated cluster.

[0007] The present invention provides a method for dynamically and automatically assembling a network of a federated peer cluster in an edge environment, the method comprising: Each edge cluster creates a unique identity credential; the local edge cluster establishes an authentication communication connection between the local edge cluster and the remote edge cluster through the authentication management module and the Kube-API service module of the remote edge cluster. Conversely, the remote edge cluster establishes an authentication communication connection between the remote edge cluster and the local edge cluster through the authentication management module and the Kube-API service module of the local edge cluster; and mutual identity authentication is performed based on the identity credentials of both parties; After the peer identity authentication is successful, the local edge cluster and the remote edge cluster create peer cluster resources and VPN tunnel endpoint information between the local edge cluster and the remote edge cluster through their respective network management control modules, establish a secure tunnel based on the peer cluster resources and VPN tunnel end information, and use the secure tunnel to synchronize and exchange the peer cluster resources, thereby realizing automatic assembly of networks between multiple edge clusters.

[0008] Further, the network management control module includes a network management module, a gateway controller and a routing controller; The network management module is used to create peer cluster resources and VPN tunnel endpoint information between the local edge cluster and the remote edge cluster, and use the secure tunnel to synchronize peer cluster resources; The gateway controller is used to obtain the peer cluster resources and VPN tunnel endpoint information, and use the peer cluster resources to establish the secure tunnel and manage, update and maintain the secure tunnel; The routing controller is used to obtain the peer cluster resources, and use the peer cluster resources to configure routing strategies and routing rules, and perform traffic interception and routing forwarding on cross-cluster network traffic according to the routing strategies and routing rules.

[0009] Furthermore, the peer cluster resources include: API services, authentication addresses, authentication identifiers, network configurations, resource provisioning and status of the local edge cluster and the remote edge cluster; The VPN tunnel endpoint information includes: VPN tunnel address, VPN authentication certificate, Pod CIDR, Pod external CIDR, NAT CIDR and NAT external CIDR of the local edge cluster and the remote edge cluster.

[0010] Further, the network management module includes a peer cluster management unit and a tunnel endpoint management unit; The peer cluster management unit in each edge cluster creates corresponding peer cluster type resources; The peer cluster management unit of the local edge cluster creates a local network configuration that represents a remote peer cluster and synchronously obtains the corresponding remote network configuration; After simultaneously acquiring the local network configuration and the remote network configuration, the tunnel endpoint management unit creates corresponding VPN tunnel endpoint information, and synchronizes the VPN tunnel endpoint information to the gateway controller and the routing controller in real time; the gateway controller and the routing controller dynamically adjust the tunnel endpoint according to the VPN tunnel endpoint information.

[0011] Furthermore, the secure tunnel establishes a connection through the gateway controller, and prevents IP address conflicts by filling in a routing table and configuring corresponding network address translation rules.

[0012] Furthermore, when configuring routing policies and routing rules, creating VPN tunnel endpoint information, and configuring network address translation rules, the gateway controller creates an independent network namespace, places all information in the network namespace, and uses the network namespace to achieve synchronization and exchange of peer cluster resources.

[0013] Furthermore, the network namespace includes: Two independent network namespaces: host network namespace and gateway network namespace; the gateway network namespace is newly created; Create a pair of network cards; one end marked as the host network card interface is set in the host network namespace, and the other end marked as the gateway network card interface is set in the gateway network namespace; Initialize a secure tunnel across cluster gateways to connect, manage, update, and maintain the secure tunnel.

[0014] Further, the routing controller includes a virtual network Operator subcomponent and a routing Operator subcomponent; The virtual network operator subcomponent is used to automatically update the forwarding data table entries of the general network virtualization encapsulation protocol device and monitor the routing controller in the network namespace where the peer cluster component is deployed; The routing Operator subcomponent is used to control and adjust VPN tunnel endpoint information, and configure routing strategies and routing rules for each tunnel endpoint object instance according to the running node.

[0015] Furthermore, when the routing controller and the gateway controller run on the same node, the routing policy and routing rules are configured to send all traffic in sequence through the geneve network card interface, the gateway network card interface of the gateway controller and the host network card interface.

[0016] Furthermore, when the routing controller runs on the first node and the gateway controller runs on the second node, the routing policy and routing rules are configured to send all traffic in sequence through the geneve network card interface of the first node, the geneve network card interface of the second node and the tunnel network card interface of the gateway controller.

[0017] In general, the present invention provides a method for dynamically and automatically assembling a network of a federated peer cluster in an edge environment. The technical solution conceived by the present invention can achieve the following beneficial effects compared with the prior art: (1) The present invention uses a network management control module to create peer cluster resources and VPN tunnel endpoint information, establishes a secure tunnel based on the peer cluster resources and VPN tunnel end information, and uses the secure tunnel to synchronize and exchange peer cluster resources. Multiple edge clusters automatically assemble a peer network by exchanging peer cluster resources and establishing secure tunnels, thereby forming a federated peer cluster. In the federated peer cluster of the present invention, the identity of each edge cluster is equal, and there is no master-slave distinction between cluster roles. The networks are interconnected with each other. Even if an abnormality occurs in one of the clusters, the resource interconnection and resource scheduling between the clusters can be guaranteed, so that the federated peer cluster can operate normally.

[0018] (2) When joining a federated peer cluster, the edge cluster of the present invention will automatically perform identity authentication and establish a dynamic security tunnel, thereby avoiding the joining of untrusted edge clusters. In the edge computing scenario, when an edge cluster is added or lost, there is no need to manually reconfigure the network or reassemble it. It can also perform network automatic authentication, network automatic assembly and cross-cluster services, thereby realizing the dynamic assembly of edge federated peer clusters. The configuration is simple and flexible, not prone to errors, and can meet the timeliness and mobility requirements of edge device collaboration in field environments.

[0019] (3) The present invention implements traffic management and high-performance communication across cluster networks by setting up a routing controller and a gateway controller to intercept and route traffic within the cluster network.

[0020] (4) The present invention achieves isolation and security control from the existing network of the edge cluster by creating a network namespace, customizing the network namespace, network interface, routing policy and routing rules, supports multi-cluster joint task scheduling and resource scheduling, and supports multi-cluster joint elastic, distributed and collaborative computing. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 It is a method flow chart of a method for dynamically and automatically assembling a network of a federated peer cluster in an edge environment provided by the present invention; Figure 2 It is a schematic diagram of the overall architecture of a method for dynamically and automatically assembling a network of a federated peer cluster in an edge environment provided by the present invention; Figure 3 It is a control logic diagram between various user-defined resources and a network management control module in a method for dynamically and automatically assembling a network of a federated peer cluster in an edge environment provided by the present invention; Figure 4 It is a schematic diagram of a network management control module of a method for dynamically and automatically assembling a network of a federated peer cluster in an edge environment provided by the present invention; Figure 5 It is a schematic diagram of the architecture of gateway network namespaces and secure tunnels of different clusters of gateway controllers in a method for dynamically and automatically assembling a network of a federated peer cluster in an edge environment provided by the present invention; Figure 6 It is a schematic diagram of the architecture of a routing controller and a gateway controller on the same node in a method for dynamically and automatically assembling a network of a federated peer cluster in an edge environment provided by the present invention; Figure 7 It is a schematic diagram of the architecture of the routing controller and the gateway controller at different nodes of a method for dynamically and automatically assembling a network of a federated peer cluster in an edge environment provided by the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings and embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work belong to the scope of protection of the present invention.

[0024] It should be noted that, in the description of the embodiments of the present invention, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a method, step or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such method, step or device. In the absence of further restrictions, the elements defined by the sentence "include a ..." do not exclude the existence of other identical elements in the method, step or device including the elements.

[0025] The English and English abbreviations involved in this invention are explained as follows: Kube-API service: Kubernetes API Server, an application that provides Kubernetes functional services and is responsible for cluster state storage; Kubernetes: a unified resource orchestration platform for containers; API: Application Programming Interface; VPN: Virtual Private Network; Pod: a workload resource object provided by a container cluster and the smallest unit of container orchestration management; CIDR: Classless Inter-Domain Routing, which aggregates and allocates network IP addresses; NAT: Network Address Translation; Operator: The operation controller that manages and maintains the application lifecycle in the container cluster; geneve: general network virtualization encapsulation protocol; Etcd - high performance distributed key-value (kv) database. Service: the service object provided by the container cluster, which implements the network layer 4 access of the container service; UDP: User Datagram Protocol; CRD: User-defined resources, which extend the user-defined resource capabilities based on Kubernetes; WebHook: HTTP-based callback function that enables event-driven, lightweight communication between APIs. CNI: container orchestration platform network interface; IPAM: management of network IP addresses; Overlay network: virtualized network technology built on top of the underlying physical network; Underlay network: basic physical network; CR: User-defined resource object instance, which extends the resources required by users based on Kubernetes; MAC: Local area network address.

[0026] The present invention provides a method for dynamically and automatically assembling a network of edge federated peer clusters, which dynamically and automatically networks multiple edge clusters by establishing a secure tunnel, establishes and communicates between cross-cluster networks, and realizes the automatic establishment of peer networks in federated peer clusters, high-speed communication between networks, and network traffic management. Figure 1 As shown, the method specifically includes: S101: Each edge cluster creates a unique identity credential; the local edge cluster establishes an authentication communication connection between the local edge cluster and the remote edge cluster through the authentication management module and the Kube-API service module of the remote edge cluster. Conversely, the remote edge cluster establishes an authentication communication connection between the remote edge cluster and the local edge cluster through the authentication management module and the Kube-API service module of the local edge cluster; and mutual identity authentication is performed based on the identity credentials of both parties.

[0027] It should be noted that the identity credential is an identification credential used by the edge cluster to identify itself and is unique.

[0028] The authentication management module implements remote edge cluster identity authentication access and peer cluster resource exchange in the process of member clusters being peer-to-peer networks. Wherein, peer networks refer to network roles with the same identity.

[0029] The Kube-API service module is a two-way authentication API service provided by the Kubernetes native container orchestration. It is usually connected to Etcd, which is a cluster resource storage component provided by the Kubernetes native container orchestration.

[0030] like Figure 2 As shown, each edge cluster includes a Kube-API service module set on a management node, and an authentication management module and a network management control module set on a computing node.

[0031] Specifically, on the one hand, the local edge cluster establishes an authentication communication connection and performs identity authentication with the Kube-API service module of the remote edge cluster through the authentication management service module, and exchanges cluster identity information with each other after the authentication is established; on the other hand, the remote edge cluster also establishes an authentication communication connection, performs identity authentication and exchanges cluster identity information with the Kube-API service module of the local edge cluster through the authentication management service.

[0032] S102: After the peer identity authentication is successful, the local edge cluster and the remote edge cluster create peer cluster resources and VPN tunnel endpoint information between the local edge cluster and the remote edge cluster through their respective network management control modules, establish a secure tunnel based on the peer cluster resources and VPN tunnel endpoint information, and use the secure tunnel to synchronize and exchange peer cluster resources, thereby realizing automatic assembly of networks between multiple edge clusters.

[0033] It should be noted that peer cluster resources include: API services, authentication addresses, authentication identifiers, network configuration, resource supply and status of local edge clusters and remote edge clusters; VPN tunnel endpoint information includes: VPN tunnel address, VPN authentication certificate, Pod CIDR, Pod external CIDR, NAT CIDR and NAT external CIDR of local edge clusters and remote edge clusters. The network management control module in each edge cluster is responsible for the synchronization and exchange of peer cluster resources.

[0034] As an embodiment, the network management control module includes a network management module, a gateway controller and a routing controller.

[0035] The network management module is used to create peer cluster resources and VPN tunnel endpoint information between the local edge cluster and the remote edge cluster, and use the secure tunnel to synchronize the peer cluster resources.

[0036] Specifically, create API services associated with the remote edge cluster, authentication addresses, authentication identifiers, network configuration, resource supply and status of the peer cluster, and VPN tunnel endpoint information required to establish a secure tunnel, and implement NAT IP address allocation such as Pod and Service between member clusters.

[0037] The gateway controller is used to obtain peer cluster resources and VPN tunnel endpoint information, establish a secure tunnel using the peer cluster resources and VPN tunnel endpoints, and manage, update and maintain the secure tunnel.

[0038] Specifically, a VPN tunnel is established through information such as the VPN tunnel address and VPN authentication certificate, the life cycle of the secure tunnel leading to the remote edge cluster is managed and updated, and the gateway Pod in each member cluster is managed and updated. Traffic between different member clusters is forwarded through the secure tunnel UDP protocol, thereby managing and maintaining normal network communication between the local edge cluster and the remote edge cluster.

[0039] The routing controller is used to obtain VPN tunnel endpoint information, and use the VPN tunnel endpoint information to configure routing policies and routing rules, and intercept and route network traffic within the cluster according to the routing policies and routing rules.

[0040] Specifically, the corresponding routing policies and routing rules are configured for the gateway's cross-cluster traffic, so that the cross-cluster traffic can be intercepted and routed through the secure tunnel on each node; that is, the routing controller obtains the VPN tunnel address, Pod CIDR and NAT CIDR provided by the VPN tunnel endpoint information to configure the routing policies and routing rules, and then intercepts and routes the network traffic within the cluster, and forwards it to the tunnel provided by the gateway controller.

[0041] In other words, Kubernetes extends the default cloud native resources through the Operator method of CRD resources + WebHook interception + Controller. The federated peer cluster is based on the user-defined resource cluster peer network. Through the dynamic assembly network of multiple edge clusters, the federated peer cluster finds the final state described by the user-defined resource in the customized network management module, gateway controller, routing controller and peer cluster, that is, distributes the CRD resource object instance to the member clusters of the peer network to be established, so that each member cluster in the peer network can use WebHook to intercept and deploy the CRD resource object instance. The controller continuously corrects the state of the CRD resource object instance by defining the control and coordination logic in advance, so that the federated peer cluster defined in the CRD resource can automatically control the running state of the assembled network.

[0042] As an example, Figure 3 As shown, the method for establishing a network management control module includes: establishing multiple user-defined resources and controllers. In the process of establishing a peer-to-peer network, the local edge cluster and the remote edge cluster need to access each other's three service endpoints.

[0043] Specifically, the service endpoints include: Kube-API service, authentication management service and tunnel endpoint service. Among them, Kube-API service is a Kube-API service module for both peer clusters to access each other, which is used to obtain the PodCIDR of the peer cluster and the running information of Pod in different replicas across clusters; authentication management service: used to authenticate and manage both clusters, and requires access to the identity authentication of both parties for security authentication; tunnel endpoint service: used to establish a secure tunnel and intercept and route the network traffic of both peer clusters based on the secure tunnel.

[0044] It should be noted that the identity authentication of both parties requires the exchange of peer cluster resources and VPN tunnel end information, including the exchange of network authentication parameters; for example, network authentication parameters may include user-defined resources such as API services, authentication addresses, authentication identifiers, VPN tunnel addresses, and VPN authentication certificates. Among them, according to the nature of resource information, each user-defined resource may include resource specifications and resource status.

[0045] As an embodiment, the network configuration method of user-defined resources includes: each network configuration specifies a recipient in the resource specification part, and the resource status part is used to send a signal to the cluster that creates the resource to determine whether the network has been remapped by the remote edge cluster; only when the resource specification part is filled with the network address and tunnel configuration parameters used by the local edge cluster, can the network configuration object instance be created. Conversely, the resource status part of the network configuration is updated by the remote edge cluster that receives it and creates resources for it.

[0046] It should be noted that each edge cluster will create a network configuration pointing to the remote edge cluster, which contains the required network authentication parameters and synchronizes it to the remote edge cluster. After receiving it, the remote edge cluster will update its resource status part and synchronize the changes to the resource status part to the original local edge cluster.

[0047] The network management control module includes a network management module, a gateway controller and a routing controller.

[0048] As an embodiment, the network management module is one of the core components of the federated peer-to-peer cluster networking, such as Figure 4 As shown, it includes a peer cluster management unit and a tunnel endpoint management unit.

[0049] The peer cluster management unit in each edge cluster creates corresponding peer cluster type resources; the peer cluster management unit of the local edge cluster creates a local network configuration, which represents a remote peer cluster, and synchronously obtains the corresponding remote network configuration.

[0050] It should be noted that one local network configuration corresponds to one edge cluster. The network management module is used to implement network communication between peer clusters, create network configurations, and send local network configurations to remote edge clusters. At the same time, the network management module is also used to receive the remote network configuration of the remote edge cluster, and configure the mapping of the remote network address used by the local edge cluster in the network configuration of the remote edge cluster. Among them, each network configuration will be synchronously copied to the remote edge cluster it points to, and vice versa, each remote edge cluster will create its own network configuration and synchronously copy it to the original local edge cluster.

[0051] After obtaining the local network configuration and the remote network configuration at the same time, the tunnel endpoint management unit creates the corresponding VPN tunnel endpoint information and synchronizes the VPN tunnel endpoint information to the gateway controller and the routing controller in real time; the gateway controller and the routing controller dynamically adjust the tunnel endpoint according to the VPN tunnel endpoint information.

[0052] That is, when the network management module collects the network configurations of the remote edge cluster and the local edge cluster at the same time, the tunnel endpoint management unit will create the corresponding VPN tunnel endpoint information, simulate the network interconnection between the two edge clusters, and then the gateway controller and the routing controller will dynamically adjust the tunnel endpoints, laying the foundation for the establishment of gateway tunnels, the configuration of routing policies and routing rules, and traffic interception and routing forwarding.

[0053] It should be noted that when performing peer-to-peer network management, the gateway controller is responsible for negotiating connection parameters with each remote edge cluster during the peer-to-peer interconnection process. Each member cluster has a network CNI address management IPAM plug-in installed by default to manage the local cluster IP address and handle possible network conflicts by configuring network address translation rules.

[0054] In addition, the gateway controller is also used to convert Pod IPs during resource synchronization from the remote edge cluster to the local edge cluster; in the process of propagating local edge cluster resources to the remote edge cluster, it is used for service endpoint shard mapping to achieve Service and Pod IP association.

[0055] Specifically, the interconnection between peer clusters is achieved by using the secure tunnel established by VPN. During the peer establishment process, the secure tunnel establishes a dynamic connection based on the parameters negotiated by both parties. That is, the secure tunnel changes dynamically based on the changes in the peer cluster resources and VPN tunnel endpoint information.

[0056] As an embodiment, the secure tunnel establishes a connection through a gateway controller, and prevents IP address conflicts by filling a routing table and configuring corresponding network address translation rules, wherein the network address translation rules can be configured using iptables.

[0057] In the Overlay virtual network across federated peer clusters, all Pod traffic directed to the remote edge cluster is forwarded to the gateway controller through the nodes of the local edge cluster, and enters the secure tunnel through the gateway controller; similarly, the remote edge cluster enters the virtual overlay network based on the traffic flowing out of the secure tunnel and reaches the node carrying the target Pod. Intra-cluster cross-node communication is still provided by the cluster's default CNI, and the cluster also supports the Underlay network.

[0058] As an example, Figure 5As shown, the gateway controller includes a tunnel operator subcomponent. That is, a gateway controller including a tunnel operator subcomponent is created in the local edge cluster and the remote edge cluster respectively.

[0059] When configuring routing policies and routing rules, creating VPN tunnel endpoint information, and configuring network address translation rules, the gateway controller creates an independent network namespace, places all information in the network namespace, uses the network namespace to synchronize and exchange peer cluster resources, and manages and maintains secure tunnels to avoid conflicts.

[0060] The gateway controller not only establishes secure tunnels with other peer clusters, but also configures network address translation rules for Pods of remote edge clusters and CIDRs to prevent conflicts. Pods in the gateway controller are deployed using Deployment, and their Pods run in host network mode.

[0061] As an example, the network namespace includes: Two independent network namespaces: host network namespace and gateway network namespace; the gateway network namespace is newly created; Create a pair of network cards; one end marked as the host network card interface is set in the host network namespace, and the other end marked as the gateway network card interface is set in the gateway network namespace; Initialize the secure tunnel across cluster gateways to connect, manage, update, and maintain the secure tunnel.

[0062] Furthermore, the gateway network namespace includes a gateway network card interface and a tunnel network card interface; the host network namespace includes a host network card interface and a physical network card.

[0063] The cross-cluster traffic generated by the local edge cluster workload is routed to the gateway network namespace before being processed. In the gateway network namespace, the tunnel operator subcomponent controls and regulates the VPN tunnel endpoint information, creates a secure tunnel to the cluster described by the CR for each VPN tunnel endpoint information, and adds a static route for the remote edge cluster.

[0064] It should be noted that if the local network address used in the local edge cluster conflicts with the remote network address in the remote edge cluster, the gateway controller will configure network address translation rules for cross-cluster traffic. That is, in the host network namespace, the tunnel operator subcomponent will add a routing policy and routing rule, indicating that the kernel must intercept and route all traffic from the remote edge cluster according to the custom routing table content.

[0065] It should be noted that the tunnel operator subcomponent can adopt a pluggable architecture design, which is mainly based on the cluster interconnection security tunnel information carried by the VPN tunnel endpoint information, providing different cluster interconnection VPN implementations for different VPN technologies, rather than being limited to a certain VPN technology.

[0066] As an embodiment, the routing controller includes a virtual network operator subcomponent and a routing operator subcomponent.

[0067] The routing controller runs on each node of the cluster and is used to intercept traffic within the cluster and forward traffic based on routing policies and routing rules. The Pod in the routing controller can be deployed using Daemon Set, and its Pod can run in host network mode.

[0068] Furthermore, the host network namespace includes host network card interfaces, physical network cards, and geneve network card interfaces.

[0069] As an embodiment, when the routing controller runs on each node of the cluster, it includes: When the routing controller starts, it creates a Geneve network card interface on the host based on the Geneve network protocol and adds it to the host network namespace; When the routing controller and the gateway controller run on the same node, configure the routing policy and routing rules to send cross-cluster traffic to the gateway NIC interface of the gateway controller; When the routing controller and the gateway controller are running on different nodes, configure the routing policy and routing rules to send cross-cluster traffic to the tunnel NIC interface of the gateway controller. It should be noted that the management of the network by the routing controller is independent of the CNI plug-in that comes with the cluster and will not interfere with the existing network configuration or existing network interfaces. The routing controller uses a custom routing table for the routing required for cross-cluster traffic and forwards traffic through the geneve NIC interface it creates.

[0070] The virtual network operator subcomponent is used to automatically update the forwarding data table entries of the generic network virtualization encapsulation protocol device and monitor the routing controller in the network namespace where the peer cluster components are deployed. Among them, when the Pod is running on the current node, it is labeled with the MAC label address of the geneve device; when the Pod is running on a different node, the geneve forwarding data table of the geneve device is filled with the information of the remote tunnel endpoint.

[0071] The Routing Operator subcomponent is used to control the mediation and VPN tunnel endpoint information, and configure routing policies and routing rules for each tunnel endpoint object instance based on the running node.

[0072] like Figure 6 As shown, when the routing controller and the gateway controller run on the same node, the routing policy and routing rules are configured to send all traffic through the geneve network card interface, the gateway network card interface of the gateway controller, and the host network card interface in sequence.

[0073] like Figure 7 As shown, when the routing controller runs on the first node and the gateway controller runs on the second node, the routing policy and routing rules are configured to send all traffic in sequence through the geneve network card interface of the first node, the geneve network card interface of the second node and the tunnel network card interface of the gateway controller.

[0074] It should be noted that during the network routing forwarding process, all routes are inserted into the custom routing table. If the running gateway controller fails, all routes will be dynamically reconfigured to send traffic to the correct node where the new running workload instance is located.

[0075] In summary, the present invention provides a method for dynamically and automatically assembling a network of a federated peer cluster in an edge environment. The edge federated peer cluster mainly includes an authentication management module, a network management module, a gateway controller, and a routing controller, which are jointly responsible for connecting and automatically assembling the networks of different edge clusters. The federated peer cluster network reuses existing networks, custom network namespaces, custom routing tables, and policy routing rules as much as possible to isolate its network configuration and avoid changing the existing network configuration. And when establishing a peer cluster connection network, the interconnection with different edge clusters can be automatically configured without the user inputting any information. The network interconnection between multiple edge clusters is completed in a dynamic and secure manner based on the existing network configuration of the cluster, without any changes to the existing cluster network, and the automatic connection of the flat network of multiple edge clusters can be achieved.

[0076] It should be noted that, for the above-mentioned various embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0077] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0078] In the several embodiments provided in this application, it should be understood that the disclosed method or system can be implemented in other ways. For example, the above-described embodiments are only schematic, and the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0079] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0080] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0081] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the whole or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a memory, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application.

[0082] Those skilled in the art will appreciate that all or part of the various circuits in the above embodiments may be completed by entering a program to instruct related hardware, and the program may be stored in a computer-readable memory, which may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0083] The above is only an exemplary embodiment of the present disclosure, and the scope of the present disclosure cannot be limited thereto. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the specification and practicing the disclosure here, those skilled in the art will easily think of the implementation scheme of the present disclosure. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the technical field not recorded in the present disclosure. The description and examples are regarded as exemplary only, and the scope and spirit of the present disclosure are defined by the claims.

[0084] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0085] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for dynamically assembling a network of federated peer clusters in an edge environment, characterized in that: The method comprises: Each edge cluster creates a unique identity credential; the local edge cluster establishes an authentication communication connection between the local edge cluster and the remote edge cluster through the authentication management module and the Kube-API service module of the remote edge cluster. Conversely, the remote edge cluster establishes an authentication communication connection between the remote edge cluster and the local edge cluster through the authentication management module and the Kube-API service module of the local edge cluster; and mutual identity authentication is performed based on the identity credentials of both parties; After the peer identity authentication is successful, the local edge cluster and the remote edge cluster create peer cluster resources and VPN tunnel endpoint information between the local edge cluster and the remote edge cluster through their respective network management control modules, establish a secure tunnel based on the peer cluster resources and VPN tunnel end information, and use the secure tunnel to synchronize and exchange the peer cluster resources, thereby realizing automatic assembly of networks between multiple edge clusters.

2. According to claim 1, a method for dynamically assembling a network of federated peer clusters in an edge environment is characterized in that: The network management control module includes a network management module, a gateway controller and a routing controller; The network management module is used to create peer cluster resources and VPN tunnel endpoint information between the local edge cluster and the remote edge cluster, and use the secure tunnel to synchronize peer cluster resources; The gateway controller is used to obtain the peer cluster resources and VPN tunnel endpoint information, and use the peer cluster resources and VPN tunnel endpoint information to establish the secure tunnel, and manage, update and maintain the secure tunnel; The routing controller is used to obtain the VPN tunnel endpoint information, and use the VPN tunnel endpoint information to configure routing policies and routing rules, and perform traffic interception and routing forwarding on cross-cluster network traffic according to the routing policies and routing rules.

3. According to claim 2, a method for dynamically assembling a network of federated peer clusters in an edge environment, characterized in that: The peer cluster resources include: API services, authentication addresses, authentication identifiers, network configuration, resource provisioning and status of local edge clusters and remote edge clusters; The VPN tunnel endpoint information includes: VPN tunnel address, VPN authentication certificate, Pod CIDR, Pod external CIDR, NAT CIDR and NAT external CIDR of the local edge cluster and the remote edge cluster.

4. According to claim 3, a method for dynamically assembling a network of federated peer clusters in an edge environment is characterized in that: The network management module includes a peer cluster management unit and a tunnel endpoint management unit; The peer cluster management unit in each edge cluster creates corresponding peer cluster type resources; The peer cluster management unit of the local edge cluster creates a local network configuration that represents a remote peer cluster and synchronously obtains the corresponding remote network configuration; After simultaneously acquiring the local network configuration and the remote network configuration, the tunnel endpoint management unit creates corresponding VPN tunnel endpoint information, and synchronizes the VPN tunnel endpoint information to the gateway controller and the routing controller in real time; The gateway controller and the routing controller dynamically adjust the tunnel endpoint according to the VPN tunnel endpoint information.

5. The method for dynamically assembling a network of a federated peer cluster in an edge environment according to claim 2, characterized in that: The secure tunnel establishes a connection through the gateway controller, and prevents IP address conflicts by filling in a routing table and configuring corresponding network address translation rules.

6. The method for dynamically assembling a network of a federated peer cluster in an edge environment according to claim 2, characterized in that: When configuring routing policies and routing rules, creating VPN tunnel endpoint information, and configuring network address translation rules, the gateway controller creates an independent network namespace, places all information in the network namespace, and uses the network namespace to synchronize and exchange peer cluster resources.

7. The method for dynamically assembling a network of a federated peer cluster in an edge environment according to claim 6, characterized in that: The network namespace includes: Two independent host network namespaces and gateway network namespaces; the gateway network namespace is newly created; Create a pair of network cards; one end marked as the host network card interface is set in the host network namespace, and the other end marked as the gateway network card interface is set in the gateway network namespace; Initialize a secure tunnel across cluster gateways to connect, manage, update, and maintain the secure tunnel.

8. The method for dynamically assembling a network of a federated peer cluster in an edge environment according to claim 2, characterized in that: The routing controller includes a virtual network operator subcomponent and a routing operator subcomponent; The virtual network operator subcomponent is used to automatically update the forwarding data table entries of the general network virtualization encapsulation protocol device and monitor the routing controller in the network namespace where the peer cluster component is deployed; The routing Operator subcomponent is used to control and adjust VPN tunnel endpoint information, and configure routing strategies and routing rules for each tunnel endpoint object instance according to the running node.

9. The method for dynamically assembling a network of a federated peer cluster in an edge environment according to claim 2, characterized in that: When the routing controller and the gateway controller are running on the same node, the routing strategy and routing rules are configured to send all traffic through the geneve network card interface, the gateway network card interface of the gateway controller and the host network card interface in sequence.

10. The method for dynamically assembling a network of a federated peer cluster in an edge environment according to claim 2, characterized in that: When the routing controller runs on the first node and the gateway controller runs on the second node, the routing strategy and routing rules are configured to send all traffic in sequence through the geneve network card interface of the first node, the geneve network card interface of the second node and the tunnel network card interface of the gateway controller.

Images