Intercommunication method, system and equipment for service network and management network of tenant in cloud scene

Abstract

The invention relates to the technical field of cloud scene networking communication, and provides an intercommunication method, system and device for a tenant service network and a management network in a cloud scene, and the method comprises the steps: creating a communication gateway in a container form, and creating a management network card and a service network card in a container of the communication gateway; creating a reverse proxy service, and configuring a corresponding reverse proxy monitoring configuration file for the communication requirements of the management network and the service network; and when a communication request is generated between the management network and the service network, monitoring and agenting the request flow through the reverse proxy. According to the intercommunication method, system and equipment for the service network and the management network of the tenant in the cloud scene, bidirectional intercommunication between the service and the management network can be realized by creating the communication gateway in a container form, external equipment is not needed, dependence on external configuration is avoided, various communication requirements are met, a user can flexibly define and manage configuration according to requirements, and the user experience is improved. And intercommunication can be realized after configuration, so that the safety is ensured.

Description

Technical Field

[0001] The present application relates to the field of cloud scenario networking communication technology, and in particular to a method, system and device for interconnecting a tenant service network and a management network in a cloud scenario. Background Art

[0002] In cloud scenarios, the network is usually divided into management network and business network to achieve isolation between management and control components and tenant services. The management network is mainly responsible for the operation and maintenance of the cloud platform, such as scheduling, monitoring and configuration of cloud resources, while the business network carries tenants' business applications, such as Web services and databases. This isolation design can improve the security of the system and prevent management traffic from interfering with business traffic.

[0003] However, in some scenarios, the management network and the business network need to communicate to meet specific management and business needs. For example, tenants may need to obtain management network data through the management network to better understand and manage the use of their cloud resources; or tenants may need to report business information to the management network so that the cloud platform can perform unified resource management and optimization.

[0004] At present, the common way to achieve communication between the management network and the business network is to connect the two through the physical network. Specifically, by configuring the corresponding VLAN and port aggregation on the physical switch, the traffic of the management network and the business network can be interconnected at the physical level. However, this method has the following problems and shortcomings: 1. Security risks: After the physical network is connected, the traffic between the management network and the business network is no longer completely isolated, making it vulnerable to network attacks and malicious access. For example, attackers may exploit vulnerabilities in the business network to invade the management network, obtain sensitive management data, or damage the cloud platform.

[0005] 2. Complex management: In order to ensure security, it is usually necessary to deploy security devices such as external firewalls in the physical network. These devices require complex configuration and management to implement security policy control of different traffic. For example, detailed access control rules need to be set to limit communication between specific IP addresses or ports. In addition, as the scale of the cloud platform expands and business needs change, these security policies need to be continuously adjusted and optimized, which increases the difficulty and workload of operation and maintenance.

[0006] 3. Additional costs: The purchase and maintenance of security equipment such as external firewalls require additional costs. For some small and medium-sized enterprises or start-ups, this may increase the overall cost of their cloud services and affect their competitiveness in the market.

[0007] Therefore, how to overcome the problems and shortcomings in terms of security, management complexity and cost when realizing communication between the management network and the business network through the physical network has become a technical problem that needs to be solved urgently. Summary of the invention

[0008] In view of this, in order to overcome the deficiencies of the prior art, the present application aims to provide a method, system and device for interconnection between a tenant business network and a management network in a cloud scenario.

[0009] According to a first aspect of the present application, a method for interconnecting a tenant service network and a management network in a cloud scenario is provided, the method comprising: Create a communication gateway in container form, and create a management network card and a business network card in the communication gateway container; Create a reverse proxy service and configure the corresponding reverse proxy listening configuration file for the communication needs between the management network and the business network; When a communication request occurs between the management network and the business network, the reverse proxy monitors and proxies the request traffic.

[0010] Optionally, the method for interconnecting a tenant business network and a management network in a cloud scenario of the present application creates a communication gateway in a container form, including: creating a communication gateway in a container form through an open source container orchestration platform.

[0011] Optionally, the intercommunication method between the tenant service network and the management network in the cloud scenario of the present application creates a management network network card and a service network network card in a container of a communication gateway, including: Create a management network NIC through the container network interface of the management network. The created management network NIC serves as the primary NIC to communicate with the container network, host network, and SVC network of the management network. A business network NIC is created through the container network interface of the virtual private cloud. The created business network NIC is used as a slave NIC to communicate with the business network used by the virtual machines in the virtual private cloud.

[0012] Optionally, the method for interconnecting the tenant business network and the management network in the cloud scenario of the present application creates a communication gateway in the form of a container, creates a management network network card and a business network network card in the container of the communication gateway, and also includes: using the address of the management network as the default routing address of the created communication gateway, and using the address of the business network network card as the gateway address of the created communication gateway in the virtual private cloud network segment.

[0013] Optionally, the method for interconnecting a tenant business network and a management network in a cloud scenario of the present application creates a reverse proxy service, including: creating a reverse proxy service by running a reverse proxy server in a container of a communication gateway.

[0014] Optionally, the intercommunication method between the tenant business network and the management network in the cloud scenario of the present application configures a corresponding reverse proxy listening configuration file for the communication requirements between the management network and the business network, including: To meet the requirement of the management network Pod accessing the business network virtual machine, configure the reverse proxy front-end listening configuration file in the reverse proxy service. The listening address consists of the management network network card address of the communication gateway and the destination port number accessed by the management network Pod. The listening back-end address is the address of the virtual machine. To meet the requirement of the business network virtual machine to access the management network Pod, configure the reverse proxy front-end listening configuration file in the reverse proxy service. The listening address consists of the business network network card address of the communication gateway and the destination port number accessed by the business network virtual machine. The listening back-end address is the address of the management network Pod.

[0015] Optionally, the method for interconnecting the tenant business network and the management network in the cloud scenario of the present application, when a communication request occurs between the management network and the business network, monitors and proxies the request traffic through a reverse proxy, including: when the management network Pod initiates a request to access the business network virtual machine, the request traffic reaches the management network network card of the communication gateway through the management network, monitors the traffic through the reverse proxy service and proxies the traffic to the backend virtual machine, and the response traffic of the virtual machine returns to the management network Pod through the reverse proxy service.

[0016] Optionally, the method for interconnection between the tenant business network and the management network in the cloud scenario of the present application, when a communication request occurs between the management network and the business network, monitors and proxies the request traffic through the reverse proxy, and also includes: when the virtual machine of the business network initiates a request to the management network Pod, the request traffic reaches the business network network card of the communication gateway through the virtual private cloud business network, monitors the traffic through the reverse proxy service and proxies the traffic to the backend Pod, and the response traffic of the Pod returns to the business network virtual machine through the reverse proxy service.

[0017] According to a second aspect of the present application, a system for interconnecting a tenant service network and a management network in a cloud scenario is provided, the system comprising an interconnection server, the interconnection server comprising: A communication gateway creation module is used to create a communication gateway in the form of a container, and to create a management network card and a business network card in the container of the communication gateway; The reverse proxy service creation module is used to create a reverse proxy service and configure the corresponding reverse proxy listening configuration file for the communication needs between the management network and the business network; The traffic interconnection module is used to monitor and proxy the request traffic through the reverse proxy when a communication request occurs between the management network and the business network.

[0018] According to a third aspect of the present application, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect of the present application when executing the program.

[0019] The method, system and device for interconnecting a tenant business network and a management network in a cloud scenario of the present application have the following beneficial technical effects: 1. Create a container-based communication gateway to achieve two-way communication between the business and management networks without the need for external equipment or reliance on external configuration.

[0020] 2. The communication gateway is based on the container's multi-network card Multus mechanism. Two network cards are used when it is created, one belonging to the management network and the other to the VPC network.

[0021] 3. Through reverse proxy, two-way communication between the management network and the business network can be achieved to meet various communication needs.

[0022] 4. Gateways can be reused, and users can flexibly define and manage configurations as needed. Only after configuration can intercommunication be achieved and security is guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1 This is an example diagram of the architecture of an intercommunication system between a tenant service network and a management network in a cloud scenario according to an embodiment of the present application; Figure 2 This is an example diagram of the architecture of an intercommunication service end of an intercommunication system between a tenant business network and a management network in a cloud scenario according to an embodiment of the present application; Figure 3 A flowchart of a method for interconnecting a tenant service network and a management network in a cloud scenario according to an embodiment of the present application; Figure 4 This is an example diagram of a method for interconnecting a tenant service network and a management network in a cloud scenario according to an embodiment of the present application; Figure 5 Another example diagram of a method for interconnecting a tenant service network and a management network in a cloud scenario according to an embodiment of the present application; Figure 6 A schematic diagram of the structure of the device provided in this application. DETAILED DESCRIPTION

[0025] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0026] It should be noted that the following embodiments and features in the embodiments may be combined with each other in the absence of conflict; and, based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making any creative work are within the scope of protection of the present disclosure.

[0027] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0028] Figure 1 FIG. 1 is an example diagram of an architecture of an intercommunication system between a tenant service network and a management network in a cloud scenario according to an embodiment of the present application. Figure 1 As shown, the system may include an intercommunication server 101, a communication network 102 and / or one or more intercommunication clients 103. Figure 1 The example shown is a plurality of intercommunication clients 103 .

[0029] The intercommunication server 101 can be any appropriate server for storing information, data, programs and / or any other suitable type of content. In some embodiments, the intercommunication server 101 can perform appropriate functions. For example, in some embodiments, the intercommunication server 101 can be used for the intercommunication between the tenant business network and the management network in a cloud scenario. As an optional example, in some embodiments, the intercommunication server 101 can be used to achieve the intercommunication between the tenant business network and the management network in a cloud scenario through a reverse proxy. For example, the intercommunication server 101 can be used to: create a communication gateway in the form of a container, create a management network network card and a business network network card in the container of the communication gateway; create a reverse proxy service, and configure a corresponding reverse proxy listening profile for the communication requirements between the management network and the business network; when a communication request occurs between the management network and the business network, the reverse proxy listens and proxies the request traffic.

[0030] Figure 2 FIG. 1 is an example diagram of the architecture of an intercommunication service end of an intercommunication system between a tenant business network and a management network in a cloud scenario according to an embodiment of the present application, such as Figure 2 As shown, the intercommunication service end of this embodiment includes: A communication gateway creation module is used to create a communication gateway in the form of a container, and to create a management network card and a business network card in the container of the communication gateway; The reverse proxy service creation module is used to create a reverse proxy service and configure the corresponding reverse proxy listening configuration file for the communication needs between the management network and the business network; The traffic interconnection module is used to monitor and proxy the request traffic through the reverse proxy when a communication request occurs between the management network and the business network.

[0031] As another example, in some embodiments, the intercommunication server 101 may send the intercommunication method between the tenant business network and the management network in the cloud scenario to the intercommunication client 103 for user use based on the request of the intercommunication client 103 .

[0032] As an optional example, in some embodiments, the intercommunication client 103 is used to provide visual intercommunication, which is used to receive a selection input operation of the intercommunication between the tenant business network and the management network in the user's cloud scenario, and to obtain the intercommunication corresponding to the option selected by the selection input operation from the intercommunication server 101 in response to the selection input operation and display the intercommunication, wherein at least the information on the intercommunication between the tenant business network and the management network in the cloud scenario and the operation options for the information on the intercommunication between the tenant business network and the management network in the cloud scenario are displayed.

[0033] In some embodiments, the communication network 102 can be any suitable combination of one or more wired and / or wireless networks. For example, the communication network 102 can include any one or more of the following: the Internet, an intranet, a wide area network (WAN), a local area network (LAN), a wireless network, a digital subscriber line (DSL) network, a frame relay network, an asynchronous transfer mode (ATM) network, a virtual private network (VPN), and / or any other suitable communication network. The intercommunication client 103 can be connected to the communication network 102 via one or more communication links (e.g., communication link 104), and the communication network 102 can be linked to the intercommunication server 101 via one or more communication links (e.g., communication link 105). The communication link can be any communication link suitable for transmitting data between the intercommunication client 103 and the intercommunication server 101, such as a network link, a dial-up link, a wireless link, a hard-wired link, any other suitable communication link, or any suitable combination of such links.

[0034] The intercommunication client 103 may include any one or more clients that present an interface related to the intercommunication between the tenant business network and the management network in the cloud scenario in an appropriate form for use and operation by the user. In some embodiments, the intercommunication client 103 may include any suitable type of device. For example, in some embodiments, the intercommunication client 103 may include a mobile device, a tablet computer, a laptop computer, a desktop computer, and / or any other suitable type of client device.

[0035] Although the interworking server 101 is illustrated as one device, in some embodiments, any suitable number of devices may be used to perform the functions performed by the interworking server 101. For example, in some embodiments, multiple devices may be used to implement the functions performed by the interworking server 101. Alternatively, a cloud service may be used to implement the functions of the interworking server 101.

[0036] Based on the above system, an embodiment of the present application provides a method for interconnection between a tenant business network and a management network in a cloud scenario, which is illustrated by the following embodiments.

[0037] Figure 3 The following is a flowchart of a method for interconnecting a tenant service network and a management network in a cloud scenario according to an embodiment of the present application. The method for interconnecting a tenant service network and a management network in a cloud scenario of the present embodiment can be executed at an interconnection service end, such as Figure 3 As shown, the method for interconnecting the tenant service network and the management network in the cloud scenario includes the following steps: Step S201: Create a communication gateway in a container form, and create a management network card and a service network card in the container of the communication gateway.

[0038] As an optional example, this embodiment creates a communication gateway in the form of a container through an open source container orchestration platform. In practical applications, the open source container orchestration platform for creating a communication gateway in the form of a container can be Kubernetes, which is an open source container orchestration platform for automating the deployment, expansion, and management of containerized applications. When implementing the method of this application, other open source container orchestration platforms can also be used to create a communication gateway in the form of a container, and this embodiment does not limit this.

[0039] In this embodiment, based on the container-based multi-NIC Multus mechanism, two NICs are used during creation, which belong to the management network and the VPC network respectively. Multus is a CNI (Container Network Interface) plug-in for Kubernetes, which allows Pods to have multiple network interfaces, thereby achieving multi-network access.

[0040] As an optional example, this embodiment creates a management network card through the container network interface of the management network, and the created management network card communicates with the container network, host network and SVC network of the management network as the main network card. In this embodiment, SVC (Service) is an abstract layer in Kubernetes, which is used to define a logical collection of a group of Pods and a policy for accessing the collection. Service provides a unified service access portal and a service proxy and discovery mechanism, so that users do not need to understand the specific operation of the background Pod. Service finds the corresponding Pod group through the label selector and uses kube-proxy for network control and load balancing. In Kubernetes, Pod is the smallest deployment unit, which is used to encapsulate containers, storage resources, network interfaces, and other configurations for managing container operation. Pod can contain one or more containers that share the same network namespace and storage volume. For example, a Pod can contain a main application container and an auxiliary container for log collection. All containers in the Pod share the same IP address and port space and can communicate through localhost. In addition, Pod can also define shared storage volumes to share data between different containers.

[0041] Kube-proxy is a core component in the Kubernetes cluster, responsible for implementing service discovery and load balancing functions. It runs on each node to ensure that network traffic can be correctly distributed from the service access point to the backend Pod.

[0042] As an optional example, this embodiment creates a business network card through the container network interface of the virtual private cloud, and the created business network card is used as a business network communication between the slave network card and the virtual machine in the virtual private cloud. It should be noted that in this embodiment, the address of the management network is used as the default routing address of the created communication gateway, and the address of the business network card is used as the gateway address of the created communication gateway in the virtual private cloud network segment. In this embodiment, the virtual private cloud (VPC) is an isolated, user-configured and managed virtual network environment created in a public cloud environment. Users can define their own IP address ranges, divide subnets, configure routing tables and gateways, etc. in the VPC.

[0043] It should be noted that the communication gateway of this embodiment is reusable. For four-layer applications, the front-end and back-end groups can be distinguished by port numbers, and for seven-layer HTTP applications, the front-end and back-end groups can be distinguished by URLs.

[0044] Step S202: Create a reverse proxy service and configure a corresponding reverse proxy listening configuration file for the communication requirements between the management network and the business network.

[0045] As an optional example, this embodiment creates a reverse proxy service by running a reverse proxy server in a container of a communication gateway. In practical applications, a reverse proxy service can be created by running Nginx or HaProxy programs. Nginx is a high-performance HTTP and reverse proxy server that also supports functions such as mail proxy and load balancing. HAProxy (High Availability Proxy) is a high-performance, open source load balancer and proxy server that is widely used in various Web service scenarios.

[0046] To meet the need of management network Pod accessing business network virtual machine, configure the reverse proxy front-end listening configuration file in the reverse proxy service. The listening address consists of the management network network card address of the communication gateway and the destination port number accessed by the management network Pod, and the back-end address for listening is the address of the virtual machine. To meet the need of business network virtual machine accessing management network Pod, configure the reverse proxy front-end listening configuration file in the reverse proxy service. The listening address consists of the business network network card address of the communication gateway and the destination port number accessed by the business network virtual machine, and the back-end address for listening is the address of the management network Pod.

[0047] Step S203: When a communication request occurs between the management network and the service network, the reverse proxy monitors and proxies the request traffic.

[0048] As an optional example, in this embodiment, when the management network Pod initiates a request to access the business network virtual machine, the request traffic passes through the management network to the management network network card of the communication gateway, monitors the traffic through the reverse proxy service and proxies the traffic to the backend virtual machine, and the response traffic of the virtual machine returns to the management network Pod through the reverse proxy service.

[0049] As an optional example, in this embodiment, when the virtual machine of the business network initiates a request to the management network Pod, the request traffic reaches the business network network card of the communication gateway through the virtual private cloud business network, monitors the traffic through the reverse proxy service and proxies the traffic to the backend Pod, and the response traffic of the Pod returns to the business network virtual machine through the reverse proxy service.

[0050] The following further describes in detail the method for interconnecting the tenant service network and the management network in the cloud scenario of this embodiment in a specific scenario.

[0051] In this scenario, the communication requirements between the management network and the business network are as follows: Management network Pod2 needs to communicate with virtual machine VM2 in VPC.

[0052] The virtual machine VM2 in the VPC needs to communicate with Pod1 in the management network.

[0053] Since the management network is isolated from the service network, the method of this embodiment is used to achieve two-way communication between the management network and the service network.

[0054] The address planning involved in this scenario is as follows:

[0055] The configuration process in this scenario is as follows: 1. The user creates a communication gateway. The communication gateway is created by K8S in the form of a container. The container uses Multus to create two network cards. NIC1 in the container is the management network network card. As the primary network card, it is created by the CNI of the management network. The address is the management network address GW_MGMT_IP 21.100.0.100. It is connected to the management network. This network card can communicate with the container network, host network and Svc network of the management network. NIC2 in the container is the business network network card. As a slave network card, it is created using VPC CNI. The subnet where the business network card is located is 192.168.1.0 / 24, and the gateway is 192.168.1.254. In this example, the address is GW_VPC_IP 192.168.1.100. This network card can communicate with the virtual machines in the VPC using the VPC business network. The default route of the gateway uses the primary network card, that is, the management network address. For the VPC network segment 192.168.0.0 / 16, the gateway is configured to be the gateway address of the business network card, that is, 192.168.1.254.

[0056] 2. Run Ngnix or HaProxy program in the container as a reverse proxy.

[0057] 3. In response to the need for management network Pod2 to actively access business network VM2, assuming that the destination port number of the access is 8000, configure the frontend listener in the reverse proxy configuration file. The listening address is the management network card address of the gateway (GW_MGMT_IP): port number, that is, 21.100.0.100:8000, and the corresponding backend address is the address of VM2, that is, 192.168.0.2:8000.

[0058] 4. For the requirement that VM1 in VPC actively accesses the management network Pod1, assuming that the destination port number is 8080, configure the frontend listener in the reverse proxy. The listening address is the business network NIC address of the gateway (GW_VPC_IP): port number, that is, 192.168.1.100:8080, and the backend address is the address of Pod1, that is, 21.100.0.100:8080. 5. Start the reverse proxy service.

[0059] The traffic flow process in this scenario is as follows: Figure 4FIG. 1 is an example diagram of a method for interconnecting a tenant service network and a management network in a cloud scenario according to an embodiment of the present application, such as Figure 4 As shown in the figure, in this scenario example, when the management network Pod2 actively initiates a request to access the business network VM2, the destination address of the request uses GW_MGMT_IP:8000, that is, 21.100.0.100:8000. The user's request traffic will reach the management network network card of the communication gateway through the management network. According to the configuration, the reverse proxy service monitors the traffic and proxies the traffic to the backend VM2. According to the routing configuration in the communication gateway container, the traffic reaching the VPC network segment will flow out from the VPC network card in the container and reach VM2 through the VPC network. The response traffic of VM2 will return to the management network Pod2 through the reverse proxy.

[0060] Figure 5 FIG. 1 is another example diagram of a method for interconnecting a tenant service network and a management network in a cloud scenario according to an embodiment of the present application, such as Figure 5 As shown in the figure, in this scenario example, when the virtual machine VM1 of the business network actively initiates a request to the Pod1 of the management network, the destination address of the request uses GW_VPC_IP:8080, that is, 192.168.1.100:8080, and the request traffic reaches the business network card of the communication gateway through the VPC business network. According to the configuration, the reverse proxy service monitors the traffic and proxies the traffic to the back-end Pod1. Since the default route in the communication gateway Pod is the address of the management network network card, the traffic will reach the management network Pod1 through the management network card, and the response traffic of Pod1 will also reach the business network virtual machine VM1 through the reverse proxy.

[0061] The method and system for interconnecting a tenant service network and a management network in a cloud scenario of this embodiment have the following beneficial technical effects: 1. Create a container-based communication gateway to achieve two-way communication between the business and management networks without the need for external equipment or reliance on external configuration.

[0062] 2. The communication gateway is based on the container's multi-network card Multus mechanism. Two network cards are used when it is created, one belonging to the management network and the other to the VPC network.

[0063] 3. Through reverse proxy, two-way communication between the management network and the business network can be achieved to meet various communication needs.

[0064] 4. Gateways can be reused, and users can flexibly define and manage configurations as needed. Only after configuration can intercommunication be achieved and security is guaranteed.

[0065] like Figure 6As shown, the present application also provides a device, including a processor 310, a communication interface 320, a memory 330 for storing a processor executable computer program, and a communication bus 340. The processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340. The processor 310 runs the executable computer program to implement the above-mentioned method for intercommunication between the tenant business network and the management network in the cloud scenario.

[0066] Among them, the computer program in the memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0067] The system embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected based on actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0068] Through the description of the above implementation modes, those skilled in the art can clearly understand that each implementation mode can be implemented by means of software plus a necessary general hardware platform, or of course by hardware. Based on such an understanding, the above technical solution can essentially or in other words be embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0069] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for interconnecting a tenant service network and a management network in a cloud scenario, characterized in that: The method comprises: Create a communication gateway in container form, and create a management network card and a business network card in the communication gateway container; Create a reverse proxy service and configure the corresponding reverse proxy listening configuration file for the communication needs between the management network and the business network; When a communication request occurs between the management network and the business network, the reverse proxy monitors and proxies the request traffic.

2. The method for interconnecting a tenant service network and a management network in a cloud scenario according to claim 1, characterized in that: Creating a communication gateway in the form of a container, including: creating a communication gateway in the form of a container through an open source container orchestration platform.

3. The method for interconnecting a tenant service network and a management network in a cloud scenario according to claim 1, characterized in that: Create management network NICs and business network NICs in the communication gateway container, including: Create a management network NIC through the container network interface of the management network. The created management network NIC serves as the primary NIC to communicate with the container network, host network, and SVC network of the management network. A business network NIC is created through the container network interface of the virtual private cloud. The created business network NIC is used as a slave NIC to communicate with the business network used by the virtual machines in the virtual private cloud.

4. The method for interconnecting a tenant service network and a management network in a cloud scenario according to claim 1, characterized in that: Create a communication gateway in the form of a container, create a management network network card and a business network network card in the container of the communication gateway, and also include: using the address of the management network as the default routing address of the created communication gateway, and using the address of the business network network card as the gateway address of the created communication gateway in the virtual private cloud network segment.

5. The method for interconnecting a tenant service network and a management network in a cloud scenario according to claim 1, characterized in that: Creating a reverse proxy service, including: creating a reverse proxy service by running a reverse proxy server in a container of a communication gateway.

6. The method for interconnecting a tenant service network and a management network in a cloud scenario according to claim 1, characterized in that: Configure the corresponding reverse proxy listening configuration file for the communication requirements between the management network and the business network, including: To meet the requirement of the management network Pod accessing the business network virtual machine, configure the reverse proxy front-end listening configuration file in the reverse proxy service. The listening address consists of the management network network card address of the communication gateway and the destination port number accessed by the management network Pod. The listening back-end address is the address of the virtual machine. To meet the requirement of the business network virtual machine to access the management network Pod, configure the reverse proxy front-end listening configuration file in the reverse proxy service. The listening address consists of the business network network card address of the communication gateway and the destination port number accessed by the business network virtual machine. The listening back-end address is the address of the management network Pod.

7. The method for interconnecting a tenant service network and a management network in a cloud scenario according to claim 1, characterized in that: When a communication request occurs between the management network and the business network, the reverse proxy monitors and proxies the request traffic, including: when the management network Pod initiates a request to access the business network virtual machine, the request traffic passes through the management network to the management network network card of the communication gateway, and the reverse proxy service monitors the traffic and proxies the traffic to the backend virtual machine. The virtual machine's response traffic returns to the management network Pod through the reverse proxy service.

8. The method for interconnecting a tenant service network and a management network in a cloud scenario according to claim 1, characterized in that: When a communication request is made between the management network and the business network, the reverse proxy monitors and proxies the request traffic. This also includes: when the business network virtual machine initiates a request to the management network Pod, the request traffic reaches the business network network card of the communication gateway through the virtual private cloud business network, and the reverse proxy service monitors the traffic and proxies the traffic to the backend Pod. The Pod's response traffic returns to the business network virtual machine through the reverse proxy service.

9. A system for interconnecting a tenant service network and a management network in a cloud scenario, characterized in that: The system includes an intercommunication server, and the intercommunication server includes: A communication gateway creation module is used to create a communication gateway in the form of a container, and to create a management network card and a business network card in the container of the communication gateway; The reverse proxy service creation module is used to create a reverse proxy service and configure the corresponding reverse proxy listening configuration file for the communication needs between the management network and the business network; The traffic interconnection module is used to monitor and proxy the request traffic through the reverse proxy when a communication request occurs between the management network and the business network.

10. A computer device, characterized in that: The computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the method according to any one of claims 1 to 8 when executing the program.

Images