A method, system, and device for interconnection between tenant business networks and management networks in a cloud scenario.

Abstract

This application relates to the field of cloud scenario networking and communication technology, providing a method, system, and device for interconnection between a tenant's business network and management network in a cloud scenario. The method includes: creating a container-type communication gateway; creating management network network cards and business network network cards within the container of the communication gateway; creating a reverse proxy service; configuring corresponding reverse proxy listening configuration files for the communication needs of the management network and business network; and listening to and proxying request traffic through the reverse proxy when communication requests occur between the management network and the business network. According to this application, the method, system, and device for interconnection between a tenant's business network and management network in a cloud scenario can achieve bidirectional interconnection between the business and management networks by creating a container-type communication gateway. This requires no external devices, is independent of external configuration, meets various communication needs, and allows users to flexibly define and manage configurations as needed. Interconnection is only possible after configuration, ensuring security.

Description

Technical Field

[0001] This application relates to the field of cloud scenario networking and communication technology, and in particular to a method, system and device for interconnection between tenant service network and management network in cloud scenario. Background Technology

[0002] In cloud networking scenarios, the network is typically divided into a management network and a service network to isolate management components from tenant services. The management network is primarily responsible for the operation and maintenance management of the cloud platform, such as the scheduling, monitoring, and configuration of cloud resources, while the service network carries tenant business applications, such as web services and databases. This isolation design can improve system security and prevent management traffic and business traffic from interfering with each other.

[0003] However, in certain scenarios, communication between the management network and the service network is required to meet specific management and business needs. For example, tenants may need to obtain management network data through the management network to better understand and manage their cloud resource usage; or tenants may need to report business information to the management network so that the cloud platform can perform unified resource management and optimization.

[0004] Currently, the common method for enabling communication between the management network and the service network is to establish a physical network connection between them. Specifically, this can be achieved by configuring appropriate VLANs, port aggregation, etc., on physical switches, allowing traffic between the management network and the service network to communicate at the physical layer. However, this method has the following problems and shortcomings:

[0005] 1. Security Risks: Once the physical networks are connected, traffic between the management network and the business network is no longer completely isolated, making them vulnerable to network attacks and malicious access. For example, attackers may exploit vulnerabilities in the business network to intrude into the management network, obtain sensitive management data, or damage the cloud platform.

[0006] 2. Complex Management: To ensure security, external firewalls and other security devices are typically deployed in the physical network. These devices require complex configuration and management to control security policies for different traffic types. For example, detailed access control rules need to be set to restrict communication between specific IP addresses or ports. Furthermore, as the cloud platform expands and business needs change, these security policies need continuous adjustment and optimization, increasing the difficulty and workload of operation and maintenance.

[0007] 3. Additional Costs: The purchase and maintenance of external firewalls and other security equipment require additional expenses. For some small and medium-sized enterprises or startups, this may increase the overall cost of their cloud services and affect their competitiveness in the market.

[0008] Therefore, overcoming the problems and shortcomings of achieving communication between the management network and the service network through the physical network in terms of security, management complexity, and cost has become an urgent technical problem to be solved. Summary of the Invention

[0009] In view of this, in order to overcome the shortcomings of the prior art, this application aims to provide a method, system and device for interconnection between tenant business network and management network in cloud scenario.

[0010] According to a first aspect of this application, a method for interconnection between a tenant's service network and management network in a cloud scenario is provided, the method comprising:

[0011] Create a containerized communication gateway, and create management network interface cards and service network interface cards within the container of the communication gateway;

[0012] Create a reverse proxy service and configure the corresponding reverse proxy listening configuration file for the communication needs between the management network and the business network;

[0013] When communication requests occur between the management network and the business network, the reverse proxy listens for and proxies the request traffic.

[0014] Optionally, the method for interconnecting the tenant's business network and management network in a cloud scenario in this application, which involves creating a container-based communication gateway, includes: creating a container-based communication gateway through an open-source container orchestration platform.

[0015] Optionally, the method for interconnecting a tenant's service network and management network in a cloud scenario according to this application involves creating a management network interface card (NIC) and a service network interface card (NIC) within the container of the communication gateway, including:

[0016] A management network interface card (NIC) is created through the container network interface of the management network. The created management network NIC serves as the primary NIC and communicates with the container network, host network, and SVC network of the management network.

[0017] A business network interface card (NIC) is created through the container network interface of the virtual private cloud (VPN). The created business network NIC serves as the slave NIC for business network communication with virtual machines within the VPN.

[0018] Optionally, the method for interconnecting a tenant's business network and management network in a cloud scenario according to this application includes creating a container-type communication gateway, creating a management network interface card and a business network interface card in the container of the communication gateway, and further includes: using the address of the management network as the default routing address of the created communication gateway, and using the address of the business network interface card as the gateway address of the created communication gateway in the virtual private cloud network segment.

[0019] Optionally, the method for interconnecting the tenant's business network and management network in a cloud scenario according to this application, which involves creating a reverse proxy service, includes: creating a reverse proxy service by running a reverse proxy server within a container of the communication gateway.

[0020] Optionally, the method for interconnection between a tenant's business network and management network in a cloud scenario according to this application configures a corresponding reverse proxy listening configuration file for the communication needs between the management network and the business network, including:

[0021] To address the requirement for management network Pods to access business network virtual machines, a reverse proxy front-end listening configuration file is configured in the reverse proxy service. The listening address consists of the management network interface card address of the communication gateway and the destination port number accessed by the management network Pod. The listening back-end address is the address of the virtual machine.

[0022] To address the requirement for virtual machines on the business network to access Pods on the management network, a reverse proxy front-end listening configuration file is configured in the reverse proxy service. The listening address consists of the business network interface card address of the communication gateway and the destination port number accessed by the virtual machine on the business network. The back-end address being listened to is the address of the Pod on the management network.

[0023] Optionally, the method for interconnection between a tenant's business network and management network in a cloud scenario in this application includes the following: when a communication request occurs between the management network and the business network, the request traffic is listened to and proxied through a reverse proxy. This includes: when a management network Pod initiates a request to access a virtual machine in the business network, the request traffic reaches the management network interface card of the communication gateway through the management network, the traffic is listened to through the reverse proxy service and proxied to the backend virtual machine, and the response traffic of the virtual machine returns to the management network Pod through the reverse proxy service.

[0024] Optionally, the method for interconnection between a tenant's business network and management network in a cloud scenario in this application, when a communication request occurs between the management network and the business network, includes listening to and proxying the request traffic through a reverse proxy. It further includes: when a virtual machine in the business network initiates a request to a Pod in the management network, the request traffic reaches the business network interface card of the communication gateway through the virtual private cloud business network, the traffic is listened to through the reverse proxy service and proxied to the backend Pod, and the Pod's response traffic returns to the business network virtual machine through the reverse proxy service.

[0025] According to a second aspect of this application, an interconnection system between a tenant's business network and management network in a cloud scenario is provided. This system includes an interconnection server, which comprises:

[0026] The communication gateway creation module is used to create a container-type communication gateway, and to create management network NICs and service network NICs within the container of the communication gateway.

[0027] The reverse proxy service creation module is used to create reverse proxy services and configure corresponding reverse proxy listening configuration files for the communication needs between the management network and the business network.

[0028] The traffic communication module is used to listen for and proxy the request traffic when communication requests occur between the management network and the business network through a reverse proxy.

[0029] According to a third aspect of this application, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in the first aspect of this application.

[0030] The method, system, and equipment for interconnection between tenant service networks and management networks in a cloud scenario as described in this application have the following beneficial technical effects:

[0031] 1. Achieve bidirectional communication between services and management networks by creating a container-like communication gateway, without requiring external devices or relying on external configurations.

[0032] 2. The communication gateway is based on the container-based multi-NIC Multus mechanism. It uses two NICs during creation, one belonging to the management network and the other to the VPC network.

[0033] 3. Through reverse proxy, bidirectional communication between the management network and the service network is realized, meeting various communication needs.

[0034] 4. Gateways are reusable, and users can flexibly define and manage configurations as needed. Interoperability can only be achieved after configuration to ensure security. Attached Figure Description

[0035] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 This is an example architecture diagram of an interconnection system between a tenant service network and a management network in a cloud scenario, according to an embodiment of this application.

[0037] Figure 2 This is an example architecture diagram of an interoperability server for a tenant business network and management network interconnection system in a cloud scenario, according to an embodiment of this application.

[0038] Figure 3 This is a flowchart illustrating the steps of a method for interconnecting a tenant's service network and management network in a cloud scenario, according to an embodiment of this application.

[0039] Figure 4 This is an example diagram illustrating a method for interconnection between a tenant's service network and management network in a cloud scenario according to an embodiment of this application;

[0040] Figure 5 This is another example diagram illustrating a method for interconnecting a tenant's service network and management network in a cloud scenario according to an embodiment of this application.

[0041] Figure 6A schematic diagram of the device provided in this application. Detailed Implementation

[0042] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0043] It should be noted that, in the absence of conflict, the following embodiments and features can be combined with each other; and, based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0044] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0045] Figure 1 This is an example architecture diagram of an interconnection system between a tenant's service network and management network in a cloud scenario, according to an embodiment of this application. Figure 1 As shown, the system may include an interconnection server 101, a communication network 102, and / or one or more interconnection clients 103. Figure 1 The example in the text shows multiple interconnected clients 103.

[0046] Interoperability server 101 can be any suitable server used to store information, data, programs, and / or any other suitable type of content. In some embodiments, interoperability server 101 can perform appropriate functions. For example, in some embodiments, interoperability server 101 can be used for interoperability between a tenant's business network and management network in a cloud scenario. As an optional example, in some embodiments, interoperability server 101 can be used to achieve interoperability between a tenant's business network and management network in a cloud scenario through a reverse proxy. For example, interoperability server 101 can be used to: create a container-type communication gateway, and create management network network cards and business network network cards in the container of the communication gateway; create a reverse proxy service, configure corresponding reverse proxy listening configuration files for the communication needs of the management network and the business network; when a communication request occurs between the management network and the business network, listen for and proxy the request traffic through the reverse proxy.

[0047] Figure 2This is an example architecture diagram of an interoperability server for a tenant business network and management network interconnection system in a cloud scenario, according to an embodiment of this application. Figure 2 As shown, the interoperability server in this embodiment includes:

[0048] The communication gateway creation module is used to create a container-type communication gateway, and to create management network NICs and service network NICs within the container of the communication gateway.

[0049] The reverse proxy service creation module is used to create reverse proxy services and configure corresponding reverse proxy listening configuration files for the communication needs between the management network and the business network.

[0050] The traffic communication module is used to listen for and proxy the request traffic when communication requests occur between the management network and the business network through a reverse proxy.

[0051] As another example, in some embodiments, the interconnection server 101 can send the interconnection method between the tenant business network and the management network in the cloud scenario to the interconnection client 103 for user use, based on the request of the interconnection client 103.

[0052] As an optional example, in some embodiments, the interconnection client 103 is used to provide visual interconnection, which is used to receive a selection input operation of interconnection between the tenant business network and the management network in the user cloud scenario, and to obtain and display the interconnection corresponding to the option selected by the selection input operation from the interconnection server 101 in response to the selection input operation. The interconnection at least displays information on the interconnection between the tenant business network and the management network in the cloud scenario and operation options for the information on the interconnection between the tenant business network and the management network in the cloud scenario.

[0053] In some embodiments, communication network 102 may be any suitable combination of one or more wired and / or wireless networks. For example, communication network 102 may include any one or more of the following: the Internet, intranet, wide area network (WAN), local area network (LAN), wireless network, digital subscriber line (DSL) network, frame relay network, asynchronous transfer mode (ATM) network, virtual private network (VPN), and / or any other suitable communication network. Interconnect client 103 may connect to communication network 102 via one or more communication links (e.g., communication link 104), which may be linked to interconnect server 101 via one or more communication links (e.g., communication link 105). Communication links may be any communication link suitable for transmitting data between interconnect client 103 and interconnect server 101, such as network links, dial-up links, wireless links, hardwired links, any other suitable communication links, or any suitable combination of such links.

[0054] Interoperability client 103 may include any one or more clients that present an interface related to the interoperability between the tenant's service network and management network in a cloud scenario, in an appropriate form, for user use and operation. In some embodiments, interoperability client 103 may include any suitable type of device. For example, in some embodiments, interoperability client 103 may include mobile devices, tablet computers, laptop computers, desktop computers, and / or any other suitable type of client device.

[0055] Although the interconnection server 101 is illustrated as a single device, in some embodiments, any suitable number of devices may be used to perform the functions performed by the interconnection server 101. For example, in some embodiments, multiple devices may be used to implement the functions performed by the interconnection server 101. Alternatively, cloud services may be used to implement the functions of the interconnection server 101.

[0056] Based on the above system, this application provides a method for interconnection between a tenant's business network and management network in a cloud scenario, which is illustrated by the following embodiments.

[0057] Figure 3 This is a flowchart illustrating the steps of a method for interconnecting a tenant service network and a management network in a cloud scenario according to an embodiment of this application. The method for interconnecting a tenant service network and a management network in a cloud scenario according to this embodiment can be executed on an interconnection server, such as... Figure 3 As shown, the method for interconnecting the tenant's business network and management network in this cloud scenario includes the following steps:

[0058] Step S201: Create a container-type communication gateway, and create a management network interface card and a service network interface card in the container of the communication gateway.

[0059] As an optional example, this embodiment creates a container-type communication gateway using an open-source container orchestration platform. In practical applications, the open-source container orchestration platform for creating the container-type communication gateway can be Kubernetes. Kubernetes is an open-source container orchestration platform used for automating the deployment, scaling, and management of containerized applications. Other open-source container orchestration platforms can also be used to create the container-type communication gateway when implementing the method of this application; this embodiment does not impose any limitations on this.

[0060] In this embodiment, the container-based multi-NIC Multus mechanism uses two NICs during creation, one belonging to the management network and the other to the VPC network. Multus is a CNI (Container Network Interface) plugin for Kubernetes that allows Pods to have multiple network interfaces, thereby enabling multi-network access.

[0061] As an optional example, this embodiment creates a management network interface card (NIC) through the container network interface of the management network. This created NIC acts as the primary NIC, communicating with the container network, host network, and SVC network of the management network. In this embodiment, SVC (Service) is an abstraction layer in Kubernetes used to define a logical collection of Pods and the strategy for accessing that collection. A Service provides a unified service access point and service proxy and discovery mechanism, eliminating the need for users to understand the specific operational status of the background Pods. The Service finds the corresponding Pod group through a tag selector and uses kube-proxy for network control and load balancing. In Kubernetes, a Pod is the smallest deployment unit, used to encapsulate containers, storage resources, network interfaces, and other configurations for managing container operation. A Pod can contain one or more containers that share the same network namespace and storage volume. For example, a Pod can contain a main application container and a secondary container for log collection. All containers in a Pod share the same IP address and port space and can communicate via localhost. Furthermore, a Pod can define shared storage volumes to allow different containers to share data.

[0062] Kube-proxy is a core component in a Kubernetes cluster, responsible for service discovery and load balancing. It runs on each node, ensuring that network traffic is correctly distributed from service access points to backend Pods.

[0063] As an optional example, this embodiment creates a service network interface card (NIC) through the container network interface of the virtual private cloud (VPC). The created service network NIC serves as the service network interface used by the NIC to communicate with virtual machines within the VPC. It is important to note that in this embodiment, the management network address is used as the default routing address of the created communication gateway, and the service network NIC address is used as the gateway address of the created communication gateway within the VPC network segment. In this embodiment, a Virtual Private Cloud (VPC) is an isolated, user-configurable, and managed virtual network environment created in a public cloud environment. Users can define their own IP address ranges, subnets, and configure routing tables and gateways within the VPC.

[0064] It should be noted that the communication gateway in this embodiment is reusable. For Layer 4 applications, the front-end and back-end groups can be distinguished by port number, and for Layer 7 HTTP applications, the front-end and back-end groups can be distinguished by URL.

[0065] Step S202: Create a reverse proxy service and configure the corresponding reverse proxy listening configuration file for the communication needs between the management network and the business network.

[0066] As an optional example, this embodiment creates a reverse proxy service by running a reverse proxy server within a container of the communication gateway. In practical applications, a reverse proxy service can be created by running Nginx or HaProxy programs. Nginx is a high-performance HTTP and reverse proxy server that also supports features such as mail proxying and load balancing. HAProxy (High Availability Proxy) is a high-performance, open-source load balancer and proxy server widely used in various web service scenarios.

[0067] For the requirement of management network Pods accessing business network virtual machines, configure a reverse proxy front-end listening configuration file in the reverse proxy service. The listening address consists of the management network interface card address of the communication gateway and the destination port number accessed by the management network Pod. The backend address to be listened to is the address of the virtual machine. For the requirement of business network virtual machines accessing management network Pods, configure a reverse proxy front-end listening configuration file in the reverse proxy service. The listening address consists of the business network interface card address of the communication gateway and the destination port number accessed by the business network virtual machine. The backend address to be listened to is the address of the management network Pod.

[0068] Step S203: When a communication request occurs between the management network and the service network, the request traffic is listened to and proxied through a reverse proxy.

[0069] As an optional example, in this embodiment, when the management network Pod initiates a request to access the business network virtual machine, the request traffic reaches the management network interface card of the communication gateway through the management network. The traffic is monitored by the reverse proxy service and proxied to the backend virtual machine. The response traffic of the virtual machine returns to the management network Pod through the reverse proxy service.

[0070] As an optional example, in this embodiment, when a virtual machine in the business network initiates a request to a Pod in the management network, the request traffic reaches the business network interface card of the communication gateway through the virtual private cloud business network. The reverse proxy service listens for the traffic and proxies the traffic to the backend Pod. The Pod's response traffic returns to the business network virtual machine through the reverse proxy service.

[0071] The following section provides a more detailed explanation of the interconnection method between the tenant's service network and management network in a cloud scenario, based on a specific example.

[0072] In this scenario, the communication requirements between the management network and the service network are as follows:

[0073] The management Pod2 needs to communicate with the virtual machine VM2 under the VPC.

[0074] VM2, a virtual machine under the VPC, needs to communicate with Pod1 on the management network.

[0075] Since the management network and the service network are isolated, the method in this embodiment is used to achieve bidirectional communication between the management network and the service network.

[0076] The address planning involved in this scenario is as follows:

[0077]

[0078] The configuration process in this scenario is as follows:

[0079] 1. The user creates a communication gateway, which is a container created by Kubernetes. The container uses Multus to create two network interface cards (NICs). NIC1 in the container is the management network NIC, acting as the primary NIC. It is created by the management network's CNI and has the management network address GW_MGMT_IP 21.100.0.100. It connects to the management network and can communicate with the container network, host network, and Svc network within the management network. NIC2 in the container is the service network NIC, acting as the secondary NIC. It is created using the VPC CNI. The service NIC resides in the subnet 192.168.1.0 / 24, and its gateway is 192.168.1.254. In this example, its address is GW_VPC_IP 192.168.1.100. This NIC enables communication with virtual machines within the VPC using the VPC service network. The default route of the gateway uses the primary network interface card (NIC), i.e., the management network address. For the VPC network segment 192.168.0.0 / 16, the gateway is configured as the gateway address of the service NIC, i.e., 192.168.1.254.

[0080] 2. Run Ngnix or HaProxy within the container as a reverse proxy.

[0081] 3. For the requirement of management network Pod2 actively accessing business network VM2, assuming the destination port number is 8000, configure frontend listening in the reverse proxy configuration file. The listening address is the gateway's management network interface address (GW_MGMT_IP):port number, i.e., 21.100.0.100:8000, and the corresponding backend address is the VM2 address, i.e., 192.168.0.2:8000.

[0082] 4. For the requirement of VM1 within the VPC actively accessing Pod1 on the management network, assuming the destination port number is 8080, configure the reverse proxy to listen on the frontend. The listening address is the gateway's business network interface address (GW_VPC_IP):port number, i.e., 192.168.1.100:8080, and the backend address is the address of Pod1, i.e., 21.100.0.100:8080.

[0083] 5. Start the reverse proxy service.

[0084] The traffic flow process in this scenario is as follows:

[0085] Figure 4 This is an example diagram illustrating a method for interconnecting a tenant's service network and management network in a cloud scenario according to an embodiment of this application. Figure 4 As shown in this example scenario, when the management network Pod2 actively initiates a request to access the business network VM2, the destination address of the request uses GW_MGMT_IP:8000, i.e., 21.100.0.100:8000. The user's request traffic will reach the management network interface card of the communication gateway through the management network. According to the configuration, the reverse proxy service listens for traffic and proxies the traffic to the backend VM2. According to the routing configuration in the communication gateway container, the traffic reaching the VPC network segment will flow out from the VPC interface card in the container and reach VM2 through the VPC network. The response traffic of VM2 will return to the management network Pod2 through the reverse proxy.

[0086] Figure 5 This is another example diagram illustrating a method for interconnecting a tenant's service network and management network in a cloud scenario according to an embodiment of this application, as shown below. Figure 5 As shown in this example scenario, when VM1 in the business network actively initiates a request to Pod1 in the management network, the destination address of the request uses GW_VPC_IP:8080, i.e., 192.168.1.100:8080. The request traffic reaches the business network card of the communication gateway through the VPC business network. According to the configuration, the reverse proxy service listens for traffic and proxies the traffic to Pod1 in the backend. Since the default route in the communication gateway Pod is the address of the management network card, the traffic will reach the management network Pod1 through the management network card. The response traffic of Pod1 also reaches VM1 in the business network through the reverse proxy.

[0087] The method and system for interconnection between tenant service networks and management networks in a cloud scenario, as described in this embodiment, have the following beneficial technical effects:

[0088] 1. Achieve bidirectional communication between services and management networks by creating a container-like communication gateway, without requiring external devices or relying on external configurations.

[0089] 2. The communication gateway is based on the container-based multi-NIC Multus mechanism. It uses two NICs during creation, one belonging to the management network and the other to the VPC network.

[0090] 3. Through reverse proxy, bidirectional communication between the management network and the service network is realized, meeting various communication needs.

[0091] 4. Gateways are reusable, and users can flexibly define and manage configurations as needed. Interoperability can only be achieved after configuration to ensure security.

[0092] like Figure 6As shown, this application also provides a device including a processor 310, a communication interface 320, a memory 330 for storing processor-executable computer programs, and a communication bus 340. The processor 310, communication interface 320, and memory 330 communicate with each other via the communication bus 340. The processor 310 executes the executable computer program to implement the aforementioned method for interconnecting tenant service networks and management networks in a cloud scenario.

[0093] The computer program in memory 330, when implemented as a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0094] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected based on actual needs to achieve the purpose of this embodiment. Those skilled in the art can understand and implement this without any creative effort.

[0095] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0096] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for interconnection between a tenant's business network and management network in a cloud scenario, characterized in that, The method includes: Create a containerized communication gateway, and create management network interface cards and service network interface cards within the container of the communication gateway; Create a reverse proxy service and configure the corresponding reverse proxy listening configuration file for the communication needs between the management network and the business network; When communication requests occur between the management network and the business network, the reverse proxy listens for and proxies the request traffic.

2. The method for interconnection between tenant business network and management network in a cloud scenario according to claim 1, characterized in that, Create container-based communication gateways, including: creating container-based communication gateways through open-source container orchestration platforms.

3. The method for interconnection between tenant service network and management network in a cloud scenario according to claim 1, characterized in that, Create management network interface cards (NICs) and service network interface cards (NICs) within the container of the communication gateway, including: A management network interface card (NIC) is created through the container network interface of the management network. The created management network NIC serves as the primary NIC and communicates with the container network, host network, and SVC network of the management network. A business network interface card (NIC) is created through the container network interface of the virtual private cloud (VPN). The created business network NIC serves as the slave NIC for business network communication with virtual machines within the VPN.

4. The method for interconnection between tenant service network and management network in a cloud scenario according to claim 1, characterized in that, Create a container-type communication gateway, and create a management network interface card (NIC) and a service network interface card (NIC) within the container of the communication gateway. This also includes: using the address of the management network as the default routing address of the created communication gateway, and using the address of the service network interface card as the gateway address of the created communication gateway in the virtual private cloud network segment.

5. The method for interconnection between tenant service network and management network in a cloud scenario according to claim 1, characterized in that, Creating a reverse proxy service includes: creating a reverse proxy service by running a reverse proxy server inside a container of a communication gateway.

6. The method for interconnection between tenant service network and management network in a cloud scenario according to claim 1, characterized in that, Configure the corresponding reverse proxy listening configuration file for the communication requirements between the management network and the service network, including: To address the requirement for management network Pods to access business network virtual machines, configure a reverse proxy front-end listening configuration file in the reverse proxy service. The listening address consists of the management network interface address of the communication gateway and the destination port number accessed by the management network Pod. The listening back-end address is the address of the virtual machine. To address the requirement for virtual machines on the business network to access Pods on the management network, a reverse proxy front-end listening configuration file is configured in the reverse proxy service. The listening address consists of the business network interface card address of the communication gateway and the destination port number accessed by the virtual machine on the business network. The back-end address being listened to is the address of the Pod on the management network.

7. The method for interconnection between tenant service network and management network in a cloud scenario according to claim 1, characterized in that, When communication requests occur between the management network and the business network, the reverse proxy listens for and proxies the request traffic. This includes: when a management network Pod initiates a request to access a business network virtual machine, the request traffic reaches the management network interface card of the communication gateway through the management network, the reverse proxy service listens for the traffic and proxies the traffic to the backend virtual machine, and the virtual machine's response traffic returns to the management network Pod through the reverse proxy service.

8. The method for interconnection between tenant service network and management network in a cloud scenario according to claim 1, characterized in that, When communication requests occur between the management network and the business network, the reverse proxy listens for and proxies the request traffic. This also includes: when a virtual machine in the business network initiates a request to a Pod in the management network, the request traffic reaches the business network interface card of the communication gateway through the virtual private cloud business network, the reverse proxy service listens for the traffic and proxies the traffic to the backend Pod, and the Pod's response traffic returns to the business network virtual machine through the reverse proxy service.

9. A system for interconnecting a tenant's business network and management network in a cloud scenario, characterized in that, The system includes an interoperability server, which includes: The communication gateway creation module is used to create a container-type communication gateway, and to create management network NICs and service network NICs within the container of the communication gateway. The reverse proxy service creation module is used to create reverse proxy services and configure corresponding reverse proxy listening configuration files for the communication needs between the management network and the business network. The traffic communication module is used to listen for and proxy the request traffic when communication requests occur between the management network and the business network through a reverse proxy.

10. A computer device, characterized in that, The computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the method according to any one of claims 1-8.

Images