Public cloud virtual network intranet connectivity detection method and device

Abstract

The invention relates to the technical field of public cloud virtual networks, and discloses a public cloud virtual network intranet connectivity detection method and device, and the method comprises the steps: creating a detection test VPC; a namespace detection virtual machine is created; obtaining an intranet IP list of the detection target VPC from a management and control service rear end, and sending the intranet IP list of the detection target VPC to a namespace detection virtual machine; issuing a hidden route for the detection test VPC and the detection target VPC; and based on the hidden routing, utilizing the namespace detection virtual machine to carry out connectivity detection on the address in the intranet IP list of the detection target VPC to obtain an intranet connectivity detection result. The connectivity detection from the namespace detection virtual machine to the VPC gateway in the detection test VPC is realized, the occupation of the IP address of the user is avoided, and the problem of false alarm caused by the interception of the user ACL and the security group is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of public cloud virtual networks, and in particular to a method and device for detecting connectivity of an intranet of a public cloud virtual network. Background Art

[0002] In cloud computing, virtual network intranet connectivity failures often occur, causing damage to user services, affecting user experience, generating customer complaints, and even causing users to claim compensation or quit the network. Therefore, how to quickly locate and detect faults and discover problems before users do, especially discovering connectivity problems in advance, has become a very important measure to solve such faults.

[0003] Related virtual network intranet connectivity detection methods require the use of user IP addresses, which makes the virtual network intranet connectivity detection process susceptible to interference from human factors such as user security groups and ACLs (Access Control Lists), resulting in false positives in connectivity detection results. Summary of the invention

[0004] In view of this, the present invention provides a method and device for detecting the connectivity of a public cloud virtual network intranet, so as to solve the problem that the virtual network intranet connectivity detection method causes the virtual network intranet connectivity detection process to be easily interfered by human factors such as user security groups and ACLs, resulting in false positives in the connectivity detection results.

[0005] In a first aspect, the present invention provides a method for detecting connectivity of a public cloud virtual network intranet, the method comprising:

[0006] Create a detection test VPC;

[0007] Create a namespace detection virtual machine;

[0008] Obtain the private IP list of the target VPC from the control service backend, and send the private IP list of the target VPC to the namespace detection VM.

[0009] Send hidden routes to detect the test VPC and the target VPC;

[0010] Based on hidden routing, the namespace detection virtual machine is used to perform connectivity detection on the addresses in the intranet IP list of the detection target VPC to obtain the intranet connectivity detection results.

[0011] This embodiment provides a method for detecting the intranet connectivity of a public cloud virtual network. By creating a detection test VPC and a namespace detection virtual machine, the intranet IP list of the detection target VPC is sent to the namespace detection virtual machine, covering the path from the namespace detection virtual machine to the VPC gateway, and issuing hidden routes for the detection test VPC and the detection target VPC, and then using the namespace detection virtual machine to perform connectivity detection on the addresses in the intranet IP list of the detection target VPC, connectivity detection from the namespace detection virtual machine in the detection test VPC to the VPC gateway is implemented, the occupation of user IP addresses is avoided, the false alarm problem caused by user ACL and security group interception is solved, and better upgrade verification and connectivity troubleshooting detection are achieved.

[0012] In an optional implementation, creating a namespace detection virtual machine includes:

[0013] Get a list of computing nodes and randomly select a host based on the list of computing nodes;

[0014] Use the host machine to create a namespace type port, and create a namespace detection virtual machine through the computing node controller.

[0015] This embodiment provides a method for detecting connectivity within a public cloud virtual network. The method randomly selects a host machine from a computing node list, creates a namespace-type port using the host machine, and creates a namespace detection virtual machine through a computing node controller. The method avoids occupying user IP addresses by establishing a detection point within a detection test VPC. In addition, the method uses a special port definition within the virtual network team to create a lightweight namespace detection virtual machine on the network side. The namespace detection virtual machine is used to decouple computing, making it easier to control the creation and destruction of detection nodes.

[0016] In an optional implementation, sending hidden routes for detecting a test VPC and a target VPC includes:

[0017] Get the subnet set corresponding to the detection target VPC, select the test subnet based on the subnet set, and add a detailed route to the subnet corresponding to the detection target VPC in the routing table of the test subnet; the test subnet does not overlap with other subnets in the subnet set;

[0018] In the subnet routing table corresponding to the detection target VPC, add a detailed route that returns the namespace detection VM.

[0019] This embodiment provides a method for detecting the intranet connectivity of a public cloud virtual network. By adding a detailed route to the subnet corresponding to the detection target VPC in the routing table of the test subnet, and adding a detailed route returning to the namespace detection virtual machine in the subnet routing table corresponding to the detection target VPC, the detection traffic can flow smoothly from the namespace detection virtual machine to the ovs in the subnet corresponding to the detection target VPC, thereby ensuring the accuracy of the public cloud virtual network intranet connectivity detection results.

[0020] In an optional implementation, based on the hidden route, the namespace detection virtual machine is used to perform connectivity detection on the addresses in the intranet IP list of the detection target VPC, and the intranet connectivity detection result is obtained, including:

[0021] Get the proxy flow table corresponding to the address in the intranet IP list of the target VPC;

[0022] Based on hidden routing, the namespace detection virtual machine is used to send the proxy flow table to the address in the intranet IP list of the detection target VPC for multi-process detection;

[0023] Obtain multi-process detection feedback data, and determine the intranet connectivity detection result based on the multi-process detection feedback data.

[0024] This embodiment provides a method for detecting the intranet connectivity of a public cloud virtual network. The method obtains the proxy flow table corresponding to the address in the intranet IP list of the detection target VPC, and uses the namespace detection virtual machine to send the proxy flow table to the address in the intranet IP list of the detection target VPC for multi-coroutine detection. The multi-coroutine detection traverses the transmission path, thereby achieving the effect of rapid detection of the intranet connectivity of the virtual network, and can accurately determine whether there is a connectivity problem.

[0025] In an optional implementation, determining the intranet connectivity detection result based on the multi-coroutine detection feedback data includes:

[0026] If the multi-process detection feedback data is received within the preset response time, the intranet connectivity detection result is that the intranet connectivity is normal;

[0027] Alternatively, if within the preset number of connectivity detection times, the response time of the multi-process detection feedback data exceeds the preset response time, the intranet connectivity detection result is an intranet connectivity failure.

[0028] This embodiment provides a method for detecting connectivity within a public cloud virtual network, which implements namespace detection of connectivity from a virtual machine to a VPC gateway in the cloud computing field, and quickly and automatically implements detection and monitoring alarms, helping to improve the ability to discover problems before users.

[0029] In an optional implementation, it also includes:

[0030] The intranet connectivity detection result is sent to the cloud monitoring device, and the cloud monitoring device is configured with associated warnings based on the intranet connectivity detection result.

[0031] This embodiment provides a method for detecting intranet connectivity of a public cloud virtual network. It configures associated warnings for cloud monitoring devices based on the intranet connectivity detection results, which helps to quickly locate connectivity faults.

[0032] In a second aspect, the present invention provides a public cloud virtual network intranet connectivity detection device, the device comprising:

[0033] The first creation module is used to create a detection test VPC;

[0034] The second creation module is used to create a namespace detection virtual machine;

[0035] The acquisition module is used to obtain the private IP list of the detection target VPC from the control service backend, and send the private IP list of the detection target VPC to the namespace detection virtual machine;

[0036] The delivery module is used to deliver hidden routes to the detection test VPC and the detection target VPC;

[0037] The detection module is used to perform connectivity detection on the addresses in the intranet IP list of the detection target VPC based on the hidden route and using the namespace detection virtual machine to obtain the intranet connectivity detection result.

[0038] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to execute a method for detecting intranet connectivity of a public cloud virtual network according to the first aspect or any corresponding embodiment thereof.

[0039] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute a method for detecting connectivity within a public cloud virtual network according to the first aspect or any corresponding embodiment thereof.

[0040] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions, wherein the computer instructions are used to enable a computer to execute a method for detecting connectivity within a public cloud virtual network according to the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 It is a flow chart of a method for detecting intranet connectivity of a public cloud virtual network according to an embodiment of the present invention;

[0043] Figure 2 is a schematic diagram of a connectivity detection and VPC configuration process according to an embodiment of the present invention;

[0044] Figure 3 It is a flowchart of another method for detecting connectivity of a public cloud virtual network intranet according to an embodiment of the present invention;

[0045] Figure 4 It is a flowchart of another method for detecting connectivity of a public cloud virtual network intranet according to an embodiment of the present invention;

[0046] Figure 5 It is a flowchart of another method for detecting connectivity of a public cloud virtual network intranet according to an embodiment of the present invention;

[0047] Figure 6 is a schematic diagram of the architecture of a public cloud virtual network connectivity detection system according to an embodiment of the present invention;

[0048] Figure 7 It is a structural block diagram of a public cloud virtual network intranet connectivity detection device according to an embodiment of the present invention;

[0049] Figure 8 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0051] Challenges of network connectivity detection include:

[0052] 1) How to quickly detect the intranet IP (Internet Protocol) in the case of a large number of virtual machine nodes and promptly feedback the detection results as an auxiliary means of troubleshooting;

[0053] 2) How to effectively reduce the interference of human factors such as user security groups and ACLs (Access Control Lists) and reduce the noise of false positives of connectivity alarms.

[0054] The embodiment of the present invention provides a method for detecting the connectivity of a public cloud virtual network intranet. By creating a detection service, automatically pulling configurations and using a lightweight namespace to detect virtual machines, and using flow table proxy, the connectivity between the VPC gateway and the computing node ovs (open virtual switch, an open source component that acts as a local virtual machine switch on the computing node) is automatically detected and monitored and alarmed, so as to achieve better upgrade verification and connectivity troubleshooting detection.

[0055] The embodiment of the present invention provides a method for detecting the connectivity of a public cloud virtual network intranet. It should be noted that the method for detecting the connectivity of a public cloud virtual network intranet provided by the embodiment of the present invention may be executed by a device for detecting the connectivity of a public cloud virtual network intranet. The device for detecting the connectivity of a public cloud virtual network intranet may be implemented as part or all of an electronic device through software, hardware, or a combination of software and hardware. The electronic device may be a server or a terminal. The server in the embodiment of the present application may be a single server or a server cluster composed of multiple servers. The terminal in the embodiment of the present application may be a smart phone, a personal computer, a tablet computer, a wearable device, an intelligent robot, or other intelligent hardware devices. In the following method embodiments, the execution subject is an electronic device as an example for explanation.

[0056] According to an embodiment of the present invention, a method for detecting connectivity within a public cloud virtual network is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in an order different from that shown here.

[0057] In this embodiment, a method for detecting connectivity of a public cloud virtual network intranet is provided, which can be used for the above-mentioned electronic device. Figure 1 is a flow chart of a method for detecting connectivity within a public cloud virtual network according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0058] Step S101: Create a detection test VPC.

[0059] Specifically, Figure 2 As shown in the figure, a test VPC, a test subnet, and a test port are created through probe-service (the detection service is responsible for automated configuration, pulling, testing, and resource management, where resource management includes creation and destruction; at the same time, it is responsible for reporting the intranet connectivity detection results to the monitoring node).

[0060] Furthermore, a test port in the virtual network corresponds to a network card. The test port will be configured with an intranet IP address. Each test port belongs to a test subnet, which is a collection of IP addresses.

[0061] Step S102: Create a namespace to detect the virtual machine.

[0062] Step S103: Obtain the intranet IP list of the detection target VPC from the management and control service backend, and send the intranet IP list of the detection target VPC to the namespace detection virtual machine.

[0063] Specifically, probe-service pulls the intranet IP list of the target VPC from vpc-server (virtual network control plane configuration management server, responsible for processing product configuration logic and resource scheduling and configuration access, and providing external interface access).

[0064] Furthermore, if Figure 2 As shown, probe-service uses scp (secure copy protocol) to detect the IP list (that is, the intranet IP list of the target VPC) and the detection program to the namespace to detect the compute-host (the computing node in cloud computing, which can be used to set up multiple virtual machines) where the virtual machine is located.

[0065] Step S104: Send hidden routes to detect the test VPC and the target VPC.

[0066] Step S105: Based on the hidden route, the namespace detection virtual machine is used to perform connectivity detection on the addresses in the intranet IP list of the detection target VPC to obtain the intranet connectivity detection result.

[0067] Specifically, the intranet connectivity detection result is sent to the cloud monitoring device, and an associated warning is configured for the cloud monitoring device based on the intranet connectivity detection result.

[0068] Furthermore, if Figure 2As shown in the figure, probe-service reports the intranet connectivity detection results to push-gateway (a functional component in prometheus) of prometheus (an open source system monitoring and alarm tool); push-gateway configures associated alarms.

[0069] Furthermore, all resources created within the public cloud virtual network are automatically cleaned up.

[0070] The public cloud virtual network intranet connectivity detection method provided in this embodiment creates a detection test VPC and a namespace detection virtual machine, sends the intranet IP list of the detection target VPC to the namespace detection virtual machine, covers the path from the namespace detection virtual machine to the VPC gateway, and sends hidden routes to the detection test VPC and the detection target VPC, and then uses the namespace detection virtual machine to perform connectivity detection on the addresses in the intranet IP list of the detection target VPC, thereby realizing connectivity detection from the namespace detection virtual machine in the detection test VPC to the VPC gateway, avoiding occupying user IP addresses, solving the false alarm problem caused by user ACL and security group interception, and achieving better upgrade verification and connectivity troubleshooting detection.

[0071] In this embodiment, a method for detecting connectivity of a public cloud virtual network intranet is provided, which can be used for the above-mentioned electronic device. Figure 3 is a flow chart of a method for detecting connectivity within a public cloud virtual network according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0072] Step S301: Create a detection test VPC. For details, see Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0073] Step S302: Create a namespace detection virtual machine.

[0074] Specifically, the above step S302 includes:

[0075] Step S3021, obtain a computing node list, and randomly select a host machine based on the computing node list.

[0076] Specifically, Figure 2 As shown, the list of available computing nodes is obtained by probe-service from the database of vpc-server (that is, the virtual network control plane configuration database mysql).

[0077] Step S3022, using the host machine to create a port of the namespace type, and creating a namespace detection virtual machine through the computing node controller.

[0078] Specifically, probe-service specifies the host to create a namespace type port, and automatically creates a namespace type VM (VirtualMachine) through the computer node controller, namely, the namespace detection VM; wherein the namespace type VM is not created through nova (a scalability platform required for managing computing resources and network authentication) or the computing interface gostack (a cloud-native application management platform).

[0079] Furthermore, namespace-type VMs are very lightweight simulated VM instances that run quickly and efficiently. They do not need to rely on other components, services, or external resources in the network during operation. They can also utilize the VXLAN (Virtual Extensible Local Area Network) encapsulation and decapsulation capabilities of OVS (Open Virtual Switch, an open source component that acts as a local virtual machine switch on the computing node) and utilize standard flow table configurations.

[0080] Furthermore, the namespace is mounted on OVS as a VM instance to simulate the VM, and the VXLAN capability of OVS is used to implement the encapsulation and decapsulation of VXLAN packets.

[0081] Step S303: Obtain the private IP list of the target VPC from the management and control service backend, and send the private IP list of the target VPC to the namespace detection virtual machine. Figure 1 Step S103 of the illustrated embodiment will not be described in detail here.

[0082] Step S304: Send hidden routes to detect the test VPC and the target VPC. Figure 1 Step S104 of the illustrated embodiment will not be described in detail here.

[0083] Step S305: Based on the hidden route, the namespace detection virtual machine is used to perform connectivity detection on the addresses in the intranet IP list of the detection target VPC to obtain the intranet connectivity detection result. Figure 1 Step S105 of the illustrated embodiment will not be described in detail here.

[0084] The public cloud virtual network intranet connectivity detection method provided in this embodiment randomly selects a host machine from the computing node list, uses the host machine to create a namespace type port, creates a namespace detection virtual machine through the computing node controller, and establishes a detection point in the detection test VPC to avoid occupying the user IP address. In addition, a special port definition within the virtual network team is used to create a lightweight namespace detection virtual machine on the network side. The namespace detection virtual machine is used to decouple computing, which makes it easier to control the creation and destruction of detection nodes.

[0085] In this embodiment, a method for detecting connectivity of a public cloud virtual network intranet is provided, which can be used for the above-mentioned electronic device. Figure 4 is a flow chart of a method for detecting connectivity within a public cloud virtual network according to an embodiment of the present invention. Figure 4 As shown, the process includes the following steps:

[0086] Step S401: Create a detection test VPC. For details, see Figure 3 Step S301 of the illustrated embodiment will not be described in detail here.

[0087] Step S402: Create a namespace detection virtual machine. Figure 3 Step S302 of the illustrated embodiment will not be described in detail here.

[0088] Step S403: Obtain the private IP list of the target VPC from the management and control service backend, and send the private IP list of the target VPC to the namespace detection virtual machine. Figure 2 Step S303 of the illustrated embodiment will not be described in detail here.

[0089] Step S404: Send hidden routes to detect the test VPC and the target VPC.

[0090] Specifically, the above step S404 includes:

[0091] Step S4041, obtain the subnet set corresponding to the detection target VPC, select a test subnet based on the subnet set, and add a detailed route to the subnet corresponding to the detection target VPC in the routing table of the test subnet; wherein the test subnet does not overlap with other subnets in the subnet set.

[0092] Specifically, according to the subnet set of the detection target VPC, a non-overlapping test subnet is selected, and a detailed route to the subnet corresponding to the detection target VPC is added to the routing table of the test subnet.

[0093] Step S4042: Add a detailed route for returning the namespace detection virtual machine to the subnet routing table corresponding to the detection target VPC.

[0094] Specifically, add a / 32 detailed route that returns the namespace detection virtual machine to the subnet routing table corresponding to the detection target VPC, where / 32 refers to a subnet mask length in an IPv4 address, indicating a separate IPv4 address.

[0095] Step S405: Based on the hidden route, the namespace detection virtual machine is used to perform connectivity detection on the addresses in the intranet IP list of the detection target VPC to obtain the intranet connectivity detection result. Figure 3 Step S305 of the illustrated embodiment will not be described in detail here.

[0096] The public cloud virtual network intranet connectivity detection method provided in this embodiment adds a detailed route to the subnet corresponding to the detection target VPC in the routing table of the test subnet, and adds a detailed route returning to the namespace detection virtual machine in the subnet routing table corresponding to the detection target VPC, so that the detection traffic can flow smoothly from the namespace detection virtual machine to the ovs in the subnet corresponding to the detection target VPC, thereby ensuring the accuracy of the public cloud virtual network intranet connectivity detection results.

[0097] In this embodiment, a method for detecting connectivity of a public cloud virtual network intranet is provided, which can be used for the above-mentioned electronic device. Figure 5 is a flow chart of a method for detecting connectivity within a public cloud virtual network according to an embodiment of the present invention. Figure 5 As shown, the process includes the following steps:

[0098] Step S501: Create a detection test VPC. For details, see Figure 4 Step S401 of the illustrated embodiment will not be described in detail here.

[0099] Step S502: Create a namespace detection virtual machine. Figure 4 Step S402 of the illustrated embodiment will not be described in detail here.

[0100] Step S503: Obtain the private IP list of the target VPC from the management and control service backend, and send the private IP list of the target VPC to the namespace detection virtual machine. Figure 4 Step S403 of the illustrated embodiment will not be described in detail here.

[0101] Step S504: Send hidden routes to detect the test VPC and the target VPC. Figure 4Step S404 of the illustrated embodiment will not be described in detail here.

[0102] Step S505: Based on the hidden route, the namespace detection virtual machine is used to perform connectivity detection on the addresses in the intranet IP list of the detection target VPC to obtain the intranet connectivity detection result.

[0103] Specifically, the above step S505 includes:

[0104] Step S5051, obtain the proxy flow table corresponding to the address in the intranet IP list of the detection target VPC.

[0105] Specifically, icmp request (Internet Control Message Protocol Request) is used as the proxy answering flow table, wherein icmp request is TOS (type of service) = 0x1C, and the detection address is src_IP (source IP, source IP address);

[0106] Step S5052: Based on the hidden route, the namespace detection virtual machine is used to send the proxy flow table to the address in the intranet IP list of the detection target VPC for multi-process detection.

[0107] Specifically, according to the detailed route to the subnet corresponding to the detection target VPC in the hidden route, the proxy flow table is issued for the address in the intranet IP list of the detection target VPC.

[0108] Furthermore, if Figure 2 As shown, the detection program is started in the namespace detection virtual machine, a ping (packet internet groper) detection is initiated, and a multi-process detection is started for the address in the intranet IP list of the target VPC.

[0109] Step S5053, obtaining multi-process detection feedback data, and determining the intranet connectivity detection result based on the multi-process detection feedback data.

[0110] In some optional implementations, the above step S5053 includes:

[0111] Step a1: If the multi-process detection feedback data is received within the preset response time, the intranet connectivity detection result is that the intranet connectivity is normal.

[0112] Specifically, assuming that the preset response time is 100ms, if the corresponding multi-process detection feedback data icmp reply (internet control message protocol) is received within 100ms, the connectivity is considered normal.

[0113] Step a2, or, if within the preset number of connectivity detection times, the response time of the multi-process detection feedback data exceeds the preset response time, the intranet connectivity detection result is an intranet connectivity failure.

[0114] Specifically, if the response time of the multi-process detection feedback data exceeds 100ms within three connectivity detections, there is a connectivity failure.

[0115] The public cloud virtual network intranet connectivity detection method provided in this embodiment obtains the proxy flow table corresponding to the address in the intranet IP list of the detection target VPC, and uses the namespace detection virtual machine to send the proxy flow table to the address in the intranet IP list of the detection target VPC for multi-coroutine detection. Through multi-coroutine detection, the transmission path is traversed to achieve the effect of rapid detection of virtual network intranet connectivity, and can accurately determine whether there is a connectivity problem. It realizes the connectivity detection from the namespace detection virtual machine to the VPC gateway in the cloud computing field, and quickly and automatically realizes detection and monitoring alarms, which helps to improve the ability to discover problems before users.

[0116] The following is a specific example of a method for detecting connectivity within a public cloud virtual network.

[0117] Embodiment 1:

[0118] like Figure 2 As shown in the figure: The specific steps of the detection process and VPC configuration delivery include:

[0119] 1) probe-service creates VPC, subnet and port, obtains and sends VPC information, subnet information and port information to vpc-server.

[0120] 2) vpc-server obtains VPC information, subnet information, and port information, obtains and sends the updated information of the test VPC, subnet, and port to mysql (virtual network control plane configuration database, which stores all resource and user configuration information).

[0121] 3) probe-service creates namespace-vm (namespace type virtual machine), obtains and sends namespace-vm information to vpc-server.

[0122] 4) vpc-server obtains namespace-vm information, obtains and sends namespace-type virtual machine update information to mysql.

[0123] 5) vpc-server obtains VPC information, subnet information, port information, and namespace-vm information, and notifies vpc-manager (VPC management service, configuration cache, communication with various distributed controllers, and delivery of VPC resources to distributed controllers).

[0124] 6) After vpc-manager pulls VPC information, subnet information, port information, and namespace-vm information from mysql, it configures vpc-gateway-ctrl (VPC control gateway) and compute-ctrl (compute control node).

[0125] 7) probe-service pulls the IP list from vpc-server and passes it to namespace-vm.

[0126] 8) namespace-vm sends a ping signal to compute-vm (the virtual machine of the computing node), obtains and sends the report results to probe-service.

[0127] 9) probe-service passes the result to pushgateway (push gateway).

[0128] Embodiment 2:

[0129] like Figure 6 As shown in the figure, the public cloud virtual network intranet connectivity detection system is composed of probe-service, probe-node:ns (namespace type detection node), Promethues, vpc-server, vpc-manager, mysql, vpc-manager, compute-host, vm, probe-node:ns, network-host and dpdk-node (network element node).

[0130] Among them, probe-service creates a test VPC and sends the test VPC information to vpc-server; probe-service creates probe-node:ns on compute-host; vpc-server sends a notification to vpc-manager; vpc-manager configures vm according to the notification; mysql obtains and stores the test VPC information and vpc-manager configuration information; probe-node:ns and vm exchange data through dpdk-node and obtain the intranet connectivity detection result; probe-service obtains the intranet connectivity detection result and sends it to Promethues; Promethues configures associated alarms based on the intranet connectivity detection result.

[0131] The above embodiments have the following technical effects:

[0132] 1) Solve the problem of occupying user IP addresses: If a detection VM is created in the target VPC, the user's IP address will be occupied, which is invasive. If an agent is built into the customer VM, many customers will disagree with this highly invasive approach and will refuse to use or disable it for security reasons, which is inconvenient to implement. This solution adopts: a detection point outside the VPC is established in the test VPC, which does not occupy the user's IP address.

[0133] 2) Solve the coupling problem with the computing team: Use the special port definition within the virtual network team to create a lightweight instance namespace on the network side to decouple computing and more conveniently control the creation and destruction of detection nodes; mount the namespace as a VM instance on OVS to simulate the VM, and use the VXLAN capability of OVS to implement the encapsulation and decapsulation of VXLAN packets.

[0134] 3) Solve the problem of automated detection: Create a linkage between probe-service and vpc-server to automatically pull the detection list, automatically send configurations and initiate detection, collect detection results, and achieve monitoring and alarm linkage.

[0135] 4) Solve the false alarm problem caused by user ACL and security group interception: By designing the pipeline (transmission path) and proxy flow table of ovs, the icmp request packet of the specified TOS can be released and traverse the pipeline to achieve the detection effect. Finally, it can perform proxy answering, so that the detection end can determine whether there is a connectivity problem.

[0136] In this embodiment, a public cloud virtual network intranet connectivity detection device is also provided, which is used to implement the above embodiments and preferred implementation modes, and will not be repeated here. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0137] This embodiment provides a public cloud virtual network intranet connectivity detection device, such as Figure 7 As shown, including:

[0138] The first creation module 701 is used to create a detection test VPC;

[0139] The second creation module 702 is used to create a namespace detection virtual machine;

[0140] The acquisition module 703 is used to obtain the intranet IP list of the detection target VPC from the management and control service backend, and send the intranet IP list of the detection target VPC to the namespace detection virtual machine;

[0141] The sending module 704 is used to send hidden routes to the detection test VPC and the detection target VPC;

[0142] The detection module 705 is used to perform connectivity detection on the addresses in the intranet IP list of the detection target VPC based on the hidden route and using the namespace detection virtual machine to obtain the intranet connectivity detection result.

[0143] In some optional implementations, the second creation module 702 includes:

[0144] A selection unit, used to obtain a list of computing nodes and randomly select a host based on the list of computing nodes;

[0145] The creation unit is used to create a namespace type port using the host machine and create a namespace detection virtual machine through the computing node controller.

[0146] In some optional implementations, the sending module 704 includes:

[0147] The first adding unit is used to obtain a subnet set corresponding to the detection target VPC, select a test subnet based on the subnet set, and add a detailed route to the subnet corresponding to the detection target VPC in the routing table of the test subnet; wherein the test subnet does not overlap with other subnets in the subnet set;

[0148] The second adding unit is used to add a detailed route returning the namespace detection virtual machine in the subnet routing table corresponding to the detection target VPC.

[0149] In some optional implementations, the detection module 705 includes:

[0150] An acquisition unit, used for acquiring a proxy flow table corresponding to an address in an intranet IP list of a detection target VPC;

[0151] The detection unit is used to perform multi-process detection based on hidden routing and using the namespace detection virtual machine to send the proxy flow table to the address in the intranet IP list of the detection target VPC;

[0152] The determination unit is used to obtain multi-process detection feedback data and determine the intranet connectivity detection result based on the multi-process detection feedback data.

[0153] In some optional implementations, the determining unit includes:

[0154] A first judgment subunit is used for, if the multi-coroutine detection feedback data is received within a preset response time, then the intranet connectivity detection result is that the intranet connectivity is normal;

[0155] The second judgment subunit is used to determine that if within a preset number of connectivity detection times, the response time of the multi-process detection feedback data exceeds the preset response time, then the intranet connectivity detection result is an intranet connectivity failure.

[0156] In some optional embodiments, the method further comprises:

[0157] The associated warning module is used to send the intranet connectivity detection result to the cloud monitoring device and configure the associated warning for the cloud monitoring device based on the intranet connectivity detection result.

[0158] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0159] In this embodiment, a public cloud virtual network intranet connectivity detection device is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0160] The embodiment of the present invention also provides a computer device having the above Figure 7 A public cloud virtual network intranet connectivity detection device is shown.

[0161] See also Figure 8, Figure 8 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 8 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 8 A processor 10 is taken as an example.

[0162] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0163] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0164] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0165] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0166] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 8 The example of connecting through bus is taken in the following.

[0167] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0168] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0169] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0170] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for detecting connectivity of a public cloud virtual network, characterized in that: The method comprises: Create a detection test VPC; Create a namespace detection virtual machine; Obtain the intranet IP list of the detection target VPC from the management and control service backend, and send the intranet IP list of the detection target VPC to the namespace detection virtual machine; Sending hidden routes to the detection test VPC and the detection target VPC; Based on the hidden route, the namespace detection virtual machine is used to perform connectivity detection on the addresses in the intranet IP list of the detection target VPC to obtain an intranet connectivity detection result.

2. The method according to claim 1, characterized in that The step of creating a namespace detection virtual machine includes: Obtain a list of computing nodes, and randomly select a host machine based on the list of computing nodes; The host machine is used to create a port of the namespace type, and the namespace detection virtual machine is created through a computing node controller.

3. The method according to claim 1, characterized in that The sending of hidden routes for the detection test VPC and the detection target VPC includes: Obtain a subnet set corresponding to the detection target VPC, select a test subnet based on the subnet set, and add a detailed route to the subnet corresponding to the detection target VPC in the routing table of the test subnet; wherein the test subnet does not overlap with other subnets in the subnet set; Add a detailed route returning to the namespace detection virtual machine in the subnet routing table corresponding to the detection target VPC.

4. The method according to claim 1, characterized in that: Based on the hidden route, the namespace detection virtual machine is used to perform connectivity detection on the addresses in the intranet IP list of the detection target VPC to obtain the intranet connectivity detection result, including: Obtain the proxy flow table corresponding to the address in the intranet IP list of the detection target VPC; Based on the hidden route, the namespace detection virtual machine is used to send the proxy flow table to the address in the intranet IP list of the detection target VPC for multi-process detection; Acquire multi-coroutine detection feedback data, and determine the intranet connectivity detection result based on the multi-coroutine detection feedback data.

5. The method according to claim 4, characterized in that The determining the intranet connectivity detection result based on the multi-coroutine detection feedback data includes: If the multi-process detection feedback data is received within the preset response time, the intranet connectivity detection result is that the intranet connectivity is normal; Alternatively, if within a preset number of connectivity detection times, the response time of the multi-process detection feedback data exceeds the preset response time, then the intranet connectivity detection result is an intranet connectivity failure.

6. The method according to claim 1, characterized in that Also includes: The intranet connectivity detection result is sent to a cloud monitoring device, and an associated warning is configured for the cloud monitoring device based on the intranet connectivity detection result.

7. A public cloud virtual network intranet connectivity detection device, characterized in that: The device comprises: The first creation module is used to create a detection test VPC; The second creation module is used to create a namespace detection virtual machine; An acquisition module is used to obtain the intranet IP list of the detection target VPC from the management and control service backend, and send the intranet IP list of the detection target VPC to the namespace detection virtual machine; A sending module, used for sending hidden routes to the detection test VPC and the detection target VPC; The detection module is used to perform connectivity detection on the addresses in the intranet IP list of the detection target VPC based on the hidden route and using the namespace detection virtual machine to obtain an intranet connectivity detection result.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the public cloud virtual network intranet connectivity detection method according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the public cloud virtual network intranet connectivity detection method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer instructions, wherein the computer instructions are used to enable a computer to execute the public cloud virtual network intranet connectivity detection method according to any one of claims 1 to 6.

Images