A method and apparatus for public cloud virtual network intranet connectivity probing

Abstract

The application relates to the technical field of public cloud virtual network and discloses a public cloud virtual network intranet connectivity detection method and device, which comprises the following steps: creating a detection test VPC; creating a namespace detection virtual machine; obtaining an intranet IP list of a detection target VPC from a management and control service back end and sending the intranet IP list of the detection target VPC to the namespace detection virtual machine; issuing a hidden route for the detection test VPC and the detection target VPC; and based on the hidden route, using the namespace detection virtual machine to detect the connectivity of addresses in the intranet IP list of the detection target VPC to obtain an intranet connectivity detection result. The application realizes connectivity detection of the namespace detection virtual machine in the detection test VPC to a VPC gateway, avoids occupying user IP addresses, and solves the false alarm problem caused by user ACL and security group interception.

Description

Technical Field

[0001] This invention relates to the field of public cloud virtual network technology, specifically to a method and apparatus for detecting the connectivity of a public cloud virtual network intranet. Background Technology

[0002] In cloud computing, virtual network connectivity failures frequently occur, causing disruptions to user services, impacting user experience, generating customer complaints, and even leading to claims or network termination. Therefore, quickly locating and detecting these failures, and identifying problems before users do, especially connectivity issues, is a crucial measure for resolving such failures.

[0003] The relevant virtual network intranet connectivity detection methods require user IP addresses, which makes the virtual network intranet connectivity detection process susceptible to interference from human factors such as user security groups and ACLs (Access Control Lists), resulting in false alarms in the connectivity detection results. Summary of the Invention

[0004] In view of this, the present invention provides a method and apparatus for detecting the intranet connectivity of a public cloud virtual network, in order to solve the problem that the intranet connectivity detection process of a virtual network is easily interfered with by human factors such as user security groups and ACLs, resulting in false alarms in the connectivity detection results.

[0005] In a first aspect, the present invention provides a method for detecting the intranet connectivity of a public cloud virtual network, the method comprising:

[0006] Create a probe test VPC;

[0007] Create a namespace detection virtual machine;

[0008] Obtain the list of internal IPs of the target VPC from the management service backend, and send the list of internal IPs of the target VPC to the namespace probe virtual machine;

[0009] To detect and test VPCs and target VPCs, hidden routes are deployed;

[0010] Based on hidden routes, the namespace probe virtual machine performs connectivity probes on the addresses in the internal network IP list of the target VPC to obtain the internal network connectivity probe results.

[0011] This embodiment provides a method for detecting intranet connectivity in a public cloud virtual network. By creating a test VPC and a namespace probe virtual machine, the method sends the list of intranet IPs of the target VPC to the namespace probe virtual machine, covering the path from the namespace probe virtual machine to the VPC gateway. Hidden routes are also issued for both the test VPC and the target VPC. The namespace probe virtual machine then performs connectivity detection on the addresses in the target VPC's intranet IP list. This achieves connectivity detection from the namespace probe virtual machine within the test VPC to the VPC gateway, avoiding the use of user IP addresses and resolving false alarms caused by user ACLs and security group blocking. This results in better upgrade verification and connectivity troubleshooting.

[0012] In one alternative implementation, a namespace detection virtual machine is created, including:

[0013] Obtain the list of compute nodes, and randomly select a host machine based on the list of compute nodes;

[0014] Use the host machine to create a port of type namespace, and use the compute node controller to create a namespace to detect virtual machines.

[0015] This embodiment provides a public cloud virtual network intranet connectivity detection method. By randomly selecting a host machine from the compute node list, creating a namespace type port on the host machine, and creating a namespace probe virtual machine through the compute node controller, a probe point is established within the probe test VPC, avoiding the occupation of user IP addresses. Furthermore, by adopting a special port definition within the virtual network team, a lightweight namespace probe virtual machine is created on the network side. The namespace probe virtual machine decouples the computation, making it easier to control the creation and destruction of probe nodes.

[0016] In one optional implementation, a hidden route is issued to both the test VPC and the target VPC for detection, including:

[0017] Obtain the set of subnets corresponding to the target VPC, select a test subnet based on the subnet set, and add a detailed route to the subnet corresponding to the target VPC in the routing table of the test subnet; the test subnet does not overlap with other subnets in the subnet set;

[0018] Add a detailed route to the subnet routing table corresponding to the target VPC to return the namespace to probe the virtual machine.

[0019] This embodiment provides a method for detecting intranet connectivity in a public cloud virtual network. By adding detailed routes to the subnet corresponding to the target VPC in the routing table of the test subnet, and adding detailed routes back to the namespace probe virtual machine in the routing table of the subnet corresponding to the target VPC, the detection traffic can travel smoothly from the namespace probe virtual machine to the OVS in the subnet corresponding to the target VPC, thus ensuring the accuracy of the intranet connectivity detection results in the public cloud virtual network.

[0020] In one optional implementation, based on hidden routing, a namespace probe virtual machine is used to perform connectivity probes on addresses in the internal network IP list of the target VPC, obtaining the internal network connectivity probe results, including:

[0021] Obtain the proxy flow table corresponding to the address in the internal network IP list of the target VPC;

[0022] Based on hidden routing, the virtual machine is probed by namespaces to send the proxy flow table to the address in the internal IP list of the target VPC for multi-coroutine probe;

[0023] Obtain multi-coroutine probe feedback data, and determine the intranet connectivity probe results based on the multi-coroutine probe feedback data.

[0024] This embodiment provides a method for detecting intranet connectivity in a public cloud virtual network. By obtaining the proxy flow table corresponding to the address in the intranet IP list of the target VPC, the method uses a namespace to detect the virtual machine and sends the proxy flow table to the address in the intranet IP list of the target VPC for multi-coroutine detection. By traversing the transmission path through multi-coroutine detection, the method achieves the effect of fast detection of intranet connectivity in the virtual network and can accurately determine whether there are connectivity problems.

[0025] In one optional implementation, determining the intranet connectivity detection result based on multi-coroutine probe feedback data includes:

[0026] If multi-coroutine probe feedback data is received within the preset response time, the intranet connectivity probe result is that the intranet connectivity is normal.

[0027] Alternatively, if the response time of the multi-coroutine probe feedback data exceeds the preset response time within the preset number of connectivity probes, then the intranet connectivity probe result is an intranet connectivity failure.

[0028] This embodiment provides a public cloud virtual network intranet connectivity detection method, which realizes the connectivity detection from virtual machines to VPC gateways in the namespace detection field of cloud computing, and quickly and automatically realizes detection and monitoring alarms, which helps to improve the ability to discover problems before users.

[0029] In one alternative implementation, it further includes:

[0030] Send the intranet connectivity detection results to the cloud monitoring device, and configure associated warnings for the cloud monitoring device based on the intranet connectivity detection results.

[0031] This embodiment provides a method for detecting intranet connectivity in a public cloud virtual network. By using the intranet connectivity detection results, associated warnings are configured for cloud monitoring devices, which helps to quickly locate connectivity faults.

[0032] Secondly, the present invention provides a public cloud virtual network intranet connectivity detection device, the device comprising:

[0033] The first creation module is used to create a probe test VPC;

[0034] The second creation module is used to create a namespace detection virtual machine;

[0035] The acquisition module is used to obtain the list of internal network IPs of the target VPC from the management service backend and send the list of internal network IPs of the target VPC to the namespace probe virtual machine;

[0036] The distribution module is used to distribute hidden routes to the test VPC and the target VPC.

[0037] The detection module is used to perform connectivity probing on addresses in the internal network IP list of the target VPC based on hidden routes and namespace detection virtual machines, and obtain the internal network connectivity detection results.

[0038] Thirdly, the present invention provides a computer device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform a public cloud virtual network intranet connectivity detection method according to the first aspect or any corresponding embodiment described above.

[0039] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute a public cloud virtual network intranet connectivity detection method according to the first aspect or any corresponding embodiment described above.

[0040] Fifthly, the present invention provides a computer program product, including computer instructions, which are used to cause a computer to execute a public cloud virtual network intranet connectivity detection method according to the first aspect or any corresponding embodiment described above. Attached Figure Description

[0041] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0042] Figure 1 This is a flowchart illustrating a public cloud virtual network intranet connectivity detection method according to an embodiment of the present invention.

[0043] Figure 2 This is a schematic diagram of the connectivity detection and VPC configuration process according to an embodiment of the present invention;

[0044] Figure 3 This is a flowchart illustrating another method for detecting intranet connectivity in a public cloud virtual network according to an embodiment of the present invention.

[0045] Figure 4 This is a flowchart illustrating another method for detecting the intranet connectivity of a public cloud virtual network according to an embodiment of the present invention;

[0046] Figure 5 This is a flowchart illustrating another method for detecting intranet connectivity in a public cloud virtual network according to an embodiment of the present invention.

[0047] Figure 6 This is a schematic diagram of the public cloud virtual network connectivity detection system architecture according to an embodiment of the present invention;

[0048] Figure 7 This is a structural block diagram of a public cloud virtual network intranet connectivity detection device according to an embodiment of the present invention;

[0049] Figure 8 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0051] Challenges of network connectivity probing include:

[0052] 1) How to quickly detect internal network IPs (Internet Protocol) and promptly report the detection results as an auxiliary means of troubleshooting when there are a large number of virtual machine nodes;

[0053] 2) How to effectively reduce interference from human factors such as user security groups and ACLs (Access Control Lists) to reduce noise in connectivity alarm false alarms.

[0054] This invention provides a method for detecting intranet connectivity in a public cloud virtual network. By creating a detection service, automatically pulling configurations and using lightweight namespaces to detect virtual machines, and employing flow table proxying, it automatically detects and monitors the connectivity between the VPC gateway and the compute node OVS (open virtual switch, an open-source component that acts as a local virtual machine switch on the compute node), thereby achieving better upgrade verification and connectivity troubleshooting.

[0055] This invention provides a method for detecting the intranet connectivity of a public cloud virtual network. It should be noted that the execution subject of this method can be a device for detecting the intranet connectivity of a public cloud virtual network. This device can be implemented as part or all of an electronic device through software, hardware, or a combination of both. The electronic device can be a server or a terminal. In this embodiment, the server can be a single server or a server cluster composed of multiple servers. The terminal can be a smartphone, personal computer, tablet computer, wearable device, or other intelligent hardware device such as a smart robot. The following method embodiments all use an electronic device as the execution subject for illustration.

[0056] According to an embodiment of the present invention, a method for detecting the intranet connectivity of a public cloud virtual network is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0057] This embodiment provides a method for detecting the intranet connectivity of a public cloud virtual network, which can be used in the aforementioned electronic devices. Figure 1 This is a flowchart of a public cloud virtual network intranet connectivity detection method according to an embodiment of the present invention, such as... Figure 1 As shown, the process includes the following steps:

[0058] Step S101: Create a probe test VPC.

[0059] Specifically, such as Figure 2 As shown, the probe-service (a probe service responsible for automated configuration, retrieval, testing, and resource management, including resource management including creation and destruction; it is also responsible for reporting the intranet connectivity probe results to the monitoring node) creates test VPCs, test subnets, and test ports.

[0060] Furthermore, in the virtual network, one test port corresponds to one network card, and the test port is configured with an internal network IP address. Each test port belongs to a test subnet, and the test subnet is a set of IP addresses.

[0061] Step S102: Create a namespace detection virtual machine.

[0062] Step S103: Obtain the list of internal network IPs of the target VPC from the management service backend, and send the list of internal network IPs of the target VPC to the namespace probe virtual machine.

[0063] Specifically, the probe-service pulls the list of internal IPs of the target VPC from the vpc-server (Virtual Network Control Plane Configuration Management Server, which is responsible for handling product configuration logic, resource scheduling and configuration access, and provides external interface access).

[0064] Furthermore, such as Figure 2 As shown, the probe-service uses scp (secure copy protocol) to probe the IP list (i.e., the list of internal IPs of the target VPC) and the probe program to probe the virtual machine's compute-host (a compute node in cloud computing, which can be configured to run multiple virtual machines) in the namespace.

[0065] Step S104: Send hidden routes to the test VPC and the target VPC for detection.

[0066] Step S105: Based on hidden routes, use namespace probe virtual machine to perform connectivity probe on the addresses in the internal network IP list of the target VPC to obtain the internal network connectivity probe results.

[0067] Specifically, the intranet connectivity detection results are sent to the cloud monitoring device, and associated warnings are configured for the cloud monitoring device based on the intranet connectivity detection results.

[0068] Furthermore, such as Figure 2As shown, the probe-service reports the intranet connectivity probe results to the push-gateway (a functional component of Prometheus, an open-source system monitoring and alerting tool); the push-gateway is configured to associate alerts.

[0069] Furthermore, it automatically removes all resources created within the public cloud virtual network.

[0070] The public cloud virtual network intranet connectivity detection method provided in this embodiment creates a test VPC and a namespace detection virtual machine. It sends the list of intranet IPs of the target VPC to the namespace detection virtual machine, covering the path from the namespace detection virtual machine to the VPC gateway. Furthermore, it distributes hidden routes to both the test VPC and the target VPC. The namespace detection virtual machine then performs connectivity detection on the addresses in the target VPC's intranet IP list. This achieves connectivity detection from the namespace detection virtual machine within the test VPC to the VPC gateway, avoiding the use of user IP addresses and resolving false alarms caused by user ACLs and security group blocking. This results in better upgrade verification and connectivity troubleshooting.

[0071] This embodiment provides a method for detecting the intranet connectivity of a public cloud virtual network, which can be used in the aforementioned electronic devices. Figure 3 This is a flowchart of a public cloud virtual network intranet connectivity detection method according to an embodiment of the present invention, such as... Figure 3 As shown, the process includes the following steps:

[0072] Step S301: Create a probe test VPC. See details below. Figure 1 Step S101 of the illustrated embodiment will not be described again here.

[0073] Step S302: Create a namespace detection virtual machine.

[0074] Specifically, step S302 includes:

[0075] Step S3021: Obtain the list of compute nodes and randomly select a host machine based on the list of compute nodes.

[0076] Specifically, such as Figure 2 As shown, the list of available compute nodes is obtained by probe-service from the vpc-server's database (i.e., the virtual network control plane configuration database mysql).

[0077] Step S3022: Create a port of type namespace using the host machine, and create a namespace probe virtual machine through the compute node controller.

[0078] Specifically, the probe-service specifies that the host machine creates a port of type namespace and automatically creates a VM (Virtual Machine) of type namespace through the computer node controller, i.e., namespace-probe virtual machine; the VM of type namespace is not created through nova (a scalable platform for managing computing resources and network authentication) or the computing interface gostack (a cloud-native application management platform).

[0079] Furthermore, namespace-type VMs are very lightweight virtual VM instances that run fast and efficiently. They do not depend on other components, services, or external resources within the network during runtime. They can also utilize the VXLAN (virtual extensible local area network) encapsulation and decapsulation capabilities of OVS (open virtual switch, an open-source component that acts as a local virtual machine switch on compute nodes) and utilize standard flow table configurations.

[0080] Furthermore, the namespace is mounted as a VM instance on OVS to simulate a VM, and OVS's VXLAN capabilities are used to encapsulate and decapsulate VXLAN packets.

[0081] Step S303: Obtain the list of internal network IPs of the target VPC from the management service backend, and send the list of internal network IPs of the target VPC to the namespace probe virtual machine. For details, please refer to [link to relevant documentation]. Figure 1 Step S103 of the illustrated embodiment will not be described again here.

[0082] Step S304 involves deploying hidden routes to the test VPC and the target VPC. For details, please refer to [link to details]. Figure 1 Step S104 of the illustrated embodiment will not be described again here.

[0083] Step S305: Based on hidden routes, use namespace probe virtual machines to perform connectivity probes on addresses in the target VPC's internal network IP list to obtain the internal network connectivity probe results. For details, please refer to... Figure 1 Step S105 of the illustrated embodiment will not be described again here.

[0084] The public cloud virtual network intranet connectivity detection method provided in this embodiment randomly selects a host machine from the list of compute nodes, creates a namespace type port on the host machine, creates a namespace detection virtual machine through the compute node controller, and establishes a detection point within the detection test VPC, thus avoiding the occupation of user IP addresses. Furthermore, it adopts a special port definition within the virtual network team to create a lightweight namespace detection virtual machine on the network side, and uses the namespace detection virtual machine to decouple computing, making it easier to control the creation and destruction of detection nodes.

[0085] This embodiment provides a method for detecting the intranet connectivity of a public cloud virtual network, which can be used in the aforementioned electronic devices. Figure 4 This is a flowchart of a public cloud virtual network intranet connectivity detection method according to an embodiment of the present invention, such as... Figure 4 As shown, the process includes the following steps:

[0086] Step S401: Create a probe test VPC. See details below. Figure 3 Step S301 of the illustrated embodiment will not be described again here.

[0087] Step S402: Create a namespace detection virtual machine. See details below. Figure 3 Step S302 of the illustrated embodiment will not be described again here.

[0088] Step S403: Obtain the list of internal network IPs of the target VPC from the management service backend, and send the list of internal network IPs of the target VPC to the namespace probe virtual machine. For details, please refer to [link to relevant documentation]. Figure 2 Step S303 of the illustrated embodiment will not be described again here.

[0089] Step S404 involves sending hidden routes to the test VPC and the target VPC for detection.

[0090] Specifically, step S404 includes:

[0091] Step S4041: Obtain the subnet set corresponding to the target VPC, select a test subnet based on the subnet set, and add a detailed route to the subnet corresponding to the target VPC in the routing table of the test subnet; wherein, the test subnet does not overlap with other subnets in the subnet set.

[0092] Specifically, based on the set of subnets of the target VPC, a non-overlapping test subnet is selected, and a detailed route to the corresponding subnet of the target VPC is added to the routing table of the test subnet.

[0093] Step S4042: Add a detailed route to the subnet routing table corresponding to the target VPC to return the namespace probe virtual machine.

[0094] Specifically, add a / 32 detailed route to the subnet routing table corresponding to the target VPC to return the namespace probe virtual machine. Here, / 32 refers to the subnet mask length in the IPv4 address, representing a single IPv4 address.

[0095] Step S405: Based on hidden routes, use namespace probe virtual machines to perform connectivity probes on addresses in the target VPC's internal network IP list to obtain the internal network connectivity probe results. For details, please refer to... Figure 3 Step S305 of the illustrated embodiment will not be described again here.

[0096] The public cloud virtual network intranet connectivity detection method provided in this embodiment adds detailed routes to the subnet corresponding to the target VPC in the routing table of the test subnet, and adds detailed routes back to the namespace probe virtual machine in the routing table of the subnet corresponding to the target VPC. This ensures that the probe traffic can travel smoothly from the namespace probe virtual machine to the OVS in the subnet corresponding to the target VPC, thus guaranteeing the accuracy of the public cloud virtual network intranet connectivity detection results.

[0097] This embodiment provides a method for detecting the intranet connectivity of a public cloud virtual network, which can be used in the aforementioned electronic devices. Figure 5 This is a flowchart of a public cloud virtual network intranet connectivity detection method according to an embodiment of the present invention, such as... Figure 5 As shown, the process includes the following steps:

[0098] Step S501: Create a probe test VPC. See details below. Figure 4 Step S401 of the illustrated embodiment will not be described again here.

[0099] Step S502: Create a namespace detection virtual machine. See details below. Figure 4 Step S402 of the illustrated embodiment will not be described again here.

[0100] Step S503: Obtain the list of internal network IPs of the target VPC from the management service backend, and send the list of internal network IPs of the target VPC to the namespace probe virtual machine. For details, please refer to [link to relevant documentation]. Figure 4 Step S403 of the illustrated embodiment will not be described again here.

[0101] Step S504 involves sending hidden routes to the test VPC and the target VPC. For details, please refer to [link to details]. Figure 4Step S404 of the illustrated embodiment will not be described again here.

[0102] Step S505: Based on hidden routes, use namespace probe virtual machines to perform connectivity probes on the addresses in the internal network IP list of the target VPC, and obtain the internal network connectivity probe results.

[0103] Specifically, step S505 includes:

[0104] Step S5051: Obtain the proxy flow table corresponding to the address in the internal network IP list of the target VPC.

[0105] Specifically, ICMP request (Internet Control Message Protocol Request) is used as a proxy response flow table, where ICMP request is a proxy response with TOS (type of service) = 0x1C and probe address is src_IP (source IP).

[0106] Step S5052: Based on hidden routing, use namespace to probe the virtual machine to send the proxy flow table to the address in the internal network IP list of the probe target VPC for multi-coroutine probe.

[0107] Specifically, based on the detailed routes to the subnet corresponding to the target VPC in the hidden routes, a proxy flow table is sent to the address in the internal IP list of the target VPC.

[0108] Furthermore, such as Figure 2 As shown, a probe is started within the namespace probe virtual machine to initiate a ping (packet internet groper) probe, and a multi-coroutine probe is started on the address in the target VPC's internal IP list.

[0109] Step S5053: Obtain multi-coroutine probe feedback data, and determine the intranet connectivity probe result based on the multi-coroutine probe feedback data.

[0110] In some optional implementations, step S5053 above includes:

[0111] Step a1: If multi-coroutine probe feedback data is received within the preset response time, the intranet connectivity probe result is that the intranet connectivity is normal.

[0112] Specifically, assuming the preset response time is 100ms, if the corresponding ICMP reply (Internet Control Message Protocol) is received within 100ms, the connectivity is considered normal.

[0113] Step a2, or, if the response time of the multi-coroutine probe feedback data exceeds the preset response time within the preset number of connectivity probes, then the intranet connectivity probe result is an intranet connectivity failure.

[0114] Specifically, if the response time of the multi-coroutine probe feedback data exceeds 100ms in all three connectivity probes, then a connectivity failure occurs.

[0115] The public cloud virtual network intranet connectivity detection method provided in this embodiment obtains the proxy flow table corresponding to the address in the intranet IP list of the target VPC, and uses the namespace probe virtual machine to send the proxy flow table to the address in the intranet IP list of the target VPC for multi-coroutine probe. By traversing the transmission path through multi-coroutine probe, the method achieves the effect of rapid detection of intranet connectivity in the virtual network, accurately determines whether there are connectivity problems, realizes the connectivity detection from the namespace probe virtual machine to the VPC gateway in the cloud computing field, and quickly and automatically implements detection and monitoring alarms, which helps to improve the ability to discover problems before users.

[0116] The following specific embodiments illustrate the detailed steps of a public cloud virtual network intranet connectivity detection method.

[0117] Example 1:

[0118] like Figure 2 As shown: The specific steps for the detection process and VPC configuration distribution include:

[0119] 1) The probe-service creates the VPC, subnet, and port, and obtains and sends the VPC, subnet, and port information to the vpc-server.

[0120] 2) The vpc-server obtains VPC information, subnet information, and port information, and receives and sends the updated information of the test VPC, subnet, and port to MySQL (the virtual network control plane configuration database, which stores all resource and user configuration information).

[0121] 3) The probe-service creates a namespace-vm (a virtual machine of type namespace), obtains and sends the namespace-vm information to the vpc-server.

[0122] 4) The vpc-server obtains namespace-vm information, gets and sends virtual machine update information of the namespace type to MySQL.

[0123] 5) The vpc-server obtains VPC information, subnet information, port information, and namespace-vm information, and notifies the vpc-manager (VPC management service, which performs configuration caching, communicates with various distributed controllers, and distributes VPC resources to the distributed controllers).

[0124] 6) After the vpc-manager pulls VPC information, subnet information, port information, and namespace-vm information from MySQL, it configures vpc-gateway-ctrl (VPC control gateway) and compute-ctrl (compute control node).

[0125] 7) probe-service pulls the list of IPs from vpc-server and passes it to namespace-vm.

[0126] 8) namespace-vm sends a ping signal to compute-vm (the virtual machine on the compute node), and retrieves and sends the report results to probe-service.

[0127] 9) The probe-service passes the results to the pushgateway.

[0128] Example 2:

[0129] like Figure 6 As shown, the public cloud virtual network intranet connectivity detection system consists of probe-service, probe-node:ns (a probe node of type namespace), Promethues, vpc-server, vpc-manager, mysql, vpc-manager, compute-host, vm, probe-node:ns, network-host, and dpdk-node (network element node).

[0130] The process involves: probe-service creating a test VPC and sending its information to vpc-server; probe-service creating probe-node:ns on compute-host; vpc-server sending a notification to vpc-manager; vpc-manager configuring the VM based on the notification; MySQL retrieving and storing the test VPC information and vpc-manager's configuration information; probe-node:ns and VM exchanging data via dpdk-node and obtaining the intranet connectivity probe results; probe-service obtaining the intranet connectivity probe results and sending them to Promethues; and Promethues configuring associated alarms based on the intranet connectivity probe results.

[0131] The above embodiments have the following technical effects:

[0132] 1) Solving the problem of occupying user IP addresses: If a probe virtual machine is created within the target VPC, it will occupy the user's IP address, which is intrusive; if the agent is built into the customer's virtual machine, many customers will disagree with this highly intrusive approach and will refuse to use or disable it on the grounds of security, making it inconvenient to implement; This solution adopts: probe points outside the VPC, and probe points are established within the test VPC, which does not occupy user IP addresses.

[0133] 2) Solve the coupling problem with the computing team: Use special port definitions within the virtual network team to create lightweight instance namespaces on the network side to decouple computing and make it easier to control the creation and destruction of probe nodes; mount the namespace as a VM instance on OVS to simulate a VM, and use OVS's VXLAN capabilities to encapsulate and decapsulate VXLAN packets.

[0134] 3) Solve the problem of automated detection: Create a linkage between probe-service and vpc-server to automatically pull the probe list, automatically distribute configurations and initiate probes, collect probe results, and achieve linkage between monitoring and alarms.

[0135] 4) Solve the problem of false alarms caused by user ACL and security group interception: By designing the OVS pipeline (transmission path) and proxy answering flow table, ICMP request packets of specified TOS can be allowed to pass through, and the pipeline can be traversed to achieve the detection effect. Finally, proxy answering can be performed so that the probe can determine whether there is a connectivity problem.

[0136] This embodiment also provides a public cloud virtual network intranet connectivity detection device, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0137] This embodiment provides a public cloud virtual network intranet connectivity detection device, such as... Figure 7 As shown, it includes:

[0138] The first creation module 701 is used to create a probe test VPC;

[0139] The second creation module 702 is used to create a namespace detection virtual machine;

[0140] The acquisition module 703 is used to obtain the list of internal network IPs of the target VPC from the management and control service backend, and send the list of internal network IPs of the target VPC to the namespace probe virtual machine;

[0141] The distribution module 704 is used to distribute hidden routes to the probe test VPC and the probe target VPC;

[0142] The detection module 705 is used to perform connectivity detection on the addresses in the internal network IP list of the target VPC based on hidden routes and namespace detection virtual machines, and obtain the internal network connectivity detection results.

[0143] In some alternative implementations, the second creation module 702 includes:

[0144] The selection unit is used to obtain a list of compute nodes and randomly select a host machine based on the list of compute nodes.

[0145] The creation unit is used to create a port of type namespace using the host machine and to create a namespace probe virtual machine through the compute node controller.

[0146] In some alternative implementations, the distribution module 704 includes:

[0147] The first adding unit is used to obtain the subnet set corresponding to the target VPC, select a test subnet based on the subnet set, and add a detailed route to the subnet corresponding to the target VPC in the routing table of the test subnet; wherein, the test subnet does not overlap with other subnets in the subnet set;

[0148] The second addition unit is used to add detailed routes for returning the namespace probe virtual machine to the subnet routing table corresponding to the probe target VPC.

[0149] In some alternative implementations, the detection module 705 includes:

[0150] The acquisition unit is used to acquire the proxy flow table corresponding to the address in the internal network IP list of the probe target VPC;

[0151] The detection unit is used to perform multi-coroutine detection based on hidden routes and by using namespaces to detect virtual machines sending proxy flow tables to addresses in the internal IP list of the target VPC.

[0152] The determination unit is used to acquire multi-coroutine probe feedback data and determine the intranet connectivity probe results based on the multi-coroutine probe feedback data.

[0153] In some alternative implementations, the determining unit includes:

[0154] The first judgment subunit is used to determine the intranet connectivity as normal if multi-coroutine probe feedback data is received within a preset response time.

[0155] The second judgment subunit is used to determine the intranet connectivity failure result if the response time of the multi-coroutine detection feedback data exceeds the preset response time within a preset number of connectivity detection attempts.

[0156] In some alternative implementations, it also includes:

[0157] The associated warning module is used to send the intranet connectivity detection results to the cloud monitoring device and configure associated warnings for the cloud monitoring device based on the intranet connectivity detection results.

[0158] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0159] In this embodiment, the public cloud virtual network intranet connectivity detection device is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0160] This invention also provides a computer device having the above-described features. Figure 7 The above describes a public cloud virtual network intranet connectivity detection device.

[0161] Please see Figure 8, Figure 8 This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 8 As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 8 Take a processor 10 as an example.

[0162] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0163] The memory 20 stores instructions executable by at least one processor 10 to cause the at least one processor 10 to perform the method shown in the above embodiments.

[0164] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0165] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0166] The computer device also includes an input device 30 and an output device 40. The processor 10, memory 20, input device 30, and output device 40 can be connected via a bus or other means. Figure 8 Taking the example of a connection between China and Israel via a bus.

[0167] Input device 30 can receive input numerical or character information, and generate key signal inputs related to user settings and function control of the computer device, such as a touchscreen, keypad, mouse, trackpad, touchpad, joystick, one or more mouse buttons, trackball, joystick, etc. Output device 40 may include display devices, auxiliary lighting devices (e.g., LEDs), and haptic feedback devices (e.g., vibration motors). The aforementioned display devices include, but are not limited to, liquid crystal displays, light-emitting diodes, displays, and plasma displays. In some alternative embodiments, the display device may be a touchscreen.

[0168] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the above embodiments.

[0169] A portion of this invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0170] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for detecting intranet connectivity in a public cloud virtual network, characterized in that, The method includes: Create a probe test VPC; Create a namespace detection virtual machine; The system obtains the list of internal network IPs of the target VPC from the management service backend and sends the list of internal network IPs of the target VPC to the namespace probe virtual machine. Hidden routes are issued to the detection test VPC and the detection target VPC; Based on the hidden route, the namespace is used to probe the virtual machine to perform connectivity probes on the addresses in the internal network IP list of the target VPC, and the internal network connectivity probe results are obtained. The creation of the namespace detection virtual machine includes: Obtain a list of compute nodes, and randomly select a host machine based on the list of compute nodes; The host machine is used to create a port of type namespace, and the namespace probe virtual machine is created through the compute node controller; The process of issuing hidden routes to the detection test VPC and the detection target VPC includes: Obtain the set of subnets corresponding to the target VPC, select a test subnet based on the set of subnets, and add a detailed route to the subnet corresponding to the target VPC in the routing table of the test subnet; wherein, the test subnet does not overlap with other subnets in the set of subnets; Add a detailed route to the subnet routing table corresponding to the target VPC to return the virtual machine in the namespace being probed.

2. The method according to claim 1, characterized in that, Based on the hidden route, the virtual machine uses the namespace to probe the internal network IP addresses in the target VPC's internal network IP list to obtain the internal network connectivity probe results, including: Obtain the proxy flow table corresponding to the address in the internal network IP list of the target VPC; Based on the hidden route, the namespace is used to probe the virtual machine to send the proxy flow table to the address in the internal network IP list of the probe target VPC for multi-coroutine probe; Obtain multi-coroutine detection feedback data, and determine the intranet connectivity detection result based on the multi-coroutine detection feedback data.

3. The method according to claim 2, characterized in that, The determination of the intranet connectivity detection result based on the multi-coroutine detection feedback data includes: If the multi-coroutine probe feedback data is received within the preset response time, the intranet connectivity detection result is that the intranet connectivity is normal. Alternatively, if the response time of the multi-coroutine detection feedback data exceeds the preset response time within a preset number of connectivity detection attempts, then the intranet connectivity detection result is an intranet connectivity failure.

4. The method according to claim 1, characterized in that, Also includes: The intranet connectivity detection results are sent to the cloud monitoring device, and associated warnings are configured for the cloud monitoring device based on the intranet connectivity detection results.

5. A public cloud virtual network intranet connectivity detection device, characterized in that, The device includes: The first creation module is used to create a probe test VPC; The second creation module is used to create a namespace detection virtual machine; The acquisition module is used to obtain the list of internal network IPs of the target VPC from the management and control service backend, and send the list of internal network IPs of the target VPC to the namespace probe virtual machine; The distribution module is used to distribute hidden routes to the detection test VPC and the detection target VPC; The detection module is used to perform connectivity detection on the addresses in the internal network IP list of the target VPC based on the hidden route and using the namespace detection virtual machine to obtain the internal network connectivity detection results. The second creation module includes: The selection unit is used to obtain a list of compute nodes and randomly select a host machine based on the list of compute nodes. A creation unit is used to create a port of type namespace using the host machine, and to create a namespace probe virtual machine through the compute node controller; The distribution module includes: The first adding unit is used to obtain the subnet set corresponding to the target VPC, select a test subnet based on the subnet set, and add a detailed route to the subnet corresponding to the target VPC in the routing table of the test subnet; wherein, the test subnet does not overlap with other subnets in the subnet set; The second addition unit is used to add detailed routes for returning the namespace probe virtual machine to the subnet routing table corresponding to the probe target VPC.

6. A computer device, characterized in that, include: The system includes a memory and a processor, which are communicatively connected to each other. The memory stores computer instructions, and the processor executes the computer instructions to perform the public cloud virtual network intranet connectivity detection method according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute the public cloud virtual network intranet connectivity detection method according to any one of claims 1 to 4.

8. A computer program product, characterized in that, The method includes computer instructions for causing a computer to execute the public cloud virtual network intranet connectivity detection method according to any one of claims 1 to 4.

Images