Domain name resolution method and device, storage medium and program product

Abstract

The embodiment of the invention provides a domain name resolution method and device, a storage medium and a program product. In the domain name resolution method, when a domain name resolution node in a first computing cluster receives a domain name resolution request of a computing node in a second computing cluster, the domain name resolution request of the computing node in the second computing cluster can be acquired based on a corresponding relationship between an isolation group in the first computing cluster and the computing node in the second computing cluster; and determining an isolation group corresponding to the computing node in the first computing cluster, and analyzing the domain name analysis request of the computing node based on the domain name mapping relationship corresponding to the isolation group, thereby realizing cross-cluster and isolated domain name analysis. Wherein the corresponding relationship between the isolation group in the first computing cluster and the computing nodes in the second computing cluster is determined based on the isolation dimensions of the first computing cluster and the second computing cluster, so that the isolation group in the first computing cluster and the isolation group in the second computing cluster have an internal relationship; and a cross-cluster domain name resolution scheme with consistent isolation can be realized.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to a domain name resolution method, device, storage medium and program product. Background Art

[0002] A cloud computing platform is a unified and manageable system that integrates hardware resources (such as network infrastructure, servers, and storage devices) with software resources (such as applications and services). In a cloud computing platform, the Domain Name System (DNS) plays a vital role. The DNS not only helps users access cloud services through easy-to-remember domain names, but also supports the decoupling of Internet Protocol (IP) addresses when cloud services are connected to each other or when cloud products are connected to external resources.

[0003] In some cloud computing application scenarios, the domain name resolution system in the cloud computing cluster can provide isolated domain name services to different tenants in the cluster to reduce the mutual impact between tenants. However, for different cloud computing clusters, it is not possible to provide isolated domain name resolution services across clusters. Therefore, a new solution needs to be proposed. Summary of the invention

[0004] Multiple aspects of the present application provide a domain name resolution method, device, storage medium and program product for providing isolated domain name resolution services across cloud computing clusters.

[0005] An embodiment of the present application provides a domain name resolution method, including: a first domain name resolution node in a first computing cluster receives a domain name resolution request sent by the first computing node; if the first computing node belongs to a second computing cluster, obtaining a first isolation group corresponding to the first computing node in the first computing cluster according to a correspondence between computing nodes in the second computing cluster and an isolation group in the first computing cluster, the second computing cluster is different from the first computing cluster, and the correspondence between computing nodes in the second computing cluster and the isolation group in the first computing cluster is determined according to an isolation dimension between the first computing cluster and the second computing cluster; resolving the domain name resolution request according to a domain name mapping relationship corresponding to the first isolation group to obtain a resolution result; and returning the resolution result to the first computing node.

[0006] Optionally, it also includes: obtaining configuration information of the isolation group in the second computing cluster, the configuration information including: the correspondence between the isolation group in the second computing cluster and the tenant and the correspondence between the isolation group in the second computing cluster and the computing nodes in the second computing cluster; according to the correspondence between the isolation group in the second computing cluster and the tenant and the correspondence between the isolation group in the first computing cluster and the tenant, converting the correspondence between the isolation group in the second computing cluster and the computing nodes in the second computing cluster into the correspondence between the computing nodes in the second computing cluster and the isolation group in the first computing cluster.

[0007] Optionally, according to the correspondence between the isolation groups in the second computing cluster and the tenants and the correspondence between the isolation groups in the first computing cluster and the tenants, the correspondence between the isolation groups in the second computing cluster and the computing nodes in the second computing cluster is converted into the correspondence between the computing nodes in the second computing cluster and the isolation groups in the first computing cluster, including: for any isolation group in the second computing cluster, according to the correspondence between the isolation groups in the second computing cluster and the tenants and the correspondence between the isolation groups in the first computing cluster and the tenants, determining the target tenant corresponding to the any isolation group in the second computing cluster; and, according to the correspondence between the isolation groups in the second computing cluster and the computing nodes in the second computing cluster, determining the target computing node corresponding to the any isolation group in the second computing cluster; determining, among the isolation groups in the first computing cluster, the target isolation group corresponding to the target tenant; and establishing the correspondence between the target computing node and the target isolation group to convert the correspondence between the isolation group and the target computing node into the correspondence between the target computing node and the target isolation group.

[0008] Optionally, the first computing cluster divides the isolation groups according to views, and the second computing cluster divides the isolation groups according to namespaces; or, the first computing cluster divides the isolation groups according to namespaces, and the second computing cluster divides the isolation groups according to views.

[0009] Optionally, obtaining configuration information of the isolation group in the second computing cluster includes: obtaining configuration information of the isolation group in the second computing cluster from a configuration center node, the configuration information of the isolation group in the second computing cluster being uploaded to the configuration center node by the second domain name resolution node in the second computing cluster.

[0010] Optionally, the domain name resolution request is resolved according to the domain name mapping relationship corresponding to the first isolation group to obtain a resolution result, including: obtaining a network address corresponding to the domain name to be resolved in the domain name request from the domain name mapping relationship corresponding to the first isolation group as the resolution result; wherein the domain name mapping relationship corresponding to the first isolation group is obtained based on the domain name registered by the computing node in the first isolation group and the network address corresponding to the domain name, and the first isolation group and the isolation group to which the first computing node belongs in the second computing cluster belong to the same tenant.

[0011] Optionally, it also includes: responding to the update operation of the isolation group in the first computing cluster, obtaining the configuration information of the second isolation group updated in the first computing cluster, the configuration information of the second isolation group including the correspondence between the second isolation group and the tenant and the correspondence with the computing nodes in the first computing cluster; sending the configuration information of the second isolation group to the configuration center node, so that the configuration center node shares the configuration information of the second isolation group with the second domain name resolution node in the second computing cluster; wherein the configuration information of the second isolation group is used to: enable the second domain name resolution node to determine the correspondence between the computing nodes in the second isolation group and the isolation groups in the second computing cluster according to the correspondence between the second isolation group and the tenant and the correspondence between the isolation groups in the second computing cluster and the tenant, so as to resolve the domain name resolution request of the computing nodes in the second isolation group according to the correspondence between the computing nodes in the second isolation group and the isolation groups in the second computing cluster.

[0012] An embodiment of the present application also provides a domain name resolution method, which is applied to a hybrid cloud computing system, wherein the hybrid cloud computing system includes a first cloud computing cluster and a second cloud computing cluster, and the method includes: a first domain name resolution node in the first cloud computing cluster receives a domain name resolution request sent by a first computing node; if the first computing node belongs to the second cloud computing cluster, then according to the correspondence between the computing nodes in the second cloud computing cluster and the isolation group in the first cloud computing cluster, obtaining a first isolation group corresponding to the first computing node in the first cloud computing cluster, wherein the second cloud computing cluster is different from the first cloud computing cluster, and the correspondence between the computing nodes in the second cloud computing cluster and the isolation group in the first cloud computing cluster is determined according to the isolation dimension of the first cloud computing cluster and the second cloud computing cluster; according to the domain name mapping relationship corresponding to the first isolation group, resolving the domain name resolution request to obtain a resolution result; and returning the resolution result to the first computing node.

[0013] Optionally, the first cloud computing cluster is a computing cluster corresponding to a public cloud, and the second cloud computing cluster is a computing cluster corresponding to a private cloud; or, the first cloud computing cluster is a computing cluster corresponding to a private cloud, and the second cloud computing cluster is a computing cluster corresponding to a public cloud. The present application also provides an electronic device, including: a communication component, a memory, and a processor; the memory is used to store one or more computer instructions; the processor is used to execute the one or more computer instructions to: use the communication method provided by the communication component to perform the steps in the method provided in the present application embodiment.

[0014] The embodiment of the present application also provides a computer-readable storage medium storing a computer program, which can implement the steps in the method provided in the embodiment of the present application when the computer program is executed by a processor.

[0015] The embodiment of the present application also provides a computer program product, including: a computer program / instructions, which, when executed by a processor, can implement the steps in the method provided in the embodiment of the present application.

[0016] In an embodiment of the present application, when a domain name resolution node in the first computing cluster receives a domain name resolution request from a computing node in the second computing cluster, it can determine the isolation group corresponding to the computing node in the first computing cluster based on the correspondence between the isolation group in the first computing cluster and the computing node in the second computing cluster, and resolve the domain name resolution request of the computing node based on the domain name mapping relationship corresponding to the isolation group, thereby realizing cross-cluster and isolated domain name resolution. Among them, the correspondence between the isolation group in the first computing cluster and the computing node in the second computing cluster is determined based on the isolation dimension of the first computing cluster and the second computing cluster. Therefore, the isolation group in the first computing cluster and the isolation group in the second computing cluster have an intrinsic connection, which is conducive to ensuring the isolation consistency of the domain name resolution service across clusters to a certain extent under the premise of realizing a cross-cluster and isolated domain name resolution solution, and reducing the potential security risks of the cross-cluster domain name resolution service. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1 A schematic diagram of the structure of a multi-cluster computing system provided for an exemplary embodiment of the present application; Figure 2 A flowchart of a domain name resolution method provided by an exemplary embodiment of the present application; Figure 3A schematic diagram of the structure of a multi-cluster computing system and a domain name resolution method provided by an exemplary embodiment of the present application; Figure 4 A schematic diagram of the structure of an electronic device provided as an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0019] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings, and "multiple" generally includes at least two, but does not exclude the inclusion of at least one.

[0020] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0021] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a product or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such a product or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the presence of other identical elements in the product or system including the element.

[0022] In some cloud computing application scenarios, the DNS resolution system in a cloud computing cluster can provide isolated DNS services to different tenants in the cluster to reduce mutual impact between tenants.

[0023] In some isolation schemes, the cloud computing cluster can provide services to different tenants by defining different views, and different views correspond to different domain name mapping relationships. Among them, different views can be used to isolate different tenants. For example, different tenants can be divided into different views according to geographical location, internal access, external access, etc. When processing the domain name resolution request of the tenant, the cloud computing cluster can return different domain name resolution results to users in different views. For example, when tenants in two different views query the same domain name, the cloud computing cluster can query different domain name mapping relationships according to the views to which different tenants belong, thereby obtaining different resolution results for the same domain name. In other isolation schemes, the cloud computing cluster can allocate an independent namespace to each tenant to ensure that the domain names registered by different tenants do not conflict.

[0024] In some hybrid cloud scenarios, cloud computing clusters cannot provide tenant-side isolated DNS resolution services well in cross-cluster situations. For example, assume that the computing nodes in isolation group C1 and the computing nodes in isolation group C2 in cloud computing cluster K1 register the same domain name A, and the network addresses of the domain names registered by different computing nodes are different. The domain name resolution node in cloud computing cluster K2 can accurately resolve the domain name resolution requests initiated by the computing nodes in isolation group C1 and isolation group C2 for domain name A to different network addresses based on the correspondence between the computing nodes and isolation groups in the cluster. When the computing nodes in isolation group C3 and the computing nodes in isolation group C4 in cloud computing cluster K2 register the same domain name B, the domain name resolution node in cloud computing cluster K2 can accurately resolve the domain name resolution requests initiated by the computing nodes in isolation group C3 and isolation group C4 for domain name B to the corresponding network address. However, in the hybrid cloud scenario, different cloud computing clusters do not synchronize the configuration information of the isolation groups, which results in the cloud computing cluster K1 being unable to accurately return the resolution result when receiving the resolution request for the domain name A from the computing nodes in cloud computing cluster K2. Accordingly, when the cloud computing cluster K2 receives the resolution request for the domain name B from the computing node in the cloud computing cluster K1, it is also unable to accurately return the resolution result, thereby failing to accurately provide isolated and consistent domain name resolution services across clusters.

[0025] In response to the above technical problems, a solution is provided in some embodiments of the present application, the core idea of ​​which is: based on the isolation dimensions of different computing clusters, a correspondence between the isolation group in any computing cluster and the computing node in another computing cluster is established to achieve a domain name resolution service that is cross-computing clusters and has consistent isolation.

[0026] The technical solutions provided by various embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0027] Figure 1is a schematic diagram of the structure of a multi-cluster computing system provided by an exemplary embodiment of the present application. Figure 1 As shown, the multi-cluster computing system 100 includes at least a first computing cluster 10 and a second computing cluster 20, the first computing cluster 10 includes a first domain name resolution node 101 and multiple computing nodes 102, and the second computing cluster 20 includes a second domain name resolution node 201 and multiple computing nodes 202. The domain name resolution node is used to provide domain name registration and domain name resolution services to computing nodes. Any domain name resolution node can store the correspondence between the isolation group and the tenant in the cluster where it is located, so as to provide isolated domain name resolution services to the tenants of this cluster. Any domain name resolution node may include one or more components related to the domain name resolution function. For example, a domain name resolution node includes a domain name resolution proxy component and a domain name resolution core component. The domain name resolution core component is used to perform the core domain name resolution function, and the domain name resolution proxy component is used to assist in identifying the domain name resolution request or identifying the source information of the computing node that initiates the domain name resolution request. The computing node refers to the basic unit that undertakes data processing and computing tasks in the cluster architecture. The computing node usually has independent computing resources, such as central processing unit (CPU), memory, storage space and other resources, and can perform computing tasks or part of tasks assigned to it. In different cloud computing clusters, computing nodes may be physical servers, virtual machines, or container units (PODs), etc., which are not limited in this embodiment. For example, in some embodiments, computing nodes in the first computing cluster 10 may be virtual machines or physical machines, and computing nodes in the second computing cluster 20 may be container units. In other embodiments, computing nodes in the first computing cluster 10 may be virtual machines or physical machines, and computing nodes in the second computing cluster 20 may be container units, which are not limited in this embodiment.

[0028] In some multi-cluster computing scenarios, the first computing cluster 10 may be an on-cloud cluster, and the second computing cluster 20 may be an off-cloud cluster, such as Figure 1 As shown. It should be understood that in other multi-cluster computing scenarios, the first computing cluster 10 may be a cloud cluster, and the second computing cluster 20 may be a cloud cluster, which is no longer illustrated. Of course, in some other multi-cluster computing scenarios, both the first computing cluster 10 and the second computing cluster 20 may be implemented as cloud clusters, or both may be implemented as cloud clusters. Optionally, the multi-cluster computing scenario may be implemented as a hybrid cloud scenario or a distributed computing scenario, which is not limited in this embodiment.

[0029] The first computing cluster 10 and the second computing cluster 20 respectively use their own applicable isolation mechanisms to isolate the computing nodes in the cluster according to the set isolation dimension. For example, the first computing cluster 10 can define different views according to the view isolation mechanism, and divide different computing nodes into different views according to the set isolation dimension. The correspondence between the domain names and network addresses registered by the computing nodes in different views can be saved in the first domain name resolution node 101 as the domain name mapping relationship corresponding to the view. When the first domain name resolution node 101 receives the domain name resolution requests from different computing nodes in the first computing cluster 10, it can query different domain name mapping relationships according to the views to which the different computing nodes belong, and return different domain name resolution results. For another example, the second computing cluster 20 can create different namespaces according to the isolation mechanism of the set namespace, and the correspondence between the domain names and network addresses registered by the computing nodes in different namespaces can be saved in the second domain name resolution node 201 as the domain name mapping relationship corresponding to the namespace. When the second domain name resolution node 201 receives the domain name resolution requests from different computing nodes in the second computing cluster 20, it can query different domain name mapping relationships according to the namespaces to which the different computing nodes belong, and return different domain name resolution results. Of course, in some other embodiments, the first computing cluster 10 may divide the isolation groups by namespace, and the second computing cluster 20 may divide the isolation groups by view, which will not be described further.

[0030] The isolation dimension of the computing node refers to the attribute dimension used to divide and manage the computing node. Optionally, the isolation attribute of the computing node may include, but is not limited to: the tenant to which the computing node belongs, the network environment corresponding to the computing node, the application type deployed on the computing node, or the data permission corresponding to the computing node. The following will mainly take the tenant to which the computing node belongs as an example for exemplary description. Figure 1 The diagram shows how computing nodes are divided based on the tenants to which they belong. Figure 1 As shown, the first computing cluster 10 can divide the computing nodes belonging to tenant 1 into isolation group C1 and the computing nodes belonging to tenant 2 into isolation group C2, and the second computing cluster 20 can divide the computing nodes belonging to tenant 1 into isolation group C3 and the computing nodes belonging to tenant 2 into isolation group C4.

[0031] Among them, the first domain name resolution node 101 can share the configuration information of different isolation groups with the second domain name resolution node 201, and the configuration information of the isolation group can include the identifier of the tenant to which the isolation group belongs and the computing node included in the isolation group, so that the second domain name resolution node 201 can resolve the domain name resolution request initiated by the computing node in the first computing cluster 10 according to the isolation group to which the computing node in the first computing cluster 10 belongs and the tenant to which the isolation group belongs, according to the resolution principle of tenant-side isolation. Correspondingly, the second domain name resolution node 201 can share the configuration information corresponding to different isolation groups with the first domain name resolution node 101, and the configuration information of the isolation group can include the identifier of the tenant to which the isolation group belongs and the computing node included in the isolation group, so that the first domain name resolution node 101 can resolve the domain name resolution request initiated by the computing node in the second computing cluster 20 according to the isolation group to which the computing node in the second computing cluster 20 belongs and the tenant to which the isolation group belongs, according to the resolution principle of tenant-side isolation.

[0032] by Figure 1 Taking the illustrated isolation group division as an example, the first computing cluster 10 includes isolation group C1 and isolation group C2. Isolation group C1 belongs to tenant 1, and isolation group C2 belongs to tenant 2. Assuming that isolation group C1 includes a first computing node, the first computing node registers domain name A in the first domain name resolution node 101, and the corresponding IP address is IP-A1; the first domain name resolution node 101 can share the correspondence between the isolation group C1, tenant 1 and the identifier of the first computing node as the configuration information of the isolation group C1 to the second domain name resolution node 201, and save the correspondence between domain name A and IP-A1 as the domain name mapping relationship corresponding to the isolation group C1 locally in the first domain name resolution node 101. Assume that the isolation group C2 in the first computing cluster 10 includes a second computing node, and the second computing node has registered domain name A in the first domain name resolution node 101, and the corresponding IP address is IP-A2. The first domain name resolution node 101 can share the correspondence between the isolation group C2, tenant 2, and the identifier of the second computing node as the configuration information of the isolation group C2 to the second domain name resolution node 201, and save the correspondence between domain name A and IP-A2 as the domain name mapping relationship corresponding to the isolation group C2 locally in the first domain name resolution node 101.

[0033] by Figure 1Taking the illustrated isolation group division as an example, the second computing cluster 20 includes isolation group C3 and isolation group C4, isolation group C3 belongs to tenant 1, and isolation group C4 belongs to tenant 2. The third computing node in isolation group C3 in the second computing cluster 20 has registered domain name B in the second domain name resolution node 201, and the corresponding IP address is IP-B1. The second domain name resolution node 201 can share the corresponding relationship between the domain name B identified by the isolation group C3, tenant 1, and the third computing node as the configuration information of the isolation group C3 to the first domain name resolution node 101, and save the corresponding relationship between domain name B and IP-B1 as the domain name mapping relationship corresponding to the isolation group C3 locally in the second domain name resolution node 201. Assume that the fourth computing node in the isolation group C4 in the second computing cluster 20 has registered domain name B in the second domain name resolution node 201, and the corresponding IP address is IP-B2. The second domain name resolution node 201 can share the correspondence between the isolation group C4, tenant 2 and the identification domain name B of the fourth computing node as the configuration information of the isolation group C4 to the first domain name resolution node 101, and save the correspondence between domain name B and IP-B2 as the domain name mapping relationship corresponding to the isolation group C4 locally in the second domain name resolution node 201.

[0034] When the first computing node in the isolation group C1 requests the first domain name resolution node 101 to resolve the domain name B, the first domain name resolution node 101 does not have a domain name mapping relationship corresponding to the domain name B, and the first computing node may send a domain name resolution request to the second domain name resolution node 201. The second domain name resolution node 201 may determine that the first computing node belongs to tenant 1 according to the configuration information of the isolation group C1, determine the isolation group C3 corresponding to tenant 1 on the second computing cluster 20, and return the IP address IP-B1 of the domain name B in the isolation group C3 as the resolution result to the first computing node.

[0035] When the second computing node in the isolation group C1 requests the first domain name resolution node 101 to resolve the domain name B, the first domain name resolution node 101 does not have a domain name mapping relationship corresponding to the domain name B, and the second computing node may send a domain name resolution request to the second domain name resolution node 201. The second domain name resolution node 201 may determine that the second computing node belongs to tenant 2 according to the configuration information of the isolation group C2, determine the isolation group C4 corresponding to tenant 2 on the second computing cluster 20, and return the IP address IP-B2 of the domain name B in the isolation group C4 as the resolution result to the first computing node.

[0036] When the third computing node in the isolation group C3 requests the second domain name resolution node 201 to resolve the domain name A, the second domain name resolution node 201 does not have a domain name mapping relationship corresponding to the domain name A, and the third computing node may send a domain name resolution request to the first domain name resolution node 101. The first domain name resolution node 101 may determine that the third computing node belongs to tenant 1 according to the configuration information of the isolation group C3, determine the isolation group C1 corresponding to tenant 1 on the first computing cluster 10, and return the IP address IP-A1 of the domain name A in the isolation group C1 as the resolution result to the third computing node.

[0037] When the fourth computing node in the isolation group C4 requests the second domain name resolution node 201 to resolve the domain name A, the second domain name resolution node 201 does not have a domain name mapping relationship corresponding to the domain name A, and the fourth computing node may send a domain name resolution request to the first domain name resolution node 101. The first domain name resolution node 101 may determine that the fourth computing node belongs to tenant 2 according to the configuration information of the isolation group C4, determine the isolation group C2 corresponding to tenant 2 on the first computing cluster 10, and return the IP address IP-A2 of the domain name A in the isolation group C2 as the resolution result to the fourth computing node.

[0038] Based on the above method, for the first computing cluster 10 and the second computing cluster 20, not only can the domain name resolution requests of the computing nodes in the cluster be processed, but also the domain name resolution requests of the computing nodes in other clusters can be processed according to the information of the tenants to which the computing nodes in other clusters belong. Based on this method, in the case of cross-cluster, the domain name resolution nodes in multiple different clusters can collaboratively perform domain name resolution according to the isolation group corresponding to the tenant, realizing the tenant-side isolation of the domain name resolution service in the cross-cluster case.

[0039] The following will take the first domain name resolution node 101 in the first computing cluster 10 in the multi-cluster computing system 100 as an example to illustrate the domain name resolution method provided by the embodiment of the present application. It should be understood that the domain name resolution method described below can also be executed by the second domain name resolution node 201 in the second computing cluster 20.

[0040] like Figure 2 As shown, when the domain name resolution method is executed by the first domain name resolution node 101, it mainly includes the following steps: Step 201: A first domain name resolution node in a first computing cluster receives a domain name resolution request sent by a first computing node.

[0041] Step 202: If the first computing node belongs to a second computing cluster, then based on the correspondence between the computing nodes in the second computing cluster and the isolation groups in the first computing cluster, obtain the first isolation group corresponding to the first computing node in the first computing cluster, the second computing cluster is different from the first computing cluster, and the correspondence between the computing nodes in the second computing cluster and the isolation groups in the first computing cluster is determined according to the isolation dimensions of the first computing cluster and the second computing cluster.

[0042] Step 203: According to the domain name mapping relationship corresponding to the first isolation group, the domain name resolution request is resolved to obtain a resolution result.

[0043] Step 204: Return the parsing result to the first computing node.

[0044] The embodiments of the present application are applied in application scenarios of multi-cluster collaborative operations, such as multi-cluster distributed operation scenarios or hybrid cloud scenarios. In a multi-cluster scenario, multiple computing clusters are connected to share resources, share workloads, or complete complex tasks together. In a multi-cluster scenario, a secure network connection is established between multiple clusters. For example, in some distributed computing scenarios, multiple computing clusters can be connected through dedicated physical lines to achieve direct communication between different computing clusters. For example, in a hybrid cloud scenario, a network connection can be established between a computing cluster corresponding to a private cloud and a computing cluster corresponding to a public cloud through a virtual private network (VPN) to efficiently and securely transmit data between different clusters. The first domain name resolution node 101 can receive a domain name resolution request sent by a first computing node through a network connection between computing clusters or a network connection between different nodes within a cluster. Among them, the first computing node refers to any computing node, and the "first" is used here to describe the computing node for the convenience of distinguishing it from other computing nodes recorded later, and does not limit the order of the computing nodes and the clusters to which they belong.

[0045] In step 202, the first domain name resolution node 101 may obtain the computing cluster to which the first computing node belongs. In some optional embodiments, the first domain name resolution node 101 may obtain metadata of different clusters, and the metadata of any cluster is used to record the computing nodes included in the cluster and the identifiers of the computing nodes. After receiving the domain name resolution request of the first computing node, the first domain name resolution node 101 may obtain the identifier of the first computing node, and query the metadata of different clusters according to the identifier of the first computing node. If the metadata of a computing cluster includes the identifier of the first computing node, the computing cluster may be used as the computing cluster to which the first computing node belongs. Among them, the identifier of any computing node may be the number or IP address of the computing node.

[0046] If the first computing node belongs to a second computing cluster 20 that is different from the first computing cluster 10, the domain name resolution request of the first computing node can be considered to be a cross-cluster domain name resolution request. In this case, the first domain name resolution node 101 can obtain the isolation group corresponding to the first computing node in the first computing cluster 10 based on the correspondence between the computing nodes in the second computing cluster 20 and the isolation groups in the first computing cluster 10, so as to perform domain name resolution based on the domain name mapping relationship corresponding to the isolation group. In this embodiment, for the convenience of description and to facilitate distinction from other subsequent isolation groups, the isolation group corresponding to the first computing node in the first computing cluster 10 is described as the first isolation group, and "first" here is not used to limit the order of the isolation groups.

[0047] Among them, the isolation group in any computing cluster refers to the computing node group obtained by dividing different computing nodes in the computing cluster according to the isolation dimension of the computing nodes in the computing cluster. The isolation dimension of the computing node refers to the attribute dimension used for dividing and managing the computing nodes. Optionally, the isolation attribute of the computing node may include: the tenant to which the computing node belongs, the network environment corresponding to the computing node, the application type deployed on the computing node, the data permissions corresponding to the computing node, etc. This embodiment includes but is not limited to this.

[0048] Different computing clusters contain different computing nodes, and the computing nodes in the same computing cluster have a corresponding relationship with the isolation group in the computing cluster, and the corresponding relationship can be stored in the domain name resolution node in the computing cluster. For example, the isolation group C1 of the first computing cluster 10 corresponds to the computing node N1 it contains, and the isolation group C2 corresponds to the computing node N2 and the computing node N3 it contains, and the above correspondence is stored in the first domain name resolution node 101. For another example, the isolation group C3 of the second computing cluster 20 corresponds to the computing node N4 and the computing node N5 it contains, and the isolation group C4 corresponds to the computing node N6 and the computing node N7 it contains, and the above correspondence is stored in the second domain name resolution node 201.

[0049] The domain name resolution node in any computing cluster stores the domain name mapping relationship corresponding to the isolation group in this computing cluster, so as to provide isolated domain name resolution services to the computing nodes in this computing cluster based on the domain name mapping relationship. In the case of cross-cluster, in order to enable the domain name resolution node in any computing cluster to provide isolated domain name resolution services to the computing nodes in the isolation group in other computing clusters, the computing nodes in one computing cluster can be mapped to the isolation group in another computing cluster to obtain the corresponding relationship between the computing nodes in one computing cluster and the isolation group in another computing cluster, so as to facilitate the use of the domain name mapping relationship corresponding to the isolation group in another computing cluster for domain name resolution. For example, the computing node N1 in the first computing cluster 10 can be mapped to the isolation group C3 of the second computing cluster 20, and the computing node N4 in the second computing cluster 20 can be mapped to the isolation group C1 of the first computing cluster 10. Furthermore, when the first domain name resolution node 101 receives the cross-cluster domain name resolution request sent by the computing node N4, the domain name resolution request of the computing node N4 can be resolved according to the domain name mapping relationship of the isolation group C1. Accordingly, when the second domain name resolution node 201 receives the cross-cluster domain name resolution request sent by the computing node N1, it can resolve the domain name resolution request of the computing node N1 according to the domain name mapping relationship of the isolation group C3.

[0050] The correspondence between the computing nodes in the second computing cluster 20 and the isolation groups in the first computing cluster 10 may be determined based on the correspondence between the computing nodes in the second computing cluster 20 and the isolation groups in the second computing cluster 20 and the correspondence between the isolation groups in the second computing cluster 20 and the isolation groups in the first computing cluster 10. An exemplary description will be given below.

[0051] In some optional embodiments, the first computing cluster 10 and the second computing cluster 20 may be divided into isolation groups according to application types, so that different types of applications in the computing clusters have their own independent logical environments while sharing the physical resources in the computing clusters. The first domain name resolution node 101 may obtain the application type corresponding to the isolation group in the second computing cluster 20 and the application type corresponding to the isolation group in the first computing cluster 10, and use the isolation groups with the same application type in different computing clusters as isolation groups with corresponding relationships. For example, in the isolation group of the first computing cluster 10, the isolation group M1 is used to run instant messaging applications, and the isolation group M2 is used to run game applications. For another example, in the isolation group of the second computing cluster 20, the isolation group M3 is used to run instant messaging applications, and the isolation group M4 is used to run game applications. The first domain name resolution node 101 may determine that the isolation group M1 has a corresponding relationship with the isolation group M3, and determine that the isolation group M2 has a corresponding relationship with the isolation group M4. The first domain name resolution node 101 may map the computing nodes in one isolation group to another isolation group based on the corresponding relationship of the isolation groups. Based on this approach, it is convenient to provide application-side isolated domain name resolution services for different types of applications when resolving domain names across clusters, so as to manage the access rights of different applications to domain names at the network level and reduce potential security threats.

[0052] In some other optional embodiments, the first computing cluster 10 and the second computing cluster 20 are divided into isolation groups according to the tenant dimension, so that different tenants in the computing cluster can have their own independent logical environment while sharing the physical resources in the computing cluster. In this embodiment, the isolation group in any computing cluster has a corresponding relationship with the tenant, and the corresponding relationship is used to describe the tenant to which the isolation group belongs. For example, in the isolation group of the first computing cluster 10, the isolation group C1 corresponds to the first tenant to which it belongs, and the isolation group C2 corresponds to the second tenant to which it belongs. For another example, in the isolation group of the second computing cluster 20, the isolation group C3 corresponds to the first tenant to which it belongs, and the isolation group C4 corresponds to the second tenant to which it belongs.

[0053] The first domain name resolution node 101 may obtain configuration information of the isolation group in the second computing cluster 20, and the configuration information includes: the correspondence between the isolation group in the second computing cluster 20 and the tenant, and the correspondence between the isolation group in the second computing cluster 20 and the computing nodes in the second computing cluster 20. The first domain name resolution node 101 has the correspondence between the isolation group in the first computing cluster 10 and the tenant stored locally, and the correspondence may be sent to the first domain name resolution node 101 by the first computing cluster 10 after completing the tenant isolation configuration. The first domain name resolution node 101 may convert the correspondence between the isolation group in the second computing cluster 20 and the computing nodes in the second computing cluster 20 into the correspondence between the computing nodes in the second computing cluster 20 and the isolation group in the first computing cluster 10 according to the correspondence between the isolation group in the second computing cluster 20 and the tenant, and the correspondence between the isolation group in the first computing cluster 10 and the tenant.

[0054] Based on this implementation, the configuration information of the isolation group in the second computing cluster 20 is shared with the first domain name resolution node 101 in the first computing cluster 10, thereby realizing the sharing of the configuration information of the isolation group between different computing clusters, and providing information support for the cross-cluster and isolated domain name resolution solution.

[0055] Optionally, a correspondence between isolation groups corresponding to the same tenant in different clusters may be established according to the principle of the same tenants, and based on the correspondence between the isolation groups, the computing nodes in one isolation group may be mapped to another isolation group. Alternatively, a correspondence between isolation groups corresponding to similar tenants in different clusters may be established according to the principle of similar tenants, and based on the correspondence between the isolation groups, the computing nodes in one isolation group may be mapped to another isolation group. Wherein, similar tenants refer to different tenants having close addresses, consistent technical preferences, similar service requirements, etc., which are not limited in this embodiment.

[0056] The following will take any isolation group in the isolation group in the second computing cluster 20 and the principle of the same tenant as an example to exemplify an optional implementation method in which the first domain name resolution node 101 converts the correspondence between the isolation group in the second computing cluster 20 and the computing nodes in the second computing cluster 20 into the correspondence between the computing nodes in the second computing cluster 20 and the isolation group in the first computing cluster 10.

[0057] Taking the principle of the same tenant as an example, in the first computing cluster 10 and the second computing cluster 20, if any two isolation groups that do not belong to the same cluster correspond to the same tenant, it can be considered that the two isolation groups have a corresponding relationship, and a corresponding relationship between the computing nodes in one isolation group and the other isolation group can be established. Optionally, for any isolation group in the second computing cluster 20, the first domain name resolution node 101 can determine the target tenant corresponding to any isolation group in the second computing cluster according to the corresponding relationship between the isolation group in the second computing cluster 20 and the tenant and the corresponding relationship between the isolation group in the first computing cluster 10 and the tenant, and can determine the target computing node corresponding to any isolation group in the second computing cluster 20 according to the corresponding relationship between the isolation group in the second computing cluster 20 and the computing node in the second computing cluster 20. After determining the target tenant, the first domain name resolution node 101 can determine the target isolation group corresponding to the target tenant in the isolation group of the first computing cluster 10, and establish a corresponding relationship between the target computing node and the target isolation group, so as to convert the corresponding relationship between the isolation group and the target computing node into the corresponding relationship between the target computing node and the target isolation group. For example, the isolation group C1 of the first computing cluster 10 and the isolation group C3 of the second computing cluster 20 belong to the first tenant. The first domain name resolution node 101 can establish a correspondence between the computing nodes in the isolation group C3 and the isolation group C1, and save the correspondence locally for query.

[0058] Based on this implementation, the first domain name resolution node 101 can mine the internal connection between the isolation group in the first computing cluster 10 and the isolation group in the second computing cluster 20 according to the correspondence between tenants and isolation groups in different computing clusters, and based on the internal connection, determine the correspondence between the isolation group in the first computing cluster 10 and the computing nodes in the second computing cluster 20. Further, it is beneficial to implement a domain name resolution solution with consistent tenant-side isolation when performing domain name resolution across clusters, and reduce the potential security risks of domain name resolution services across clusters.

[0059] The isolation mechanisms corresponding to the first computing cluster 10 and the second computing cluster 20 may be the same or different. Optionally, the first computing cluster 10 and the second computing cluster 20 are divided into isolation groups according to views and namespaces, respectively, or the first computing cluster 10 and the second computing cluster 20 are divided into isolation groups according to views and namespaces, respectively.

[0060] Optionally, if the first computing cluster 10 divides isolation groups according to views and the second computing cluster 20 divides isolation groups according to namespaces, the first domain name resolution node 101 can obtain the target tenant belonging to any namespace in the second computing cluster 20 and the computing nodes in the namespace; determine the target view corresponding to the target tenant in the view of the first computing cluster 10, and map the computing nodes in the namespace to the target view, so as to convert the correspondence between the namespace and the computing node into the correspondence between the target view and the computing node.

[0061] Optionally, if the first computing cluster 10 divides isolation groups according to namespaces, and the second computing cluster 20 divides isolation groups according to views, the first domain name resolution node 101 can obtain the target tenant to which any view in the second computing cluster 20 belongs and the computing nodes in the view; determine the target namespace corresponding to the target tenant in the namespace of the first computing cluster 10, and map the computing nodes in the view to the target namespace to convert the correspondence between the view and the computing node into the correspondence between the target namespace and the computing node.

[0062] Based on this implementation, when the isolation mechanisms of the first computing cluster 10 and the second computing cluster 20 are different, the configuration information of the isolation group in the second computing cluster 20 is converted according to the isolation mechanism of the first computing cluster 10, and the configuration information of the isolation group in the second computing cluster 20 can be converted into a format that can be recognized by the first domain name resolution node 101, so that the first domain name resolution node 101 can query the converted configuration information, thereby efficiently realizing a cross-cluster and isolated domain name resolution solution.

[0063] In step 203, the first domain name resolution node 101 can resolve the domain name resolution request according to the domain name mapping relationship corresponding to the first isolation group to obtain a resolution result. The domain name mapping relationship corresponding to the first isolation group is used to describe the correspondence between the domain name and the network address registered by the computing node included in the first isolation group. The first domain name resolution node 101 can query the network address corresponding to the domain name carried by the domain name resolution request in the domain name mapping relationship corresponding to the first isolation group as the resolution result.

[0064] Optionally, the domain name mapping relationship corresponding to the first isolation group is obtained according to the domain name registered by the computing node in the first isolation group and the network address corresponding to the domain name, and the first isolation group and the isolation group to which the first computing node belongs in the second computing cluster 20 belong to the same tenant. In other words, although the domain name resolution request of the first computing node is resolved across clusters, it can be ensured that the domain name resolution result is associated with the tenant corresponding to the first computing node, thereby realizing a domain name resolution solution across clusters and tenant-side isolation groups.

[0065] In step 204, after obtaining the resolution result corresponding to the domain name resolution request, the first domain name resolution node 101 may return the resolution result to the first computing node.

[0066] In this embodiment, when the domain name resolution node in the first computing cluster 10 receives the domain name resolution request of the computing node in the second computing cluster 20, it can determine the isolation group corresponding to the computing node in the first computing cluster 10 based on the correspondence between the isolation group in the first computing cluster 10 and the computing node in the second computing cluster 20, and resolve the domain name resolution request of the computing node based on the domain name mapping relationship corresponding to the isolation group, thereby realizing cross-cluster and isolated domain name resolution. Among them, the correspondence between the isolation group in the first computing cluster 10 and the computing node in the second computing cluster 20 is determined based on the isolation dimension of the first computing cluster 10 and the second computing cluster 20. Therefore, the isolation group in the first computing cluster 10 and the isolation group in the second computing cluster 20 have an intrinsic connection, which is conducive to ensuring the isolation consistency of the domain name resolution service when crossing clusters to a certain extent under the premise of realizing a cross-cluster and isolated domain name resolution solution, and reducing the potential security risks of the cross-cluster domain name resolution service.

[0067] In some optional embodiments, Figure 1 The multi-cluster computing system 100 shown may also include a configuration center node 30, which is used to centrally manage configuration information of different clusters in the multi-cluster computing system 100. The configuration center node 30 may receive configuration information of an isolation group within the cluster sent by a domain name resolution node in any cluster, and share the received configuration information of the isolation group among multiple clusters.

[0068] Optionally, when the first domain name resolution node 101 obtains the configuration information of the isolation group in the second computing cluster 20, it may obtain the configuration information of the isolation group in the second computing cluster 20 from the configuration center node 30. The configuration information of the isolation group in the second computing cluster 20 is uploaded to the configuration center node 30 by the second domain name resolution node 201 in the second computing cluster 20. In some optional embodiments, the configuration information of the isolation group in the second computing cluster 20 may be uploaded to the configuration center node 30 by the second domain name resolution node according to a specific upload cycle, or may be uploaded to the configuration center node 30 each time the second domain name resolution node obtains the configuration information of a new isolation group in the cluster, which is not limited in this embodiment.

[0069] Optionally, the first domain name resolution node 101 may periodically obtain the configuration information of the isolation group in the second computing cluster 20 from the configuration center node 30. Alternatively, the first domain name resolution node 101 may actively obtain the configuration information of the isolation group in the second computing cluster 20 from the configuration center node 30 each time it receives an update message sent by the configuration center node 30. The update message may be sent by the configuration center node 30 each time it receives the configuration information uploaded by the second domain name resolution node. Furthermore, the first domain name resolution node may share the configuration information of the isolation group of other clusters in real time, thereby improving the domain name resolution performance across clusters.

[0070] In some optional embodiments, in addition to obtaining the configuration information of the isolation group of other computing clusters, the first domain name resolution node 101 may also share the configuration information of the isolation group in the computing cluster with other computing clusters, so that other computing clusters can provide cross-cluster and isolated domain name resolution services to the computing nodes in the computing cluster where the first domain name resolution node 101 is located.

[0071] Optionally, the first domain name resolution node 101 may respond to the update operation of the isolation group in the first computing cluster 10, and obtain the configuration information of the second isolation group updated in the first computing cluster 10, and the configuration information of the second isolation group may include the correspondence between the second isolation group and the tenant and the correspondence between the second isolation group and the computing nodes in the first computing cluster 10. The first domain name resolution node 101 may send the configuration information of the second isolation group to the configuration center node 30, so that the configuration center node 30 shares the configuration information of the second isolation group with the second domain name resolution node 201 in the second computing cluster 20. The configuration information of the second isolation group is used to enable the second domain name resolution node 201 to determine the correspondence between the computing nodes in the second isolation group and the isolation groups in the second computing cluster 20 according to the correspondence between the second isolation group and the tenant and the correspondence between the isolation groups in the second computing cluster 20 and the tenant, so as to resolve the domain name resolution request of the computing nodes in the second isolation group according to the correspondence between the computing nodes in the second isolation group and the isolation groups in the second computing cluster 20.

[0072] In this implementation, when the isolation group within the cluster is updated, the first domain name resolution node 101 actively shares the configuration information of the updated isolation group within the cluster with other clusters, so as to facilitate timely synchronization of the division of isolation groups within different clusters in a cross-cluster situation, thereby improving the accuracy of the cross-cluster and isolated domain name resolution solution.

[0073] The following will be combined with the attached Figure 3 , further exemplifies the domain name resolution method performed by the multi-cluster computing system provided in the embodiment of the present application. Figure 3As shown, the multi-cluster computing system includes a first computing cluster 10, a second computing cluster 20, and a configuration center node 30. The computing nodes in the first computing cluster 10 can be container units (PODs), and the computing nodes in the second computing cluster 20 can be physical machines or virtual machines. The configuration center node 30 is used to record the correspondence between tenants and namespaces, the correspondence between tenants and views, the correspondence between views and IP segments, the correspondence between namespaces and IP segments, etc. Figure 3 As shown, when there are tenant 1 and tenant 2, the first namespace in the first computing cluster 10 and the first view in the second computing cluster 20 belong to tenant 1, and the correspondence between tenant 1 and the first namespace and the first view is stored as the first record in the configuration center node 30; the second namespace and the second view belong to tenant 2, and the correspondence between tenant 2 and the second namespace and the second view is stored as the second record in the configuration center node 30. Among them, the IP address of POD1 contained in the first namespace is IP1, and the correspondence between POD1 and IP1 is stored as the third record in the configuration center node 30; the POD-IP contained in the second namespace is IP2, and the correspondence between POD2 and IP2 is stored as the fourth record in the configuration center node 30. The IP of server 1 in the first view is IP3, and the correspondence between server 1 and IP3 is stored as the fifth record in the configuration center node 30; the IP of server 2 in the second view is IP4, and the correspondence between server 2 and IP4 is stored as the sixth record in the configuration center node 30.

[0074] like Figure 1 As shown, the multi-cluster computing system 100 includes a first domain name resolution node 101, a DNS proxy server 103, and a second domain name resolution node 201. The DNS proxy server 103 is used to cooperate with the first domain name resolution node 101 to provide cross-cluster domain name resolution services. The access order of the domain name resolution nodes is configured in the DNS resolution configuration file in each computing node (for example, the file under the / etc / resolve.conf path). The POD in the first computing cluster 10 preferentially requests the first domain name resolution node 101 for domain name resolution, and if the resolution fails, requests the second domain name resolution node 201 for resolution; the second computing cluster 20 preferentially requests the second domain name resolution node 201 for resolution, and if the resolution fails, requests the DNS proxy server 103 for resolution.

[0075] The following will be combined with the attached Figure 3 The system architecture provided further illustrates the process of domain name resolution.

[0076] like Figure 3As shown, in step 1, the DNS proxy server 103 in the first computing cluster 10 interacts with the configuration center node 30 to upload the configuration information of the namespace of the first computing cluster 10 to the configuration center node 30 to form the third and fourth records. The DNS proxy server 103 can download the first and second records in the configuration center node 30 to the local computer to obtain the corresponding relationship between the namespace in the first computing cluster 10, the view in the second computing cluster 20, and the tenant 1 and tenant 2.

[0077] In step 2, the second domain name resolution node 201 in the second computing cluster 20 interacts with the configuration center node 30 to upload the configuration information of the view in the second computing cluster 20 to the configuration center node 30, forming the 5th and 6th records in the configuration center node 30. The second domain name resolution node 201 can download the 1st and 2nd records in the configuration center node 30 to the local computer to obtain the corresponding relationship between the namespace in the first computing cluster 10, the view in the second computing cluster 20, and tenants 1 and 2.

[0078] In addition, the DNS proxy server 103 can download the configuration information of the view of the second computing cluster 20 stored in the configuration center node 30, that is, the 5th and 6th records in the configuration center node 30 to the local. The second domain name resolution node 201 can download the configuration information of the namespace of the first computing cluster 10 stored in the configuration center node 30, that is, the 3rd and 4th records to the local, and convert the downloaded 3rd and 4th records into the 5th and 6th records of the local.

[0079] In step 3, POD1 in the first namespace registers domain name A with the first domain name resolution node 101, and its corresponding IP is IP-A1. The first domain name resolution node 101 records the mapping relationship between domain name A and IP-A1 in the configuration information of the first namespace.

[0080] In step 4, the server 1 in the first view registers the domain name B with the second domain name resolution node 201, whose corresponding IP is IP-B1, and the second domain name resolution node 201 records it in the configuration information of the first view.

[0081] In step 5, POD2 in the second namespace registers domain name A with the first domain name resolution node 101, and its corresponding IP is IP-A2. The first domain name resolution node 101 can record the correspondence between domain name A and IP-A2 in the configuration information of the second namespace. In this case, POD1 and POD2 have registered domain name A, but the IPs corresponding to the domain names are different.

[0082] In step 6, server 2 in the second view registers domain name B with second domain name resolution node 201, and its corresponding IP is IP-B2. Second domain name resolution node 201 can record the correspondence between domain name B and IP-B2 in the configuration information of the second view. In this case, server 1 and server 2 have registered domain name B, but the IPs corresponding to the domain names are different.

[0083] In step 7, when POD1 requests to resolve the IP corresponding to domain name A, it preferentially initiates a domain name resolution request to the first domain name resolution node 101. The first domain name resolution node 101 returns the IP address corresponding to domain name A in the first namespace according to the namespace to which POD1 belongs, that is, returns IP-A1.

[0084] In step 8, when server 1 requests to resolve the IP corresponding to domain name B, it preferentially initiates a domain name resolution request to second domain name resolution node 201. Second domain name resolution node 201 returns the IP address corresponding to domain name B in the first view, i.e., returns IP-B1, according to the view in which server 1 is located.

[0085] In step 9, when POD2 requests to resolve the IP corresponding to domain name A, it preferentially initiates a domain name resolution request to the first domain name resolution node 101. The first domain name resolution node 101 can return the IP address corresponding to domain name A in the second namespace according to the namespace to which POD2 belongs, that is, returns IP-A2. In steps 7 and 9, although POD1 and POD2 request to resolve the same domain name, since POD1 and POD2 belong to different namespaces in the first computing cluster 10, the first domain name resolution node 101 can return different resolution results, thereby realizing tenant-side isolated domain name resolution within the first computing cluster 10.

[0086] In step 10, when server 2 requests to resolve the IP corresponding to domain name B, it preferentially initiates a domain name resolution request to the second domain name resolution node 201. The second domain name resolution node 201 can return the IP address corresponding to domain name B in the second view according to the view in which server 2 is located, that is, return IP-B2. In steps 8 and 10, although server 1 and server 2 request to resolve the same domain name, since server 1 and server 2 belong to different servers in the second computing cluster 20, the second domain name resolution node 201 can return different resolution results, and tenant-side isolated domain name resolution is implemented within the second computing cluster 20.

[0087] In step 11, when POD1 requests to resolve domain name B in the second computing cluster 20, it preferentially initiates a domain name resolution request to the first domain name resolution node 101. The first domain name resolution node 101 does not store records related to domain name B, so a prompt message "Domain name information not found" is returned to POD1.

[0088] In step 12, POD1 initiates a domain name resolution request to the second domain name resolution node 201 according to the configured access order. The second domain name resolution node 201 can determine that POD1 is in the first view based on the correspondence between the view obtained in step 2 and the IP address of the POD (i.e., the 5th and 6th records of the second domain name resolution node 201). The second domain name resolution node 201 can return the IP address corresponding to domain name B, i.e., IP-B1, based on the domain name mapping relationship in the first view (i.e., the 1st record of the second domain name resolution node 201).

[0089] Similarly, when POD2 requests to resolve domain name B, the second domain name resolution node 201 can return the IP address corresponding to domain name B, i.e. IP-B2, according to the domain name mapping relationship in the second view (i.e. the second record of the second domain name resolution node 201). Based on this, for tenant 1 to which POD1 belongs and tenant 2 to which POD2 belongs, in the case of cross-cluster, the second domain name resolution node 201 provides different resolution results for the same domain name, i.e., realizes the tenant-side DNS isolation solution of different clusters.

[0090] In step 13, when server 1 requests to resolve domain name A in the first computing cluster 10, it preferentially initiates a domain name resolution request to the second domain name resolution node 201. The second domain name resolution node 201 does not store the mapping relationship corresponding to domain name A. The second domain name resolution node 201 may return a prompt message "Domain name information not found" to server 1.

[0091] In step 14, server 1 continues to initiate domain name resolution requests to DNS proxy server 103 according to the configured access order. Based on the configuration information of the view in the second computing cluster 20 obtained from the configuration center node 30 (i.e., the 5th record of the configuration center node 30), DNS proxy server 103 knows that server 1 belongs to the first view, and according to the 1st record in the configuration center node 30, the first view and the first namespace belong to the same tenant. DNS proxy server 103 can send a new domain name resolution request to the first domain name resolution node 101 based on the domain name resolution, and the new domain name resolution request is used to apply for resolution of the IP address of domain name A in the first namespace.

[0092] In step 15, the first domain name resolution node 101 queries the domain name mapping relationship in the first namespace and returns the IP address corresponding to the domain name A in the first namespace, that is, returns IP-A1 to the server 1 to complete the domain name resolution.

[0093] Similarly, when server 2 requests to resolve domain name A, the first domain name resolution node 101 can return IP-A2, thereby realizing the tenant-side DNS isolation solution of different clusters collaboration.

[0094] Figure 1 The illustrated multi-cluster computing system may be a hybrid cloud computing system, that is, the domain name resolution method provided in the embodiment of the present application may be applied to the hybrid cloud computing system. The hybrid cloud computing system includes a first cloud computing cluster and a second cloud computing cluster. Optionally, the first cloud computing cluster is a computing cluster corresponding to a public cloud, and the second cloud computing cluster is a computing cluster corresponding to a private cloud; or, the first cloud computing cluster is a computing cluster corresponding to a private cloud, and the second cloud computing cluster is a computing cluster corresponding to a public cloud.

[0095] The first domain name resolution node in the first cloud computing cluster receives the domain name resolution request sent by the first computing node; if the first computing node belongs to the second cloud computing cluster, the first domain name resolution node can obtain the first isolation group corresponding to the first computing node in the first cloud computing cluster according to the correspondence between the computing nodes in the second cloud computing cluster and the isolation group in the first cloud computing cluster. The second cloud computing cluster is different from the first cloud computing cluster, and the correspondence between the computing nodes in the second cloud computing cluster and the isolation group in the first cloud computing cluster is determined according to the isolation dimension of the first cloud computing cluster and the second cloud computing cluster. The first domain name resolution node can resolve the domain name resolution request according to the domain name mapping relationship corresponding to the first isolation group, obtain the resolution result, and return the resolution result to the first computing node.

[0096] Based on this implementation, in the hybrid cloud scenario, when the domain name resolution node in the first cloud computing cluster receives the domain name resolution request of the computing node in the second cloud computing cluster, it can determine the isolation group corresponding to the computing node in the first cloud computing cluster based on the correspondence between the isolation group in the first cloud computing cluster and the computing node in the second cloud computing cluster, and resolve the domain name resolution request of the computing node based on the domain name mapping relationship corresponding to the isolation group, thereby realizing cross-cloud computing cluster and isolated domain name resolution. Among them, the correspondence between the isolation group in the first cloud computing cluster and the computing node in the second cloud computing cluster is determined based on the isolation dimension of the first cloud computing cluster and the second cloud computing cluster. Therefore, the isolation group in the first cloud computing cluster has an intrinsic connection with the isolation group in the second cloud computing cluster, which is conducive to realizing a domain name resolution solution with consistent isolation across cloud computing clusters. It should be noted that the execution subject of each step of the method provided in the above embodiment can be the same device, or the method can also be executed by different devices. For example, the execution subject of steps 301 to 304 can be device A; for another example, the execution subject of steps 301 and 302 can be device A, and the execution subject of step 303 can be device B; and so on.

[0097] In addition, in some of the processes described in the above embodiments and the accompanying drawings, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel, and the sequence numbers of the operations, such as 301, 302, etc., are only used to distinguish between different operations, and the sequence numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0098] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0099] Figure 4 A schematic diagram of the structure of an electronic device provided by an exemplary embodiment of the present application is illustrated, on which a domain name resolution service corresponding to a first computing cluster in a multi-computing cluster system can be run to serve as a first domain name resolution node in the first computing cluster.

[0100] like Figure 4 As shown, the electronic device includes: a memory 401 , a processor 402 and a communication component 403 .

[0101] The memory 401 is used to store computer programs and can be configured to store various other data to support operations on the electronic device. Examples of such data include instructions for any application or method used to operate on the electronic device.

[0102] The processor 402 is coupled to the memory 401 and is used to execute the computer program in the memory 401, so as to: receive a domain name resolution request sent by the first computing node through the communication component 403; if the first computing node belongs to the second computing cluster, obtain the first isolation group corresponding to the first computing node in the first computing cluster according to the correspondence between the computing nodes in the second computing cluster and the isolation group in the first computing cluster, the second computing cluster is different from the first computing cluster, and the correspondence between the computing nodes in the second computing cluster and the isolation group in the first computing cluster is determined according to the isolation dimension of the first computing cluster and the second computing cluster; parse the domain name resolution request according to the domain name mapping relationship corresponding to the first isolation group to obtain a resolution result; and return the resolution result to the first computing node through the communication component 403.

[0103] Optionally, the processor 402 is also used to: obtain configuration information of the isolation group in the second computing cluster, the configuration information including: the correspondence between the isolation group in the second computing cluster and the tenant and the correspondence between the isolation group in the second computing cluster and the computing nodes in the second computing cluster; according to the correspondence between the isolation group in the second computing cluster and the tenant and the correspondence between the isolation group in the first computing cluster and the tenant, convert the correspondence between the isolation group in the second computing cluster and the computing nodes in the second computing cluster into the correspondence between the computing nodes in the second computing cluster and the isolation group in the first computing cluster.

[0104] Optionally, when the processor 402 converts the correspondence between the isolation groups in the second computing cluster and the computing nodes in the second computing cluster into the correspondence between the computing nodes in the second computing cluster and the isolation groups in the first computing cluster according to the correspondence between the isolation groups in the second computing cluster and the tenants and the correspondence between the isolation groups in the first computing cluster and the tenants, the processor 402 is specifically used to: for any isolation group in the isolation groups in the second computing cluster, determine the target tenant corresponding to the any isolation group in the second computing cluster according to the correspondence between the isolation groups in the second computing cluster and the tenants and the correspondence between the isolation groups in the first computing cluster and the tenants; and, determine the target computing node corresponding to the any isolation group in the second computing cluster according to the correspondence between the isolation groups in the second computing cluster and the computing nodes in the second computing cluster; determine the target isolation group corresponding to the target tenant in the isolation groups of the first computing cluster; and establish a correspondence between the target computing node and the target isolation group to convert the correspondence between the isolation group and the target computing node into the correspondence between the target computing node and the target isolation group.

[0105] Optionally, the first computing cluster divides the isolation groups according to views, and the second computing cluster divides the isolation groups according to namespaces; or, the first computing cluster divides the isolation groups according to namespaces, and the second computing cluster divides the isolation groups according to views.

[0106] Optionally, when the processor 402 obtains the configuration information of the isolation group in the second computing cluster, it is specifically used to: obtain the configuration information of the isolation group in the second computing cluster from the configuration center node, and the configuration information of the isolation group in the second computing cluster is uploaded to the configuration center node by the second domain name resolution node in the second computing cluster.

[0107] Optionally, when the processor 402 parses the domain name resolution request according to the domain name mapping relationship corresponding to the first isolation group and obtains the resolution result, it is specifically used to: obtain, from the domain name mapping relationship corresponding to the first isolation group, a network address corresponding to the domain name to be resolved in the domain name request as the resolution result; wherein, the domain name mapping relationship corresponding to the first isolation group is obtained based on the domain name registered by the computing node in the first isolation group and the network address corresponding to the domain name, and the first isolation group and the isolation group to which the first computing node belongs in the second computing cluster belong to the same tenant.

[0108] Optionally, the processor 402 is also used to: respond to an update operation of the isolation group in the first computing cluster, obtain configuration information of the second isolation group updated in the first computing cluster, the configuration information of the second isolation group including the correspondence between the second isolation group and the tenant and the correspondence with the computing nodes in the first computing cluster; send the configuration information of the second isolation group to the configuration center node, so that the configuration center node shares the configuration information of the second isolation group with the second domain name resolution node in the second computing cluster; wherein the configuration information of the second isolation group is used to: enable the second domain name resolution node to determine the correspondence between the computing nodes in the second isolation group and the isolation groups in the second computing cluster according to the correspondence between the second isolation group and the tenant and the correspondence between the isolation groups in the second computing cluster and the tenant, so as to resolve the domain name resolution request of the computing nodes in the second isolation group according to the correspondence between the computing nodes in the second isolation group and the isolation groups in the second computing cluster.

[0109] Figure 4The electronic device shown in the figure can also be used to perform a domain name resolution method in a hybrid cloud architecture. The domain name resolution service corresponding to the first cloud computing cluster in the hybrid cloud architecture can be run on the electronic device to serve as the first domain name resolution node in the first cloud computing cluster. The processor 402 is coupled to the memory 401 and is used to execute the computer program in the memory 401 to: receive a domain name resolution request sent by the first computing node through the communication component 403; if the first computing node belongs to the second cloud computing cluster, then according to the correspondence between the computing nodes in the second cloud computing cluster and the isolation group in the first cloud computing cluster, obtain the first isolation group corresponding to the first computing node in the first cloud computing cluster, the second cloud computing cluster is different from the first cloud computing cluster, and the correspondence between the computing nodes in the second cloud computing cluster and the isolation group in the first cloud computing cluster is determined according to the isolation dimension of the first cloud computing cluster and the second cloud computing cluster; according to the domain name mapping relationship corresponding to the first isolation group, the domain name resolution request is resolved to obtain a resolution result; and the resolution result is returned to the first computing node through the communication component 403.

[0110] Optionally, the first cloud computing cluster is a computing cluster corresponding to a public cloud, and the second cloud computing cluster is a computing cluster corresponding to a private cloud; or, the first cloud computing cluster is a computing cluster corresponding to a private cloud, and the second cloud computing cluster is a computing cluster corresponding to a public cloud.

[0111] Further, if Figure 4 As shown, the electronic device also includes: a power supply component 404, a display component 405, an audio component 406 and other components. Figure 4 Only some components are shown schematically, which does not mean that the electronic device only includes Figure 4 Components shown.

[0112] Among them, the memory 401 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0113] The communication component 403 is configured to facilitate wired or wireless communication between the device where the communication component is located and other devices. The device where the communication component is located can access a wireless network based on a communication standard, such as Wi-Fi (wireless network communication technology), 2G (such as Global System for Mobile Communications (GSM)), 3G (such as Wideband Code Division Multiple Access (WCDMA), 4G (such as Long Term Evolution (LTE)), 4G+ (such as upgraded Long Term Evolution (LTE-Advanced, LTE-A)) or 5G (5th Generation Mobile Communication Technology), or a combination thereof. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component can be implemented based on Near Field Communication (NFC) technology, Radio Frequency Identification (RFID) technology, Infrared Data Association (IrDA) technology, Ultra Wide Band (UWB) technology, Bluetooth (BT) technology and other technologies.

[0114] The power supply component 404 is used to provide power to various components of the device where the power supply component is located. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing and distributing power to the device where the power supply component is located.

[0115] The display assembly includes a screen, which may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundary of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.

[0116] The audio component may be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC), and when the device where the audio component is located is in an operating mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal may be further stored in a memory or sent via a communication component. In some embodiments, the audio component also includes a speaker for outputting an audio signal.

[0117] In this embodiment, when a domain name resolution node in the first computing cluster receives a domain name resolution request from a computing node in the second computing cluster, it can determine the isolation group corresponding to the computing node in the first computing cluster based on the correspondence between the isolation group in the first computing cluster and the computing node in the second computing cluster, and resolve the domain name resolution request of the computing node based on the domain name mapping relationship corresponding to the isolation group, thereby realizing cross-cluster and isolated domain name resolution. Among them, the correspondence between the isolation group in the first computing cluster and the computing node in the second computing cluster is determined based on the isolation dimension of the first computing cluster and the second computing cluster. Therefore, the isolation group in the first computing cluster and the isolation group in the second computing cluster have an intrinsic connection, which is conducive to ensuring the isolation consistency of the domain name resolution service across clusters to a certain extent under the premise of realizing a cross-cluster and isolated domain name resolution solution, and reducing the potential security risks of the cross-cluster domain name resolution service.

[0118] Accordingly, the embodiment of the present application also provides a computer-readable storage medium storing a computer program, and when the computer program is executed, each step that can be performed by the electronic device in the above method embodiment can be implemented. Among them, the computer-readable storage medium includes volatile or non-volatile or a combination thereof, and can be removable or non-removable. Examples of computer-readable storage media include, but are not limited to, phase-change random access memory (Phase-change Random Access Memory, PRAM), static random access memory (SRAM), dynamic random access memory (Dynamic Random Access Memory, DRAM), other types of random access memory (Random-Access Memory, RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), flash memory or other memory technology, read-only compact disc read-only memory (CD-ROM), digital versatile disc (Digital Video Disc, DVD) or other optical storage, magnetic cassette, tape disk storage or other magnetic storage device or any other non-transmission medium.

[0119] The present application embodiment also provides a computer program product, including: a computer program / instruction, which can implement the steps in the method provided in the present application embodiment when the computer program / instruction is executed by a processor. It should be understood that each process or a combination of multiple processes in the above method flow can be implemented by a computer program or instruction. In addition, these computer programs or instructions can be applied to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device, so that the processor of the general-purpose computer, the special-purpose computer, the embedded processor or other programmable data processing device can be implemented as a device for implementing the corresponding functions in the above method embodiment.

[0120] It should also be noted that the terms "comprises", "includes" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, product or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, product or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the presence of other identical elements in the process, method, product or device including the element.

[0121] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A domain name resolution method, characterized in that: include: The first domain name resolution node in the first computing cluster receives the domain name resolution request sent by the first computing node; If the first computing node belongs to a second computing cluster, obtaining a first isolation group corresponding to the first computing node in the first computing cluster according to a correspondence between computing nodes in the second computing cluster and isolation groups in the first computing cluster, the second computing cluster being different from the first computing cluster, and the correspondence between computing nodes in the second computing cluster and isolation groups in the first computing cluster being determined according to isolation dimensions of the first computing cluster and the second computing cluster; Parsing the domain name resolution request according to the domain name mapping relationship corresponding to the first isolation group to obtain a resolution result; The parsing result is returned to the first computing node.

2. The method according to claim 1, characterized in that Also includes: Obtaining configuration information of the isolation group in the second computing cluster, the configuration information including: a correspondence between the isolation group in the second computing cluster and the tenant and a correspondence between the isolation group in the second computing cluster and the computing nodes in the second computing cluster; According to the correspondence between the isolation groups in the second computing cluster and the tenants and the correspondence between the isolation groups in the first computing cluster and the tenants, the correspondence between the isolation groups in the second computing cluster and the computing nodes in the second computing cluster is converted into the correspondence between the computing nodes in the second computing cluster and the isolation groups in the first computing cluster.

3. The method according to claim 2, characterized in that According to the correspondence between the isolation groups in the second computing cluster and the tenants and the correspondence between the isolation groups in the first computing cluster and the tenants, converting the correspondence between the isolation groups in the second computing cluster and the computing nodes in the second computing cluster into the correspondence between the computing nodes in the second computing cluster and the isolation groups in the first computing cluster, including: For any isolation group in the second computing cluster, determine the target tenant corresponding to any isolation group in the second computing cluster according to the correspondence between the isolation groups in the second computing cluster and the tenants and the correspondence between the isolation groups in the first computing cluster and the tenants; and determine the target computing node corresponding to any isolation group in the second computing cluster according to the correspondence between the isolation groups in the second computing cluster and the computing nodes in the second computing cluster; Determine, in the isolation groups of the first computing cluster, a target isolation group corresponding to the target tenant; A correspondence between the target computing node and the target isolation group is established to convert the correspondence between the isolation group and the target computing node into a correspondence between the target computing node and the target isolation group.

4. The method according to claim 3, characterized in that The first computing cluster is divided into isolation groups according to views, and the second computing cluster is divided into isolation groups according to namespaces; or, the first computing cluster is divided into isolation groups according to namespaces, and the second computing cluster is divided into isolation groups according to views.

5. The method according to claim 2, characterized in that: Obtaining configuration information of the isolation group in the second computing cluster includes: The configuration information of the isolation group in the second computing cluster is obtained from the configuration center node, where the configuration information of the isolation group in the second computing cluster is uploaded to the configuration center node by the second domain name resolution node in the second computing cluster.

6. The method according to any one of claims 1 to 5, characterized in that: The domain name resolution request is resolved according to the domain name mapping relationship corresponding to the first isolation group to obtain a resolution result, including: Acquire, from the domain name mapping relationship corresponding to the first isolation group, a network address corresponding to the domain name to be resolved in the domain name request as the resolution result; Among them, the domain name mapping relationship corresponding to the first isolation group is obtained according to the domain name registered by the computing node in the first isolation group and the network address corresponding to the domain name, and the first isolation group and the isolation group to which the first computing node belongs in the second computing cluster belong to the same tenant.

7. The method according to any one of claims 1 to 5, characterized in that: Also includes: In response to an update operation of the isolation group in the first computing cluster, obtaining configuration information of a second isolation group updated in the first computing cluster, the configuration information of the second isolation group including a correspondence between the second isolation group and tenants and a correspondence between the second isolation group and computing nodes in the first computing cluster; Sending the configuration information of the second isolation group to a configuration center node, so that the configuration center node shares the configuration information of the second isolation group with a second domain name resolution node in the second computing cluster; Among them, the configuration information of the second isolation group is used to: enable the second domain name resolution node to determine the correspondence between the computing nodes in the second isolation group and the isolation groups in the second computing cluster according to the correspondence between the second isolation group and the tenant and the correspondence between the isolation groups in the second computing cluster and the tenant, so as to resolve the domain name resolution request of the computing nodes in the second isolation group according to the correspondence between the computing nodes in the second isolation group and the isolation groups in the second computing cluster.

8. A domain name resolution method, applied to a hybrid cloud computing system, wherein the hybrid cloud computing system comprises a first cloud computing cluster and a second cloud computing cluster, wherein: include: The first domain name resolution node in the first cloud computing cluster receives the domain name resolution request sent by the first computing node; If the first computing node belongs to a second cloud computing cluster, obtaining a first isolation group corresponding to the first computing node in the first cloud computing cluster according to a correspondence between computing nodes in the second cloud computing cluster and isolation groups in the first cloud computing cluster, the second cloud computing cluster being different from the first cloud computing cluster, and the correspondence between computing nodes in the second cloud computing cluster and isolation groups in the first cloud computing cluster being determined according to isolation dimensions of the first cloud computing cluster and the second cloud computing cluster; Parsing the domain name resolution request according to the domain name mapping relationship corresponding to the first isolation group to obtain a resolution result; The parsing result is returned to the first computing node.

9. The method according to claim 8, characterized in that The first cloud computing cluster is a computing cluster corresponding to a public cloud, and the second cloud computing cluster is a computing cluster corresponding to a private cloud; or, the first cloud computing cluster is a computing cluster corresponding to a private cloud, and the second cloud computing cluster is a computing cluster corresponding to a public cloud.

10. An electronic device, characterized in that: include: communications components, memory, and processors; The memory is used to store one or more computer instructions; The processor is used to execute the one or more computer instructions to: utilize the communication method provided by the communication component to perform the steps in the method described in any one of claims 1-9.

11. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps in the method described in any one of claims 1 to 9 can be implemented.

12. A computer program product, characterized in that include: A computer program / instruction, which, when executed by a processor, can implement the steps of the method according to any one of claims 1 to 9.

Images