Domain Name Resolution Method, Device, Storage Medium and Program Product

Abstract

An embodiment of the present application provides a domain name resolution method, device, storage medium, and program product. In the domain name resolution method, when a domain name resolution node in a first computing cluster receives a domain name resolution request from a computing node in a second computing cluster, it can determine the isolation group corresponding to the computing node in the first computing cluster based on the correspondence between the isolation groups in the first computing cluster and the computing nodes in the second computing cluster, and resolve the domain name resolution request of the computing node based on the domain name mapping relationship corresponding to the isolation group, thereby realizing cross-cluster and isolated domain name resolution. Among them, the correspondence between the isolation groups in the first computing cluster and the computing nodes in the second computing cluster is determined based on the isolation dimension between the first computing cluster and the second computing cluster. Therefore, there is an inherent connection between the isolation groups in the first computing cluster and the isolation groups in the second computing cluster, which is conducive to realizing a cross-cluster and isolated-consistent domain name resolution scheme.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular, to a domain name resolution method, device, storage medium, and program product. Background Art

[0002] A cloud computing platform is a unified and operable system that can integrate hardware resources (such as network infrastructure, servers, and storage devices) and software resources (such as application programs and services). In a cloud computing platform, the Domain Name System (DNS) plays a crucial role. The domain name system can not only help users access cloud services through easy-to-remember domain names, but also support the decoupling of Internet Protocol (IP) addresses when network access occurs between cloud services or between cloud products and external resources.

[0003] In some application scenarios of cloud computing, the domain name resolution system in a cloud computing cluster can provide isolated domain name services to different tenants in the cluster to reduce the mutual influence between tenants. However, for different cloud computing clusters, it is not possible to provide isolated domain name resolution services well in the case of cross-clusters. Therefore, there is a need to propose a new solution. Summary of the Invention

[0004] Multiple aspects of this application provide a domain name resolution method, device, storage medium, and program product for providing isolated domain name resolution services in the case of cross-cloud computing clusters.

[0005] An embodiment of this application provides a domain name resolution method, including: a first domain name resolution node in a first computing cluster receives a domain name resolution request sent by a first computing node; if the first computing node belongs to a second computing cluster, then according to the correspondence between the computing nodes in the second computing cluster and the isolation groups in the first computing cluster, obtain the first isolation group corresponding to the first computing node in the first computing cluster, the second computing cluster is different from the first computing cluster, and the correspondence between the computing nodes in the second computing cluster and the isolation groups in the first computing cluster is determined according to the isolation dimension between the first computing cluster and the second computing cluster; resolve the domain name resolution request according to the domain name mapping relationship corresponding to the first isolation group to obtain a resolution result; and return the resolution result to the first computing node.

[0006] Optionally, it further includes: obtaining the configuration information of the isolation groups in the second computing cluster, where the configuration information includes the correspondence between the isolation groups in the second computing cluster and the tenants, and the correspondence between the isolation groups in the second computing cluster and the computing nodes in the second computing cluster; according to the correspondence between the isolation groups in the second computing cluster and the tenants and the correspondence between the isolation groups in the first computing cluster and the tenants, converting the correspondence between the isolation groups in the second computing cluster and the computing nodes in the second computing cluster into the correspondence between the computing nodes in the second computing cluster and the isolation groups in the first computing cluster.

[0007] Optionally, according to the correspondence between the isolation groups in the second computing cluster and the tenants and the correspondence between the isolation groups in the first computing cluster and the tenants, converting the correspondence between the isolation groups in the second computing cluster and the computing nodes in the second computing cluster into the correspondence between the computing nodes in the second computing cluster and the isolation groups in the first computing cluster includes: for any isolation group in the isolation groups in the second computing cluster, determining the target tenant corresponding to the any isolation group in the second computing cluster according to the correspondence between the isolation groups in the second computing cluster and the tenants and the correspondence between the isolation groups in the first computing cluster and the tenants; and, determining the target computing node corresponding to the any isolation group in the second computing cluster according to the correspondence between the isolation groups in the second computing cluster and the computing nodes in the second computing cluster; determining the target isolation group corresponding to the target tenant in the isolation groups of the first computing cluster; establishing the correspondence between the target computing node and the target isolation group to convert the correspondence between the isolation group and the target computing node into the correspondence between the target computing node and the target isolation group.

[0008] Optionally, the first computing cluster divides the isolation groups according to views, and the second computing cluster divides the isolation groups according to namespaces; or, the first computing cluster divides the isolation groups according to namespaces, and the second computing cluster divides the isolation groups according to views.

[0009] Optionally, obtaining the configuration information of the isolation groups in the second computing cluster includes: obtaining the configuration information of the isolation groups in the second computing cluster from the configuration center node, and the configuration information of the isolation groups in the second computing cluster is uploaded to the configuration center node by the second domain name resolution node in the second computing cluster.

[0010] Optionally, according to the domain name mapping relationship corresponding to the first isolation group, resolve the domain name resolution request to obtain a resolution result, including: obtaining the network address corresponding to the domain name to be resolved in the domain name request from the domain name mapping relationship corresponding to the first isolation group as the resolution result; wherein, the domain name mapping relationship corresponding to the first isolation group is obtained according to the domain names registered by the computing nodes in the first isolation group and the network addresses corresponding to the domain names, and the first isolation group and the isolation group to which the first computing node belongs in the second computing cluster belong to the same tenant.

[0011] Optionally, it further includes: responding to the update operation of the isolation group in the first computing cluster, obtaining the configuration information of the updated second isolation group in the first computing cluster, where the configuration information of the second isolation group includes the corresponding relationship between the second isolation group and the tenant and the corresponding relationship with the computing nodes in the first computing cluster; sending the configuration information of the second isolation group to the configuration center node, so that the configuration center node shares the configuration information of the second isolation group with the second domain name resolution node in the second computing cluster; wherein, the configuration information of the second isolation group is used to: enable the second domain name resolution node to determine the corresponding relationship between the computing nodes in the second isolation group and the isolation groups in the second computing cluster according to the corresponding relationship between the second isolation group and the tenant and the corresponding relationship between the isolation groups in the second computing cluster and the tenant, so as to resolve the domain name resolution requests of the computing nodes in the second isolation group according to the corresponding relationship between the computing nodes in the second isolation group and the isolation groups in the second computing cluster.

[0012] An embodiment of the present application further provides a domain name resolution method, which is applied to a hybrid cloud computing system. The hybrid cloud computing system includes a first cloud computing cluster and a second cloud computing cluster. The method includes: a first domain name resolution node in the first cloud computing cluster receives a domain name resolution request sent by a first computing node; if the first computing node belongs to the second cloud computing cluster, obtain the first isolation group corresponding to the first computing node in the first cloud computing cluster according to the corresponding relationship between the computing nodes in the second cloud computing cluster and the isolation groups in the first cloud computing cluster. The second cloud computing cluster and the first cloud computing cluster are different, and the corresponding relationship between the computing nodes in the second cloud computing cluster and the isolation groups in the first cloud computing cluster is determined according to the isolation dimension of the first cloud computing cluster and the second cloud computing cluster; resolve the domain name resolution request according to the domain name mapping relationship corresponding to the first isolation group to obtain a resolution result; return the resolution result to the first computing node.

[0013] Optionally, the first cloud computing cluster is a computing cluster corresponding to a public cloud, and the second cloud computing cluster is a computing cluster corresponding to a private cloud; or, the first cloud computing cluster is a computing cluster corresponding to a private cloud, and the second cloud computing cluster is a computing cluster corresponding to a public cloud. An embodiment of this application further provides an electronic device, including: a communication component, a memory, and a processor; the memory is used to store one or more computer instructions; the processor is used to execute the one or more computer instructions to: use the communication method provided by the communication component to execute the steps in the method provided by the embodiment of this application.

[0014] An embodiment of this application further provides a computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, it can implement the steps in the method provided by the embodiment of this application.

[0015] An embodiment of this application further provides a computer program product, including: a computer program / instructions, and when the computer program / instructions are executed by a processor, it can implement the steps in the method provided by the embodiment of this application.

[0016] In an embodiment of this application, when the domain name resolution node in the first computing cluster receives a domain name resolution request from a computing node in the second computing cluster, it can determine the isolation group corresponding to the computing node in the first computing cluster based on the correspondence between the isolation groups in the first computing cluster and the computing nodes in the second computing cluster, and resolve the domain name resolution request of the computing node based on the domain name mapping relationship corresponding to the isolation group, thereby implementing cross-cluster and isolated domain name resolution. Among them, the correspondence between the isolation groups in the first computing cluster and the computing nodes in the second computing cluster is determined based on the isolation dimension between the first computing cluster and the second computing cluster. Therefore, there is an internal connection between the isolation groups in the first computing cluster and the isolation groups in the second computing cluster, which is conducive to ensuring the isolation consistency of the domain name resolution service across clusters to a certain extent and reducing the potential security risks existing in the cross-cluster domain name resolution service on the premise of implementing a cross-cluster and isolated domain name resolution solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of this application, and constitute a part of this application. The illustrative embodiments and descriptions of this application are used to explain this application, and do not constitute an improper limitation to this application. In the drawings:

[0018] Figure 1 It is a schematic structural diagram of a multi-cluster computing system provided by an exemplary embodiment of this application;

[0019] Figure 2 It is a schematic flowchart of a domain name resolution method provided by an exemplary embodiment of this application;

[0020] Figure 3 A schematic diagram of the structure of a multi-cluster computing system and a domain name resolution method provided by an exemplary embodiment of the present application;

[0021] Figure 4 A schematic diagram of the structure of an electronic device provided by an exemplary embodiment of the present application. Detailed implementation manners

[0022] To make the objectives, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be clearly and completely described below in conjunction with specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only a part rather than all of the embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present application without making creative efforts shall fall within the scope of protection of the present application.

[0023] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The singular forms "a", "the" and "said" used in the embodiments of the present invention and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. "Multiple" generally includes at least two, but does not exclude the case of including at least one.

[0024] It should be understood that the term "and / or" used herein is only a kind of association relationship describing associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " herein generally represents an "or" relationship between the associated objects before and after.

[0025] It should also be noted that the terms "comprising", "including" or any other variants thereof are intended to cover non-exclusive inclusion, so that a product or system including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or further includes elements inherent to such a product or system. Without further limitation, the element defined by the statement "including one..." does not exclude the existence of another identical element in the product or system including the said element.

[0026] In some application scenarios of cloud computing, the DNS resolution system in a cloud computing cluster can provide mutually isolated DNS services to different tenants in the same cluster to reduce the mutual influence between tenants.

[0027] In some isolation solutions, a cloud computing cluster can provide services for different tenants by defining different views, and the domain name mapping relationships corresponding to different views are different. Among them, different views can be used to isolate different tenants. For example, different tenants can be divided into different views according to principles such as geographical location, internal access, and external access. When the cloud computing cluster processes the domain name resolution requests of tenants, it can return different domain name resolution results to users in different views. For example, when tenants in two different views query the same domain name, the cloud computing cluster can query different domain name mapping relationships according to the views to which different tenants belong, so as to obtain different resolution results for the same domain name. In other isolation solutions, the cloud computing cluster can allocate an independent namespace for each tenant to ensure that domain names registered by different tenants do not conflict.

[0028] In some scenarios of hybrid clouds, the cloud computing cluster cannot provide well-isolated DNS resolution services for tenants across clusters. For example, assume that computing nodes in isolation group C1 and computing nodes in isolation group C2 in cloud computing cluster K1 register the same domain name A, and the network addresses of the domain names registered by different computing nodes are different. The domain name resolution node in cloud computing cluster K2 can accurately resolve the domain name resolution requests initiated by computing nodes in isolation group C1 and isolation group C2 for domain name A to different network addresses based on the corresponding relationships between computing nodes and isolation groups within the cluster. When computing nodes in isolation group C3 and computing nodes in isolation group C4 in cloud computing cluster K2 register the same domain name B, the domain name resolution node in cloud computing cluster K2 can accurately resolve the domain name resolution requests initiated by computing nodes in isolation group C3 and isolation group C4 for domain name B to the corresponding network addresses. However, in the scenario of hybrid clouds, the configuration information of isolation groups is not synchronized among different cloud computing clusters, resulting in the cloud computing cluster K1 being unable to accurately return the resolution result when receiving the resolution request for domain name A from a computing node in cloud computing cluster K2. Correspondingly, the cloud computing cluster K2 is also unable to accurately return the resolution result when receiving the resolution request for domain name B from a computing node in cloud computing cluster K1, thus resulting in the inability to accurately provide isolation-consistent domain name resolution services across clusters.

[0029] To address the above technical problems, in some embodiments of this application, a solution is provided. The core idea is to establish the corresponding relationship between isolation groups in any computing cluster and computing nodes in another computing cluster based on the isolation dimensions of different computing clusters, so as to achieve cross-computing cluster and isolation-consistent domain name resolution services.

[0030] The following will detail the technical solutions provided by each embodiment of this application with reference to the accompanying drawings.

[0031] Figure 1FIG. 1 is a schematic diagram of a multi-cluster computing system provided by an exemplary embodiment of the present application. Figure 1 As shown, the multi-cluster computing system 100 includes at least a first computing cluster 10 and a second computing cluster 20. The first computing cluster 10 includes a first domain name resolution node 101 and multiple computing nodes 102, while the second computing cluster 20 includes a second domain name resolution node 201 and multiple computing nodes 202. Domain name resolution nodes provide domain name registration and resolution services to computing nodes. Each domain name resolution node can store the correspondence between isolation groups and tenants in its cluster to provide isolated domain name resolution services to tenants in that cluster. Each domain name resolution node can include one or more components related to domain name resolution. For example, a domain name resolution node may include a domain name resolution proxy component and a domain name resolution core component. The domain name resolution core component performs core domain name resolution functions, while the domain name resolution proxy component assists in identifying domain name resolution requests or identifying the source information of the computing node initiating the domain name resolution request. A computing node is a basic unit in a cluster architecture that performs data processing and computing tasks. A computing node typically has independent computing resources, such as a central processing unit (CPU), memory, and storage space, and can perform assigned computing tasks or portions of tasks. In different cloud computing clusters, computing nodes can be physical servers, virtual machines, or container units (PODs), etc., and this embodiment does not impose any restrictions. For example, in some embodiments, the computing nodes in the first computing cluster 10 can be virtual machines or physical machines, and the computing nodes in the second computing cluster 20 can be container units. In other embodiments, the computing nodes in the first computing cluster 10 can be virtual machines or physical machines, and the computing nodes in the second computing cluster 20 can be container units, and this embodiment does not impose any restrictions.

[0032] In some multi-cluster computing scenarios, the first computing cluster 10 may be an on-cloud cluster, and the second computing cluster 20 may be an off-cloud cluster, such as Figure 1 As shown. It should be understood that in other multi-cluster computing scenarios, the first computing cluster 10 can be an off-cloud cluster, and the second computing cluster 20 can be an on-cloud cluster, which is not shown in the figure. Of course, in other multi-cluster computing scenarios, both the first computing cluster 10 and the second computing cluster 20 can be implemented as on-cloud clusters, or both can be implemented as off-cloud clusters. Optionally, the multi-cluster computing scenario can be implemented as a hybrid cloud scenario or a distributed computing scenario, which is not limited in this embodiment.

[0033] The first computing cluster 10 and the second computing cluster 20 respectively adopt their respective applicable isolation mechanisms to isolate the computing nodes within the cluster according to the set isolation dimensions. For example, the first computing cluster 10 can define different views according to the view isolation mechanism, and divide different computing nodes into different views according to the set isolation dimensions. The correspondence between the domain names and network addresses registered by the computing nodes in different views can be saved as the domain name mapping relationship corresponding to the view at the first domain name resolution node 101. When the first domain name resolution node 101 receives a domain name resolution request from different computing nodes in the first computing cluster 10, it can query different domain name mapping relationships according to the views to which the different computing nodes belong, and return different domain name resolution results. Another example is that the second computing cluster 20 can create different namespaces according to the isolation mechanism of the set namespace. The correspondence between the domain names and network addresses registered by the computing nodes in different namespaces can be saved as the domain name mapping relationship corresponding to the namespace at the second domain name resolution node 201. When the second domain name resolution node 201 receives a domain name resolution request from different computing nodes in the second computing cluster 20, it can query different domain name mapping relationships according to the namespaces to which the different computing nodes belong, and return different domain name resolution results. Of course, in some other embodiments, the first computing cluster 10 can use the namespace method to divide isolation groups, and the second computing cluster 20 can use the view method to divide isolation groups, which will not be described separately.

[0034] Among them, the isolation dimension of the computing node refers to the attribute dimension used for dividing and managing the computing node. Optionally, the isolation attributes of the computing node may include but are not limited to: the tenant to which the computing node belongs, the network environment corresponding to the computing node, the application type deployed on the computing node, or the data permissions corresponding to the computing node, etc. Hereinafter, an example will be mainly given by taking the tenant to which the computing node belongs. Figure 1 Illustrates the situation of dividing computing nodes by the tenant to which the computing nodes belong. As Figure 1 shown, the first computing cluster 10 can divide the computing nodes belonging to tenant 1 into the isolation group C1, and divide the computing nodes belonging to tenant 2 into the isolation group C2. The second computing cluster 20 can divide the computing nodes belonging to tenant 1 into the isolation group C3, and divide the computing nodes belonging to tenant 2 into the isolation group C4.

[0035] Among them, the first domain name resolution node 101 can share the configuration information of different isolation groups with the second domain name resolution node 201. The configuration information of the isolation group can include the tenant to which the isolation group belongs and the identifiers of the computing nodes included in the isolation group, so that the second domain name resolution node 201 can initiate a domain name resolution request for the computing nodes in the first computing cluster 10 according to the isolation group to which the computing nodes in the first computing cluster 10 belong and the tenant to which the isolation group belongs, and resolve it according to the resolution principle of tenant-side isolation. Correspondingly, the second domain name resolution node 201 can share the configuration information corresponding to different isolation groups with the first domain name resolution node 101. The configuration information of the isolation group can include the tenant to which the isolation group belongs and the identifiers of the computing nodes included in the isolation group, so that the first domain name resolution node 101 can initiate a domain name resolution request for the computing nodes in the second computing cluster 20 according to the isolation group to which the computing nodes in the second computing cluster 20 belong and the tenant to which the isolation group belongs, and resolve it according to the resolution principle of tenant-side isolation.

[0036] Taking Figure 1 the schematic isolation group division situation as an example, the first computing cluster 10 includes isolation group C1 and isolation group C2. Isolation group C1 belongs to tenant 1, and isolation group C2 belongs to tenant 2. Assume that the first computing node is included in isolation group C1, and the first computing node has registered domain name A in the first domain name resolution node 101, and the corresponding IP address is IP-A1; the first domain name resolution node 101 can share the corresponding relationship between isolation group C1, tenant 1, and the identifier of the first computing node as the configuration information of isolation group C1 with the second domain name resolution node 201, and save the corresponding relationship between domain name A and IP-A1 as the domain name mapping relationship corresponding to isolation group C1 locally in the first domain name resolution node 101. Assume that the second computing node is included in isolation group C2 in the first computing cluster 10, and the second computing node has registered domain name A in the first domain name resolution node 101, and the corresponding IP address is IP-A2. The first domain name resolution node 101 can share the corresponding relationship between isolation group C2, tenant 2, and the identifier of the second computing node as the configuration information of isolation group C2 with the second domain name resolution node 201, and save the corresponding relationship between domain name A and IP-A2 as the domain name mapping relationship corresponding to isolation group C2 locally in the first domain name resolution node 101.

[0037] Taking Figure 1Taking the schematic isolation group division as an example, the second computing cluster 20 includes an isolation group C3 and an isolation group C4. The isolation group C3 belongs to tenant 1, and the isolation group C4 belongs to tenant 2. The third computing node in the isolation group C3 of the second computing cluster 20 registers the domain name B in the second domain name resolution node 201, and the corresponding IP address is IP-B1. The second domain name resolution node 201 can share the domain name B correspondence relationship of the isolation group C3, tenant 1, and the third computing node identifier as the configuration information of the isolation group C3 with the first domain name resolution node 101, and save the correspondence relationship between the domain name B and IP-B1 as the domain name mapping relationship corresponding to the isolation group C3 locally in the second domain name resolution node 201. Suppose the fourth computing node in the isolation group C4 of the second computing cluster 20 registers the domain name B in the second domain name resolution node 201, and the corresponding IP address is IP-B2. The second domain name resolution node 201 can share the domain name B correspondence relationship of the isolation group C4, tenant 2, and the fourth computing node identifier as the configuration information of the isolation group C4 with the first domain name resolution node 101, and save the correspondence relationship between the domain name B and IP-B2 as the domain name mapping relationship corresponding to the isolation group C4 locally in the second domain name resolution node 201.

[0038] When the first computing node in the isolation group C1 requests the first domain name resolution node 101 to resolve the domain name B, the first domain name resolution node 101 does not have the domain name mapping relationship corresponding to the domain name B. The first computing node can send a domain name resolution request to the second domain name resolution node 201. The second domain name resolution node 201 can determine that the first computing node belongs to tenant 1 according to the configuration information of the isolation group C1, determine the isolation group C3 corresponding to tenant 1 on the second computing cluster 20, and return the IP address IP-B1 of the domain name B in the isolation group C3 as the resolution result to the first computing node.

[0039] When the second computing node in the isolation group C1 requests the first domain name resolution node 101 to resolve the domain name B, the first domain name resolution node 101 does not have the domain name mapping relationship corresponding to the domain name B. The second computing node can send a domain name resolution request to the second domain name resolution node 201. The second domain name resolution node 201 can determine that the second computing node belongs to tenant 2 according to the configuration information of the isolation group C2, determine the isolation group C4 corresponding to tenant 2 on the second computing cluster 20, and return the IP address IP-B2 of the domain name B in the isolation group C4 as the resolution result to the first computing node.

[0040] When the third computing node in isolation group C3 requests the second domain name resolution node 201 to resolve the domain name A, and the second domain name resolution node 201 does not have a domain name mapping relationship corresponding to the domain name A, the third computing node can send a domain name resolution request to the first domain name resolution node 101. The first domain name resolution node 101 can determine that the third computing node belongs to tenant 1 according to the configuration information of isolation group C3, determine the isolation group C1 corresponding to tenant 1 on the first computing cluster 10, and return the IP address IP-A1 of the domain name A in isolation group C1 to the third computing node as the resolution result.

[0041] When the fourth computing node in isolation group C4 requests the second domain name resolution node 201 to resolve the domain name A, and the second domain name resolution node 201 does not have a domain name mapping relationship corresponding to the domain name A, the fourth computing node can send a domain name resolution request to the first domain name resolution node 101. The first domain name resolution node 101 can determine that the fourth computing node belongs to tenant 2 according to the configuration information of isolation group C4, determine the isolation group C2 corresponding to tenant 2 on the first computing cluster 10, and return the IP address IP-A2 of the domain name A in isolation group C2 to the fourth computing node as the resolution result.

[0042] Based on the above method, for the first computing cluster 10 and the second computing cluster 20, not only can the domain name resolution requests of the computing nodes in the same cluster be processed, but also the domain name resolution requests of the computing nodes in other clusters can be processed according to the information of the tenants to which the computing nodes in other clusters belong. Based on this method, in the case of cross-cluster, the domain name resolution nodes in multiple different clusters can cooperate to perform domain name resolution according to the isolation groups corresponding to the tenants, realizing the tenant-side isolation of the domain name resolution service in the case of cross-cluster.

[0043] Hereinafter, taking the first domain name resolution node 101 in the first computing cluster 10 of the multi-cluster computing system 100 as an example, the domain name resolution method provided by the embodiments of the present application will be illustrated by an example diagram. It should be understood that the domain name resolution method described below can also be executed by the second domain name resolution node 201 in the second computing cluster 20.

[0044] As Figure 2 shown, when the domain name resolution method is executed by the first domain name resolution node 101, it mainly includes the following steps:

[0045] Step 201: The first domain name resolution node in the first computing cluster receives a domain name resolution request sent by the first computing node.

[0046] Step 202: If the first computing node belongs to the second computing cluster, obtain the first isolation group corresponding to the first computing node in the first computing cluster according to the correspondence between the computing nodes in the second computing cluster and the isolation groups in the first computing cluster. The second computing cluster is different from the first computing cluster, and the correspondence between the computing nodes in the second computing cluster and the isolation groups in the first computing cluster is determined according to the isolation dimensions of the first computing cluster and the second computing cluster.

[0047] Step 203: Parse the domain name resolution request according to the domain name mapping relationship corresponding to the first isolation group to obtain a parsing result.

[0048] Step 204: Return the parsing result to the first computing node.

[0049] The embodiments of the present application are applied in an application scenario of multi-cluster collaborative operations, such as a scenario of multi-cluster distributed jobs or a scenario of hybrid cloud. In the scenario of multi-clusters, multiple computing clusters are connected, capable of sharing resources, sharing workloads or jointly completing complex tasks. In the scenario of multi-clusters, secure network connections are established between multiple clusters. For example, in some distributed computing scenarios, multiple computing clusters can be connected through dedicated physical lines to achieve direct communication between different computing clusters. For example, in the scenario of hybrid cloud, a computing cluster corresponding to a private cloud and a computing cluster corresponding to a public cloud can establish a network connection through a virtual private network (VPN) to efficiently and securely transmit data between different clusters. The first domain name resolution node 101 can receive a domain name resolution request sent by the first computing node through the network connection between computing clusters or the network connection between different nodes within a cluster. Here, the first computing node refers to any computing node. The term "first" is used here to describe the computing node for the convenience of distinguishing it from other computing nodes described later, and does not limit the order of the computing nodes and the clusters to which they belong.

[0050] In step 202, the first domain name resolution node 101 can obtain the computing cluster to which the first computing node belongs. In some optional embodiments, the first domain name resolution node 101 can obtain the metadata of different clusters respectively. The metadata of any cluster is used to record the computing nodes included in the cluster and the identifiers of the computing nodes. After receiving the domain name resolution request of the first computing node, the first domain name resolution node 101 can obtain the identifier of the first computing node and query the metadata of different clusters according to the identifier of the first computing node. If the metadata of a certain computing cluster includes the identifier of the first computing node, then this computing cluster can be used as the computing cluster to which the first computing node belongs. Here, the identifier of any computing node can be the number or IP address of the computing node.

[0051] If the first computing node belongs to a second computing cluster 20 different from the first computing cluster 10, the domain name resolution request of the first computing node can be regarded as a cross-cluster domain name resolution request. In this case, the first domain name resolution node 101 can obtain the isolation group corresponding to the first computing node in the first computing cluster 10 according to the correspondence between the computing nodes in the second computing cluster 20 and the isolation groups in the first computing cluster 10, so as to perform domain name resolution based on the domain name mapping relationship corresponding to the isolation group. In this embodiment, for the convenience of description and to facilitate differentiation from other isolation groups in the follow-up, the isolation group corresponding to the first computing node in the first computing cluster 10 is described as the first isolation group, and the "first" here does not limit the order of the isolation groups.

[0052] Among them, the isolation group in any computing cluster refers to a group of computing nodes obtained by dividing different computing nodes in the computing cluster according to the isolation dimension of the computing nodes in the computing cluster. The isolation dimension of the computing node refers to the attribute dimension used for dividing and managing the computing nodes. Optionally, the isolation attributes of the computing nodes may include: the tenant to which the computing node belongs, the network environment corresponding to the computing node, the application type deployed on the computing node, the data permissions corresponding to the computing node, etc. This embodiment includes but is not limited to this.

[0053] The computing nodes included in different computing clusters are different. The computing nodes in the same computing cluster have a corresponding relationship with the isolation groups in this computing cluster, and this corresponding relationship can be stored in the domain name resolution node in this computing cluster. For example, the isolation group C1 of the first computing cluster 10 corresponds to the computing node N1 it contains, and the isolation group C2 corresponds to the computing nodes N2 and N3 it contains. The above corresponding relationship is stored in the first domain name resolution node 101. Another example is that the isolation group C3 of the second computing cluster 20 corresponds to the computing nodes N4 and N5 it contains, and the isolation group C4 corresponds to the computing nodes N6 and N7 it contains. The above corresponding relationship is stored in the second domain name resolution node 201.

[0054] The domain name resolution nodes in any computing cluster store the domain name mapping relationships corresponding to the isolation groups in this computing cluster, so as to provide isolated domain name resolution services to the computing nodes in this computing cluster based on these domain name mapping relationships. In the case of cross-cluster, in order to enable the domain name resolution nodes in any computing cluster to provide isolated domain name resolution services to the computing nodes in the isolation groups in other computing clusters, the computing nodes in one computing cluster can be mapped to the isolation groups in another computing cluster, so as to obtain the corresponding relationship between the computing nodes in one computing cluster and the isolation groups in another computing cluster, thus facilitating the use of the domain name mapping relationships corresponding to the isolation groups in another computing cluster for domain name resolution. For example, the computing node N1 in the first computing cluster 10 can be mapped to the isolation group C3 in the second computing cluster 20, and the computing node N4 in the second computing cluster 20 can be mapped to the isolation group C1 in the first computing cluster 10. Furthermore, when the first domain name resolution node 101 receives a cross-cluster domain name resolution request sent by the computing node N4, it can resolve the domain name resolution request of the computing node N4 according to the domain name mapping relationship of the isolation group C1. Correspondingly, when the second domain name resolution node 201 receives a cross-cluster domain name resolution request sent by the computing node N1, it can resolve the domain name resolution request of the computing node N1 according to the domain name mapping relationship of the isolation group C3.

[0055] The corresponding relationship between the computing nodes in the second computing cluster 20 and the isolation groups in the first computing cluster 10 can be determined according to the corresponding relationship between the computing nodes in the second computing cluster 20 and the isolation groups in the second computing cluster 20 and the corresponding relationship between the isolation groups in the second computing cluster 20 and the isolation groups in the first computing cluster 10. The following will give an exemplary illustration.

[0056] In some optional embodiments, the first computing cluster 10 and the second computing cluster 20 may divide isolation groups according to application types, so that different types of applications in the computing clusters can have their own independent logical environments while sharing the physical resources in the computing clusters. The first domain name resolution node 101 may obtain the application types corresponding to the isolation groups in the second computing cluster 20 and the application types corresponding to the isolation groups in the first computing cluster 10, and use the isolation groups with the same application type in different computing clusters as isolation groups with corresponding relationships. For example, in the isolation groups of the first computing cluster 10, isolation group M1 is used to run instant messaging applications, and isolation group M2 is used to run game applications. For another example, in the isolation groups of the second computing cluster 20, isolation group M3 is used to run instant messaging applications, and isolation group M4 is used to run game applications. The first domain name resolution node 101 may determine that isolation group M1 and isolation group M3 have a corresponding relationship, and determine that isolation group M2 and isolation group M4 have a corresponding relationship. The first domain name resolution node 101 may map the computing nodes in one isolation group to another isolation group based on the corresponding relationship of the isolation groups. Based on this method, it is convenient to provide an application-side isolated domain name resolution service for different types of applications in the case of cross-cluster domain name resolution, so as to manage the access permissions of different applications to domain names at the network level and reduce potential security threats.

[0057] In some other optional embodiments, the first computing cluster 10 and the second computing cluster 20 divide isolation groups according to the tenant dimension, so that different tenants in the computing clusters can have their own independent logical environments while sharing the physical resources in the computing clusters. In this implementation, the isolation groups in any computing cluster have a corresponding relationship with the tenants, and this corresponding relationship is used to describe the tenant to which the isolation group belongs. For example, in the isolation groups of the first computing cluster 10, isolation group C1 corresponds to the first tenant to which it belongs, and isolation group C2 corresponds to the second tenant to which it belongs. For another example, in the isolation groups of the second computing cluster 20, isolation group C3 corresponds to the first tenant to which it belongs, and isolation group C4 corresponds to the second tenant to which it belongs.

[0058] The first domain name resolution node 101 can obtain the configuration information of the isolation groups in the second computing cluster 20. The configuration information includes: the correspondence between the isolation groups in the second computing cluster 20 and the tenants, and the correspondence between the isolation groups in the second computing cluster 20 and the computing nodes in the second computing cluster 20. The local storage of the first domain name resolution node 101 has the correspondence between the isolation groups in the first computing cluster 10 and the tenants. This correspondence can be sent by the first computing cluster 10 to the first domain name resolution node 101 after completing the tenant isolation configuration. The first domain name resolution node 101 can convert the correspondence between the isolation groups in the second computing cluster 20 and the computing nodes in the second computing cluster 20 into the correspondence between the computing nodes in the second computing cluster 20 and the isolation groups in the first computing cluster 10 according to the correspondence between the isolation groups in the second computing cluster 20 and the tenants and the correspondence between the isolation groups in the first computing cluster 10 and the tenants.

[0059] Based on this implementation, sharing the configuration information of the isolation groups in the second computing cluster 20 with the first domain name resolution node 101 in the first computing cluster 10 realizes the sharing of the configuration information of the isolation groups between different computing clusters, providing information support for the implementation of the cross-cluster and isolated domain name resolution scheme.

[0060] Optionally, the correspondence between the isolation groups corresponding to the same tenant in different clusters can be established according to the principle of the same tenant, and based on the correspondence of the isolation groups, the computing nodes in one isolation group can be mapped to another isolation group. Or, the correspondence between the isolation groups corresponding to the similar tenants in different clusters can be established according to the principle of similar tenants, and based on the correspondence of the isolation groups, the computing nodes in one isolation group can be mapped to another isolation group. Here, similar tenants means that the address locations of different tenants are close, the technical preferences are the same, the service requirements are similar, etc., which are not limited in this embodiment.

[0061] The following will take any isolation group in the isolation groups in the second computing cluster 20 and the principle of the same tenant as an example to exemplarily illustrate the optional implementation of the first domain name resolution node 101 converting the correspondence between the isolation groups in the second computing cluster 20 and the computing nodes in the second computing cluster 20 into the correspondence between the computing nodes in the second computing cluster 20 and the isolation groups in the first computing cluster 10.

[0062] Taking the same principle of tenants as an example, in the first computing cluster 10 and the second computing cluster 20, if any two isolation groups that do not belong to the same cluster correspond to the same tenant, it can be considered that these two isolation groups have a corresponding relationship, and the corresponding relationship between the computing nodes in one isolation group and the other isolation group can be established. Optionally, for any isolation group in the isolation groups of the second computing cluster 20, the first domain name resolution node 101 can determine the target tenant corresponding to the any isolation group in the second computing cluster according to the corresponding relationship between the isolation groups and tenants in the second computing cluster 20 and the corresponding relationship between the isolation groups and tenants in the first computing cluster 10, and can determine the target computing node corresponding to the any isolation group in the second computing cluster 20 according to the corresponding relationship between the isolation groups and the computing nodes in the second computing cluster 20. After determining the target tenant, the first domain name resolution node 101 can determine the target isolation group corresponding to the target tenant in the isolation groups of the first computing cluster 10, and establish the corresponding relationship between the target computing node and the target isolation group, so as to convert the corresponding relationship between the isolation group and the target computing node into the corresponding relationship between the target computing node and the target isolation group. For example, if the isolation group C1 of the first computing cluster 10 and the isolation group C3 of the second computing cluster 20 belong to the first tenant, the first domain name resolution node 101 can establish the corresponding relationship between the computing nodes in the isolation group C3 and the isolation group C1, and save the corresponding relationship locally for query.

[0063] Based on this implementation manner, the first domain name resolution node 101 can explore the internal connection between the isolation groups in the first computing cluster 10 and the isolation groups in the second computing cluster 20 according to the corresponding relationship between the tenants and the isolation groups in different computing clusters, and based on this internal connection, determine the corresponding relationship between the isolation groups in the first computing cluster 10 and the computing nodes in the second computing cluster 20. Furthermore, it is beneficial to implement a domain name resolution scheme with consistent tenant-side isolation in the case of cross-cluster domain name resolution, and reduce the potential security risks existing in the cross-cluster domain name resolution service.

[0064] The isolation mechanisms corresponding to the first computing cluster 10 and the second computing cluster 20 can be the same or different. Optionally, the first computing cluster 10 and the second computing cluster 20 divide the isolation groups according to views and namespaces respectively, or the first computing cluster 10 and the second computing cluster 20 divide the isolation groups according to views and namespaces respectively.

[0065] Optionally, if the first computing cluster 10 divides isolation groups according to views and the second computing cluster 20 divides isolation groups according to namespaces, the first domain name resolution node 101 can obtain the target tenant to which any namespace in the second computing cluster 20 belongs and the computing nodes in that namespace; determine the target view corresponding to the target tenant in the view of the first computing cluster 10, and map the computing nodes in that namespace to the target view, so as to convert the correspondence between the namespace and the computing nodes into the correspondence between the target view and the computing nodes.

[0066] Optionally, if the first computing cluster 10 divides isolation groups according to namespaces and the second computing cluster 20 divides isolation groups according to views, the first domain name resolution node 101 can obtain the target tenant to which any view in the second computing cluster 20 belongs and the computing nodes in that view; determine the target namespace corresponding to the target tenant in the namespace of the first computing cluster 10, and map the computing nodes in that view to the target namespace, so as to convert the correspondence between the view and the computing nodes into the correspondence between the target namespace and the computing nodes.

[0067] Based on this implementation, when the isolation mechanisms of the first computing cluster 10 and the second computing cluster 20 are different, by converting the configuration information of the isolation groups in the second computing cluster 20 according to the isolation mechanism of the first computing cluster 10, the configuration information of the isolation groups in the second computing cluster 20 can be converted into a format that the first domain name resolution node 101 can recognize, so as to facilitate the first domain name resolution node 101 to query the converted configuration information, thereby efficiently implementing a cross-cluster and isolated domain name resolution scheme.

[0068] In step 203, the first domain name resolution node 101 can resolve the domain name resolution request according to the domain name mapping relationship corresponding to the first isolation group, and obtain a resolution result. The domain name mapping relationship corresponding to the first isolation group is used to describe the correspondence between the domain names registered by the computing nodes included in the first isolation group and the network addresses. The first domain name resolution node 101 can query the network address corresponding to the domain name carried in the domain name resolution request in the domain name mapping relationship corresponding to the first isolation group as the resolution result.

[0069] Optionally, the domain name mapping relationship corresponding to the first isolation group is obtained according to the domain names registered by the computing nodes in the first isolation group and the network addresses corresponding to the domain names. The first isolation group and the isolation group to which the first computing node belongs in the second computing cluster 20 belong to the same tenant. That is to say, although the domain name resolution request of the first computing node is resolved across clusters, it can be ensured that the domain name resolution result is associated with the tenant corresponding to the first computing node, realizing a cross-cluster and tenant-side isolated domain name resolution scheme.

[0070] In step 204, after obtaining the resolution result corresponding to the domain name resolution request, the first domain name resolution node 101 can return the resolution result to the first computing node.

[0071] In this embodiment, when the domain name resolution node in the first computing cluster 10 receives a domain name resolution request from a computing node in the second computing cluster 20, it can determine the corresponding isolation group of the computing node in the first computing cluster 10 based on the correspondence between the isolation groups in the first computing cluster 10 and the computing nodes in the second computing cluster 20, and resolve the domain name resolution request of the computing node based on the domain name mapping relationship corresponding to the isolation group, thereby implementing cross-cluster and isolated domain name resolution. Among them, the correspondence between the isolation groups in the first computing cluster 10 and the computing nodes in the second computing cluster 20 is determined based on the isolation dimension between the first computing cluster 10 and the second computing cluster 20. Therefore, there is an internal connection between the isolation groups in the first computing cluster 10 and the isolation groups in the second computing cluster 20, which is beneficial to ensuring the isolation consistency of the domain name resolution service across clusters to a certain extent and reducing the potential security risks existing in the cross-cluster domain name resolution service on the premise of implementing a cross-cluster and isolated domain name resolution scheme.

[0072] In some optional embodiments, Figure 1 The multi-cluster computing system 100 shown may further include a configuration center node 30, which is used to centrally manage the configuration information of different clusters in the multi-cluster computing system 100. The configuration center node 30 can receive the configuration information of the isolation groups within the cluster sent by the domain name resolution node in any cluster and share the received configuration information of the isolation groups among multiple clusters.

[0073] Optionally, when the first domain name resolution node 101 obtains the configuration information of the isolation groups in the second computing cluster 20, it can obtain the configuration information of the isolation groups in the second computing cluster 20 from the configuration center node 30. Among them, the configuration information of the isolation groups in the second computing cluster 20 is uploaded to the configuration center node 30 by the second domain name resolution node 201 in the second computing cluster 20. In some optional embodiments, the configuration information of the isolation groups in the second computing cluster 20 can be uploaded to the configuration center node 30 by the second domain name resolution node according to a specific upload period, or can be uploaded to the configuration center node 30 each time the second domain name resolution node obtains new configuration information of the isolation groups within its own cluster. This embodiment does not make any restrictions.

[0074] Optionally, the first domain name resolution node 101 may periodically obtain the configuration information of the isolation groups in the second computing cluster 20 from the configuration center node 30. Alternatively, the first domain name resolution node 101 may actively obtain the configuration information of the isolation groups in the second computing cluster 20 from the configuration center node 30 each time it receives an update message sent by the configuration center node 30, and this update message may be sent by the configuration center node 30 each time it receives the configuration information uploaded by the second domain name resolution node. Furthermore, the first domain name resolution node can share the configuration information of the isolation groups of other clusters in real time, thereby improving the domain name resolution performance across clusters.

[0075] In some optional embodiments, in addition to obtaining the configuration information of the isolation groups of other computing clusters, the first domain name resolution node 101 may also share the configuration information of the isolation groups in its own computing cluster with other computing clusters, so that other computing clusters can provide cross-cluster and isolated domain name resolution services to the computing nodes in the computing cluster where the first domain name resolution node 101 is located.

[0076] Optionally, the first domain name resolution node 101 may respond to the update operation of the isolation groups in the first computing cluster 10, obtain the configuration information of the updated second isolation groups in the first computing cluster 10, and the configuration information of the second isolation groups may include the correspondence between the second isolation groups and the tenants and the correspondence between the second isolation groups and the computing nodes in the first computing cluster 10. The first domain name resolution node 101 may send the configuration information of the second isolation groups to the configuration center node 30, so that the configuration center node 30 can share the configuration information of the second isolation groups with the second domain name resolution node 201 in the second computing cluster 20. Among them, the configuration information of the second isolation groups is used to enable the second domain name resolution node 201 to determine the correspondence between the computing nodes in the second isolation groups and the isolation groups in the second computing cluster 20 according to the correspondence between the second isolation groups and the tenants and the correspondence between the isolation groups and the tenants in the second computing cluster 20, so as to resolve the domain name resolution requests of the computing nodes in the second isolation groups according to the correspondence between the computing nodes in the second isolation groups and the isolation groups in the second computing cluster 20.

[0077] In this implementation manner, when the isolation groups within the first domain name resolution node 101 are updated, the first domain name resolution node 101 actively shares the configuration information of the updated isolation groups within its own cluster with other clusters, which is convenient for synchronizing the division of isolation groups in different clusters in a timely manner in the case of cross-clusters, thereby improving the accuracy of the cross-cluster and isolated domain name resolution solution.

[0078] The following will be combined with the attached Figure 3 , to further exemplarily illustrate the domain name resolution method executed by the multi-cluster computing system provided in the embodiments of the present application. As Figure 3As shown in the figure, the multi-cluster computing system includes a first computing cluster 10, a second computing cluster 20, and a configuration center node 30. Among them, the computing nodes in the first computing cluster 10 can be container units (PODs), and the computing nodes in the second computing cluster 20 can be physical machines or virtual machines. Among them, the configuration center node 30 is used to record the correspondence between tenants and namespaces, the correspondence between tenants and views, the correspondence between views and IP segments, the correspondence between namespaces and IP segments, etc. As Figure 3 shown in the figure, when there are tenant 1 and tenant 2, the first namespace in the first computing cluster 10 and the first view in the second computing cluster 20 belong to tenant 1, and the correspondence between tenant 1, the first namespace, and the first view is stored as the first record in the configuration center node 30; the second namespace and the second view belong to tenant 2, and the correspondence between tenant 2, the second namespace, and the second view is stored as the second record in the configuration center node 30. Among them, the IP address of POD1 included in the first namespace is IP1, and the correspondence between POD1 and IP1 is stored as the third record in the configuration center node 30; the POD-IP included in the second namespace is IP2, and the correspondence between POD2 and IP2 is stored as the fourth record in the configuration center node 30. The IP of server 1 in the first view is IP3, and the correspondence between server 1 and IP3 is stored as the fifth record in the configuration center node 30; the IP of server 2 in the second view is IP4, and the correspondence between server 2 and IP4 is stored as the sixth record in the configuration center node 30.

[0079] As Figure 1 shown in the figure, the multi-cluster computing system 100 includes a first domain name resolution node 101, a DNS proxy server 103, and a second domain name resolution node 201. Among them, the DNS proxy server 103 is used to cooperate with the first domain name resolution node 101 to provide cross-cluster domain name resolution services. Among them, the access order of the domain name resolution nodes is configured in the DNS resolution configuration file (such as the file under the path / etc / resolve.conf) in each computing node. Among them, the PODs in the first computing cluster 10 preferentially request the first domain name resolution node 101 for domain name resolution. If the resolution fails, they request resolution from the second domain name resolution node 201; the second computing cluster 20 preferentially requests the second domain name resolution node 201 for resolution. If the resolution fails, it requests resolution from the DNS proxy server 103.

[0080] The following will further exemplarily illustrate the process of domain name resolution in combination with the Figure 3 system architecture provided in the appendix.

[0081] As Figure 3As shown, in Step 1, the DNS proxy server 103 in the first computing cluster 10 interacts with the configuration center node 30 to upload the configuration information of the namespace of the first computing cluster 10 to the configuration center node 30, forming the 3rd and 4th records. The DNS proxy server 103 can download the 1st and 2nd records in the configuration center node 30 to local to obtain the correspondence between the namespace in the first computing cluster 10, the views in the second computing cluster 20, and Tenant 1 and Tenant 2.

[0082] In Step 2, the second domain name resolution node 201 in the second computing cluster 20 interacts with the configuration center node 30 to upload the configuration information of the views in the second computing cluster 20 to the configuration center node 30, forming the 5th and 6th records in the configuration center node 30. The second domain name resolution node 201 can download the 1st and 2nd records in the configuration center node 30 to local to obtain the correspondence between the namespace in the first computing cluster 10, the views in the second computing cluster 20, and Tenant 1 and Tenant 2.

[0083] In addition, the DNS proxy server 103 can download the configuration information of the views of the second computing cluster 20 stored in the configuration center node 30, that is, the 5th and 6th records in the configuration center node 30, to local. The second domain name resolution node 201 can download the configuration information of the namespace of the first computing cluster 10 stored in the configuration center node 30, that is, the 3rd and 4th records, to local and convert the downloaded 3rd and 4th records into the 5th and 6th records locally.

[0084] In Step 3, POD1 in the first namespace registers the domain name A with the first domain name resolution node 101, and its corresponding IP is IP-A1. The first domain name resolution node 101 records the mapping relationship between the domain name A and IP-A1 in the configuration information of the first namespace.

[0085] In Step 4, Server 1 in the first view registers the domain name B with the second domain name resolution node 201, and its corresponding IP is IP-B1. The second domain name resolution node 201 records it in the configuration information of the first view.

[0086] In Step 5, POD2 in the second namespace registers the domain name A with the first domain name resolution node 101, and its corresponding IP is IP-A2. The first domain name resolution node 101 can record the correspondence between the domain name A and IP-A2 in the configuration information of the second namespace. In this case, POD1 and POD2 register the domain name A, but the IPs corresponding to the domain names are different.

[0087] In step 6, server 2 in the second view registers domain name B with the second domain name resolution node 201, and its corresponding IP is IP-B2. The second domain name resolution node 201 can record the correspondence between domain name B and IP-B2 in the configuration information of the second view. In this case, both server 1 and server 2 register domain name B, but the IPs corresponding to the domain name are different.

[0088] In step 7, when POD1 requests to resolve the IP corresponding to domain name A, it preferentially sends a domain name resolution request to the first domain name resolution node 101. The first domain name resolution node 101 returns the IP address corresponding to domain name A in the first namespace according to the namespace to which POD1 belongs, that is, it returns IP-A1.

[0089] In step 8, when server 1 requests to resolve the IP corresponding to domain name B, it preferentially sends a domain name resolution request to the second domain name resolution node 201. The second domain name resolution node 201 returns the IP address corresponding to domain name B in the first view according to the view in which server 1 is located, that is, it returns IP-B1.

[0090] In step 9, when POD2 requests to resolve the IP corresponding to domain name A, it preferentially sends a domain name resolution request to the first domain name resolution node 101. The first domain name resolution node 101 can return the IP address corresponding to domain name A in the second namespace according to the namespace to which POD2 belongs, that is, it returns IP-A2. In steps 7 and 9, although the domain names requested to be resolved by POD1 and POD2 are the same, since POD1 and POD2 belong to different namespaces in the first computing cluster 10, the first domain name resolution node 101 can return different resolution results, achieving tenant-side isolated domain name resolution within the first computing cluster 10.

[0091] In step 10, when server 2 requests to resolve the IP corresponding to domain name B, it preferentially sends a domain name resolution request to the second domain name resolution node 201. The second domain name resolution node 201 can return the IP address corresponding to domain name B in the second view according to the view in which server 2 is located, that is, it returns IP-B2. In steps 8 and 10, although the domain names requested to be resolved by server 1 and server 2 are the same, since server 1 and server 2 belong to different servers in the second computing cluster 20, the second domain name resolution node 201 can return different resolution results, achieving tenant-side isolated domain name resolution within the second computing cluster 20.

[0092] In step 11, when POD1 requests to resolve domain name B in the second computing cluster 20, it preferentially sends a domain name resolution request to the first domain name resolution node 101. Since the first domain name resolution node 101 does not store records related to domain name B, it returns a prompt message of "domain name information not found" to POD1.

[0093] In step 12, POD1 initiates a domain name resolution request to the second domain name resolution node 201 according to the configured access order. The second domain name resolution node 201 can determine that POD1 is in the first view based on the correspondence between the views obtained in step 2 and the IP addresses of the PODs (i.e., the 5th and 6th records in the local of the second domain name resolution node 201). The second domain name resolution node 201 can return the IP address corresponding to domain name B, i.e., IP-B1, according to the domain name mapping relationship in the first view (i.e., the 1st record in the local of the second domain name resolution node 201).

[0094] Similarly, when POD2 requests to resolve domain name B, the second domain name resolution node 201 can return the IP address corresponding to domain name B, i.e., IP-B2, according to the domain name mapping relationship in the second view (i.e., the 2nd record in the local of the second domain name resolution node 201). Based on this, for tenant 1 to which POD1 belongs and tenant 2 to which POD2 belongs, in the case of cross-cluster, the second domain name resolution node 201 provides different resolution results for the same domain name, that is, a tenant-side DNS isolation scheme for different clusters to cooperate is realized.

[0095] In step 13, when server 1 requests to resolve domain name A in the first computing cluster 10, it preferentially initiates a domain name resolution request to the second domain name resolution node 201. The second domain name resolution node 201 does not store the mapping relationship corresponding to domain name A. The second domain name resolution node 201 can return a prompt message of "domain name information not found" to server 1.

[0096] In step 14, server 1 continues to initiate a domain name resolution request to the DNS proxy server 103 according to the configured access order. The DNS proxy server 103 knows from the configuration information of the view in the second computing cluster 20 obtained from the configuration center node 30 (i.e., the 5th record of the configuration center node �) that server 1 belongs to the first view, and according to the 1st record in the configuration center node 30, the first view and the first namespace belong to the same tenant. The DNS proxy server 103 can send a new domain name resolution request to the first domain name resolution node 101 according to this domain name resolution. The new domain name resolution request is used to apply for resolving the IP address of domain name A in the first namespace.

[0097] In step 15, the first domain name resolution node 101 queries the domain name mapping relationship in the first namespace and returns the IP address corresponding to domain name A in the first namespace, that is, returns IP-A1 to server 1 to complete the domain name resolution.

[0098] Similarly, when server 2 requests to resolve domain name A, the first domain name resolution node 101 can return IP-A2, and thus a tenant-side DNS isolation scheme for different clusters to cooperate is realized.

[0099] Figure 1 The schematic multi - cluster computing system can be a hybrid cloud computing system. That is, the domain name resolution method provided in the embodiments of the present application can be applied to the hybrid cloud computing system. Among them, the hybrid cloud computing system includes a first cloud computing cluster and a second cloud computing cluster. Optionally, the first cloud computing cluster is a computing cluster corresponding to the public cloud, and the second cloud computing cluster is a computing cluster corresponding to the private cloud; or, the first cloud computing cluster is a computing cluster corresponding to the private cloud, and the second cloud computing cluster is a computing cluster corresponding to the public cloud.

[0100] Among them, the first domain name resolution node in the first cloud computing cluster receives the domain name resolution request sent by the first computing node; if the first computing node belongs to the second cloud computing cluster, the first domain name resolution node can obtain the first isolation group corresponding to the first computing node in the first cloud computing cluster according to the correspondence between the computing nodes in the second cloud computing cluster and the isolation groups in the first cloud computing cluster. Among them, the second cloud computing cluster is different from the first cloud computing cluster, and the correspondence between the computing nodes in the second cloud computing cluster and the isolation groups in the first cloud computing cluster is determined according to the isolation dimension between the first cloud computing cluster and the second cloud computing cluster. The first domain name resolution node can resolve the domain name resolution request according to the domain name mapping relationship corresponding to the first isolation group, obtain the resolution result, and return the resolution result to the first computing node.

[0101] Based on this implementation, in the scenario of a hybrid cloud, when the domain name resolution node in the first cloud computing cluster receives the domain name resolution request of the computing node in the second cloud computing cluster, it can determine the isolation group corresponding to the computing node in the first cloud computing cluster based on the correspondence between the isolation groups in the first cloud computing cluster and the computing nodes in the second cloud computing cluster, and resolve the domain name resolution request of the computing node based on the domain name mapping relationship corresponding to the isolation group, realizing cross - cloud computing cluster and isolated domain name resolution. Among them, the correspondence between the isolation groups in the first cloud computing cluster and the computing nodes in the second cloud computing cluster is determined based on the isolation dimension between the first cloud computing cluster and the second cloud computing cluster. Therefore, there is an internal connection between the isolation groups in the first cloud computing cluster and the isolation groups in the second cloud computing cluster, which is conducive to realizing a cross - cloud computing cluster and isolated - consistent domain name resolution scheme. It should be noted that the execution subject of each step of the method provided in the above embodiments can be the same device, or the method can also be executed by different devices as the execution subject. For example, the execution subject of steps 301 to 304 can be device A; for another example, the execution subject of steps 301 and 302 can be device A, and the execution subject of step 303 can be device B; and so on.

[0102] In addition, in some of the processes described in the above embodiments and accompanying drawings, a number of operations appear in a specific order. However, it should be clearly understood that these operations may not be executed in the order in which they appear herein or may be executed in parallel. The serial numbers of the operations, such as 301, 302, etc., are only used to distinguish different operations, and the serial numbers themselves do not represent any order of execution. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions such as "first" and "second" in this article are used to distinguish different messages, devices, modules, etc., and do not represent a sequence, nor do they limit that "first" and "second" are of different types.

[0103] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. And the collection, use, and processing of relevant data need to comply with the relevant laws, regulations, and standards of relevant countries and regions, and corresponding operation entrances are provided for users to choose to authorize or refuse.

[0104] Figure 4 The schematic structural diagram of an electronic device provided by an exemplary embodiment of the present application is shown. The domain name resolution service corresponding to the first computing cluster in the multi-computing cluster system can run on this electronic device to serve as the first domain name resolution node in the first computing cluster.

[0105] As Figure 4 shown, the electronic device includes: a memory 401, a processor 402, and a communication component 403.

[0106] Among them, the memory 401 is used to store computer programs and can be configured to store various other data to support operations on the electronic device. Examples of these data include instructions for any application program or method for operating on the electronic device.

[0107] A processor 402, coupled to a memory 401, is configured to execute a computer program in the memory 401 for: receiving, via a communication component 403, a domain name resolution request sent by a first computing node; if the first computing node belongs to a second computing cluster, obtaining, according to the correspondence between computing nodes in the second computing cluster and isolation groups in the first computing cluster, a first isolation group corresponding to the first computing node in the first computing cluster, where the second computing cluster and the first computing cluster are different, and the correspondence between computing nodes in the second computing cluster and isolation groups in the first computing cluster is determined according to the isolation dimension between the first computing cluster and the second computing cluster; resolving the domain name resolution request according to the domain name mapping relationship corresponding to the first isolation group to obtain a resolution result; and returning the resolution result to the first computing node via the communication component 403.

[0108] Optionally, the processor 402 is further configured to: obtain configuration information of isolation groups in the second computing cluster, where the configuration information includes: the correspondence between isolation groups in the second computing cluster and tenants and the correspondence between isolation groups in the second computing cluster and computing nodes in the second computing cluster; and convert, according to the correspondence between isolation groups in the second computing cluster and tenants and the correspondence between isolation groups in the first computing cluster and tenants, the correspondence between isolation groups in the second computing cluster and computing nodes in the second computing cluster into the correspondence between computing nodes in the second computing cluster and isolation groups in the first computing cluster.

[0109] Optionally, when the processor 402 converts, according to the correspondence between isolation groups in the second computing cluster and tenants and the correspondence between isolation groups in the first computing cluster and tenants, the correspondence between isolation groups in the second computing cluster and computing nodes in the second computing cluster into the correspondence between computing nodes in the second computing cluster and isolation groups in the first computing cluster, it is specifically configured to: for any isolation group in the isolation groups in the second computing cluster, determine a target tenant corresponding to the any isolation group in the second computing cluster according to the correspondence between isolation groups in the second computing cluster and tenants and the correspondence between isolation groups in the first computing cluster and tenants; and determine a target computing node corresponding to the any isolation group in the second computing cluster according to the correspondence between isolation groups in the second computing cluster and computing nodes in the second computing cluster; determine a target isolation group corresponding to the target tenant in the isolation groups of the first computing cluster; and establish a correspondence between the target computing node and the target isolation group to convert the correspondence between the isolation group and the target computing node into the correspondence between the target computing node and the target isolation group.

[0110] Optionally, the first computing cluster divides isolation groups according to views, and the second computing cluster divides isolation groups according to namespaces; or, the first computing cluster divides isolation groups according to namespaces, and the second computing cluster divides isolation groups according to views.

[0111] Optionally, when obtaining the configuration information of the isolation groups in the second computing cluster, the processor 402 is specifically configured to: obtain the configuration information of the isolation groups in the second computing cluster from the configuration center node, and the configuration information of the isolation groups in the second computing cluster is uploaded to the configuration center node by the second domain name resolution nodes in the second computing cluster.

[0112] Optionally, when parsing the domain name resolution request according to the domain name mapping relationship corresponding to the first isolation group to obtain a parsing result, the processor 402 is specifically configured to: obtain the network address corresponding to the domain name to be resolved in the domain name request from the domain name mapping relationship corresponding to the first isolation group as the parsing result; wherein, the domain name mapping relationship corresponding to the first isolation group is obtained according to the domain names registered by the computing nodes in the first isolation group and the network addresses corresponding to the domain names, and the first isolation group and the isolation group to which the first computing node belongs in the second computing cluster belong to the same tenant.

[0113] Optionally, the processor 402 is further configured to: in response to the update operation of the isolation groups in the first computing cluster, obtain the configuration information of the updated second isolation groups in the first computing cluster, where the configuration information of the second isolation groups includes the corresponding relationship between the second isolation groups and tenants and the corresponding relationship with the computing nodes in the first computing cluster; send the configuration information of the second isolation groups to the configuration center node, so that the configuration center node shares the configuration information of the second isolation groups with the second domain name resolution nodes in the second computing cluster; wherein, the configuration information of the second isolation groups is used to: enable the second domain name resolution nodes to determine the corresponding relationship between the computing nodes in the second isolation groups and the isolation groups in the second computing cluster according to the corresponding relationship between the second isolation groups and tenants and the corresponding relationship between the isolation groups in the second computing cluster and tenants, so as to parse the domain name resolution requests of the computing nodes in the second isolation groups according to the corresponding relationship between the computing nodes in the second isolation groups and the isolation groups in the second computing cluster.

[0114] Figure 4The schematic electronic device can also be used to execute a domain name resolution method in the architecture of a hybrid cloud. Among them, a domain name resolution service corresponding to the first cloud computing cluster in the hybrid cloud architecture can run on the electronic device to serve as the first domain name resolution node in the first cloud computing cluster. Among them, the processor 402 is coupled to the memory 401 and is used to execute the computer program in the memory 401 for: receiving a domain name resolution request sent by the first computing node through the communication component 403; if the first computing node belongs to the second cloud computing cluster, obtaining the first isolation group corresponding to the first computing node in the first cloud computing cluster according to the correspondence between the computing nodes in the second cloud computing cluster and the isolation groups in the first cloud computing cluster, where the second cloud computing cluster and the first cloud computing cluster are different, and the correspondence between the computing nodes in the second cloud computing cluster and the isolation groups in the first cloud computing cluster is determined according to the isolation dimension between the first cloud computing cluster and the second cloud computing cluster; resolving the domain name resolution request according to the domain name mapping relationship corresponding to the first isolation group to obtain a resolution result; and returning the resolution result to the first computing node through the communication component 403.

[0115] Optionally, the first cloud computing cluster is a computing cluster corresponding to a public cloud, and the second cloud computing cluster is a computing cluster corresponding to a private cloud; or, the first cloud computing cluster is a computing cluster corresponding to a private cloud, and the second cloud computing cluster is a computing cluster corresponding to a public cloud.

[0116] Further, as Figure 4 shown, the electronic device further includes: a power supply component 404, a display component 405, an audio component 406, and other components. Figure 4 Only some components are schematically shown herein, and it does not mean that the electronic device only includes Figure 4 the components shown.

[0117] Among them, the memory 401 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, a magnetic disk, or an optical disc.

[0118] Among them, the communication component 403 is configured to facilitate communication between the device where the communication component is located and other devices in a wired or wireless manner. The device where the communication component is located can access a wireless network based on a communication standard, such as Wi-Fi (wireless network communication technology), 2G (such as Global System for Mobile Communications (GSM), etc.), 3G (such as Wideband Code Division Multiple Access (WCDMA)), 4G (such as Long Term Evolution (LTE), etc.), 4G+ (such as LTE-Advanced (LTE-A), etc.) or 5G (5th Generation Mobile Communication Technology), or a combination thereof. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component can be implemented based on Near Field Communication (NFC) technology, Radio Frequency Identification (RFID) technology, Infrared Data Association (IrDA) technology, Ultra Wide Band (UWB) technology, Bluetooth (BT) technology and other technologies.

[0119] Among them, the power supply component 404 is used to provide power for various components of the device where the power supply component is located. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the device where the power supply component is located.

[0120] The display component includes a screen, and the screen may include a Liquid Crystal Display (LCD) and a Touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touch screen to receive input signals from users. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors can not only sense the boundaries of touch or swipe actions, but also detect the duration and pressure associated with the touch or swipe operations.

[0121] An audio component that can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC). When the device where the audio component is located is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive external audio signals. The received audio signals can be further stored in a memory or transmitted via a communication component. In some embodiments, the audio component further includes a speaker for outputting audio signals.

[0122] In this embodiment, when the domain name resolution node in the first computing cluster receives a domain name resolution request from a computing node in the second computing cluster, it can determine the corresponding isolation group of the computing node in the first computing cluster based on the correspondence between the isolation groups in the first computing cluster and the computing nodes in the second computing cluster, and resolve the domain name resolution request of the computing node based on the domain name mapping relationship corresponding to the isolation group, thus achieving cross-cluster and isolated domain name resolution. Among them, the correspondence between the isolation groups in the first computing cluster and the computing nodes in the second computing cluster is determined based on the isolation dimension between the first computing cluster and the second computing cluster. Therefore, there is an inherent connection between the isolation groups in the first computing cluster and the isolation groups in the second computing cluster, which is beneficial to ensuring the isolation consistency of the domain name resolution service across clusters to a certain extent and reducing the potential security risks existing in the cross-cluster domain name resolution service on the premise of implementing a cross-cluster and isolated domain name resolution scheme.

[0123] Correspondingly, an embodiment of the present application further provides a computer-readable storage medium storing a computer program. When the computer program is executed, it can implement the steps executable by an electronic device in the above method embodiments. Among them, the computer-readable storage medium can be implemented by a volatile or non-volatile or a combination thereof, and can be removable or non-removable. Examples of computer-readable storage media include, but are not limited to, phase-change random access memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical storage, magnetic cassette tape, magnetic disk storage or other magnetic storage devices or any other non-transmission medium.

[0124] The embodiments of this application also provide a computer program product, including: computer programs / instructions, which can implement the steps in the methods provided by the embodiments of this application when executed by a processor. It should be understood that each process or the combination of multiple processes in the above method flow can be implemented by computer programs or instructions. In addition, these computer programs or instructions can be applied to the processors of general-purpose computers, special-purpose computers, embedded processors or other programmable data processing devices, so that the processors of general-purpose computers, special-purpose computers, embedded processors or other programmable data processing devices can be used as devices to implement the corresponding functions in the above method embodiments.

[0125] It should also be noted that the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, product or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or further includes elements inherent to such process, method, product or device. Without more limitations, the element defined by the statement "including one..." does not exclude the existence of additional identical elements in the process, method, product or device including the said element.

[0126] The above are only the embodiments of this application and are not used to limit this application. For those skilled in the art, various changes and modifications can be made to this application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this application shall be included within the scope of the claims of this application.

Claims

1. A domain name resolution method, characterized in that: include: The first domain name resolution node in the first computing cluster receives the domain name resolution request sent by the first computing node; If the first computing node belongs to a second computing cluster, obtaining a first isolation group corresponding to the first computing node in the first computing cluster based on a correspondence between computing nodes in the second computing cluster and isolation groups in the first computing cluster, where the second computing cluster is different from the first computing cluster, and the correspondence between computing nodes in the second computing cluster and isolation groups in the first computing cluster is determined based on isolation dimensions of the first computing cluster and the second computing cluster; Parsing the domain name resolution request according to the domain name mapping relationship corresponding to the first isolation group to obtain a resolution result; The parsing result is returned to the first computing node.

2. The method according to claim 1, characterized in that Also includes: Obtain configuration information of the isolation group in the second computing cluster, the configuration information including: a correspondence between the isolation group and the tenant in the second computing cluster and a correspondence between the isolation group and the computing nodes in the second computing cluster; According to the correspondence between the isolation groups in the second computing cluster and the tenants and the correspondence between the isolation groups in the first computing cluster and the tenants, the correspondence between the isolation groups in the second computing cluster and the computing nodes in the second computing cluster is converted into a correspondence between the computing nodes in the second computing cluster and the isolation groups in the first computing cluster.

3. The method according to claim 2, characterized in that The method includes converting the correspondence between the isolation groups in the second computing cluster and the computing nodes in the second computing cluster into a correspondence between the computing nodes in the second computing cluster and the isolation groups in the first computing cluster, according to the correspondence between the isolation groups in the second computing cluster and the tenants and the correspondence between the isolation groups in the first computing cluster and the tenants: For any isolation group in the second computing cluster, determine the target tenant corresponding to any isolation group in the second computing cluster based on the correspondence between the isolation groups in the second computing cluster and the tenants and the correspondence between the isolation groups in the first computing cluster and the tenants; and determine the target computing node corresponding to any isolation group in the second computing cluster based on the correspondence between the isolation groups in the second computing cluster and the computing nodes in the second computing cluster; Determine, in the isolation groups of the first computing cluster, a target isolation group corresponding to the target tenant; A correspondence between the target computing node and the target isolation group is established to convert the correspondence between the isolation group and the target computing node into a correspondence between the target computing node and the target isolation group.

4. The method according to claim 3, characterized in that The first computing cluster divides the isolation groups according to views, and the second computing cluster divides the isolation groups according to namespaces; or the first computing cluster divides the isolation groups according to namespaces, and the second computing cluster divides the isolation groups according to views.

5. The method according to claim 2, characterized in that Obtaining configuration information of the isolation group in the second computing cluster includes: The configuration information of the isolation group in the second computing cluster is obtained from the configuration center node, where the configuration information of the isolation group in the second computing cluster is uploaded to the configuration center node by the second domain name resolution node in the second computing cluster.

6. The method according to any one of claims 1 to 5, characterized in that Parsing the domain name resolution request according to the domain name mapping relationship corresponding to the first isolation group to obtain a resolution result, including: Obtaining, from the domain name mapping relationship corresponding to the first isolation group, a network address corresponding to the domain name to be resolved in the domain name resolution request as the resolution result; Among them, the domain name mapping relationship corresponding to the first isolation group is obtained based on the domain name registered by the computing node in the first isolation group and the network address corresponding to the domain name. The first isolation group and the isolation group to which the first computing node belongs in the second computing cluster belong to the same tenant.

7. The method according to any one of claims 1 to 5, characterized in that Also includes: In response to an update operation of the isolation group in the first computing cluster, obtaining configuration information of a second isolation group updated in the first computing cluster, the configuration information of the second isolation group including a correspondence between the second isolation group and tenants and a correspondence between the second isolation group and computing nodes in the first computing cluster; Sending the configuration information of the second isolation group to a configuration center node, so that the configuration center node shares the configuration information of the second isolation group with a second domain name resolution node in the second computing cluster; Among them, the configuration information of the second isolation group is used to: enable the second domain name resolution node to determine the correspondence between the computing nodes in the second isolation group and the isolation groups in the second computing cluster based on the correspondence between the second isolation group and the tenant and the correspondence between the isolation groups in the second computing cluster and the tenant, so as to resolve the domain name resolution request of the computing nodes in the second isolation group based on the correspondence between the computing nodes in the second isolation group and the isolation groups in the second computing cluster.

8. A domain name resolution method, applied to a hybrid cloud computing system, wherein the hybrid cloud computing system includes a first cloud computing cluster and a second cloud computing cluster, characterized in that: include: The first domain name resolution node in the first cloud computing cluster receives the domain name resolution request sent by the first computing node; If the first computing node belongs to a second cloud computing cluster, obtaining a first isolation group corresponding to the first computing node in the first cloud computing cluster based on a correspondence between computing nodes in the second cloud computing cluster and isolation groups in the first cloud computing cluster, the second cloud computing cluster being different from the first cloud computing cluster, and the correspondence between computing nodes in the second cloud computing cluster and isolation groups in the first cloud computing cluster being determined based on an isolation dimension between the first cloud computing cluster and the second cloud computing cluster; Parsing the domain name resolution request according to the domain name mapping relationship corresponding to the first isolation group to obtain a resolution result; The parsing result is returned to the first computing node.

9. The method according to claim 8, characterized in that The first cloud computing cluster is a computing cluster corresponding to a public cloud, and the second cloud computing cluster is a computing cluster corresponding to a private cloud; or, the first cloud computing cluster is a computing cluster corresponding to a private cloud, and the second cloud computing cluster is a computing cluster corresponding to a public cloud.

10. An electronic device, characterized in that: include: communications components, memory, and processors; The memory is used to store one or more computer instructions; The processor is configured to execute the one or more computer instructions to: utilize the communication method provided by the communication component to perform the steps in the method according to any one of claims 1 to 9.

11. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 can be implemented.

12. A computer program product, characterized in that include: A computer program / instruction, which, when executed by a processor, can implement the steps of the method according to any one of claims 1 to 9.

Images