Container network implementation method based on Kubernetes

Abstract

The invention provides a container network implementation method and device based on Kubernetes and a storage medium. The method comprises the following steps: creating a distributed logic router based on a virtual VPC, and creating a corresponding distributed logic switch based on the distributed logic router; acquiring a Node node and a Pod in the cluster, adding the Node node and the Pod into a distributed logic switch, and determining a logic subnet corresponding to the Node node and the Pod; and internal access and external access of the Pod are realized based on the distributed logic switch. According to the method, the technical effect of improving the network access efficiency is achieved.

Description

Technical Field

[0001] The present application relates to the field of the Internet, and in particular to a method, device, and storage medium for implementing a container network based on Kubernetes. Background Art

[0002] The rise of container technology has made the deployment and management of applications more flexible and efficient. However, communication between containers is a challenge because containers can run on different hosts and their network addresses may change dynamically. To solve this problem, a container network solution is needed that can provide communication and network isolation between containers and can automatically adapt to dynamic changes in containers. Kubernetes, as a container orchestration and management platform, provides abstraction and management functions for container networks, making communication between containers simpler and more reliable.

[0003] In the existing Kubernetes container network implementation method: Pod access and communication include: communication between different Pods on the same node can be carried out through the second-layer network. When communication between Pods occurs on the same node, Kubernetes uses the network equipment on the node to communicate without leaving the node; when communication between Pods occurs on different nodes, Kubernetes uses the third-layer network for communication. Each Pod has a unique IP address, which can be used for cross-node communication. Kubernetes implements cross-node communication between Pods through routing and network configuration; Pods can communicate with external networks through Services and Ingress; Services can load balance requests to multiple Pods on the backend and return responses to the requester through the network equipment on the node, and Ingress can route external HTTP and HTTPS requests to Services within the cluster.

[0004] In the prior art, Pod's communication covers Layer 2 and Layer 3 networks, and the way that one host corresponds to one subnet results in a long access link. Due to too many entries on the host, the access performance of the network is reduced. Communication between the Pod and the external network increases the access pressure of the network. Therefore, there is a technical problem of low network access efficiency in the prior art. Summary of the invention

[0005] The present application provides a container network implementation method, device and storage medium based on Kubernetes to solve the technical problem of low network access efficiency existing in the prior art.

[0006] In a first aspect, the present application provides a method for implementing a container network based on Kubernetes, comprising:

[0007] Create a distributed logical router based on the virtual VPC, and create a corresponding distributed logical switch based on the distributed logical router;

[0008] Get the Node nodes and Pods in the cluster, add the Node nodes and Pods to the distributed logical switch, and determine the logical subnets corresponding to the Node nodes and Pods;

[0009] Internal and external access to Pods is achieved based on distributed logical switches.

[0010] Optionally, obtain the Node nodes and Pods in the cluster, add the Node nodes and Pods to the distributed logical switch, and determine the logical subnets corresponding to the Node nodes and Pods, including:

[0011] Get the number of Node nodes in the preset cluster, and create a logical subnet corresponding to the Node node and a preset subnet based on the distributed logical switch;

[0012] Add the Node to the preset subnet, create a network card corresponding to the Node, and mount the network card to the logical port of the preset subnet;

[0013] Create a Pod based on the Node node, and mount the network card of the container in the Pod to the logical subnet corresponding to the Node node to which the Pod belongs.

[0014] Optionally, before implementing internal access and external access of the Pod based on the distributed logical switch, the following steps are also included:

[0015] Start the Pod based on the Node node, obtain the configuration information based on the Pod configuration file, obtain the logical subnet of the Node node corresponding to the Pod based on the configuration information, and add the Pod to the logical subnet.

[0016] Optionally, internal access and external access of the Pod are implemented based on a distributed logical switch, including:

[0017] When a Pod accesses other Pods, the accessing Pod and the accessed Pod belong to the same distributed logical switch, and the accessing Pod accesses the accessed Pod based on the distributed logical switch;

[0018] The accessing Pod and the accessed Pod belong to the same Node and / or do not belong to the same Node.

[0019] Optionally, internal access and external access of the Pod are implemented based on a distributed logical switch, and also include:

[0020] When a Pod accesses a Node, access from the Pod to the Node is implemented based on the same distributed logical router to which the Node and the Pod belong.

[0021] Optionally, internal access and external access of the Pod are implemented based on a distributed logical switch, and also include:

[0022] When the Pod accesses the SVC, the access traffic of the Pod is forwarded to the Node to which the Pod belongs based on the first preset rule, and the destination address accessed by the Pod is determined as the network address of the Pod based on the second preset rule;

[0023] Based on the third preset rule in the network card of the Node node, the source address accessed by the Pod is determined as the address of the network card, and access to the Pod and SVC is achieved in the same distributed logical switch based on the address of the network card and the network address of the Pod.

[0024] Optionally, internal access and external access of the Pod are implemented based on a distributed logical switch, and also include:

[0025] When a Pod accesses an external network address, based on the distributed logical router, the Pod's access traffic is directed to the network card of the Node node to which the Pod belongs, and the external network address is accessed based on the physical network card of the Node node.

[0026] In a second aspect, the present application provides a container network implementation device based on Kubernetes, including:

[0027] A first processing module is used to create a distributed logical router based on the virtual VPC, and create a corresponding distributed logical switch based on the distributed logical router;

[0028] The second processing module is used to obtain the Node nodes and Pods in the cluster, add the Node nodes and Pods to the distributed logical switch, and determine the logical subnets corresponding to the Node nodes and Pods;

[0029] The third processing module is used to implement internal access and external access of the Pod based on the distributed logical switch.

[0030] Optionally, the device is also used to:

[0031] Get the number of Node nodes in the preset cluster, and create a logical subnet corresponding to the Node node and a preset subnet based on the distributed logical switch;

[0032] Add the Node to the preset subnet, create a network card corresponding to the Node, and mount the network card to the logical port of the preset subnet;

[0033] Create a Pod based on the Node node, and mount the network card of the container in the Pod to the logical subnet corresponding to the Node node to which the Pod belongs.

[0034] Optionally, the device is also used to:

[0035] Start the Pod based on the Node node, obtain the configuration information based on the Pod configuration file, obtain the logical subnet of the Node node corresponding to the Pod based on the configuration information, and add the Pod to the logical subnet.

[0036] Optionally, the device is also used to:

[0037] When a Pod accesses other Pods, the accessing Pod and the accessed Pod belong to the same distributed logical switch, and the accessing Pod accesses the accessed Pod based on the distributed logical switch;

[0038] The accessing Pod and the accessed Pod belong to the same Node and / or do not belong to the same Node.

[0039] Optionally, the device is also used to:

[0040] When a Pod accesses a Node, access from the Pod to the Node is implemented based on the same distributed logical router to which the Node and the Pod belong.

[0041] Optionally, the device is also used to:

[0042] When the Pod accesses the SVC, the access traffic of the Pod is forwarded to the Node to which the Pod belongs based on the first preset rule, and the destination address accessed by the Pod is determined as the network address of the Pod based on the second preset rule;

[0043] Based on the third preset rule in the network card of the Node node, the source address accessed by the Pod is determined as the address of the network card, and access to the Pod and SVC is achieved in the same distributed logical switch based on the address of the network card and the network address of the Pod.

[0044] Optionally, the device is also used to:

[0045] When a Pod accesses an external network address, based on the distributed logical router, the Pod's access traffic is directed to the network card of the Node node to which the Pod belongs, and the external network address is accessed based on the physical network card of the Node node.

[0046] A third aspect of the present application provides a container network implementation device based on Kubernetes, including:

[0047] Processor and memory;

[0048] Memory stores computer-executable instructions;

[0049] The processor executes the computer execution instructions stored in the memory, so that the Kubernetes-based container network implementation device executes any one of the Kubernetes-based container network implementation methods in the first aspect.

[0050] In a fourth aspect, the present application provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are executed by a processor, they are used to implement a container network implementation method based on Kubernetes as described in any one of the first aspects.

[0051] The present application provides a method, device and storage medium for implementing a container network based on Kubernetes. The method includes: creating a distributed logical router based on a virtual VPC, creating a corresponding distributed logical switch based on the distributed logical router; obtaining the Node nodes and Pods in the cluster, adding the Node nodes and Pods to the distributed logical switch, and determining the logical subnets corresponding to the Node nodes and Pods; and realizing internal access and external access to the Pod based on the distributed logical switch. By dividing the logical subnets and preset subnets based on the number of Node nodes in the cluster under the same distributed logical switch, and adding the Node nodes to the preset subnets, the network access link is shortened, and the internal access and external access of the Pod nodes belong to the same distributed logical switch, which shortens the access link and improves the access efficiency; the way of logically dividing the subnets enables the Pods in the Node to be added to the same network segment, and uses the physical network card of the Node node to realize the external access of the Pod, which reduces the network access pressure of the cluster while facilitating management, and realizes the technical effect of improving network access efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0053] Figure 1 The process of implementing the container network based on Kubernetes provided in the embodiment of the present application Figure 1 ;

[0054] Figure 2 The process of implementing the container network based on Kubernetes provided in the embodiment of the present application Figure 2 ;

[0055] Figure 3An application architecture diagram of a Kubernetes-based container network implementation method provided in an embodiment of the present application;

[0056] Figure 4 Network access link for Kubernetes-based container network provided in the embodiment of the present application Figure 1 ;

[0057] Figure 5 Network access link for Kubernetes-based container network provided in the embodiment of the present application Figure 2 ;

[0058] Figure 6 Network access link for Kubernetes-based container network provided in the embodiment of the present application Figure 3 ;

[0059] Figure 7 A schematic diagram of the structure of a Kubernetes-based container network implementation device provided in an embodiment of the present application;

[0060] Figure 8 A hardware structure diagram of a Kubernetes-based container network implementation device provided in an embodiment of the present application.

[0061] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0062] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0063] First, the terms involved in this application are explained:

[0064] Kubernetes: is an open source container orchestration platform for automating the deployment, scaling, and management of containerized applications; it was originally developed by Google and released in 2014; Kubernetes provides a reliable and scalable platform for managing the lifecycle of containerized applications, including deployment, scaling, automation, and fault tolerance.

[0065] Open Virtual Network (OVN) is an open source virtual network solution based on Open vSwitch (OVS) and OpenFlow technology for building and managing virtual networks. OVN provides a distributed and scalable network architecture suitable for cloud computing and container environments.

[0066] Node: refers to the working node in the Kubernetes cluster, also known as the actual host, which is responsible for running and managing container applications. They communicate with the Master node and execute instructions from the Master node to ensure the normal operation of the application.

[0067] Pod: It is the smallest deployable unit in Kubernetes. It is a set of related containers that share network and storage resources. Pod runs on the Node node and is the basic unit of Kubernetes scheduling and management.

[0068] Virtual Private Cloud (VPC): It can also be called a proprietary network or a private network. When you order a cloud host, a VPC will be configured so that the ordered cloud host can be divided into a private network and isolated from other users.

[0069] Distributed Logical Switch (DLS): refers to a technology used in virtualized networks to provide logical Layer 2 network switching functions. It is implemented in a software-defined networking (SDN) environment by separating the network switching function from the physical switch and implementing it in a virtualized environment in software.

[0070] Distributed logical routing: is a layer network routing function used in virtualized networks. It is implemented in a software-defined networking (SDN) environment by separating the network routing function from the physical router and implementing it in a virtualized environment in software.

[0071] Source Network Address Translation (SNAT) is a network address translation technology used to modify the source IP address of a data packet in a network. It is usually used to solve the conversion problem between IP addresses in private networks and IP addresses in public networks.

[0072] Service (SVC): In the nodes of the cluster, SVC is a resource object in Kubernetes that is used to define the access method and network policy of a group of Pods.

[0073] Classless Inter-Domain Routing (CIDR) is a method for allocating and managing IP addresses. In CIDR, an IP address is represented as an address block with a prefix length, such as 192.168.0.0 / 24. The prefix length represents the number of bits in the network portion of the address block, while the remaining bits are used to classify IP addresses. Traditional IP address classification divides IP addresses into Class A, Class B, and Class C, each with a fixed network portion and host portion. However, this classification method leads to a waste of address space because each network has a fixed number of host addresses, while the actual number of hosts used is generally far less than this number. The advantage of CIDR is that it allows for more flexible allocation of IP addresses. By using variable-length prefixes, CIDR can allocate address blocks based on actual needs, thereby reducing the waste of address space. In addition, CIDR simplifies the management of routing tables because it can merge multiple address blocks into a larger address block, thereby reducing the number of entries in the routing table.

[0074] IP Virtual Server (ipvs): is a module in the Linux kernel that provides a high-performance load balancing solution; in Kubernetes, ipvs can be used as a load balancing solution to distribute traffic to multiple Pods. The kube-proxy component of Kubernetes can use the ipvs mode to achieve load balancing and provide high-performance service proxy functions.

[0075] iptables: is a firewall tool that works on the Linux operating system. It can be used to configure, manage and monitor the rules of network connections. It is a kernel-based firewall system that can protect computers and networks from malicious attacks and unauthorized access by filtering, forwarding and modifying network data packets.

[0076] kube-proxy: It is a core component in the Kubernetes cluster. It is responsible for implementing the proxy and load balancing functions of the Kubernetes service. Kube-proxy runs on each Node node and communicates with the Kubernetes API server to obtain information about services and endpoints.

[0077] Kubelet: refers to an important component in the Kubernetes cluster, which runs on each node and is responsible for managing and maintaining the containers on the node. The main responsibility of Kubelet is to communicate with the Kubernetes main control plane, receive commands, and ensure that the containers run correctly on the node.

[0078] In the existing container network implementation method of Kubernetes: Pod access and communication include: communication between different Pods on the same node can be carried out through the second-layer network. When the communication between Pods occurs on the same node, Kubernetes uses the network equipment on the node to communicate without leaving the node; when the communication between Pods occurs on different nodes, Kubernetes uses the third-layer network for communication. Each Pod has a unique IP address, which can be used to communicate across nodes. Kubernetes implements cross-node communication between Pods through routing and network configuration; Pods can communicate with external networks through Service and Ingress; Service can load balance requests to multiple Pods on the backend, and return the response to the requester through the network equipment on the node, and Ingress can route external HTTP and HTTPS requests to the Service inside the cluster. In the prior art, Pod communication covers the second-layer network and the third-layer network, and the way that one host corresponds to one subnet leads to a long access link. Due to too many entries on the host, the access performance of the network is reduced; Pod communication with the external network will increase the access pressure of the network. Therefore, there is a technical problem of low network access efficiency in the prior art.

[0079] The present application provides a method, device and storage medium for implementing a container network based on Kubernetes. The method includes: creating a distributed logical router based on a virtual VPC, creating a corresponding distributed logical switch based on the distributed logical router; obtaining the Node nodes and Pods in the cluster, adding the Node nodes and Pods to the distributed logical switch, and determining the logical subnets corresponding to the Node nodes and Pods; and realizing internal access and external access to the Pod based on the distributed logical switch. By dividing the logical subnets and preset subnets based on the number of Node nodes in the cluster under the same distributed logical switch, and adding the Node nodes to the preset subnets, the network access link is shortened, and the internal access and external access of the Pod nodes belong to the same distributed logical switch, which shortens the access link and improves the access efficiency; the way of logically dividing the subnets enables the Pods in the Node to be added to the same network segment, and uses the physical network card of the Node node to realize the external access of the Pod, which reduces the network access pressure of the cluster while facilitating management, thereby solving the technical problem of low network access efficiency in the prior art.

[0080] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0081] Figure 1 The process of implementing the container network based on Kubernetes provided in the embodiment of the present application Figure 1 .like Figure 1 As shown, the method includes:

[0082] S101. Create a distributed logical router based on the virtual VPC, and create a corresponding distributed logical switch based on the distributed logical router;

[0083] In the first example, a VPC is created based on the cluster, a distributed logical router is created based on the VPC, and a distributed logical switch is created based on the distributed logical router. In this embodiment, the distributed logical switch and the distributed logical router are in a one-to-one correspondence.

[0084] S102: Obtain the Node nodes and Pods in the cluster, add the Node nodes and Pods to the distributed logical switch, and determine the logical subnets corresponding to the Node nodes and Pods;

[0085] In this embodiment, the Node and the Pod are added to the same distributed logical switch, and the Pods can directly access each other in the same distributed logical switch; the communication between all Node nodes is also forwarded through the distributed logical switch.

[0086] S103. Implement internal and external access to the Pod based on the distributed logical switch.

[0087] In the second example, the Pod performs external access based on the distributed logical switch, and performs external access through the physical network card of the Node host where the Pod is located.

[0088] The present application provides a method for implementing a container network based on Kubernetes. The method includes: creating a distributed logical router based on a virtual VPC, creating a corresponding distributed logical switch based on the distributed logical router; obtaining the Node nodes and Pods in the cluster, adding the Node nodes and Pods to the distributed logical switch, and determining the logical subnets corresponding to the Node nodes and Pods; and realizing internal access and external access to the Pod based on the distributed logical switch. By dividing the logical subnets and preset subnets based on the number of Node nodes in the cluster under the same distributed logical exchange, and adding the Node nodes to the preset subnets, the network access link is shortened, and the internal access and external access of the Pod nodes belong to the same distributed logical switch, which shortens the access link and improves the access efficiency; the way of logically dividing the subnets enables the Pods in the Node to be added to the same network segment, and uses the physical network card of the Node node to realize the external access of the Pod, which reduces the network access pressure of the cluster while facilitating management, and solves the technical problem of low network access efficiency in the prior art.

[0089] Figure 2 The process of implementing the container network based on Kubernetes provided in the embodiment of the present application Figure 2 . Figure 3 The application architecture diagram of the container network implementation method based on Kubernetes provided in the embodiment of the present application is as follows: Figure 3 As shown, there are N Node nodes in the cluster, and N+1 logical subnets are divided based on the distributed logical switch, including: a preset subnet and subnets of N Node nodes. Each Node node creates a corresponding network card and mounts it to the logical port of the preset subnet. The container network card of the Pod in the Node node is mounted to the subnet of the corresponding Node node. Figure 4 , Figure 5 and Figure 6 The network access links for the container network based on Kubernetes provided in the embodiments of the present application are respectively Figure 1 , two And three, network access links include: access between Pods: Pods can directly access each other through the distributed logical switch; Pod to Node access, access through the logical port of the preset subnet, to achieve access under the same distributed logical routing; Pod to SVC access, through the conversion of source address and destination address, converting the source address to the address of the Node node's network card, converting the destination address to the address of the Pod, to achieve Pod to SVC access in the same virtual VPC network. Figure 2 As shown, the method includes:

[0090] S201. Create a distributed logical router based on the virtual VPC, and create a corresponding distributed logical switch based on the distributed logical router;

[0091] S202. Obtain the number of Node nodes in the preset cluster, and create a logical subnet corresponding to the Node node and a preset subnet based on the distributed logical switch; add the Node node to the preset subnet, create a network card corresponding to the Node node, and mount the network card to the logical port of the preset subnet; create a Pod based on the Node node, and mount the network card of the container in the Pod to the logical subnet corresponding to the Node node to which the Pod belongs;

[0092] In this embodiment, the number of Node nodes in the preset cluster is N, where N is a positive integer. N+1 subnets are divided based on the distributed logical switch, where N subnets serve as subnets for the Node nodes and one preset subnet; the N Node nodes are added to the preset subnet, and a network card for the Node node is created, and the network card is mounted on the logical port of the preset subnet.

[0093] In this embodiment, the logical subnet is divided by CIDR, and the preset subnet and the logical subnet of the Node node belong to the same distributed logical switch, and the difference is that the network segments of the two are different.

[0094] In this embodiment, when a Pod in a Node node is created, the network card of the container in the Pod is mounted to the logical subnet of the corresponding Node node to realize the connection between the container network and the Node node network; in the third example, a virtual network card is created for the container in bridging mode, and the virtual network card is connected to the host machine's bridge. The host machine's bridge will be responsible for forwarding the container's network traffic to the host machine's physical network card, thereby realizing the connection between the container and host machine networks.

[0095] In this embodiment, to mount the network card of the container in the Pod in the cluster to the logical subnet of the node, Kubernetes' network plug-in can be used to achieve this. Kubernetes provides a variety of network plug-ins (CNI, Container Network Interface), which can be Flannel, Calico, and Weave. They can assign IP addresses to the Pods in the cluster and connect the Pod's network card to the logical subnet of the node.

[0096] S203, starting the Pod based on the Node node, obtaining configuration information based on the Pod configuration file, obtaining the logical subnet of the Node node corresponding to the Pod based on the configuration information, and adding the Pod to the logical subnet;

[0097] In this embodiment, in the fourth example, when the Node node starts a Pod, the kubelet will send a request to the CNI plug-in; the CNI plug-in will read configuration files from the / etc / cni / net.d / path, and these configuration files contain the network configuration information of the current node; through these configuration files, the CNI plug-in can directly add the Pod to the logical subnet of the corresponding Node node, so that the Pod can communicate with the Pod on other nodes; in this way, the Pod can perform network communication within the cluster.

[0098] S204: When a Pod accesses another Pod, the accessing Pod and the accessed Pod belong to the same distributed logical switch, and the accessing Pod accesses the accessed Pod based on the distributed logical switch.

[0099] In this embodiment, the accessing Pod and the accessed Pod belong to the same Node and / or do not belong to the same Node; at the OVN level, access between Pods is performed on the same distributed logical switch, that is, access at the same Layer 2.

[0100] In the fifth example, the access between Pods is the access between the Pod with network address A and the Pod with network address B, both of which belong to the network segment of the distributed logical switch and can be directly accessed through the distributed logical switch.

[0101] S205. When the Pod accesses the Node, the access from the Pod to the Node is implemented based on the same distributed logical router to which the Node and the Pod belong.

[0102] In this embodiment, on OVN, traffic passes through the distributed logical switch to the distributed logical router. By adding source address routing on the VPC, the traffic from the CID R network segment corresponding to the Node node's subnet is forwarded to the logical port mounted on the Node node's network card, thereby achieving access to the Node node. This access link is under the same logical router of OVN.

[0103] S206. When the Pod accesses the SVC, the access traffic of the Pod is forwarded to the Node node to which the Pod belongs based on the first preset rule, and the destination address accessed by the Pod is determined as the network address of the Pod based on the second preset rule; based on the third preset rule in the network card of the Node node, the source address accessed by the Pod is determined as the address of the network card, and access to the Pod and the SVC is implemented in the same distributed logical switch based on the address of the network card and the network address of the Pod;

[0104] In this embodiment, the access traffic of the Pod is forwarded to the Node node where the load Pod is located by configuring the routing rules of the VPC. After the traffic reaches the Node node, it is written to the ipvs or iptables rules of the Node node through Kubernetes, and is resolved to the Pod network address of the backend load, and the destination address is converted into the network address of the Pod; then, the source address is converted into the address of the network card through the snat rule of the network card on the Node. The address of the network card and the Pod network address are in the same VPC network, thereby realizing the access of the Pod to the SVC address.

[0105] S207. When the Pod accesses an external network address, based on the distributed logical router, the access traffic of the Pod is directed to the network card of the Node node to which the Pod belongs, and the external network address is accessed based on the physical network card of the Node node.

[0106] In this embodiment, when a Pod accesses an external network address, it can be accessed based on the physical network card of the host machine, thereby balancing the network access pressure within the cluster.

[0107] The present application provides a method for implementing a container network based on Kubernetes. The method includes: creating a distributed logical router based on a virtual VPC, creating a corresponding distributed logical switch based on the distributed logical router, wherein one distributed logical router corresponds to a distributed logical switch; obtaining the Node nodes and Pods in the cluster, adding the Node nodes and Pods to the distributed logical switch, and determining the logical subnets corresponding to the Node nodes and Pods; realizing internal access and external access to the Pod based on the distributed logical switch; by determining a same virtual VPC for all nodes in a cluster and determining a corresponding distributed logical router and a distributed logical switch, all nodes in the cluster are added to the same distributed logical switch, the communication of the Node nodes and the communication of the Pod use the same distributed logical switch, that is, the access control of the network is in the same Layer 2 network, and the external communication of the Pod is implemented using the physical network card of the host machine, while reducing the network access level, supporting distributed NAT gateways, while shortening the access link, reducing the network access pressure in the cluster, thereby solving the technical problem of low network access efficiency.

[0108] Figure 7 This is a schematic diagram of the structure of a Kubernetes-based container network implementation device provided in an embodiment of the present application. The device of this embodiment can be in the form of software and / or hardware. Figure 7 As shown, a Kubernetes-based container network implementation device 700 provided in an embodiment of the present application includes: a first processing module 701, a second processing module 702, and a third processing module 703.

[0109] The first processing module 701 is used to create a distributed logical router based on the virtual VPC, and create a corresponding distributed logical switch based on the distributed logical router;

[0110] The second processing module 702 is used to obtain the Node nodes and Pods in the cluster, add the Node nodes and Pods to the distributed logical switch, and determine the logical subnets corresponding to the Node nodes and Pods;

[0111] The third processing module 703 is used to implement internal access and external access of the Pod based on the distributed logical switch.

[0112] In a possible implementation, the device is further used for:

[0113] Get the number of Node nodes in the preset cluster, and create a logical subnet corresponding to the Node node and a preset subnet based on the distributed logical switch;

[0114] Add the Node to the preset subnet, create a network card corresponding to the Node, and mount the network card to the logical port of the preset subnet;

[0115] Create a Pod based on the Node node, and mount the network card of the container in the Pod to the logical subnet corresponding to the Node node to which the Pod belongs.

[0116] In a possible implementation, the device is further used for:

[0117] Start the Pod based on the Node node, obtain the configuration information based on the Pod configuration file, obtain the logical subnet of the Node node corresponding to the Pod based on the configuration information, and add the Pod to the logical subnet.

[0118] In a possible implementation, the device is further used for:

[0119] When a Pod accesses other Pods, the accessing Pod and the accessed Pod belong to the same distributed logical switch, and the accessing Pod accesses the accessed Pod based on the distributed logical switch;

[0120] The accessing Pod and the accessed Pod belong to the same Node and / or do not belong to the same Node.

[0121] In a possible implementation, the device is further used for:

[0122] When a Pod accesses a Node, access from the Pod to the Node is implemented based on the same distributed logical router to which the Node and the Pod belong.

[0123] In a possible implementation, the device is further used for:

[0124] When the Pod accesses the SVC, the access traffic of the Pod is forwarded to the Node to which the Pod belongs based on the first preset rule, and the destination address accessed by the Pod is determined as the network address of the Pod based on the second preset rule;

[0125] Based on the third preset rule in the network card of the Node node, the source address accessed by the Pod is determined as the address of the network card, and access to the Pod and SVC is achieved in the same distributed logical switch based on the address of the network card and the network address of the Pod.

[0126] In a possible implementation, the device is further used for:

[0127] When a Pod accesses an external network address, based on the distributed logical router, the Pod's access traffic is directed to the network card of the Node node to which the Pod belongs, and the external network address is accessed based on the physical network card of the Node node.

[0128] The present application provides a container network implementation device based on Kubernetes. The device includes: a first processing module, which is used to create a distributed logical router based on a virtual VPC, and a corresponding distributed logical switch based on the distributed logical router, wherein one distributed logical router corresponds to one distributed logical switch; a second processing module, which is used to obtain the Node nodes and Pods in the cluster, add the Node nodes and Pods to the distributed logical switch, and determine the logical subnets corresponding to the Node nodes and Pods; a third processing module, which is used to implement internal access and external access to the Pod based on the distributed logical switch; by determining a same virtual VPC for all nodes in a cluster and determining a corresponding distributed logical router and a distributed logical switch, all nodes in the cluster are added to the same distributed logical switch, and the communication of the Node nodes and the communication of the Pod use the same distributed logical switch, that is, the access control of the network is in the same Layer 2 network, and the external communication of the Pod is implemented using the physical network card of the host machine, while reducing the network access level, supporting distributed NAT gateways, while shortening the access link, reducing the network access pressure in the cluster, thereby solving the technical problem of low network access efficiency.

[0129] Figure 8 The hardware structure diagram of the container network implementation device based on Kubernetes provided in the embodiment of the present application. Figure 8 As shown, the Kubernetes-based container network implementation device 800 includes:

[0130] Processor 801 and memory 802;

[0131] Memory stores computer-executable instructions;

[0132] The processor executes the computer execution instructions stored in the memory 802, so that the Kubernetes-based container network implementation device executes the Kubernetes-based container network implementation method as described above.

[0133] It should be understood that the processor 801 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly implemented as a hardware processor, or can be implemented by a combination of hardware and software modules in the processor. The memory 802 may include a high-speed random access memory (RAM), and may also include a non-volatile memory (NVM), such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a disk or an optical disk, etc.

[0134] The embodiment of the present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement a container network implementation method based on Kubernetes.

[0135] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required for the present application.

[0136] It should be further noted that, although the various steps in the flowchart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0137] It should be understood that the above-mentioned device embodiments are only illustrative, and the device of the present application can also be implemented in other ways. For example, the division of units / modules in the above-mentioned embodiments is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0138] In addition, unless otherwise specified, each functional unit / module in each embodiment of the present application may be integrated into one unit / module, each unit / module may exist physically separately, or two or more units / modules may be integrated together. The above-mentioned integrated unit / module may be implemented in the form of hardware or in the form of a software program module.

[0139] If the integrated unit / module is implemented in the form of hardware, the hardware may be a digital circuit, an analog circuit, etc. The physical implementation of the hardware structure includes but is not limited to transistors, memristors, etc. If not specifically stated, the processor may be any appropriate hardware processor, such as a CPU, a GPU, an FPGA, a DSP, and an ASIC, etc. If not specifically stated, the storage unit may be any appropriate magnetic storage medium or magneto-optical storage medium, such as a resistive random access memory RRAM (Resistive Random Access Memory), a dynamic random access memory DRAM (Dynamic Random Access Memory), a static random access memory SRAM (Static Random-Access Memory), an enhanced dynamic random access memory EDRAM (Enhanced Dynamic Random Access Memory), a high-bandwidth memory HBM (High-Bandwidth Memory), a hybrid memory cube HMC (Hybrid Memory Cube), etc.

[0140] If the integrated unit / module is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of each embodiment method of the present application. The aforementioned memory includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0141] In the above embodiments, the description of each embodiment has its own emphasis. For the part not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0142] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0143] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A container network implementation method based on Kubernetes, characterized in that: include: Create a distributed logical router based on the virtual VPC, and create a corresponding distributed logical switch based on the distributed logical router; Obtain the Node nodes and Pods in the cluster, add the Node nodes and the Pods to the distributed logical switch, and determine the logical subnets corresponding to the Node nodes and the Pods; Internal access and external access to the Pod are achieved based on the distributed logical switch.

2. The method according to claim 1, characterized in that The obtaining of the Node nodes and the Pod in the cluster, adding the Node nodes and the Pod to the distributed logical switch, and determining the logical subnet corresponding to the Node nodes and the Pod includes: Obtain the number of Node nodes in a preset cluster, and create the logical subnet corresponding to the Node node and a preset subnet based on the distributed logical switch; Add the Node node to the preset subnet, create a network card corresponding to the Node node, and mount the network card to the logical port of the preset subnet; A Pod is created based on the Node node, and the network card of the container in the Pod is mounted to the logical subnet corresponding to the Node node to which the Pod belongs.

3. The method according to claim 2, characterized in that Before the internal access and external access of the Pod are realized based on the distributed logical switch, the method further includes: The Pod is started based on the Node node, configuration information is obtained based on the configuration file of the Pod, the logical subnet of the Node node corresponding to the Pod is obtained based on the configuration information, and the Pod is added to the logical subnet.

4. The method according to claim 3, characterized in that Implementing internal access and external access to the Pod based on the distributed logical switch includes: When the Pod accesses other Pods, the accessing Pod and the accessed Pod belong to the same distributed logical switch, and the accessing Pod accesses the accessed Pod based on the distributed logical switch; The accessing Pod and the accessed Pod belong to the same Node and / or do not belong to the same Node.

5. The method according to claim 4, characterized in that Implementing internal access and external access to the Pod based on the distributed logical switch also includes: When the Pod accesses the Node node, the access of the Pod to the Node node is implemented based on the same distributed logical router to which the Node node and the Pod belong.

6. The method according to claim 5, characterized in that Implementing internal access and external access to the Pod based on the distributed logical switch also includes: When the Pod accesses the SVC, the access traffic of the Pod is forwarded to the Node to which the Pod belongs based on the first preset rule, and the destination address accessed by the Pod is determined as the network address of the Pod based on the second preset rule; Based on the third preset rule in the network card of the Node node, the source address accessed by the Pod is determined as the address of the network card, and based on the address of the network card and the network address of the Pod, access to the Pod and the SVC is implemented in the same distributed logical switch.

7. The method according to claim 6, characterized in that Implementing internal access and external access to the Pod based on the distributed logical switch also includes: When the Pod accesses an external network address, based on the distributed logical router, the access traffic of the Pod is directed to the network card of the Node node to which the Pod belongs, and the external network address is accessed based on the physical network card of the Node node.

8. A container network implementation device based on Kubernetes, characterized in that: include: A first processing module, configured to create a distributed logical router based on the virtual VPC, and to create a corresponding distributed logical switch based on the distributed logical router; The second processing module is used to obtain the Node nodes and the Pod in the cluster, add the Node nodes and the Pod to the distributed logical switch, and determine the logical subnet corresponding to the Node nodes and the Pod; The third processing module is used to implement internal access and external access of the Pod based on the distributed logical switch.

9. A container network implementation device based on Kubernetes, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the Kubernetes-based container network implementation method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the Kubernetes-based container network implementation method according to any one of claims 1 to 7.

Images