Application deployment method and device, storage medium and electronic equipment

Abstract

The embodiment of the invention provides an application deployment method and device, a storage medium and electronic equipment, and the method comprises the steps: determining a target configuration parameter of a target service, the target configuration parameter being used for configuring a network address and a virtual local area network isolation domain for the target service in a target container; determining a target application space for operating the target service; determining a target network address pool associated with the target application space and a target virtual local area network isolation domain included in the target configuration parameter, the target virtual local area network isolation domain being a virtual local area network isolation domain allocated to a target tenant to which the target service belongs, and the target virtual local area network isolation domain being a virtual local area network isolation domain allocated to a target tenant to which the target service belongs; the target virtual local area network isolation domain is only used for deploying services belonging to the target tenant; and distributing a target network address for the target service from the target network address pool, and deploying the target service to the target virtual local area network isolation domain according to the target network address. According to the invention, the problem of poor network isolation in the prior art is solved.

Description

Technical Field

[0001] The embodiments of the present application relate to the computer field, and specifically, to an application deployment method, device, storage medium and electronic device. Background Art

[0002] In the related technology, the commonly used open source k8s load balancing plug-in does not provide multi-tenant network isolation, and cannot guarantee the independence of data between multi-tenant networks and the security of business.

[0003] It can be seen from this that the related technology has the problem of poor network isolation.

[0004] Currently, no effective solution has been proposed for the above-mentioned problems existing in the related technologies. Summary of the invention

[0005] The embodiments of the present application provide an application deployment method, device, storage medium and electronic device to at least solve the problem of poor network isolation existing in the related art.

[0006] According to an embodiment of the present application, a method for deploying an application is provided, characterized in that it is applied to a target container, the target container includes an application space, and the application space is used to run a service, including: determining target configuration parameters of the target service, wherein the target configuration parameters are used to configure a network address and a virtual local area network isolation domain for the target service in the target container; determining a target application space for running the target service; determining a target network address pool and a target virtual local area network isolation domain associated with the target application space included in the target configuration parameters, wherein the target virtual local area network isolation domain is a virtual local area network isolation domain allocated to a target tenant to which the target service belongs, and the target virtual local area network isolation domain is only used to deploy services belonging to the target tenant; allocating a target network address to the target service from the target network address pool, and deploying the target service to the target virtual local area network isolation domain according to the target network address.

[0007] According to another embodiment of the present application, a deployment device for an application is provided, characterized in that it is applied to a target container, the target container includes an application space, and the application space is used to run a service, including: a first determination module, used to determine the target configuration parameters of the target service, wherein the target configuration parameters are used to configure a network address and a virtual local area network isolation domain for the target service in the target container; a second determination module, used to determine the target application space for running the target service; a third determination module, used to determine the target network address pool associated with the target application space and the target virtual local area network isolation domain included in the target configuration parameters, wherein the target virtual local area network isolation domain is a virtual local area network isolation domain allocated to a target tenant to which the target service belongs, and the target virtual local area network isolation domain is only used to deploy services belonging to the target tenant; a deployment module, used to allocate a target network address to the target service from the target network address pool, and deploy the target service to the target virtual local area network isolation domain according to the target network address.

[0008] According to another embodiment of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when run.

[0009] According to another embodiment of the present application, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0010] According to another embodiment of the present application, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in any of the above method embodiments are implemented.

[0011] Through this application, after determining the target configuration parameters for configuring the network address and the virtual local area network isolation domain for the target service in the target container, the target application space for running the target service, and the target network address pool and the target virtual local area network isolation domain associated with the target application space included in the target configuration parameters, the target network address can be allocated to the target service from the target network address pool, and the target service can be deployed to the target virtual local area network isolation domain that is only used to deploy services belonging to the target tenant according to the target network address, thereby achieving the isolation of services between tenants. Therefore, the problem of poor network isolation existing in the related art can be solved, and the effect of maintaining data independence and improving user business security can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1It is a hardware structure block diagram of a server device of the application deployment method according to an embodiment of the present application;

[0013] Figure 2 is a flowchart of a method for deploying an application according to an embodiment of the present application;

[0014] Figure 3 is a schematic diagram of a load balancing system for multi-tenant network isolation according to an embodiment of the present application;

[0015] Figure 4 It is a schematic diagram of the implementation framework of a multi-tenant load balancing plug-in according to an embodiment of the present application;

[0016] Figure 5 is a flow chart of the deployment application of the MultiLB Controller plug-in according to an embodiment of the present application;

[0017] Figure 6 is a flowchart of controlling a target node to announce a target service according to a specific embodiment of the present invention;

[0018] Figure 7 is a block diagram of the cloud platform system according to an embodiment of the present application;

[0019] Figure 8 is an implementation flow chart of a resource management module according to an embodiment of the present application;

[0020] Fig. 9 is a flow chart of configuration parameter verification according to an embodiment of the present application;

[0021] Fig.10 It is a structural block diagram of a deployment device for an application according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] The embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0024] The method embodiments provided in the embodiments of the present application can be executed in a server device or a similar computing device. Taking running on a server device as an example, Figure 1 1 is a hardware structure diagram of a server device of an application deployment method according to an embodiment of the present application. Figure 1 As shown, the server device may include one or more ( Figure 1Only one is shown in the figure) processor 102 (processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the server device may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above server device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0025] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the deployment method of the application in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the server device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0026] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the server device. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0027] In this embodiment, a method for deploying an application is provided. Figure 2 is a flow chart of a method for deploying an application according to an embodiment of the present application, such as Figure 2 As shown, the process includes the following steps:

[0028] Step S202, determining target configuration parameters of the target service, wherein the target configuration parameters are used to configure a network address and a virtual local area network isolation domain for the target service in a target container;

[0029] Step S204, determining a target application space for running the target service;

[0030] Step S206, determining a target network address pool and a target virtual local area network isolation domain included in the target configuration parameters and associated with the target application space, wherein the target virtual local area network isolation domain is a virtual local area network isolation domain allocated to a target tenant to which the target service belongs, and the target virtual local area network isolation domain is only used to deploy services belonging to the target tenant;

[0031] Step S208: allocate a target network address to the target service from the target network address pool, and deploy the target service to the target virtual local area network isolation domain according to the target network address.

[0032] In the above embodiment, the application deployment method can be applied to the target container, the target container includes an application space, and the application space is used to run the service. The target container can be a container in a cluster, the cluster can include one or more container groups pod, a container group can include multiple containers, the container group can be the smallest resource management component in the Kubernetes (K8s) cluster, or it can be a resource object that minimizes the running of containerized applications. A Pod represents an execution task running in the cluster, that is, the above-mentioned running service. The application space can be the minimum granularity of resource management in the K8s cluster, and it is also the minimum granularity for dividing tenant resources. A tenant can have multiple application spaces at the same time, each application can be packaged into a container image, and there is a corresponding relationship between each container and the application.

[0033] In the above embodiment, the target configuration parameters of the target service may be parameters such as the address of the apiServer, the health check port, the log level, etc., but are not limited thereto. The apiServer may be a server program in a distributed system, serving as an interface for the system to interact with external applications or users, managing the system's status and resources, coordinating system components, and managing system security. The deployment service may be implemented by a multi-tenant load balancing plug-in in the cloud platform management system, i.e., the application deployment may be implemented by a load balancing system including a multi-tenant load balancing plug-in. Figure 3 A load balancing system for multi-tenant network isolation according to an embodiment of the present application, such as Figure 3 As shown, the system includes: cloud platform management and K8s cluster multi-tenant load balancing plug-in. Among them, the cloud platform management system realizes the network resource configuration and configuration distribution of tenants, that is, the cloud platform management system realizes the configuration target configuration parameters, and the multi-tenant load balancing component realizes the load balancing service IP allocation, multi-tenant network isolation deployment and load balancing service broadcast.

[0034] In the above embodiment, the implementation framework diagram of the multi-tenant load balancing plug-in is as follows: Figure 4 As shown in the figure, the multi-tenant load balancing plug-in includes two parts: MultiLB Controller (multi-tenant load balancing controller) and MultiLB Daemon (multi-tenant load balancing daemon). Among them, MultiLB Controller can realize the IP allocation and recovery of load balancing service, and MultiLB Daemon can realize the external notification of load balancing service. The deployment method of the application can be implemented through MultiLBController, and the deployment is carried out in the Deployment mode. In addition, HA active-standby mode is supported. Among them, Deployment is the deployment unit in K8s, and the control of the target Pod replica is realized by ReplicaSet (RS), which can ensure that the specified number of target Pod replicas runs in the cluster and can be expanded and reduced as needed. Among them, ReplicaSet is a resource object in the K8s cluster, which can manage the number and health status of the target Pod replicas. HA active-standby mode means configuring two identical devices in the network, one of which is in active state (this is the main device) and the other is in standby state (this is the backup device) to realize automatic failure switching and ensure the continuous availability of the running service. After the MultiLB Controller plug-in is started, you can obtain the List / Watch CRD / Namespace / Service resources; obtain the IP address pool deployed by the service resource according to the Namespace of the target service resource; then deploy the IP address for the target service according to the configuration information of the IP address pool; after the IP address is successfully deployed, you can add the IP address and the target virtual local area network isolation domain information to the target service and update the target service information; at the same time, update the IP address and target virtual local area network domain information deployed by the target service to the status of the configured IP address resource, and record the network information deployed by the target service. Among them, List / WatchCRD / Namespace / Service is equivalent to the full data, user-defined incremental data, application space data and service resources; Namespace represents the above target application space; status is used to indicate the current status of the resource; IP address is equivalent to the above target address, and IP address pool is equivalent to the above IP target address pool.

[0035] In the above embodiment, the flowchart of the deployment application of the MultiLB Controller plug-in can be found in the attached Figure 5 ,like Figure 5 As shown, the process includes:

[0036] Step S502, parsing parameters;

[0037] Step S504, component selection master;

[0038] Step S506, Is Leader?;

[0039] Step S508, detecting the master node status and seizing the renewal lock;

[0040] Step S510, loading cache data;

[0041] Step S512, obtain CRD / Namespace / service;

[0042] Step S514, service Type==Loadbalance?;

[0043] Step S516, obtaining the service affinity IP address;

[0044] Step S518, assigning an IP address to the service;

[0045] Step S520, IP address allocation successful?;

[0046] Step S522, updating service resources;

[0047] Step S524, updating local cache data;

[0048] Step S526, record the error log and update the service annotation.

[0049] When MultiLB Controller is started, it parses the target configuration parameters and implements the master selection mechanism by using the ETCD renewal lock method to determine whether the controller has successfully obtained the renewal lock. If yes, it executes step S510. If not, it executes step S508 to periodically check the status of the renewal lock. If the main controller is abnormal, it occupies the renewal lock and becomes the main controller. Among them, the ETCD renewal lock method can be summarized as: client initialization and connection establishment, creation of automatic lease renewal, creation of transaction to obtain lock, execution of business logic and finally release of lock.

[0050] In the above embodiment, the main controller loads all cache data, which may include deployment information of service resources and IP address pools, to ensure that the main controller can restore IP address deployment information in the event of an abnormal restart. The main server component obtains CRD / Namespace / service resources and performs coordination processing of each resource. When the service resource is obtained, determine whether the type of the service resource is LoadBalancer. If it is not LoadBalancer, determine the type of the service before the change. If the type before the change is still not LoadBalancer, end the processing flow. If the type of the service resource is LoadBalancer, obtain the IP address pool associated with the target application space according to the target application space where the target service resource is located and the tenantbindpool configuration information, where the IP address pool associated with the target application space; deploy IP for the target service from the IP address pool. If the IP address deployment fails, record the error log and update the annotation information of the target service to trigger the target service update to continue the tuning process. If the IP deployment is successful, update the status information of the target service and the status information of ipaddresspool CRD, update the local cache information, and record the information of the target service and the deployment information of the IP address. Among them, ipaddresspoolCRD represents the user-defined resource IP address pool, and LoadBalancer can be understood as a load balancing type.

[0051] In the above embodiment, the error log recording function may be implemented by a log module, which is used to record the tenant's operation log, resource update information and error information, so as to facilitate process analysis and troubleshooting.

[0052] Through this application, after determining the target configuration parameters for configuring the network address and the virtual local area network isolation domain for the target service in the target container, the target application space for running the target service, and the target network address pool and the target virtual local area network isolation domain associated with the target application space included in the target configuration parameters, the target network address can be allocated to the target service from the target network address pool, and the target service can be deployed to the target virtual local area network isolation domain that is only used to deploy services belonging to the target tenant according to the target network address, thereby achieving the isolation of services between tenants. Therefore, the problem of poor network isolation existing in the related art can be solved, and the effect of maintaining data independence and improving user business security can be achieved.

[0053] The execution entity of the above steps may be a K8s distributed cluster, but is not limited thereto.

[0054] In an exemplary embodiment, after deploying the target service in the target virtual local area network isolation domain according to the target network address, the method further includes: determining a target node for broadcasting the target service; and controlling the target node to broadcast the target service.

[0055] In the above embodiment, the target node may be a master notification node, and there may be one or more notification nodes, but there is only one master notification node. After determining that the node is the master node for running the service notification, the master notification node is controlled to send the broadcast information. By determining the master notification node, the accuracy of the broadcast message can be achieved, and it is avoided that multiple nodes broadcast the same information resources, which increases the storage pressure of the system and hinders the normal operation of the system.

[0056] In an exemplary embodiment, controlling the target node to broadcast the target service includes: creating a virtual local area network isolation domain sub-interface based on the target network address of the target service and the target virtual local area network isolation domain; setting a response mode of the virtual local area network isolation domain sub-interface; and controlling the target node to broadcast the target service through the response mode.

[0057] In the above embodiment, the response mode can be an ARP (Address Resolution Protocol) response mode, including: checking the requested target IP address, source MAC address, source IP address, target MAC address and target IP address. Among them, ARP stands for Address Resolution Protocol, which is a protocol for resolving IP addresses into Ethernet MAC addresses (physical addresses). In a local area network, when a host or other network device sends information data to another host or device, the network layer address (i.e., IP address) of the other party must be clear, but only the IP address information is not enough, because the IP data packet needs to be encapsulated into a frame to be sent through the physical network, so the physical address of the address station needs to be received, that is, a mapping from IP address to physical address is required.

[0058] In the above embodiment, a Vlan sub-interface can be created by the IP address of the target service and the Vlan isolation domain information, the ARP response mode of the Vlan sub-interface can be set, and the load balancing service can be notified externally by using ARP broadcast. When the host sends information, it broadcasts the ARP request containing the target IP address to all hosts on the local area network, and receives the return message to determine the physical address of the target; when the return message is received, the IP address and the physical address are stored in the local ARP cache and retained for a certain period of time. The ARP cache can be directly queried at the next request, thereby saving resources and avoiding repeated operations to obtain the physical address, thereby improving execution efficiency.

[0059] In an exemplary embodiment, determining the target node for broadcasting the target service includes: determining a service node where a target container group running the target service is located; and determining the target node among the service nodes.

[0060] In the above embodiment, the service node where the target container group is located may be the node where the target service backend Pod is located. If the target service backend Pod exists in the current node, the target node is determined based on this. By determining the node where the target service backend Pod is located, the target node can be quickly confirmed.

[0061] In an exemplary embodiment, determining the target node in the service node includes: determining the node name of each node included in the service node; sorting the node names to obtain a set of notifiable nodes; determining a target length of the set of notifiable nodes; concatenating the target application space and the service name of the target service into a name field; and determining the target node based on the target length, the name field, and the set of notifiable nodes.

[0062] In the above embodiment, the target node can be the main notification node. According to the node where the target service backend Pod is located, the notification node set is sorted according to the node name, and the node set length can be recorded as lennode. For example, when the channel node set includes N nodes, the target length can be considered to be N. Concatenating the target application space and the service name of the target service point can include connecting the name of the target application space with the service name to obtain a name field. For example, the service namespace and the service name are assembled as a key, that is, the name field. By determining the notification node in the notification node set to perform subsequent execution tasks, the tediousness caused by multiple nodes executing tasks can be reduced, the number of errors can be reduced, and efficiency can be improved.

[0063] In an exemplary embodiment, determining the target node based on the target length, the name field, and the notifiable node set includes: determining a target value of the name field; determining a remainder of dividing the target value by the target length; and determining a node in the notifiable node set whose sequence number is the remainder as the target node.

[0064] In the above embodiment, the selection of the notification node can be realized by the hash strategy, as shown in the following formula: res = hashcode (service namespace + service name) % lennode, where service namespace and service name represent the target service application space and the target service name are connected to obtain the name field, and hashcode (service namespace + service name) represents the target value of the name field; lennode represents the length of the notification node set. For example, if the target value of the target service is A and the length of the notification node set is B, then the remainder obtained by dividing A by B is the position of the target node, which can realize fast access to the entire notification set node.

[0065] In the above embodiment, controlling the target node to broadcast the target service may be performed by the MultiLB Daemon component. Figure 6 FIG. 1 is a flowchart of controlling a target node to notify a target service according to a specific embodiment of the present invention. Figure 6 As shown, the process includes:

[0066] Step S602, parameter analysis;

[0067] Step S604, obtain CRD / namespace / service;

[0068] Step S606, determine whether LoadBalance has an IP address, if yes, execute step S608, if no, execute step S624;

[0069] Step S608, obtaining the Vlan isolation domain information of the IP address pool where the service is located;

[0070] Step S610, determine whether there is a Vlan sub-interface, if yes, execute step S616, if no, execute step S612;

[0071] Step S612, common Vlan sub-interface;

[0072] Step S614, enable the VLAN sub-interface arp broadcast no-response capability;

[0073] Step S616, determine whether there is a Service backend Pod on this node, if yes, execute step S618, if no, execute step S624;

[0074] Step S618, Service hash master selection strategy;

[0075] Step S620, determining whether the node is the Service notification master node, if yes, executing step S622, if no, executing step S624;

[0076] Step S622, sending arp broadcast via Vlan sub-interface;

[0077] Step S624, end the service processing flow.

[0078] In the above embodiment, MutiLB daemon implements external notification of load balancing service, and deploys files in the form of Daemonset. During deployment, the address of Kubernetes apiServer, health check port, log level, notification network card and other parameters can also be configured through the deployment file. Among them, Daemonset is a controller object in the K8s cluster, which is used to run a target Pod on each node in the K8s cluster. That is, when Daemonset is created, the system will automatically schedule all Pods to qualified nodes to ensure that there is only one target Pod on each node.

[0079] In the above embodiment, MultiLB Controller parses the configuration parameters at startup. To solve the problem of inconsistent node network card names in the Kubernetes cluster, the announcement network card can support setting multiple network card names. For example, the setting format can be prefer-announce-vlan-interfaces: ens192, ens12, ens3. According to the order of network card configuration from left to right, if this network card exists on the node, this network card will be used as the parent network card of the vlan sub-interface. The MultiLB Controller plug-in obtains the List / watch CRD / namespace / service resource and performs tuning processing on each resource. The type of the service resource obtained is judged. If the target service type is LoadBalancer and the IP address has been successfully allocated, the IP address pool and VLAN isolation domain information of the IP address are obtained according to the IP address allocated by the service. If the type of the service resource does not match, the process ends. After obtaining the VLAN isolation domain information, the network card name of the vlan sub-interface is constructed in the form of vlan+vlan isolation domain ID, and the kernel protocol stack is searched for whether the vlan sub-interface exists. If it does not exist, the kernel interface is called, the sub-interface is created, and the arp broadcast and processing capabilities of the vlan sub-interface are called. If it exists, the node judgment step is directly entered. Determine whether there is a backend Pod for the service at this node. If not, end the process. If it exists, select the notification node according to the hash strategy. After selecting the notification node, determine whether this node is the notification node of the service. If not, end the process. If yes, send arp broadcast information through the vlan sub-interface to complete the external notification process of the load balancing service IP. In an exemplary embodiment, before determining the target configuration parameters of the target service, the method also includes: receiving the configuration parameters input by the target tenant; verifying the configuration parameters to obtain the target verification result; when the target verification result indicates that the configuration parameters are legal, determine the configuration parameters as the target configuration parameters.

[0080] In the above embodiment, the target tenant can input configuration parameters through the interface of the cloud platform management system. The structural diagram of the cloud platform management system can be found in the attached Figure 7 ,like Figure 7As shown, the cloud platform management system can include a log module, a resource configuration module, a resource management module, and a resource delivery module. By configuring the load balancing service on the cloud management platform, the IP management and full-link network isolation capabilities of the load balancing service between multiple tenants can be easily realized. The configuration and parameter verification of the load balancing IP address pool by the tenant can be implemented through the resource configuration module. The resource configuration module can provide a resource configuration interface for the tenant, and determine the configuration parameters as the target configuration parameters after verifying that the configuration parameters are legal. The accuracy of the data can be discovered in time to facilitate the execution of subsequent steps. Among them, the multi-tenant load balancing plug-in can realize the configuration of the binding relationship between the load balancing IP address pool and the tenant address pool by defining two types of CRD resources: ipaddresspool and tenantbindpool.

[0081] In the above embodiment, the cloud platform management system may also include a resource management module and a resource distribution module. The resource management module mainly realizes the dynamic association and management of tenant resources, including: dynamic update of tenant network policies, application spaces and other resources. Among them, network policies are an important means to achieve east-west access isolation of multi-tenant networks and ensure network isolation between tenants. Among them, east-west access isolation can be to isolate mutual access between tenants in the same container. The implementation process of the resource management module is as follows: Figure 8 As shown, the tenant's configuration file, application space and network policy are obtained, and the tenant's network policy and application space annotation information are dynamically updated to ensure that the network of the tenant's business and the configured IP address pool is reachable and has access restrictions with other tenants, and the information of the load balancing address pool bound to the application space is added to the application space in the form of annotations.

[0082] In the aforementioned embodiment, the resource delivery module is used to implement the verification and delivery of CRD resources (user-defined resources). The legitimacy of the CRD resources is verified by dryRun. If legal, they are delivered to the Kubernetes cluster to implement persistent storage of tenant configurations and configuration access of multi-tenant load balancing plug-ins. If illegal, the log returns an error message. Among them, dryRun means preloading and pre-running data to verify the role of resources. After the tenant completes the parameter configuration, the resources are configured, verified, and delivered, and the MultiLB Controller plug-in can receive the target configuration parameters and perform subsequent operations according to the target configuration parameters. In an exemplary embodiment, verifying the configuration parameters to obtain a target verification result includes: verifying the network address pool included in the configuration parameters to obtain a first verification result; verifying the uniqueness of the virtual local area network isolation domain included in the configuration parameters to obtain a second verification result; verifying the attribution of the application space included in the configuration parameters to obtain a third verification result; if the first verification result, the second verification result, and the third verification result all pass, determining that the target verification result is that the configuration parameters are legal; if there is a failed verification result among the first verification result, the second verification result, and the third verification result, determining that the target verification result is that the configuration parameters are illegal.

[0083] In the above embodiment, the configuration parameters may include the available IP address range, the VLAN isolation domain, and the affinity of the application space. The configuration parameter verification process can be found in the attached Fig. 9 . The first verification result indicates the result of the legality check of the load balancing IP address pool, the second verification result indicates the result of the uniqueness check of the Vlan isolation domain, and the third verification result indicates the result of the application space attribution check. When the first verification result, the second verification result, and the third verification result all pass the verification, it is determined that the configuration parameters are legal and then the configuration file is generated. When any of the three verification results fails the verification, an error message is returned. By verifying the configuration parameters, it can be ensured that the cloud management platform has no error messages.

[0084] In an exemplary embodiment, the verifying the network address pool included in the configuration parameters to obtain a first verification result includes: verifying the format of the address included in the network address pool; when the format is legal, determining the first verification result as a passed verification; when the format is illegal, determining the second verification result as a failed verification.

[0085] In the above embodiment, the legality of the load balancing IP address pool can be determined by checking the IP address format input by the user. If the format is legal, it is determined that the configuration parameters have passed the verification. If the format is illegal, it is determined that the configuration parameters have not passed the verification, and an error message is returned to the log module to record and prompt the user that the IP address format input is incorrect. By prompting the user, the user can quickly understand the error, make corrections and continue to perform the service.

[0086] In an exemplary embodiment, the verification of the uniqueness of the virtual local area network isolation domain included in the configuration parameters to obtain a second verification result includes: determining whether the virtual local area network isolation domain belongs only to the target tenant; when the virtual local area network isolation domain belongs only to the target tenant, determining that the second verification result is a passed verification; when the virtual local area network isolation domain belongs to multiple tenants, determining that the second verification result is a failed verification.

[0087] In the above embodiment, the Vlan isolation domain (i.e., the above-mentioned virtual local area grid isolation domain) is the basis for realizing the north-south access isolation of multiple tenants, and the tenant can specify the Vlan isolation domain to be used according to the physical network. The verification principle of the Vlan isolation domain can be that one tenant has one Vlan isolation domain, or one tenant has multiple Vlan isolation domains, but one Vlan isolation domain can only belong to one tenant. If the Vlan isolation domain configuration is illegal (i.e., the Vlan isolation domain belongs to multiple tenants), the second verification result fails and an error message is returned. Among them, north-south access isolation means isolation of the external network. The isolation of the intranet and the extranet can be achieved through the Vlan isolation domain, which ensures that the load balancing IP: Port is accessed through a client outside the Kubernetes cluster, and the load balancing service access is successful. The load balancing IP: Port is accessed through a client outside other Kubernetes clusters, and the load balancing service access fails.

[0088] In an exemplary embodiment, the verification of the attribution of the application space included in the configuration parameters to obtain a third verification result includes: determining the attribution of the application space; when the attribution indicates that the application space belongs to the target tenant, determining that the third verification result is a passed verification; when the attribution indicates that the application space does not belong to the target tenant, determining that the third verification result is a failed verification.

[0089] In the above embodiment, attribution can be understood as the association between the IP address pool configured by the tenant and the application space, and the tenant can verify the application space. A tenant can have multiple application spaces. If the tenant configures the attribution of the IP address pool and the application space, it is verified whether the application space belongs to this tenant (that is, the third verification result mentioned above). If the attribution configuration of the application space is illegal, an error message is returned to the log module and recorded. This verification behavior also ensures that the tenants belonging to this client can access the load balancing service normally, excluding tenants other than the client.

[0090] In a specific embodiment, a MultiLB plug-in is developed, including a MultiLB controller and a MultiLBdaemon module, and an image is built; the MultiLB Controller and Daemon images are pulled from the HUB; a yaml file is written, key parameters such as the apiserver, health check port, log level, and notification network card are set, and the deployment of the MultiLB component is completed; the Controller and Daemon components of MultiLB are checked to see if they are in the Running state, and the component logs are checked to ensure that the components are running normally; the load balancing IP address pool information is configured through the cloud management platform, including the available IP address range, VLAN isolation domain, and namespace affinity, and the configuration data is submitted to ensure that there is no error information on the cloud management platform; check whether Kubernetes has successfully created the corresponding ipaddresspool and tenantbindpool resources, and check whether the corresponding namespace has been successfully annotated; a load balancing service is created through the cloud management platform; after the load balancing service is successfully created, check whether the service is successfully assigned to the load balancing IP. If the IP address is not successfully assigned, check the MultiLBcontroller log file to analyze the cause of the failure; if the load balancing address is successfully assigned, check whether the Kubernetes node has successfully created the VLAN sub-interface, and check whether the MultiLB Daemon logs ensure that the load balancing service IP address is successfully notified; when a client outside the Kubernetes cluster of this tenant accesses the load balancing IP:Port, the load balancing service is successfully accessed; when a client outside the Kubernetes cluster of another tenant accesses the load balancing IP:Port, the load balancing service fails to access.

[0091] In an exemplary embodiment, when deploying a target service for a target tenant, the configuration parameters of the target service can be determined, wherein the configuration parameters include the target type of the client that is allowed to access the target service after the target service is deployed, and the configuration parameters also include the deployment address of the target service, the target service is deployed to the deployment address, and the access rights of the target service are set according to the target type of the client, and the access rights are for allowing the client of the target type to access the target service. In this embodiment, the access rights of the target service can be directly set when deploying the target service. After the target service is deployed, only clients with access rights can access the target service, and clients without access rights are not allowed to access the target service, thereby achieving access isolation for tenants.

[0092] In the above embodiment, when the target client accesses the target service, an access request may be sent to the target service, and the access request may carry identification information of the target client, and the identification information includes the tenant to which the target client belongs, the type of the target client, and the access rights of the target client. The target container may identify the identification information and determine whether the target client is allowed to access the target service. If so, the target client is allowed to access the target service. If not, a prompt message indicating that access is prohibited is returned to the client.

[0093] In the above embodiment, the access rights of the target service can be directly set when deploying the target service. After the target service is deployed, only clients with access rights can access the target service, and clients without access rights are not allowed to access the target service, thereby achieving access isolation of tenants and improving the security of user services.

[0094] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0095] In this embodiment, a deployment device for an application is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0096] Fig.10 is a structural block diagram of a deployment device for an application according to an embodiment of the present application, such as Fig.10 As shown, the device comprises:

[0097] A first determination module 1002 is used to determine target configuration parameters of a target service, wherein the target configuration parameters are used to configure a network address and a virtual local area network isolation domain for the target service in a target container;

[0098] A second determination module 1004 is used to determine a target application space for running the target service;

[0099] The third determination module 1006 is used to determine the target network address pool and the target virtual local area network isolation domain included in the target configuration parameters and associated with the target application space, wherein the target virtual local area network isolation domain is a virtual local area network isolation domain allocated to the target tenant to which the target service belongs, and the target virtual local area network isolation domain is only used to deploy services belonging to the target tenant;

[0100] The deployment module 1008 is used to allocate a target network address to the target service from the target network address pool, and deploy the target service to the target virtual local area network isolation domain according to the target network address.

[0101] In an exemplary embodiment, the apparatus may be used to, after deploying the target service in the target virtual local area network isolation domain according to the target network address: determine a target node for broadcasting the target service; and control the target node to broadcast the target service.

[0102] In an exemplary embodiment, the device can control the target node to broadcast the target service in the following manner: create a virtual local area network isolation domain sub-interface based on the target network address of the target service and the target virtual local area network isolation domain; set the response mode of the virtual local area network isolation domain sub-interface; control the target node to broadcast the target service through the response mode.

[0103] In an exemplary embodiment, the apparatus may determine the target node for broadcasting the target service in the following manner: determine a service node where a target container group running the target service is located; and determine the target node among the service nodes.

[0104] In an exemplary embodiment, the device can determine the target node in the service node in the following manner: determine the node name of each node included in the service node; sort the node names to obtain a set of notifiable nodes; determine the target length of the set of notifiable nodes; concatenate the target application space and the service name of the target service into a name field; and determine the target node based on the target length, the name field, and the set of notifiable nodes.

[0105] In an exemplary embodiment, the device can implement the determination of the target node based on the target length, the name field and the notifiable node set in the following manner: determine the target value of the name field; determine the remainder of the target value divided by the target length; and determine the node included in the notifiable node set whose sequence number is the remainder as the target node.

[0106] In an exemplary embodiment, the device can also be used to, before determining the target configuration parameters of the target service: receive the configuration parameters input by the target tenant; verify the configuration parameters to obtain a target verification result; and determine the configuration parameters as the target configuration parameters when the target verification result indicates that the configuration parameters are legal.

[0107] In an exemplary embodiment, the device can implement the verification of the configuration parameters and obtain the target verification result in the following manner: verify the network address pool included in the configuration parameters to obtain a first verification result; verify the uniqueness of the virtual local area network isolation domain included in the configuration parameters to obtain a second verification result; verify the attribution of the application space included in the configuration parameters to obtain a third verification result; if the first verification result, the second verification result and the third verification result are all passed, determine that the target verification result is that the configuration parameters are legal; if there is a failed verification result among the first verification result, the second verification result and the third verification result, determine that the target verification result is that the configuration parameters are illegal.

[0108] In an exemplary embodiment, the device can implement the verification of the network address pool included in the configuration parameters to obtain a first verification result in the following manner: verifying the format of the address included in the network address pool; when the format is legal, determining the first verification result as verification passed; when the format is illegal, determining the second verification result as verification failed.

[0109] In an exemplary embodiment, the device can implement the verification of the uniqueness of the virtual local area network isolation domain included in the configuration parameters to obtain a second verification result in the following manner: determine whether the virtual local area network isolation domain belongs only to the target tenant; when the virtual local area network isolation domain belongs only to the target tenant, determine that the second verification result is verification passed; when the virtual local area network isolation domain belongs to multiple tenants, determine that the second verification result is verification failed.

[0110] In an exemplary embodiment, the device can implement the verification of the ownership of the application space included in the configuration parameters to obtain a third verification result in the following manner: determine the ownership of the application space; when the ownership indicates that the application space belongs to the target tenant, determine that the third verification result is a passed verification; when the ownership indicates that the application space does not belong to the target tenant, determine that the third verification result is a failed verification.

[0111] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0112] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0113] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0114] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0115] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0116] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any one of the above method embodiments are implemented.

[0117] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0118] Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0119] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for deploying an application, characterized in that: applied to a target container, the target container including an application space, the application space being used to run a service, include: Determining target configuration parameters of a target service, wherein the target configuration parameters are used to configure a network address and a virtual local area network isolation domain for the target service in a target container; Determine a target application space for running the target service; Determine a target network address pool and a target virtual local area network isolation domain included in the target configuration parameters and associated with the target application space, wherein the target virtual local area network isolation domain is a virtual local area network isolation domain allocated to a target tenant to which the target service belongs, and the target virtual local area network isolation domain is only used to deploy services belonging to the target tenant; A target network address is allocated to the target service from the target network address pool, and the target service is deployed in the target virtual local area network isolation domain according to the target network address.

2. The method according to claim 1, characterized in that After deploying the target service in the target virtual local area network isolation domain according to the target network address, the method further includes: Determining a target node for broadcasting the target service; The target node is controlled to broadcast the target service.

3. The method according to claim 2, characterized in that The controlling the target node to broadcast the target service comprises: Creating a virtual local area network isolation domain sub-interface based on the target network address of the target service and the target virtual local area network isolation domain; Setting the response mode of the virtual local area network isolation domain sub-interface; The target node is controlled to broadcast the target service through the response mode.

4. The method according to claim 2, characterized in that: The determining of a target node for broadcasting the target service comprises: Determine the service node where the target container group running the target service is located; The target node is determined among the service nodes.

5. The method according to claim 4, characterized in that The determining of the target node in the service node includes: Determine a node name of each node included in the service node; Sort the node names to obtain a notifiable node set; Determining a target length of the notifiable node set; Concatenate the target application space and the service name of the target service into a name field; The target node is determined based on the target length, the name field, and the set of advisable nodes.

6. The method according to claim 5, characterized in that The determining the target node based on the target length, the name field, and the notifiable node set includes: determining a target value for the name field; determining a remainder of dividing the target value by the target length; The node whose sequence number is the remainder and is included in the notifiable node set is determined as the target node.

7. The method according to claim 5, characterized in that Before determining the target configuration parameters of the target service, the method further includes: Receiving configuration parameters input by the target tenant; Verifying the configuration parameters to obtain a target verification result; When the target verification result indicates that the configuration parameter is legal, the configuration parameter is determined as the target configuration parameter.

8. The method according to claim 7, characterized in that The verifying the configuration parameters to obtain a target verification result includes: Verifying the network address pool included in the configuration parameters to obtain a first verification result; Verifying the uniqueness of the virtual local area network isolation domain included in the configuration parameters to obtain a second verification result; Verifying the attribution of the application space included in the configuration parameters to obtain a third verification result; When the first verification result, the second verification result, and the third verification result are all passed, determining that the target verification result is that the configuration parameters are legal; In the case that there is a failed verification result among the first verification result, the second verification result, and the third verification result, it is determined that the target verification result is that the configuration parameter is illegal.

9. The method according to claim 8, characterized in that The verifying the network address pool included in the configuration parameters to obtain a first verification result includes: Verifying the format of the addresses included in the network address pool; If the format is legal, determining the first verification result is verification passed; When the format is illegal, the second verification result is determined to be verification failure.

10. The method according to claim 8, characterized in that The verifying the uniqueness of the virtual local area network isolation domain included in the configuration parameters to obtain a second verification result includes: Determining whether the virtual local area grid isolation domain belongs only to the target tenant; In a case where the VLAN isolation domain belongs only to the target tenant, determining that the second verification result is verification passed; In a case where the virtual local area network isolation domain belongs to multiple tenants, it is determined that the second verification result is verification failure.

11. The method according to claim 8, characterized in that The verifying the attribution of the application space included in the configuration parameters to obtain a third verification result includes: Determining the attribution of the application space; In a case where the attribution indicates that the application space belongs to the target tenant, determining that the third verification result is verification passed; When the attribution indicates that the application space does not belong to the target tenant, it is determined that the third verification result is verification failure.

12. An application deployment device, characterized in that: applied to a target container, the target container including an application space, the application space being used to run a service, include: A first determination module is used to determine target configuration parameters of a target service, wherein the target configuration parameters are used to configure a network address and a virtual local area network isolation domain for the target service in a target container; A second determination module is used to determine a target application space for running the target service; A third determination module is used to determine a target network address pool and a target virtual local area network isolation domain included in the target configuration parameters and associated with the target application space, wherein the target virtual local area network isolation domain is a virtual local area network isolation domain allocated to a target tenant to which the target service belongs, and the target virtual local area network isolation domain is only used to deploy services belonging to the target tenant; A deployment module is used to allocate a target network address to the target service from the target network address pool, and deploy the target service to the target virtual local area network isolation domain according to the target network address.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method described in any one of claims 1 to 11 when executed by a processor.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method described in any one of claims 1 to 11 are implemented.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 11 are implemented.

Images