Method and device for forwarding south-north traffic of cloud native container network based on DPU (Distributed Processing Unit), and electronic equipment

Abstract

The invention provides a DPU-based cloud native container network south-north traffic forwarding method and device and electronic equipment, in the forwarding method, configuration parameters of an lrp port of a logic router GRvpc are set to guide traffic redirection in a bridging mode, the tunnel packaging process of the south-north traffic is canceled, and the forwarding speed of the south-north traffic is improved. Namely, when the current container needs to access the public network and the current container is not at the gateway DPU node, the tunnel generic / vxlan packing operation of the local DPU node of the current container and the tunnel generic / vxlan unpacking operation of the gateway DPU node are cancelled, and the computing resources, the memory resources and the network resources of the local DPU node and the gateway DPU node are released. The complexity of the ovs flow table of the south-north flow and the complexity of the hardware forwarding process are reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of communications, and in particular, to a method, device, and electronic device for forwarding north-south traffic of a cloud-native container network based on a DPU. Background Art

[0002] A DPU (Data Processing Unit, data processing unit or dedicated data processor) is a new generation of computing chip that is data-centric, I / O-intensive, and uses a software-defined technology route to support virtualization of the infrastructure resource layer. It has the capabilities of improving the efficiency of the computing system, reducing the total cost of ownership of the overall system, enhancing data processing performance, and reducing the performance loss of other computing chips.

[0003] Container cloud is a cloud service product realized by deploying container services on cluster servers through docker technology. Container cloud is a cloud delivery mode at the PaaS layer. Container cloud can be deployed in two ways: one is to deploy containers on virtual machines (in many traditional enterprises, containers are deployed on virtual machines); the other method is to directly deploy containers on bare-metal servers. The reason for deploying containers to virtual machines is that they require the isolation and security features of virtual machines. In fact, in order to achieve the same effect, virtual machines do not need to be used, or with the development of technology, these problems may be solved in containers.

[0004] Kubernetes is a portable and extensible open-source platform for managing containerized workloads and services, which can promote declarative configuration and automation. Kubernetes has a large and rapidly growing ecosystem, and the scope of use of its services, support, and tools is quite extensive.

[0005] In the current network architecture solution of K8S (i.e., Kubernetes), as Figure 1 shown, when the current container (such as pod2) needs to access the external network (i.e., north-south traffic), and the current container is not on the gateway node (referring to the gateway DPU node, i.e., the node1 node), the traffic goes through Figure 1The blue line in goes from the vf of DPU-HOST at node2 to the vfr of DPU-SOC, and then to the port of ovn-xx-0 on br-int of ovs (open-source multi-layer virtual switch) for geneve / vxlan tunnel encapsulation. It is transmitted through the tunnel to port p0, and then through the switch to port p0 of the gateway node (i.e., node1). It is transmitted through the tunnel to ovn-xx-0 of the gateway node. Ovn-xx-0 performs geneve / vxlan decapsulation operation, and then matches the corresponding NAT rules. Then, it goes through the patch port of br-int of the gateway node to br-out bridge, and finally through port p0 of the gateway node to the switch and then to the public network.

[0006] It can be seen that the above process requires geneve / vxlan encapsulation to be done locally (i.e., at node2), and the traffic is transmitted through the tunnel port to the gateway node (i.e., node1). After the gateway node receives the traffic from the tunnel port, it performs decapsulation operation, and then sends it to the external network through the patch port of ovs on the local (i.e., node1). In this process, it is necessary to perform geneve / vxlan packet encapsulation operation on the DPU-SOC of the local container (i.e., node2), which occupies the computing and network resources of the local DPU, and the gateway node (i.e., node1) needs to perform geneve / vxlan packet decapsulation operation, which also occupies the computing and network resources of the gateway DPU.

[0007] In summary, there is a technical problem of wasting DPU computing and network resources in the north-south traffic forwarding of traditional DPU-based cloud-native container networks. Summary of the Invention

[0008] In view of this, the purpose of the present invention is to provide a method, device and electronic device for forwarding north-south traffic of a DPU-based cloud-native container network, so as to alleviate the technical problem of wasting DPU computing and network resources in the north-south traffic forwarding of traditional DPU-based cloud-native container networks.

[0009] In the first aspect, an embodiment of the present invention provides a method for forwarding north-south traffic of a DPU-based cloud-native container network, which is applied to a network management component. The network management component sets the configuration parameters of the lrp port of the logical router GR_vpc to guide traffic redirection through bridging. The method includes:

[0010] When it is recognized that the current container needs to access the public network and the current container is not on the gateway DPU node, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node;

[0011] The traffic of the current container continues to pass through the patch port of the local DPU node to the br-out bridge, and then reaches the switch through the p0 network port of the br-out bridge;

[0012] The traffic of the current container then reaches the p0 network port of the gateway DPU node, and then reaches the br-out bridge of the gateway DPU node and is transferred to the br-int bridge through the patch port;

[0013] The traffic of the current container matches the corresponding NAT rule, and then passes through the patch port of the br-int of the gateway DPU node to the br-out bridge, and reaches the public network through the p0 network port of the gateway DPU node and then the switch.

[0014] Further, the method further includes:

[0015] When it is recognized that the current container needs to access another container, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node;

[0016] Perform geneve / vxlan packet encapsulation operation on the traffic of the current container at the ovn-xxx-0 port of the br-int bridge to obtain the encapsulated traffic;

[0017] The encapsulated traffic reaches the p0 network port of the local DPU node through the tunnel, then reaches the switch, and further reaches the DPU node of the other container;

[0018] At the p0 network port of the DPU node of the other container, it reaches the br-int bridge of the DPU node of the other container through the tunnel. The ovn-xxx-0 port of the br-int bridge performs geneve / vxlan decapsulation operation on the encapsulated traffic to obtain the traffic of the current container;

[0019] The traffic of the current container reaches the other container through the vfr and vf of the DPU node of the other container.

[0020] Further, before the network management component sets the configuration parameters of the lrp port of the logical router GR_vpc to direct traffic redirection in a bridging manner, the method further includes:

[0021] Create the logical router GR_vpc and configure multiple DPU nodes for the logical router GR_vpc.

[0022] Further, the guidance of traffic redirection through bridging includes: redirect-type=bridged, reside-on-redirect-chassis="true".

[0023] Further, the logical router GR_vpc includes: a br-int bridge, and the br-int bridge includes: an ovn-xxx-0 port, a patch port, a br-out bridge, a p0 network port, and a vfr.

[0024] Further, the logical router GR_vpc and the container are hosted on a DPU node.

[0025] In a second aspect, an embodiment of the present invention further provides a forwarding device for north-south traffic of a cloud-native container network based on a DPU, which is applied to a network management component. The network management component sets the configuration parameters of the lrp port of the logical router GR_vpc to guide traffic redirection in a bridging manner. The device includes:

[0026] A first forwarding unit, configured to, when it is recognized that the current container needs to access the public network and the current container is not on the gateway DPU node, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node;

[0027] A second forwarding unit, configured to continue the traffic of the current container to the br-out bridge through the patch port of the local DPU node, and the traffic goes to the p0 network port through the br-out bridge to reach the switch;

[0028] A third forwarding unit, configured to further forward the traffic of the current container to the p0 network port of the gateway DPU node, and then to the br-out bridge of the gateway DPU node and reach the br-int bridge through the patch port;

[0029] A fourth forwarding unit, configured to match the traffic of the current container with the corresponding NAT rule, and then reach the br-out bridge through the patch port of the br-int of the gateway DPU node, and reach the public network through the p0 network port of the gateway DPU node, the switch.

[0030] Further, the device is also configured to:

[0031] When it is recognized that the current container needs to access another container, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node;

[0032] Perform geneve / vxlan packet encapsulation operation on the traffic of the current container at the ovn-xxx-0 port of the br-int bridge to obtain the encapsulated traffic;

[0033] The encapsulated traffic reaches the p0 network port of the local DPU node through the tunnel, then reaches the switch, and further reaches the DPU node of the other container;

[0034] At the p0 network port of the DPU node of the other container, it reaches the br-int bridge of the DPU node of the other container through the tunnel. The ovn-xxx-0 port of the br-int bridge performs geneve / vxlan decapsulation operation on the encapsulated traffic to obtain the traffic of the current container;

[0035] The traffic of the current container reaches the other container through the vfr and vf of the DPU node of the other container.

[0036] In a third aspect, an embodiment of the present invention further provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the steps of the method according to any one of the above first aspects are implemented.

[0037] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium. The computer-readable storage medium stores machine-executable instructions. When the machine-executable instructions are called and run by the processor, the machine-executable instructions cause the processor to run the method according to any one of the above first aspects.

[0038] In an embodiment of the present invention, a method for forwarding north-south traffic of a cloud-native container network based on a DPU is provided, which is applied to a network management component. The network management component sets the configuration parameters of the lrp port of the logical router GR_vpc to guide traffic redirection through bridging. The method includes: when it is recognized that the current container needs to access the public network and the current container is not on the gateway DPU node, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node; the traffic of the current container continues to reach the br-out bridge through the patch port of the local DPU node, and reaches the switch through the p0 network port of the br-out bridge; the traffic of the current container then reaches the p0 network port of the gateway DPU node, and then reaches the br-int bridge of the gateway DPU node through the patch port of the br-out bridge; the traffic of the current container matches the corresponding NAT rule, and then reaches the br-out bridge through the patch port of the br-int of the gateway DPU node, and reaches the public network through the p0 network port of the gateway DPU node and then through the switch. From the above description, it can be seen that in the method for forwarding north-south traffic of the cloud-native container network based on a DPU of the present invention, by setting the configuration parameters of the lrp port of the logical router GR_vpc to guide traffic redirection through bridging, the tunnel encapsulation process of north-south traffic is cancelled, that is, when the current container needs to access the public network and the current container is not on the gateway DPU node, the tunnel geneve / vxlan packet encapsulation operation of the local DPU node of the current container and the tunnel geneve / vxlan packet decapsulation operation of the gateway DPU node are cancelled, releasing the computing resources, memory resources and network resources of the local DPU node and the gateway DPU node, reducing the complexity of the ovs flow table for north-south traffic and reducing the complexity of the hardware forwarding process, and alleviating the technical problem of waste of DPU computing and network resources in the traditional north-south traffic forwarding of the cloud-native container network based on a DPU. Description of the Drawings

[0039] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings required for the description of the specific embodiments or the prior art. Obviously, the following drawings are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0040] Figure 1 Schematic diagram of the forwarding of east-west traffic and north-south traffic provided by the traditional technology;

[0041] Figure 2 Flowchart of a method for forwarding north-south traffic of a cloud-native container network based on a DPU provided by an embodiment of the present invention;

[0042] Figure 3 It is a forwarding schematic diagram of east-west traffic and north-south traffic provided by an embodiment of the present invention;

[0043] Figure 4 It is a logical schematic diagram of the K8S network architecture provided by an embodiment of the present invention;

[0044] Figure 5 It is a schematic diagram of a forwarding device for north-south traffic of a cloud-native container network based on DPU provided by an embodiment of the present invention;

[0045] Figure 6 It is a schematic diagram of an electronic device provided by an embodiment of the present invention. Detailed implementation manners

[0046] Next, the technical solutions of the present invention will be clearly and completely described in conjunction with the embodiments. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0047] The traditional forwarding of north-south traffic in a cloud-native container network based on DPU wastes DPU computing and network resources.

[0048] Based on this, in the method for forwarding north-south traffic of a cloud-native container network based on DPU of the present invention, by setting the configuration parameters of the lrp port of the logical router GR_vpc to guide traffic redirection through bridging, the tunneling encapsulation process of north-south traffic is cancelled, that is, when the current container needs to access the public network and the current container is not on the gateway DPU node, the tunneling geneve / vxlan packet encapsulation operation of the local DPU node of the current container and the tunneling geneve / vxlan decapsulation operation of the gateway DPU node are cancelled, releasing the computing resources, memory resources and network resources of the local DPU node and the gateway DPU node, reducing the complexity of the ovs flow table of north-south traffic and reducing the complexity of the hardware forwarding process.

[0049] For the convenience of understanding this embodiment, first, a method for forwarding north-south traffic of a cloud-native container network based on DPU disclosed in the embodiments of the present invention will be introduced in detail.

[0050] Embodiment 1:

[0051] According to an embodiment of the present invention, an embodiment of a method for forwarding north-south traffic of a cloud-native container network based on a DPU is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. And although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than here.

[0052] Figure 2 FIG. is a flowchart of a method for forwarding north-south traffic of a cloud-native container network based on a DPU according to an embodiment of the present invention. As Figure 2 shown, the method includes the following steps:

[0053] Step S202, when it is recognized that the current container wants to access the public network and the current container is not on the gateway DPU node, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node;

[0054] In an alternative embodiment of the present invention, the above forwarding method can be applied to a network management component, specifically ovn-kubernetes cni. Configure the OVS (virtual switch) on the DPU SOC of the DPU node to cancel the geneve / vxlan tunnel encapsulation operation for north-south traffic, that is, the network management component sets the configuration parameters of the lrp port of the logical router GR_vpc to direct traffic redirection in a bridging manner.

[0055] After the configuration parameters are set, referring to Figure 3 , when it is recognized that the current container, such as the pod2 container, wants to access the public network (i.e., north-south traffic) and the current container is not on the gateway DPU node (i.e., node1:dpu001), the traffic of the current container follows the blue line. The traffic of the current container reaches the br-int bridge of the local DPU node (i.e., node2:dpu002) through the vf and vfr of the local DPU node.

[0056] Step S204, the traffic of the current container continues to reach the br-out bridge through the patch port of the local DPU node, and reaches the switch through the p0 network port of the br-out bridge;

[0057] Specifically, as Figure 3 shown, the traffic of the current container continues to reach the br-out bridge through the patch port, and reaches the switch through the p0 network port of the br-out bridge.

[0058] Step S206, the traffic of the current container then reaches the p0 network port of the gateway DPU node, and then reaches the br-out bridge of the gateway DPU node and reaches the br-int bridge through the patch port;

[0059] Specifically, as Figure 3 shown, the traffic of the current container goes to the p0 network interface of the gateway DPU node (node1:dpu001), and then to the br-out bridge of the gateway DPU node through the patch port and then to the br-int bridge.

[0060] Step S208, the traffic of the current container matches the corresponding NAT rule, and then goes to the br-out bridge through the patch port of br-int of the gateway DPU node, and goes to the switch and then to the public network through the p0 network interface of the gateway DPU node.

[0061] Specifically, as Figure 3 shown, on the br-int bridge, the traffic of the current container matches the corresponding NAT rule, and then goes to the br-out bridge through the patch port of br-int of the gateway DPU node, and goes to the switch and then to the public network through the p0 network interface of the gateway DPU node, thus completing the forwarding process of the traffic of the current container to the public network.

[0062] The following explains some technical abbreviations involved in the above process:

[0063] DPU is short for Data Processing Unit. It is a major category of newly developed dedicated processors. After the CPU and GPU, it is the third important computing power chip in the data center scenario, providing a computing engine for high-bandwidth, low-latency, data-intensive computing scenarios.

[0064] Kubernetes, also known as K8s, is an open-source system for automatically deploying, scaling, and managing containerized applications. It combines the containers that make up an application into logical units for easy management and service discovery. Kubernetes originates from Google's 15-year operation and maintenance experience in the production environment and also incorporates the best ideas and practices of the community.

[0065] A Pod is the smallest basic unit of deployment and management in a kubernetes cluster, with coordinated addressing and scheduling. A Pod is a collection of one or more containers and an abstract collection of one or a group of services (processes). In a Pod, the network and storage can be shared (which can be simply understood as a logically virtual machine, but it is not a virtual machine).

[0066] Linux containers provide a lightweight virtualization method and can run multiple virtual environments (containers) on a single host at the same time. In technologies such as Xen or KVM, the processor simulates the entire hardware environment and the hypervisor controls the virtual machines. In contrast, containers provide virtualization at the operating system level, where the kernel controls the isolated containers.

[0067] The CNI (Container Network Interface), simply referred to as CNI, is a project under the CNCF. It consists of a set of specifications and libraries for configuring the network interfaces of Linux containers, and also includes some plugins. CNI only concerns the network allocation when a container is created and the release of network resources when the container is deleted.

[0068] OVN (Open Virtual Network) is an open-source project that provides software-defined network (SDN) capabilities, especially for use in conjunction with Open vSwitch (OVS). OVN provides powerful virtual network functions such as logical switching, logical routing, firewall rules, and load balancing. The distributed gateway is an important concept in OVN, aiming to provide efficient and reliable network connections, especially in large-scale distributed environments.

[0069] The basic concept of the distributed gateway

[0070] Logical router: In OVN, the logical router is responsible for forwarding traffic between different logical switches. It is equivalent to a virtual router and can implement packet routing between different virtual networks.

[0071] Distributed gateway: A distributed gateway refers to distributing the gateway function to multiple computing nodes rather than concentrating it on a single node. This architecture helps to improve the scalability and reliability of the network, while reducing network bottlenecks and single points of failure.

[0072] VPC, or Virtual Private Cloud

[0073] Isolation: VPC allows users to create an isolated network environment in the cloud, ensuring that the user's resources are isolated from those of other users.

[0074] IP address range: Users can choose the IP address range to be assigned to the VPC, defining the IP address space of the internal network of the VPC.

[0075] Subnet: The VPC can be divided into multiple subnets, and each subnet can be associated with different Availability Zones to improve high availability.

[0076] Route table: Users can configure the route table within the VPC to define the routing rules for network traffic.

[0077] Security group and network ACL: Security groups and network access control lists (ACLs) are used to control the traffic in and out of the VPC to ensure network security.

[0078] Cloud service connection: The VPC allows connections to other cloud services, such as cloud databases, load balancers, etc.

[0079] VPN connection: The VPC supports establishing a secure connection through a Virtual Private Network (VPN) to connect the on-premises data center with the VPC in the cloud.

[0080] Scalability in the cloud: Users can expand resources in the VPC as needed, such as adding subnets, adjusting the IP address range, connecting different VPCs, etc.

[0081] Monitoring and logging: The VPC provides monitoring and logging services to help users monitor network traffic, events, and performance.

[0082] OVN-Kubernetes CNI (Container Network Interface): In solutions such as cloud-native network traffic offloading, extreme-speed containers, and cloud platforms, it provides the default POD-to-Service network communication capability for Kubernetes clusters and offloads Kubernetes network traffic to the DPU, thereby providing extremely low latency and high-bandwidth network forwarding performance for upper-layer applications.

[0083] PF: Physical Function. An Ethernet physical controller that supports the SR-IOV protocol.

[0084] VF: Virtual Function. A virtual PCIe device created from a physical Ethernet controller.

[0085] PFR: The PF Representor is a virtual port on the DPU side of the port of the physical function PF used to connect to the OVS bridge.

[0086] VFR: The VF Representor is a virtual port on the DPU side of the port of the virtual function VF used to connect to the OVS bridge.

[0087] Uplink R: The Uplink Representor is a virtual port on the DPU side of the Uplink port used to connect to the OVS bridge.

[0088] SR-IOV: Single Root I / O Virtualization, a single-root virtualization technology that provides independent memory space, interrupts, DMA data streams, etc. for virtualized devices.

[0089] DPU: Data Process Unit, a data processing unit that integrates a network card, a central processing unit, and hardware offloading, and can perform various network traffic offloading.

[0090] DPU Host: A server / machine / system that connects to the DPU through a PCIe port.

[0091] DPU Soc: A machine / system on the DPU network card.

[0092] K8s: Kubernetes container orchestration and management system.

[0093] OVS: Open virtual switch is an open-source multi-layer virtual switch.

[0094] Multus: Multus is a meta-plugin that allows pods to have multiple network interfaces.

[0095] LRP: Refers to Logical Router Port, that is, the logical router port. The logical router port is a logical network component in OVN, used to connect the communication between the logical router and the logical switch or logical port. The LRP has an IP address and can be configured on the logical router to achieve packet routing between different subnets in the virtual network.

[0096] geneve / vxlan encapsulation: OVS (Open vSwitch) supports multiple tunnel encapsulation protocols, including VXLAN (Virtual Extensible LAN) and Geneve (Generic Network Virtualization Encapsulation). These protocols are used to encapsulate layer 2 network traffic in layer 3 IP packets, thereby achieving cross-network virtual network connections.

[0097] In an embodiment of the present invention, a method for forwarding north-south traffic of a cloud-native container network based on a DPU is provided, which is applied to a network management component. The network management component sets the configuration parameters of the lrp port of the logical router GR_vpc to guide traffic redirection through bridging. The method includes: when it is recognized that the current container needs to access the public network and the current container is not on the gateway DPU node, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node; the traffic of the current container continues to reach the br-out bridge through the patch port of the local DPU node, and reaches the switch through the p0 network port of the br-out bridge; the traffic of the current container then reaches the p0 network port of the gateway DPU node, and then reaches the br-int bridge of the gateway DPU node through the patch port of the br-out bridge of the gateway DPU node; the traffic of the current container matches the corresponding NAT rule, and then reaches the br-out bridge through the patch port of the br-int of the gateway DPU node, and reaches the public network through the p0 network port of the gateway DPU node to the switch. Through the above description, it can be seen that in the method for forwarding north-south traffic of the cloud-native container network based on a DPU of the present invention, by setting the configuration parameters of the lrp port of the logical router GR_vpc to guide traffic redirection through bridging, the tunnel encapsulation process of north-south traffic is cancelled, that is, when the current container needs to access the public network and the current container is not on the gateway DPU node, the tunnel geneve / vxlan packet encapsulation operation of the local DPU node of the current container and the tunnel geneve / vxlan decapsulation operation of the gateway DPU node are cancelled, releasing the computing resources, memory resources and network resources of the local DPU node and the gateway DPU node, reducing the complexity of the ovs flow table of north-south traffic and reducing the complexity of the hardware forwarding process, and alleviating the technical problem of waste of DPU computing and network resources in the north-south traffic forwarding of the traditional cloud-native container network based on a DPU.

[0098] The above briefly introduces the method for forwarding north-south traffic of the cloud-native container network based on a DPU of the present invention, and the following will describe the specific content involved in detail.

[0099] In an alternative embodiment of the present invention, the method further includes the following steps:

[0100] (1) When it is recognized that the current container needs to access another container, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node;

[0101] Specifically, as Figure 3As shown, when POD / VM (containers) need to access each other (east-west traffic), that is, when the current container (such as pod2) needs to access another container (pod1), the traffic of the current container follows the red line. The traffic of the current container reaches the br-int bridge of the local DPU node (i.e., node2:dpu002) through the vf and vfr of the local DPU node.

[0102] (2) Perform geneve / vxlan packet encapsulation operation on the traffic of the current container at the ovn-xxx-0 port of the br-int bridge to obtain the encapsulated traffic.

[0103] (3) The encapsulated traffic reaches the p0 network port of the local DPU node through the tunnel, then reaches the switch, and further reaches the DPU node of another container.

[0104] Specifically, refer to Figure 3 , the DPU node of another container (i.e., node1:dpu001).

[0105] (4) The traffic of the current container reaches the br-int bridge of the DPU node of another container through the tunnel at the p0 network port of the DPU node of another container. The ovn-xxx-0 port of the br-int bridge performs geneve / vxlan decapsulation operation on the encapsulated traffic to obtain the traffic of the current container.

[0106] (5) The traffic of the current container reaches another container through the vfr and vf of the DPU node of another container.

[0107] In an alternative embodiment of the present invention, before the network management component sets the configuration parameters of the lrp port of the logical router GR_vpc to direct traffic redirection through bridging, the method further includes:

[0108] Create a logical router GR_vpc and configure multiple DPU nodes for the logical router GR_vpc.

[0109] Specifically, refer to Figure 4 , multiple DPU nodes are the orange parts in the figure, node1:dpu001 and node2:dpu002, Figure 4 The pods and vms in

[0110] In an alternative embodiment of the present invention, directing traffic redirection through bridging includes: redirect-type = bridged, reside-on-redirect-chassis = "true".

[0111] Specifically, after the above settings are made, the logical router GR_vpc supports the function of splitting east-west traffic and north-south traffic. That is, the east-west traffic still performs tunnel encapsulation operations and tunnel decapsulation operations, while the north-south traffic no longer performs tunnel encapsulation operations and tunnel decapsulation operations.

[0112] In an alternative embodiment of the present invention, the logical router GR_vpc includes: a br-int bridge, and the br-int bridge includes: an ovn-xxx-0 port, a patch port, a br-out bridge, a p0 network port, and a vfr.

[0113] In an alternative embodiment of the present invention, the logical router GR_vpc and the container are hosted on a DPU node.

[0114] Figure 1 Shown is the forwarding process of traditional east-west traffic and north-south traffic. When the lrp of GR_vpc does not support the traffic splitting function, when POD / VMs want to access each other (east-west traffic) (such as Figure 1 ... the red line part), when pod1 accesses pod2, the traffic follows the red line. The traffic of pod1 reaches the br-int bridge of this dpu node (node1: dpu001) through vf and vfr, performs vxlan / geneve encapsulation operations at the ovn-xxx-0 port, reaches the peer dpu node (node2: dpu002) through the p0 network port to the switch, performs vxlan / geneve decapsulation operations at the ovn-xxx-0 port from the p0 network port to the br-int bridge of the dpu node (node2: dpu002), and reaches pod2 through vfr and vf; when the lrp of GR_vpc does not support the traffic splitting function, when POD / VMs want to access the public network (north-south traffic) (such as Figure 1, for the blue line part), pod2 accesses the public network, and the traffic follows the blue line. The traffic of pod2 reaches the br-int bridge of this DPU node (node2: dpu002) through vf and vfr, and performs vxlan / geneve packet encapsulation operations at the ovn-xxx-0 port. Then it goes to the switch through the p0 network port to reach the gateway DPU node (node1: dpu001). At the p0 network port of the gateway DPU node (node1: dpu001) to the ovn-xxx-0 port of the br-int bridge, vxlan / geneve packet decapsulation operations are performed, and then the corresponding NAT rules are matched. Then it passes through the patch port of br-int to the br-out bridge, and finally reaches the public network through the p0 port of the gateway DPU node to the switch. It can be seen that the north-south traffic in the traditional technology needs to perform tunnel geneve / vxlan packet encapsulation operations on the DPU node where the container is located, and also needs to perform tunnel geneve / vxlan packet decapsulation operations on the gateway DPU node, wasting DPU computing and network resources.

[0115] In the north-south traffic forwarding method of the cloud-native container network based on DPU of the present invention, the k8s cluster is deployed on the server cluster using DPU. By making relevant configurations to the gateway router (i.e., logical router) of ovn-kubernetes, the tunnel encapsulation process of north-south traffic is cancelled, saving the computing resources and memory resources of the local DPU node and the gateway DPU node, reducing the complexity of the ovs flow table of north-south traffic and reducing the complexity of the hardware forwarding process.

[0116] In the basic K8S network of the present invention, for the north-south traffic in the network, the geneve / vxlan encapsulation process is cancelled. When the service container provides services to the external network and accesses the public network, its network performance is improved, and the limited computing and memory resources on the DPU node are also saved, enabling the computing and memory resources to be better utilized on the service container. Saving the cost for customers to use the container cloud platform.

[0117] Embodiment 2:

[0118] The embodiment of the present invention also provides a north-south traffic forwarding device for a cloud-native container network based on DPU. The north-south traffic forwarding device for a cloud-native container network based on DPU is mainly used to execute the north-south traffic forwarding method for a cloud-native container network based on DPU provided in Embodiment 1 of the present invention. The following is a specific introduction to the north-south traffic forwarding device for a cloud-native container network based on DPU provided by the embodiment of the present invention.

[0119] Figure 5 is a schematic diagram of a north-south traffic forwarding device for a cloud-native container network based on an embodiment of the present invention, as Figure 5As shown, the device mainly includes: a first forwarding unit 10, a second forwarding unit 20, a third forwarding unit 30, and a fourth forwarding unit 40, where:

[0120] The first forwarding unit is used to, when it is recognized that the current container needs to access the public network and the current container is not on the gateway DPU node, make the traffic of the current container reach the br-int bridge of the local DPU node through the vf and vfr of the local DPU node;

[0121] The second forwarding unit is used to make the traffic of the current container continue to reach the br-out bridge through the patch port of the local DPU node, and then reach the switch through the p0 network port of the br-out bridge;

[0122] The third forwarding unit is used to make the traffic of the current container reach the p0 network port of the gateway DPU node, and then reach the br-int bridge of the gateway DPU node through the patch port of the br-out bridge of the gateway DPU node;

[0123] The fourth forwarding unit is used to match the corresponding NAT rule for the traffic of the current container, and then reach the br-out bridge through the patch port of the br-int of the gateway DPU node, and reach the public network through the p0 network port of the gateway DPU node, then through the switch.

[0124] In an embodiment of the present invention, a forwarding device for north-south traffic of a cloud-native container network based on DPU is provided, which is applied to a network management component. The network management component sets the configuration parameters of the lrp port of the logical router GR_vpc to guide traffic redirection in a bridging manner. The device includes: when it is recognized that the current container needs to access the public network and the current container is not on the gateway DPU node, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node; the traffic of the current container continues to reach the br-out bridge through the patch port of the local DPU node, and reaches the switch through the p0 network port of the br-out bridge; the traffic of the current container then reaches the p0 network port of the gateway DPU node, and then reaches the br-out bridge of the gateway DPU node and reaches the br-int bridge through the patch port; the traffic of the current container matches the corresponding NAT rule, and then reaches the br-out bridge through the patch port of the br-int of the gateway DPU node, and reaches the public network through the p0 network port of the gateway DPU node and then through the switch. Through the above description, it can be seen that in the forwarding device for north-south traffic of the cloud-native container network based on DPU of the present invention, by setting the configuration parameters of the lrp port of the logical router GR_vpc to guide traffic redirection in a bridging manner, the tunnel encapsulation process of north-south traffic is cancelled, that is, when the current container needs to access the public network and the current container is not on the gateway DPU node, the tunnel geneve / vxlan packet encapsulation operation of the local DPU node of the current container and the tunnel geneve / vxlan packet decapsulation operation of the gateway DPU node are cancelled, releasing the computing resources, memory resources and network resources of the local DPU node and the gateway DPU node, reducing the complexity of the ovs flow table of north-south traffic and reducing the complexity of the hardware forwarding process, and alleviating the technical problem of waste of DPU computing and network resources in the north-south traffic forwarding of the traditional cloud-native container network based on DPU.

[0125] Optionally, the device is further configured to: when it is recognized that the current container needs to access another container, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node; perform geneve / vxlan packet encapsulation operation on the traffic of the current container at the ovn-xxx-0 port of the br-int bridge to obtain the encapsulated traffic; the encapsulated traffic reaches the p0 network port of the local DPU node through the tunnel, and then reaches the switch, and then reaches the DPU node of another container; the traffic reaches the br-int bridge of the DPU node of another container through the tunnel at the p0 network port of the DPU node of another container, and the ovn-xxx-0 port of the br-int bridge performs geneve / vxlan packet decapsulation operation on the encapsulated traffic to obtain the traffic of the current container; the traffic of the current container reaches another container through the vfr and vf of the DPU node of another container.

[0126] Optionally, the apparatus is further configured to: create a logical router GR_vpc, and configure a plurality of DPU nodes for the logical router GR_vpc.

[0127] Optionally, guiding traffic redirection in a bridging manner includes: redirect-type = bridged, reside-on-redirect-chassis = "true".

[0128] Optionally, the logical router GR_vpc includes: a br-int bridge, and the br-int bridge includes: an ovn-xxx-0 port, a patch port, a br-out bridge, a p0 network port, and a vfr.

[0129] Optionally, the logical router GR_vpc and the container are hosted on a DPU node.

[0130] The apparatus provided by the embodiments of the present invention has the same implementation principle and the same technical effects as those of the foregoing method embodiments. For the sake of brief description, for the parts not mentioned in the apparatus embodiments, reference may be made to the corresponding content in the foregoing method embodiments.

[0131] As Figure 6 shown, an electronic device 600 provided by an embodiment of the present application includes: a processor 601, a memory 602, and a bus. The memory 602 stores machine-readable instructions executable by the processor 601. When the electronic device runs, the processor 601 communicates with the memory 602 through the bus, and the processor 601 executes the machine-readable instructions to perform the steps of the foregoing method for forwarding north-south traffic of a cloud-native container network based on a DPU.

[0132] Specifically, the foregoing memory 602 and processor 601 can be general-purpose memory and processor, which are not specifically limited herein. When the processor 601 runs the computer program stored in the memory 602, it can execute the foregoing method for forwarding north-south traffic of a cloud-native container network based on a DPU.

[0133] The processor 601 may be an integrated circuit chip with the ability to process signals. In the implementation process, each step of the above method can be completed by the integrated logic circuit in the hardware of the processor 601 or instructions in the form of software. The above-mentioned processor 601 may be a general-purpose processor, including a central processing unit (CPU for short), a network processor (NP for short), etc.; it may also be a digital signal processor (DSP for short), an application specific integrated circuit (ASIC for short), a field-programmable gate array (FPGA for short), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. It can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as being executed and completed by a hardware decoding processor, or executed and completed by a combination of hardware and software modules in the decoding processor. The software module may be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. This storage medium is located in the memory 602, and the processor 601 reads the information in the memory 602 and combines its hardware to complete the steps of the above method.

[0134] Corresponding to the above method for forwarding north-south traffic of a cloud-native container network based on a DPU, an embodiment of the present application further provides a computer-readable storage medium, and the computer-readable storage medium stores machine-executable instructions. When the computer-executable instructions are called and run by a processor, the computer-executable instructions cause the processor to run the steps of the above method for forwarding north-south traffic of a cloud-native container network based on a DPU.

[0135] The apparatus for forwarding north-south traffic of a cloud-native container network based on a DPU provided in the embodiments of the present application may be specific hardware on a device or software or firmware installed on the device, etc. For the apparatus provided in the embodiments of the present application, the implementation principle and the technical effects produced are the same as those of the foregoing method embodiments. For the sake of brief description, for the parts not mentioned in the apparatus embodiments, reference may be made to the corresponding content in the foregoing method embodiments. Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the systems, apparatuses, and units described above can all refer to the corresponding processes in the foregoing method embodiments, and will not be elaborated here.

[0136] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For another example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed couplings or direct couplings or communication connections to each other can be through some communication interfaces. The indirect couplings or communication connections of the devices or units can be in electrical, mechanical or other forms.

[0137] For another example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions, and operations of devices, methods, and computer program products according to multiple embodiments of this application. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code, and the module, program segment, or part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than marked in the accompanying drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and they can sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system that performs the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0138] The units described as separate components may or may not be physically separated. The components shown as units may or may not be physical units, that is, they can be located in one place, or they can be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0139] In addition, the functional units in the embodiments provided in this application can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit.

[0140] When the above-mentioned functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing an electronic device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method for forwarding north-south traffic of a cloud-native container network based on DPU described in various embodiments of this application. The aforementioned storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM for short), random access memories (RAM for short), magnetic disks, or optical discs that can store program codes.

[0141] It should be noted that: similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. In addition, the terms "first", "second", "third", etc. are only used for descriptive distinction and cannot be understood as indicating or implying relative importance.

[0142] Finally, it should be noted that: the above-mentioned embodiments are only specific implementation manners of this application, used to illustrate the technical solution of this application, rather than limiting it. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: any person skilled in the art within the technical scope disclosed in this application can still modify the technical solutions recorded in the foregoing embodiments, or can easily think of changes, or perform equivalent replacements on some of the technical features; and these modifications, changes, or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of this application. All should be covered by the protection scope of this application. Therefore, the protection scope of this application should be subject to the protection scope of the claims.

Claims

1. A method for forwarding north-south traffic of cloud-native containers based on DPU, characterized in that, Applied to a network management component, the network management component sets the configuration parameters of the lrp port of the logical router GR_vpc to guide traffic redirection in a bridging manner. The method includes: When it is recognized that the current container needs to access the public network and the current container is not on the gateway DPU node, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node; The traffic of the current container continues to reach the br-out bridge through the patch port of the local DPU node, and reaches the switch through the p0 network port of the br-out bridge; The traffic of the current container then reaches the p0 network port of the gateway DPU node, and then reaches the br-int bridge of the gateway DPU node through the patch port of the br-out bridge; The traffic of the current container matches the corresponding NAT rule, and then reaches the br-out bridge through the patch port of the br-int of the gateway DPU node, and reaches the public network through the p0 network port of the gateway DPU node, then through the switch; 2. The method according to claim 1, characterized in that The method further includes: When it is recognized that the current container needs to access another container, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node; Perform geneve / vxlan packet encapsulation operation on the traffic of the current container at the ovn-xxx-0 port of the br-int bridge to obtain the encapsulated traffic; The encapsulated traffic reaches the p0 network port of the local DPU node through the tunnel, then reaches the switch, and further reaches the DPU node of the other container; At the p0 network port of the DPU node of the other container, it reaches the br-int bridge of the DPU node of the other container through the tunnel. The ovn-xxx-0 port of the br-int bridge performs geneve / vxlan decapsulation operation on the encapsulated traffic to obtain the traffic of the current container; The traffic of the current container reaches the other container through the vfr and vf of the DPU node of the other container.

3. The method according to claim 1, characterized in that Before the network management component sets the configuration parameters of the lrp port of the logical router GR_vpc to guide traffic redirection in a bridging manner, the method further includes: Create the logical router GR_vpc and configure multiple DPU nodes for the logical router GR_vpc.

4. The method according to claim 1, characterized in that, The guiding of traffic redirection in a bridging manner includes: redirect-type = bridged, reside-on-redirect-chassis = "true".

5. The method according to claim 1, wherein The logical router GR_vpc includes: a br-int bridge, and the br-int bridge includes: an ovn-xxx-0 port, a patch port, a br-out bridge, a p0 network port, and a vfr.

6. The method according to claim 1, wherein The logical router GR_vpc and the container are carried on the DPU node.

7. A forwarding device for north-south traffic of cloud-native containers based on DPU, characterized in that, Applied to a network management component, the network management component sets the configuration parameters of the lrp port of the logical router GR_vpc to guide traffic redirection in a bridging manner. The device includes: A first forwarding unit, configured to, when it is recognized that the current container needs to access the public network and the current container is not on the gateway DPU node, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node; A second forwarding unit, configured to continue the traffic of the current container to the br-out bridge through the patch port of the local DPU node, and the traffic goes to the p0 network port of the br-out bridge to reach the switch; A third forwarding unit, configured to continue the traffic of the current container to the p0 network port of the gateway DPU node, and then to the br-out bridge of the gateway DPU node and reach the br-int bridge through the patch port; A fourth forwarding unit, configured to match the traffic of the current container with the corresponding NAT rule, and then reach the br-out bridge through the patch port of the br-int of the gateway DPU node, and reach the public network through the p0 network port of the gateway DPU node, then to the switch; 8. The device according to claim 7, characterized in that The device is further configured to: When it is recognized that the current container needs to access another container, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node; Perform geneve / vxlan packet encapsulation operation on the traffic of the current container at the ovn-xxx-0 port of the br-int bridge to obtain the encapsulated traffic; The encapsulated traffic reaches the p0 network port of the local DPU node through the tunnel, then reaches the switch, and further reaches the DPU node of the other container; At the p0 network port of the DPU node of the other container, reach the br-int bridge of the DPU node of the other container through the tunnel, and perform geneve / vxlan packet decapsulation operation on the encapsulated traffic at the ovn-xxx-0 port of the br-int bridge to obtain the traffic of the current container; The traffic of the current container reaches the other container through the vfr and vf of the DPU node of the other container; 9. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method described in any one of claims 1 to 6 above.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores machine-executable instructions. When the machine-executable instructions are called and run by the processor, the machine-executable instructions cause the processor to run the method described in any one of claims 1 to 6 above.

Images