Methods, devices, and electronic equipment for forwarding north-south traffic in cloud-native container networks based on DPU

Abstract

This invention provides a method, apparatus, and electronic device for forwarding north-south traffic in a cloud-native container network based on a DPU. In this forwarding method, by setting the configuration parameters of the LRP port of the logical router GR_vpc to guide traffic redirection through bridging, the tunnel encapsulation process for north-south traffic is eliminated. That is, when the current container needs to access the public network and the current container is not on the gateway DPU node, the tunnel generate / vxlan encapsulation operation of the local DPU node of the current container and the tunnel generate / vxlan uncapsulation operation of the gateway DPU node are eliminated. This releases the computing resources, memory resources, and network resources of the local DPU node and the gateway DPU node, reduces the complexity of the OVS flow table for north-south traffic, and reduces the complexity of the hardware forwarding process.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a method, apparatus, and electronic device for forwarding north-south traffic in a cloud-native container network based on a DPU. Background Technology

[0002] A DPU (Data Processing Unit) is a next-generation computing chip that is data-centric, I / O-intensive, and uses a software-defined technology approach to support infrastructure resource layer virtualization. It can improve computing system efficiency, reduce the total cost of ownership of the overall system, improve data processing performance, and reduce the performance loss of other computing chips.

[0003] Container cloud is a cloud service product implemented by deploying container services on clustered servers using Docker technology. It's a PaaS-layer cloud delivery model. Container cloud can be deployed in two ways: one is by deploying containers on virtual machines (as is common in many traditional enterprises); the other is by deploying containers directly on bare metal servers. The reason for deploying containers on virtual machines is that they require the isolation and security features of virtual machines. In fact, to achieve the same effect, it's not necessary to use virtual machines, or, with technological advancements, these issues may be resolved within containers.

[0004] Kubernetes is a portable, scalable, open-source platform for managing containerized workloads and services, facilitating declarative configuration and automation. Kubernetes boasts a large and rapidly growing ecosystem with a wide range of services, support, and tools available.

[0005] In current K8S (i.e. Kubernetes) network architecture solutions, such as Figure 1 As shown, when the current container (e.g., pod2) needs to access the external network (i.e., north-south traffic), and the current container is not on the gateway node (referring to the gateway DPU node, i.e., node1 node), the traffic route is... Figure 1The blue line in the diagram starts from the vf of the DPU-HOST on node2, then goes to the vfr of the DPU-SOC, and then to the ovn-xx-0 port of the br-int of the OVS (open-source multi-layer virtual switch) for a generate / vxlan tunnel encapsulation. It is then transmitted through the tunnel to the p0 port, and then through the switch to the p0 port of the gateway node (i.e., node1). It is then transmitted through the tunnel to the ovn-xx-0 of the gateway node, where the generate / vxlan decapsulation operation is performed. The corresponding NAT rules are then matched, and then the transmission goes through the patch port of the br-int of the gateway node to the br-out bridge. Finally, it goes through the p0 port of the gateway node to the switch and then to the public network.

[0006] As can be seen, the above process requires generating / vxlan encapsulation on the local machine (i.e., node2) and transmitting it through the tunnel to the gateway node (i.e., node1). After receiving the traffic from the tunnel, the gateway node performs decapsulation and then sends it to the external network through the patch port of the local OVS (i.e., node1). In this process, the tunnel generating / vxlan encapsulation operation needs to be performed on the DPU-SOC on the local machine (i.e., node2), which consumes the local DPU's computing and network resources. Furthermore, the tunnel generating / vxlan unpacking operation needs to be performed on the gateway node (i.e., node1), which also consumes the gateway DPU's computing and network resources.

[0007] In summary, the traditional north-south traffic forwarding in DPU-based cloud-native container networks suffers from the technical problem of wasting DPU computing and network resources. Summary of the Invention

[0008] In view of this, the purpose of the present invention is to provide a method, apparatus and electronic device for forwarding north-south traffic in cloud-native container networks based on DPU, so as to alleviate the technical problem of wasting DPU computing and network resources in the forwarding of north-south traffic in traditional DPU-based cloud-native container networks.

[0009] In a first aspect, embodiments of the present invention provide a method for forwarding north-south traffic in a cloud-native container network based on a DPU, applied to a network management component. The network management component sets the configuration parameters of the LRP port of the logical router GR_vpc to guide traffic redirection via bridging. The method includes:

[0010] When it is detected that the current container needs to access the public network, and the current container is not on the gateway DPU node, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node.

[0011] The current container's traffic continues through the patch port of the local DPU node to the br-out bridge, and from the br-out bridge to the p0 port to reach the switch;

[0012] The current container's traffic then goes to the p0 network port of the gateway DPU node, and then to the br-out bridge of the gateway DPU node, from the patch port to the br-int bridge;

[0013] The traffic of the current container is matched with the corresponding NAT rules, and then goes through the patch port of the br-int of the gateway DPU node to the br-out bridge, and through the p0 port of the gateway DPU node to the switch and then to the public network.

[0014] Furthermore, the method also includes:

[0015] When it is detected that the current container needs to access another container, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node.

[0016] Perform a generate / vxlan packetization operation on the current container's traffic at port ovn-xxx-0 of the br-int bridge to obtain the packetized traffic;

[0017] The packetized traffic travels through a tunnel to the p0 port of the local DPU node, then to the switch, and finally to the DPU node of the other container.

[0018] The p0 network port of the DPU node in the other container reaches the br-int bridge of the DPU node in the other container through a tunnel. The ovn-xxx-0 port of the br-int bridge performs a generate / vxlan unpacking operation on the packetized traffic to obtain the traffic of the current container.

[0019] The traffic of the current container reaches the other container through the vfr and vf of the DPU node of the other container.

[0020] Furthermore, before the network management component sets the configuration parameters of the LRP port of the logical router GR_vpc to guide traffic redirection via bridging, the method further includes:

[0021] Create the logical router GR_vpc and configure multiple DPU nodes for the logical router GR_vpc.

[0022] Furthermore, the method of guiding traffic redirection via bridging includes: redirect-type=bridged,reside-on-redirect-chassis="true".

[0023] Furthermore, the logical router GR_vpc includes: a br-int bridge, which includes: ovn-xxx-0 port, patch port, br-out bridge, p0 port, and vfr.

[0024] Furthermore, the logical router GR_vpc and the container are hosted on the DPU node.

[0025] Secondly, embodiments of the present invention also provide a DPU-based north-south traffic forwarding device for cloud-native container networks, applied to a network management component. The network management component sets the configuration parameters of the LRP port of the logical router GR_vpc to guide traffic redirection via bridging. The device includes:

[0026] The first forwarding unit is used to, when it is detected that the current container wants to access the public network and the current container is not on the gateway DPU node, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node.

[0027] The second forwarding unit is used to allow the traffic of the current container to continue to pass through the patch port of the local DPU node to the br-out bridge, and then from the br-out bridge to the p0 port to reach the switch.

[0028] The third forwarding unit is used to forward the traffic of the current container to the p0 network port of the gateway DPU node, and then to the br-out bridge of the gateway DPU node from the patch port to the br-int bridge;

[0029] The fourth forwarding unit is used to match the traffic of the current container with the corresponding NAT rules, and then through the patch port of the br-int of the gateway DPU node to the br-out bridge, through the p0 port of the gateway DPU node to the switch, and then to the public network.

[0030] Furthermore, the device is also used for:

[0031] When it is detected that the current container needs to access another container, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node.

[0032] Perform a generate / vxlan packetization operation on the current container's traffic at port ovn-xxx-0 of the br-int bridge to obtain the packetized traffic;

[0033] The packetized traffic travels through a tunnel to the p0 port of the local DPU node, then to the switch, and finally to the DPU node of the other container.

[0034] The p0 network port of the DPU node in the other container reaches the br-int bridge of the DPU node in the other container through a tunnel. The ovn-xxx-0 port of the br-int bridge performs a generate / vxlan unpacking operation on the packetized traffic to obtain the traffic of the current container.

[0035] The traffic of the current container reaches the other container through the vfr and vf of the DPU node of the other container.

[0036] Thirdly, embodiments of the present invention also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described in any of the first aspects above.

[0037] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing machine-executable instructions, which, when invoked and executed by a processor, cause the processor to perform the method described in any of the first aspects above.

[0038] In this embodiment of the invention, a method for forwarding north-south traffic in a cloud-native container network based on DPU is provided. This method is applied to a network management component, which configures the LRP port of the logical router GR_vpc to guide traffic redirection via bridging. The method includes: when it is detected that the current container needs to access the public network and the current container is not on the gateway DPU node, the current container's traffic reaches the br-int bridge of the local DPU node through the vf and vfr ports; the current container's traffic continues through the patch port of the local DPU node to the br-out bridge, then from the br-out bridge to the p0 port of the switch; the current container's traffic then goes to the p0 port of the gateway DPU node, then to the br-out bridge of the gateway DPU node, and from there to the br-int bridge via the patch port; the current container's traffic matches the corresponding NAT rules, then goes through the patch port of the br-int bridge of the gateway DPU node to the br-out bridge, then through the p0 port of the gateway DPU node to the switch, and finally to the public network. As described above, the north-south traffic forwarding method for DPU-based cloud-native container networks of the present invention eliminates the tunnel encapsulation process for north-south traffic by setting the configuration parameters of the LRP port of the logical router GR_vpc to guide traffic redirection through bridging. That is, when the current container needs to access the public network and the current container is not on the gateway DPU node, the tunnel generate / vxlan encapsulation operation of the local DPU node of the current container and the tunnel generate / vxlan unpacking operation of the gateway DPU node are canceled. This releases the computing resources, memory resources and network resources of the local DPU node and the gateway DPU node, reduces the complexity of the OVS flow table for north-south traffic and reduces the complexity of the hardware forwarding process, thus alleviating the technical problem of wasting DPU computing and network resources in the forwarding of north-south traffic in traditional DPU-based cloud-native container networks. Attached Figure Description

[0039] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0040] Figure 1 A schematic diagram illustrating the forwarding of east-west and north-south traffic for traditional technologies;

[0041] Figure 2 A flowchart illustrating a method for forwarding north-south traffic in a cloud-native container network based on a DPU, as provided in an embodiment of the present invention;

[0042] Figure 3 A schematic diagram of east-west and north-south traffic forwarding provided for embodiments of the present invention;

[0043] Figure 4 This is a schematic diagram of the K8S network architecture provided in an embodiment of the present invention;

[0044] Figure 5 A schematic diagram of a north-south traffic forwarding device for a cloud-native container network based on a DPU, provided for an embodiment of the present invention;

[0045] Figure 6 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0046] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0047] Traditional DPU-based cloud-native container networks waste DPU computing and network resources by forwarding north-south traffic.

[0048] Based on this, in the north-south traffic forwarding method of cloud-native container networks based on DPU of the present invention, by setting the configuration parameters of the LRP port of the logical router GR_vpc to guide traffic redirection through bridging, the tunnel encapsulation process of north-south traffic is cancelled. That is, when the current container needs to access the public network and the current container is not on the gateway DPU node, the tunnel generate / vxlan encapsulation operation of the local DPU node of the current container and the tunnel generate / vxlan unpacking operation of the gateway DPU node are cancelled, thereby releasing the computing resources, memory resources and network resources of the local DPU node and the gateway DPU node, reducing the complexity of the OVS flow table of north-south traffic and reducing the complexity of the hardware forwarding process.

[0049] To facilitate understanding of this embodiment, a detailed description of a DPU-based method for forwarding north-south traffic in a cloud-native container network will be provided first.

[0050] Example 1:

[0051] According to an embodiment of the present invention, an embodiment of a method for forwarding north-south traffic in a cloud-native container network based on DPU is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0052] Figure 2 This is a flowchart illustrating a method for forwarding north-south traffic in a cloud-native container network based on a DPU, according to an embodiment of the present invention. Figure 2 As shown, the method includes the following steps:

[0053] Step S202: When it is detected that the current container needs to access the public network and the current container is not on the gateway DPU node, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node.

[0054] In an optional embodiment of the present invention, the above forwarding method can be applied to a network management component, specifically an ovn-kubernetes cni, to configure the OVS (virtual switch) on the DPU SOC of the DPU node to cancel the generate / vxlan tunnel encapsulation operation for north-south traffic. That is, the network management component sets the configuration parameters of the lrp port of the logical router GR_vpc to guide traffic redirection through bridging.

[0055] After completing the configuration parameter settings, refer to Figure 3 When it is detected that the current container, such as pod2, needs to access the public network (i.e., north-south traffic), and the current container is not on the gateway DPU node (i.e., node1:dpu001), the traffic of the current container follows the blue line. The traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node (i.e., node2:dpu002).

[0056] Step S204: The current container traffic continues to pass through the patch port of the local DPU node to the br-out bridge, and then from the br-out bridge to the p0 port to reach the switch.

[0057] Specifically, such as Figure 3 As shown, the current container's traffic continues through the patch port to the br-out bridge, and from the br-out bridge to the p0 port and finally to the switch.

[0058] Step S206: The current container's traffic then goes to the p0 network interface of the gateway DPU node, and then to the br-out bridge of the gateway DPU node via the patch interface to the br-int bridge;

[0059] Specifically, such as Figure 3 As shown, the current container's traffic then goes to the p0 network interface of the gateway DPU node (node1:dpu001), and then to the br-out bridge of the gateway DPU node via the patch port to the br-int bridge.

[0060] In step S208, the current container's traffic matches the corresponding NAT rules, and then goes through the patch port of the gateway DPU node's br-int to the br-out bridge, and through the p0 port of the gateway DPU node to the switch and then to the public network.

[0061] Specifically, such as Figure 3 As shown, the traffic of the current container on the br-int bridge matches the corresponding NAT rules, and then goes through the patch port of the br-int gateway DPU node to the br-out bridge, through the p0 port of the gateway DPU node to the switch, and then to the public network, thus completing the forwarding process of the current container's traffic to the public network.

[0062] The following explains some of the technical abbreviations used in the above process:

[0063] DPU stands for Data Processing Unit. It is a major category of newly developed dedicated processors and the third important computing chip in data center scenarios after CPU and GPU. It provides a computing engine for high-bandwidth, low-latency, and data-intensive computing scenarios.

[0064] Kubernetes, also known as K8s, is an open-source system for automating the deployment, scaling, and management of containerized applications. It groups the containers that make up an application into logical units to facilitate management and service discovery. Kubernetes originates from Google's 15 years of experience operating in production environments and incorporates the best ideas and practices from the community.

[0065] A Pod is the smallest unit of deployment and management in a Kubernetes cluster, coordinating addressing and scheduling. A Pod is a collection of one or more containers, an abstract collection of one or more services (processes). Pods can share network and storage (it can be simply understood as a logical virtual machine, but it is not a virtual machine).

[0066] Linux containers provide a lightweight virtualization approach that allows multiple virtual environments (containers) to run simultaneously on a single host machine. In technologies like Xen or KVM, the processor emulates the entire hardware environment, and a hypervisor controls the virtual machines. Containers, however, differ by providing virtualization at the operating system level, where the kernel controls isolated containers.

[0067] The Container Network Interface (CNI) is a project under the CNCF (CNCF) that consists of a set of specifications and libraries for configuring network interfaces for Linux containers, and also includes some plugins. CNI only cares about network allocation when a container is created and releasing network resources when the container is deleted.

[0068] OVN (Open Virtual Network) is an open-source project that provides software-defined networking (SDN) capabilities, particularly for use with Open vSwitch (OVS). OVN offers powerful virtual network features such as logical switching, logical routing, firewall rules, and load balancing. Distributed gateways are a key concept in OVN, designed to provide efficient and reliable network connectivity, especially in large-scale distributed environments.

[0069] Basic concepts of distributed gateways

[0070] Logical Router: In OVN, a logical router is responsible for forwarding traffic between different logical switches. It acts as a virtual router, enabling packet routing between different virtual networks.

[0071] Distributed gateway: A distributed gateway distributes gateway functionality across multiple computing nodes, rather than centralizing it on a single node. This architecture helps improve network scalability and reliability while reducing network bottlenecks and single points of failure.

[0072] VPC, or Virtual Private Cloud

[0073] Isolation: VPC allows users to create an isolated network environment in the cloud, ensuring that a user's resources are isolated from those of other users.

[0074] IP address range: Users can choose the range of IP addresses to be assigned to the VPC, defining the IP address space of the internal network of the VPC.

[0075] Subnets: A VPC can be divided into multiple subnets, and each subnet can be associated with a different Availability Zone to improve high availability.

[0076] Routing table: Users can configure the routing table within the VPC to define routing rules for network traffic.

[0077] Security groups and network ACLs: Security groups and network access control lists (ACLs) are used to control traffic to and from the VPC and ensure network security.

[0078] Cloud service connectivity: VPC allows connection to other cloud services, such as cloud databases and load balancers.

[0079] VPN Connection: VPC supports establishing secure connections via Virtual Private Network (VPN) to connect on-premises data centers to VPCs in the cloud.

[0080] Scalability in the cloud: Users can expand resources in a VPC as needed, such as adding subnets, adjusting IP address ranges, and connecting to different VPCs.

[0081] Monitoring and logging: VPC provides monitoring and logging services to help users monitor network traffic, events, and performance.

[0082] OVN-Kubernetes CNI (Container Network Interface): In cloud-native network traffic offloading, high-speed containers, cloud platforms and other solutions, it provides default POD and Service network communication capabilities for Kubernetes clusters, and offloads Kubernetes network traffic to DPU, thereby providing upper-layer applications with extremely low latency and high bandwidth network forwarding performance.

[0083] PF: Physical Function. An Ethernet physical controller that supports the SR-IOV protocol.

[0084] VF: Virtual Function. A virtual PCIe device created from a physical Ethernet controller.

[0085] PFR: PF Representer is a virtual port on the DPU side used to connect to the OVS bridge, representing the physical function PF.

[0086] VFR: VF Representer is a virtual port on the DPU side used to connect to the OVS bridge.

[0087] Uplink R: Uplink Representer is a virtual port on the DPU side used by the Uplink port to connect to the OVS bridge.

[0088] SR-IOV: Single Root I / O Virtualization, a single root virtualization technology that provides virtualized devices with independent memory space, interrupts, DMA data streams, etc.

[0089] DPU: Data Processing Unit, is a data processing unit that integrates a network interface card, a central processing unit, and hardware offloading, and can perform various network traffic offloading tasks.

[0090] DPU Host: A server / machine / system that connects to the DPU via a PCIe port.

[0091] DPU SoC: The machine / system on the DPU network card.

[0092] K8s: Kubernetes container orchestration and management system.

[0093] OVS: Open Virtual Switch is an open-source multi-layer virtual switch.

[0094] Multus: Multus is a meta plugin that allows pods to have multiple network interfaces.

[0095] LRP stands for Logical Router Port. A logical router port is a logical network component in OVN used to connect logical routers to logical switches or logical ports for communication. LRPs have IP addresses and can be configured on logical routers to enable packet routing between different subnets within a virtual network.

[0096] Geneve / VXLAN Encapsulation: OVS (Open vSwitch) supports multiple tunnel encapsulation protocols, including VXLAN (Virtual Extensible LAN) and Geneve (Generic Network Virtualization Encapsulation). These protocols are used to encapsulate Layer 2 network traffic within Layer 3 IP packets, thereby enabling virtual network connections across networks.

[0097] In this embodiment of the invention, a method for forwarding north-south traffic in a cloud-native container network based on DPU is provided. This method is applied to a network management component, which configures the LRP port of the logical router GR_vpc to guide traffic redirection via bridging. The method includes: when it is detected that the current container needs to access the public network and the current container is not on the gateway DPU node, the current container's traffic reaches the br-int bridge of the local DPU node through the vf and vfr ports; the current container's traffic continues through the patch port of the local DPU node to the br-out bridge, then from the br-out bridge to the p0 port of the switch; the current container's traffic then goes to the p0 port of the gateway DPU node, then to the br-out bridge of the gateway DPU node, and from there to the br-int bridge via the patch port; the current container's traffic matches the corresponding NAT rules, then goes through the patch port of the br-int bridge of the gateway DPU node to the br-out bridge, then through the p0 port of the gateway DPU node to the switch, and finally to the public network. As described above, the north-south traffic forwarding method for DPU-based cloud-native container networks of the present invention eliminates the tunnel encapsulation process for north-south traffic by setting the configuration parameters of the LRP port of the logical router GR_vpc to guide traffic redirection through bridging. That is, when the current container needs to access the public network and the current container is not on the gateway DPU node, the tunnel generate / vxlan encapsulation operation of the local DPU node of the current container and the tunnel generate / vxlan unpacking operation of the gateway DPU node are canceled. This releases the computing resources, memory resources and network resources of the local DPU node and the gateway DPU node, reduces the complexity of the OVS flow table for north-south traffic and reduces the complexity of the hardware forwarding process, thus alleviating the technical problem of wasting DPU computing and network resources in the forwarding of north-south traffic in traditional DPU-based cloud-native container networks.

[0098] The above provides a brief overview of the north-south traffic forwarding method for cloud-native container networks based on DPU of the present invention. The specific details involved are described in detail below.

[0099] In an optional embodiment of the present invention, the method further includes the following steps:

[0100] (1) When it is detected that the current container needs to access another container, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node.

[0101] Specifically, such as Figure 3As shown, when POD / VM (containers) need to access each other (east-west traffic), that is, when the current container (such as pod2) needs to access another container (pod1), the traffic of the current container follows the red line. The traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node (i.e., node2:dpu002).

[0102] (2) Perform a generate / vxlan packetization operation on the current container's traffic on the ovn-xxx-0 port of the br-int bridge to obtain the packetized traffic;

[0103] (3) The packetized traffic reaches the p0 network port of the local DPU node through the tunnel, then reaches the switch, and then reaches the DPU node of another container.

[0104] For details, please refer to Figure 3 The DPU node of another container (i.e., node1:dpu001).

[0105] (4) The p0 network interface of the DPU node of another container reaches the br-int bridge of the DPU node of another container through a tunnel. The ovn-xxx-0 interface of the br-int bridge performs generate / vxlan unpacking operation on the packetized traffic to obtain the traffic of the current container.

[0106] (5) The current container’s traffic reaches another container through the vfr and vf of the DPU node of another container.

[0107] In an optional embodiment of the present invention, before the network management component sets the configuration parameters of the LRP port of the logical router GR_vpc to guide traffic redirection via bridging, the method further includes:

[0108] Create a logical router GR_vpc and configure multiple DPU nodes for the logical router GR_vpc.

[0109] For details, please refer to Figure 4 Multiple DPU nodes are shown in orange as node1:dpu001 and node2:dpu002 in the figure. Figure 4 In this context, both pods and VMs are containers.

[0110] In an optional embodiment of the present invention, guiding traffic redirection via bridging includes: redirect-type = bridged, stay-on-redirect-chassis = "true".

[0111] Specifically, after the above settings are made, the logical router GR_vpc supports the function of splitting east-west traffic and north-south traffic. That is, east-west traffic still undergoes tunnel encapsulation and tunnel decapsulation operations, while north-south traffic no longer undergoes tunnel encapsulation and tunnel decapsulation operations.

[0112] In an optional embodiment of the present invention, the logical router GR_vpc includes: a br-int bridge, which includes: an ovn-xxx-0 port, a patch port, a br-out bridge, a p0 port, and a vfr port.

[0113] In an alternative embodiment of the invention, the logical router GR_vpc and the container are hosted on the DPU node.

[0114] Figure 1 The diagram illustrates the traditional east-west and north-south traffic forwarding process. However, when GR_vpc's LRP does not support traffic splitting, and when PODs / VMs need to access each other (east-west traffic) (e.g.) Figure 1 (The red line indicates the traffic flow). When pod1 accesses pod2, the traffic follows the red line pattern. Pod1's traffic reaches the br-int bridge on the local DPU node (node1:dpu001) via VF and VFR, where it undergoes VXLAN / Geneve packet encapsulation on the OVN-xxx-0 port. It then reaches the peer DPU node (node2:dpu002) via the P0 port on the br-int bridge via VXLAN / Geneve decapsulation, finally reaching pod2 via VFR and VF. When GR_VPC's LRP does not support traffic splitting, when a POD / VM needs to access the public network (north-south traffic) (e.g., ...), ... Figure 1(The blue line section) When pod2 accesses the public network, the traffic follows the path shown by the blue line. pod2's traffic reaches the br-int bridge on the local DPU node (node2:dpu002) via VF and VFR, where it undergoes VXLAN / geneve packet encapsulation on the OVN-xxx-0 port. It then travels through the P0 port to the switch, reaching the gateway DPU node (node1:dpu001). On the gateway DPU node (node1:dpu001), the P0 port connects to the OVN-xxx-0 port of the br-int bridge, where VXLAN / geneve decapsulation is performed. The traffic then matches the corresponding NAT rules, travels through the br-int patch port to the br-out bridge, and finally through the gateway DPU node's P0 port to the switch and then to the public network. It is evident that in traditional technologies, north-south traffic requires tunneling via geneve / vxlan encapsulation on the DPU node where the container resides, and also requires tunneling via geneve / vxlan decapsulation on the gateway DPU node, wasting DPU computing and network resources.

[0115] In the north-south traffic forwarding method of cloud-native container networks based on DPU of the present invention, the Kubernetes cluster is deployed on a server cluster using DPU. By configuring the gateway router (i.e., logical router) of ovn-kubernetes, the tunnel encapsulation process of north-south traffic is canceled, which saves computing and memory resources of local DPU nodes and gateway DPU nodes, reduces the complexity of OVS flow table of north-south traffic and reduces the complexity of hardware forwarding process.

[0116] This invention eliminates the generate / vxlan encapsulation process for north-south traffic in a basic Kubernetes network. This improves network performance for service containers when providing services to the external network and accessing the public internet, while also saving limited computing and memory resources on DPU nodes, allowing these resources to be better utilized by the service containers. This reduces the cost for customers using container cloud platforms.

[0117] Example 2:

[0118] This invention also provides a DPU-based north-south traffic forwarding device for cloud-native container networks. This DPU-based north-south traffic forwarding device is mainly used to execute the DPU-based north-south traffic forwarding method for cloud-native container networks provided in Embodiment 1 of this invention. The following is a detailed description of the DPU-based north-south traffic forwarding device for cloud-native container networks provided in this invention.

[0119] Figure 5 This is a schematic diagram of a DPU-based cloud-native container network north-south traffic forwarding device according to an embodiment of the present invention, as shown below. Figure 5As shown, the device mainly includes: a first forwarding unit 10, a second forwarding unit 20, a third forwarding unit 30, and a fourth forwarding unit 40, wherein:

[0120] The first forwarding unit is used to ensure that when it is detected that the current container needs to access the public network and the current container is not on the gateway DPU node, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node.

[0121] The second forwarding unit is used to allow the traffic of the current container to continue to pass through the patch port of the local DPU node to the br-out bridge, and then from the br-out bridge to the p0 port to reach the switch;

[0122] The third forwarding unit is used to forward the current container's traffic to the p0 network interface of the gateway DPU node, and then to the br-out bridge of the gateway DPU node via the patch interface to the br-int bridge;

[0123] The fourth forwarding unit is used to match the current container's traffic with the corresponding NAT rules, and then through the br-int patch port of the gateway DPU node to the br-out bridge, and through the p0 port of the gateway DPU node to the switch and then to the public network.

[0124] In this embodiment of the invention, a forwarding device for north-south traffic in a cloud-native container network based on a DPU is provided. This device is applied to a network management component, which configures the LRP port of the logical router GR_vpc to guide traffic redirection via bridging. The device includes the following steps: when it is detected that a container needs to access the public network and the container is not on the gateway DPU node, the container's traffic reaches the br-int bridge of the local DPU node via the vf and vfr ports; the container's traffic continues through the patch port of the local DPU node to the br-out bridge, then through the br-out bridge to the p0 port of the switch; the container's traffic then goes to the p0 port of the gateway DPU node, then to the br-out bridge via the patch port to the br-int bridge; the container's traffic matches the corresponding NAT rules, then goes through the patch port of the br-int bridge of the gateway DPU node to the br-out bridge, then through the p0 port of the gateway DPU node to the switch, and finally to the public network. As described above, the north-south traffic forwarding device for cloud-native container networks based on DPU of the present invention eliminates the tunnel encapsulation process for north-south traffic by setting the configuration parameters of the LRP port of the logical router GR_vpc to guide traffic redirection through bridging. That is, when the current container needs to access the public network and the current container is not on the gateway DPU node, the tunnel generate / vxlan encapsulation operation of the local DPU node of the current container and the tunnel generate / vxlan unpacking operation of the gateway DPU node are canceled. This releases the computing resources, memory resources and network resources of the local DPU node and the gateway DPU node, reduces the complexity of the OVS flow table of north-south traffic and reduces the complexity of the hardware forwarding process, and alleviates the technical problem of wasting DPU computing and network resources in the forwarding of north-south traffic in traditional DPU-based cloud-native container networks.

[0125] Optionally, the device is further configured to: when it is detected that the current container needs to access another container, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node; perform generate / vxlan encapsulation operation on the traffic of the current container on the ovn-xxx-0 port of the br-int bridge to obtain the encapsulated traffic; the encapsulated traffic reaches the p0 port of the local DPU node through a tunnel, then reaches the switch, and then reaches the DPU node of the other container; the p0 port of the DPU node of the other container reaches the br-int bridge of the DPU node of the other container through a tunnel, and the ovn-xxx-0 port of the br-int bridge performs generate / vxlan decapsulation operation on the encapsulated traffic to obtain the traffic of the current container; the traffic of the current container reaches the other container through the vfr and vf of the DPU node of the other container.

[0126] Optionally, the device is also used to: create a logical router GR_vpc and configure multiple DPU nodes for the logical router GR_vpc.

[0127] Optionally, traffic redirection can be guided via bridging by setting redirect-type=bridged,reside-on-redirect-chassis="true".

[0128] Optionally, the logical router GR_vpc includes: the br-int bridge, which includes: ovn-xxx-0 port, patch port, br-out bridge, p0 port, and vfr.

[0129] Optionally, the logical router GR_vpc and the container are hosted on the DPU node.

[0130] The device provided in this embodiment of the invention has the same implementation principle and technical effect as the aforementioned method embodiment. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the aforementioned method embodiment.

[0131] like Figure 6 As shown in the embodiment of this application, an electronic device 600 includes a processor 601, a memory 602, and a bus. The memory 602 stores machine-readable instructions executable by the processor 601. When the electronic device is running, the processor 601 communicates with the memory 602 via the bus. The processor 601 executes the machine-readable instructions to perform the steps of the above-described method for forwarding north-south traffic in a DPU-based cloud-native container network.

[0132] Specifically, the memory 602 and processor 601 mentioned above can be general-purpose memory and processor, without any specific limitations. When the processor 601 runs the computer program stored in the memory 602, it can execute the above-mentioned method for forwarding north-south traffic in cloud-native container networks based on DPU.

[0133] The processor 601 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 601 or by instructions in software form. The processor 601 may be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it may also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 602, and processor 601 reads the information from memory 602 and, in conjunction with its hardware, completes the steps of the above method.

[0134] Corresponding to the above-described method for forwarding north-south traffic in a DPU-based cloud-native container network, this application also provides a computer-readable storage medium storing machine-executable instructions. When these machine-executable instructions are invoked and executed by a processor, they cause the processor to perform the steps of the above-described method for forwarding north-south traffic in a DPU-based cloud-native container network.

[0135] The north-south traffic forwarding device for cloud-native container networks based on DPU provided in this application embodiment can be specific hardware on the device or software or firmware installed on the device. The implementation principle and technical effects of the device provided in this application embodiment are the same as those in the foregoing method embodiments. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the foregoing method embodiments. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can all be referred to the corresponding processes in the above method embodiments, and will not be repeated here.

[0136] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0137] For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0138] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0139] In addition, the functional units in the embodiments provided in this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0140] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the north-south traffic forwarding method for cloud-native container networks based on DPU described in various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, external hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0141] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0142] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application. All should be covered within the protection scope of this application. Therefore, the protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A method for forwarding north-south traffic in a cloud-native container network based on DPU, characterized in that, This is applied to a network management component, which sets the configuration parameters of the LRP port of the logical router GR_vpc to guide traffic redirection via bridging. The method for guiding traffic redirection via bridging includes: redirect-type=bridged, reside-on-redirect-chassis="true". When it is detected that the current container needs to access the public network, and the current container is not on the gateway DPU node, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node. The current container's traffic continues through the patch port of the local DPU node to the br-out bridge, and from the br-out bridge to the p0 port to reach the switch; The current container's traffic then goes to the p0 network port of the gateway DPU node, and then to the br-out bridge of the gateway DPU node, from the patch port to the br-int bridge; The traffic of the current container is matched with the corresponding NAT rules, and then goes through the patch port of the br-int of the gateway DPU node to the br-out bridge, and through the p0 port of the gateway DPU node to the switch and then to the public network.

2. The method according to claim 1, characterized in that, The method further includes: When it is detected that the current container needs to access another container, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node. Perform a generate / vxlan packetization operation on the current container's traffic at port ovn-xxx-0 of the br-int bridge to obtain the packetized traffic; The packetized traffic travels through a tunnel to the p0 port of the local DPU node, then to the switch, and finally to the DPU node of the other container. The p0 network port of the DPU node in the other container reaches the br-int bridge of the DPU node in the other container through a tunnel. The ovn-xxx-0 port of the br-int bridge performs a generate / vxlan unpacking operation on the packetized traffic to obtain the traffic of the current container. The traffic of the current container reaches the other container through the vfr and vf of the DPU node of the other container.

3. The method according to claim 1, characterized in that, Before the network management component sets the configuration parameters of the LRP port of the logical router GR_vpc to guide traffic redirection via bridging, the method further includes: Create the logical router GR_vpc and configure multiple DPU nodes for the logical router GR_vpc.

4. The method according to claim 1, characterized in that, The logical router GR_vpc includes: the br-int bridge, which includes: ovn-xxx-0 port, patch port, br-out bridge, p0 port, and vfr.

5. The method according to claim 1, characterized in that, The logical router GR_vpc and the container are hosted on the DPU node.

6. A DPU-based device for forwarding north-south traffic in cloud-native container networks, characterized in that, Applied to a network management component, the network management component sets the configuration parameters of the LRP port of the logical router GR_vpc to guide traffic redirection via bridging, wherein guiding traffic redirection via bridging includes: redirect-type=bridged, reside-on-redirect-chassis="true", and the device includes: The first forwarding unit is used to, when it is detected that the current container wants to access the public network and the current container is not on the gateway DPU node, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node. The second forwarding unit is used to allow the traffic of the current container to continue to pass through the patch port of the local DPU node to the br-out bridge, and then from the br-out bridge to the p0 port to reach the switch. The third forwarding unit is used to forward the traffic of the current container to the p0 network port of the gateway DPU node, and then to the br-out bridge of the gateway DPU node from the patch port to the br-int bridge; The fourth forwarding unit is used to match the traffic of the current container with the corresponding NAT rules, and then through the patch port of the br-int of the gateway DPU node to the br-out bridge, through the p0 port of the gateway DPU node to the switch, and then to the public network.

7. The apparatus according to claim 6, characterized in that, The device is also used for: When it is detected that the current container needs to access another container, the traffic of the current container reaches the br-int bridge of the local DPU node through the vf and vfr of the local DPU node. Perform a generate / vxlan packetization operation on the current container's traffic at port ovn-xxx-0 of the br-int bridge to obtain the packetized traffic; The packetized traffic travels through a tunnel to the p0 port of the local DPU node, then to the switch, and finally to the DPU node of the other container. The p0 network port of the DPU node in the other container reaches the br-int bridge of the DPU node in the other container through a tunnel. The ovn-xxx-0 port of the br-int bridge performs a generate / vxlan unpacking operation on the packetized traffic to obtain the traffic of the current container. The traffic of the current container reaches the other container through the vfr and vf of the DPU node of the other container.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores machine-executable instructions that, when invoked and executed by a processor, cause the processor to perform the method according to any one of claims 1 to 5.

Images