Virtual machine access method and device and storage medium

Abstract

The invention discloses an access method and device of a virtual machine and a storage medium, relates to the technical field of computers, and discloses the access method of the virtual machine, comprising: receiving first information from a client for requesting to establish SPICE connection between the client and a target container group in the virtual machine; and under the condition that the target container group supports SPICE protocol access, establishing SPICE connection between the client and the target container group so as to support the client to access the target container group through the SPICE protocol. According to the virtual machine access method and device, the SPICE protocol and virtual machine access are combined, the client side can access the virtual machine through the SPICE protocol, the SPICE protocol provides richer interaction capacity for virtual machine access, for example, file uploading operation, clipboard sharing and other operation between an operation machine and the virtual machine can be achieved, and the interaction experience of virtual machine access is effectively improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, and storage medium for accessing a virtual machine. Background Art

[0002] In the field of virtual machine technology, KubeVirt, as a mainstream virtualization solution based on the K8s (also known as Kubernetes) platform, provides VNC (Virtual Network Computing) as a remote access method for virtual machines by default.

[0003] However, the VNC solutions currently provided by KubeVirt generally suffer from poor interactive experience in accessing virtual machines.

[0004] The above content is only used to assist in understanding the technical solution of this application and does not constitute an admission that the above content is prior art. Summary of the Invention

[0005] The main purpose of this application is to provide a virtual machine access method, device and storage medium, aiming to solve the technical problem of poor interactive experience of virtual machine access in the VNC solution currently provided by KubeVirt.

[0006] To achieve the above objectives, the present application proposes a method for accessing a virtual machine, the method comprising:

[0007] receiving first information from a client requesting to establish a SPICE connection between the client and a target container group in a virtual machine;

[0008] In a case where the target container group supports SPICE protocol access, a SPICE connection is established between the client and the target container group to enable the client to access the target container group through the SPICE protocol.

[0009] In one embodiment, receiving the first information from the client includes:

[0010] The first information from the client is received through the proxy server and the K8s cluster forwarding in turn.

[0011] In one embodiment, the receiving of the first information from the client via the proxy server and the forwarding of the K8s cluster in sequence includes:

[0012] In a case where both the proxy server and the K8s cluster support access to the target container group, the first information from the client is received via the proxy server and the K8s cluster in sequence.

[0013] In one embodiment, before receiving the first information from the client via the proxy server and the K8s cluster forwarding in sequence, the method further includes:

[0014] intercepting second information sent by the virtual machine; wherein the second information is used to request the creation of a runtime container group;

[0015] Modify the configuration information of the runtime container group in the second information to add at least one application programming interface container to the runtime container group; wherein the application programming interface container supports modification to configure the target container group to provide a network environment supported by the K8s cluster for access.

[0016] In one embodiment, before receiving the first information from the client via the proxy server and the K8s cluster forwarding in sequence, the method further includes:

[0017] The proxy server is configured to support access to a port of the SPICE protocol, and to act as a proxy for the container group to receive the first information from the client.

[0018] In one embodiment, the method further comprises:

[0019] Receive third information from the business layer;

[0020] A label is set for at least one container group where the application programming interface container indicated by the third information is located, so as to indicate that the at least one container group supporting the proxy server access is set with the label.

[0021] In one embodiment, the method further comprises:

[0022] Receive the fourth information from the business layer;

[0023] The tag of at least one container group where the application programming interface container indicated by the fourth information is located is removed, so as to indicate that the proxy server is prohibited from accessing the at least one container group from which the tag is removed.

[0024] In one embodiment, the method further comprises:

[0025] Create the service name corresponding to the runtime container group;

[0026] Binding the service name to the application programming interface container to facilitate the business layer to access the application programming interface container based on the service name;

[0027] Bind the service name to the port of the SPICE protocol to facilitate exposing the SPICE function to the K8s cluster through the service name.

[0028] In one embodiment, before receiving the first information from the client, the method further includes:

[0029] Creating the virtual machine and generating a configuration file corresponding to the virtual machine;

[0030] Add fifth information related to the SPICE protocol to the configuration file, and set the listening address and port corresponding to the SPICE protocol to configure the virtual machine to support the SPICE protocol.

[0031] In one embodiment, adding fifth information related to the SPICE protocol to the configuration file includes:

[0032] Through the Sidecar function provided by KubeVirt, fifth information related to the SPICE protocol is added to the configuration file.

[0033] In addition, to achieve the above-mentioned purpose, the present application also proposes a virtual machine access device, the device comprising:

[0034] A receiving module, configured to receive first information from a client, requesting to establish a SPICE connection between the client and a target container group in a virtual machine;

[0035] The processing module is configured to establish a SPICE connection between the client and the target container group when the target container group supports SPICE protocol access, so as to enable the client to access the target container group through the SPICE protocol.

[0036] In one embodiment, the receiving module is specifically used to receive the first information from the client via the proxy server and the K8s cluster forwarding in sequence.

[0037] In one embodiment, the receiving module is further specifically configured to: when both the proxy server and the K8s cluster support access to the target container group, receive the first information from the client via the proxy server and the K8s cluster in sequence.

[0038] In one embodiment, the processing module is further configured to:

[0039] intercepting a second message sent by the virtual machine; wherein the second message is used to request the creation of a container group;

[0040] Modify the configuration information of the runtime container group in the second information to add at least one application programming interface container to the runtime container group; wherein the application programming interface container supports modification to configure the target container group to provide a network environment supported by the K8s cluster for access.

[0041] In one embodiment, the processing module is further configured to: configure the proxy server to support access to a port of the SPICE protocol, and to proxy the container group to receive the first information from the client.

[0042] In one embodiment, the receiving module is further configured to: receive third information from the business layer;

[0043] The processing module is further configured to set a label for at least one container group where the application programming interface container indicated by the third information is located, so as to indicate that the at least one container group supporting the proxy server to access the set label.

[0044] In one embodiment, the receiving module is further configured to: receive fourth information from the business layer;

[0045] The processing module is further configured to remove a tag from at least one container group where the application programming interface container indicated by the fourth information is located, so as to indicate that the proxy server is prohibited from accessing the at least one container group from which the tag is removed.

[0046] In one embodiment, the processing module is further configured to:

[0047] Create the service name corresponding to the runtime container group;

[0048] Binding the service name to the application programming interface container to facilitate the business layer to access the application programming interface container based on the service name;

[0049] Bind the service name to the port of the SPICE protocol to facilitate exposing the SPICE function to the K8s cluster through the service name.

[0050] In one embodiment, the processing module is further configured to:

[0051] Creating the virtual machine and generating a configuration file corresponding to the virtual machine;

[0052] Add fifth information related to the SPICE protocol to the configuration file, and set the listening address and port corresponding to the SPICE protocol to configure the virtual machine to support the SPICE protocol.

[0053] In one embodiment, the processing module is further specifically configured to:

[0054] Through the Sidecar function provided by KubeVirt, fifth information related to the SPICE protocol is added to the configuration file.

[0055] In addition, to achieve the above-mentioned purpose, the present application also proposes a virtual machine access device, which includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the computer program is configured to implement the steps of the virtual machine access method as described above.

[0056] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium and stores a computer program. When the computer program is executed by the processor, the steps of the virtual machine access method as described above are implemented.

[0057] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the steps of the virtual machine access method as described above.

[0058] One or more technical solutions proposed in this application have at least the following technical effects:

[0059] This application combines the SPICE protocol and virtual machine access. The client can access the virtual machine through the SPICE protocol. The SPICE protocol provides richer interactive capabilities for virtual machine access. For example, it can realize file uploading operations and clipboard sharing between the operating machine and the virtual machine, effectively improving the interactive experience of virtual machine access. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0061] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0062] Figure 1 This is one of the flow charts of the method for accessing a virtual machine provided by this application;

[0063] Figure 2 This is the second flow chart of the method for accessing a virtual machine provided by this application;

[0064] Figure 3 This is the third flow chart of the method for accessing a virtual machine provided by this application;

[0065] Figure 4 This is the fourth flow chart of the method for accessing a virtual machine provided by this application;

[0066] Figure 5 This is the fifth flow chart of the method for accessing a virtual machine provided by this application;

[0067] Figure 6 This is a schematic diagram of the overall process of the virtual machine access method provided by this application;

[0068] Figure 7 This is a flowchart of access control in the virtual machine access method provided by this application;

[0069] Figure 8 This is a schematic diagram of the structure of the virtual machine access device provided by this application;

[0070] Figure 9 This is a schematic diagram of the structure of the access device of the virtual machine provided in this application.

[0071] The purpose, features and advantages of this application will be further explained with reference to the accompanying drawings in conjunction with the embodiments. DETAILED DESCRIPTION

[0072] It should be understood that the specific embodiments described herein are merely used to explain the technical solutions of the present application and are not intended to limit the present application.

[0073] Unless otherwise defined, all technical and scientific terms used in this application have the same meanings as commonly understood by technicians in the technical field to which this application belongs; the terms used in this application are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" in the specification and claims of this application and the above-mentioned figure descriptions and any variations thereof are intended to cover non-exclusive inclusions.

[0074] In the description of the embodiments of this application, the technical terms "first" and "second" are used only to distinguish different objects and should not be understood to indicate or imply relative importance or implicitly indicate the quantity, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, the meaning of "plurality" is two or more, unless otherwise specifically defined.

[0075] References to "embodiments" in this application mean that a particular feature, structure, or characteristic described in connection with the embodiment may be included in at least one embodiment of the application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0076] In the description of the embodiments of this application, the term "and / or" is simply a description of the association relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent the following three situations: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " in this document generally indicates that the associated objects are in an "or" relationship.

[0077] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0078] KubeVirt, a mainstream virtualization solution based on the Kubernetes platform, provides VNC as a default remote access method for virtual machines. However, the VNC solution provided by KubeVirt has the following limitations:

[0079] 1) The H5 (HTML5) page provided by noVnc has poor interactivity, for example, mouse dragging and dropping operations cannot be implemented;

[0080] 2) File upload operations between the operating machine and the virtual machine cannot be performed;

[0081] 3) Clipboard sharing between the operating machine and the virtual machine cannot be achieved.

[0082] In response to the above problems, the present application provides a method, device and storage medium for accessing a virtual machine. Since the SPICE protocol can provide richer interactive capabilities, the present application considers combining the SPICE protocol with virtual machine access. However, due to the architectural design of KubeVirt, the underlying QEMU (Quick EMUlator) process is not directly exposed, resulting in the inability to directly access it using the SPICE protocol. The present application modifies the network environment of the runtime container group (running Pod) in the virtual machine so that it can access the underlying layer of the virtual machine through the K8s network; in addition, the client can access the SPICE service provided by the underlying layer of the Pod running in the virtual machine through the Squid proxy. In this way, the function of accessing the virtual machine through SPICE is achieved.

[0083] It should be noted that the execution subject of the embodiments of the present application can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, mobile phone, etc., or an electronic device capable of performing the above functions, a virtual machine access device, etc. The following uses a virtual machine access device as an example to illustrate the embodiments of the present application and the following embodiments.

[0084] The following embodiments of the present application and the following embodiments are described in detail.

[0085] The present application embodiment provides a method for accessing a virtual machine, referring to Figure 1 , Figure 1 This is one of the flow charts of the method for accessing a virtual machine provided in this application, which includes steps S101 to S102:

[0086] Step S101: Receive first information from a client, requesting to establish a SPICE connection between the client and a target container group in a virtual machine.

[0087] It should be noted that the client requesting to establish a SPICE connection needs to support the SPICE protocol.

[0088] It should also be noted that the target container group is also called the target Pod, and one or more containers can be set in a Pod.

[0089] Step S102 : If the target container group supports SPICE protocol access, a SPICE connection is established between the client and the target container group to enable the client to access the target container group through the SPICE protocol.

[0090] Specifically, when the client needs to access the virtual machine using the SPICE protocol, it can first send a first message to the target Pod in the virtual machine to request to establish a SPICE connection between the client and the target Pod in the virtual machine. After receiving the first message, the target Pod determines whether the target Pod supports SPICE protocol access. If it supports SPICE protocol access, a SPICE connection can be established with the client. After the SPICE connection is established, the client can access the target Pod in the virtual machine through the SPICE protocol.

[0091] An embodiment of the present application provides a method for accessing a virtual machine, which combines the SPICE protocol and virtual machine access. The client can access the virtual machine through the SPICE protocol, wherein the SPICE protocol provides richer interactive capabilities for virtual machine access, such as file upload operations and clipboard sharing between the operating machine and the virtual machine, effectively improving the interactive experience of virtual machine access.

[0092] In some embodiments, a specific implementation manner of receiving first information from a client by a target container group in a virtual machine is provided. Figure 2 This is the second flow chart of the method for accessing a virtual machine provided by this application, such as Figure 2 As shown, in Figure 1 On the basis of, the above step S101 includes:

[0093] Step S101 - 1 , receiving first information from a client via a proxy server and a K8s cluster in sequence, for requesting to establish a SPICE connection between the client and a target container group in a virtual machine.

[0094] In some embodiments, the proxy server may be a Squid proxy server. The Squid proxy may serve as a bridge between the client and the virtual machine, providing functions such as caching, request forwarding, and proxy services.

[0095] Specifically, the target container group of the virtual machine is usually not directly exposed to the client, resulting in the client being unable to directly access it. This application can use the proxy server and the proxy forwarding of the K8s cluster to achieve access to the target container group.

[0096] In some embodiments, a specific implementation of receiving the first information from the client via the proxy server and the K8s cluster in sequence may include:

[0097] In a case where both the proxy server and the K8s cluster support access to the target container group, the first information from the client is received via the proxy server and the K8s cluster in sequence.

[0098] Specifically, before the proxy server and K8s cluster forward the first information from the client, they first need to determine whether the proxy server and K8s cluster support access to the target Pod. Only when both support access to the target Pod can the proxy forward the first information to the target Pod. Otherwise, the proxy server and K8s cluster need to be configured to support access to the target Pod.

[0099] In some embodiments, a specific implementation method is provided for configuring the target container group to provide a network environment that supports access to the K8s cluster. Figure 2 As shown, before step S101-1, the above method may further include the following steps:

[0100] Step S103, intercepting the second information sent by the virtual machine;

[0101] The second information is used to request creation of a runtime container group.

[0102] In some embodiments, the second information sent by the virtual machine may be intercepted by a Mutating Webhook.

[0103] Step S104, modifying the configuration information of the runtime container group in the second information so as to add at least one application programming interface container to the runtime container group;

[0104] The application programming interface container supports modification to configure the target container group to provide a network environment that supports access by the K8s cluster.

[0105] It should be noted that the application programming interface container is also called the API (Application Programming Interface) container. Adding an API container helps to adjust the network environment of the Pod where the API container is running by modifying the configuration of the API container.

[0106] Specifically, when a virtual machine requests to create a runtime container group, it can intercept the second information for requesting creation, and modify the configuration information of the runtime container group in the second information, so that at least one application programming interface container, that is, an API container, is added to the runtime container group, and then the runtime container group is created using the modified second information. Since each container in a runtime container group is equal, the API container can be modified so that other containers in the runtime container group are also modified accordingly, and then the network environment supported by the K8s cluster for access is modified in the runtime container so that the K8s cluster can access the runtime container group normally. This application does not need to recreate a runtime container with a network environment supported by the K8s cluster for access, and the configuration is simple and effective.

[0107] In some embodiments, a specific implementation method of configuring a proxy server to support access to a target container group is provided. Figure 2 As shown, before step S101-1, the above method may further include:

[0108] Step S105 : configuring the proxy server to support access to the port of the SPICE protocol, and proxying the container group to receive the first information from the client.

[0109] It should be noted that this application does not limit the order of executing the above steps S103 to S104 and step S105, that is, it does not limit whether the network environment of the target container group is configured first or the proxy server is configured first. This application only illustrates an example of executing steps S103 and S104 first and then executing step S105.

[0110] Specifically, the client needs to access the K8s cluster through the proxy server, and then access the container group of the virtual machine. Therefore, the proxy server needs to be configured synchronously, and the proxy server needs to support access to the port of the SPICE protocol to interact with the client that supports the SPICE protocol, and the proxy container group receives the first information sent by the client, and then forwards it to the container group side through the K8s cluster, so as to realize the client's access to the container group in the virtual machine.

[0111] In some embodiments, a specific implementation method for dynamically controlling access rights of a container group at a business layer is provided. Figure 3 This is the third flow chart of the method for accessing a virtual machine provided by this application, such as Figure 3 As shown, the method for accessing a virtual machine further includes steps S301 to S302:

[0112] Step S301: Receive third information from the business layer.

[0113] Step S302: Setting a label for at least one container group where the application programming interface container indicated by the third information is located, so as to indicate that the at least one container group supporting the proxy server access setting the label.

[0114] It should be noted that steps S301 and S302 may occur before step S101. After the user clicks the button to establish a SPICE with the container group, the service layer may be triggered to send the third information to the container group. If the container group includes an API container indicated by the third information, a label may be set for the container group to indicate that it supports proxy server access. Other container groups that are not tagged are considered not to support proxy server access.

[0115] In some embodiments, the business layer may also dynamically remove at least some of the tags set in the container group according to actual needs to indicate that it does not support proxy server access.

[0116] In some embodiments, another specific implementation method for dynamically controlling access rights of a container group at the business layer is provided. The above method may further include the following steps:

[0117] Receive the fourth information from the business layer;

[0118] The tag of at least one container group where the application programming interface container indicated by the fourth information is located is removed, so as to indicate that the proxy server is prohibited from accessing the at least one container group from which the tag is removed.

[0119] Specifically, the business layer can also dynamically control the access permissions of the container group. Specifically, it can send a third information to indicate the API container, and then set a label for at least one container group where the API container is located to indicate that these container groups support access by the proxy server, that is, these container groups support access by the client through the proxy server, providing fine-grained access control at the container group level. When the client accesses some container groups with labels, it will not affect other container groups, thereby ensuring the security of other container groups. In addition, the business layer can dynamically set or remove labels to dynamically adjust the container groups that can be accessed.

[0120] In some embodiments, Figure 4This is the fourth flow chart of the method for accessing a virtual machine provided by this application, such as Figure 4 As shown, the method for accessing a virtual machine further includes steps S401 to S403:

[0121] Step S401: Create a service name corresponding to the runtime container group.

[0122] It should be noted that the above service name can be called SVC (service), and the service name can be set according to actual needs and is not limited in this application.

[0123] Step S402 : Bind the service name to the application programming interface container, so that the business layer can access the application programming interface container based on the service name.

[0124] Step S403: Bind the service name to the port of the SPICE protocol to facilitate exposing the SPICE function to the K8s cluster through the service name.

[0125] It should be noted that this application does not limit the order between the above steps S402 and S403, that is, the service name and the API container can be bound first, or the service name and the port of the SPICE protocol can be bound first, or both can be bound at the same time.

[0126] Specifically, this application creates a corresponding service name for the runtime container group and binds the service name to the API container, so that the business layer can access the API container in the corresponding runtime container based on the service name. It also binds the service name to the port of the SPICE protocol to facilitate the exposure of SPICE functions to the K8s cluster through the service name. Since the address of the container group is not fixed, in order to ensure that the container group can be called normally later, this application creates a corresponding service name for the container group. The service name can be considered relatively fixed, which makes it easy to use the service name to find the corresponding container group and perform operations.

[0127] In some embodiments, a specific implementation method for configuring a virtual machine to support the SPICE protocol when creating the virtual machine is provided. Figure 5 This is the fifth flow chart of the method for accessing a virtual machine provided by this application, such as Figure 5 As shown, in Figure 1 On the basis of the above, before step S101, the following steps are further included:

[0128] Step S106: Create the virtual machine and generate a configuration file corresponding to the virtual machine.

[0129] It should be noted that the configuration file corresponding to the virtual machine generated above may be Libvirt XML.

[0130] Step S107: Add fifth information related to the SPICE protocol to the configuration file, and set a listening address and port corresponding to the SPICE protocol to configure the virtual machine to support the SPICE protocol.

[0131] In some embodiments, a specific implementation of adding the fifth information related to the SPICE protocol to the configuration file may include:

[0132] Through the Sidecar function provided by KubeVirt, fifth information related to the SPICE protocol is added to the configuration file.

[0133] Specifically, the Sidecar function provided by KubeVirt can be used to inject containers into the runtime Pod of the virtual machine to modify the virtual machine parameters, and the Sidecar function can be used to add SPICE protocol-related configurations to the Libvirt XML generated by Kubevirt.

[0134] In an embodiment of the present application, in order to configure the virtual machine to support the SPICE protocol, the generated configuration file can be modified during the virtual machine creation stage, specifically adding the fifth information related to the SPICE protocol, and setting the corresponding listening address and port. The configuration is simple and effective, and does not affect the original process of creating the virtual machine.

[0135] The following examples illustrate the method for accessing a virtual machine provided by an embodiment of the present application. Based on the business scenario, the present application includes the following contents:

[0136] 1) Virtual machine creation phase:

[0137] ① Use the Sidecar function provided by KubeVirt to inject containers into the runtime Pod of the virtual machine to modify the virtual machine parameters;

[0138] ② Use the Sidecar function to add SPICE protocol-related configurations to the Libvirt XML generated by Kubevirt;

[0139] ③Set the SPICE listening address and port.

[0140] 2) Pod modification phase when the virtual machine is running:

[0141] ①Mutating Webhook intercepts the virtual machine Pod creation request;

[0142] ② Modify the configuration of the Pod when the virtual machine is running, inject the API container, and realize the ability to directly operate Libvirt through the API;

[0143] ③ Modify the network environment of the entire Pod through the injected container so that the K8s cluster can access the runtime Pod normally.

[0144] 3) Service exposure stage:

[0145] ① Create an SVC binding to the runtime Pod;

[0146] ②SVC binding API port is used by the internal business layer of the cluster to access the API container in the virtual machine;

[0147] ③SVC binds the SPICE protocol port to expose SPICE functions to the cluster.

[0148] 4) Proxy configuration phase:

[0149] ① Deploy Squid proxy server to proxy Pod;

[0150] ②Configure the Squid proxy server to allow access to the port of the SPICE protocol;

[0151] ③ Set access control rules, for example, allow the Squid proxy server to resolve domain names, resolve SVC to the address of the Pod itself, or allow a Squid proxy server to only proxy a certain port.

[0152] 5) Security control mechanism:

[0153] ① Configure the egress rules of the Squid proxy Pod through Network Policy. For example, you can allow the release of a certain label and limit which ports with which labels are set to be accessible.

[0154] ②Implement tag management API services;

[0155] ③The business layer dynamically controls access rights.

[0156] In summary, Figure 6 This is a schematic diagram of the overall process of the virtual machine access method provided by this application, such as Figure 6 As shown, it is mainly divided into the following four parts:

[0157] 1) The SPICE client sets the proxy to point to Squid's SVC, and then accesses the Pod in the virtual machine through the Squid proxy server and K8s SVC. Specifically, the egress rules of the Squid proxy server are configured through Network Policy, and the K8s SVC port is mapped to the Pod in the virtual machine.

[0158] 2) The business layer calls the label management API to dynamically control the labels of Pods in the virtual machine.

[0159] 3) Mutating Webhook modifies the definition of the Pod in the virtual machine.

[0160] 4) The Sidecar container modifies the Libvirt XML definition to enable the virtual machine to support the SPICE protocol.

[0161] Figure 7 This is a flowchart of access control in the virtual machine access method provided by this application, such as Figure 7 As shown, it includes steps S701 to S706;

[0162] In step S701, the business layer requests the API server to add an access tag.

[0163] Step S702: The API server sets a label for the Pod in the virtual machine.

[0164] Step S703: The client sends a SPICE connection request to the Squid proxy server.

[0165] Step S704: The Squid proxy server forwards the request to the K8s SVC (needs to pass the egress rule verification).

[0166] Step S705: K8s SVC forwards the request to the Pod in the virtual machine.

[0167] Step S706: A SPICE connection is established between the Pod in the virtual machine and the client.

[0168] In the embodiments of the present application, there are at least the following beneficial effects:

[0169] a) By combining the SPICE protocol with virtual machine access, the interactive experience of virtual machine access is improved, and functions such as file transfer and clipboard sharing are also implemented;

[0170] b) The uniformity of the KubeVirt system architecture is maintained. That is, this application does not change the relevant configuration of the KubeVirt system. Even if the KubeVirt system is subsequently upgraded or updated, it will not affect the implementation of this application.

[0171] c) Dynamically control access rights through the business layer, provide a fine-grained access control mechanism, and achieve dynamic security control.

[0172] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the access method of the virtual machine of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0173] This application also provides a virtual machine access device, Figure 8 This is a schematic diagram of the structure of the access device of the virtual machine provided by this application, such as Figure 8 As shown, the access device of the virtual machine includes:

[0174] A receiving module 801 is configured to receive first information from a client, requesting to establish a SPICE connection between the client and a target container group in a virtual machine;

[0175] The processing module 802 is configured to establish a SPICE connection between the client and the target container group if the target container group supports SPICE protocol access, so as to enable the client to access the target container group through the SPICE protocol.

[0176] In some embodiments, the receiving module 801 is specifically used to receive the first information from the client via the proxy server and the K8s cluster forwarding in sequence.

[0177] In some embodiments, the receiving module 801 is further specifically configured to: when both the proxy server and the K8s cluster support access to the target container group, receive the first information from the client via the proxy server and the K8s cluster in sequence.

[0178] In some embodiments, the processing module 802 is further configured to:

[0179] intercepting a second message sent by the virtual machine; wherein the second message is used to request the creation of a container group;

[0180] Modify the configuration information of the runtime container group in the second information to add at least one application programming interface container to the runtime container group; wherein the application programming interface container supports modification to configure the target container group to provide a network environment supported by the K8s cluster for access.

[0181] In some embodiments, the processing module 802 is further configured to: configure the proxy server to support access to a port of the SPICE protocol, and to proxy the container group to receive the first information from the client.

[0182] In some embodiments, the receiving module 801 is further configured to: receive third information from the business layer;

[0183] The processing module 802 is further configured to set a label for at least one container group where the application programming interface container indicated by the third information is located, so as to indicate that the at least one container group supporting the proxy server access sets the label.

[0184] In some embodiments, the receiving module 801 is further configured to: receive fourth information from the business layer;

[0185] The processing module 802 is further configured to remove a tag from at least one container group where the application programming interface container indicated by the fourth information is located, so as to indicate that the proxy server is prohibited from accessing the at least one container group from which the tag is removed.

[0186] In some embodiments, the processing module 802 is further configured to:

[0187] Create the service name corresponding to the runtime container group;

[0188] Binding the service name to the application programming interface container to facilitate the business layer to access the application programming interface container based on the service name;

[0189] Bind the service name to the port of the SPICE protocol to facilitate exposing the SPICE function to the K8s cluster through the service name.

[0190] In some embodiments, the processing module 802 is further configured to:

[0191] Creating the virtual machine and generating a configuration file corresponding to the virtual machine;

[0192] Add fifth information related to the SPICE protocol to the configuration file, and set the listening address and port corresponding to the SPICE protocol to configure the virtual machine to support the SPICE protocol.

[0193] In some embodiments, the processing module 802 is further specifically configured to:

[0194] Through the Sidecar function provided by KubeVirt, fifth information related to the SPICE protocol is added to the configuration file.

[0195] The virtual machine access device provided in this application, using the virtual machine access method described in the aforementioned embodiments, can address the technical issue of poor interactive experience in virtual machine access, a common issue with the current VNC solution provided by KubeVirt. Compared to the prior art, the virtual machine access device provided in this application has the same beneficial effects as the virtual machine access method described in the aforementioned embodiments. Other technical features of the virtual machine access device are the same as those disclosed in the aforementioned embodiments and are not further elaborated here.

[0196] The present application provides a virtual machine access device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the virtual machine access method in the above embodiment.

[0197] Reference below Figure 9 , Figure 9 The present application provides a schematic diagram of a virtual machine access device, which illustrates a schematic diagram of a virtual machine access device suitable for implementing embodiments of the present application. The virtual machine access device in the embodiments of the present application may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 9 The access device of the virtual machine shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0198] like Figure 9 As shown, the virtual machine's access device may include a processing device 901 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in a read-only memory (ROM) 902 or programs loaded from a storage device 903 into a random access memory (RAM) 904. RAM 904 also stores various programs and data required for the operation of the virtual machine's access device. Processing device 901, ROM 902, and RAM 904 are interconnected via a bus 905. An input / output (I / O) interface 906 is also connected to the bus. Typically, the following systems can be connected to I / O interface 906: input devices 907 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 908 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage device 903 including, for example, a magnetic tape, hard disk, etc.; and communication device 909. The communication device 909 can allow the virtual machine's access device to communicate with other devices wirelessly or wired to exchange data. Although the figure shows the virtual machine's access device with various systems, it should be understood that it is not required to implement or have all of the systems shown. More or fewer systems can be implemented or provided instead.

[0199] In particular, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device 903, or installed from a ROM 902. When the computer program is executed by the processing device 901, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0200] The virtual machine access device provided in this application, utilizing the virtual machine access method described in the aforementioned embodiments, can address the technical issue of poor interactive virtual machine access experience commonly encountered in the current VNC solution provided by KubeVirt. Compared to the prior art, the virtual machine access device provided in this application has the same beneficial effects as the virtual machine access method described in the aforementioned embodiments. Other technical features of this virtual machine access device are the same as those disclosed in the aforementioned embodiments and are not further elaborated here.

[0201] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0202] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0203] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, a computer program) stored thereon, wherein the computer-readable program instructions are used to execute the method for accessing the virtual machine in the above-mentioned embodiment.

[0204] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0205] The computer-readable storage medium may be included in the access device of the virtual machine; or may exist independently without being assembled into the access device of the virtual machine.

[0206] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the access device of the virtual machine, the access device of the virtual machine performs the following steps:

[0207] receiving first information from a client requesting to establish a SPICE connection between the client and a target container group in a virtual machine;

[0208] In a case where the target container group supports SPICE protocol access, a SPICE connection is established between the client and the target container group to enable the client to access the target container group through the SPICE protocol.

[0209] Computer program code for performing the operations of the present application may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0210] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0211] The modules described in the embodiments of the present application may be implemented in software or hardware, wherein the name of a module does not necessarily limit the unit itself.

[0212] The computer-readable storage medium provided in this application stores computer-readable program instructions (i.e., a computer program) for executing the aforementioned method for accessing a virtual machine. This computer-readable storage medium can address the current technical issue of KubeVirt's VNC solution, which generally suffers from a poor interactive experience in accessing virtual machines. Compared to the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the method for accessing a virtual machine provided in the aforementioned embodiments, and are not further elaborated here.

[0213] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned virtual machine access method when executed by a processor.

[0214] The computer program product provided in this application can address the technical issue of poor interactive experience in virtual machine access, which is common in the current VNC solution provided by KubeVirt. Compared to the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the virtual machine access method provided in the above-mentioned embodiments, and are not further elaborated here.

[0215] The above description is only part of the embodiments of the present application and does not limit the patent scope of the present application. All equivalent structural transformations made by using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect application in other related technical fields are included in the patent protection scope of the present application.

[0216] The present application discloses A1, a method for accessing a virtual machine, the method comprising:

[0217] receiving first information from a client requesting to establish a SPICE connection between the client and a target container group in a virtual machine;

[0218] In a case where the target container group supports SPICE protocol access, a SPICE connection is established between the client and the target container group to enable the client to access the target container group through the SPICE protocol.

[0219] A2. The method according to A1, wherein receiving the first information from the client comprises:

[0220] The first information from the client is received through the proxy server and the K8s cluster forwarding in turn.

[0221] A3. The method as described in A2, wherein the first information is received from the client via the proxy server and the K8s cluster forwarding in sequence, including:

[0222] In a case where both the proxy server and the K8s cluster support access to the target container group, the first information from the client is received via the proxy server and the K8s cluster in sequence.

[0223] A4. The method as described in A2 or A3, before receiving the first information from the client via the proxy server and the K8s cluster forwarding in sequence, the method further includes:

[0224] intercepting second information sent by the virtual machine; wherein the second information is used to request the creation of a runtime container group;

[0225] Modify the configuration information of the runtime container group in the second information to add at least one application programming interface container to the runtime container group; wherein the application programming interface container supports modification to configure the target container group to provide a network environment supported by the K8s cluster for access.

[0226] A5. The method as described in A2 or A3, before receiving the first information from the client via the proxy server and the K8s cluster forwarding in sequence, the method further includes:

[0227] The proxy server is configured to support access to a port of the SPICE protocol, and to act as a proxy for the container group to receive the first information from the client.

[0228] A6. The method according to A5, further comprising:

[0229] Receive third information from the business layer;

[0230] A label is set for at least one container group where the application programming interface container indicated by the third information is located, so as to indicate that the at least one container group supporting the proxy server access is set with the label.

[0231] A7. The method according to A5, further comprising:

[0232] Receive the fourth information from the business layer;

[0233] The tag of at least one container group where the application programming interface container indicated by the fourth information is located is removed, so as to indicate that the proxy server is prohibited from accessing the at least one container group from which the tag is removed.

[0234] A8. The method according to A6 or A7, further comprising:

[0235] Create the service name corresponding to the runtime container group;

[0236] Binding the service name to the application programming interface container to facilitate the business layer to access the application programming interface container based on the service name;

[0237] Bind the service name to the port of the SPICE protocol to facilitate exposing the SPICE function to the K8s cluster through the service name.

[0238] A9. The method according to any one of A1 to A3, before receiving the first information from the client, further comprising:

[0239] Creating the virtual machine and generating a configuration file corresponding to the virtual machine;

[0240] Add fifth information related to the SPICE protocol to the configuration file, and set the listening address and port corresponding to the SPICE protocol to configure the virtual machine to support the SPICE protocol.

[0241] A10. The method according to A9, wherein adding fifth information related to the SPICE protocol to the configuration file comprises:

[0242] Through the Sidecar function provided by KubeVirt, fifth information related to the SPICE protocol is added to the configuration file.

[0243] The present application also discloses B1, a virtual machine access device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the virtual machine access method described in any one of A1 to A8.

[0244] The present application also discloses C1, a storage medium, which is a computer-readable storage medium and stores a computer program. When the computer program is executed by a processor, the steps of the method for accessing a virtual machine as described in any one of A1 to A8 are implemented.

[0245] The present application also discloses D1, a device for accessing a virtual machine, the device comprising:

[0246] A receiving module, configured to receive first information from a client, requesting to establish a SPICE connection between the client and a target container group in a virtual machine;

[0247] The processing module is configured to establish a SPICE connection between the client and the target container group when the target container group supports SPICE protocol access, so as to enable the client to access the target container group through the SPICE protocol.

[0248] D2. In the device as described in D1, the receiving module is specifically used to: receive the first information from the client via the proxy server and the K8s cluster forwarding in sequence.

[0249] D3. In the device as described in D2, the receiving module is further specifically used to: when both the proxy server and the K8s cluster support access to the target container group, receive the first information from the client via the proxy server and the K8s cluster in sequence.

[0250] D4. The device according to D2 or D3, wherein the processing module is further configured to:

[0251] intercepting a second message sent by the virtual machine; wherein the second message is used to request the creation of a container group;

[0252] Modify the configuration information of the runtime container group in the second information to add at least one application programming interface container to the runtime container group; wherein the application programming interface container supports modification to configure the target container group to provide a network environment supported by the K8s cluster for access.

[0253] D5. In the device as described in D2 or D3, the processing module is further used to: configure the proxy server to support access to the port of the SPICE protocol, and proxy the container group to receive the first information from the client.

[0254] D6. The device according to D5, wherein the receiving module is further configured to: receive third information from the service layer;

[0255] The processing module is further configured to set a label for at least one container group where the application programming interface container indicated by the third information is located, so as to indicate that the at least one container group supporting the proxy server to access the set label.

[0256] D7. The device according to D5, wherein the receiving module is further configured to: receive fourth information from the service layer;

[0257] The processing module is further configured to remove a tag from at least one container group where the application programming interface container indicated by the fourth information is located, so as to indicate that the proxy server is prohibited from accessing the at least one container group from which the tag is removed.

[0258] D8. The device according to D6 or D7, wherein the processing module is further configured to:

[0259] Create the service name corresponding to the runtime container group;

[0260] Binding the service name to the application programming interface container to facilitate the business layer to access the application programming interface container based on the service name;

[0261] Bind the service name to the port of the SPICE protocol to facilitate exposing the SPICE function to the K8s cluster through the service name.

[0262] D9. The device according to any one of D1 to D3, wherein the processing module is further configured to:

[0263] Creating the virtual machine and generating a configuration file corresponding to the virtual machine;

[0264] Add fifth information related to the SPICE protocol to the configuration file, and set the listening address and port corresponding to the SPICE protocol to configure the virtual machine to support the SPICE protocol.

[0265] D10. The device according to D9, wherein the processing module is further configured to:

[0266] Through the Sidecar function provided by KubeVirt, fifth information related to the SPICE protocol is added to the configuration file.

Claims

1. A method for accessing a virtual machine, characterized in that: The method comprises: receiving first information from a client requesting to establish a SPICE connection between the client and a target container group in a virtual machine; In a case where the target container group supports SPICE protocol access, a SPICE connection is established between the client and the target container group to enable the client to access the target container group through the SPICE protocol.

2. The method according to claim 1, wherein The receiving of first information from the client includes: The first information from the client is received through the proxy server and the K8s cluster forwarding in turn.

3. The method according to claim 2, wherein The receiving of the first information from the client via the proxy server and the K8s cluster forwarding in sequence includes: In a case where both the proxy server and the K8s cluster support access to the target container group, the first information from the client is received via the proxy server and the K8s cluster in sequence.

4. The method according to claim 2 or 3, wherein: Before receiving the first information from the client via the proxy server and the K8s cluster forwarding in sequence, the method further includes: intercepting second information sent by the virtual machine; wherein the second information is used to request the creation of a runtime container group; Modify the configuration information of the runtime container group in the second information to add at least one application programming interface container to the runtime container group; wherein the application programming interface container supports modification to configure the target container group to provide a network environment supported by the K8s cluster for access.

5. The method according to claim 2 or 3, wherein: Before receiving the first information from the client via the proxy server and the K8s cluster forwarding in sequence, the method further includes: The proxy server is configured to support access to a port of the SPICE protocol, and to act as a proxy for the container group to receive the first information from the client.

6. The method according to claim 5, wherein The method further comprises: Receive third information from the business layer; A label is set for at least one container group where the application programming interface container indicated by the third information is located, so as to indicate that the at least one container group supporting the proxy server access is set with the label.

7. The method according to claim 5, wherein The method further comprises: Receive the fourth information from the business layer; The tag of at least one container group where the application programming interface container indicated by the fourth information is located is removed, so as to indicate that the proxy server is prohibited from accessing the at least one container group from which the tag is removed.

8. The method according to claim 6 or 7, wherein: The method further comprises: Create the service name corresponding to the runtime container group; Binding the service name to the application programming interface container to facilitate the business layer to access the application programming interface container based on the service name; Bind the service name to the port of the SPICE protocol to facilitate exposing the SPICE function to the K8s cluster through the service name.

9. The method according to any one of claims 1 to 3, wherein: Before receiving the first information from the client, the method further includes: Creating the virtual machine and generating a configuration file corresponding to the virtual machine; Add fifth information related to the SPICE protocol to the configuration file, and set the listening address and port corresponding to the SPICE protocol to configure the virtual machine to support the SPICE protocol.

10. The method according to claim 9, wherein The fifth information related to the SPICE protocol is added to the configuration file, including: Through the Sidecar function provided by KubeVirt, fifth information related to the SPICE protocol is added to the configuration file.

Images