Network detection operation and maintenance device

Abstract

The invention discloses a network detection operation and maintenance device. The device comprises a command executable file of a client, a management component of a server and a daemon process running on each node of a container cloud platform. The command executable file is used for setting configuration parameters of the detection task and accessing the management component in combination with identity information of the operation and maintenance personnel. The management component is responsible for identity authentication, configuration parameter analysis, generation of a to-be-detected container list and a detection instruction, and sending related data and an authorized access token to a command executable file. After the command executable file is received, the daemon process of the node where each container is located is accessed. And after the daemon process receives the detection request and the authorized access token, calling a host machine node container runtime interface through the mounted socket file, downloading a detector container mirror image, operating the detector container and generating a detection result. According to the operation and maintenance device, the efficiency, safety and flexibility of network detection operation and maintenance are remarkably improved, and the operation and maintenance device is suitable for complex and changeable network environments.

Description

Technical Field

[0001] The present application relates to the field of network detection technology, and in particular to a network detection operation and maintenance device. Background Art

[0002] In the operation and maintenance management of container cloud platforms, rapid diagnosis and location of network faults are critical to ensuring stable platform operation. Network probing, as a core technology, provides a crucial basis for troubleshooting by monitoring and analyzing network traffic, connection status, and data transmission paths. It plays an irreplaceable role in fault diagnosis for cloud-native architectures.

[0003] However, with the rapid development of cloud computing and the widespread adoption of microservice architectures and container technologies, the network environment of container cloud platforms has become increasingly complex. On the one hand, the number of nodes and containers within the platform has increased dramatically, leading to exponential growth in network traffic. On the other hand, inter-service dependencies have become increasingly complex, and the lifecycles of nodes and containers are short and dynamic, with their status rapidly changing in response to business needs.

[0004] In this context, traditional network detection tools, due to their own design limitations, generally have the inherent defect of single-point monitoring; they are difficult to adapt to the dynamic changes of nodes and containers in container cloud platforms, have poor adaptability to distributed network environments, and cannot effectively cover complex network scenarios with multiple nodes and multiple containers, which seriously restricts the efficiency and accuracy of network fault diagnosis in container cloud platforms. Summary of the Invention

[0005] Based on the above problems, the present application provides a network detection and operation and maintenance device that can reduce the complexity of network detection for operation and maintenance personnel, and at the same time automatically adapt to the rapid changes in the status of nodes and containers in the container cloud platform, effectively cope with multi-node, distributed, and complex dependency network environments, and improve the efficiency and accuracy of network fault diagnosis on the container cloud platform.

[0006] The embodiments of this application disclose the following technical solutions:

[0007] In a first aspect, the present application discloses a network detection and operation and maintenance device, the device comprising: a command executable file running on a client, a management component running on a server, and a daemon process running on each node of a container cloud platform;

[0008] The command executable file is used to set the configuration parameters of the target detection task; and access the management component based on the configuration parameters and the identity information of the operation and maintenance personnel;

[0009] The management component is configured to authenticate the identity information; parse the configuration parameters to generate a parsing result; generate a list of containers to be detected based on the parsing result and the container cloud platform control plane; generate a detection instruction based on the list of containers to be detected; and send the list of containers to be detected, the detection instruction, and the authorized access token to the command executable file;

[0010] The command executable file is further configured to access the daemon process of the node where each container in the list of containers to be detected is located after receiving the detection instruction and the authorized access token;

[0011] The daemon process is used to call the interface of the host node container runtime based on the socket file of the mounted host node container runtime after receiving the detection request and the authorized access token to download the detector container image; run the detector container based on the configuration parameters and the detector container image to generate a detection result; and send the detection result to the command executable file.

[0012] In an optional implementation, the daemon process is further configured to start a new detection container on the node where the target pod container specified in the target detection task is located, so as to capture network packets of the node where the target pod container is located.

[0013] In an optional implementation, the command executable file is further used to store the detection result in a local directory of the client.

[0014] In an optional implementation, the command executable file is further used to display the detection result in a Shell window of the client in real time.

[0015] In an optional implementation, the guard is further used to restart the detector container and continue to execute the target detection task after the detector container exits abnormally.

[0016] In an optional implementation, the command line executable file is also used to monitor the size of the collected network packets; if the size of a single network packet is larger than a preset packet threshold, the currently executing target detection task is shut down; and after the target detection task is stopped, a new detection task is started.

[0017] In an optional implementation, the management component is further configured to detect the workload of the cluster, the working status of the pods and containers of the container cloud platform, and transmit the detected working status to the command executable file.

[0018] In an optional implementation, the command executable file is further used to update the target detection task based on the detected working status.

[0019] In an optional implementation, the command executable file is further used to send a detection termination request to all daemons that are executing the target detection task after determining that the execution time of the target detection task exceeds a preset time length threshold.

[0020] In an optional implementation, the daemon process is further configured to close and delete the probe container via a sigterm signal after receiving the probe termination request.

[0021] Compared with the existing technology, this application has the following beneficial effects:

[0022] The network operation and maintenance device disclosed in the present application realizes efficient, secure and flexible network detection and operation and maintenance functions through the collaborative work of the client, server and container cloud platform. First, the device ensures the security and compliance of the detection task through the interaction of command executable files and management components, combined with the identity authentication and authorization of operation and maintenance personnel. Secondly, the management component can parse the configuration parameters and generate a list of containers to be detected and detection instructions, realizing the automatic configuration and management of the detection task, greatly improving the operation and maintenance efficiency. In addition, the device uses the daemon process of the container cloud platform to run the detector container on the host node and generate detection results, making full use of the isolation and scalability of container technology, and can quickly adapt to network environments of different scales. At the same time, by calling the host node container runtime interface through the socket file, efficient resource utilization and rapid deployment of the detector container are achieved. Overall, the device significantly improves the efficiency, security and flexibility of network detection and operation and maintenance, reduces operation and maintenance costs, is suitable for complex and changeable network environments, and provides powerful tool support for network operation and maintenance personnel. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0024] Figure 1 A schematic diagram of the structure of a network detection and operation and maintenance device provided in an embodiment of the present application;

[0025] Figure 2 A schematic diagram of the interaction between the various components in a network detection and operation and maintenance device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] As previously described, the rapid development of cloud computing and the widespread adoption of microservices architectures and container technologies have led to increasingly complex network environments within container cloud platforms. Containers and nodes within a container cloud platform cluster are constantly changing, making it difficult for operations personnel to quickly track their status using traditional network detection tools.

[0027] Taking the Kubernetes cluster in the container cloud platform as an example, pods may run on any node in the cluster, and operations personnel need to perform network detection on each pod on the node. In a Kubernetes cluster, applications often contain multiple workloads, each workload contains multiple pods, and the number of containers may reach hundreds. Because the container cloud platform uses a distributed architecture, these containers are distributed across many nodes. Operations personnel need to first query the ID of each container in the cluster, then go to the node where each container is located to enter its network namespace, and finally perform network detection tasks. This process needs to be repeated hundreds of times, which means that operations personnel can hardly use traditional network detection tools to fully detect the application.

[0028] Furthermore, many application access failures occur during pod rolling updates. During this period, new pods are gradually released and old pods are gradually deleted. Traditional network probing tools cannot automatically track these state changes or quickly initiate network probing tasks for new pods, potentially resulting in the loss of important network packets.

[0029] To address at least some of the aforementioned technical issues, the present application discloses a network detection and operation and maintenance device. The network operation and maintenance device disclosed in this application implements efficient, secure, and flexible network detection and operation and maintenance functions through the collaborative work of a client, a server, and a container cloud platform. First, the device ensures the security and compliance of detection tasks through the interaction of command executable files and management components, combined with the identity authentication and authorization of operation and maintenance personnel. Second, the management component can parse configuration parameters and generate a list of containers to be detected and detection instructions, enabling automated configuration and management of detection tasks and significantly improving operation and maintenance efficiency. Furthermore, the device utilizes the daemon process of the container cloud platform to run detector containers on host nodes and generate detection results, fully leveraging the isolation and scalability of container technology and enabling rapid adaptation to network environments of varying scales. Furthermore, by calling the host node container runtime interface through a socket file, efficient resource utilization and rapid deployment of detector containers are achieved. Overall, the device significantly improves the efficiency, security, and flexibility of network detection and operation and maintenance, reduces operation and maintenance costs, is suitable for complex and changing network environments, and provides powerful tool support for network operation and maintenance personnel.

[0030] To facilitate understanding of the technical solutions in this application, the technical terms involved in this application are first explained.

[0031] Cloud computing is an Internet-based computing service model that integrates and dynamically manages distributed computing resources through software-defined resource pooling technology, achieving elastic supply and on-demand allocation of computing resources.

[0032] The Container Cloud Platform is a cloud computing infrastructure built on container technology, enabling standardized application packaging and delivery through containerization. The platform integrates automated operations and maintenance tools to manage the entire container lifecycle. Leveraging orchestration systems like Kubernetes, it enables intelligent scheduling, dynamic scaling, and load balancing of container resources, significantly improving the efficiency of application development, deployment, and operations.

[0033] The container cloud platform's control plane is responsible for unified management and resource scheduling of multiple Kubernetes clusters. Through standardized API interfaces, it achieves abstraction and centralized control of underlying resources, ensuring efficient utilization of cluster resources and business continuity.

[0034] Kubernetes is an open source container orchestration engine that provides automated deployment, elastic scaling, and operation and maintenance management capabilities for containerized applications. It supports deployment in multiple environments, including private cloud, public cloud, and hybrid cloud architectures, and has become the de facto standard for enterprise-level container management.

[0035] In container cloud platforms, a workload is a collection of logical units used to complete specific computing tasks. In the Kubernetes ecosystem, this includes resource objects such as Deployment (stateless application deployment), StatefulSet (stateful application management), and DaemonSet (node-level service deployment). Each workload consists of multiple Pod instances working together.

[0036] A Pod is the smallest scheduling unit in a Kubernetes cluster, encapsulating one or more tightly coupled containers. As the fundamental unit of resource allocation and scheduling, a Pod enables dynamic deployment and resource allocation across nodes through the Kubernetes scheduler.

[0037] Nodes are the fundamental computing units of a container cloud platform cluster, providing an operating environment for containerized applications. Node types include physical servers and virtual hosts, providing computing resources such as CPU, memory, and storage, and enabling unified resource management and scheduling through the control plane.

[0038] Containers are lightweight runtime environments based on operating system-level virtualization technology. They use resource isolation and restriction mechanisms to standardize the encapsulation of applications and their dependencies. Container technology implements process-level isolation and supports fine-grained control over resources such as CPU, memory, and storage.

[0039] Tcpdump is an open source network protocol analysis tool. By capturing network data packets and performing protocol analysis, it provides network operation and maintenance personnel with traffic monitoring, fault diagnosis, and performance analysis capabilities. It is an important technical tool in the field of network security and operation and maintenance.

[0040] In order to help those skilled in the art better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0041] Figure 1 A schematic diagram of the structure of a network detection and operation and maintenance device provided in an embodiment of the present application. Figure 1 The network detection and operation and maintenance device 100 includes: a command executable file 101 running on the client, a management component 102 running on the server, and a daemon process 103 running on each node of the container cloud platform.

[0042] Command line executable file 101 is deployed on the operator's remote operation terminal and serves as the entry point for initiating detection tasks. Its core functions include: receiving target detection task configuration parameters (such as target detection object identification parameters and protocol type) input by the operator; integrating these configuration parameters with the operator's identity information, and using this information as credentials to access management component 102.

[0043] The core functions of the server-side management component deployment 102 include: strict authentication and permission verification of the operation and maintenance personnel identity information passed in by the client to ensure the legitimacy of the operation; in-depth analysis of the received configuration parameters to generate analysis results including detection range, rules, etc.; based on the analysis results, combined with the cluster resource data (such as container distribution, node status, etc.) provided by the container cloud platform management and control surface, dynamically generate a list of containers to be detected; based on the list of containers to be detected, generate corresponding detection instructions; and feed back the list of containers to be detected, detection instructions and authorized access tokens for secure communication to the client command line executable file.

[0044] The core functions of the command line executable file 101 also include, after receiving the list of containers to be detected, the detection instruction and the authorized access token returned by the server, determining the node where each container is located according to the list of containers to be detected and accessing the daemons on these nodes.

[0045] The daemon process 103 is deployed on each node of the container cloud platform as a terminal for executing detection tasks. After the daemon process 103 receives the detection request and authorized access token from the client, it calls the interface of the host node container runtime with the help of the mounted host node container runtime socket file to download the detector container image (such as the tcpdump container image); then, based on the configuration parameters provided by the client, the detector container is started in combination with the downloaded detector container image, network detection is carried out and detection results are generated. Among them, the network segment where the detector container is located is the same as the network segment of the pod container specified in the target detection task to ensure the consistency of the detection environment.

[0046] In the collaborative process, the client initiates a request, the server completes authentication, parsing, and instruction generation, and the client then passes the relevant information to the daemon of the corresponding node. The daemon finally executes the detection and generates results, forming a complete and efficient network detection closed loop; greatly reducing the complexity of operation and maintenance and significantly improving operation and maintenance efficiency; improving the feasibility of full detection and ensuring the integrity and accuracy of the detection; and strengthening operational security and reducing the risks brought by unauthorized access.

[0047] Figure 2 This is a schematic diagram of the interaction between the components of a network detection and operation and maintenance device provided in an embodiment of the present application. Figure 2 As shown, the interaction process of each component in this application includes the following steps:

[0048] S201, specify configuration parameters of the target detection task.

[0049] The operation and maintenance personnel use the command line executable file on the remote operation machine to specify the configuration parameters of the target detection task.

[0050] The configuration parameters for a target detection task include target detection object identification parameters and target detection task parameters. Target detection object identification parameters include the detected cluster name, namespace name, or workload name. Target detection object task parameters include the detected network protocol, detected network card, detected port, detected IP address, and whether node detection is enabled.

[0051] Optionally, the configuration parameters of the target detection task may further include target detection task execution rule parameters, wherein the target detection task execution rule parameters include the detection duration of the detection task and the rotation size of the network message file.

[0052] It should be noted that Figure 2 The client command executable file is the command executable file running on the client mentioned in the aforementioned embodiment of this application; the server management component is the management component running on the server mentioned in the aforementioned embodiment of this application.

[0053] S202: Send configuration parameters and identity information of operation and maintenance personnel.

[0054] The command line executable file carries configuration parameters and operation and maintenance personnel information to access the management component.

[0055] S203: Authentication and authorization, parsing configuration parameters, generating a list of containers to be detected, and generating detection instructions.

[0056] After the management component receives the configuration parameters and identity information of the operation and maintenance personnel sent by the client's executable file, it authenticates the identity information; after the identity information of the operation and maintenance personnel is authenticated, the server-side management component parses the configuration parameters and generates a parsing result; based on the parsing result and the container cloud platform control plane, it checks the pod operation status under the specified workload (i.e., the workload included in the target detection task), checks the status of each container in the pod, and generates a list of containers to be detected; based on the list of containers to be detected, it generates a detection instruction; and sends the list of containers to be detected, the detection instruction, and the authorized access token to the client command executable file.

[0057] Exemplarily, when the probe container is a tcpdump container, the probe instruction recognizable by the daemon process is a startup parameter of the tcpdump container.

[0058] S204: Send a list of containers to be detected, a detection instruction, and an authorized access token.

[0059] The management component sends the list of containers to be probed, the probe instructions, and the authorized access token to the command executable file.

[0060] S205 , access the guard node with the list of containers to be detected, the detection instruction and the authorized access token.

[0061] The command executable file carries the list of containers to be detected, the detection instruction, and the authorized access token sent by the management component, and accesses the daemon process of the node where each container in the list of containers to be detected is located.

[0062] The daemon is a collection of pods that run on each node in the cluster. Each pod mounts the container runtime access socket file (such as / var / run / docker.sock) of the node it is running on to interact with the node's container runtime.

[0063] S206: Send a probe request.

[0064] The command line executable sends a probe request for the target probe task to the daemon.

[0065] S207: Respond to the detection request and generate a detection result.

[0066] After receiving the probe request and authorized access token, the daemon running on each node of the container cloud platform invokes the host node's container runtime interface based on the mounted host node's container runtime socket file to download the probe container image (such as the tcpdump container image). It then starts the probe container based on the configuration parameters provided by the client and the downloaded probe container image, conducts network probing, and generates detection results. The probe container's network segment is the same as the pod container's network segment specified in the target probing task to ensure consistency and accuracy of the probing environment.

[0067] If the operation and maintenance personnel start the node network detection mode (that is, the target detection task is set to view the network packets of the node where the Pod container is located), a new detector container, such as a tcpdump container, will be started in the node network segment to capture the network packets on the node where the pod is located.

[0068] S208: Send the detection result.

[0069] The daemon process running on each node of the container cloud platform sends the detection results to the command executable file.

[0070] For example, if the detector container is a tcpdump container, the daemon process continuously receives the standard output (detection results) of the tcpdump container and returns the standard output to the client command line executable file through the buffer stream.

[0071] S209: Save and display the detection results.

[0072] The command line executable file continuously receives the streaming data (detection results) returned by the daemon process and stores the detection results in a local directory.

[0073] The directory structure is: workload name - detection start timestamp / pod name - container ID / pod name - container.pcap (if the node detection mode is enabled, an additional node network message file is generated: node name.pcap).

[0074] At the same time, the client command line executable file displays the pod information, container information, node information, data volume, and detection task status in the detection results in real time in the operating machine shell window.

[0075] Among them, if an error log is thrown during the detection process, the error log will also be displayed in real time at the bottom of the window.

[0076] S210: The detector container exits abnormally, and the detector container is restarted.

[0077] If an exception occurs in the detector container during the detection process, such as the abnormal exit of the tcpdump container, the daemon process attempts to automatically resume the detection task, that is, attempts to restart the tcpdump container to continue the detection task, thereby increasing the fault tolerance of the detection.

[0078] It should be noted that when the operation and maintenance personnel actively shut down the detection task, the daemon process will not attempt to restart the detector container.

[0079] It should be noted that in this application, S210 is referred to as the automatic restart mechanism of the detection task. It will only fail when the user actively stops the detection task. Otherwise, no matter what kind of abnormality or interruption occurs, the automatic restart mechanism will continue to run.

[0080] It should be emphasized that when the detection file reaches the specified size, the current detection task is closed and a new detection task is restarted. At the same time, a new file is generated and the detection results are saved.

[0081] S211, monitoring the size of the collected data, and when it is determined that a single network message file is too large, shutting down the target detection task.

[0082] The client command line executable file continuously monitors the size of the collected data. When it is determined that a single network message file is too large, for example, the size of a single network message file exceeds the value specified by the operation and maintenance personnel (the preset message threshold), the current detection task is automatically shut down.

[0083] It is understandable that since the daemon process has the ability to automatically restart the detection task, the daemon process will create a new detection task and network message file on the operating machine, and increment the network message file number. All subsequent network message data will be stored in the new file, and this recursion will avoid a single network message file from being too large.

[0084] S212, detecting the termination request.

[0085] After the operation and maintenance personnel actively terminate the detection task, close the shell window, or the detection task reaches the timer specified length, the command line executable file initiates a detection termination request to all daemon processes that are executing the detection task.

[0086] S213, close the detector container.

[0087] The daemon process calls the container runtime interface, shuts down and deletes the specified tcpdump container through the SIGTERM signal, and ends the detection task.

[0088] S214, continuously collects the working status of workloads, pods, and containers in the cluster.

[0089] The management component installed on the server side continuously monitors the working status of workloads, pods, and containers in the cluster.

[0090] S215: Send the detected working status.

[0091] The management component installed on the server streams information about the detected working status to the command line executable file.

[0092] S216, updating the target detection task.

[0093] When the command line executable file receives the working status sent by the management component, it compares the target detection task currently being executed with the latest detected status data. For pods that have been destroyed, its detection task is closed; for newly added pods, a new detection task is created to achieve automatic tracking of container status.

[0094] S217, restart the detection task.

[0095] After the detector container exits abnormally and the detector is restarted, restart the detection task, that is, restart the detection task after step S210; after determining that a single network message is too large and shutting down the target detection task, restart the detection task, that is, restart the detection task after step S211; after updating the target detection task, restart the detection task according to the updated startup parameters, that is, restart the detection task after step S216.

[0096] It should be noted that the main process of the detector container (such as the tcpdump container) in this application is a shell script, and the script consists of two threads, a main thread and a secondary thread. The main thread is used to execute the tcpdump main command and can receive the tcpdump detection parameters (i.e., container startup parameters) passed in from the outside of the script. In order to avoid the appearance of a tcpdump container on the node that has not been cleaned up by the daemon process after the detection task is completed, which affects the node performance, a self-destruction mechanism is set inside the container, that is, a timer is set in the secondary thread. If the container has been running for more than 24 hours, the secondary thread actively shuts down the main process of the container, causing the container to exit and delete itself. If the normal detection task exceeds 24 hours, the tcpdump container will still self-destruct, but because the daemon process has the above-mentioned detection task restart capability, it will automatically start a new tcpdump container to continue the detection task and ensure the continuous progress of the detection task.

[0097] The above is merely one specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A network detection and operation and maintenance device, characterized in that: The device includes: a command executable file running on the client, a management component running on the server, and a daemon process running on each node of the container cloud platform; The command executable file is used to set the configuration parameters of the target detection task; and access the management component based on the configuration parameters and the identity information of the operation and maintenance personnel; The management component is configured to authenticate the identity information; parse the configuration parameters to generate a parsing result; generate a list of containers to be detected based on the parsing result and the container cloud platform control plane; generate a detection instruction based on the list of containers to be detected; and send the list of containers to be detected, the detection instruction, and the authorized access token to the command executable file; The command executable file is further configured to access the daemon process of the node where each container in the list of containers to be detected is located after receiving the detection instruction and the authorized access token; The daemon process is used to, after receiving the detection request and the authorized access token, run the detector container based on the socket file when the mounted host node container is running, based on the configuration parameters and the detector container image, to generate a detection result; and send the detection result to the command executable file.

2. The device according to claim 1, characterized in that The daemon process is further used to start a new detection container on the node where the target pod container specified in the target detection task is located, so as to capture the network message of the node where the target pod container is located.

3. The device according to claim 1, characterized in that The command executable file is also used to store the detection result in the local directory of the client.

4. The device according to claim 1, characterized in that The command executable file is also used to display the detection result in real time in the Shell window of the client.

5. The device according to claim 1, characterized in that The guard process is also used to restart the detector container and continue to execute the target detection task after the detector container exits abnormally.

6. The device according to claim 1, characterized in that The command line executable file is also used to monitor the size of the collected network messages; if the size of a single network message is greater than a preset message threshold, the currently executing target detection task is shut down; and after the target detection task is stopped, a new detection task is started.

7. The device according to claim 1, characterized in that The management component is further used to detect the workload of the cluster, pod and container working status of the container cloud platform, and transmit the detected working status to the command executable file.

8. The device according to claim 7, characterized in that The command executable file is further used to update the target detection task based on the detected working status.

9. The device according to claim 1, characterized in that The command executable file is further used to send a detection termination request to all daemon processes that are executing the target detection task after determining that the execution time of the target detection task exceeds a preset time length threshold.

10. The device according to claim 9, characterized in that The daemon process is further configured to close and delete the detector container via a sigterm signal after receiving the detection termination request.

Images