Containerized tenant isolation method and device and related equipment
By dynamically allocating VLANs and isolation rules through a cloud management platform and SDN controller, and automating the configuration of network devices, the problem of low efficiency in manual configuration is solved. This enables efficient containerized tenant isolation and real-time traffic management, reducing labor costs.
Patent Information
- Application Number
- CN202511340168.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-18
- Publication Date
- 2026-01-09
AI Technical Summary
In existing technologies, the containerized tenant isolation caused by manual configuration of network equipment is inefficient, cannot meet the needs of rapid response and large-scale deployment in intelligent computing networking, and has high labor costs, and cannot achieve real-time traffic isolation between tenants.
By dynamically allocating VLANs to tenants through the cloud management platform and SDN controller, and binding isolation rules on switches, network devices are automatically configured to achieve traffic isolation for containerized tenants.
It enables automated network configuration in large-scale tenant scenarios, reduces labor costs, supports minute-level scaling of Kubernetes clusters, and ensures real-time traffic isolation and security between tenants.
Smart Images
Figure CN121309360A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of virtualized network technology, and in particular to a containerized tenant isolation method, apparatus and related equipment. Background Technology
[0002] Against the backdrop of the explosive evolution of artificial intelligence technology, diverse intelligent computing scenarios, such as large-scale model training (e.g., GPT-4, Claude3, DeepSeek-R1) and real-time edge inference, are driving an exponential increase in computing power demand. This process exposes three core contradictions: resource competition for training models with hundreds of billions of parameters and high-concurrency inference tasks may lead to performance fluctuations; data leakage and lateral movement risks in multi-tenant hybrid deployments threaten compliance bottom lines; and the rigid resource allocation model of traditional virtualization technology is even less able to support the rapid iteration needs of AI businesses.
[0003] Against this backdrop, containerized tenant isolation technology has become a key breakthrough. Through lightweight namespace control tools within the Kubernetes ecosystem and SR-IOV (Single Root I / O Virtualization, a hardware virtualization technology), it achieves a three-dimensional restructuring: In terms of resource efficiency, it finely schedules CPU / GPU resources and sets fair preemption policies to ensure the stability of high-priority tasks (such as online inference) and mitigate the "noisy neighbor" effect; in terms of security and compliance, it relies on container image signing, network policy isolation, and security sandbox mechanisms to build robust protection between tenants, ensuring "data does not leave the domain and computation does not cross boundaries," meeting the requirements of the General Data Protection Regulation (GDPR) and data sovereignty; and with the deepening evolution of heterogeneous hardware and global compliance rules, containerized isolation has evolved from a technical option to a core infrastructure for the large-scale deployment of AI, providing irreplaceable underlying support for enterprises to balance performance, security, and business agility. Therefore, the elastic scaling capabilities and dynamic optimization of resource utilization of containerized tenant isolation are particularly important.
[0004] Currently, in the intelligent computing network, the servers adopt SR-IOV virtualization technology and are managed by Kubernetes for containerization; on the network device side, the tenant isolation configuration is planned manually and the configuration is manually written to the network device.
[0005] However, manually writing configurations to the devices is labor-intensive and prone to errors; there is also an efficiency ceiling problem, with a single engineer only able to complete the configuration of a few dozen devices per day, and having to go through a trial-and-error cycle of "writing-verifying-rolling back". When deployed in a smart computing center with a scale of over 10,000 cards, the labor cost increases exponentially.
[0006] When there are many tenants, this manual configuration method results in slow business orchestration and an inability to respond in real time. When faced with minute-level scaling up and down of Kubernetes clusters, manual operation is completely unable to track the real-time changes in network policies at the Pod level. Summary of the Invention
[0007] This application provides a containerized tenant isolation method, apparatus, and related equipment.
[0008] Firstly, this application provides a containerized tenant isolation method applied to a controller; the method includes:
[0009] Receive a notification message sent by the cloud management platform, wherein the notification message includes the network card address of the target Pod to be created, the target tenant to which the target Pod belongs, and the target server information used to create the target Pod;
[0010] Based on the target server information, the target switch connected to the target server in the network is determined, and the downlink port of the target switch connected to the target server is determined.
[0011] Assign a target VLAN to the target tenant, instruct the target switch to allow the target VLAN on the downlink port connecting to the target server, and bind the isolation rule corresponding to the target tenant on the VLAN virtual interface corresponding to the target VLAN;
[0012] The cloud management platform sends an isolation configuration to the target server, including the network interface card address of the target Pod, the target VLAN, and the IP address of the VLAN virtual interface, so that when the cloud management platform instructs the target server to start the target Pod, the target server creates the target Pod based on the isolation configuration.
[0013] Optionally, the target server information is the network interface card address of the target server;
[0014] Based on the target server information, the steps of determining the target switch connected to the target server in the network and determining the downlink port of the target switch connected to the target server include:
[0015] Based on the network card address of the target server and the LLDP information reported by each network device included in the network, the target switch connected to the target server in the network is determined, and the downlink port of the target switch connected to the target server is determined.
[0016] Optionally, the method further includes:
[0017] Determine whether a corresponding target VLAN has been assigned to the target tenant;
[0018] If the determination result is negative, proceed with the step of allocating a target VLAN to the target tenant;
[0019] If the determination result is yes, the step of sending the isolation configuration including the network card address of the target Pod, the target VLAN, and the IP address of the VLAN virtual interface to the target server is executed.
[0020] Secondly, this application provides a containerized tenant isolation method applied to a cloud management platform; the method includes:
[0021] The system sends a notification message to the controller, which includes the network interface card (NIC) address of the target Pod to be created, the target tenant to which the target Pod belongs, and the target server information used to create the target Pod. Based on the target server information, the controller determines the target switch connected to the target server in the network and the downlink port of the target switch connecting to the target server. It allocates a target VLAN to the target tenant and instructs the target switch to allow the target VLAN on the downlink port connecting to the target server, and binds the isolation rule corresponding to the target tenant to the VLAN virtual interface corresponding to the target VLAN. Finally, it sends an isolation configuration to the target server, including the NIC address of the target Pod, the IP address of the target VLAN, and the IP address of the VLAN virtual interface.
[0022] An instruction is sent to the target server to launch the target Pod, so that the target server creates the target Pod based on the isolation configuration.
[0023] Optionally, the method further includes:
[0024] When a user-triggered request to bring a target Pod online is received, the step of sending a notification message to the controller is executed.
[0025] Thirdly, this application provides a containerized tenant isolation device applied to a controller; the device includes:
[0026] The receiving unit is used to receive a notification message sent by the cloud management platform, wherein the notification message includes the network card address of the target Pod to be created, the target tenant to which the target Pod belongs, and the target server information used to create the target Pod;
[0027] The determining unit is used to determine, based on the target server information, the target switch connected to the target server in the network, and to determine the downlink port of the target switch connected to the target server;
[0028] The allocation unit is used to allocate a target VLAN to the target tenant, instruct the target switch to allow the target VLAN on the downlink port connected to the target server, and bind the isolation rule corresponding to the target tenant on the VLAN virtual interface corresponding to the target VLAN.
[0029] The sending unit is used to send the isolation configuration, including the network card address of the target Pod, the target VLAN, and the IP address of the VLAN virtual interface, to the target server, so that when the cloud management platform instructs the target server to start the target Pod, the target server creates the target Pod based on the isolation configuration.
[0030] Optionally, the target server information is the network interface card address of the target server;
[0031] Based on the target server information, the determining unit identifies the target switch connected to the target server in the network, and when determining the downlink port of the target switch connected to the target server, the determining unit is specifically used for:
[0032] Based on the network card address of the target server and the LLDP information reported by each network device included in the network, the target switch connected to the target server in the network is determined, and the downlink port of the target switch connected to the target server is determined.
[0033] Optionally, the device further includes:
[0034] The determination unit is used to determine whether a corresponding target VLAN has been allocated to the target tenant.
[0035] If the determination result of the determination unit is negative, the allocation unit is used to perform the step of allocating a target VLAN to the target tenant;
[0036] When the determination result of the determination unit is yes, the sending unit is used to perform the step of sending the isolation configuration including the network card address of the target Pod, the target VLAN and the IP address of the VLAN virtual interface to the target server.
[0037] Fourthly, this application provides a containerized tenant isolation device for use in a cloud management platform; the device includes:
[0038] A sending unit is configured to send a notification message to the controller, wherein the notification message includes the network interface card address of the target Pod to be created, the target tenant to which the target Pod belongs, and the target server information used to create the target Pod; the controller, based on the target server information, determines the target switch connected to the target server in the network, and determines the downlink port of the target switch connecting to the target server; allocates a target VLAN to the target tenant, and instructs the target switch to allow the target VLAN on the downlink port connecting to the target server, and binds the isolation rule corresponding to the target tenant to the VLAN virtual interface corresponding to the target VLAN; and sends an isolation configuration including the network interface card address of the target Pod, the target VLAN, and the IP address of the VLAN virtual interface to the target server.
[0039] The issuing unit is used to issue an instruction to the target server to launch the target Pod, so that the target server creates the target Pod based on the isolation configuration.
[0040] Optionally, the device further includes a receiving unit:
[0041] If the receiving unit receives a user-triggered request to bring a target Pod online, the sending unit performs the step of sending a notification message to the controller.
[0042] Fifthly, embodiments of this application provide a containerized tenant isolation device, which includes:
[0043] Memory, used to store program instructions;
[0044] A processor is configured to invoke program instructions stored in the memory and execute the steps of the method as described in any one of the first aspects above, according to the obtained program instructions.
[0045] Fourthly, embodiments of this application also provide a computer-readable storage medium storing computer-executable instructions for causing a computer to perform the steps of the method as described in any of the first aspects above.
[0046] In a seventh aspect, embodiments of this application provide a containerized tenant isolation device, which includes:
[0047] Memory, used to store program instructions;
[0048] A processor is configured to invoke program instructions stored in the memory and execute the steps of the method as described in any one of the second aspects above, according to the obtained program instructions.
[0049] Eighthly, embodiments of this application also provide a computer-readable storage medium storing computer-executable instructions for causing the computer to perform the steps of the method as described in any of the second aspects above.
[0050] In summary, the containerized tenant isolation method provided in this application is applied to a controller. The method includes: receiving a notification message sent by a cloud management platform, wherein the notification message includes the network card address of the target Pod to be created, the target tenant to which the target Pod belongs, and the target server information used to create the target Pod; based on the target server information, determining the target switch connected to the target server in the network, and determining the downlink port of the target switch connected to the target server; allocating a target VLAN to the target tenant, and instructing the target switch to allow the target VLAN on the downlink port connected to the target server, and binding the isolation rule corresponding to the target tenant to the VLAN virtual interface corresponding to the target VLAN; sending an isolation configuration including the network card address of the target Pod, the target VLAN, and the IP address of the VLAN virtual interface to the target server, so that when the cloud management platform instructs the target server to start the target Pod, the target server creates the target Pod based on the isolation configuration.
[0051] By adopting the containerized tenant isolation method provided in this application embodiment, a tenant Pod can be defined on the cloud management platform, and a VLAN can be dynamically allocated to each tenant in conjunction with the SDN controller. The ACL rule corresponding to the tenant can be bound to the VLAN virtual interface corresponding to the VLAN, thereby realizing traffic isolation of containerized tenants, supporting large-scale tenant scenarios, reducing manpower costs, and simplifying the process of containerized tenant isolation. Attached Figure Description
[0052] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments of this application or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings of the embodiments of this application.
[0053] Figure 1 A detailed flowchart illustrating a containerized tenant isolation method provided in this application embodiment;
[0054] Figure 2 A detailed flow diagram of another containerized tenant isolation method provided in the embodiments of this application;
[0055] Figure 3A schematic diagram illustrating a containerized tenant isolation process provided in an embodiment of this application;
[0056] Figure 4 This is a schematic diagram of the structure of a containerized tenant isolation device provided in an embodiment of this application;
[0057] Figure 5 This is a schematic diagram of another containerized tenant isolation device provided in an embodiment of this application;
[0058] Figure 6 A schematic diagram of the hardware architecture of a containerized tenant isolation device provided in this application embodiment;
[0059] Figure 7 This is a schematic diagram of the hardware architecture of another containerized tenant isolation device provided in an embodiment of this application. Detailed Implementation
[0060] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the application. The singular forms “a,” “the,” and “the” as used in this application and claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to any and all possible combinations comprising one or more of the associated listed items.
[0061] It should be understood that although the terms first, second, third, etc., may be used to describe various information in embodiments of this application, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" may also be interpreted as "when," "when," or "in response to a determination."
[0062] For example, see Figure 1 The diagram shown is a detailed flowchart of a containerized tenant isolation method provided in an embodiment of this application. This method is applied to a controller and includes the following steps:
[0063] Step 100: Receive notification messages sent by the cloud management platform.
[0064] In this embodiment of the application, the notification message includes the network card address of the target Pod to be created, the target tenant to which the target Pod belongs, and the target server information used to create the target Pod.
[0065] In practical applications, the cloud management platform establishes a communication connection with the SDN controller through the northbound interface (e.g., OpenAPI interface) of the SDN (Software Defined Network) controller. When the cloud management platform determines that a service Pod needs to be created on a certain server, it will send the request to the SDN controller through a notification message. Specifically, the notification message needs to include information about the server used to create the service Pod, the network interface card address information of the service Pod, and the tenant information to which the service Pod belongs.
[0066] Step 110: Based on the target server information, determine the target switch in the network that accesses the target server, and determine the downlink port of the target switch that connects to the target server.
[0067] In this embodiment, the target server information is the network interface card (NIC) address of the target server. Therefore, based on the target server information, when determining the target switch connected to the target server in the network, and determining the downlink port of the target switch connected to the target server, a preferred implementation is as follows:
[0068] Based on the target server information, the steps of determining the target switch connected to the target server in the network and determining the downlink port of the target switch connected to the target server include:
[0069] Based on the network card address of the target server and the LLDP information reported by each network device included in the network, the target switch connected to the target server in the network is determined, and the downlink port of the target switch connected to the target server is determined.
[0070] Specifically, the SDN controller receives a notification message from the cloud management platform. Based on the network card address (e.g., MAC address) of the physical server carried in the notification message and the LLDP information reported by each switch in the network, it queries the switches connected to the physical server in the network and determines the downlink port (e.g., AC port) connected to the physical server.
[0071] Step 120: Assign a target VLAN to the target tenant, instruct the target switch to allow the target VLAN on the downlink port connected to the target server, and bind the isolation rule corresponding to the target tenant on the VLAN virtual interface corresponding to the target VLAN.
[0072] In this embodiment of the application, before performing step 120, the containerized tenant isolation method may further include the following steps:
[0073] Determine whether a corresponding target VLAN has been assigned to the target tenant.
[0074] In practical applications, a tenant can include multiple business Pods. However, with tenant isolation, there is no need to isolate the multiple business Pods within a single tenant.
[0075] So, when it is determined that a target Pod needs to be created, first, it is determined whether a VLAN has been allocated to the target tenant to which the target Pod belongs. If it is determined that a VLAN has been allocated to the target tenant, then there is no need to allocate a VLAN to the target tenant again, and the already allocated VLAN can be used as the target VLAN.
[0076] If it is determined that no VLAN has been allocated for the target tenant, the SDN controller selects a VLAN from the available VLANs and assigns it to the target tenant, using that VLAN as the target VLAN.
[0077] After determining the target VLAN for the target tenant, the target switch is instructed to allow the target VLAN on the downlink port connected to the target server, and to bind the isolation rule corresponding to the target tenant on the VLAN virtual interface corresponding to the target VLAN.
[0078] In practical applications, a VLAN (assigned to the target tenant) is created on the target switch, and the target switch is instructed to allow the target VLAN on its AC port. Furthermore, the corresponding ACL (Access Control List) isolation rule for the target tenant is bound to the VLAN virtual interface corresponding to the target VLAN. For example, the ACL rule for the target tenant might be: only allow network segments within the target tenant. This is used to implement containerized tenant isolation for VLAN interfaces. For the same switch, different tenants using different VLANs may have different ACL isolation rules.
[0079] Step 130: Send the isolation configuration, including the network card address of the target Pod, the target VLAN, and the IP address of the VLAN virtual interface, to the target server.
[0080] Thus, when the cloud management platform instructs the target server to launch the target Pod, the target server creates the target Pod based on the isolation configuration.
[0081] In this embodiment, each server is pre-deployed with an agent program. Each server establishes a communication connection with the SDN controller through the agent program. The SDN controller also sends the isolation configuration, including the network card address of the target Pod, the target VLAN, and the IP address of the VLAN virtual interface, to the target server through the agent program deployed on the target server. The agent program on the target server stores the received isolation configuration in a designated location.
[0082] In practical applications, the cloud management platform notifies the Kubernetes cluster to start the target Pod. Before the Kubernetes cluster starts the POD on the target server, it first reads the isolation configuration file corresponding to the target Pod and sets information such as VLAN and gateway IP in the VF. After the POD starts, the VF configuration finally takes effect in the POD.
[0083] For example, see Figure 2 The diagram shown is a detailed flowchart of the containerized tenant isolation method provided in this application embodiment. This method is applied to a cloud management platform and includes the following steps:
[0084] Step 200: Send a notification message to the controller.
[0085] In this embodiment, the notification message includes the network interface card address of the target Pod to be created, the target tenant to which the target Pod belongs, and the target server information used to create the target Pod. Based on the target server information, the controller determines the target switch connected to the target server in the network and determines the downlink port of the target switch connected to the target server. It allocates a target VLAN to the target tenant and instructs the target switch to allow the target VLAN on the downlink port connected to the target server, and binds the isolation rule corresponding to the target tenant to the VLAN virtual interface corresponding to the target VLAN. It sends an isolation configuration including the network interface card address of the target Pod, the IP address of the target VLAN and the VLAN virtual interface to the target server.
[0086] In this embodiment of the application, when a user-triggered request to bring a target Pod online is received, the step of sending a notification message to the controller is executed.
[0087] In other words, users can define the Pod to be created, the tenant to which the Pod belongs, and the physical server on which the Pod runs on the cloud management platform. Additionally, they can configure ACL rules for each tenant and network segment information allocated to each tenant on the SDN controller. However, these details are not specifically limited in this embodiment.
[0088] Step 210: Send an instruction to the target server to launch the target Pod, so that the target server creates the target Pod based on the isolation configuration.
[0089] The containerized tenant isolation process provided in this application embodiment will be described in detail below with reference to specific application scenarios. For example, see [link to relevant documentation]. Figure 3 The diagram shown is a schematic representation of a containerized tenant isolation process provided in an embodiment of this application.
[0090] Step 1: The cloud management platform notifies the SDN controller via the OpenAPI interface that containerized tenant isolation needs to be deployed on a certain server. The notification message needs to include the MAC address of the server's network interface card, the MAC address of the Pod that needs to be containerized and isolated, and the tenant information to which the Pod belongs.
[0091] Step 2: The SDN controller, based on the incoming server's network interface card (NIC) MAC address, queries the network for switches connected to the server. It then issues a VLAN to the AC port of that switch connecting to the server and binds an ACL isolation rule for the tenant to which the Pod belongs to the corresponding VLAN interface. This ACL rule only allows network segments within the tenant. The bottom rule is to deny access, used to achieve containerized tenant isolation via VLAN interfaces. For the same switch, different tenants use different allowed VLANs and have different ACL isolation rules.
[0092] The SDN notification server provides the corresponding Agent-related isolation configuration. This isolation configuration includes the mapping between the MAC addresses of the network cards of the VLANs and pods that are allowed and the gateway (IP address information of the VLAN interface). The agent generates an isolation configuration file based on this and saves it to a specified location on the server.
[0093] Step 3: The cloud management platform notifies the Kubernetes cluster to start the Pod. Before Kubernetes starts the Pod, it reads the isolation configuration file generated by the Agent and sets information such as VLAN and gateway IP in the VF. After the Pod starts, the VF configuration finally takes effect in the Pod.
[0094] At this point, the containerized tenant isolation process is complete. Within the same server, packets sent by Pods belonging to different tenants carry different VLAN IDs. After the packets reach the switch, the switch matches the corresponding vlan-interface based on the VLAN ID carried in the packet, and then finds the bound ACL rule group to determine whether to allow or drop the packet, thereby achieving containerized tenant isolation.
[0095] For example, see Figure 4 The diagram shown is a structural schematic of a containerized tenant isolation device provided in an embodiment of this application. This device is applied to a controller and includes:
[0096] The receiving unit 40 is used to receive a notification message sent by the cloud management platform, wherein the notification message includes the network card address of the target Pod to be created, the target tenant to which the target Pod belongs, and the target server information used to create the target Pod;
[0097] The determining unit 41 is used to determine, based on the target server information, the target switch connected to the target server in the network, and to determine the downlink port of the target switch connected to the target server;
[0098] The allocation unit 42 is used to allocate a target VLAN to the target tenant, instruct the target switch to allow the target VLAN on the downlink port connected to the target server, and bind the isolation rule corresponding to the target tenant on the VLAN virtual interface corresponding to the target VLAN.
[0099] The sending unit 43 is used to send the isolation configuration, including the network card address of the target Pod, the target VLAN, and the IP address of the VLAN virtual interface, to the target server, so that when the cloud management platform instructs the target server to start the target Pod, the target server creates the target Pod based on the isolation configuration.
[0100] Optionally, the target server information is the network interface card address of the target server;
[0101] Based on the target server information, the determining unit 41 is specifically used to determine the target switch connected to the target server in the network, and to determine the downlink port of the target switch connected to the target server.
[0102] Based on the network card address of the target server and the LLDP information reported by each network device included in the network, the target switch connected to the target server in the network is determined, and the downlink port of the target switch connected to the target server is determined.
[0103] Optionally, the device further includes:
[0104] The determination unit is used to determine whether a corresponding target VLAN has been allocated to the target tenant.
[0105] If the determination result of the determination unit is negative, then the allocation unit 42 is used to perform the step of allocating a target VLAN to the target tenant;
[0106] When the determination result of the determination unit is yes, the sending unit 43 is used to perform the step of sending the isolation configuration including the network card address of the target Pod, the target VLAN and the IP address of the VLAN virtual interface to the target server.
[0107] For example, see Figure 5 The diagram shown is a structural schematic of a containerized tenant isolation device provided in an embodiment of this application. This device is applied to a cloud management platform; the device includes:
[0108] The sending unit 50 is configured to send a notification message to the controller, wherein the notification message includes the network interface card address of the target Pod to be created, the target tenant to which the target Pod belongs, and the target server information used to create the target Pod; the controller, based on the target server information, determines the target switch connected to the target server in the network, and determines the downlink port of the target switch connected to the target server; allocates a target VLAN to the target tenant, and instructs the target switch to allow the target VLAN on the downlink port connected to the target server, and binds the isolation rule corresponding to the target tenant to the VLAN virtual interface corresponding to the target VLAN; and sends an isolation configuration including the network interface card address of the target Pod, the target VLAN, and the IP address of the VLAN virtual interface to the target server.
[0109] The issuing unit 51 is used to issue an instruction to the target server to launch the target Pod, so that the target server creates the target Pod based on the isolation configuration.
[0110] Optionally, the device further includes a receiving unit:
[0111] If the receiving unit receives a user-triggered request to bring a target Pod online, the sending unit 50 performs the step of sending a notification message to the controller.
[0112] These units can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more digital signal processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when one of these units is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these units can be integrated together to form a system-on-a-chip (SOC).
[0113] Furthermore, regarding the containerized tenant isolation device provided in this application embodiment, from a hardware perspective, the hardware architecture diagram of the containerized tenant isolation device can be found in [reference needed]. Figure 6 As shown, the containerized tenant isolation device may include: a memory 60 and a processor 61.
[0114] The memory 60 is used to store program instructions; the processor 61 calls the program instructions stored in the memory 60 and executes the method embodiment applied to the controller according to the obtained program instructions. The specific implementation and technical effects are similar, and will not be described again here.
[0115] Optionally, this application also provides a controller, including at least one processing element (or chip) for performing the above-described method embodiments applied to the controller.
[0116] Optionally, this application also provides a program product, such as a computer-readable storage medium storing computer-executable instructions for causing the computer to perform the above-described method embodiments applied to the controller.
[0117] Furthermore, regarding the containerized tenant isolation device provided in this application embodiment, from a hardware perspective, the hardware architecture diagram of the containerized tenant isolation device can be found in [reference needed]. Figure 7 As shown, the containerized tenant isolation device may include: a memory 70 and a processor 71.
[0118] The memory 70 is used to store program instructions; the processor 71 calls the program instructions stored in the memory 70 and executes the method embodiment applied to the cloud management platform according to the obtained program instructions. The specific implementation method and technical effect are similar, and will not be described again here.
[0119] Optionally, this application also provides a cloud management platform, including at least one processing element (or chip) for performing the above-described method embodiments applied to the cloud management platform.
[0120] Optionally, this application also provides a program product, such as a computer-readable storage medium storing computer-executable instructions for causing the computer to execute the above-described method embodiments applied to a cloud management platform.
[0121] Here, a machine-readable storage medium can be any electronic, magnetic, optical, or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, a machine-readable storage medium can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard disk drives), solid-state drives, any type of storage disk (such as optical discs, DVDs, etc.), or similar storage media, or combinations thereof.
[0122] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.
[0123] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.
[0124] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0125] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0126] Furthermore, these computer program instructions can also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in the process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0127] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0128] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.
Claims
1. A containerized tenant isolation method, characterized in that, Applied to a controller; the method includes: Receive a notification message sent by the cloud management platform, wherein the notification message includes the network card address of the target Pod to be created, the target tenant to which the target Pod belongs, and the target server information used to create the target Pod; Based on the target server information, the target switch connected to the target server in the network is determined, and the downlink port of the target switch connected to the target server is determined. Assign a target VLAN to the target tenant, instruct the target switch to allow the target VLAN on the downlink port connecting to the target server, and bind the isolation rule corresponding to the target tenant on the VLAN virtual interface corresponding to the target VLAN; The cloud management platform sends an isolation configuration to the target server, including the network interface card address of the target Pod, the target VLAN, and the IP address of the VLAN virtual interface, so that when the cloud management platform instructs the target server to start the target Pod, the target server creates the target Pod based on the isolation configuration.
2. The method as described in claim 1, characterized in that, The target server information is the network interface card address of the target server; Based on the target server information, the steps of determining the target switch connected to the target server in the network and determining the downlink port of the target switch connected to the target server include: Based on the network card address of the target server and the LLDP information reported by each network device included in the network, the target switch connected to the target server in the network is determined, and the downlink port of the target switch connected to the target server is determined.
3. The method as described in claim 1 or 2, characterized in that, The method further includes: Determine whether a corresponding target VLAN has been assigned to the target tenant; If the determination result is negative, proceed with the step of allocating a target VLAN to the target tenant; If the determination result is yes, the step of sending the isolation configuration including the network card address of the target Pod, the target VLAN, and the IP address of the VLAN virtual interface to the target server is executed.
4. A containerized tenant isolation method, characterized in that, Applied to a cloud management platform; the method includes: The system sends a notification message to the controller, which includes the network interface card (NIC) address of the target Pod to be created, the target tenant to which the target Pod belongs, and the target server information used to create the target Pod. Based on the target server information, the controller determines the target switch connected to the target server in the network and the downlink port of the target switch connecting to the target server. It allocates a target VLAN to the target tenant and instructs the target switch to allow the target VLAN on the downlink port connecting to the target server, and binds the isolation rule corresponding to the target tenant to the VLAN virtual interface corresponding to the target VLAN. Finally, it sends an isolation configuration to the target server, including the NIC address of the target Pod, the IP address of the target VLAN, and the IP address of the VLAN virtual interface. An instruction is sent to the target server to launch the target Pod, so that the target server creates the target Pod based on the isolation configuration.
5. The method as described in claim 4, characterized in that, The method further includes: When a user-triggered request to bring a target Pod online is received, the step of sending a notification message to the controller is executed.
6. A containerized tenant isolation device, characterized in that, Applied to a controller; the device includes: The receiving unit is used to receive a notification message sent by the cloud management platform, wherein the notification message includes the network card address of the target Pod to be created, the target tenant to which the target Pod belongs, and the target server information used to create the target Pod; The determining unit is used to determine, based on the target server information, the target switch connected to the target server in the network, and to determine the downlink port of the target switch connected to the target server; The allocation unit is used to allocate a target VLAN to the target tenant, instruct the target switch to allow the target VLAN on the downlink port connected to the target server, and bind the isolation rule corresponding to the target tenant on the VLAN virtual interface corresponding to the target VLAN. The sending unit is used to send the isolation configuration, including the network card address of the target Pod, the target VLAN, and the IP address of the VLAN virtual interface, to the target server, so that when the cloud management platform instructs the target server to start the target Pod, the target server creates the target Pod based on the isolation configuration.
7. The apparatus as claimed in claim 6, characterized in that, The target server information is the network interface card address of the target server; Based on the target server information, the determining unit identifies the target switch connected to the target server in the network, and when determining the downlink port of the target switch connected to the target server, the determining unit is specifically used for: Based on the network card address of the target server and the LLDP information reported by each network device included in the network, the target switch connected to the target server in the network is determined, and the downlink port of the target switch connected to the target server is determined.
8. The apparatus as claimed in claim 6 or 7, characterized in that, The device further includes: The determination unit is used to determine whether a corresponding target VLAN has been allocated to the target tenant. If the determination result of the determination unit is negative, the allocation unit is used to perform the step of allocating a target VLAN to the target tenant; When the determination result of the determination unit is yes, the sending unit is used to perform the step of sending the isolation configuration including the network card address of the target Pod, the target VLAN and the IP address of the VLAN virtual interface to the target server.
9. A containerized tenant isolation device, characterized in that, Applied to a cloud management platform; the device includes: A sending unit is configured to send a notification message to the controller, wherein the notification message includes the network interface card address of the target Pod to be created, the target tenant to which the target Pod belongs, and the target server information used to create the target Pod; the controller, based on the target server information, determines the target switch connected to the target server in the network, and determines the downlink port of the target switch connecting to the target server; allocates a target VLAN to the target tenant, and instructs the target switch to allow the target VLAN on the downlink port connecting to the target server, and binds the isolation rule corresponding to the target tenant to the VLAN virtual interface corresponding to the target VLAN; and sends an isolation configuration including the network interface card address of the target Pod, the target VLAN, and the IP address of the VLAN virtual interface to the target server. The issuing unit is used to issue an instruction to the target server to launch the target Pod, so that the target server creates the target Pod based on the isolation configuration.
10. A containerized tenant isolation device, characterized in that, The containerized tenant isolation device includes: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the steps of the method as claimed in any one of claims 1-3 or any one of claims 4-5, according to the obtained program instructions.
11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions for causing the computer to perform the steps of the method as described in any one of claims 1-3 or any one of claims 4-5.