A network isolation method and device based on a cloud-native hyper-converged platform

Abstract

The application provides a network isolation method and device based on a cloud native hyper-converged platform, comprising: creating a management aggregation interface, a management bridge interface, a storage aggregation interface and a storage bridge interface on the cloud native hyper-converged platform; establishing a binding relationship between the management aggregation interface, the management bridge interface and a physical network port for management services, and opening a virtual local area network used by service traffic on the management bridge interface, so that the physical network port for management services accesses management and service traffic; establishing a binding relationship between the storage aggregation interface, the storage bridge interface and a physical network port for storage, and opening a virtual local area network used by storage traffic on the storage bridge interface, and completing storage traffic configuration by using a resource self-definition mechanism provided by an open source container orchestration system. By configuring the bridge interface at the operating system level, the combination of service and management traffic is established, and the storage traffic is separated from the management network, thereby improving storage performance and cluster stability.

Description

Technical Field

[0001] This application relates to the field of network configuration technology, and in particular to a network isolation method and apparatus based on a cloud-native hyperconverged platform. Background Technology

[0002] In cloud-native hyperconverged platform virtualization clusters based on NestOS (a cloud-based operating system incubated by Kylin Software) and Harvester (an open-source hyperconverged infrastructure software built on Kubernetes), the network architecture adopts a design scheme of shared storage management network and independent business network. This architecture defines three key network planes: management network, business network, and storage network. That is, in the relevant network architecture of cloud-native hyperconverged platform virtualization clusters, it is usually necessary to carry three types of traffic: management, business, and storage. However, the general-purpose servers on cloud-native hyperconverged platforms are usually only equipped with 4 physical network ports, making it difficult to achieve complete physical isolation of the three types of traffic.

[0003] Furthermore, traffic analysis based on laboratory scenarios revealed that the data transmission requirements of the storage network are relatively high. In most cases, the traffic of the storage network is higher than that of the business network. If storage traffic shares network bandwidth with management traffic or business traffic, it may affect storage performance and thus reduce the overall stability of the cluster. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide at least one network isolation method and device based on a cloud-native hyperconverged platform, which improves storage performance and cluster stability by configuring a bridge interface at the operating system level to merge business and management traffic and separate storage traffic from the management network.

[0005] This application mainly includes the following aspects: In a first aspect, embodiments of this application provide a network isolation method based on a cloud-native hyperconverged platform. The cloud-native hyperconverged platform provides physical network ports for management services and physical network ports for storage in its corresponding network architecture. The method includes: creating a management aggregation interface, a management bridge interface, a storage aggregation interface, and a storage bridge interface in the underlying operating system of the cloud-native hyperconverged platform; establishing a binding relationship between the management aggregation interface, the management bridge interface, and the physical network ports for management services, and opening the virtual local area network (VLAN) used by service traffic on the management bridge interface, allowing the physical network ports for management services to access management and service traffic; establishing a binding relationship between the storage aggregation interface, the storage bridge interface, and the physical network ports for storage, and opening the VLAN used by storage traffic on the storage bridge interface; and utilizing the resource customization mechanism provided by an open-source container orchestration system to complete the configuration of storage traffic and connect the storage traffic to the physical network ports for storage.

[0006] In one possible implementation, the physical network interface for management services includes a first physical network interface and a second physical network interface. The binding relationship between the management aggregation interface, the management bridge interface, and the physical network interface for management services is created in the following ways: the management aggregation interface is configured to be bound to the management bridge interface using a master-slave binding mode, wherein the management aggregation interface is a slave interface of the management bridge interface; and a load balancing binding mode is used to create a binding relationship between the first physical network interface and the management aggregation interface, and a binding relationship between the second physical network interface and the management aggregation interface, respectively.

[0007] In one possible implementation, the virtual local area network (VLAN) corresponding to the service traffic is opened on the management bridge interface by: enabling the VLAN filtering function corresponding to the management bridge interface; and using the service VLAN add command to allow at least one VLAN used by the service traffic accessed by the physical network port of the management service on the traffic channel formed between the management aggregation interface and the management bridge interface.

[0008] In one possible implementation, before opening the virtual LAN corresponding to the service traffic on the management bridge interface, the method further includes: disabling the spanning tree protocol on the management bridge interface.

[0009] In one possible implementation, the method further includes: invoking a service traffic configuration interface provided by a cloud-native hyperconverged platform, the service traffic configuration interface including a service traffic addition control; generating a service traffic information configuration item and its corresponding virtual local area network (VLAN) configuration item in response to a selection operation performed on the service traffic addition control; creating a target service traffic in response to a configuration operation performed on the service traffic information configuration item; and binding the target service traffic to the target VLAN opened between the management aggregation interface and the management bridge interface through link aggregation in response to a configuration operation performed on the VLAN configuration item.

[0010] In one possible implementation, the storage physical network interface includes a third physical network interface and a fourth physical network interface, wherein the binding relationship between the storage aggregation interface, the storage bridge interface, and the storage physical network interface is created in the following ways: using a master-slave binding mode, the storage aggregation interface is configured to bind to the storage bridge interface, wherein the storage aggregation interface is a slave interface of the storage bridge interface; using a load balancing binding mode, the binding relationship between the third physical network interface and the storage aggregation interface and the binding relationship between the fourth physical network interface and the management aggregation interface are created respectively.

[0011] In one possible implementation, storage traffic is configured as follows: deploy custom resources on the underlying operating system; with the support of custom resources, establish a cluster-level address management system through the resource customization mechanism provided by the open-source container orchestration system, which is used to declare the storage network; configure the storage network parameters corresponding to the storage network through the cluster-level address management system; after completing the configuration operation of the storage network parameters, trigger storage network reconstruction based on the changed storage network parameters to complete the storage traffic configuration.

[0012] In one possible implementation, the method further includes: executing configuration verification instructions provided by the resource customization mechanism provided by the open-source container orchestration system and obtaining the refactoring status feedback field; if the refactoring status feedback field indicates that the configuration is effective, then determining that the storage traffic has been separated from the management traffic; if the refactoring status feedback field indicates that the configuration is ineffective, then returning to re-execute the storage network parameter configuration operation.

[0013] Secondly, this application also provides a network isolation device based on a cloud-native hyperconverged platform. The cloud-native hyperconverged platform provides physical network ports for management services and physical network ports for storage in its corresponding network architecture. The device includes: an interface creation module, used to create a management aggregation interface, a management bridge interface, a storage aggregation interface, and a storage bridge interface respectively in the underlying operating system of the cloud-native hyperconverged platform; a merging module, used to establish a binding relationship between the management aggregation interface, the management bridge interface, and the physical network ports for management services, and to open the virtual local area network used by service traffic on the management bridge interface, allowing the physical network ports for management services to access management and service traffic; and a separation module, used to establish a binding relationship between the storage aggregation interface, the storage bridge interface, and the physical network ports for storage, and to open the virtual local area network used by storage traffic on the storage bridge interface, and to complete the storage traffic configuration and connect the storage traffic to the physical network ports for storage using the resource customization mechanism provided by the open-source container orchestration system.

[0014] Thirdly, embodiments of this application also provide an electronic device, including: a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor and the memory communicate through the bus. The machine-readable instructions are executed by the processor to perform the steps of the network isolation method based on the cloud-native hyperconverged platform provided in any of the above embodiments.

[0015] This application provides a network isolation method and apparatus based on a cloud-native hyperconverged platform, comprising: creating a management aggregation interface, a management bridge interface, a storage aggregation interface, and a storage bridge interface in the underlying operating system of the cloud-native hyperconverged platform; establishing a binding relationship between the management aggregation interface, the management bridge interface, and the physical network interface used for management services, and opening the virtual local area network used by service traffic on the management bridge interface, allowing the physical network interface used for management services to access management and service traffic; establishing a binding relationship between the storage aggregation interface, the storage bridge interface, and the physical network interface used for storage, and opening the virtual local area network used by storage traffic on the storage bridge interface; utilizing the resource customization mechanism provided by the open-source container orchestration system to complete the configuration of storage traffic and connect the storage traffic to the physical network interface used for storage. By configuring the bridge interface at the operating system level, the merging of service and management traffic and the separation of storage traffic from the management network are established, thereby improving storage performance and cluster stability.

[0016] The advantages of this application are: 1. In existing technologies, storage networks have high data transmission requirements. If they share network bandwidth with management traffic or business traffic, it may affect storage performance and reduce the overall stability of the cluster. Based on this problem, this application optimizes the network architecture of cloud-native hyperconverged platforms. Specifically, a bridge is configured in the underlying operating system of the cloud-native hyperconverged platform to merge management traffic and business traffic, allowing them to share the same set of management interfaces. Storage traffic is separated from the management network and independently allocated to another set of interfaces. Storage traffic also enjoys the remaining network resources. In this way, efficient transmission of storage traffic is ensured while meeting the network deployment requirements of a standard four-port server architecture.

[0017] 2. This application configures the management aggregation interface and the management bridge interface, and enables the virtual LAN filtering function (vlan-filtering=true) on the bridge interface. This allows service traffic to be forwarded on the management bridge interface by attaching a VLAN ID (Virtual LAN identifier), simplifying the deployment process of the virtual network. At the same time, management traffic still maintains unlabeled communication, realizing the coexistence and logical isolation of management traffic and service traffic on the physical link. This achieves the merging of management and service traffic and provides technical support for the subsequent separation of storage networks.

[0018] 3. Before opening the virtual LAN corresponding to the service traffic on the management bridge interface, this application performs a shutdown operation on the spanning tree protocol on the management bridge interface. In this way, the spanning tree protocol can be prevented from interfering with the network switch's spanning tree.

[0019] 4. This application modifies the relevant storage network configuration of the cloud-native hyperconverged platform by using the resource customization mechanism provided by the open-source container orchestration system (for example, the CRD mechanism provided by Kubernetes), assigns corresponding IP addresses to the servers in the cluster and assigns a specified virtual local area network to the storage network, so that storage traffic can be synchronously transmitted between different servers in the cluster through the specified virtual local area network, that is, the transmission efficiency of storage traffic is guaranteed through a dedicated network channel.

[0020] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 A flowchart of a network isolation method based on a cloud-native hyperconverged platform provided in an embodiment of this application is shown; Figure 2 This illustration shows a network isolation structure block diagram provided in an embodiment of this application; Figure 3 This application provides a flowchart illustrating the steps of opening a virtual local area network (VLAN) for service traffic on a management bridge interface, as illustrated in an embodiment of this application. Figure 4 This application provides a flowchart illustrating the steps of a storage traffic network configuration process according to an embodiment of the present application. Figure 5 This paper illustrates a functional block diagram of a network isolation device based on a cloud-native hyperconverged platform, according to an embodiment of this application. Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the drawings in this application are for illustrative and descriptive purposes only and are not intended to limit the scope of protection of this application. Furthermore, it should be understood that the schematic drawings are not drawn to scale. The flowcharts used in this application illustrate operations implemented according to some embodiments of this application. It should be understood that the operations in the flowcharts may not be implemented in sequence, and steps without logical contextual relationships may be reversed or implemented simultaneously. In addition, those skilled in the art, guided by the content of this application, may add one or more other operations to the flowcharts, or remove one or more operations from the flowcharts.

[0024] Furthermore, the described embodiments are merely some, not all, of the embodiments of this application. The components of the embodiments of this application described and illustrated herein can typically be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0025] In the cloud-native hyperconverged platform virtualization cluster based on NestOS and Harvester, the network architecture adopts a design scheme of shared storage management network and independent business network. This architecture defines three key network planes: management network, business network and storage network.

[0026] The Management Network, as the core control plane of the cloud-native hyperconverged platform virtualization cluster, is responsible for carrying critical traffic such as cluster management, system monitoring and operation and maintenance. It also handles communication traffic between Pods (the smallest deployment unit in the cloud-native system) within the cluster. This network plane is the fundamental guarantee for maintaining the stable operation of the cluster.

[0027] The business network is geared towards end users and application services, and mainly carries east-west communication traffic of virtual machines and north-south business traffic for external services, including network access, API calls and other application service requests.

[0028] Storage networks are dedicated to data synchronization and sharing between nodes, providing a dedicated data transmission channel for distributed storage systems (e.g., Longhorn).

[0029] Based on the aforementioned network architecture, cloud-native hyperconverged platform virtualization clusters typically need to handle three types of traffic: management, business, and storage. In actual deployment environments, since the general-purpose servers running on these clusters are usually configured with only four physical network ports, it's difficult to achieve complete physical isolation between these three networks. Traffic analysis based on laboratory scenarios revealed that, in most cases, storage network traffic exceeds business network traffic. Furthermore, this analysis also showed that storage network data transmission demands are higher, with storage network traffic consistently exceeding business network traffic. If storage traffic shares network bandwidth with management or business traffic, it may impact storage performance, thereby reducing the overall stability of the cluster.

[0030] Based on this, this application provides a network isolation method and apparatus based on a cloud-native hyperconverged platform. By configuring a bridge interface at the operating system level, it establishes the merging of service and management traffic and separates storage traffic from the management network, thereby improving storage performance and cluster stability, as detailed below: Please see Figure 1 , Figure 1 A flowchart illustrating a network isolation method based on a cloud-native hyperconverged platform provided in an embodiment of this application is shown. Figure 1 As shown, the method provided in this application embodiment includes the following steps: S100: In the underlying operating system of the cloud-native hyperconverged platform, create management aggregation interface, management bridge interface, storage aggregation interface, and storage bridge interface respectively.

[0031] S101. Establish the binding relationship between the management aggregation interface, the management bridge interface, and the physical network port used for management services, and open the virtual LAN used by the service traffic on the management bridge interface, so that the physical network port used for management services can access management and service traffic.

[0032] S102. Establish the binding relationship between the storage aggregation interface, the storage bridge interface, and the physical network port for storage, and open the virtual LAN used by storage traffic on the storage bridge interface. Utilize the resource customization mechanism provided by the open-source container orchestration system to complete the storage traffic configuration and connect the storage traffic to the physical network port for storage.

[0033] For example, the resource customization mechanism provided by an open-source container orchestration system can be the CRD mechanism provided by the open-source container orchestration system Kubernetes.

[0034] In a preferred embodiment, please refer to Figure 2 , Figure 2 A block diagram of a network isolation structure provided in an embodiment of this application is shown. Figure 2As shown, the cloud-native hyperconverged platform virtualization cluster includes multiple servers. Each server provides a physical network interface for management services and a physical interface for storage. The first physical network interface eth0 and the second physical network interface eth1 provided by the server are assigned to the physical network interface for management services, while the third physical network interface eth2 and the fourth physical network interface eth3 provided by the server are assigned to the physical interface for storage.

[0035] In the prior art, the default network architecture is that storage traffic and management traffic share a network link, while business traffic has a separate network link. However, in this application, considering the high demand for storage traffic, the method provided in step S102 is used to separate storage traffic from management traffic. Specifically, in conjunction with step S101, management traffic and business traffic share the first physical network interface eth0 and the second physical network interface eth1, while storage traffic uses the third physical network interface eth2 and the fourth physical network interface eth3 separately. This can ensure the transmission efficiency of storage traffic with high traffic demand, while adapting to the network deployment requirements of the standard four-port server architecture.

[0036] In step S100, such as Figure 2 As shown, in the underlying operating system of the server on the cloud-native hyperconverged platform, a management aggregation interface mgmt-bo, a management bridge interface mgmt-br, a storage aggregation interface storage-bo, and a storage bridge interface storage-br are created respectively.

[0037] In a preferred embodiment, step S101 includes: Using the master-slave binding mode, the management aggregation interface mgmt-bo is configured to bind to the management bridge interface mgmt-br. Here, the management aggregation interface mgmt-br is the slave interface of the management bridge interface mgmt-br. Using the load balancing binding mode, a binding relationship is created between the first physical network interface eth0 and the management aggregation interface mgmt-bo, and a binding relationship is created between the second physical network interface eth1 and the management aggregation interface mgmt-bo.

[0038] Figure 2 In this context, "bonding" refers to network interface binding technology.

[0039] In practice, creating the binding relationship between the first physical network interface eth0, the second physical network interface eth1 and the management aggregation interface mgmt-bo is actually the process of binding the first physical network interface eth0 and the second physical network interface eth1 as slave interfaces to the management bridge interface mgmt-br through the management aggregation interface mgmt-bo. This ensures that management traffic is forwarded through the bridge.

[0040] In one example, prior to performing step S102, the method provided by this application for optimizing bridge configuration further includes: Disable STP (Spanning Tree Protocol) on the management bridge interface mgmt-br to avoid unnecessary network convergence delays.

[0041] In a preferred embodiment, step S101 includes: In response to the configuration operation of the configuration file corresponding to the management bridge interface mgmt-br, the VLAN (Virtual Local Area Network) filtering function (vlan_filtering) corresponding to the management bridge interface mgmt-br is enabled to ensure that subsequent access service traffic can be forwarded to the corresponding virtual machine on demand on the management bridge interface mgmt-br, while isolating different service traffic.

[0042] Using the business VLAN add command (for example, the command bridge vlan add), on the traffic channel formed between the management aggregation interface mgmt-bo and the management bridge interface mgmt-br, allow at least one VLAN used by the business traffic accessed by the physical network port of the management business (i.e., virtual machine network traffic under the cloud-native hyperconverged platform, which is marked by the identity identifier VLAN ID corresponding to the VLAN).

[0043] In a preferred embodiment, please refer to Figure 3 , Figure 3 A flowchart illustrating the steps of opening a virtual local area network (VLAN) for service traffic on a management bridge interface, as provided in an embodiment of this application, is shown. Figure 3 As shown, step S101 further includes: S1010: Call the business traffic configuration interface provided by the cloud-native hyperconverged platform.

[0044] The business traffic configuration interface includes controls for adding business traffic.

[0045] S1011. In response to the selection operation performed by adding a control for business traffic, generate business traffic information configuration items and their corresponding virtual LAN configuration items.

[0046] S1012. In response to the configuration operation performed on the configuration item for the service traffic information, create the target service traffic.

[0047] The service traffic information configuration item includes the virtual machine configuration item, wherein, in response to the configuration operation performed on the virtual machine configuration item, the target virtual machine and its corresponding target service traffic are created.

[0048] S1013. In response to the configuration operation performed on the virtual LAN configuration item, the target service traffic is bound to the target virtual LAN that is opened between the management aggregation interface and the management bridge interface through link aggregation.

[0049] In response to configuration operations performed on virtual LAN configuration items, the target virtual LAN used by the target service traffic is determined from at least one virtual LAN that is allowed between the management aggregation interface mgmt-bo and the management bridge interface mgmt-br. (Specifically, a target VLAN ID can be selected from at least one VLAN ID corresponding to the at least one virtual LAN that is allowed between the management aggregation interface mgmt-bo and the management bridge interface mgmt-br. The target virtual LAN corresponding to the target VLAN ID is used as the target virtual LAN used by the target virtual machine or the target service traffic under the target virtual machine, simplifying the virtual LAN deployment process.)

[0050] In one specific embodiment, in steps S1010 to S1013, the target service traffic is bound to the target virtual local area network (VLAN) through link aggregation. This ensures that the target service traffic can be forwarded normally to the corresponding virtual machine (VM) through the designated target VLAN on the bridge accessed by the management bridge interface mgmt-br.

[0051] Furthermore, by configuring different virtual LANs for different service traffic in the above manner, isolation between service traffic can be achieved, and different virtual LANs ultimately connect to different virtual machines (such as...). Figure 2 As shown, for example, multiple virtual machines are configured according to the cluster's business requirements, including virtual machines VMA, VMB, etc. (which will not be elaborated on here). For example, virtual LAN VLAN101 is connected to virtual machine VMA.

[0052] The purpose of the process performed in step S101 above is to enable management traffic and service traffic to share the same set of bridge resources, thereby completing the convergence of the networks used by management traffic and service traffic.

[0053] In this application, during the above process, the service traffic needs to be appended with the corresponding Virtual Local Area Network (VLAN) ID before being forwarded on the corresponding bridge. Meanwhile, the management traffic remains untagged communication. In this way, the coexistence and logical isolation of management traffic and service traffic on the physical link are achieved.

[0054] return Figure 1 and Figure 2 In a preferred embodiment, the physical network interface for storage includes a third physical network interface eth2 and a fourth physical network interface eth3, wherein step S102 includes: The storage aggregation interface storage-bo is configured to be bound to the storage bridge interface storage-br using the master-slave binding mode. The storage aggregation interface storage-bo is the slave interface of the storage bridge interface storage-br. Using the load balancing binding mode, a binding relationship is created between the third physical network interface eth2 and the storage aggregation interface storage-bo, and a binding relationship is created between the fourth physical network interface eth3 and the management aggregation interface storage-br.

[0055] In practice, creating the binding relationship between the third physical network interface eth2, the fourth physical network interface eth3 and the storage aggregation interface storage-bo is actually the process of binding the third physical network interface eth2 and the fourth physical network interface eth3 as slave interfaces to the storage bridge interface storage-br through the storage aggregation interface storage-bo. This ensures that storage traffic is forwarded on the bridge corresponding to the storage bridge interface storage-br.

[0056] Steps S104 to S106 provided in this application separate storage traffic from management traffic. Storage traffic uses the third physical network interface eth2 and the fourth physical network interface eth3 separately, which can ensure the transmission efficiency of storage traffic with high traffic demand.

[0057] In another preferred embodiment, the process of opening the virtual local area network used for storage traffic on the storage bridge interface storage-br as described in step S105 is similar to the process of opening the virtual local area network used for service traffic on the management bridge interface mgmt-br as described in step S102, and will not be elaborated further here.

[0058] Please see Figure 4 , Figure 4 A flowchart illustrating the steps of a storage traffic network configuration process provided in an embodiment of this application is shown. Figure 4 As shown, step S102 includes: S1020: Deploy custom resources on the underlying operating system.

[0059] S1021. With the support of custom resources, a cluster-level address management system is established through the resource customization mechanism provided by the open-source container orchestration system.

[0060] Among them, the cluster-level address management system is used to declare the dynamic allocation of storage network and cluster network resources.

[0061] S1022. Configure the storage network parameters corresponding to the storage network through the cluster-level IP address management system.

[0062] S1023. After completing the configuration operation of the storage network parameters, based on the changed key storage network parameters, trigger the storage network reconstruction and complete the storage traffic configuration.

[0063] In one specific embodiment, in steps S1020 to S1023, a custom resource ippools.whereabouts.cni.cncf.io is deployed on the underlying operating system. With the support of the custom resource ippools.whereabouts.cni.cncf.io, a cluster-level address management (i.e., IPAM, IP Address Management) system is established through the resource customization mechanism provided by the open-source container orchestration system (exemplary, such as the Kubernetes CRD mechanism). By accessing the global configuration interface corresponding to the cluster through CRD settings.harvesterhci.io provided by the cluster-level address management system, storage network parameters related to the storage network can be adjusted and configured. Specifically, storage network parameters include, but are not limited to, at least one of the following: the VLAN ID of the virtual LAN used by the storage network, the cluster network topology applied by the storage network (i.e., the servers involved in the storage network in the cloud-native hyperconverged platform virtualization cluster), the IP address pool (assigning corresponding IP addresses to the servers in the cloud-native hyperconverged platform virtualization cluster to realize server-level data interaction), and the subnetting of the IP address pool. After completing the configuration operation of the storage network parameters, storage network reconstruction is triggered based on the changed storage network parameters to complete the storage traffic configuration.

[0064] In a preferred embodiment, the method provided in this application further includes: The system executes the configuration verification command `kubectl getsettings.harvesterhci.io storage-network -o yaml` provided by the resource customization mechanism of the open-source container orchestration system, and retrieves the refactoring status feedback field. If the refactoring status feedback field indicates that the configuration is effective, it is determined that the storage traffic has been separated from the management traffic. If the refactoring status feedback field indicates that the configuration is ineffective, it returns to re-execute the storage network parameter configuration operation.

[0065] like Figure 2In the given embodiment, after the storage network is successfully reconstructed, the storage network transmits the data to the Longhorn instance manager via the third physical network port eth2 and the fourth physical network port eth3, the storage aggregation interface storage-bo, and the corresponding virtual local area network VLAN 100 on the storage bridge interface storage-br. The Longhorn instance manager (one of the core components of the open-source distributed storage system Longhorn) then further processes the storage traffic.

[0066] Based on the same application concept, this application also provides a network isolation device based on a cloud-native hyperconverged platform, which corresponds to the network isolation method based on a cloud-native hyperconverged platform provided in the above embodiments. Since the principle of the device in this application is similar to the network isolation method based on a cloud-native hyperconverged platform in the above embodiments of this application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0067] Please see Figure 5 , Figure 5 This illustration shows a functional block diagram of a network isolation device based on a cloud-native hyperconverged platform according to an embodiment of this application. The cloud-native hyperconverged platform provides physical network ports for management services and physical network ports for storage in its corresponding network architecture, such as... Figure 5 As shown, the device includes: The interface creation module 200 is used to create management aggregation interface, management bridge interface, storage aggregation interface and storage bridge interface respectively in the underlying operating system of the cloud-native hyperconverged platform; The merging module 201 is used to establish the binding relationship between the management aggregation interface, the management bridge interface, and the physical network port used for management services, and to open the virtual LAN used by the service traffic on the management bridge interface, so that the physical network port used for management services can access management and service traffic; The separation module 202 is used to establish the binding relationship between the storage aggregation interface, the storage bridge interface and the physical network port for storage, and to open the virtual local area network used by storage traffic on the storage bridge interface. It uses the Kubernetes CRD mechanism to complete the storage traffic configuration and connect the storage traffic to the physical network port for storage.

[0068] Based on the same application concept, please refer to Figure 6 , Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of this application is shown. Figure 6As shown, the electronic device 30 includes a processor 301, a memory 302, and a bus 303. The memory 302 stores machine-readable instructions that can be executed by the processor 301. When the electronic device 30 is running, the processor 301 and the memory 302 communicate through the bus 303. The machine-readable instructions are executed by the processor 301 to perform the steps of the network isolation method based on the cloud-native hyperconverged platform provided in any of the above embodiments.

[0069] Based on the same concept, this application also provides a computer-readable storage medium storing a computer program, which, when run by a processor, executes the steps of the network isolation method based on a cloud-native hyperconverged platform provided in the above embodiments.

[0070] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and devices described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection may be through some communication interfaces; the indirect coupling or communication connection of devices or units may be electrical, mechanical, or other forms.

[0071] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0072] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0073] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0074] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A network isolation method based on a cloud-native hyperconverged platform, characterized in that, The cloud-native hyperconverged platform provides physical network interfaces for management and storage in its corresponding network architecture. The method includes: In the underlying operating system of the cloud-native hyperconverged platform, management aggregation interface, management bridge interface, storage aggregation interface, and storage bridge interface are created respectively; Establish a binding relationship between the management aggregation interface, the management bridge interface, and the physical network port used for management services, and open the virtual local area network used by the service traffic on the management bridge interface, so that the physical network port used for management services can access management and service traffic; Establish the binding relationship between the storage aggregation interface, the storage bridge interface, and the physical network port for storage, and open the virtual local area network used by the storage traffic on the storage bridge interface. Utilize the resource customization mechanism provided by the open source container orchestration system to complete the storage traffic configuration and connect the storage traffic to the physical network port for storage.

2. The method according to claim 1, characterized in that, The physical network ports used for management services include a first physical network port and a second physical network port. The binding relationship between the management aggregation interface, the management bridge interface, and the physical network interface used for management services is created in the following way: The management aggregation interface is configured to be bound to the management bridge interface using a master-slave binding mode, wherein the management aggregation interface is a slave interface of the management bridge interface; Using the load balancing binding mode, create a binding relationship between the first physical network port and the management aggregation interface, and create a binding relationship between the second physical network port and the management aggregation interface.

3. The method according to claim 1, characterized in that, The virtual LAN corresponding to the service traffic can be opened on the management bridge interface in the following ways: Enable the virtual LAN filtering function corresponding to the management bridge interface; Use the business virtual LAN to add commands and instructions to allow at least one virtual LAN used by the business traffic accessed by the physical network port of the management business on the traffic channel formed between the management aggregation interface and the management bridge interface.

4. The method according to claim 1, characterized in that, Before opening the virtual local area network corresponding to the service traffic on the management bridge interface, the method further includes: Disable the spanning tree protocol on the management bridge interface.

5. The method according to claim 3, characterized in that, The method further includes: The service traffic configuration interface provided by the cloud-native hyperconverged platform is invoked, and the service traffic configuration interface includes a service traffic addition control. In response to the selection operation performed by adding a control for the service traffic, a service traffic information configuration item and its corresponding virtual LAN configuration item are generated. In response to configuration operations performed on configuration items related to service traffic information, create the target service traffic; In response to configuration operations performed on virtual LAN configuration items, target service traffic is bound to the target virtual LAN that is open between the management aggregation interface and the management bridge interface through link aggregation.

6. The method according to claim 1, characterized in that, The physical network ports used for storage include a third physical network port and a fourth physical network port. The binding relationship between the storage aggregation interface, the storage bridge interface, and the physical network interface for storage is created in the following way: The storage aggregation interface is configured to be bound to the storage bridge interface using a primary / standby binding mode, wherein the storage aggregation interface is a slave interface of the storage bridge interface; Using the load balancing binding mode, create a binding relationship between the third physical network port and the storage aggregation interface, and create a binding relationship between the fourth physical network port and the storage aggregation interface.

7. The method according to claim 1, characterized in that, Configure storage traffic as follows: Deploy custom resources on the underlying operating system; With the support of custom resources, a cluster-level address management system is established through the resource customization mechanism provided by the open-source container orchestration system. The cluster-level address management system is used to declare the storage network. Configure the storage network parameters corresponding to the storage network through a cluster-level address management system; After configuring the storage network parameters, the storage network is reconfigured based on the changed parameters to complete the storage traffic configuration.

8. The method according to claim 7, characterized in that, The method further includes: Execute configuration verification commands provided by the resource customization mechanism of the open-source container orchestration system and obtain refactoring status feedback fields; If the refactoring status feedback field indicates that the configuration is effective, then it is determined that storage traffic has been separated from management traffic; If the reconstruction status feedback field indicates that the configuration is invalid, then return and re-execute the storage network parameter configuration operation.

9. A network isolation device based on a cloud-native hyperconverged platform, characterized in that, The cloud-native hyperconverged platform provides physical network interfaces for management services and storage in its corresponding network architecture. The device includes: The interface creation module is used to create management aggregation interface, management bridge interface, storage aggregation interface and storage bridge interface respectively in the underlying operating system of the cloud-native hyperconverged platform; The merging module is used to establish the binding relationship between the management aggregation interface, the management bridge interface, and the physical network port used for management services, and to open the virtual local area network used by the service traffic on the management bridge interface, so that the physical network port used for management services can access management and service traffic; The separation module is used to establish the binding relationship between the storage aggregation interface, the storage bridge interface, and the physical network port for storage, and to open the virtual local area network used by storage traffic on the storage bridge interface. It utilizes the resource customization mechanism provided by the open source container orchestration system to complete the storage traffic configuration and connect the storage traffic to the physical network port for storage.

10. An electronic device, characterized in that, include: The device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. The machine-readable instructions are executed by the processor to perform the steps of the network isolation method based on a cloud-native hyperconverged platform as described in any one of claims 1 to 8.

Images