Load balancer source address conversion control method based on OpenStack Octavia and SDN technology, storage medium and equipment

Abstract

The invention discloses a load balancer source address conversion control method based on OpenStack Octavia and an SDN (Software Defined Network) technology. The load balancer source address conversion control method comprises the following steps of: configuring a fail provider = sdndriver in a configuration file of an octaviaapi service of the OpenStack Octavia, wherein the fail provider = sdndriver; the method comprises the following steps of: introducing an enable snat parameter into OpenStack Octavia; packaging each northbound interface of the SDN controller by using an sdndriver to carry out calling; the method comprises the following steps: analyzing an enable snat parameter sent by an sdndriver of OpenStack Octavia through a northbound interface of an SDN controller, selecting a southbound interface protocol according to a model of a load balancer, and issuing configuration for enabling or disabling source address translation to a monitor instance of the load balancer, thereby realizing accurate enabling or disabling of source address translation according to a monitor dimension on the premise of being compatible with an OpenStack Octavia native function.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network cloud, in particular, to a load balancer source address translation control method based on OpenStack Octavia and SDN technology, a storage medium and equipment. BACKGROUND

[0002] The source address translation (SNAT) of the load balancer is a network address translation technology, which is used for modifying the source IP address of the client request, so that it is "disguised" as the IP address of the load balancer when reaching the backend server. The core purpose is to solve the problem of the backend server return packet path, and to enhance the security and manageability of the cloud platform.

[0003] With the rapid development of cloud computing and virtualization technology, the source address translation function of the traditional load balancer such as hardware LB needs to be manually configured, which cannot adapt to the dynamic business needs of the cloud environment. OpenStack has become one of the mainstream cloud platform solutions. In the OpenStack architecture, Octavia acts as a load balancer component, which undertakes the important task of traffic distribution and load balancing. However, its source address translation behavior is implicitly determined by the listener protocol, which is enabled by default. The original listener of Octavia lacks the enabled_snat parameter of the switch source address translation, and cannot dynamically control the source address translation switch through the API. Therefore, under the default configuration, flexible control of the source address translation is usually not provided, which makes it difficult for users to dynamically adjust the network behavior of the load balancer according to the business needs in actual deployment. In the hybrid cloud scenario, the wide application of software defined network SDN technology makes it possible to dynamically configure and manage network resources, but the SDN controller needs to uniformly manage heterogeneous LB devices. The existing scheme lacks a standardized source address translation control interface, and lacks end-to-end source address translation life cycle management capability from the configuration interface to the data plane execution. SUMMARY

[0004] In view of the problems in the prior art, the present application provides a load balancer source address translation control method based on OpenStack Octavia and SDN technology, a storage medium and equipment, which constructs the full life cycle management of source address translation, realizes the fine-grained dynamic control of source address translation from the cloud platform to the SDN controller to the load balancer hardware device, and improves the manageability and scalability of the cloud platform.

[0005] To achieve the above technical purposes, the present application adopts the following technical scheme: A load balancer source address translation control method based on OpenStack Octavia and SDN technology, the specific process is as follows: Configure default_provider_driver = sdn_driver in the configuration file of the octavia_api service of OpenStack Octavia; Introduce the enabled_snat parameter in OpenStack Octavia; Use the sdn_driver to encapsulate the respective northbound interfaces of the SDN controller for calling; Parse the enabled_snat parameter sent by the sdn_driver of OpenStack Octavia through the northbound interface of the SDN controller, select the southbound interface protocol according to the model of the load balancer, and deliver the configuration of enabling or disabling source address translation to the listener instance of the load balancer; Create a load balancer, and OpenStack Octavia transmits the request parameters of the load balancer to the SDN controller, and the SDN controller delivers the configuration of VLB to the load balancer; Create a listener under the load balancer, and the SDN controller delivers the configuration of the listener and the configuration of source address translation to the VLB of the load balancer; Create a resource pool under the listener, and the SDN controller delivers the configuration of the resource pool to the VLB of the load balancer; Create a service virtual machine under the resource pool, and the SDN controller delivers the configuration of the service virtual machine to the VLB of the load balancer; The client accesses the VLB of the load balancer, if the configuration of source address translation of the listener of the load balancer is enabled, the source address seen by the service virtual machine is the IP address allocated by the address pool of the load balancer, otherwise, the source address seen by the service virtual machine is the source IP address requested by the client.

[0006] Further, the specific process of introducing the enabled_snat switch in OpenStack Octavia is as follows: Create or update the Octavia interface and the return value of the Octavia interface in the API layer of the listener of OpenStack Octavia, and add the enabled_snat parameter; Add the verification of the enabled_snat parameter in the parameter verification file of the listener of OpenStack Octavia; Add the enabled_snat parameter in the listener table in the database migration file of OpenStack Octavia.

[0007] Further, the calling of the various northbound interfaces of the SDN controller using the sdn_driver includes: querying, creating, updating, and deleting various resources of the load balancer by calling the northbound interfaces of the SDN controller, issuing resources of the OpenStack Octavia API by calling the northbound interfaces of the SDN controller.

[0008] Further, the SDN controller is also configured to periodically pull the running state of the load balancer, and when the state of each resource of the load balancer is inconsistent with the resource storage state of the SDN controller, issuing a correction and writing an audit log.

[0009] Further, the configuration of the listener includes configuring the listener protocol and the listener port; and the configuration of the source address translation is configured to enable or disable the source address translation.

[0010] Further, a health checker is created under the resource pool, and the SDN controller issues the configuration of the health checker to the VLB of the load balancer for checking the business virtual machines under the resource pool.

[0011] Further, if the configuration of the source address translation of the listener of the load balancer is enabled, the moving path of the data packet is: the request data packet with the client IP as the source IP and the VIP of the VLB of the load balancer as the destination IP is sent from the client to the firewall, the Border, and the load balancer in turn; the load balancer performs source address translation to modify the source IP to the IP allocated by the load balancer address pool, updates the data packet, and forwards the updated data packet to the business virtual machine; the response data packet with the business virtual machine IP as the source IP and the IP allocated by the load balancer address pool as the destination IP is returned from the business virtual machine to the load balancer via the Border; the load balancer receives the response data packet, performs target address translation to modify the destination IP to the client IP and the source IP to the VIP of the VLB of the load balancer, updates the response data packet, and forwards the updated response data packet to the client.

[0012] Further, if the configuration of the source address translation of the listener of the load balancer is disabled, the moving path of the data packet is: the request data packet with the client IP as the source IP and the VIP of the VLB of the load balancer as the destination IP is sent from the client to the firewall, the Border, and the load balancer in turn; after receiving the request data packet, the load balancer modifies the destination IP to the business virtual machine IP, updates the request data packet, and forwards the updated request data packet to the business virtual machine; The response packet with the service virtual machine IP as the source IP and the client IP as the destination IP is returned to the client through the Border and the firewall.

[0013] Further, the application further provides a computer readable storage medium, which stores a computer program, and the computer program enables a computer to execute the load balancer source address conversion control method based on OpenStack Octavia and SDN technology.

[0014] Further, the application further provides an electronic device, which comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the load balancer source address conversion control method based on OpenStack Octavia and SDN technology when executing the computer program.

[0015] Compared with the prior art, the application has the following beneficial effects: (1) The load balancer source address conversion control method based on OpenStack Octavia and SDN technology adds an sdn_driver in OpenStack Octavia, connects a northbound interface of an SDN controller, creates resources such as a load balancer, a listener, a resource pool and a service virtual machine, and maps an enabled_snat parameter to the SDN controller, so that the method can be compatible with original functions of OpenStack Octavia, and meanwhile, the method can dynamically adjust source address conversion control rules of a bottom load balancer according to the enabled_snat parameter, avoids errors and delays caused by manual configuration, and reduces operation and maintenance complexity. (2) The application introduces the enabled_snat parameter in OpenStack Octavia, adds the enabled_snat parameter in a listener table API layer of OpenStack Octavia, supports independent control of a source address conversion switch according to a listener dimension, breaks through traditional restrictions, and realizes fine control; the application adds the enabled_snat parameter in a listener table in a database migration file, realizes smooth upgrade through database migration, adds enabled_snat parameter verification logic, and ensures legality. (3) The application modifies the source address conversion control strategy in real time through an API or an interface, the SDN controller can take effect and issue new rules in seconds, does not affect existing traffic, reduces operation and maintenance costs, does not need to reconstruct a network architecture or manually configure a hardware device, reduces operation and maintenance complexity, at the same time, the SDN controller instantaneously issues or cancels the rules of source address conversion control, does not need to reconstruct a load balancer instance or migrate service traffic, and meets the requirements of high availability and zero downtime of a production environment. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 A configuration schematic diagram of the load balancer source address conversion control method based on OpenStack Octavia and SDN technology of the application; Figure 2 A resource linkage diagram issued by the OpenStack Octavia and the SDN controller in the application; Figure 3 A moving path schematic diagram of a data packet when the source address conversion of a listener of the load balancer is configured to be enabled; Figure 4 A moving path schematic diagram of a data packet when the source address conversion of a listener of the load balancer is configured to be disabled. DETAILED DESCRIPTION

[0017] The technical solutions of the application are further explained and described below in combination with the drawings.

[0018] The application provides a load balancer source address conversion control method based on OpenStack Octavia and SDN technology, and the specific process is as follows: As Figure 1 The default_provider_driver = sdn_driver is configured in a configuration file of an octavia_api service of the OpenStack Octavia.

[0019] An enabled_snat parameter is introduced in the OpenStack Octavia, and specifically: An Octavia interface and an Octavia interface return value are created or updated in an API layer of an OpenStack Octavia listener, and an enabled_snat parameter is added, the enabled_snat parameter is a Boolean type, supports independent control of a source address conversion switch according to a listener dimension, breaks through a traditional limitation, and realizes fine control; The enabled_snat parameter is added in a parameter verification file of the OpenStack Octavia listener, and legality is ensured; An enabled_snat parameter is added in the listener table in the database migration file of OpenStack Octavia, a migration file is executed, and a smooth upgrade is realized through database migration, wherein the enabled_snat parameter is not a mandatory field and is enabled by default.

[0020] Various northbound interfaces of the SDN controller are encapsulated using the sdn_driver to make a call, including: Through the northbound interface of the SDN controller, queries, creation, update and deletion of various resources of the load balancer are performed, Through the northbound interface of the SDN controller, resource delivery of the OpenStack Octavia API is performed.

[0021] The enabled_snat parameter sent by the sdn_driver of the OpenStack Octavia is parsed through the northbound interface of the SDN controller, and is mapped to a vendor-independent YANG / JSON service model, so that multi-vendor load balancers can be uniformly scheduled, a southbound interface protocol is selected according to the model of the load balancer, including Netconf, RESTCONF, gRPC, CLI, etc., and the configuration of enabling or disabling source address translation is delivered to the listener instance of the load balancer.

[0022] The SDN controller is also used to periodically pull the running state of the load balancer, when the state of each resource of the load balancer is inconsistent with the resource storage state of the SDN controller, a correction is delivered and written into an audit log, and automatic correction of drift configuration is realized.

[0023] Through the above configuration, the enabled_snat parameter is transmitted from the OpenStack Octavia listener to the underlying load balancer, and the SDN controller is responsible for protocol conversion, configuration delivery and state calibration, the octavia_api service is restarted to make the new item in the configuration file effective, and flexible source address translation control at the listener level of the load balancing service is realized.

[0024] As Figure 2 In a cloud platform interface or a command line mode, a load balancer is created, the request parameters of the load balancer are transmitted to the SDN controller by the OpenStack Octavia, and the SDN controller delivers the configuration of the VLB to the load balancer.

[0025] A listener is created under the load balancer through a cloud platform interface or a command line, a listener protocol is selected as one of tcp, udp, http or https protocol, a listening port is input, and source address translation is selected to be enabled or disabled as needed. The SDN controller issues a listener configuration and a source address translation configuration to the VLB of the load balancer, wherein the listener configuration includes configuring the listener protocol and the listening port; and the source address translation configuration is used to configure the source address translation to be enabled or disabled.

[0026] A resource pool is created under the listener through a cloud platform interface or a command line, and a polling algorithm is selected. The SDN controller issues a resource pool configuration and the polling algorithm to the VLB of the load balancer.

[0027] The service virtual machine provides real load service for the load balancer. When a client accesses the load balancer, the load balancer loads traffic to the corresponding service virtual machine according to the algorithm indicated by the algorithm configured by the resource pool. The service virtual machine is created under the resource pool through a cloud platform interface or a command line. After the OpenStack Octavia API layer performs parameter verification on the service virtual machine, the SDN controller issues a service virtual machine configuration to the VLB of the load balancer.

[0028] A health checker is created under the resource pool. After the OpenStack Octavia API layer performs parameter verification on the health checker, the SDN controller issues a health checker configuration to the VLB of the load balancer, which is used to check whether the service virtual machine under the resource pool can provide load service.

[0029] The client accesses the VLB of the load balancer. If the source address translation configuration of the listener of the load balancer is enabled, the source address seen by the service virtual machine is the IP address allocated by the load balancer address pool, otherwise, the source address seen by the service virtual machine is the source IP address requested by the client.

[0030] The application can be compatible with the OpenStack Octavia native function, meanwhile, the source address conversion control can be centrally managed through the SDN controller, the source address conversion control rules of the underlying load balancer can be dynamically adjusted according to the enabled snat parameter, the errors and delays caused by manual configuration can be avoided, the operation and maintenance complexity can be reduced, the global source address conversion strategy audit and optimization can be realized at the SDN controller level, the standard OpenStack Octavia API is used, the use of the existing cloud platform management tool is not affected, the smooth upgrade and compatibility are ensured, meanwhile, the source address conversion control strategy can be modified in real time through the API or the interface, the SDN controller can second-level effect and issue new rules, the existing traffic is not affected, the operation and maintenance cost is reduced, the network architecture does not need to be reconstructed or the hardware device needs to be manually configured, the operation and maintenance complexity is reduced, meanwhile, the rules of the source address conversion control can be issued or revoked in real time through the SDN controller, the load balancer instance does not need to be reconstructed or the business traffic needs to be migrated, the requirements of high availability and zero downtime in the production environment are met. The load balancer source address conversion control method improves the flexibility and manageability of the cloud platform, and is suitable for network optimization and traffic management in a large-scale cloud computing environment and an SDN controller environment.

[0031] As Figure 3 , the configuration of the source address conversion of the listener of the load balancer is enabled, and the moving path of the data packet is: the request data packet with the client IP as the source IP and the VIP of the VLB of the load balancer as the destination IP is sent from the client to the firewall, the Border and the load balancer in turn; the load balancer performs the source address conversion, modifies the source IP into the IP allocated by the load balancer address pool, updates the data packet, and forwards the updated data packet to the business virtual machine; the response data packet with the business virtual machine IP as the source IP and the IP allocated by the load balancer address pool as the destination IP is returned from the business virtual machine to the load balancer through the Border; the load balancer receives the response data packet, performs the target address conversion, modifies the destination IP into the client IP and the source IP into the VIP of the VLB of the load balancer, realizes the response data packet update, and forwards the updated response data packet to the client.

[0032] As Figure 4 , the configuration of the source address conversion of the listener of the load balancer is disabled, and the moving path of the data packet is: the request data packet with the client IP as the source IP and the VIP of the VLB of the load balancer as the destination IP is sent from the client to the firewall, the Border and the load balancer in turn; After receiving the request data packet, the load balancer modifies the destination IP as the service virtual machine IP, realizes the update of the request data packet, and forwards the updated request data packet to the service virtual machine. The response data packet with the service virtual machine IP as the source IP and the client IP as the destination IP is returned to the client through the Border and the firewall.

[0033] When the source address conversion configuration of the listener of the load balancer is disabled, the load balancer does not need to modify the source IP of the data packet, reduces the table entry maintenance and calculation overhead of the address conversion table, and improves the forwarding efficiency. For example, in high-throughput services such as video streaming and CDN services, the source address conversion function can be closed to improve performance. Traditional source address conversion hides the client IP, so that the backend server cannot obtain the real access source, and after closing the source address conversion, the security log audit can directly record the client IP, facilitating the analysis of attack sources.

[0034] In one technical solution of the present application, a computer readable storage medium storing a computer program is also provided, and the computer program enables a computer to execute the load balancer source address conversion control method based on OpenStack Octavia and SDN technology.

[0035] In one technical solution of the present application, an electronic device is also provided, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and when the processor executes the computer program, the load balancer source address conversion control method based on OpenStack Octavia and SDN technology is realized.

[0036] In the embodiments disclosed in the present application, the computer storage medium can be a tangible medium, which can contain or store programs for use by or in connection with an instruction execution system, apparatus or device. The computer storage medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses or devices, or any suitable combination of the above. More specific examples of computer storage media can include one or more wires, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.

[0037] Those skilled in the art can understand that the units and algorithm steps of each example described in combination with the embodiments disclosed in the present application can be realized in electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software manner depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0038] The above is only the preferred embodiment of the present application, and the protection scope of the present application is not limited to the above-mentioned embodiments. Any technical solution falling within the concept of the present application shall fall within the protection scope of the present application. It should be noted that, for ordinary skilled persons in the art, some improvements and refinements without departing from the principles of the present application shall be considered as the protection scope of the present application.

Claims

1. A load balancer source address translation control method based on OpenStack Octavia and SDN technology, characterized in that, The specific process is as follows: In the configuration file of the octavia_api service of OpenStack Octavia, the default_provider_driver = sdn_driver is configured; An enabled_snat parameter is introduced in OpenStack Octavia; The sdn_driver encapsulates each northbound interface of the SDN controller for calling; The enabled_snat parameter sent by the sdn_driver of OpenStack Octavia is parsed through the northbound interface of the SDN controller, the southbound interface protocol is selected according to the model of the load balancer, and the configuration of enabling or disabling source address translation is sent to the listener instance of the load balancer; A load balancer is created, OpenStack Octavia transmits the request parameter of the load balancer to the SDN controller, and the SDN controller sends the VLB configuration of the load balancer to the load balancer; A listener is created under the load balancer, the SDN controller sends the configuration of the listener and the configuration of source address translation to the VLB of the load balancer; A resource pool is created under the listener, the SDN controller sends the configuration of the resource pool to the VLB of the load balancer; A service virtual machine is created under the resource pool, and the SDN controller sends the configuration of the service virtual machine to the VLB of the load balancer; The client accesses the VLB of the load balancer, if the configuration of source address translation of the listener of the load balancer is enabled, the source address seen by the service virtual machine is the IP address allocated by the address pool of the load balancer, otherwise, the source address seen by the service virtual machine is the source IP address requested by the client. 2.The OpenStack Octavia and SDN technology-based load balancer source address translation control method of claim 1, wherein, The specific process of introducing the enabled_snat parameter in OpenStack Octavia is as follows: In the API layer of the listener of OpenStack Octavia, the Octavia interface is created or updated, and the return value of the Octavia interface is returned, and the enabled_snat parameter is added; In the parameter verification file of the listener of OpenStack Octavia, the verification of the enabled_snat parameter is added; In the database migration file of OpenStack Octavia, the enabled_snat parameter is added in the listener table. 3.The OpenStack Octavia and SDN technology-based load balancer source address translation control method of claim 1, wherein, The sdn_driver encapsulates each northbound interface of the SDN controller for calling, including: Through the northbound interface of the SDN controller, the query, creation, update and deletion of each resource of the load balancer are called, Through the northbound interface of the SDN controller, the resource of OpenStack Octavia API is sent. 4.The OpenStack Octavia and SDN technology-based load balancer source address translation control method of claim 1, wherein, The SDN controller is also used for periodically pulling the running state of the load balancer, when the state of each resource of the load balancer is inconsistent with the resource storage state of the SDN controller, the correction is sent and written into the audit log. 5.The OpenStack Octavia and SDN technology-based load balancer source address translation control method of claim 1, wherein, The configuration of the listener includes configuring the listener protocol and the listener port; and the configuration of the source address translation is configured to enable or disable the source address translation. 6.The OpenStack Octavia and SDN technology-based load balancer source address translation control method of claim 1, wherein, A health checker is created under the resource pool, and the SDN controller issues the configuration of the health checker to the VLB of the load balancer, which is used to check the service virtual machine under the resource pool.

7. The load balancer source address translation control method based on OpenStack Octavia and SDN technology according to claim 1, characterized in that, If the configuration of the source address translation of the listener of the load balancer is enabled, the moving path of the data packet is as follows: The request data packet with the client IP as the source IP and the VIP of the VLB of the load balancer as the destination IP is sent from the client to the firewall, the Border and the load balancer in sequence; The load balancer performs the source address translation, modifies the source IP to the IP allocated by the load balancer address pool, updates the data packet, and forwards the updated data packet to the service virtual machine; The response data packet with the service virtual machine IP as the source IP and the IP allocated by the load balancer address pool as the destination IP is returned from the service virtual machine to the load balancer through the Border; The load balancer receives the response data packet, performs the target address translation, modifies the destination IP to the client IP and the source IP to the VIP of the VLB of the load balancer, updates the response data packet, and forwards the updated response data packet to the client. 8.The method of claim 1, wherein, If the configuration of the source address translation of the listener of the load balancer is disabled, the moving path of the data packet is as follows: The request data packet with the client IP as the source IP and the VIP of the VLB of the load balancer as the destination IP is sent from the client to the firewall, the Border and the load balancer in sequence; The load balancer receives the request data packet, modifies the destination IP to the service virtual machine IP, updates the request data packet, and forwards the updated request data packet to the service virtual machine; The response data packet with the service virtual machine IP as the source IP and the client IP as the destination IP is returned to the client through the Border and the firewall.

9. A computer readable storage medium storing a computer program, characterized in that, The computer program enables the computer to execute the load balancer source address translation control method based on OpenStack Octavia and SDN technology according to any one of claims 1-8.

10. An electronic device, comprising: It comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the load balancer source address translation control method based on OpenStack Octavia and SDN technology according to any one of claims 1-8.

Images