Cross-vpc access configuration method based on cloud computing technology and cloud management platform

Abstract

Disclosed is a cross-VPC access configuration method based on cloud computing technology and a cloud management platform, relating to the technical field of cloud computing. In the method, the cloud management platform records the association between each VPC and the public VPC in N VPCs through an intranet domain group, thereby realizing the authorization of each VPC to establish a cross-VPC connection channel with the public VPC. Since the association between N VPCs and the public VPC can be managed through the created intranet domain group, the process of configuring the association is simplified and the complexity of the process is reduced. On the basis of the association between the VPC and the public VPC, the cloud management platform creates a cross-VPC connection channel between the VPC and the public VPC according to a cross-VPC connection channel creation request, so that the virtual instances in the VPC can access any cloud service associated with the public VPC through the cross-VPC connection channel, thereby improving the ease of use and convenience of cross-VPC access to cloud services and the user experience of tenants.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a cross-VPC access configuration method and cloud management platform based on cloud computing technology. Background Technology

[0002] As tenants place increasing emphasis on the security of accessing cloud services, their demand for accessing cloud services across virtual private clouds (VPCs) is growing. However, the configuration solutions for cross-VPC access to cloud services provided in related technologies are not only cumbersome but also highly complex, significantly increasing the difficulty of accessing cloud services across VPCs. Summary of the Invention

[0003] This application provides a cross-VPC access configuration method and cloud management platform based on cloud computing technology, which not only helps to simplify the configuration process and reduce the complexity of the configuration process, but also helps to improve the ease of accessing cloud services.

[0004] Firstly, a cross-VPC access configuration method based on cloud computing technology is provided, applied to a cloud management platform. The cloud management platform manages infrastructure, which includes multiple cloud data centers. At least one of the cloud data centers contains N VPCs belonging to a tenant's main account and / or sub-accounts associated with the main account, and 1 public VPC. The public VPC contains M cloud services or is connected to M cloud services, where N is a positive integer greater than 1 and M is a positive integer greater than 0. The method includes: the cloud management platform receiving an internal domain name group creation request input by the tenant, the internal domain name group creation request including the identifiers of the N VPCs and the identifier of the public VPC; and the cloud management platform creating an internal domain name group according to the internal domain name group creation request. The internal domain name group records the association between the identifiers of N VPCs and the identifiers of public VPCs, and the internal domain name group is set with an internal domain name group identifier. The cloud management platform receives a first cross-VPC connection channel creation request input by the tenant or other tenants authorized by the tenant. The first cross-VPC connection channel creation request includes the identifier of the first VPC among the N VPCs, the identifier of the public VPC, and the internal domain name group identifier. According to the first cross-VPC connection channel creation request, the cloud management platform establishes a first cross-VPC connection between the first VPC and the public VPC, and allows virtual instances in the first VPC to access any one of the M cloud services set in the public VPC or any one of the M cloud services connected to the public VPC through the first cross-VPC connection channel.

[0005] In the above scheme, the cloud management platform records the association between each VPC and the public VPC through an internal domain name group, thereby granting each VPC the permission to establish a cross-VPC connection channel with the public VPC. Since the association between the N VPCs and the public VPC can be managed through the created internal domain name group, it helps simplify the process of configuring associations and reduces the complexity of the configuration process. Based on the association between the first VPC and the public VPC, the cloud management platform creates a first cross-VPC connection channel between the first VPC and the public VPC according to the first cross-VPC connection channel creation request. This allows any virtual instance in the first VPC to access any cloud service in the public VPC or any cloud service connected to the public VPC through the first cross-VPC connection channel. Since each VPVC can access any cloud service through a single cross-VPC connection channel with the public VPC, this improves the ease of use and convenience of accessing cloud services across VPCs, thereby enhancing the tenant's user experience.

[0006] In one possible implementation, M cloud services are configured with M intranet domain names, wherein each of the M cloud services has one intranet domain name, and each intranet domain name corresponds to a private IP address of a public VPC. Different intranet domain names correspond to different private IP addresses of public VPCs. The method further includes: a cloud management platform receiving a target request input by a tenant, wherein the target request includes identifiers of N VPCs and identifiers of M cloud services; and the cloud management platform responding to the target request by creating a mapping relationship between the identifiers of the N VPCs and the M private domain name resolution services, wherein the M private domain name resolution services are used to record the mapping relationship between the M intranet domain names and the corresponding private IP addresses of the M intranet domain names.

[0007] In this implementation, the cloud management platform creates a mapping between N VPC identifiers and M private domain name resolution services based on the tenant's target request. This grants the N VPCs permission to use the M private domain name resolution services, allowing them to obtain the private IP addresses corresponding to the M internal domain names. This ensures that only the specified N VPCs can access the cloud service, thus contributing to the security and reliability of the cloud service. Because the cloud management platform can establish the mapping between N VPC identifiers and M private domain name resolution services based on the target request, it simplifies the configuration process, reduces the complexity of configuring the mapping, and improves the convenience of granting the N VPCs permission to use the M private domain name resolution services.

[0008] In another possible implementation, the method further includes: the cloud management platform receiving a first domain name access request sent by a virtual instance in the first VPC, wherein the first domain name access request is used to request access to the intranet domain name of the first cloud service among M cloud services in the public VPC, and the first domain name access request includes the identifier of the first VPC; in response to the first domain name access request, the cloud management platform returns the first private IP address to the virtual instance in the first VPC according to the correspondence between the intranet domain name of the first cloud service and the first private IP address of the public VPC, wherein the virtual instance in the first VPC sends a network packet with the destination IP address as the first private IP address to the public VPC through a first cross-VPC connection channel.

[0009] In this implementation, after receiving a domain name access request from a virtual instance in the first VPC, the cloud management platform determines whether the virtual instance in the first VPC has the authority to obtain the private IP address of the first cloud service based on the correspondence between the identifier of the first VPC and the first private network domain name resolution service. This helps prevent unauthorized VPCs from obtaining the private IP address of the first cloud service, thereby helping to ensure the security of the first cloud service. Furthermore, by providing the first private network IP address to virtual instances in authorized first VPCs, the cloud management platform enables pre-designated virtual instances in the first VPC to successfully access the first cloud service, thus helping to guarantee the access rights of the designated virtual instances in the first VPC to the first cloud service.

[0010] In another possible implementation, the method further includes: the cloud management platform receiving a second domain name access request sent by a virtual instance in the first VPC, wherein the second domain name access request is used to access the intranet domain name of the second cloud service among M cloud services in the public VPC, and the second domain name access request includes the identifier of the first VPC; in response to the second domain name access request, the cloud management platform returns the second private network IP address to the virtual instance in the first VPC according to the correspondence between the intranet domain name of the second cloud service and the second private network IP address of the public VPC, wherein the virtual instance in the first VPC sends a network packet with the destination IP address as the second private network IP address to the public VPC through a first cross-VPC connection channel.

[0011] In this implementation, after receiving a domain name access request from a virtual instance in the first VPC, the cloud management platform determines whether the virtual instance in the first VPC has the authority to obtain the private IP address of the second cloud service based on the correspondence between the identifier of the first VPC and the second private network domain name resolution service. This helps prevent unauthorized VPCs from obtaining the private IP address of the second cloud service, thereby helping to ensure the security of the second cloud service. Furthermore, by providing the second private IP address to virtual instances in the authorized first VPC, the cloud management platform enables pre-designated virtual instances in the first VPC to successfully access the second cloud service, thus helping to guarantee the access rights of the designated virtual instances in the first VPC to the second cloud service.

[0012] In another possible implementation, the method further includes: the cloud management platform receiving a second cross-VPC connection channel creation request input by a tenant or another tenant authorized by the tenant, the second cross-VPC connection channel creation request including the identifier of the second VPC among N VPCs, the identifier of the public VPC, and the identifier of the intranet domain name group; the cloud management platform establishing a second cross-VPC connection channel between the second VPC and the public VPC according to the second cross-VPC connection channel creation request, and allowing virtual instances in the second VPC to access any one of the M cloud services set in the public VPC or any one of the M cloud services connected to the public VPC through the second cross-VPC connection channel.

[0013] In this implementation, the cloud management platform creates a second cross-VPC connection channel between the second VPC and the public VPC based on the second cross-VPC connection channel creation request. This allows any virtual instance in the second VPC to access any cloud service in the public VPC or any cloud service connected to the public VPC through the second cross-VPC connection channel. Since the second VPC can access any cloud service through a single cross-VPC connection channel with the public VPC, this improves the ease of use and convenience of accessing cloud services across VPCs, thereby enhancing the user experience for tenants.

[0014] In another possible implementation, the method further includes: the cloud management platform receiving a third domain name access request sent by a virtual instance in the second VPC, wherein the third domain name access request is used to access the intranet domain name of the third cloud service among the M cloud services in the public VPC, and the third domain name access request includes the identifier of the second VPC; in response to the third domain name access request, the cloud management platform returns the third private network IP address to the virtual instance in the second VPC according to the correspondence between the intranet domain name of the third cloud service and the third private network IP address of the public VPC, wherein the virtual instance in the second VPC sends a network packet with the destination IP address as the third private network IP address to the public VPC through a second cross-VPC connection channel.

[0015] In this implementation, after receiving a domain name access request from a virtual instance in the second VPC, the cloud management platform can determine whether the virtual instance in the second VPC has the authority to obtain the private IP address of the third cloud service based on the mapping between the second VPC's identifier and the third private network domain name resolution service. This helps prevent unauthorized VPCs from obtaining the private IP address of the third cloud service, thereby contributing to the security of the third cloud service. Furthermore, by providing the third private network IP address to virtual instances in authorized second VPCs, the cloud management platform enables pre-designated virtual instances in the second VPC to successfully access the third cloud service, thus ensuring the access rights of the designated virtual instances in the second VPC to the third cloud service.

[0016] In another possible implementation, the method further includes: the cloud management platform receiving a fourth domain name access request sent by a virtual instance in the second VPC, wherein the fourth domain name access request is used to access the intranet domain name of the fourth cloud service among the M cloud services in the public VPC, and the fourth domain name access request includes the identifier of the second VPC; in response to the fourth domain name access request, the cloud management platform returns the fourth private network IP address to the virtual instance in the second VPC according to the correspondence between the intranet domain name of the fourth cloud service and the fourth private network IP address of the public VPC, wherein the virtual instance in the second VPC sends a network packet with the destination IP address of the fourth private network IP address to the public VPC through a second cross-VPC connection channel.

[0017] In this implementation, after receiving a domain name access request from a virtual instance in the second VPC, the cloud management platform can determine whether the virtual instance in the second VPC has the authority to obtain the private IP address of the fourth cloud service based on the correspondence between the identifier of the second VPC and the fourth private network domain name resolution service. This helps prevent unauthorized VPCs from obtaining the private IP address of the fourth cloud service, thereby helping to ensure the security of the fourth cloud service. Furthermore, by providing the fourth private network IP address to virtual instances in authorized second VPCs, the cloud management platform enables pre-designated virtual instances in the second VPC to successfully access the fourth cloud service, thus helping to guarantee the access rights of the designated virtual instances in the second VPC to the fourth cloud service.

[0018] In another possible implementation, the method further includes: the cloud management platform receiving an intranet domain name group association request input by a tenant, the intranet domain name group association request including an intranet domain name group identifier, an identifier of the newly added VPC, and an identifier of the public VPC; the cloud management platform recording the association relationship between the identifier of the newly added VPC and the identifier of the public VPC in the intranet domain name group according to the intranet domain name group association request; the cloud management platform receiving a third cross-VPC connection channel creation request input by the tenant or other tenants authorized by the tenant, the third cross-VPC connection channel creation request including the identifier of the newly added VPC, the identifier of the public VPC, and the intranet domain name group identifier; the cloud management platform establishing a third cross-VPC connection channel between the newly added VPC and the public VPC according to the third cross-VPC connection channel creation request, and allowing virtual instances in the newly added VPC to access any one of the M cloud services in the public VPC or any one of the M cloud services connected to the public VPC through the third cross-VPC connection channel.

[0019] In this implementation, the cloud management platform, based on the tenant's internal domain name group association request, can establish associations between the newly created VPC and the public VPC through the internal domain name group. This not only improves the convenience of managing associations on the cloud management platform but also enhances the ease of extending associations. Furthermore, based on the third cross-VPC connection channel creation request, the cloud management platform creates a third cross-VPC connection channel between the new VPC and the public VPC. This allows any virtual instance in the new VPC to access any cloud service in the public VPC or any cloud service connected to the public VPC through the third cross-VPC connection channel. Since the new VPC can access any cloud service through a single cross-VPC connection channel with the public VPC, the ease of use and convenience of accessing cloud services across new VPCs is improved, thereby enhancing the tenant's user experience.

[0020] In another possible implementation, the method further includes: the cloud management platform receiving a new target request input by the tenant, wherein the new target request includes the identifier of the new VPC and the identifiers of M cloud services; the cloud management platform responding to the new target request creates a mapping between the identifier of the new VPC and the M private domain name resolution services.

[0021] In this implementation, the cloud management platform creates a mapping between the identifier of the new VPC and M private domain name resolution services based on the tenant's new target request. This grants the new VPC permission to use the M private domain name resolution services, allowing it to obtain the private IP addresses corresponding to the M internal domain names. This enables the designated new VPC to access cloud services, thus helping to ensure the security and reliability of cloud services. Because the cloud management platform can establish the mapping between the new VPC identifier and the M private domain name resolution services directly from the target request, it simplifies the configuration process, reduces the complexity of configuring the mapping, and improves the convenience of granting the new VPC permission to use the M private domain name resolution services.

[0022] In another possible implementation, the method further includes: the cloud management platform receiving a fifth domain name access request sent by a virtual instance in the newly added VPC, wherein the fifth domain name access request is used to access the intranet domain name of the fifth cloud service among the M cloud services in the public VPC, and the fifth domain name access request includes the identifier of the newly added VPC; in response to the fifth domain name access request, the cloud management platform returns the fifth private network IP address to the virtual instance in the newly added VPC according to the correspondence between the intranet domain name of the fifth cloud service and the fifth private network IP address of the public VPC, wherein the virtual instance in the newly added VPC sends a network packet with the destination IP address of the fifth private network IP address to the public VPC through a third cross-VPC connection channel.

[0023] In this implementation, after receiving a domain name access request from a virtual instance in a newly added VPC, the cloud management platform determines whether the virtual instance in the new VPC has the permission to obtain the private IP address of the fifth cloud service based on the correspondence between the new VPC's identifier and the fifth private network domain name resolution service. This helps prevent unauthorized VPCs from obtaining the private IP address of the fifth cloud service, thereby helping to ensure the security of the fifth cloud service. Furthermore, by providing the fifth private network IP address to the virtual instance in the newly added VPC with the appropriate permissions, the cloud management platform enables the pre-specified virtual instance in the new VPC to successfully access the fifth cloud service, thus helping to guarantee the access permissions of the specified virtual instance in the new VPC to the fifth cloud service.

[0024] In another possible implementation, the method further includes: the cloud management platform receiving a sixth domain name access request sent by a virtual instance in the newly added VPC, wherein the sixth domain name access request is used to access the intranet domain name of the sixth cloud service among the M cloud services in the public VPC, and the sixth domain name access request includes the identifier of the newly added VPC; the cloud management platform responding to the sixth domain name access request, according to the correspondence between the intranet domain name of the sixth cloud service and the sixth private IP address of the public VPC, returns the sixth private IP address to the virtual instance in the newly added VPC, wherein the virtual instance in the newly added VPC sends a network packet with the sixth private IP address as the destination IP address to the public VPC through a third cross-VPC connection channel.

[0025] In this implementation, after receiving a domain name access request from a virtual instance in a newly added VPC, the cloud management platform determines whether the virtual instance in the new VPC has the authority to obtain the private IP address of the sixth cloud service based on the correspondence between the new VPC's identifier and the sixth private network domain name resolution service. This helps prevent unauthorized VPCs from obtaining the private IP address of the sixth cloud service, thereby contributing to the security of the sixth cloud service. Furthermore, by providing the sixth private network IP address to virtual instances in authorized new VPCs, the cloud management platform ensures that pre-specified virtual instances in new VPCs can successfully access the sixth cloud service, thus guaranteeing the access rights of the specified virtual instances in the new VPCs to the sixth cloud service.

[0026] Secondly, a cross-VPC access configuration method based on cloud computing technology is provided, applied to a cloud management platform. This method includes: the cloud management platform responding to a first creation request from a tenant to create a target intranet domain name group, wherein the first creation request is used to request the creation of the intranet domain name group; the cloud management platform establishes a first correspondence between the target intranet domain name group and N VPCs; the cloud management platform establishes a second correspondence between the target intranet domain name group and M terminal nodes; the cloud management platform establishes a correspondence between the private domain name resolution services of the N VPCs and the M terminal nodes based on the first and second correspondences, wherein the private domain name resolution services of the M terminal nodes are used to provide the Internet Protocol (IP) addresses mapped to the domain names of the M terminal nodes for the N VPCs. The IP addresses mapped to the domain names of the M terminal nodes are the IP addresses of the M terminal nodes.

[0027] In the above scheme, a mapping relationship is established between each tenant's VPC and the private domain name resolution service of the endpoint. This associates each tenant's VPC with the private domain name resolution service of the endpoint, enabling the endpoint's private domain name resolution service to provide each tenant's VPC with the IP address mapped to the endpoint's domain name. Thus, each tenant's VPC can access the endpoint within the public VPC through the endpoint's IP address, thereby enabling access to the cloud services corresponding to the endpoint's services through the endpoint within the public VPC.

[0028] Furthermore, by associating the private domain name resolution service of each VPC and each endpoint with the target internal domain name group, the association between the private domain name resolution services of each VPC and each endpoint is automatically achieved. This helps reduce the number of times the mapping relationship needs to be configured, especially when the number of VPCs or endpoints is large, significantly reducing the number of mapping relationship configurations and thus helping to reduce the complexity of the configuration process and improve configuration efficiency. In addition, since all endpoints used to access cloud services are placed in a public VPC, each VPC that needs to access cloud services accesses cloud services through endpoints within the public VPC. This eliminates the need to create endpoints for each VPC separately, reducing the number of endpoints that need to be created. This not only simplifies the configuration process and reduces its complexity but also helps to reduce subsequent maintenance costs.

[0029] In one possible implementation, the cloud management platform establishes a first correspondence between the target intranet domain name group and the tenant's N VPCs, including: the cloud management platform responding to a first association request from the tenant to establish a first correspondence between the target intranet domain name group and the N VPCs, wherein the first association request is used to indicate the target intranet domain name group and the N VPCs.

[0030] In this implementation, tenants associate a specified virtual private cloud and intranet domain name group through a separate association request. This not only helps to improve the flexibility of associating virtual private clouds and intranet domain name groups, but also helps to increase the diversity of ways to associate virtual private clouds and intranet domain name groups.

[0031] In another possible implementation, the cloud management platform establishes a first correspondence between the target intranet domain name group and the tenant's N VPCs, including: the cloud management platform instructs the N VPCs according to the first creation request to establish a first correspondence between the target intranet domain name group and the N VPCs.

[0032] In this implementation, the tenant indicates the virtual private cloud to be associated with the intranet domain name group through the creation request of the intranet domain name group. In this way, the creation and association operations can be completed simultaneously with a single request, which helps to simplify the operation of associating intranet domain name groups and VPCs. This not only helps to improve the efficiency of associating intranet domain name groups and VPCs, but also helps to simplify the tenant's operation and improve the tenant's user experience.

[0033] In another possible implementation, the cloud management platform establishes a second correspondence between the target intranet domain name group and the M terminal nodes, including: the cloud management platform receiving a second creation request from the tenant, wherein the second creation request is used to request the creation of terminal nodes, and the second creation request is also used to indicate the target terminal node service and the target intranet domain name group among the M terminal node services; the cloud management platform responds to the second creation request and creates the target terminal node in the public VPC according to the target terminal node service; the cloud management platform establishes a second correspondence between the target terminal node and the target intranet domain name group according to the target intranet domain name group indicated by the second creation request.

[0034] In this implementation, by specifying an internal network domain name group in the terminal node creation request, the cloud management platform automatically associates the terminal node with the specified internal network domain name group after creation. This allows the cloud management platform to automatically associate the private network domain name resolution service corresponding to the terminal node with the target internal network domain name group associated with the terminal node after automatically creating the service. Thus, each time a tenant creates a new terminal node, the private network domain name resolution service corresponding to the terminal node can be automatically associated with the target internal network domain name group, thereby improving the convenience of associating the private network domain name resolution service with the internal network domain name group.

[0035] In another possible implementation, the cloud management platform establishes a second correspondence between the target intranet domain name group and M terminal nodes, including: the cloud management platform responds to a second association request from the tenant and establishes a second correspondence between the target intranet domain name group and M terminal nodes, wherein the second association request is used to indicate the target intranet domain name group and M terminal nodes.

[0036] In this implementation, the private network domain name resolution service is associated with the target intranet domain name group through a separate association request. This helps to improve the convenience of adding associated private network domain name resolution services to the target intranet domain name group, thereby improving the user experience.

[0037] In another possible implementation, the N VPCs include the target VPC, and the method further includes: the cloud management platform responding to a disassociation request from a tenant by deleting the first correspondence between the target intranet domain name group and the target VPC, wherein the disassociation request is used to indicate the target intranet domain name group and the target VPC; and the cloud management platform deleting the correspondence between the target VPC and the private domain name resolution services of the M terminal nodes.

[0038] In this implementation, by setting the tenant to instruct the cloud management platform to remove the mapping relationship between the private domain name resolution service of the specified virtual private cloud and the terminal node through a disassociation request, the permission of the specified virtual private cloud to access cloud services can be cancelled.

[0039] In another possible implementation, after creating the target endpoint within a public VPC, the method further includes: the cloud management platform scheduling the creation interface of the private domain name system DNS to create a private domain name resolution service for the target endpoint based on the domain name and IP address of the target endpoint.

[0040] In this implementation, by calling the creation interface of the private domain name system (DNS), a private domain name resolution service for the target terminal node is created for the private domain name system. This allows the private domain name system to directly obtain the private domain name resolution service created by the cloud management platform, which helps to improve the convenience of the private domain name system in obtaining the private domain name resolution service.

[0041] In another possible implementation, the cloud management platform deletes the mapping relationship between the target VPC and the private domain name resolution services of the M terminal nodes. This includes: the cloud management platform calling the deletion interface of the private domain name system DNS to delete the mapping relationship between the target VPC and the private domain name resolution services of the M terminal nodes.

[0042] In another possible implementation, the method further includes: the cloud management platform receiving a third creation request from a tenant, wherein the third creation request is used to request the creation of a terminal node, and the third creation request is also used to instruct a first terminal node service; the cloud management platform responding to the third creation request, creating a first terminal node in a public VPC according to the first terminal node service, wherein the first terminal node is used to access the cloud service to which the first terminal node service belongs; the cloud management platform creating a first intranet domain name group, and establishing a correspondence between the first intranet domain name group and the first terminal node.

[0043] In this implementation, when a tenant creates a terminal node, if the tenant does not specify the internal network domain name group associated with the terminal node in the creation request, the cloud management platform automatically creates a first internal network domain name group and associates the first internal network domain name group with the newly created terminal node. This not only helps improve the uniformity of terminal node management, but also eliminates the need to re-associate the internal network domain name group when it is necessary to associate a newly created terminal node with the terminal node in the future, thereby improving the convenience of subsequent terminal node association.

[0044] In another possible implementation, the method further includes: the cloud management platform receiving a first query request from the tenant, wherein the first query request is used to request a query for a target intranet domain name group; the cloud management platform responding to the first query request returns information about the target intranet domain name group.

[0045] In this implementation, tenants can query detailed information about a specified intranet domain name group through a first query request, which helps tenants understand the detailed information of the created intranet domain name group and thus helps improve the user experience.

[0046] In another possible implementation, the method further includes: the cloud management platform receiving a second query request from a tenant, wherein the second query request is for requesting a query of an intranet domain name group; and the cloud management platform responding to the second query request by returning object information, wherein the object information is for indicating at least one intranet domain name group.

[0047] In another possible implementation, the cloud management platform establishes a correspondence between the private domain name resolution services of N VPCs and M terminal nodes based on the first and second correspondences. This includes: the cloud management platform calling the interface of the private domain name system DNS to establish a correspondence between the private domain name resolution services of N VPCs and M terminal nodes based on the first and second correspondences.

[0048] In this implementation, the private domain name system (DNS) interface is called to establish a correspondence for the private domain name system, so that the private domain name system can directly obtain the correspondence created by the cloud management platform, which helps to improve the convenience of the private domain name system in obtaining the correspondence.

[0049] Thirdly, a cloud management platform is provided, the device comprising: functional units for performing any of the methods provided in the first aspect, wherein the actions performed by each functional unit are implemented by hardware or by hardware executing corresponding software. For example, the cloud management platform includes a receiving module and a creating module. The receiving module receives an intranet domain name group creation request input by a tenant. The intranet domain name group creation request includes the identifiers of N VPCs and the identifier of a public VPC. The creating module creates an intranet domain name group based on the intranet domain name group creation request. The intranet domain name group records the association between the identifiers of the N VPCs and the identifiers of the public VPC, and the intranet domain name group is set with an intranet domain name group identifier. The receiving module is also used to receive a first cross-VPC connection channel creation request input by a tenant or another tenant authorized by the tenant. The first cross-VPC connection channel creation request includes the identifier of the first VPC among the N VPCs, the identifier of the public VPC, and the identifier of the intranet domain name group. The creating module is also used to establish a first cross-VPC connection channel between the first VPC and the public VPC based on the first cross-VPC connection channel creation request, and allow virtual instances in the first VPC to access any one of the M cloud services set in the public VPC or any one of the M cloud services connected to the public VPC through the first cross-VPC connection channel.

[0050] Fourthly, a cloud management platform is provided. This device includes functional units for executing any of the methods provided in the second aspect, wherein the actions performed by each functional unit are implemented by hardware or by hardware executing corresponding software. For example, the cloud management platform includes a relationship management module and an association module. The relationship management module is used to create a target intranet domain name group in response to a first creation request from a tenant, wherein the first creation request is used to request the creation of the intranet domain name group; the association module is used to establish a first correspondence between the target intranet domain name group and N VPCs of the tenant; the association module is also used to establish a second correspondence between the target intranet domain name group and M terminal nodes; the association module is also used to establish a correspondence between the private domain name resolution services of the N VPCs and the M terminal nodes based on the first and second correspondences, wherein the private domain name resolution services of the M terminal nodes are used to provide IP addresses mapped to the domain names of the M terminal nodes for the N VPCs.

[0051] Fifthly, a processor is provided that can be used to execute any of the methods provided in the first aspect above, or to execute any of the methods provided in the second aspect above.

[0052] In a sixth aspect, a chip is provided, comprising: a processor and a power supply circuit; the power supply circuit can be used to supply power to the chip; the processor can be used to execute any of the methods provided in the first aspect above, or to execute any of the methods provided in the second aspect above.

[0053] A seventh aspect provides a computing device, comprising: a processor, a memory, and computer programs / instructions stored in the memory; the processor executes the computer programs / instructions to cause the computing device to perform any of the methods provided in the first aspect, or to perform any of the methods provided in the second aspect.

[0054] Eighthly, a computing device cluster is provided, comprising: at least one computing device, each computing device including a processor, a memory, and computer programs / instructions stored in the memory; the processor of each computing device executes the computer programs / instructions to enable the computing device cluster to implement any of the methods provided in the first aspect above, or to execute any of the methods provided in the second aspect above.

[0055] Ninthly, a computer program product is provided, comprising a computer program / instruction that, when executed by a computing device, implements any of the methods provided in the first aspect above, or is used to execute any of the methods provided in the second aspect above.

[0056] In a tenth aspect, a computer-readable storage medium is provided, on which a computer program / instructions are stored, which, when executed by a computing device, implement any of the methods provided in the first aspect above, or are used to execute any of the methods provided in the second aspect above.

[0057] The technical effects of any of the implementation methods in aspects two through ten can be seen in the technical effects of different implementation methods in aspect one above, and will not be repeated here. Attached Figure Description

[0058] Figure 1 One of the schematic diagrams of a cloud service system provided in this application;

[0059] Figure 2 A second schematic diagram of the system architecture of a cloud service system provided in this application;

[0060] Figure 3 One of the flowcharts provided in this application is a cross-VPC access configuration method based on cloud computing technology;

[0061] Figure 4 A schematic diagram illustrating a configuration method provided in this application;

[0062] Figure 5 This is a schematic diagram of a configuration scheme for accessing cloud services in related technologies;

[0063] Figure 6 Flowchart 2 of a cross-VPC access configuration method based on cloud computing technology provided for this application;

[0064] Figure 7 One of the schematic diagrams of a configuration process provided in this application;

[0065] Figure 8 A second schematic diagram illustrating a configuration process provided in this application;

[0066] Figure 9 One of the schematic diagrams of a cloud management platform provided in this application;

[0067] Figure 10 A second schematic diagram of a cloud management platform provided for this application;

[0068] Figure 11 A schematic diagram of a computing device provided in this application;

[0069] Figure 12 A schematic diagram of a computing device cluster provided in this application;

[0070] Figure 13 This is a schematic diagram of the connection of a computing device cluster provided in this application. Detailed Implementation

[0071] The technical solution provided in this application will be described in detail below with reference to the accompanying drawings.

[0072] To facilitate a clear description of the technical solutions of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish identical or similar items with substantially the same function and effect. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and that "first" and "second" are not necessarily different. Furthermore, in the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is being used as an example, illustration, or explanation. Any embodiment or design scheme described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner for ease of understanding.

[0073] In this application, "and / or" is merely a way of describing the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone. A and B can be singular or plural.

[0074] In the description of this application, unless otherwise stated, "multiple" means two or more. "At least one" or similar expressions mean any combination of these items, including any combination of single or multiple items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0075] In the description of this application, unless otherwise stated, " / " indicates that the objects before and after are in an "or" relationship. For example, A / B can mean A or B. "And / or" in this application is merely a description of the relationship between the related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. A and B can be singular or plural.

[0076] To facilitate understanding, a brief introduction to the relevant terms used in this application will be provided first.

[0077] VPC: A VPC is a logically isolated network area built by a tenant on a public cloud platform. This network area is the tenant's private network (i.e., private network). Tenants can customize the IP address range of the VPC, create subnets of the VPC, etc.

[0078] Endpoint service: A service built on cloud services to support access by endpoints. Endpoints can access the cloud services to which the endpoint service belongs by accessing the endpoint service. One endpoint corresponds to one endpoint service, and one endpoint service can correspond to at least one endpoint.

[0079] It should be noted that this application does not restrict the name of the endpoint service. In some scenarios, the endpoint service may also be called the VPC endpoint service. In other scenarios, the endpoint service may be called the private network connection endpoint service.

[0080] An endpoint is an interface created based on an endpoint service and used to access that service. Branch nodes can access the endpoint service corresponding to the endpoint through the endpoint. One endpoint service can correspond to multiple endpoints, and one endpoint can correspond to one branch node.

[0081] It should be noted that this application does not restrict the name of the endpoint. In some scenarios, the endpoint may be called a VPC endpoint. In other scenarios, the endpoint service may be called a private network connection endpoint.

[0082] Private Domain Name System (Private DNS): Used to establish the mapping relationship between private domain names and private IP addresses, thereby providing domain name resolution services for virtual private clouds.

[0083] For example, a private domain name system can be a domain name system provided by a public cloud platform.

[0084] Private DNS zone: This is a service in the Private DNS system used to establish the mapping relationship between private domain names and private IP addresses.

[0085] Currently, as tenants place increasing emphasis on the security of accessing cloud services, their demand for accessing cloud services across virtual private clouds (VPCs) is growing. However, the configuration solutions for cross-VPC access to cloud services provided in related technologies are not only cumbersome but also highly complex, significantly increasing the difficulty of accessing cloud services across VPCs.

[0086] In view of this, this application provides a cross-VPC access configuration method based on cloud computing technology, applied to a cloud management platform. The cloud management platform records the association between each VPC and the public VPC through an internal domain name group, thereby granting each VPC the permission to establish a cross-VPC connection channel with the public VPC. Since the association between the N VPCs and the public VPC can be managed through the created internal domain name group, it helps simplify the process of configuring associations and reduces the complexity of the configuration process. Based on the association between the first VPC and the public VPC, the cloud management platform creates a first cross-VPC connection channel between the first VPC and the public VPC according to the first cross-VPC connection channel creation request. This allows any virtual instance in the first VPC to access any cloud service in the public VPC or any cloud service connected to the public VPC through the first cross-VPC connection channel. Since each VPVC can access any cloud service through a single cross-VPC connection channel with the public VPC, this improves the ease of use and convenience of cross-VPC access to cloud services, thereby enhancing the tenant's user experience.

[0087] It should be noted that the various implementation methods of the above configuration method will be discussed later. Figure 3 The examples shown will be described in detail here, but will not be elaborated upon further.

[0088] Next, the system architecture involved in the technical solution provided by this application will be further described with reference to the accompanying drawings.

[0089] This application provides a cloud service system, which includes infrastructure and a cloud management platform for managing the infrastructure. The cloud management platform is used to implement the cross-VPC access configuration method based on cloud computing technology provided in this application. The infrastructure includes multiple cloud data centers, at least one of which contains one public VPC and N VPCs, where N is a positive integer greater than 1. The one public VPC and the N VPCs belong to a tenant's main account and / or sub-accounts associated with the main account.

[0090] In one example, one public VPC and N VPCs can be configured in different cloud data centers. In another example, one public VPC and N VPCs can be configured in the same cloud data center.

[0091] It should be noted that this application does not restrict the configuration of one public VPC or N VPCs; the above is merely an illustrative example. The following example illustrates this application by setting up one public VPC and N VPCs in different cloud data centers.

[0092] Example 1, Figure 1 This is one of the schematic diagrams of the system architecture of the cloud service system provided in this application. Figure 1 As shown, multiple cloud data centers can include Data Center 1 and Data Center 2, and N VPCs include VPC 1, ..., VPC N. A public VPC is located in Data Center 1, and VPC 1, ..., VPC N are located in Data Center 2. Each public VPC contains M cloud services, where M is a positive integer greater than 0. For example, the M cloud services include Cloud Service 1, ..., Cloud Service M.

[0093] For example, each of the M cloud services can be configured with an endpoint service. The endpoint services of the cloud services can be deployed in the same VPC as the cloud services. For example, endpoint service 1 of cloud service 1, ..., endpoint service M of cloud service M are also deployed in a public VPC.

[0094] It should be noted that this application does not restrict the deployment location relationship between terminal node services and cloud services; the above is merely an illustrative example.

[0095] Optionally, cloud services may include Elastic Compute Service (ECS), Elastic Load Balancer (ELB), etc.

[0096] It should be noted that this application does not limit the type of cloud service; the above is merely an illustrative example.

[0097] For example, N VPCs and a public VPC are deployed in the same Region. This helps improve the reliability of establishing connections between the N VPCs and the public VPC.

[0098] It should be noted that this application does not limit the number of VPCs and the deployment location of public VPCs; the above is merely an illustrative example.

[0099] For example, a public VPC can also deploy M endpoints for M cloud services. Virtual instances in N VPCs can access the endpoint services in VPC 0 through the endpoints in the public VPC, thereby enabling access to the cloud services in VPC 0. For instance, the public VPC can be used to deploy endpoint 1 for cloud service 1, ..., endpoint M for cloud service M.

[0100] It should be noted that this application does not restrict the type of virtual instances in the N VPCs. For example, they can be virtual machines, private cloud services, user services, etc.

[0101] For example, M cloud services are configured with M internal network domain names, and each of the M cloud services is configured with one internal network domain name. For instance, cloud service 1 is configured with internal network domain name 1, ..., cloud service M is configured with internal network domain name M.

[0102] For example, each internal domain name corresponds to a private IP address in a public VPC. Different internal domain names correspond to different private IP addresses in the public VPC. For instance, internal domain name 1 corresponds to private IP address 1 in the public VPC, ..., internal domain name M corresponds to private IP address M in the public VPC. Here, private IP address 1, ..., private IP address M are different private IP addresses.

[0103] For example, each cloud service's endpoint service can record the internal domain name of each cloud service. For instance, endpoint service 1 records the internal domain name 1 of cloud service 1, ..., and endpoint service M records the internal domain name of cloud service 1.

[0104] For example, in this application, the intranet domain name of the cloud service can be the intranet domain name of the cloud service's terminal node service / the intranet domain name of the cloud service's terminal node, or in other words, the intranet domain name of the cloud service's terminal node service / the intranet domain name of the cloud service's terminal node can be the intranet domain name of the cloud service. Furthermore, the private IP address corresponding to the intranet domain name of the cloud service can be the private IP address of the cloud service's terminal node service / the private IP address of the cloud service's terminal node, or in other words, the private IP address of the cloud service's terminal node service / the private IP address of the cloud service's terminal node can be the private IP address corresponding to the intranet domain name of the cloud service.

[0105] Optionally, a Private Domain Name System (PDNS) is also deployed on the infrastructure. The PDNS stores the private domain name resolution services for M cloud services. Each cloud service's PDNS records its internal domain name and the corresponding private IP address. For example, the PDNS service for cloud service 1 records cloud service 1's internal domain name 1 and the corresponding private IP address 1.

[0106] For example, a cloud management platform can provide private domain name resolution services for N VPCs through the private domain name resolution services of M cloud services stored in the private domain name system.

[0107] Optionally, the cloud management platform can communicate with the tenant's electronic devices. A console can be deployed on the tenant's electronic devices, allowing the tenant to communicate with the cloud management platform and enable the cloud management platform to execute the configuration methods provided in this application.

[0108] For example, electronic devices can be tablet computers, handheld computers, personal computers (PCs), personal digital assistants (PDAs), ultra-mobile personal computers (UMPCs), laptops, netbooks, desktop computers, or all-in-one computers, etc.

[0109] It should be noted that the embodiments of this application do not limit the type of electronic device; the above is merely an illustrative example.

[0110] Figure 2 The second schematic diagram of the system architecture of the cloud service system provided in this application.

[0111] For example, such as Figure 2As shown, VPC 0 is also deployed on data center 2. M cloud services are deployed on VPC 0. VPC 0 is connected to the public VPC, thus enabling the public VPC to connect to M cloud services. In addition, M cloud service endpoint services are also deployed on VPC 0, namely endpoint service 1, ..., endpoint service M.

[0112] For example, the public VPC and the N VPCs adopt a hub-and-spoke architecture. The public VPC can be considered the central node (hub) of the hub-and-spoke architecture, and the N VPCs can be considered branch nodes (spoke) of the hub-and-spoke architecture. Each of the N VPCs communicates with the public VPC through VPC peering.

[0113] It should be noted that this application does not restrict the deployment method of cloud services; the above is merely an illustrative example. For example, cloud services can also be deployed directly on infrastructure. The following example, using the deployment of cloud services in a public VPC, will be used to illustrate this application.

[0114] For example, VPC 0 (the VPC deploying cloud services), N VPCs, and a public VPC are deployed in the same Region. This helps improve the reliability of establishing connections between the N VPCs and the public VPC.

[0115] It should be noted that this application does not impose restrictions on the deployment location of VPC 0, N VPCs, and public VPCs; the above is merely an illustrative example.

[0116] It needs to be explained that, Figure 2 For further details regarding the system architecture shown, please refer to the above. Figure 1 The system architecture shown will not be elaborated here.

[0117] It should be noted that the above system architecture does not constitute a limitation on systems using the configuration methods provided in this application.

[0118] It should be noted that the system architecture and application scenarios described in this application are for the purpose of more clearly illustrating the technical solutions of this application, and do not constitute a limitation on the technical solutions provided in this application. As those skilled in the art will know, with the evolution of system architecture and the emergence of new application scenarios, the technical solutions provided in this application are also applicable to similar technical problems.

[0119] For ease of understanding, the configuration method provided in the embodiments of this application will be described exemplarily below with reference to the above system architecture and accompanying drawings.

[0120] Figure 3This is one of the flowcharts for a cross-VPC access configuration method based on cloud computing technology provided in this application. Exemplarily, the configuration method may include the following steps 301-304. The steps in this embodiment can be abbreviated as "S" and will not be described further thereafter.

[0121] For example, after a tenant creates N VPCs in data center 1, the cloud management platform can establish an association between each of the N VPCs through S301-S302, thereby granting each VPC the permission to establish a cross-VPC connection channel with the public VPC. Subsequently, the cloud management platform can establish a cross-VPC connection channel between each of the N VPCs and the public VPC through S303-S304, allowing virtual instances in each VPC to access any cloud service associated with the public VPC through the cross-VPC connection channel.

[0122] Among them, any cloud service associated with a public VPC includes any one of the M cloud services set in the public VPC or any one of the M cloud services connected to the public VPC.

[0123] S301: The cloud management platform receives a request from a tenant to create an intranet domain name group.

[0124] The internal domain name group creation request includes the identifiers of N VPCs and the identifier of the public VPC.

[0125] For example, after logging into the console on an electronic device, a tenant can enter the identifiers of N VPCs and the identifier of a public VPC on the first configuration interface provided by the console. The tenant then sends an internal domain name group creation request to the cloud management platform via the console, requesting the cloud management platform to create the internal domain name group. This request can include the identifiers of the N VPCs and the identifier of the public VPC. The cloud management platform can then receive the internal domain name group creation request entered by the tenant through the console.

[0126] For example, the intranet domain name group creation request may also include the name of the intranet domain name group. By setting the intranet domain name group creation request to include the name of the intranet domain name group, the tenant can specify the name of the intranet domain name group, which helps to improve the convenience of tenant management of intranet domain name groups and thus improves the tenant's user experience.

[0127] S302: The cloud management platform creates an intranet domain name group based on the intranet domain name group creation request.

[0128] The internal domain name group records the association between the identifiers of N VPCs and the identifiers of public VPCs, and the internal domain name group is set with an internal domain name group identifier.

[0129] For example, after receiving an intranet domain name group creation request, the cloud management platform creates an intranet domain name group based on the request, so that the intranet domain name group can be used to record the association between the identifiers of N VPCs and the identifiers of public VPCs. For example, the intranet domain name group can be used to record the association between VPC 1 and public VPCs, ..., the association between VPC N and public VPCs.

[0130] For example, after the cloud management platform creates an internal domain name group, it can set an identifier for the internal domain name group to obtain the internal domain name group identifier. This helps tenants add the necessary management relationships to a specified internal domain name group through the internal domain name group identifier, such as the relationship between a newly added VPC and a public VPC.

[0131] In the above embodiments, the cloud management platform creates an internal domain name group based on the tenant's request, and records the association between each VPC and the public VPC through the internal domain name group, thereby granting each VPC the permission to establish a cross-VPC connection channel with the public VPC. Since the association between N VPCs and the public VPC can be managed through the created internal domain name group, it helps to simplify the process of configuring associations and reduce the complexity of configuring associations.

[0132] S303: The cloud management platform receives the first cross-VPC connection channel creation request from a tenant or another tenant authorized by the tenant.

[0133] The first cross-VPC connection channel creation request includes the identifier of the first VPC among the N VPCs, the identifier of the public VPC, and the identifier of the internal domain name group.

[0134] For example, when a tenant or another tenant authorized by the tenant needs to establish a cross-VPC connection channel between a first VPC and a public VPC, they can enter the identifier of the first VPC, the identifier of the public VPC, and the internal domain name group identifier on the second configuration interface provided by the console on the electronic device, and send a first cross-VPC connection channel creation request to the cloud management platform to request the cloud management platform to establish a cross-VPC connection channel between the first VPC and the public VPC. The first cross-VPC connection channel creation request includes the identifier of the first VPC, the identifier of the public VPC, and the internal domain name group identifier entered by the tenant or other tenants on the second configuration interface provided by the console. The cloud management platform can receive the first cross-VPC connection channel creation request entered by the tenant or another tenant authorized by the tenant through the console.

[0135] S304: Based on the first cross-VPC connection channel creation request, the cloud management platform establishes a first cross-VPC connection channel between the first VPC and the public VPC, and allows virtual instances in the first VPC to access any one of the M cloud services set in the public VPC or any one of the M cloud services connected to the public VPC through the first cross-VPC connection channel.

[0136] For example, after receiving the first cross-VPC connection channel creation request, the cloud management platform determines whether the internal domain name group to which ...

[0137] If the result shows that the internal domain name group record to which the internal domain name group identifier belongs has an association relationship between the identifier of the first VPC and the identifier of the public VPC, it indicates that the first VPC has the authority to establish a cross-VPC connection channel with the public VPC. The cloud management platform establishes a first cross-VPC connection channel between the first VPC and the public VPC, and allows virtual instances in the first VPC to access any one of the M cloud services set in the public VPC or any one of the M cloud services connected to the public VPC through the first cross-VPC connection channel.

[0138] For example, establishing a first cross-VPC connection channel between the first VPC and the public VPC can be considered as building a cloud intranet / network between the first VPC and the public VPC, thereby enabling virtual instances in the first VPC to communicate with the public VPC through the cloud intranet / network.

[0139] Based on the above, such as Figure 4 As shown, the cloud management platform can establish cross-VPC connection channels between each VPC and the public VPC. For example, it can create cross-VPC connection channel 1 between VPC 1 and the public VPC, ..., and establish cross-VPC connection channel N between VPC N and the public VPC. This allows virtual instance 1 in VPC 1 to access any one of cloud services 1, ..., cloud service M through cross-VPC connection channel 1, ..., and virtual instance N in VPC N to access any one of cloud services 1, ..., cloud service M through cross-VPC connection channel N.

[0140] In the above embodiments, the cloud management platform creates a first cross-VPC connection channel between the first VPC and the public VPC based on the first cross-VPC connection channel creation request. This allows any virtual instance in the first VPC to access any cloud service in the public VPC or any cloud service connected to the public VPC through the first cross-VPC connection channel. Since each VPVC can access any cloud service through a single cross-VPC connection channel with the public VPC, this improves the ease of use and convenience of accessing cloud services across VPCs, thereby enhancing the user experience for tenants.

[0141] In this application, the cross-VPC access configuration method based on cloud computing technology may further include the following S1-S2. By executing the following S1-S2, the cloud management platform can grant each of the N VPCs the permission to use the private domain name resolution service.

[0142] In this application, M cloud services are configured with M intranet domain names. Each of the M cloud services is configured with an intranet domain name, and each intranet domain name corresponds to a private IP address of a public VPC. Different intranet domain names correspond to different private IP addresses of the public VPC.

[0143] S1: The cloud management platform receives the target request input by the tenant.

[0144] The target request includes the identifiers of N VPCs and the identifiers of M cloud services.

[0145] For example, before N VPCs access M cloud services, a tenant can enter the identifiers of the N VPCs and the identifiers of the M cloud services on a third configuration interface provided by the console on their electronic device, and send a target request to the cloud management platform to request the creation of a mapping between the identifiers of the N VPCs and the M private domain name resolution services. The target request includes the identifiers of the N VPCs and the identifiers of the M cloud services entered by the tenant on the third configuration interface provided by the console. The cloud management platform can receive the target request entered by the tenant through the console.

[0146] S2: In response to the target request, the cloud management platform creates a mapping relationship between N VPC identifiers and M private network domain name resolution services. The M private network domain name resolution services are used to record the mapping relationship between M intranet domain names and the corresponding private network IP addresses.

[0147] For example, after receiving a target request, the cloud management platform creates a private domain name resolution service for each of the M cloud services, based on the identifiers of the M cloud services included in the target request, thus obtaining M private domain name resolution services. These M private domain name resolution services record the mapping between the M internal network domain names and their corresponding private network IP addresses. Based on this, the cloud management platform establishes a mapping between the identifiers of the N VPCs and the M private domain name resolution services, based on the identifiers of the N VPCs included in the target request, thereby granting the N VPCs permission to use the M private domain name resolution services.

[0148] In the above embodiments, the cloud management platform creates a mapping relationship between N VPC identifiers and M private domain name resolution services based on the tenant's target request. This enables the N VPCs to have the permission to use the M private domain name resolution services, and thus allows the N VPCs to obtain the private IP addresses corresponding to the M intranet domain names through the M private domain name resolution services. In this way, only the specified N VPCs can access the cloud service, which helps to ensure the security and reliability of the cloud service.

[0149] Since the cloud management platform can establish a mapping relationship between the identifiers of N VPCs and the private domain name resolution services through target requests, it helps to simplify the process of configuring the mapping relationship between the identifiers of N VPCs and the private domain name resolution services, reduce the complexity of the mapping relationship configuration process, and improve the convenience of granting N VPCs the right to use the private domain name resolution services.

[0150] In this application, the cross-VPC access configuration method based on cloud computing technology may further include the following S3-S4. By executing S3-S4, the cloud management platform can provide internal domain name resolution services for the first cloud service to virtual instances in the first VPC.

[0151] For example, the M cloud services include a first cloud service, which can be any one of the M cloud services. The following description uses the first cloud service as an example to illustrate S3-S4.

[0152] S3: The cloud management platform receives the first domain name access request sent by the virtual instance in the first VPC.

[0153] The first domain name access request is used to request access to the intranet domain name of the first cloud service among the M cloud services in the public VPC. The first domain name access request includes the identifier of the first VPC.

[0154] For example, when a virtual instance in the first VPC accesses the first cloud service through the intranet domain name of the first cloud service, the virtual instance in the first VPC sends a first domain name access request to the cloud management platform to request access to the intranet domain name of the first cloud service among the M cloud services in the public VPC.

[0155] S4: In response to the first domain name access request, the cloud management platform returns the first private IP address to the virtual instance in the first VPC based on the mapping between the intranet domain name of the first cloud service and the first private IP address of the public VPC.

[0156] In this process, the virtual instance in the first VPC sends a network packet with the destination IP address of the first private network IP address to the public VPC through the first cross-VPC connection channel.

[0157] For example, after receiving a first domain name access request, the cloud management platform determines at least one private domain name resolution service corresponding to the first VPC identifier, based on the identifier of the first VPC included in the first domain name access request. Then, based on the internal domain name of the first cloud service, the cloud management platform determines the private domain name resolution service of the first cloud service from the at least one private domain name resolution service, wherein the private domain name resolution service of the first cloud service includes the mapping relationship between the internal domain name of the first cloud service and the first private IP address of the public VPC. Subsequently, the cloud management platform obtains the first private IP address corresponding to the internal domain name of the first cloud service through the resolution service provided by the private domain name resolution service of the first cloud service, and returns the first private IP address to the virtual instance in the first VPC.

[0158] For example, after a virtual instance in the first VPC receives the first private network IP address returned by the cloud management platform, it can send a network packet with the destination IP address of the first private network IP address to the public VPC through the first cross-VPC connection channel, thereby enabling the network packet to be sent to the first cloud service to which the first private network IP address belongs through the public VPC.

[0159] In the above embodiments, after receiving a domain name access request from a virtual instance of the first VPC, the cloud management platform determines whether the virtual instance of the first VPC has the authority to obtain the private IP address of the first cloud service based on the correspondence between the identifier of the first VPC and the first private network domain name resolution service. This helps prevent unauthorized VPCs from obtaining the private IP address of the first cloud service, thereby helping to ensure the security of the first cloud service. Furthermore, by providing the first private network IP address to virtual instances in authorized first VPCs, the cloud management platform enables pre-designated virtual instances in the first VPC to successfully access the first cloud service, thus helping to ensure the access rights of the designated virtual instances in the first VPC to the first cloud service.

[0160] In this application, the cross-VPC access configuration method based on cloud computing technology may further include the following S5-S6. By executing S5-S6, the cloud management platform can provide internal domain name resolution services for the second cloud service to virtual instances in the first VPC.

[0161] For example, the M cloud services include a second cloud service, which can be any one of the M cloud services other than the first cloud service. The following description uses the second cloud service as an example to illustrate S5-S6.

[0162] S5: The cloud management platform receives a second domain name access request sent by a virtual instance in the first VPC.

[0163] The second domain name access request is used to access the intranet domain name of the second cloud service among the M cloud services in the public VPC, and the first domain name access request includes the identifier of the first VPC.

[0164] S6: In response to the second domain name access request, the cloud management platform returns the second private IP address to the virtual instance in the first VPC based on the mapping between the intranet domain name of the second cloud service and the second private IP address of the public VPC.

[0165] In this process, the virtual instance in the first VPC sends a network packet with the destination IP address being the second private network IP address to the public VPC through the first cross-VPC connection channel.

[0166] It should be noted that the relevant explanations for S5-S6 can be found in the explanations for S3-S4 above, and will not be repeated here.

[0167] In the above embodiments, after receiving a domain name access request from a virtual instance in the first VPC, the cloud management platform determines whether the virtual instance in the first VPC has the authority to obtain the private IP address of the second cloud service based on the correspondence between the identifier of the first VPC and the second private network domain name resolution service. This helps prevent unauthorized VPCs from obtaining the private IP address of the second cloud service, thereby helping to ensure the security of the second cloud service. Furthermore, by providing the second private IP address to the virtual instance in the authorized first VPC, the cloud management platform enables the pre-designated virtual instance in the first VPC to successfully access the second cloud service, thus helping to ensure the access rights of the designated virtual instance in the first VPC to the second cloud service.

[0168] In this application, the cross-VPC access configuration method based on cloud computing technology may further include the following S7-S8 steps. The cloud management platform can establish a second cross-VPC connection channel between the second VPC and the public VPC by executing S7-S8. Here, the second VPC is any VPC other than the first VPC among N VPCs.

[0169] S7: The cloud management platform receives a second cross-VPC connection channel creation request from a tenant or another tenant authorized by the tenant.

[0170] The second cross-VPC connection channel creation request includes the identifier of the second VPC among the N VPCs, the identifier of the public VPC, and the identifier of the internal domain name group.

[0171] S8: Based on the second cross-VPC connection channel creation request, the cloud management platform establishes a second cross-VPC connection channel between the second VPC and the public VPC, and allows virtual instances in the second VPC to access any one of the M cloud services set in the public VPC or any one of the M cloud services connected to the public VPC through the second cross-VPC connection channel.

[0172] It should be noted that the relevant explanations for S7-S8 can be found in the explanations of S303-S304 above, and will not be repeated here.

[0173] In the above embodiments, the cloud management platform creates a second cross-VPC connection channel between the second VPC and the public VPC based on the second cross-VPC connection channel creation request. This allows any virtual instance in the second VPC to access any cloud service in the public VPC or any cloud service connected to the public VPC through the second cross-VPC connection channel. Since the second VPC can access any cloud service through a single cross-VPC connection channel with the public VPC, this improves the ease of use and convenience of accessing cloud services across VPCs, thereby enhancing the user experience for tenants.

[0174] In this application, the cross-VPC access configuration method based on cloud computing technology may further include the following S9-S10. By executing S9-S10, the cloud management platform can provide internal domain name resolution services for third cloud services to virtual instances in the second VPC.

[0175] For example, the M cloud services include a third cloud service. The third cloud service can be the same cloud service as the first cloud service / second cloud service, or it can be a different cloud service. This application does not impose any restrictions on this. The following describes S9-S10 using the third cloud service as an example.

[0176] S9: The cloud management platform receives access requests for third-domain names sent by virtual instances in the second VPC.

[0177] Among them, the third domain name access request is used to access the internal domain name of the third cloud service among the M cloud services in the public VPC.

[0178] S10: In response to the third domain name access request, the cloud management platform returns the third private IP address to the virtual instance in the second VPC based on the mapping relationship between the internal domain name of the third cloud service and the third private IP address of the public VPC.

[0179] In this case, the virtual instance in the second VPC sends a network packet with the destination IP address of the third private network IP address to the public VPC through the second cross-VPC connection channel.

[0180] It should be noted that the relevant explanations for S9-S10 can be found in the explanations for S3-S4 above, and will not be repeated here.

[0181] In the above embodiments, after receiving a domain name access request from a virtual instance in the second VPC, the cloud management platform can determine whether the virtual instance in the second VPC has the authority to obtain the private IP address of the third cloud service based on the correspondence between the identifier of the second VPC and the third private network domain name resolution service. This helps prevent unauthorized VPCs from obtaining the private IP address of the third cloud service, thereby helping to ensure the security of the third cloud service. Furthermore, by providing a third private network IP address to virtual instances in authorized second VPCs, the cloud management platform enables pre-specified virtual instances in the second VPC to successfully access the third cloud service, thus helping to ensure the access rights of the specified virtual instances in the second VPC to the third cloud service.

[0182] In this application, the cross-VPC access configuration method based on cloud computing technology may further include the following steps S11-S12. By executing S11-S12, the cloud management platform can provide the internal domain name resolution service of the fourth cloud service for virtual instances in the second VPC.

[0183] For example, the M cloud services include a fourth cloud service, which can be any cloud service among the M cloud services except for the third cloud service. The following description uses the fourth cloud service as an example to illustrate steps S11-S12.

[0184] S11: The cloud management platform receives a fourth domain name access request from a virtual instance in the second VPC.

[0185] The fourth domain name access request is used to access the internal domain name of the fourth cloud service among the M cloud services in the public VPC.

[0186] S12: In response to the fourth domain name access request, the cloud management platform returns the fourth private IP address to the virtual instance in the second VPC based on the mapping between the intranet domain name of the fourth cloud service and the fourth private IP address of the public VPC.

[0187] In this case, the virtual instance in the second VPC sends a network packet with the destination IP address of the fourth private network IP address to the public VPC through the second cross-VPC connection channel.

[0188] It should be noted that the relevant explanations for S11-S12 can be found in the explanations for S3-S4 above, and will not be repeated here.

[0189] In the above embodiments, after receiving a domain name access request from a virtual instance in the second VPC, the cloud management platform can determine whether the virtual instance in the second VPC has the authority to obtain the private IP address of the fourth cloud service based on the correspondence between the identifier of the second VPC and the fourth private network domain name resolution service. This helps prevent unauthorized VPCs from obtaining the private IP address of the fourth cloud service, thereby helping to ensure the security of the fourth cloud service. Furthermore, by providing the fourth private network IP address to virtual instances in authorized second VPCs, the cloud management platform enables pre-designated virtual instances in the second VPC to successfully access the fourth cloud service, thus helping to ensure the access rights of the designated virtual instances in the second VPC to the fourth cloud service.

[0190] In this application, the cross-VPC access configuration method based on cloud computing technology may further include the following steps S13-S16. Through steps S13-S16, the cloud management platform can grant the tenant's newly created VPC the permission to establish a cross-VPC connection channel with a public VPC.

[0191] S13: The cloud management platform receives the intranet domain name group association request input by the tenant.

[0192] The internal domain name group association request includes the internal domain name group identifier, the identifier of the newly added VPC, and the identifier of the public VPC.

[0193] For example, after a tenant creates a new VPC (hereinafter referred to as the new VPC) based on N existing VPCs, they need to establish an association between the new VPC and the public VPC to grant the new VPC permission to establish a cross-VPC connection channel with the public VPC. The tenant can enter the internal domain group identifier, the identifier of the new VPC, and the identifier of the public VPC on the fourth configuration interface provided in the console on their electronic device, and send an internal domain group association request to the cloud management platform. This request requests that the internal domain group identifier be associated with the identifier of the new VPC and the identifier of the public VPC through the internal domain group to which the internal domain group identifier belongs, thereby establishing an association between the new VPC and the public VPC.

[0194] S14: Based on the intranet domain name group association request, the cloud management platform records the association relationship between the identifier of the newly added VPC and the identifier of the public VPC in the intranet domain name group.

[0195] For example, after receiving an intranet domain name group association request, the cloud management platform, based on the intranet domain name group association request including the intranet domain name group identifier, the identifier of the newly added VPC, and the identifier of the public VPC, records the association relationship between the identifier of the newly added VPC and the identifier of the public VPC through the intranet domain name group to which the intranet domain name group identifier belongs.

[0196] It should be noted that other related explanations in S13-S14 can be found in the explanations in S301-S302 above, and will not be repeated here.

[0197] In the above embodiments, the cloud management platform can establish a relationship between the newly created VPC and the public VPC of the tenant based on the tenant's intranet domain name group association request. This not only helps to improve the convenience of the cloud management platform in managing the relationship, but also helps to improve the convenience of expanding the relationship.

[0198] S15: The cloud management platform receives a third cross-VPC connection channel creation request from a tenant or another tenant authorized by the tenant.

[0199] The third cross-VPC connection channel creation request includes the identifier of the newly added VPC, the identifier of the public VPC, and the identifier of the internal domain name group.

[0200] S16: Based on the request to create a third cross-VPC connection channel, the cloud management platform establishes a third cross-VPC connection channel between the newly added VPC and the public VPC, and allows virtual instances in the newly added VPC to access any one of the M cloud services in the public VPC or any one of the M cloud services connected to the public VPC through the third cross-VPC connection channel.

[0201] It should be noted that the relevant explanations for S15-S16 can be found in the explanations for S303-S304 above, and will not be repeated here.

[0202] In the above embodiments, the cloud management platform creates a third cross-VPC connection channel between the new VPC and the public VPC based on the third cross-VPC connection channel creation request. This allows any virtual instance in the new VPC to access any cloud service in the public VPC or any cloud service connected to the public VPC through the third cross-VPC connection channel. Since the new VPC can access any cloud service through a single cross-VPC connection channel with the public VPC, the ease of use and convenience of accessing cloud services across VPCs is improved, thereby enhancing the user experience for tenants.

[0203] In this application, the cross-VPC access configuration method based on cloud computing technology may further include the following steps S17-S18. Through S17-S18, the cloud management platform can establish a correspondence between the identifier of the newly added VPC and the private domain name resolution services of M cloud services.

[0204] S17: The cloud management platform receives a new target request from a tenant.

[0205] The new target requests include the identifiers for the new VPC and the identifiers for M cloud services.

[0206] S18: In response to the new target request, the cloud management platform creates the identifier of the new VPC and the mapping relationship of M private network domain name resolution services.

[0207] It should be noted that the explanations for S17-S18 can be found in the explanations for S1-S2 above, and will not be repeated here. For example, the explanation of adding a target request can be found in the explanation of the target request, and will not be repeated here.

[0208] In the above embodiments, the cloud management platform creates a mapping between the identifier of the new VPC and M private domain name resolution services based on the tenant's new target request. This grants the new VPC permission to use the M private domain name resolution services, allowing it to obtain the private IP addresses corresponding to the M intranet domain names. This enables the designated new VPC to access cloud services, thus helping to ensure the security and reliability of cloud services. Since the cloud management platform can establish the mapping between the identifier of the new VPC and the M private domain name resolution services based on the target request, it simplifies the configuration process, reduces the complexity of configuring the mapping, and improves the convenience of granting the new VPC permission to use the M private domain name resolution services.

[0209] In this application, the cross-VPC access configuration method based on cloud computing technology may further include the following steps S19-S20. By executing S19-S20, the cloud management platform can provide internal domain name resolution services for the fifth cloud service for virtual instances in newly added VPCs.

[0210] For example, the M cloud services include a fifth cloud service. The fifth cloud service may be the same cloud service as the first / second / third / fourth cloud service, or it may be a different cloud service; this application does not impose any restrictions on this. The following description uses the fifth cloud service as an example to illustrate S19-S20.

[0211] S19: The cloud management platform receives a fifth domain name access request from a virtual instance in the newly added VPC.

[0212] The fifth domain name access request is used to access the internal domain name of the fifth cloud service among the M cloud services in the public VPC.

[0213] S20: In response to the fifth domain name access request, the cloud management platform returns the fifth private network IP address to the virtual instance in the newly added VPC based on the mapping relationship between the internal network domain name of the fifth cloud service and the fifth private network IP address of the public VPC.

[0214] Among them, the virtual instances in the newly added VPC send network packets with the destination IP address of the fifth private network IP address to the public VPC through the third cross-VPC connection channel.

[0215] It should be noted that the relevant explanations for S19-S20 can be found in the explanations for S3-S4 above, and will not be repeated here.

[0216] In the above embodiments, after receiving a domain name access request from a virtual instance in a newly added VPC, the cloud management platform determines whether the virtual instance in the newly added VPC has the authority to obtain the private IP address of the fifth cloud service based on the correspondence between the identifier of the newly added VPC and the fifth private network domain name resolution service. This helps prevent unauthorized VPCs from obtaining the private IP address of the fifth cloud service, thereby helping to ensure the security of the fifth cloud service. Furthermore, by providing the fifth private network IP address to the virtual instance in the newly added VPC with the appropriate authority, the cloud management platform enables the pre-specified virtual instance in the newly added VPC to successfully access the fifth cloud service, thus helping to ensure the access rights of the specified virtual instance in the newly added VPC to the fifth cloud service.

[0217] In this application, the cross-VPC access configuration method based on cloud computing technology may further include the following steps S21-S22. By executing S21-S22, the cloud management platform can provide internal domain name resolution services for the sixth cloud service for virtual instances in newly added VPCs.

[0218] For example, the M cloud services also include a sixth cloud service, which is any cloud service other than the fifth cloud service among the M cloud services. The following description uses the sixth cloud service as an example to illustrate S21-S22.

[0219] S21: The cloud management platform receives a request for access to the sixth domain name from a virtual instance in the newly added VPC.

[0220] The sixth domain name access request is used to access the internal domain name of the sixth cloud service among the M cloud services in the public VPC.

[0221] S22: In response to the access request for the sixth domain name, the cloud management platform returns the sixth private IP address to the virtual instance in the newly added VPC based on the mapping between the internal domain name of the sixth cloud service and the sixth private IP address of the public VPC.

[0222] Among them, the virtual instances in the newly added VPC send network packets with the destination IP address of the sixth private network IP address to the public VPC through the third cross-VPC connection channel.

[0223] It should be noted that the relevant explanations for S21-S22 can be found in the explanations for S3-S4 above, and will not be repeated here.

[0224] In the above embodiments, after receiving a domain name access request from a virtual instance in a newly added VPC, the cloud management platform determines whether the virtual instance in the newly added VPC has the authority to obtain the private IP address of the sixth cloud service based on the correspondence between the identifier of the newly added VPC and the sixth private network domain name resolution service. This helps prevent unauthorized VPCs from obtaining the private IP address of the sixth cloud service, thereby helping to ensure the security of the sixth cloud service. Furthermore, by providing the sixth private network IP address to the virtual instances in the newly added VPC with the appropriate authority, the cloud management platform enables the pre-specified virtual instances in the newly added VPC to successfully access the sixth cloud service, thus helping to ensure the access rights of the specified virtual instances in the newly added VPC to the sixth cloud service.

[0225] The above embodiments detail a scheme for establishing cross-VPC connection channels between different VPCs. The following embodiments, through... Figures 6 to 8 Another solution provided in this application is described by way of example. This other solution is an implementation of S1-S2 above, used to establish a correspondence between the identifiers of N VPCs and the private domain name resolution services of M cloud services.

[0226] It should be noted that the following only describes the contents not described in the above embodiments, and the contents already described in the above embodiments will not be repeated.

[0227] As more and more tenants begin using VPCs to access cloud services, related technologies have proposed a configuration scheme for accessing cloud services. For example, such as... Figure 5As shown, the proposed configuration scheme involves creating a cloud service endpoint 'a' within the tenant's VPC A and a cloud service endpoint 'b' within the tenant's VPC B. Then, a private domain name resolution service 'a' is created for cloud service endpoint 'a', and a private domain name resolution service 'b' is created for cloud service endpoint 'b'. Both private domain name resolution services 'a' and 'b' are deployed within the DNS. Specifically, private domain name resolution service 'a' indicates the mapping between domain name 'a' and IP address 'a', and private domain name resolution service 'b' indicates the mapping between domain name 'b' and IP address 'b'.

[0228] Based on this, service 'a' within VPC Ca resolves the domain name of terminal node 'a' through private network DNS service 'a', obtaining the IP address 'a' of terminal node 'a'. Thus, IP address 'a' of terminal node 'a' accesses terminal node 'a', thereby enabling access to the cloud service to which terminal node 'a' belongs. Similarly, service 'b' within VPC b resolves the domain name of terminal node 'b' through private network DNS service 'b', obtaining the IP address 'b' of terminal node 'b'. Thus, IP address 'b' of terminal node 'b' accesses terminal node 'b', thereby enabling access to the cloud service to which terminal node 'b' belongs. Therefore, this configuration scheme not only has a cumbersome configuration process, increasing the complexity of the configuration, but also increases subsequent maintenance costs.

[0229] Figure 6 This is a second flowchart of a cross-VPC access configuration method based on cloud computing technology provided in this application. For example, this configuration method may include the following steps S601-S604.

[0230] For example, by executing the schemes shown in S601-S604, the cloud management platform establishes a correspondence between the identifiers of N VPCs and the private domain name resolution services of M cloud services. This not only helps to simplify the configuration process and reduce the complexity of the configuration process, but also helps to improve the ease of accessing cloud services and reduce subsequent maintenance costs.

[0231] In the configuration method provided in this application, the cloud management platform automatically creates a mapping relationship between the identifiers of N VPCs and the private domain name resolution services of M cloud services through the first and second mapping relationships managed by the relationship management object. This not only slows down the configuration process and reduces the complexity of the configuration process, but also helps to improve the convenience of establishing the mapping relationship between the identifiers of N VPCs and the private domain name resolution services of M cloud services, improves the ease of accessing cloud services, and reduces the cost of the subsequent mapping relationship between the identifiers of N VPCs and the private domain name resolution services of M cloud services.

[0232] It should be noted that this application does not limit the objects that manage the first and second correspondence relationships. The following example, using the internal network domain name group managing the first and second correspondence relationships in the above instance, will be used as an example to illustrate this application.

[0233] S601: The cloud management platform responds to the first creation request from the tenant and creates the target intranet domain name group. The first creation request is used to request the creation of the intranet domain name group.

[0234] In one example, the target domain group in S601 is the same as the domain group in S302. This helps simplify the complexity of the cloud management platform in executing the configuration method. For example, if the target domain group in S601 is the same as the domain group in S302, the first creation request can be a creation request for the intranet domain group in S301.

[0235] In another example, the target domain group in S601 is a different domain group than the domain group in S302. This helps the cloud management platform manage different correspondences / associations through different intranet domain groups, thereby improving the accuracy of relationship management.

[0236] In this application, the tenant sends a first creation request to the cloud management platform via a console on an electronic device to request the creation of an intranet domain name group. After receiving the first creation request from the tenant, the cloud management platform responds to the first creation request and creates the target intranet domain name group.

[0237] For example, a target intranet domain name group is an object used to manage relationships. The target intranet domain name group can be used to manage the relationships between M cloud service endpoints, the private domain name resolution services of M cloud services, and N VPCs. For instance, the target intranet domain name group can manage the relationships between the identifiers of the M cloud service endpoints, the identifiers of the M cloud service private domain name resolution services, and the identifiers of the N VPCs, thereby managing the relationships between the M cloud service endpoints, the M cloud service private domain name resolution services, and the N VPCs.

[0238] It should be noted that this application does not restrict the name of the intranet domain name group. For example, the intranet domain name group can also be called a DNS private domain name group (dns zone group), relationship management object, etc.

[0239] For example, the object structure of a target intranet domain name group created by the cloud management platform may include attributes such as the identifier (id) of the target intranet domain name group, the name of the target intranet domain name group, the description of the target intranet domain name group, the tags of the target intranet domain name group, the identifiers of the VPCs associated with the target intranet domain name group (vpc_ids), and the information of the endpoints associated with the target intranet domain name group. Specifically, the identifier (id) is a universally unique identifier (UUID). The name is a string. The description is a string. The tags are a list object. The identifiers of the VPCs associated with the target intranet domain name group (vpc_ids) are a list object. The information of the endpoints associated with the target intranet domain name group (dns_zones) is a list.

[0240] For example, the object structure of the target intranet domain name group also includes the object structure of the endpoints. The object structure of the endpoints is used to indicate the content of the endpoint information. For example, the object structure of the endpoints includes attributes such as the endpoint identifier (vpc_endpoint_id), the identifier of the endpoint's private domain name resolution service (dns_zone_id), and the name of the endpoint's private domain name resolution service (dns_zone_name). Among them, the attribute type of dns_zone_id is UUID, the attribute type of dns_zone_name is string, and the attribute type of vpc_endpoint_id is UUID.

[0241] For example, the first creation request may include the name of the internal domain name group to be created. For instance, the first creation request may include the name of the target internal domain name group. This allows tenants to specify the name of the internal domain name group to be created, thus facilitating tenant maintenance of the internal domain name group.

[0242] For example, the first creation request can be POST / dns-zone-groups, where “dns-zone-groups” is used to indicate the name of the intranet domain name group to be created.

[0243] It should be noted that the first creation request can be considered as an interface provided by the cloud management platform for requesting the creation of an intranet domain name group. Tenants call the first creation request through the console to instruct the cloud management platform to create an intranet domain name group.

[0244] S602: The cloud management platform establishes the first correspondence between the target intranet domain name group and N VPCs.

[0245] In this application, after the cloud management platform creates the target intranet domain name group, it can establish a primary correspondence between the target intranet domain name group and each of the N VPCs, thereby establishing an association between the target intranet domain name group and each VPC, and ultimately associating the target intranet domain name group with each VPC. For example, as shown... Figure 7 As shown in (a), the cloud management platform can establish the first correspondence between the target intranet domain name group and VPC 1, ..., the first correspondence between the target intranet domain name group and VPCN.

[0246] For example, the cloud management platform can establish a first correspondence between the identifier of the target intranet domain name group and the identifier of each VPC, thereby realizing the establishment of a first correspondence between the target intranet domain name group and each VPC.

[0247] Optionally, an internal domain name group can be associated with multiple VPCs. This allows multiple VPCs to be managed through a single internal domain name group, thereby improving the ease of VPC management.

[0248] Optionally, S602 includes multiple implementations, which are exemplified below using method 1 and method 2.

[0249] Method 1, S602 includes: The cloud management platform, in response to a first association request from a tenant, establishes a first mapping between a target intranet domain name group and N VPCs. The first association request indicates the N VPCs and the target intranet domain name group. For example, in Method 1, the target request includes the first association request.

[0250] Example 1a: After a tenant creates N VPCs on the infrastructure, they create a target internal domain name group on the infrastructure through the cloud management platform. Then, the tenant sends a first association request to the cloud management platform via the console. This first association request requests the establishment of an association between the internal domain name group and the N VPCs, indicating the target internal domain name group and the N VPCs. Upon receiving the first association request from the tenant, the cloud management platform responds by establishing the first mapping between the target internal domain name group and the N VPCs.

[0251] For example, the first association request is used to indicate the identifier of the target intranet domain name group. Based on the identifier of the target intranet domain name group, the cloud management platform determines the intranet domain name group to be associated as the target intranet domain name group. The first association request is used to indicate the identifiers of N VPCs. Based on the identifiers of the N VPCs, the cloud management platform determines the virtual private cloud to be associated as N VPCs.

[0252] For example, the first association request can be POST / dns-zone-groups / {dns_zone_group_id} / associate-vpc'vpc_id':“xx x”. Here, “dns_zone_group_id” indicates the identifier of the internal domain name group, “associate-vpc” indicates the operation of associating a VPC, and 'vpc_id':“xxx” indicates the identifier of the VPC to be associated.

[0253] It should be noted that the first association request can also be considered an interface provided by the cloud management platform for establishing association relationships. Tenants invoke the first association request through the console to instruct the cloud management platform to establish an association relationship between the internal domain name group and the VPC.

[0254] In Example 1b, after creating the target intranet domain name group, the tenant can create N VPCs on the infrastructure. The tenant can then send the first association request to the cloud management platform.

[0255] For further explanation of other relevant details in Example 1b, please refer to the explanation of Example 1a above, which will not be repeated here.

[0256] In this approach, tenants associate specified N VPCs and intranet domain name groups through a single association request. This not only helps to improve the flexibility of associating VPCs and intranet domain name groups, but also helps to increase the diversity of ways to associate VPCs and intranet domain name groups.

[0257] Method 2, S602 includes: the cloud management platform instructs N VPCs based on the first creation request, and establishes a first mapping relationship between the target intranet domain name group and the N VPCs. For example, in Method 2, the target request includes the first creation request.

[0258] For example, after a tenant creates N VPCs on the infrastructure, they send a first creation request to the cloud management platform via the console to request the creation of an internal domain name group. The first creation request also specifies the N VPCs. After the cloud management platform creates the target internal domain name group, it establishes a first mapping between the target internal domain name group and each of the N VPCs, based on the N VPCs specified in the first creation request. For example, the first creation request may include the identifiers of the N VPCs.

[0259] It should be noted that other relevant explanations for Method 2 can be found in the explanations for Method 1 above, and will not be repeated here.

[0260] In this approach, the tenant specifies the VPC to be associated with the internal domain name group through the creation request of the internal domain name group. This allows the creation and association operations to be completed simultaneously with a single request, which simplifies the process of associating internal domain name groups and VPCs. This not only improves the efficiency of associating internal domain name groups and VPCs but also simplifies the tenant's operations and enhances the tenant's user experience.

[0261] S603: The cloud management platform establishes a second correspondence between the target intranet domain name group and M terminal nodes.

[0262] In this application, after the cloud management platform creates the target intranet domain name group, it can establish a second correspondence between the target intranet domain name group and each of the M terminal nodes, thereby establishing an association between the target intranet domain name group and each terminal node, and thus associating the target intranet domain name group with each terminal node. For example, the cloud management platform can establish a second correspondence between the identifier of the target intranet domain name group and the identifier of each terminal node to achieve this second correspondence.

[0263] For example, such as Figure 7 As shown in (b), the cloud management platform can establish a second correspondence between the target intranet domain name group and terminal node 1, ..., and a second correspondence between the target intranet domain name group and terminal node M.

[0264] Optionally, a terminal node can establish a correspondence with only one internal domain name group. That is, a terminal node is associated with only one internal domain name group. This helps avoid redundant management of the terminal node's private domain name resolution service, thereby simplifying the configuration process.

[0265] Optionally, different terminal nodes can manage the same intranet domain name group.

[0266] In this embodiment, different terminal nodes can manage the same intranet domain name group. This allows multiple terminal nodes to manage their private domain name resolution services through a single intranet domain name group, thereby improving the convenience of managing the private domain name resolution services of terminal nodes.

[0267] Optionally, when different intranet domain name groups are associated with the same endpoint, different intranet domain name groups cannot be associated with the same Virtual Private Cloud (VPC). This helps avoid repeatedly establishing correspondences for the same endpoint and VPC, thereby simplifying the configuration process.

[0268] Optionally, S603 includes multiple implementations, of which S603 and S604 are described below as examples.

[0269] Hereinafter, Method 3 will be described by way of example via S603a to S603c. For example, in Method 3, the target request includes a second creation request.

[0270] For example, the M cloud services include the target cloud service, and the M terminal node services include the terminal node services of the target cloud service (hereinafter referred to as the target terminal node service). The following description uses the target terminal node service as an example to illustrate this application.

[0271] S603a: The cloud management platform receives a second creation request from the tenant.

[0272] The second creation request is used to request the creation of a terminal node. The second creation request also indicates the target intranet domain name group and the target terminal node service. For example, the second creation request can be used to indicate the identifier of the target intranet domain name group, thereby indicating the target intranet domain name group. The second creation request may include the identifier of the target terminal node service / the identifier of the target cloud service, thereby indicating the target terminal node service.

[0273] For example, after a tenant creates a target intranet domain name group, they can send a second creation request to the cloud management platform via the console. This second creation request is used to request the creation of an endpoint. The cloud management platform can receive the second creation request from the tenant.

[0274] S603b: In response to the second creation request, the cloud management platform creates the target endpoint within the public VPC based on the target endpoint service.

[0275] For example, after receiving the second creation request, the cloud management platform creates a target endpoint within a public VPC based on the target endpoint service indicated in the second creation request. Since the target endpoint is created based on a target endpoint service, it can be used to access the cloud services to which the target endpoint service belongs. For instance, the cloud management platform creates a target endpoint for accessing the target endpoint service based on the identifier of the target endpoint service indicated in the second creation request.

[0276] For example, the second creation request can also be used to identify a public VPC. The cloud management platform, based on the identifier of the public VPC indicated by the second creation request, creates the target endpoint within the public VPC, rather than creating the target endpoint within another VPC.

[0277] The following is an example of how to determine the IP address of the target terminal node (i.e., the IP address of the target cloud service / the IP address of the target terminal node service).

[0278] Example A: The second creation request can be used to indicate the first IP address. The cloud management platform can use the first IP address as the IP address of the target endpoint. For example, a public VPC includes at least one subnet, and the at least one subnet includes a first subnet, which can be any one of the at least one subnets. For instance, the first IP address can be the IP address of the first subnet.

[0279] For example, the second creation request can be used to indicate the identifier of the first subnet. Based on the identifier of the first subnet, the cloud management platform obtains the IP address range of the first subnet from the infrastructure's storage space and determines whether the first IP address belongs to the IP address range of the first subnet. If the first IP address belongs to the IP address range of the first subnet, the cloud management platform uses the first IP address as the IP address of the target terminal node. This helps ensure the accuracy of the IP address of the target terminal node.

[0280] In this example, the IP address of the target endpoint can be specified by the tenant, which helps the tenant manage the endpoint more easily.

[0281] In Example B, the second creation request can be used to indicate the identifier of the first subnet. Based on the identifier of the first subnet, the cloud management platform obtains a range of IP addresses for the first subnet from the infrastructure's storage space. Then, the cloud management platform selects an IP address from the range of IP addresses for the first subnet (e.g., selects the first IP address) as the IP address of the target terminal node.

[0282] For further explanation of Example B, please refer to the explanation of Example A above, which will not be repeated here.

[0283] In this example, the IP address of the target terminal node can be determined by the cloud management platform, which helps to increase the diversity of ways to determine the IP address.

[0284] It should be noted that this application does not restrict the method of determining the IP address of the target terminal node; the above is merely an illustrative example.

[0285] S603c: The cloud management platform establishes a second correspondence between the target terminal node and the target intranet domain name group based on the second creation request.

[0286] For example, after the cloud management platform creates the target terminal node, it establishes a second correspondence between the target terminal node and the target intranet domain name group based on the identifier of the target intranet domain name group indicated by the second creation request, thereby establishing an association between the target terminal node and the target intranet domain name group, and then associating the target terminal node and the target intranet domain name group.

[0287] For example, the cloud management platform can establish a second correspondence between the target terminal node and the target intranet domain name group by establishing a second correspondence between the identifier of the target terminal node and the identifier of the target intranet domain name group. The identifier of the target terminal node can be determined by the cloud management platform.

[0288] In this approach, by specifying an internal network domain name group in the terminal node creation request, the cloud management platform automatically associates the terminal node with the specified internal network domain name group after creation. This allows the cloud management platform to automatically associate the private network domain name resolution service corresponding to the terminal node with the target internal network domain name group. Thus, each time a tenant creates a new terminal node, the private network domain name resolution service corresponding to the terminal node is automatically associated with the target internal network domain name group, thereby improving the convenience of associating the private network domain name resolution service with the internal network domain name group.

[0289] Optionally, the cross-VPC access configuration method based on cloud computing technology also includes the following S1. Through the following S1, the cloud management platform can create a private domain name resolution service for the target endpoint. Here, the private domain name resolution service for the target endpoint is either the private domain name resolution service of the target endpoint service or the private domain name resolution service of the target cloud service.

[0290] S1: The cloud management platform calls the private domain name system (DNS) creation interface to create a private domain name resolution service for the target terminal node based on the target terminal node's domain name and IP address.

[0291] The private domain name resolution service of the target terminal node is used to provide the IP address for mapping the domain name of the target terminal node. The IP address mapped to the domain name of the target terminal node is the IP address of the target terminal node.

[0292] For example, the cloud management platform obtains the domain name of the target terminal node (i.e., the domain name corresponding to the target terminal node service) from the target terminal node service based on the identifier of the target terminal node service / identifier of the target cloud service indicated by the second creation request. Then, the cloud management platform calls the creation interface of the private domain name system (DNS) to create a private domain name resolution service for the target terminal node within the DNS based on the domain name and IP address of the target terminal node. This achieves the creation of a private domain name resolution service for the target terminal node within the private domain name system, which includes the mapping relationship between the domain name and IP address of the target terminal node.

[0293] For example, the cloud management platform sends a fourth creation request to the private domain name system by calling its creation interface. This fourth creation request instructs the creation of a private domain name resolution service for the target terminal node. Upon receiving the fourth creation request, the private domain name system responds by creating the private domain name resolution service for the target terminal node.

[0294] In this embodiment, by calling the creation interface of the private domain name system (DNS), a private domain name resolution service for the target terminal node is created for the private domain name system. This allows the private domain name system to directly obtain the private domain name resolution service created by the cloud management platform, which helps to improve the convenience of the private domain name system in obtaining the private domain name resolution service.

[0295] Hereinafter, method 4 will be described by way of example via S603d. For example, in method 4, the target request includes a second associated request.

[0296] S603d: In response to a second association request from a tenant, the cloud management platform establishes a second correspondence between the target intranet domain name group and M terminal nodes, wherein the second association request is used to indicate the target intranet domain name group and M terminal nodes.

[0297] For example, after a tenant creates a target intranet domain name group, they can send a second association request to the cloud management platform via the console. Upon receiving the second association request, the cloud management platform establishes a second correspondence between the identifier of the target intranet domain name group and the identifiers of the M terminal nodes, based on the identifier of the target intranet domain name group indicated in the second association request and the identifiers of each of the M terminal nodes. This establishes an association between the target intranet domain name group and each terminal node, thereby associating the target intranet domain name group with each terminal node.

[0298] In this approach, a private domain name resolution service is associated with the target intranet domain name group through a separate association request. This helps to improve the convenience of adding associated private domain name resolution services to the target intranet domain name group, thereby improving the user experience.

[0299] It should be noted that this application does not restrict the execution order of S602 and S603; the above is merely an illustrative example.

[0300] In another example, the cloud management platform could also execute S603 first, followed by S602. For example, as... Figure 8 As shown in (a), the cloud management platform first establishes a second correspondence between the target intranet domain name group and terminal node 1, ..., and a second correspondence between the target intranet domain name group and terminal node M. Then, as... Figure 8As shown in (b), the cloud management platform establishes the first correspondence between the target intranet domain name group and VPC 1, ..., the first correspondence between the target intranet domain name group and VPC N.

[0301] Optionally, cross-VPC access configuration methods based on cloud computing technology also include S2-S4. Through S2-S4, the cloud management platform provides another way to create endpoints.

[0302] For example, a first cloud service and a first terminal node service of the first cloud service are deployed on the infrastructure. The following description uses the first terminal node service as an example to illustrate this application.

[0303] S2: The cloud management platform receives a third creation request from the tenant. This third creation request is used to request the creation of an endpoint node, and it also instructs the first endpoint node to provide services.

[0304] For example, a tenant sends a third-party creation request to the cloud management platform via the console to request the creation of an end node. The cloud management platform receives the third-party creation request from the tenant.

[0305] S3: The cloud management platform responds to the third creation request and creates the first terminal node based on the first terminal node service.

[0306] For example, after receiving a third creation request from a tenant, the cloud management platform creates a first terminal node according to the first terminal node service indicated by the third creation request, so that the first terminal node can be used to access the first cloud service corresponding to the first terminal node service.

[0307] S4: The cloud management platform creates the first intranet domain name group and establishes the correspondence between the first intranet domain name group and the first terminal node.

[0308] For example, since the third creation request does not indicate an intranet domain name group, the cloud management platform can automatically create an intranet domain name group (e.g., first relationship management) and establish a correspondence between the first intranet domain name group and the first terminal node, thereby establishing an association between the first intranet domain name group and the first terminal node, and thus associating the first intranet domain name group with the first terminal node.

[0309] It should be noted that other related explanations for S2-S4 can be found in the explanations of S603a-S603c above, and will not be repeated here.

[0310] In this embodiment, when a tenant creates a terminal node, if the tenant does not specify the internal network domain name group associated with the terminal node in the creation request, the cloud management platform automatically creates a first internal network domain name group and associates the first internal network domain name group with the newly created terminal node. This not only helps improve the uniformity of terminal node management, but also eliminates the need to re-associate the internal network domain name group when a newly created terminal node needs to be associated with it later, thus improving the convenience of subsequent terminal node associations.

[0311] S604: The cloud management platform establishes a correspondence between the private domain name resolution services of N VPCs and M terminal nodes based on the first and second correspondence relationships.

[0312] The private domain name resolution service for the M terminal nodes is equivalent to the private domain name resolution service for the M cloud services. This service records the mapping between the M internal network domain names and their corresponding private IP addresses. It provides the IP addresses mapped to the domain names of the M terminal nodes for the N VPCs.

[0313] For example, the domain name of an endpoint can be its private domain name / private domain name. The IP address mapped to the domain name of an endpoint can be its private IP address / private IP address.

[0314] For example, by establishing a mapping between the target terminal node's private domain name resolution service and N VPCs, the target terminal node's private domain name resolution service can be used to provide internal domain name resolution services for virtual instances in each of the N VPCs. That is, the target terminal node's private domain name resolution service can provide each virtual instance in a VPC with the IP address mapped to the target terminal node's domain name (i.e., the target terminal node's IP address), allowing each virtual instance in a VPC to obtain the target terminal node's IP address through its internal domain name.

[0315] For example, the network between N VPCs and the public VPC, and the network between virtual instances within N VPCs and end nodes within the public VPC, can also be a cloud intranet / network. In other words, by establishing a mapping between the private domain name resolution services of M cloud services and the N VPCs, it is also possible to construct a cloud intranet / network between the N VPCs and the public VPC, thereby enabling virtual instances within each VPC to access end nodes within the public VPC through the cloud intranet / network.

[0316] In this application, when a target intranet domain name group is simultaneously associated with VPCs and endpoints, the cloud management platform automatically establishes a correspondence between the private domain name resolution services of the M endpoints associated with the target intranet domain name group and the N VPCs associated with the target intranet domain name group. This establishes the association between the private domain name resolution services of the M endpoints and the N VPCs, thereby associating the private domain name resolution service of each endpoint among the M endpoints with each VPC among the N VPCs.

[0317] For example, such as Figure 7 (c) and Figure 8 As shown in (c), the cloud management platform associates VPC 1 with the private domain name resolution service 1 of terminal node 1, ..., the private domain name resolution service M of terminal node M, ..., and associates VPC N with the private domain name resolution service 1 of terminal node 1, ..., the private domain name resolution service M of terminal node M. Private domain name resolution service 1 is used to indicate the correspondence between the internal domain name 1 of cloud service 1 and the private IP address 1 of cloud service 1. For explanations of private domain name resolution services 2, ..., and M, please refer to the explanation of private domain name resolution service 1, which will not be repeated here.

[0318] For example, when a tenant deploys N VPCs and M cloud services, the solution provided in this application requires only M configuration operations. For instance, the M configuration operations may include creating endpoints for the M cloud services. Compared to establishing associations between each VPC and the private domain name resolution services of the M cloud services separately, this reduces the number of operations by N*MM, where N*M indicates the number of configuration steps required to establish associations between each VPC and the private domain name resolution services of the M cloud services. Therefore, the solution provided in this application significantly reduces the number of configuration steps, lowers the complexity of the configuration process, and improves configuration efficiency.

[0319] Optionally, S604 includes: the cloud management platform calling the interface of the private domain name system, and establishing a correspondence between the private domain name resolution service of M terminal nodes and N VPCs based on the first correspondence and the second correspondence.

[0320] For example, the cloud management platform establishes a mapping between M terminal nodes' private domain name resolution services and N VPCs within the private domain name system by calling its interface. This achieves the goal of establishing this mapping for the private domain name system. For instance, the cloud management platform sends a fifth creation request to the private domain name system by calling its interface. This fifth creation request requests the creation of the mapping between the M terminal nodes' private domain name resolution services and the N VPCs. Upon receiving the fifth creation request, the private domain name system responds by establishing the mapping between the M terminal nodes' private domain name resolution services and the N VPCs. Figure 7 As shown in (c), the private domain name system includes the correspondence between VPC 1 and private domain name resolution service 1, ..., and the correspondence between VPC N and private domain name resolution service 1. For explanations of private domain name resolution services 2, ..., and M, please refer to the explanation of private domain name resolution service 1; further details will not be provided here.

[0321] In the above embodiments, by establishing a mapping relationship between the private domain name resolution services of each VPC and the endpoint, the private domain name resolution services of each VPC and the endpoint are associated, enabling the private domain name resolution services of the endpoint to provide the IP address of the endpoint's domain name mapping to each VPC of the tenant. In this way, each VPC of the tenant can access the endpoint within the public VPC through the IP address of the endpoint, thereby enabling access to the cloud services corresponding to the endpoint services through the endpoint within the public VPC. Furthermore, by associating the private domain name resolution services of each VPC and each endpoint with the target internal domain name group, the association between the private domain name resolution services of each VPC and each endpoint is automatically achieved. This helps reduce the number of times the mapping relationship needs to be configured, especially when the number of VPCs or endpoints is large, significantly reducing the number of configurations. This helps reduce the complexity of the configuration process, improves configuration efficiency and ease of use, and makes the networking configuration scheme between N VPCs and the public VPC simpler and easier to use.

[0322] In addition, since all endpoints used to access cloud services are placed in a public VPC, each VPC that needs to access cloud services accesses them through endpoints within the public VPC. This eliminates the need to create endpoints for each VPC separately, thereby reducing the number of endpoints that need to be created. This not only helps to simplify the configuration process and reduce its complexity, but also helps to reduce subsequent maintenance costs and improve the user experience for tenants.

[0323] For example, the N VPCs include a target VPC, which can be any one of the N VPCs. The following description uses the target VPC as an example to illustrate this application.

[0324] For example, when a virtual instance within a target VPC accesses a target cloud service via a target internal domain name, it sends a target domain name access request to the cloud management platform. This request includes the identifier of the target VPC. Upon receiving the request, the cloud management platform uses the Private Domain Name System (PDNS) to determine the target private domain name resolution service corresponding to the target VPC's identifier. This service includes the target internal domain name and its corresponding private IP address. Then, the cloud management platform obtains the target private IP address from the PDNS and sends it to the virtual instance within the target VPC.

[0325] Virtual instances within the target VPC obtain the target private network IP address and send target packets to the public VPC via a cross-VPC connection channel between the target VPC and the public VPC. The destination address of the target packets is the target private network IP address. Upon receiving the target packets, the target endpoints of the target cloud service in the public VPC forward them to the target endpoint service of the target cloud service. The target endpoint service, upon receiving the target packets, forwards them to the target cloud service. The target private network domain name resolution service is a private network domain name resolution service between the target cloud service and the target endpoint / target endpoint service.

[0326] Optionally, the cross-VPC access configuration method based on cloud computing technology may also include the following S5-S6. Through S5-S6, the cloud management platform can remove the association between a specified VPC and the private network domain name resolution service.

[0327] S5: In response to a disassociation request from a tenant, the cloud management platform deletes the first mapping between the target intranet domain name group and the target VPC. The disassociation request specifies the target intranet domain name group and the target VPC.

[0328] For example, a tenant can send a disassociation request to the cloud management platform via the console to request the deletion of the mapping between a target intranet domain name group and a target VPC. Upon receiving the disassociation request, the cloud management platform, in response to the identifier of the target intranet domain name group and the identifier of the target VPC indicated in the disassociation request, deletes the mapping between the identifier of the target intranet domain name group and the identifier of the target VPC, thereby deleting the mapping between the target intranet domain name group and the target VPC.

[0329] For example, a disassociation request could be POST / dns-zone-groups / {dns_zone_group_id} / disassociate-vpc{'vpc_id':“xxx”}. Here, “dns_zone_group_id” indicates the identifier of the internal domain group, “disassociate-vpc” indicates the operation to disassociate the VPC, and 'vpc_id':“xxx” indicates the identifier of the VPC to be disassociated.

[0330] S6: The cloud management platform deletes the mapping relationship between the target VPC and the private domain name resolution service of at least one end node.

[0331] For example, after the cloud management platform deletes the first correspondence between the target intranet domain name group and the target VPC, it deletes the correspondence between the target VPC and the private domain name resolution service of at least one end node.

[0332] In this embodiment, by setting the tenant to instruct the cloud management platform to remove the correspondence between the private domain name resolution service of the specified virtual private cloud and the terminal node through a disassociation request, the permission for the specified virtual private cloud service can be cancelled.

[0333] Optionally, S6 includes: the cloud management platform calling the deletion interface of the private domain name system to delete the correspondence between the target VPC and the private domain name resolution service of at least one terminal node.

[0334] For example, the cloud management platform schedules the deletion interface of the private domain name system to delete the mapping relationship between the target VPC and the private domain name resolution service of at least one end node. For instance, it deletes the mapping relationship between the target VPC within the private domain name system and the private domain name resolution service of at least one end node.

[0335] Optionally, the configuration method for accessing cloud services based on a virtual private cloud may also include the following S7-S8.

[0336] S7: The cloud management platform receives the first query request from the tenant. The first query request is used to request a query for the target intranet domain name group.

[0337] For example, when a tenant needs to query a specific intranet domain name group, they can send a first query request to the cloud management platform through the console to retrieve relevant information about the specified intranet domain name group. The cloud management platform can receive the first query request sent from the console.

[0338] For example, the first query request could be GET / dns-zone-groups / {dns_zone_group_id}. Here, "dns_zone_group_id" indicates the identifier of the internal domain name group to be queried.

[0339] S8: The cloud management platform responds to the first query request and returns information about the target intranet domain name group.

[0340] For example, after receiving the first query request, the cloud management platform responds to the first query request by returning information about the target intranet domain name group indicated by the first query request.

[0341] For example, the information of the target intranet domain name group may include the identifier, name, description, tags, identifier of the managed virtual private cloud, and information of the associated terminal nodes of the target intranet domain name group.

[0342] In this embodiment, by enabling tenants to query detailed information of a specified intranet domain name group through a first query request, tenants can better understand the details of the created intranet domain name group, thereby improving the user experience.

[0343] Optionally, the configuration method for accessing cloud services based on a virtual private cloud also includes the following S9-S10.

[0344] S9: The cloud management platform receives a second query request from the tenant. The second query request is used to request a query for the intranet domain name group.

[0345] For example, if a tenant needs to query all created intranet domain name groups, they can send a second query request to the cloud management platform through the console to request a query for currently existing intranet domain name groups. The cloud management platform can receive the second query request sent from the console.

[0346] For example, the second query request could be GET / dns-zone-groups.

[0347] S10: The cloud management platform responds to the second query request and returns object information.

[0348] The object information is used to indicate at least one intranet domain name group.

[0349] For example, after receiving the second query request, the cloud management platform responds by returning object information to the console. This object information can be used to indicate at least one internal network domain name group that has been created. For instance, the object information may include the identifier, name, description, and tags of each internal network domain name group.

[0350] In this embodiment, by configuring tenants to query the already created intranet domain name groups through a second query request, tenants can understand the status of the intranet domain name groups they have created, thereby improving the user experience.

[0351] The foregoing mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, the cloud management platform includes the corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, based on the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0352] This application embodiment can, according to the above method, exemplarily divide a cloud management platform into functional modules. For example, the cloud management platform may include various functional modules corresponding to each functional division, or two or more functions may be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division; in actual implementation, there may be other division methods.

[0353] For example, Figure 9 This diagram illustrates a possible schematic of the cloud management platform (i.e., cloud management platform 900) involved in the above embodiments. The actions performed by the cloud management platform 900 can be executed by a computing device or by executing corresponding software on a computing device. The cloud management platform 900 may include a receiving module 901 and a creating module 902. The receiving module 901 is used to receive an intranet domain name group creation request input by a tenant. The intranet domain name group creation request includes the identifiers of N VPCs and the identifier of a public VPC. For example, such as... Figure 3 As shown in S301, module 902 is used to create an internal network domain name group based on an internal network domain name group creation request. The internal network domain name group records the association between the identifiers of N VPCs and the identifiers of public VPCs, and the internal network domain name group is configured with an internal network domain name group identifier. For example, as... Figure 3 As shown in S302, the receiving module 901 is further configured to receive a first cross-VPC connection channel creation request input by a tenant or another tenant authorized by the tenant. The first cross-VPC connection channel creation request includes the identifier of the first VPC among N VPCs, the identifier of the public VPC, and the identifier of the internal network domain name group. For example, as... Figure 3As shown in S303. Creation module 902 is further configured to establish a first cross-VPC connection channel between the first VPC and the public VPC based on the first cross-VPC connection channel creation request, and allow virtual instances in the first VPC to access any one of the M cloud services configured in the public VPC or any one of the M cloud services connected to the public VPC through the first cross-VPC connection channel. For example, as... Figure 3 S304 is shown.

[0354] Optionally, the M cloud services are configured with M intranet domain names, wherein each of the M cloud services is configured with one intranet domain name, and each intranet domain name corresponds to a private IP address of a public VPC, with different intranet domain names corresponding to different private IP addresses of public VPCs; the receiving module 901 is further configured to: receive a target request input by a tenant, wherein the target request includes the identifiers of N VPCs and the identifiers of M cloud services; the cloud management platform also includes a management module 903, which is further configured to: in response to the target request, create a mapping relationship between the identifiers of N VPCs and the M private domain name resolution services, wherein the M private domain name resolution services are used to record the mapping relationship between the M intranet domain names and the private IP addresses corresponding to the M intranet domain names.

[0355] Optionally, the receiving module 901 is further configured to: receive a first domain name access request sent by a virtual instance in the first VPC, wherein the first domain name access request is used to request access to the intranet domain name of the first cloud service among the M cloud services in the public VPC, and the first domain name access request includes the identifier of the first VPC; the management module 903 is further configured to: respond to the first domain name access request, and return the first private network IP address to the virtual instance in the first VPC according to the correspondence between the intranet domain name of the first cloud service and the first private network IP address of the public VPC, wherein the virtual instance in the first VPC sends a network packet with the destination IP address as the first private network IP address to the public VPC through the first cross-VPC connection channel.

[0356] Optionally, the receiving module 901 is further configured to: receive a second domain name access request sent by a virtual instance in the first VPC, wherein the second domain name access request is used to access the intranet domain name of the second cloud service among the M cloud services in the public VPC, and the second domain name access request includes the identifier of the first VPC; the management module 903 is further configured to: respond to the second domain name access request, return the second private network IP address to the virtual instance in the first VPC according to the correspondence between the intranet domain name of the second cloud service and the second private network IP address of the public VPC, wherein the virtual instance in the first VPC sends a network packet with the destination IP address as the second private network IP address to the public VPC through the first cross-VPC connection channel.

[0357] Optionally, the receiving module 901 is further configured to: receive a second cross-VPC connection channel creation request input by a tenant or another tenant authorized by the tenant, the second cross-VPC connection channel creation request including the identifier of the second VPC among N VPCs, the identifier of the public VPC, and the identifier of the intranet domain name group; the creation module 902 is further configured to: establish a second cross-VPC connection channel between the second VPC and the public VPC according to the second cross-VPC connection channel creation request, and allow virtual instances in the second VPC to access any one of the M cloud services set in the public VPC or any one of the M cloud services connected to the public VPC through the second cross-VPC connection channel.

[0358] Optionally, the receiving module 901 is further configured to: receive a third domain name access request sent by a virtual instance in the second VPC, wherein the third domain name access request is used to access the intranet domain name of the third cloud service among the M cloud services in the public VPC, and the third domain name access request includes the identifier of the second VPC; the management module 903 is further configured to: respond to the third domain name access request, and return the third private network IP address to the virtual instance in the second VPC according to the correspondence between the intranet domain name of the third cloud service and the third private network IP address of the public VPC, wherein the virtual instance in the second VPC sends a network packet with the destination IP address as the third private network IP address to the public VPC through the second cross-VPC connection channel.

[0359] Optionally, the receiving module 901 is further configured to: receive a fourth domain name access request sent by a virtual instance in the second VPC, wherein the fourth domain name access request is used to access the intranet domain name of the fourth cloud service among the M cloud services in the public VPC, and the fourth domain name access request includes the identifier of the second VPC; the management module 903 is further configured to: respond to the fourth domain name access request, and return the fourth private network IP address to the virtual instance in the second VPC according to the correspondence between the intranet domain name of the fourth cloud service and the fourth private network IP address of the public VPC, wherein the virtual instance in the second VPC sends a network packet with the destination IP address as the fourth private network IP address to the public VPC through the second cross-VPC connection channel.

[0360] Optionally, the receiving module 901 is further configured to: receive an intranet domain name group association request input by a tenant, the intranet domain name group association request including an intranet domain name group identifier, an identifier of the newly added VPC, and an identifier of the public VPC; the creation module 902 is further configured to: record the association relationship between the identifier of the newly added VPC and the identifier of the public VPC in the intranet domain name group according to the intranet domain name group association request; the receiving module 901 is further configured to: receive a third cross-VPC connection channel creation request input by a tenant or another tenant authorized by the tenant, the third cross-VPC connection channel creation request including an identifier of the newly added VPC, an identifier of the public VPC, and an intranet domain name group identifier; the creation module 902 is further configured to: establish a third cross-VPC connection channel between the newly added VPC and the public VPC according to the third cross-VPC connection channel creation request, and allow virtual instances in the newly added VPC to access any one of the M cloud services in the public VPC or any one of the M cloud services connected to the public VPC through the third cross-VPC connection channel.

[0361] Optionally, the receiving module 901 is further configured to: receive a new target request input by a tenant, wherein the new target request includes the identifier of the new VPC and the identifiers of M cloud services; the management module 903 is further configured to: in response to the new target request, create a mapping relationship between the identifier of the new VPC and the M private domain name resolution services.

[0362] Optionally, the receiving module 901 is further configured to: receive a fifth domain name access request sent by a virtual instance in the newly added VPC, wherein the fifth domain name access request is used to access the intranet domain name of the fifth cloud service among the M cloud services in the public VPC, and the fifth domain name access request includes the identifier of the newly added VPC; the management module 903 is further configured to: respond to the fifth domain name access request, and return the fifth private network IP address to the virtual instance in the newly added VPC according to the correspondence between the intranet domain name of the fifth cloud service and the fifth private network IP address of the public VPC, wherein the virtual instance in the newly added VPC sends a network packet with the destination IP address as the fifth private network IP address to the public VPC through the third cross-VPC connection channel.

[0363] Optionally, the receiving module 901 is further configured to: receive a sixth domain name access request sent by a virtual instance in the newly added VPC, wherein the sixth domain name access request is used to access the intranet domain name of the sixth cloud service among the M cloud services in the public VPC, and the sixth domain name access request includes the identifier of the newly added VPC; the management module 903 is further configured to: respond to the sixth domain name access request, and return the sixth private network IP address to the virtual instance in the newly added VPC according to the correspondence between the intranet domain name of the sixth cloud service and the sixth private network IP address of the public VPC, wherein the virtual instance in the newly added VPC sends a network packet with the sixth private network IP address as the destination IP address to the public VPC through the third cross-VPC connection channel.

[0364] For a detailed description of the above-mentioned optional methods, please refer to the aforementioned method embodiments, which will not be repeated here. Furthermore, the explanation of any of the cloud management platforms 900 provided above, as well as the description of their beneficial effects, can be found in the corresponding method embodiments described above, and will not be repeated here.

[0365] In this application, the receiving module 901, the creation module 902, and the management module 903 can all be implemented in software or in hardware. For example, the implementation of the creation module 902 will be described below. Similarly, the implementation of the receiving module 901 and the management module 903 can refer to the implementation of the creation module 902.

[0366] As an example of a software functional unit, module 902 can include code running on a computing instance. The computing instance can include at least one of a physical host (computing device), a virtual machine, or a container. Furthermore, the aforementioned computing instance can be one or more. For example, module 902 can include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code can be distributed within the same region or in different regions. Further, the multiple hosts / virtual machines / containers used to run the code can be distributed within the same availability zone (AZ) or in different AZs, each AZ including one or more geographically proximate data centers. Typically, a region can include multiple AZs.

[0367] Similarly, multiple hosts / virtual machines / containers used to run this code can be distributed within the same Virtual Private Cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Communication between two VPCs within the same region, as well as between VPCs in different regions, requires a communication gateway to be set up within each VPC to enable interconnection between VPCs.

[0368] As an example of a hardware functional unit, module 902 can include at least one computing device, such as a server. Alternatively, module 902 can also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD can be implemented using a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), generic array logic (GAL), or any combination thereof.

[0369] The multiple computing devices included in creation module 902 can be distributed within the same region or in different regions. Similarly, the multiple computing devices included in creation module 902 can be distributed within the same Availability Zone (AZ) or in different AZs. Likewise, the multiple computing devices included in creation module 902 can be distributed within the same VPC or in multiple VPCs. These multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0370] It should be noted that, in other embodiments, the receiving module 901 can be used to execute any step in the configuration method, the creation module 902 can be used to execute any step in the configuration method, and the management module 903 can be used to execute any step in the configuration method. The steps implemented by the receiving module 901, the creation module 902, and the management module 903 can be specified as needed. By implementing different steps in the configuration method through the receiving module 901, the creation module 902, and the management module 903, all functions of the data storage device can be realized.

[0371] For example, Figure 10 This diagram illustrates another possible schematic of the cloud management platform (i.e., cloud management platform 1000) involved in the above embodiments. The actions performed by the cloud management platform 1000 can be executed by a computing device or by executing corresponding software on a computing device. The cloud management platform 1000 may include: a relationship management module 1001 and an association module 1002; the relationship management module 1001 is used to create a target intranet domain name group in response to a first creation request from a tenant, wherein the first creation request is used to request the creation of an intranet domain name group. For example, as... Figure 6S601 is shown. The association module 1002 is used to establish the first correspondence between the target intranet domain name group and the tenant's N VPCs. For example, as shown... Figure 6 The S602 shown. The association module 1002 is also used by the cloud management platform to establish a second correspondence between the target intranet domain name group and the M terminal nodes. For example, as... Figure 6 S603 is shown. The association module 1002 is further configured to establish a correspondence between the private domain name resolution services of N VPCs and M terminal nodes based on the first and second correspondence relationships, wherein the private domain name resolution services of the M terminal nodes are used to provide the IP addresses of the domain name mappings of the M terminal nodes for the N VPCs. For example, as shown... Figure 6 The S604 shown.

[0372] Optionally, the association module 1002 is specifically used to: in response to a first association request from a tenant, establish a first correspondence between a target intranet domain name group and N VPCs, wherein the first association request is used to indicate the target intranet domain name group and N VPCs.

[0373] Optionally, the association module 1002 is specifically used to: establish a first correspondence between the target intranet domain name group and the N VPCs according to the first creation request indicating N VPCs.

[0374] Optionally, the relationship management module 1001 is further configured to: receive a second creation request from a tenant, wherein the second creation request is used to request the creation of a terminal node, and the second creation request is also used to indicate a target terminal node service and a target intranet domain name group among M terminal node services; in response to the second creation request, create a target terminal node in the public VPC according to the target terminal node service; the association module 1002 is specifically configured to: establish a second correspondence between the target terminal node and the target intranet domain name group according to the target intranet domain name group indicated by the second creation request.

[0375] Optionally, the association module 1002 is specifically used to: in response to a second association request from a tenant, establish a second correspondence between the target intranet domain name group and M terminal nodes, wherein the second association request is used to indicate the target intranet domain name group and M terminal nodes.

[0376] Optionally, the N VPCs include the target VPC, and the association module 1002 is further configured to: in response to a disassociation request from a tenant, delete the first correspondence between the target intranet domain name group and the target VPC, wherein the disassociation request is used to indicate the target intranet domain name group and the target VPC; and delete the correspondence between the target VPC and the private domain name resolution services of the M terminal nodes.

[0377] Optionally, the association module 1002 is specifically used to: call the deletion interface of the private domain name system DNS to delete the correspondence between the target VPC and the private domain name resolution service of at least one terminal node.

[0378] Optionally, the association module 1002 is specifically used to: call the interface of the private domain name system DNS, and establish a correspondence between N VPCs and at least one terminal node's private domain name resolution service according to the first correspondence and the second correspondence.

[0379] Optionally, after creating the target endpoint within the public VPC, the relationship management module 1001 is also used to: schedule the creation interface of the private domain name system DNS, and create a private domain name resolution service for the target endpoint based on the domain name and IP address of the target endpoint.

[0380] Optionally, the N VPCs include the target VPC, and the association module 1002 is further configured to: in response to a disassociation request from a tenant, delete the first correspondence between the target intranet domain name group and the target VPC, wherein the disassociation request is used to indicate the target intranet domain name group and the target VPC; schedule the deletion interface of the private domain name system DNS to delete the third correspondence between the target VPC and the private domain name resolution service of at least one terminal node.

[0381] Optionally, the relationship management module 1001 is further configured to: receive a third creation request from a tenant, wherein the third creation request is used to request the creation of a terminal node, and the third creation request is also used to instruct a first terminal node service; in response to the third creation request, create a first terminal node in a public VPC according to the first terminal node service, wherein the first terminal node is used to access the cloud service corresponding to the first terminal node service; create a first intranet domain name group; the association module 1002 is further configured to: establish a correspondence between the first intranet domain name group and the first terminal node.

[0382] Optionally, the cloud management platform also includes a query module 1003, which is used to: receive a first query request from a tenant, wherein the first query request is used to request a query of a target intranet domain name group; and in response to the first query request, return information about the target intranet domain name group.

[0383] Optionally, the query module 1003 is further configured to: receive a second query request from a tenant, wherein the second query request is used to request a query for an intranet domain name group; and in response to the second query request, return object information, wherein the object information is used to indicate at least one intranet domain name group.

[0384] For a detailed description of the above-mentioned optional methods, please refer to the foregoing method embodiments, which will not be repeated here. Furthermore, the explanation of any of the cloud management platforms 1000 provided above, as well as the description of their beneficial effects, can be found in the corresponding method embodiments described above, and will not be repeated here.

[0385] It needs to be explained that, Figure 10 For other relevant information about the cloud management platform 1000 shown, please refer to [link / reference]. Figure 9 The description of the cloud management platform 900 shown will not be repeated here.

[0386] This application also provides a computing device 1100. For example... Figure 11 As shown, the computing device 1100 includes a bus 1102, a processor 1104, a memory 1106, and a communication interface 1108. The processor 1104, the memory 1106, and the communication interface 1108 communicate with each other via the bus 1102. The computing device 1100 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device 1100.

[0387] Bus 1102 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 11 The bus 1102 may be represented by a single line, but this does not mean that there is only one bus or one type of bus. The bus 1102 may include a path for transmitting information between various components of the computing device 1100 (e.g., memory 1106, processor 1104, communication interface 1108).

[0388] The processor 1104 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0389] The memory 1106 may include volatile memory, such as random access memory (RAM). The processor 1104 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0390] The memory 1106 stores executable program code, and the processor 1104 executes the executable program code to implement the functions of the aforementioned receiving module 901, creation module 902, and management module 903, thereby achieving... Figure 3 The configuration method shown. Alternatively, the processor 1104 executes the executable program code to implement the functions of the aforementioned relationship management module 1001, association module 1002, and query module 1003, thereby achieving... Figure 6 The configuration method shown is as follows. That is, the memory 1106 stores instructions for executing the configuration method.

[0391] The communication interface 1108 uses transceiver modules such as, but not limited to, network interface cards and transceivers to enable communication between the computing device 1100 and other devices or communication networks.

[0392] For example, the computing device 1100 described above may be Figure 1 and Figure 2 The equipment in the infrastructure shown.

[0393] This application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0394] like Figure 12 As shown, the computing device cluster 1200 includes at least one computing device 1100. The memory 1106 of one or more computing devices 1100 in the computing device cluster 1200 may store the same instructions for executing configuration methods.

[0395] In some possible implementations, the memory 1106 of one or more computing devices 1100 in the computing device cluster may also store partial instructions for executing the configuration method. In other words, a combination of one or more computing devices 1100 can jointly execute the instructions for executing the configuration method.

[0396] It should be noted that the memory 1106 in different computing devices 1100 within the computing device cluster can store different instructions, each used to execute a portion of the cloud management platform's functions. That is, the instructions stored in the memory 1106 of different computing devices 1100 can implement the functions of one or more modules among the receiving module 901, the creation module 902, and the management module 903. Alternatively, the instructions stored in the memory 1106 of different computing devices 1100 can implement the functions of one or more modules among the relationship management module 1001, the association module 1002, and the query module 1003.

[0397] In some possible implementations, one or more computing devices in a computing device cluster can be connected via a network. This network can be a wide area network (WAN), a local area network (LAN), or similar. Figure 13 One possible implementation is shown. For example... Figure 13 As shown, the two computing devices 1100A and 1100B are connected via a network. Specifically, they are connected to the network through the communication interfaces in each computing device.

[0398] In this type of possible implementation, the memory 1106 in computing device 1100A stores instructions for executing the functions of the receiving module 901 and the creation module 902. Meanwhile, the memory 1106 in computing device 1100B stores instructions for executing the functions of the management module.

[0399] Figure 13 The connection method between the computing device clusters shown can be such that, considering the configuration method provided in this application requires a large amount of computation, the function of the management module 903 is delegated to the computing device 1100B.

[0400] It should be understood that Figure 13 The functions of computing device 1100A shown can also be performed by multiple computing devices 1100. Similarly, the functions of computing device 1100B can also be performed by multiple computing devices 1100.

[0401] This application also provides another computing device cluster. The connection relationships between the computing devices in this computing device cluster can be similarly referred to... Figure 12 and Figure 13 The connection method of the computing device cluster shown is different in that the memory 1106 of one or more computing devices 1100 in this computing device cluster can store the same instructions for executing the configuration method.

[0402] In some possible implementations, the memory 1106 of one or more computing devices 1100 in the computing device cluster may also store partial instructions for executing the configuration method. In other words, a combination of one or more computing devices 1100 can jointly execute the instructions for executing the configuration method.

[0403] This application also provides a processor that can be used to perform the above-described methods.

[0404] This application also provides a chip, including: a processor and a power supply circuit; the power supply circuit can be used to supply power to the processor; the processor can be used to perform the above-described methods.

[0405] This application also provides a computing device, which may include a processor, a memory, and a computer program / instructions stored in the memory; the processor executes the computer program / instructions to enable the computing device to implement the above-described method.

[0406] This application also provides a computing device cluster, which includes at least one computing device; each computing device includes a processor, a memory, and computer programs / instructions stored in the memory, wherein the processor of each computing device executes the computer programs / instructions stored in the memory of each computing device to enable each computing device to implement the above-described method.

[0407] This application also provides a computer program product. The computer program product includes a computer program / instructions, which are software or program products capable of running on a computing device or stored on any usable medium. When the computer program / instructions are executed on at least one computing device, the at least one computing device can perform the methods described above.

[0408] This application also provides a computer-readable storage medium, which can be any available medium capable of being stored by a computing device or a data storage device such as a data center containing one or more available media. The computer-readable storage medium stores a computer program / instructions that, when executed on at least one computing device, enable the at least one computing device to perform the described method.

[0409] For example, the available media may be magnetic media (e.g., floppy disks, magnetic disks, magnetic tapes), optical media (e.g., digital video discs (DVDs)), or semiconductor media (e.g., solid state drives (SSDs)).

[0410] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. A cross-VPC access configuration method based on cloud computing technology, characterized in that, The method is applied to a cloud management platform for managing infrastructure, which includes multiple cloud data centers. At least one of the cloud data centers contains N VPCs (Virtual Private Clouds) and 1 public VPC, each belonging to a tenant's master account and / or sub-accounts associated with the master account. The public VPC contains M cloud services or is connected to M cloud services, where N is a positive integer greater than 1 and M is a positive integer greater than 0. The method includes: The cloud management platform receives an intranet domain name group creation request input by the tenant. The intranet domain name group creation request includes the identifiers of the N VPCs and the identifier of the public VPC. The cloud management platform creates an intranet domain name group based on the intranet domain name group creation request. The intranet domain name group records the association between the identifiers of the N VPCs and the identifiers of the public VPCs. The intranet domain name group is set with an intranet domain name group identifier. The cloud management platform receives a first cross-VPC connection channel creation request input by the tenant or other tenants authorized by the tenant. The first cross-VPC connection channel creation request includes the identifier of the first VPC among the N VPCs, the identifier of the public VPC, and the identifier of the intranet domain name group. The cloud management platform establishes a first cross-VPC connection channel between the first VPC and the public VPC based on the first cross-VPC connection channel creation request, and allows virtual instances in the first VPC to access any one of the M cloud services set in the public VPC or any one of the M cloud services connected to the public VPC through the first cross-VPC connection channel.

2. The method according to claim 1, characterized in that, The M cloud services are configured with M intranet domain names, wherein each of the M cloud services is configured with one intranet domain name, and each intranet domain name corresponds to a private IP address of the public VPC. Different intranet domain names correspond to different private IP addresses of the public VPC. The method further includes: The cloud management platform receives the target request input by the tenant, wherein the target request includes the identifiers of N VPCs and the identifiers of the M cloud services; In response to the target request, the cloud management platform creates a correspondence between the identifiers of the N VPCs and the M private domain name resolution services, wherein the M private domain name resolution services are used to record the correspondence between the M intranet domain names and the corresponding private IP addresses.

3. The method according to claim 2, characterized in that, The method further includes: The cloud management platform receives a first domain name access request sent by a virtual instance in the first VPC. The first domain name access request is used to request access to the intranet domain name of the first cloud service among the M cloud services in the public VPC. The first domain name access request includes the identifier of the first VPC. In response to the first domain name access request, the cloud management platform returns the first private network IP address to the virtual instance in the first VPC according to the correspondence between the intranet domain name of the first cloud service and the first private network IP address of the public VPC. The virtual instance in the first VPC sends a network packet with the first private network IP address as the destination IP address to the public VPC through the first cross-VPC connection channel.

4. The method according to claim 3, characterized in that, The method further includes: The cloud management platform receives a second domain name access request sent by a virtual instance in the first VPC. The second domain name access request is used to access the intranet domain name of the second cloud service among the M cloud services in the public VPC. The second domain name access request includes the identifier of the first VPC. In response to the second domain name access request, the cloud management platform returns the second private network IP address to the virtual instance in the first VPC according to the correspondence between the intranet domain name of the second cloud service and the second private network IP address of the public VPC. The virtual instance in the first VPC sends a network packet with the destination IP address as the second private network IP address to the public VPC through the first cross-VPC connection channel.

5. The method according to any one of claims 2 to 4, characterized in that, The method further includes: The cloud management platform receives a second cross-VPC connection channel creation request input by the tenant or other tenants authorized by the tenant. The second cross-VPC connection channel creation request includes the identifier of the second VPC among the N VPCs, the identifier of the public VPC, and the identifier of the intranet domain name group. The cloud management platform establishes a second cross-VPC connection channel between the second VPC and the public VPC based on the second cross-VPC connection channel creation request, and allows virtual instances in the second VPC to access any one of the M cloud services set in the public VPC or any one of the M cloud services connected to the public VPC through the second cross-VPC connection channel.

6. The method according to claim 5, characterized in that, The method further includes: The cloud management platform receives a third domain name access request sent by a virtual instance in the second VPC. The third domain name access request is used to access the intranet domain name of the third cloud service among the M cloud services in the public VPC. The third domain name access request includes the identifier of the second VPC. In response to the third domain name access request, the cloud management platform returns the third private network IP address to the virtual instance in the second VPC according to the correspondence between the intranet domain name of the third cloud service and the third private network IP address of the public VPC. The virtual instance in the second VPC sends a network packet with the destination IP address of the third private network IP address to the public VPC through the second cross-VPC connection channel.

7. The method according to claim 6, characterized in that, The method further includes: The cloud management platform receives a fourth domain name access request sent by a virtual instance in the second VPC. The fourth domain name access request is used to access the intranet domain name of the fourth cloud service among the M cloud services in the public VPC. The fourth domain name access request includes the identifier of the second VPC. In response to the fourth domain name access request, the cloud management platform returns the fourth private network IP address to the virtual instance in the second VPC according to the correspondence between the intranet domain name of the fourth cloud service and the fourth private network IP address of the public VPC. The virtual instance in the second VPC sends a network packet with the destination IP address of the fourth private network IP address to the public VPC through the second cross-VPC connection channel.

8. The method according to any one of claims 2 to 7, characterized in that, The method further includes: The cloud management platform receives an intranet domain name group association request input by the tenant. The intranet domain name group association request includes the intranet domain name group identifier, the identifier of the newly added VPC, and the identifier of the public VPC. The cloud management platform records the association relationship between the identifier of the newly added VPC and the identifier of the public VPC in the intranet domain name group according to the intranet domain name group association request; The cloud management platform receives a third cross-VPC connection channel creation request from the tenant or other tenants authorized by the tenant. The third cross-VPC connection channel creation request includes the identifier of the newly added VPC, the identifier of the public VPC, and the identifier of the intranet domain name group. The cloud management platform establishes a third cross-VPC connection channel between the newly added VPC and the public VPC based on the third cross-VPC connection channel creation request, and allows virtual instances in the newly added VPC to access any one of the M cloud services in the public VPC or any one of the M cloud services connected to the public VPC through the third cross-VPC connection channel.

9. The method according to claim 8, characterized in that, The method further includes: The cloud management platform receives a fifth domain name access request sent by a virtual instance in the newly added VPC. The fifth domain name access request is used to access the intranet domain name of the fifth cloud service among the M cloud services in the public VPC. The fifth domain name access request includes the identifier of the newly added VPC. In response to the fifth domain name access request, the cloud management platform returns the fifth private network IP address to the virtual instance in the newly added VPC according to the correspondence between the intranet domain name of the fifth cloud service and the fifth private network IP address of the public VPC. The virtual instance in the newly added VPC sends a network packet with the destination IP address of the fifth private network IP address to the public VPC through the third cross-VPC connection channel.

10. The method according to claim 9, characterized in that, The method further includes: The cloud management platform receives a sixth domain name access request sent by a virtual instance in the newly added VPC. The sixth domain name access request is used to access the intranet domain name of the sixth cloud service among the M cloud services in the public VPC. The sixth domain name access request includes the identifier of the newly added VPC. In response to the sixth domain name access request, the cloud management platform returns the sixth private network IP address to the virtual instance in the newly added VPC according to the correspondence between the intranet domain name of the sixth cloud service and the sixth private network IP address of the public VPC. The virtual instance in the newly added VPC sends a network packet with the destination IP address of the sixth private network IP address to the public VPC through the third cross-VPC connection channel.

11. A cloud management platform, characterized in that, The cloud management platform is used to manage infrastructure, which includes multiple cloud data centers. At least one of the cloud data centers contains N VPCs (Virtual Private Clouds) belonging to a tenant's main account and / or sub-accounts associated with the main account, and 1 public VPC. The public VPC contains M cloud services or is connected to M cloud services, where N is a positive integer greater than 1 and M is a positive integer greater than 0. The cloud management platform includes: The receiving module is used to receive the intranet domain name group creation request input by the tenant, wherein the intranet domain name group creation request includes the identifiers of the N VPCs and the identifier of the public VPC; A creation module is used to create an intranet domain name group according to the intranet domain name group creation request, wherein the intranet domain name group records the association relationship between the identifiers of the N VPCs and the identifiers of the public VPC, and the intranet domain name group is set with an intranet domain name group identifier; The receiving module is further configured to receive a first cross-VPC connection channel creation request input by the tenant or other tenants authorized by the tenant, wherein the first cross-VPC connection channel creation request includes the identifier of the first VPC among the N VPCs, the identifier of the public VPC, and the identifier of the intranet domain name group; The creation module is further configured to establish a first cross-VPC connection channel between the first VPC and the public VPC according to the first cross-VPC connection channel creation request, and allow virtual instances in the first VPC to access any one of the M cloud services set in the public VPC or any one of the M cloud services connected to the public VPC through the first cross-VPC connection channel.

12. The cloud management platform according to claim 11, characterized in that, The M cloud services are configured with M intranet domain names. Each of the M cloud services is configured with an intranet domain name, and each intranet domain name corresponds to a private IP address of the public VPC. Different intranet domain names correspond to different private IP addresses of the public VPC. The receiving module is further configured to: receive the target request input by the tenant, wherein the target request includes the identifiers of N VPCs and the identifiers of the M cloud services; The cloud management platform also includes a management module, which is further configured to: in response to the target request, create a correspondence between the identifiers of the N VPCs and the M private domain name resolution services, wherein the M private domain name resolution services are used to record the correspondence between the M intranet domain names and the private IP addresses corresponding to the M intranet domain names.

13. The cloud management platform according to claim 12, characterized in that, The receiving module is further configured to: receive a first domain name access request sent by a virtual instance in the first VPC, wherein the first domain name access request is used to request access to the intranet domain name of the first cloud service among the M cloud services in the public VPC, and the first domain name access request includes the identifier of the first VPC; The management module is further configured to: respond to the first domain name access request, and return the first private network IP address to the virtual instance in the first VPC according to the correspondence between the intranet domain name of the first cloud service and the first private network IP address of the public VPC, wherein the virtual instance in the first VPC sends a network packet with the destination IP address of the first private network IP address to the public VPC through the first cross-VPC connection channel.

14. The cloud management platform according to claim 13, characterized in that, The receiving module is further configured to: receive a second domain name access request sent by a virtual instance in the first VPC, wherein the second domain name access request is used to access the intranet domain name of the second cloud service among the M cloud services in the public VPC, and the first domain name access request includes the identifier of the first VPC; The management module is further configured to: respond to the second domain name access request, return the second private network IP address to the virtual instance in the first VPC according to the correspondence between the intranet domain name of the second cloud service and the second private network IP address of the public VPC, wherein the virtual instance in the first VPC sends a network packet with the destination IP address as the second private network IP address to the public VPC through the first cross-VPC connection channel.

15. The cloud management platform according to any one of claims 12 to 14, characterized in that, The receiving module is further configured to: receive a second cross-VPC connection channel creation request input by the tenant or other tenants authorized by the tenant, wherein the second cross-VPC connection channel creation request includes the identifier of the second VPC among the N VPCs, the identifier of the public VPC, and the identifier of the intranet domain name group; The creation module is further configured to: establish a second cross-VPC connection channel between the second VPC and the public VPC according to the second cross-VPC connection channel creation request, and allow virtual instances in the second VPC to access any one of the M cloud services set in the public VPC or any one of the M cloud services connected to the public VPC through the second cross-VPC connection channel.

16. The cloud management platform according to claim 15, characterized in that, The receiving module is further configured to: receive a third domain name access request sent by a virtual instance in the second VPC, wherein the third domain name access request is used to access the intranet domain name of the third cloud service among the M cloud services in the public VPC, and the third domain name access request includes the identifier of the second VPC. The management module is further configured to: respond to the third domain name access request, and return the third private network IP address to the virtual instance in the second VPC according to the correspondence between the intranet domain name of the third cloud service and the third private network IP address of the public VPC, wherein the virtual instance in the second VPC sends a network packet with the destination IP address of the third private network IP address to the public VPC through the second cross-VPC connection channel.

17. The cloud management platform according to claim 16, characterized in that, The receiving module is further configured to: receive a fourth domain name access request sent by a virtual instance in the second VPC, wherein the fourth domain name access request is used to access the intranet domain name of the fourth cloud service among the M cloud services in the public VPC, and the fourth domain name access request includes the identifier of the second VPC; The management module is further configured to: respond to the fourth domain name access request, and return the fourth private network IP address to the virtual instance in the second VPC according to the correspondence between the intranet domain name of the fourth cloud service and the fourth private network IP address of the public VPC, wherein the virtual instance in the second VPC sends a network packet with the destination IP address of the fourth private network IP address to the public VPC through the second cross-VPC connection channel.

18. The cloud management platform according to any one of claims 12 to 17, characterized in that, The receiving module is further configured to: receive an intranet domain name group association request input by the tenant, wherein the intranet domain name group association request includes the intranet domain name group identifier, the identifier of the newly added VPC, and the identifier of the public VPC; The creation module is also used to: record the association relationship between the identifier of the newly added VPC and the identifier of the public VPC in the intranet domain name group according to the intranet domain name group association request; The receiving module is further configured to: receive a third cross-VPC connection channel creation request input by the tenant or other tenants authorized by the tenant, wherein the third cross-VPC connection channel creation request includes the identifier of the newly added VPC, the identifier of the public VPC, and the identifier of the intranet domain name group; The creation module is further configured to: establish a third cross-VPC connection channel between the newly added VPC and the public VPC according to the third cross-VPC connection channel creation request, and allow virtual instances in the newly added VPC to access any one of the M cloud services in the public VPC or any one of the M cloud services connected to the public VPC through the third cross-VPC connection channel.

19. The cloud management platform according to claim 18, characterized in that, The receiving module is further configured to: receive a fifth domain name access request sent by a virtual instance in the newly added VPC, wherein the fifth domain name access request is used to access the intranet domain name of the fifth cloud service among the M cloud services in the public VPC, and the fifth domain name access request includes the identifier of the newly added VPC; The management module is further configured to: respond to the fifth domain name access request, and return the fifth private network IP address to the virtual instance in the newly added VPC according to the correspondence between the intranet domain name of the fifth cloud service and the fifth private network IP address of the public VPC, wherein the virtual instance in the newly added VPC sends a network packet with the destination IP address of the fifth private network IP address to the public VPC through the third cross-VPC connection channel.

20. The cloud management platform according to claim 19, characterized in that, The receiving module is further configured to: the cloud management platform receive a sixth domain name access request sent by a virtual instance in the newly added VPC, wherein the sixth domain name access request is used to access the intranet domain name of the sixth cloud service among the M cloud services in the public VPC, and the sixth domain name access request includes the identifier of the newly added VPC; The management module is further configured to: respond to the sixth domain name access request, and return the sixth private network IP address to the virtual instance in the first VPC according to the correspondence between the intranet domain name of the sixth cloud service and the sixth private network IP address of the public VPC, wherein the virtual instance in the newly added VPC sends a network packet with the destination IP address of the sixth private network IP address to the public VPC through the third cross-VPC connection channel.

21. A computing device cluster, characterized in that, The computing device cluster includes at least one computing device; Each of the at least one computing device includes a processor, a memory, and a computer program / instructions stored in the memory; The processor of each computing device executes computer programs / instructions stored in the memory of each computing device to enable each computing device to implement the method as described in any one of claims 1-10.

22. A computer program product, characterized in that, The computer program product includes a computer program / instruction, which, when executed by a computing device, implements the method as described in any one of claims 1-10.

23. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program / instruction, which, when executed by a computing device, implements the method as described in any one of claims 1-10.

Images