Cloud service system and cloud service providing method based on public cloud technology

Abstract

The invention discloses a public cloud technology-based cloud service system and a cloud service providing method, and belongs to the technical field of cloud services. In a cloud service system, a virtual machine manager obtains a first access request of a virtual instance for a cloud hard disk, adds an identifier of a target computing node to the first access request to obtain a second access request, and sends the second access request to a first intelligent network card, and the first access request and the second access request carry disk information of the cloud hard disk; the first intelligent network card is used for forwarding a second access request to the target storage node indicated by the disk information under the condition of determining that the target computing node has the access permission of the cloud hard disk; the target storage node is used for responding to the second access request and sending an access response to the virtual instance through the first intelligent network card and the virtual machine manager. According to the method and the device, the access permission of the cloud hard disk is controlled on the granularity of the computing node, and the data consistency of the cloud hard disk can be ensured.

Description

(19) State Intellectual Property Office (12) Invention Patent Application (10) Application Publication Number (43) Application Publication Date (21) Application Number 202410796636.5 (22) Application Date 2024.06.19 (71) Applicant Huawei Cloud Computing Technology Co., Ltd. Address 550025, Guizhou Province, Guiyang City, Gui'an New District, Qianzhong Avenue, Xinggong Road Huawei Cloud Data Center (72) Inventors Lu Wancheng, Zhao Kewei, Shi Ning (74) Patent Agency Beijing Sangao Yongxin Intellectual Property Agency Co., Ltd. 11138 Patent Attorney Li Fang (51) Int.Cl. H04L 9 / 40 (2022.01) H04L 67 / 10 (2022.01) H04L 67 / 1097 (2022.01) G06F 9 / 455 (2018.01) (54) Invention Title: Cloud Service System and Cloud Service Provision Method Based on Public Cloud Technology (57) Abstract: This application discloses a cloud service system and cloud service provision method based on public cloud technology, belonging to the field of cloud service technology. In the cloud service system, the virtual machine manager obtains a first access request from a virtual instance for a cloud disk, adds the identifier of the target computing node to the first access request to obtain a second access request, and sends the second access request to a first smart network card. The first and second access requests carry disk information of the cloud disk. The first smart network card is used to forward the second access request to the target storage node indicated by the disk information, provided that the target computing node has access rights to the cloud disk. The target storage node is used to respond to the second access request and send an access response to the virtual instance through the first smart network card and the virtual machine manager. This application implements access control of the cloud disk at the granularity of the computing node, which can ensure the data consistency of the cloud disk. Claims (4 pages), Description (28 pages), Drawings (17 pages), CN 121173485 A, 2025.12.19, CN 1 21 17 34 85 A. 1. A cloud service system based on public cloud technology, characterized in that the cloud service system comprises: a computing node cluster, a smart network interface card (NIC) cluster, and a storage node cluster; the computing node cluster comprises multiple computing nodes; the smart NIC cluster comprises multiple smart NICs; the storage node cluster comprises multiple storage nodes; the multiple computing nodes include a target computing node; the target computing node runs a virtual machine manager and a virtual instance for implementing tenant services; the virtual instance is mounted with a cloud disk obtained by device simulation based on the storage node; the virtual machine manager is used to obtain a first access request from the virtual instance for the cloud disk, add the identifier of the target computing node to the first access request to obtain a second access request, and send the second access request to a first smart NIC.The second access request, wherein the first access request and the second access request carry disk information of the cloud disk, and the first smart network interface card (NIC) is one of the plurality of smart NICs; the first smart NIC is used to forward the second access request to the target storage node indicated by the disk information, provided that the target computing node has access rights to the cloud disk based on the identifier of the target computing node, and the target storage node is one of the plurality of storage nodes; the target storage node is used to respond to the second access request and send an access response to the virtual instance through the first smart NIC and the virtual machine manager. 2. The system as described in claim 1, characterized in that: the virtual machine manager is further configured to obtain a first permission acquisition request sent by the virtual instance, add the identifier of the target computing node to the first permission acquisition request to obtain a second permission acquisition request, and send the second permission acquisition request to a second smart network interface card (NIC), wherein both the first permission acquisition request and the second permission acquisition request are used to obtain access permissions to the cloud disk, and the second smart network interface card is one of the plurality of smart network interface cards; the second smart network interface card is configured to forward the second permission acquisition request to the management node of the storage node cluster; the management node is configured to send a first notification to the plurality of smart network interface cards based on the second permission acquisition request when the target computing node has the conditions to access the cloud disk, wherein the first notification is used to indicate that the target computing node has access permissions to the cloud disk; the plurality of smart network interface cards are configured to update their own configuration based on the first notification, wherein the updated configuration indicates that the target computing node has access permissions to the cloud disk. 3. The system as described in claim 2, wherein the management node is specifically configured to, when the target computing node has the conditions to access the cloud disk, generate metadata indicating that the target computing node has access to the cloud disk based on the second permission acquisition request, persist the metadata, and send the first notification to the plurality of smart network interface cards after completing the persistence of the metadata. 4. The system as described in claim 3, wherein the third smart network interface card is configured to, when the configuration information indicating access to the cloud disk is lost, acquire the metadata, and update the configuration indicating access to the cloud disk based on the metadata, wherein the third smart network interface card is one of the plurality of smart network interface cards. 5. The system as described in any one of claims 1 to 4, wherein the virtual machine manager is further configured to acquire the first permission release request sent by the virtual instance, add the identifier of the target computing node to the first permission release request to obtain a second permission release request, and send the second permission release request to the fourth smart network interface card, wherein both the first permission release request and the second permission release request are used to indicate cancellation.Access permissions to the cloud disk, wherein the fourth smart network interface card (NIC) is one of the plurality of smart NICs; the fourth smart NIC is used to forward the second permission release request to the management node of the storage node cluster; The management node is used to send a second notification to the plurality of smart NICs based on the second permission release request, the second notification being used to indicate the cancellation of access permissions to the cloud disk; the plurality of smart NICs are used to update their own configuration based on the second notification, the updated configuration indicating that the target computing node does not have access permissions to the cloud disk. 6. The system of claim 5, wherein the management node is specifically used to delete metadata indicating that the target computing node has access permissions to the cloud disk based on the second permission release request, and send the second notification to the plurality of smart NICs. 7. The system as described in any one of claims 1 to 6, wherein the virtual machine manager is further configured to obtain a first permission clearing request sent by the virtual instance, and send the first permission clearing request to a fifth smart network interface card (NIC), wherein the first permission clearing request is used to instruct the compute nodes where all virtual instances mounted on the cloud disk reside to cancel their access permissions to the cloud disk, and the fifth smart network interface card is one of the plurality of smart network interface cards; the fifth smart network interface card is configured to forward the first permission clearing request to the management node of the storage node cluster; the management node is configured to send a third notification to the plurality of smart network interface cards based on the first permission clearing request, wherein the third notification is used to instruct the compute nodes where all virtual instances mounted on the cloud disk reside to cancel their access permissions to the cloud disk; the plurality of smart network interface cards are configured to update their own configuration based on the third notification, wherein the updated configuration indicates that the compute nodes where all virtual instances mounted on the cloud disk reside do not have access permissions to the cloud disk. 8. The system as described in claim 7, wherein the management node is specifically configured to delete all metadata indicating that compute nodes have access permissions to the cloud disk based on the first permission clearing request, and send the third notification to the plurality of smart network interface cards. 9. A method for providing cloud services based on public cloud technology, characterized in that the method is applied to a cloud service system, the cloud service system comprising: a compute node cluster, a smart NIC cluster, and a storage node cluster, wherein the compute node cluster comprises multiple compute nodes, the smart NIC cluster comprises multiple smart NICs, the storage node cluster comprises multiple storage nodes, the multiple compute nodes include a target compute node, the target compute node runs a virtual machine manager and a virtual instance for implementing tenant services, the virtual instance is mounted with a cloud disk obtained by device simulation based on the storage node, and the method comprises:The virtual machine manager obtains a first access request from the virtual instance for the cloud disk, adds the identifier of the target compute node to the first access request to obtain a second access request, and sends the second access request to a first smart network interface card (NIC). Both the first and second access requests carry disk information of the cloud disk. The first smart NIC is one of the plurality of smart NICs. If the first smart NIC determines that the target compute node has access to the cloud disk based on the identifier of the target compute node carried in the second access request, it forwards the second access request to the target storage node indicated by the disk information. The target storage node is one of the plurality of storage nodes. The target storage node responds to the second access request and sends an access response to the virtual instance through the first smart NIC and the virtual machine manager. 10. The method as described in claim 9, characterized in that the method further comprises: the virtual machine manager obtaining a first permission acquisition request sent by the virtual instance, adding the identifier of the target computing node to the first permission acquisition request to obtain a second permission acquisition request, and sending the second permission acquisition request to a second smart network interface card (NIC), wherein both the first permission acquisition request and the second permission acquisition request are used to acquire access rights to the cloud disk, and the second smart network interface card is one of the plurality of smart network interface cards; the second smart network interface card forwards the second permission acquisition request to the management node of the storage node cluster; when the target computing node has the conditions to access the cloud disk, the management node sends a first notification to the plurality of smart network interface cards based on the second permission acquisition request, wherein the first notification is used to indicate that the target computing node has access rights to the cloud disk; the plurality of smart network interface cards update their own configuration based on the first notification, and the updated configuration indicates that the target computing node has access rights to the cloud disk. 11. The method of claim 10, wherein when the target computing node has the condition to access the cloud disk, the management node sends a first notification to the plurality of smart network interface cards based on the second permission acquisition request, comprising: when the target computing node has the condition to access the cloud disk, the management node generates metadata indicating that the target computing node has access permission to the cloud disk based on the second permission acquisition request, persists the metadata, and sends the first notification to the plurality of smart network interface cards after completing the persistence of the metadata. 12. The method of claim 11, further comprising: when the third smart network interface card loses the configuration information indicating access permission to the cloud disk, it acquires the metadata and...Based on the metadata update, a configuration indicating access permissions to the cloud disk is obtained, wherein the third smart network interface card (NIC) is one of the plurality of smart NICs. 13. The method according to any one of claims 9 to 12, characterized in that the method further comprises: the virtual machine manager obtaining a first permission release request sent by the virtual instance, adding the identifier of the target compute node to the first permission release request to obtain a second permission release request, and sending the second permission release request to a fourth smart NIC, wherein both the first permission release request and the second permission release request are used to indicate the cancellation of access permissions to the cloud disk, wherein the fourth smart NIC is one of the plurality of smart NICs; the fourth smart NIC forwarding the second permission release request to the management node of the storage node cluster; the management node sending a second notification to the plurality of smart NICs based on the second permission release request, wherein the second notification is used to indicate the cancellation of access permissions to the cloud disk; the plurality of smart NICs updating their own configuration based on the second notification, wherein the updated configuration indicates that the target compute node does not have access permissions to the cloud disk. 14. The method as described in claim 13, wherein the management node sends a second notification to the plurality of smart network interface cards based on the second permission release request, comprising: the management node deleting metadata indicating that the target computing node has access to the cloud disk based on the second permission release request, and sending the second notification to the plurality of smart network interface cards. 15. The method according to any one of claims 9 to 14, characterized in that the method further comprises: the virtual machine manager obtaining a first permission clearing request sent by the virtual instance, and sending the first permission clearing request to a fifth smart network interface card (NIC), wherein the first permission clearing request is used to instruct the compute nodes where all virtual instances mounted on the cloud disk reside to cancel their access permissions to the cloud disk, and the fifth smart network interface card is one of the plurality of smart network interface cards; the fifth smart network interface card forwarding the first permission clearing request to the management node of the storage node cluster; the management node sending a third notification to the plurality of smart network interface cards based on the first permission clearing request, wherein the third notification is used to instruct the compute nodes where all virtual instances mounted on the cloud disk reside to cancel their access permissions to the cloud disk; the plurality of smart network interface cards updating their own configuration based on the third notification, wherein the updated configuration indicates that all compute nodes where all virtual instances mounted on the cloud disk reside do not have access permissions to the cloud disk. 16. The method as described in claim 15, wherein the management node sends a third notification to the plurality of smart network interface cards based on the first permission clearing request, comprising: the management node deleting all indications that the computing node has the cloud disk based on the first permission clearing request.The metadata of access permissions is sent to the plurality of smart network cards. 17. A computing device cluster, characterized in that it includes a plurality of computing devices, the plurality of computing devices including a plurality of processors and a plurality of memories, the plurality of memories storing program instructions, the plurality of processors running the program instructions, causing the computing device cluster to perform the method of any one of claims 9 to 16. 18. A computer-readable storage medium, characterized in that it includes program instructions, which, when run on a computing device, cause the computing device to perform the method of any one of claims 9 to 16. 19. A computer program product containing instructions, characterized in that, when the instructions are run by a computing device cluster, the computing device cluster causes the computing device cluster to perform the method of any one of claims 9 to 16. Claims 4 / 4 Page 5 CN 121173485 A Cloud Service System and Cloud Service Provision Method Based on Public Cloud Technology Technical Field

[0001] This application relates to the field of cloud service technology, and particularly to a cloud service system and cloud service provision method based on public cloud technology. Background Technology

[0002] In cloud disk usage scenarios, there will be scenarios where multiple virtual machines use the same cloud disk. At this time, different virtual machines can simultaneously mount the same cloud disk and read and write to it simultaneously. In this case, to avoid data corruption caused by multiple virtual machines writing to the same cloud disk at the same time, a locking mechanism needs to be introduced to ensure data consistency of the cloud disk. For example, a Small Computer System Interface (SCSI)-3 locking mechanism can be introduced. Through the SCSI-3 locking mechanism, virtual machines can use reservation and preemption commands to implement access permissions or exclusive permissions for a certain cloud disk.

[0003] Currently, servers are configured with a one-to-one correspondence with smart network cards, that is, all requests sent by a certain server are forwarded through its corresponding smart network card. Based on this, when implementing the SCSI-3 locking mechanism, the locking permissions of cloud disks are managed at the storage client level. When virtual machine a in server a has access permissions to the cloud disk, since the smart network card configured for server a is smart network card a, the locking permission record shows that smart network card a has the permission to access the cloud disk. At this time, all virtual machines using smart network card a on server a can access the cloud disk, while all virtual machines on other servers cannot access the cloud disk.

[0004] However, when smart network interface cards (NICs) serve the server in a resource pool manner, the correspondence between the server and the smart NICs becomes a many-to-many relationship. This causes the SCSI-3 locking mechanism to fail, making it difficult to guarantee data consistency of the cloud hard drive through this mechanism.

[0005] This application provides a cloud service system and a cloud service provision method based on public cloud technology. This application implements access control for cloud disks at the granularity of computing nodes, ensuring data consistency of the cloud disks. The technical solution provided by this application is as follows:

[0006] In a first aspect, this application provides a cloud service system based on public cloud technology. The cloud service system includes: a computing node cluster, a smart network interface card (NIC) cluster, and a storage node cluster. The computing node cluster includes multiple computing nodes. The smart NIC cluster includes multiple smart NICs. The storage node cluster includes multiple storage nodes. The multiple computing nodes include a target computing node. A virtual machine manager and virtual instances for implementing tenant services run on the target computing node. The virtual instances are mounted with cloud disks obtained by simulating devices based on the storage nodes. The virtual machine manager is used to obtain the first access request from the virtual instance for the cloud disk, add the identifier of the target compute node to the first access request to obtain a second access request, and send the second access request to the first smart network interface card (NIC). The first and second access requests carry the disk information of the cloud disk. The first smart network interface card is one of multiple smart network interface cards. The first smart network interface card is used to forward the second access request to the target storage node indicated by the disk information, based on the identifier of the target compute node carried in the second access request. The target storage node is one of multiple storage nodes. The target storage node is used to respond to the second access request and send an access response to the virtual instance through the first smart network interface card and the virtual machine manager.

[0007] As can be seen from this, since the virtual machine manager can add the identifier of the target computing node to the first access request, and the first smart network card can verify whether the target computing node has access to the cloud disk based on the identifier of the target computing node carried in the received second access request, it is equivalent to implementing access control of the cloud disk at the granularity of the computing node, rather than controlling the access control of the cloud disk at the granularity of the smart network card or the storage client in the smart network card. In this way, regardless of whether the smart network card and the computing node are configured one-to-one or many-to-many, the storage client in the smart network card can accurately determine the computing node with access to the cloud disk, and can control the access control of the cloud disk based on the computing node to which the access request belongs, thereby ensuring the data consistency of the cloud disk through the control of the access control of the cloud disk. Therefore, this application can ensure the data consistency of the cloud disk in the smart network card pooling scenario.

[0008] In one possible implementation, the virtual machine manager is further configured to obtain a first permission acquisition request sent by a virtual instance, add the identifier of the target compute node to the first permission acquisition request to obtain a second permission acquisition request, and then send the second permission acquisition request to the virtual instance.The smart network interface card (NIC) sends a second permission acquisition request. Both the first and second permission acquisition requests are used to acquire access permissions to the cloud disk. The second smart NIC is one of multiple smart NICs. The second smart NIC is used to forward the second permission acquisition request to the management node of the storage node cluster. When the target computing node has the conditions to access the cloud disk, the management node sends a first notification to the multiple smart NICs based on the second permission acquisition request. The first notification is used to indicate that the target computing node has access permissions to the cloud disk. The multiple smart NICs are used to update their own configuration based on the first notification. The updated configuration indicates that the target computing node has access permissions to the cloud disk. In this way, locking of the cloud disk can be achieved at the granularity of the computing node.

[0009] In one possible implementation, after determining that the target computing node has the conditions to access the cloud disk, the management node may first generate metadata indicating that the target computing node has access permissions to the cloud disk based on the second permission acquisition request, persist the metadata, and send the first notification to the multiple smart NICs after the metadata persistence is completed.

[0010] Since the metadata is used to indicate the access permissions to the cloud disk, the main purpose of the metadata is to indicate the access permissions to the cloud disk. In one possible implementation, the third smart network interface card (NIC) is used to obtain metadata when the configuration information indicating access permissions to the cloud disk is lost, and update the configuration indicating access permissions to the cloud disk based on the metadata. The third smart NIC is one of multiple smart NICs.

[0011] In one possible implementation, the virtual machine manager is also used to obtain a first permission release request sent by the virtual instance, add the identifier of the target compute node to the first permission release request to obtain a second permission release request, and send the second permission release request to the fourth smart NIC. Both the first permission release request and the second permission release request are used to indicate the cancellation of access permissions to the cloud disk. The fourth smart NIC is one of multiple smart NICs. The fourth smart NIC is used to forward the second permission release request to the management node of the storage node cluster. The management node is used to send a second notification to multiple smart NICs based on the second permission release request. The second notification is used to indicate the cancellation of access permissions to the cloud disk. The multiple smart NICs are used to update their own configuration based on the second notification. The updated configuration indicates that the target compute node does not have access permissions to the cloud disk. In this way, the lock release of the cloud disk can be implemented at the granularity of the compute node.

[0012] In one possible implementation, the management node is specifically used to delete metadata indicating that the target computing node has access to the cloud disk based on the second permission release request, and send a second notification to multiple smart network cards.

[0013] In one possible implementation, the virtual machine manager is also used to obtain a first permission clearing request sent by the virtual instance, and send a first permission clearing request to the fifth smart network card. The first permission clearing request is used to indicate the unmounting of the cloud disk.The fifth smart network interface card (NIC) is one of multiple smart NICs, and all virtual instances of the cloud disk on the compute nodes are granted access to the cloud disk. The fifth smart NIC is used to forward a first permission clearing request to the management node of the storage node cluster. The management instruction manual, page 2 / 28, CN 121173485 A, states that the node is used to send a third notification to multiple smart NICs based on the first permission clearing request. The third notification is used to instruct the compute nodes on which all virtual instances with cloud disks are mounted to cancel their access to the cloud disk. The multiple smart NICs are used to update their own configuration based on the third notification. The updated configuration indicates that all compute nodes on which virtual instances with cloud disks are mounted do not have access to the cloud disk. In this way, the access to the cloud disk can be released for all compute nodes on which virtual instances with cloud disks are mounted.

[0014] In one possible implementation, the management node is specifically used to delete all metadata indicating that the compute nodes have access to the cloud disk based on the first permission clearing request and send a third notification to multiple smart NICs.

[0015] In a second aspect, this application provides a cloud service provision method based on public cloud technology. This cloud service provision method is applied to a cloud service system. The cloud service system includes: a compute node cluster, a smart NIC cluster, and a storage node cluster. The compute node cluster includes multiple compute nodes. The smart NIC cluster includes multiple smart NICs. The storage node cluster includes multiple storage nodes. The multiple compute nodes include a target compute node. The target compute node runs a virtual machine manager and virtual instances used to implement tenant services. The virtual instances are mounted with cloud disks obtained through device simulation based on the storage nodes. The cloud service provision method includes: the virtual machine manager obtaining a first access request from the virtual instance for the cloud disk, adding the identifier of the target compute node to the first access request to obtain a second access request, and sending the second access request to a first smart NIC. Both the first and second access requests carry disk information for the cloud disk. The first smart NIC is one of multiple smart NICs. The first smart NIC, based on the identifier of the target compute node carried in the second access request, determines that the target compute node has access permissions to the cloud disk, and forwards the second access request to the target storage node indicated by the disk information. The target storage node is one of multiple storage nodes. The target storage node responds to the second access request and sends an access response to the virtual instance through the first smart NIC and the virtual machine manager.

[0016] In one possible implementation, the cloud service provision method further includes: a virtual machine manager obtaining a first permission acquisition request sent by a virtual instance, adding the identifier of a target computing node to the first permission acquisition request to obtain a second permission acquisition request, and sending the second permission acquisition request to a second smart network interface card (NIC), wherein both the first permission acquisition request and the second permission acquisition request are used to obtain access permissions to the cloud disk, and the second smart network interface card is one of a plurality of smart network interface cards; the second smart network interface card...The card forwards a second permission acquisition request to the management node of the storage node cluster; when the target computing node has the conditions to access the cloud disk, the management node sends a first notification to multiple smart network cards based on the second permission acquisition request, the first notification being used to indicate that the target computing node has access to the cloud disk; the multiple smart network cards update their own configuration based on the first notification, the updated configuration indicating that the target computing node has access to the cloud disk.

[0017] In one possible implementation, when the target computing node has the conditions to access the cloud disk, the management node sends a first notification to multiple smart network cards based on the second permission acquisition request, including: when the target computing node has the conditions to access the cloud disk, the management node generates metadata indicating that the target computing node has access to the cloud disk based on the second permission acquisition request, persists the metadata, and sends a first notification to multiple smart network cards after the metadata persistence is completed.

[0018] In one possible implementation, the cloud service provision method further includes: when the third smart network card loses the configuration information indicating access to the cloud disk, it acquires the metadata and updates the configuration indicating access to the cloud disk based on the metadata, the third smart network card being one of multiple smart network cards.

[0019] In one possible implementation, the cloud service provision method further includes: a virtual machine manager obtaining a first permission release request sent by a virtual instance, adding the identifier of the target computing node to the first permission release request to obtain a second permission release request, and sending the second permission release request to a fourth smart network interface card (NIC). Both the first and second permission release requests are used to indicate the cancellation of access permissions to the cloud disk. The fourth smart network interface card is one of multiple smart network interface cards. The fourth smart network interface card forwards the second permission release request to the management node of the storage node cluster. Based on the second permission release request (page 3 / 28, CN 121173485 A), the management node sends a second notification to multiple smart network interface cards. The second notification is used to indicate the cancellation of access permissions to the cloud disk. The multiple smart network interface cards update their own configurations based on the second notification. The updated configuration indicates that the target computing node does not have access permissions to the cloud disk.

[0020] In one possible implementation, the management node sending a second notification to multiple smart network interface cards based on the second permission release request includes: the management node deleting metadata indicating that the target computing node has access permissions to the cloud disk based on the second permission release request, and sending the second notification to multiple smart network interface cards.

[0021] In one possible implementation, the cloud service provision method further includes: a virtual machine manager obtaining a first permission clearing request sent by a virtual instance, and sending a first permission clearing request to a fifth smart network interface card (NIC), wherein the first permission clearing request is used to instruct the computing nodes where all virtual instances mounted with cloud disks reside to cancel their access permissions to the cloud disks; the fifth smart network interface card (NIC)...The network interface card (NIC) is one of multiple smart NICs; the fifth smart NIC forwards a first permission clearing request to the management node of the storage node cluster; based on the first permission clearing request, the management node sends a third notification to the multiple smart NICs, the third notification being used to instruct the compute nodes where all virtual instances mounted with cloud disks are located to cancel their access permissions to the cloud disks; the multiple smart NICs update their own configurations based on the third notification, the updated configuration indicating that the compute nodes where all virtual instances mounted with cloud disks are located do not have access permissions to the cloud disks.

[0022] In one possible implementation, the management node sending a third notification to the multiple smart NICs based on the first permission clearing request includes: the management node deleting all metadata indicating that the compute nodes have access permissions to the cloud disks based on the first permission clearing request, and sending a third notification to the multiple smart NICs.

[0023] In a third aspect, this application provides a computing node based on public cloud technology. The computing node runs a virtual machine manager and a virtual instance for implementing tenant services. The virtual instance is mounted with a cloud disk obtained by simulating a storage node. The virtual machine manager is used to obtain a first access request from the virtual instance for the cloud disk, add the identifier of the computing node to the first access request to obtain a second access request, and send the second access request to a first smart network interface card (NIC). The first and second access requests carry disk information of the cloud disk. The virtual machine manager is also used to receive an access response sent by the first smart NIC for the second access request.

[0024] In one possible implementation, the virtual machine manager is further used to obtain a first permission acquisition request sent by the virtual instance, add the identifier of the computing node to the first permission acquisition request to obtain a second permission acquisition request, and send the second permission acquisition request to a second smart NIC. Both the first and second permission acquisition requests are used to obtain access permissions to the cloud disk. The virtual machine manager is also used to receive a permission acquisition response sent by the second smart NIC for the second permission acquisition request.

[0025] In one possible implementation, the virtual machine manager is further configured to obtain a first permission release request sent by a virtual instance, add the identifier of the compute node to the first permission release request to obtain a second permission release request, and send the second permission release request to a fourth smart network interface card (NIC). Both the first and second permission release requests are used to indicate the cancellation of access permissions to the cloud disk. The virtual machine manager is also configured to receive a permission release response sent by the fourth smart network interface card in response to the second permission release request.

[0026] In one possible implementation, the virtual machine manager is further configured to obtain a first permission clearing request sent by a virtual instance, and send a first permission clearing request to a fifth smart network interface card (NIC). The first permission clearing request is used to indicate the cancellation of access permissions to the cloud disk by the compute nodes where all virtual instances mounted on the cloud disk reside. The fifth smart network interface card is one of multiple smart network interfaces.One of the cards; the virtual machine manager is also used to receive the permission clearing response sent by the fifth smart network card in response to the first permission clearing request.

[0027] In a fourth aspect, this application provides a cloud service provision method based on public cloud technology. The cloud service provision specification 4 / 28 pages 9 CN 121173485 A The method is applied to a computing node, on which a virtual machine manager and a virtual instance for implementing tenant services are running. The virtual instance is mounted with a cloud hard disk obtained by simulating a device based on a storage node. The cloud service provision method includes: the virtual machine manager obtains a first access request from the virtual instance for the cloud hard disk, adds the identifier of the computing node to the first access request to obtain a second access request, and sends the second access request to the first smart network card. The first access request and the second access request carry disk information of the cloud hard disk; the virtual machine manager receives the access response sent by the first smart network card in response to the second access request.

[0028] In one possible implementation, the cloud service provision method further includes: a virtual machine manager obtaining a first permission acquisition request sent by a virtual instance, adding the identifier of a compute node to the first permission acquisition request to obtain a second permission acquisition request, and sending the second permission acquisition request to a second smart network interface card (NIC), wherein both the first permission acquisition request and the second permission acquisition request are used to obtain access permissions to the cloud disk; and the virtual machine manager receiving a permission acquisition response sent by the second smart network interface card in response to the second permission acquisition request.

[0029] In one possible implementation, the cloud service provision method further includes: a virtual machine manager obtaining a first permission release request sent by a virtual instance, adding the identifier of a compute node to the first permission release request to obtain a second permission release request, and sending the second permission release request to a fourth smart network interface card (NIC), wherein both the first permission release request and the second permission release request are used to indicate the cancellation of access permissions to the cloud disk; and the virtual machine manager receiving a permission release response sent by the fourth smart network interface card in response to the second permission release request.

[0030] In one possible implementation, the cloud service provision method further includes: a virtual machine manager obtaining a first permission clearing request sent by a virtual instance, and sending the first permission clearing request to a fifth smart network interface card (NIC). The first permission clearing request is used to instruct the computing nodes where all virtual instances mounted on cloud disks reside to cancel their access permissions to the cloud disks. The fifth smart network interface card is one of a plurality of smart network interface cards (NICs). The virtual machine manager receives a permission clearing response sent by the fifth smart network interface card in response to the first permission clearing request.

[0031] In a fifth aspect, this application provides a smart network interface card based on public cloud technology. The smart network interface card includes a transceiver module and a processing module. The transceiver module is used to receive a second access request sent by a virtual machine manager. The second access request carries disk information of the cloud disk requested by the virtual instance managed by the virtual machine manager and the computing node where the virtual machine manager resides.The processing module is used to determine whether the computing node where the virtual machine manager is located has access to the cloud disk based on the identifier of the target computing node carried in the second access request; the transceiver module is also used to forward the second access request to the target storage node indicated by the disk information if the computing node where the virtual machine manager is located has access to the cloud disk; the transceiver module is also used to receive the access response of the target storage node to the second access request and send the access response to the virtual machine manager.

[0032] In one possible implementation, the processing module is also used to obtain metadata indicating that the computing node has access to the cloud disk when the configuration information indicating the access permission of the cloud disk is lost, and update the configuration indicating the access permission of the cloud disk based on the metadata.

[0033] In a sixth aspect, this application provides a cloud service provision method based on public cloud technology. The cloud service provision method is applied to a smart network interface card (NIC). The cloud service provision method includes: the smart NIC receiving a second access request sent by a virtual machine manager (VM), the second access request carrying disk information of a virtual instance managed by the VM manager requesting access to a cloud disk and an identifier of the computing node where the VM manager is located; the smart NIC determining whether the computing node where the VM manager is located has access to the cloud disk based on the identifier of the target computing node carried in the second access request; the smart NIC forwarding the second access request to the target storage node indicated by the disk information if the computing node where the VM manager is located has access to the cloud disk; the smart NIC receiving an access response from the target storage node in response to the second access request and sending the access response to the VM manager.

[0034] In one possible implementation, the cloud service provision method further includes: when the smart NIC loses configuration information indicating access to the cloud disk, it obtains metadata indicating that the computing node has access to the cloud disk, and updates the configuration indicating access to the cloud disk based on the metadata.

[0035] In a seventh aspect, this application provides a storage node based on public cloud technology. The storage node includes: a transceiver module and a processing module; the transceiver module is used to acquire a second permission acquisition request sent by a smart network card, the second permission acquisition request carrying an identifier of a computing node, the second permission acquisition request being used to acquire the computing node's access permission to a cloud hard drive obtained by device simulation based on the storage node; the processing module is used to determine whether the computing node has the conditions to access the cloud hard drive based on the identifier of the computing node carried in the second permission acquisition request; the transceiver module is also used to send a first notification to the smart network card based on the second permission acquisition request when the computing node has the conditions to access the cloud hard drive, the first notification being used to indicate that the computing node has the access permission to the cloud hard drive.

[0036] In one possible implementation, the processing module is further used to, when the computing node has the conditions to access the cloud hard drive...At that time, based on the second permission acquisition request, metadata indicating that the computing node has access to the cloud disk is generated, the metadata is persisted, and after the metadata persistence is completed, a first notification is sent to the smart network card.

[0037] In one possible implementation, the transceiver module is further used to acquire a second permission release request sent by the smart network card. The second permission release request carries the identifier of the computing node and is used to indicate the cancellation of the computing node's access to the cloud disk.

[0038] The transceiver module is further used to send a second notification to the smart network card based on the second permission release request. The second notification is used to indicate the cancellation of the computing node's access to the cloud disk.

[0039] In one possible implementation, the transceiver module is specifically used to delete the metadata indicating that the computing node has access to the cloud disk based on the second permission release request and send a second notification to the smart network card.

[0040] In one possible implementation, the transceiver module is further configured to obtain a first permission clearing request sent by the smart network card, the first permission clearing request being used to instruct the computing nodes where all virtual instances with mounted cloud disks reside to cancel their access permissions to the cloud disks; the transceiver module is further configured to send a third notification to the smart network card based on the first permission clearing request, the third notification being used to instruct the computing nodes where all virtual instances with mounted cloud disks reside to cancel their access permissions to the cloud disks.

[0041] In one possible implementation, the transceiver module is specifically configured to delete all metadata indicating that the computing nodes have access permissions to the cloud disks based on the first permission clearing request, and send a third notification to the smart network card.

[0042] In an eighth aspect, this application provides a cloud service provision method based on public cloud technology. This cloud service provision method is applied to a storage node. The method includes: a storage node receiving a second permission acquisition request sent by a smart network interface card (NIC), the second permission acquisition request carrying an identifier of a computing node, the second permission acquisition request being used to acquire access permissions of the computing node to a cloud hard drive obtained through device simulation based on the storage node; the storage node determining whether the computing node has the conditions to access the cloud hard drive based on the identifier of the computing node carried in the second permission acquisition request; and the storage node sending a first notification to the smart NIC based on the second permission acquisition request when the computing node has the conditions to access the cloud hard drive, the first notification indicating that the computing node has access permissions to the cloud hard drive.

[0043] In one possible implementation, the storage node sending a first notification to the smart NIC based on the second permission acquisition request when the computing node has the conditions to access the cloud hard drive includes: the storage node generating metadata indicating that the computing node has access permissions to the cloud hard drive based on the second permission acquisition request, persisting the metadata, and sending the first notification to the smart NIC after completing the persistence of the metadata.

[0044] In one possible implementation, the cloud service provision method further includes: the storage node obtaining the smart network card information.Page 6 / 28, CN 121173485 A: A second permission release request is sent, the second permission release request carries the identifier of the computing node, and the second permission release request is used to indicate the cancellation of the computing node's access permission to the cloud disk; the storage node sends a second notification to the smart network card based on the second permission release request, the second notification is used to indicate the cancellation of the computing node's access permission to the cloud disk.

[0045] In one possible implementation, the storage node sends a second notification to the smart network card based on the second permission release request, including: the storage node deletes the metadata indicating that the computing node has access permission to the cloud disk based on the second permission release request, and sends a second notification to the smart network card.

[0046] In one possible implementation, the cloud service providing method further includes: the storage node obtains a first permission clearing request sent by the smart network card, the first permission clearing request is used to indicate the cancellation of the access permission of the computing node where all virtual instances with cloud disks are mounted to the cloud disk; the storage node sends a third notification to the smart network card based on the first permission clearing request, the third notification is used to indicate the cancellation of the access permission of the computing node where all virtual instances with cloud disks are mounted to the cloud disk.

[0047] In one possible implementation, the storage node sends a third notification to the smart network card based on a first permission clearing request, including: the storage node deletes all metadata indicating that the computing node has access to the cloud disk based on the first permission clearing request, and sends a third notification to the smart network card.

[0048] In a ninth aspect, this application provides a computing device, including a memory and a processor, the memory storing program instructions, and the processor executing the program instructions to perform the methods provided in the fourth, sixth, and eighth aspects of this application and any possible implementation thereof.

[0049] In a tenth aspect, this application provides a computing device cluster, including multiple computing devices, the multiple computing devices including multiple processors and multiple memories, the multiple memories storing program instructions, and the multiple processors executing the program instructions, causing the computing device cluster to perform the methods provided in the second, fourth, sixth, and eighth aspects of this application and any possible implementation thereof.

[0050] In an eleventh aspect, this application provides a computer-readable storage medium, which is a non-volatile computer-readable storage medium, comprising program instructions that, when executed on a computing device, cause the computing device to perform the methods provided in the second, fourth, sixth, and eighth aspects of this application and any possible implementation thereof.

[0051] In a twelfth aspect, this application provides a computer program product containing instructions that, when executed on a computer, cause the computer to perform the methods provided in the second, fourth, sixth, and eighth aspects of this application and any possible implementation thereof. Brief Description of the Drawings

[0052] FIG1 is a schematic diagram of a shared cloud hard drive provided in an embodiment of this application;

[0053] Figure 2 is a schematic diagram of a virtual machine a1 having access to a cloud disk a1 provided in an embodiment of this application;

[0054] Figure 3 is a schematic diagram of a virtual machine b1 having access to a cloud disk a1 provided in an embodiment of this application;

[0055] Figure 4 is a schematic diagram of multiple smart network cards being grouped into a resource pool provided in an embodiment of this application;

[0056] Figure 5 is a schematic diagram of an implementation scenario involving a cloud service provision method provided in an embodiment of this application;

[0057] Figure 6 is a schematic diagram of the deployment of basic resources provided in an embodiment of this application;

[0058] Figure 7 is a schematic diagram of a cloud service system provided in an embodiment of this application;

[0059] Figure 8 is a schematic diagram of determining whether access rights are available provided in an embodiment of this application;

[0060] Figure 9 is a schematic diagram of another cloud service system provided in an embodiment of this application; Specification 7 / 28 pages 12 CN 121173485 A

[0061] Figure 10 is a schematic diagram of obtaining access rights provided in an embodiment of this application;

[0062] Figure 11 is a schematic diagram of releasing access rights provided in an embodiment of this application;

[0063] Figure 12 is a flowchart of a cloud service provision method provided in an embodiment of this application;

[0064] Figure 13 is a flowchart of another cloud service provision method provided in an embodiment of this application;

[0065] Figure 14 is a flowchart of yet another cloud service provision method provided in an embodiment of this application;

[0066] Figure 15 is a flowchart of yet another cloud service provision method provided in an embodiment of this application;

[0067] Figure 16 is a flowchart of yet another cloud service provision method provided in an embodiment of this application;

[0068] Figure 17 is a flowchart of yet another cloud service provision method provided in an embodiment of this application;

[0069] Figure 18 is a flowchart of yet another cloud service provision method provided in an embodiment of this application;

[0070] Figure 19 is a flowchart of yet another cloud service provision method provided in an embodiment of this application;

[0071] Figure 20 is a structural schematic diagram of a computing device provided in an embodiment of this application;

[0072] Figure 21 is a structural schematic diagram of a computing device cluster provided in an embodiment of this application;

[0073] Figure 22 is a structural schematic diagram of another computing device cluster provided in an embodiment of this application. Detailed Description of Embodiments

[0074] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0075] For ease of understanding, the technologies and background involved in the embodiments of this application will be introduced below.

[0076] Cloud computing: Cloud computing is a type of distributed computing, referring to a network that uniformly manages and schedules a large number of computing and storage resources to provide on-demand services to users. These computing and storage resources are all...The computing equipment clusters set up in the data center are provided. Furthermore, cloud computing can provide users with various types of services, such as Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). Infrastructure as a Service provides virtual machines or other resources as a service to tenants. Platform as a Service provides a development platform as a service to tenants. Software as a Service provides applications (Apps) as a service to customers.

[0077] Internet data centers (IDCs) are facilities and related service systems that provide operation and maintenance for devices that centrally collect, store, process, and transmit data based on the Internet network. Conceptually, it can be understood as a public, commercial Internet "computer room," and it is also a professional IT service and an important infrastructure of the IT industry. IDC is not only a service concept but also a network concept; it constitutes part of the network infrastructure resources, like the backbone network and access network, providing a high-end data delivery service and high-speed access service. Generally, a tenant's offline IDC can be understood as the tenant's offline data center. It is a standardized telecommunications-grade data center environment established by the tenant using existing Internet communication lines and bandwidth resources to provide comprehensive services such as server hosting, rental, and related value-added services. A cloud data center is an Internet data center deployed using the basic resources owned by cloud vendors.

[0078] A resource pool is a collection of various hardware and software resources involved in a cloud data center. Usually, according to the type of resources, the resources in the resource pool can be divided into computing resources, storage resources, and network resources, etc.

[0079] Resource pooling refers to integrating multiple computing and storage resources together to form a unified resource library for unified dynamic allocation and management. Resource pooling can achieve a high degree of resource sharing, improve resource utilization, simplify resource management, and provide users with flexible on-demand allocation services.

[0080] Host (physical machine, PM): The physical resource used to carry virtualization technology. The host is also called a physical machine. Typically, the host used to deploy virtual instances is a physical server. A physical server has multiple physical devices. For example, physical...Servers have physical devices such as processors and memory. Multiple virtual instances can be deployed on a single host, and multiple virtual instances deployed on the same host share the host's physical resources. Depending on the usage, multiple virtual instances deployed on a single host may belong to the same tenant or to different tenants.

[0081] Virtualization is a resource management technology. Virtualization can abstract and transform various physical resources of a host, such as computing resources, network resources, and storage resources, to break down the indivisible barriers between the physical structures of the host, allowing tenants to use these resources in a better way than the original configuration. Resources obtained through virtualization are called virtualized resources, and virtualized resources are not limited by the existing physical resource setup method, location, or physical configuration.

[0082] Virtualized resources are usually provided to tenants in the form of virtual instances. Virtual instances can use the host's hardware resources and run on the host's operating system. Applications run in the virtual instances, and these applications are used to implement the tenant's business. The host's hardware resources can be used by one or more tenants at the granularity of virtual instances. Different virtual instances are isolated from each other, enabling tenants to use physical resources conveniently and flexibly under the premise of secure isolation, and greatly improving the utilization rate of physical resources. Typically, virtual instances can be virtual machines, containers, or independent processes (such as functions). Virtual instances can also be called cloud servers (elastic compute service, ECS) or elastic instances (different cloud service providers have different names).

[0083] Virtual machine (VM): refers to a complete computer system with complete hardware system functions, running in a completely isolated environment, simulated through virtualization technology. A subset of the instructions of a virtual machine can be processed in the host machine, while other instructions can be executed in a simulated manner. Virtual machines are also called virtual servers. A virtual machine can be regarded as a collection of several virtual devices, which have complete hardware system functions and run in a completely isolated environment. Virtual devices are obtained by virtualization technology based on physical devices that can share resources. For example, a virtual processor, obtained by virtualizing a processor based on virtualization technology, is a virtual device. For example, a training card virtually created based on a field-programmable gate array (FPGA) using virtualization technology is also a type of virtual device. For instance, the virtual machine in this application can be a kernel-based virtual machine (KVM). The tasks that can be performed on a server...All of these can be achieved in a virtual machine. When creating a virtual machine on a server, a portion of the physical machine's hard drive and memory capacity needs to be used as the virtual machine's hard drive and memory capacity. Each virtual machine has an independent hard drive and operating system, and the virtual machine's tenant can operate the virtual machine as if it were a server. The runtime environments (such as virtual machine applications, operating systems, and virtual hardware) in different virtual machines are completely isolated. Communication between different virtual machines requires forwarding network packets through the virtual machine manager.

[0084] Containers utilize the namespace and cgroup technologies supported by the Linux kernel to isolate the application process and its dependent packages (runtime environment bins / libs, specifically all files required to run the application) in an independent runtime environment. Containers provide a lightweight virtual runtime environment. Containers can be obtained by packaging all the tenant's application code, libraries, and dependencies into an image. When the image is executed, the image runs in a virtual runtime environment. At this time, the container is a runtime instance of the image, similar to a lightweight sandbox, which can be started, stopped, and deleted. The infrastructure of a container can be server hardware or virtual machines in the cloud (i.e., containers can also be deployed in virtual machines). The operating system uses the Linux kernel and supports namespaces and cgroups. Namespaces are used to isolate processes. cgroups are used to allocate process resources, specifically the virtual processors and memory allocated to the process. The container engine is similar to a virtual machine manager and runs in the operating system to manage containers. Compared with the characteristic of virtual machines having their own operating system, containers do not have an operating system. Containers run as processes in the host machine's operating system, so containers start up faster than virtual machines, making them particularly suitable for lightweight applications. A single host machine can run thousands of containers (processes) simultaneously.

[0085] Network interface card (NIC): also known as a network interface controller (NIC), network adapter, or LAN receiver, is a type of computer hardware designed to allow hosts or computing devices to communicate over a network.

[0086] Memory: Also known as internal memory or main memory, its function is to temporarily store the data processed by the CPU, as well as the data exchanged with external storage devices such as hard drives.

[0087] Quality of Service (QoS) is a technology for effectively managing network resources. QoS provides end-to-end quality of service guarantees for various services based on their different needs. With limited bandwidth resources, QoS allows different traffic flows to compete unequally for network resources, enabling it to provide better service capabilities for specified network communications. For example, voice,Video and important data applications can receive priority service in network devices.

[0088] In a cloud storage scenario, as shown in Figure 1, a virtual machine (VM) is set up in the server, and the VM is mounted with a cloud disk. The cloud disk is obtained by simulating the storage capacity of the storage nodes in the storage node cluster. The VM's access request for the cloud disk is transmitted to the storage node cluster through the smart network card, and the storage node cluster responds to the access request. The storage node cluster's response to the access request includes the storage client of the storage node cluster processing the access request and the storage medium responding to the access request. Currently, the storage client of the storage node cluster is usually offloaded to the smart network card. Furthermore, since the cloud disk is actually a block device created by the storage client of the storage node cluster to the server's virtualization operating system, the VM's access to the cloud disk is usually submitted to the storage client in the smart network card through the virtualization operating system, and then the storage client submits the access to the storage node cluster. The technology of offloading the storage client to the smart network card is also called the smart network card-based storage client technology.

[0089] The smart network interface card (NIC) has a built-in central processing unit (CPU) and memory, etc., offloading the storage clients of the storage node cluster to the smart NIC, enabling the storage clients to utilize the processing power of the smart NIC to process virtual machine service data. This feature allows the smart NIC to process data without going through the server's CPU. Therefore, the system architecture that offloads the storage clients to the smart NIC can reduce the CPU consumption in the server, helping to improve the server's computing power and increase the server's available resources. For this reason, this system architecture is currently widely used in cloud vendor servers.

[0090] In cloud disk usage scenarios, there are situations where multiple virtual machines use the same cloud disk. This scenario is called a shared cloud disk scenario. In a shared cloud disk scenario, multiple virtual machines can simultaneously mount the same cloud disk and read and write to the cloud disk simultaneously. Shared cloud disk scenarios are common in cluster file system scenarios. Alternatively, in failover scenarios, when a virtual machine in the cluster fails, if a new virtual machine is used to replace the failed one, the cloud disk originally mounted on the failed virtual machine needs to be mounted on the new virtual machine. This scenario also involves shared cloud disks. In shared cloud disk scenarios, to prevent data corruption caused by multiple virtual machines simultaneously performing write operations on the same cloud disk, a locking mechanism is needed to ensure data consistency. For example, a Small Computer System Interface (SCSI)-3 locking mechanism can be introduced. Through the SCSI-3 locking mechanism, virtual machines can use reserved...Commands such as reservation and preemption grant access or exclusive rights to cloud disks.

[0091] Typically, the SCSI-3 locking mechanism has the following two types of commands:

[0092] 1. Persistent Reserve Out (PR OUT): Used to implement operations such as registration, reservation, preemption, and cleanup of the device (cloud disk in this application) by the application program in the virtual machine. These are modifications to lock permissions, which require persistence of the storage node cluster on the machine.

[0093] 2. Persistent Reserve In (PR IN): Used to implement operations such as reading the current registration and reservation information from the device (cloud disk in this application) by the application in the virtual machine. This operation does not require persistence of the storage node cluster on the machine. Registration information is used to indicate all computing nodes that can obtain access to the device. Permission information is used to indicate computing nodes that have access to the device.

[0094] In a shared cloud disk scenario, the virtual machine's access request to the cloud disk is handled by the storage client on the smart network interface card (NIC) that forwards the access request for the virtual machine. For example, as shown in Figure 1, cloud disk a is shared and mounted to virtual machine a and virtual machine b. Virtual machine a is set on server a. Virtual machine b is set on server b. Server a is configured with a corresponding smart NIC a, and the access request from virtual machine a to cloud disk a is handled by storage client a on smart NIC a. Server b is configured with a corresponding smart NIC b, and the access request from virtual machine b to cloud disk a is handled by storage client b on smart NIC b. Since there is a one-to-one correspondence between the server and the smart NIC, after introducing a SCSI-3 locking mechanism based on cloud disks, the locking permissions of cloud disks are managed at the storage client level. For example, as shown in Figure 2, when virtual machine a1 has access permissions to cloud disk a1, the locking permission record indicates that storage client a on smart NIC a has the permission to access cloud disk a1. At this point, all virtual machines (i.e., a1 to an) using smart NIC a on server a, storing client a, can access cloud disk a1, while all virtual machines on other servers cannot access cloud disk a1. When access permissions for cloud disk a1 need to be switched to virtual machine b, as shown in Figure 3, virtual machine b will preempt the lock, acquire access permissions for cloud disk a1, and revoke virtual machine a's access permissions to cloud disk a1. Correspondingly, the lock permission record will switch to smart NIC b storing client b having permission to access cloud disk a1. At this point, all virtual machines (i.e., b1 to bm) using smart NIC b storing client b on server b can access cloud disk a1.Cloud disk a1, all virtual machines on server a using smart network interface card a and storage client a can no longer access cloud disk a1.

[0095] However, with the evolution of resource pooling, it has become a trend to group smart network interfaces into a resource pool. For example, the architecture shown in Figure 1 has evolved into the architecture shown in Figure 4. As shown in Figure 4, multiple smart network interfaces in the same rack are grouped into a smart network interface pool. Virtual machine access requests can be sent to any smart network interface in the smart network interface pool, and the storage client in the smart network interface that receives the access request forwards the access request to the storage node cluster. Compared with the architecture shown in Figure 1, after smart network interface resource pooling, the correspondence between servers and smart network interfaces becomes a many-to-many relationship, and cloud disk access requests can be processed by any smart network interface among multiple smart network interfaces in the smart network interface pool. This causes the original SCSI-3 locking mechanism with storage client as the granularity to become invalid. For example, when the lock permission record shows that a certain storage client has lock permissions, since multiple server access requests may be handled by this storage client, the server with lock permissions cannot be accurately determined based on the lock permission record, resulting in the inability to guarantee the data consistency of the cloud disk through the SCSI-3 lock mechanism.

[0096] In view of this, this application embodiment provides a cloud service provision method and cloud service system based on public cloud technology. The cloud service system includes: a compute node cluster, a smart network card cluster, and a storage node cluster. The compute node cluster includes multiple compute nodes. The smart network card cluster includes multiple smart network cards. The storage node cluster includes multiple storage nodes. The multiple compute nodes include a target compute node. A virtual machine manager and a virtual instance for implementing tenant services are running on the target compute node. The virtual instance is mounted with a cloud disk obtained by device simulation based on the storage node. In this cloud service system, after the virtual instance accesses the cloud disk, the virtual machine manager can obtain the first access request of the virtual instance for the cloud disk, add the identifier of the target compute node to the first access request to obtain a second access request, and send the second access request to the first smart network card. After receiving the second access request, the first smart network interface card (NIC) can determine whether the target computing node has access to the cloud disk based on the identifier of the target computing node carried in the second access request. If the target computing node has access to the cloud disk, the NIC forwards the second access request to the target storage node indicated by the disk information carried in the second access request. Upon receiving the second access request, the target storage node responds to the second access request and sends an access response to the virtual instance through the first smart NIC and the virtual machine manager.

[0097] It can be seen that, since the virtual machine manager can add the identifier of the target computing node to the first access request, and the first smart NIC can verify the target computing node based on the identifier of the target computing node carried in the received second access request...By specifying whether a compute node has access to the cloud disk, this approach achieves access control at the compute node level, rather than at the level of the smart network interface card (NIC) or the storage client within the NIC. This allows storage clients within the NIC to accurately identify the compute nodes with cloud disk access permissions, regardless of whether the NIC and compute node are configured in a one-to-one or many-to-many relationship. This enables them to control access permissions based on the compute node to which the access request belongs, thereby ensuring data consistency within the cloud disk. Therefore, this application can guarantee data consistency for cloud disks in NIC pooling scenarios. For example, this application enables storage node clusters to support SCSI-3 locks in NIC pooling scenarios, ensuring the implementation of shared volume features and thus guaranteeing data consistency based on cloud disks within the storage node cluster.

[0098] It should be noted that although this application describes the control of cloud disk access permissions using the compute node granularity as an example, it does not exclude the possibility that virtual machines or other units with fixed configurations with compute nodes can also be used as the granularity to control cloud disk access permissions. This application does not specifically limit this. Furthermore, when other granularities are used to control cloud disk access permissions, the purpose is still to carry a unique identifier for that other granularity in the access request sent by the compute node to the smart network card. For example, when it is a virtual machine granularity, the identifier of the virtual machine needs to be carried, and the identification of whether there is access permission to the cloud disk at that other granularity is determined based on the identifier information. For the implementation principle, please refer to the relevant description of the control of cloud disk access permissions using the compute node granularity as an example. This application will not elaborate on it.

[0099] This article describes the technical solution of this application in detail from multiple perspectives such as implementation scenarios, method flow, hardware devices, and software devices.

[0100] The implementation scenarios of the embodiments of this application are illustrated below.

[0101] Figure 5 is a schematic diagram of an implementation scenario involved in a cloud service provision method provided by an embodiment of this application. As shown in Figure 5, the implementation scenario includes: data center 1 and client 2. Data center 1 and client 2 can establish a communication connection through a network. Optionally, the network can be the Internet or other networks, which are not limited in this embodiment. Tenants can interact with data center 1 through client 2. For example, tenants can send cloud service requests and other information to data center 1 through client 2. Data center 1 responds based on the information sent by client 2.

[0102] Data center 1 is equipped with a large amount of infrastructure owned by cloud service providers, such as computing resources, storage resources, and network resources. For example, computing resources can be computing devices (such as servers) that can provide computing capabilities. As shown in Figure 5As shown, data center 1 includes a cloud management platform and infrastructure (not shown in Figure 5). The cloud management platform and infrastructure are connected through the data center's internal network. The cloud management platform is used to manage the infrastructure. The infrastructure is used to provide public cloud services. In this application, the infrastructure includes servers, smart network cards, and storage. The servers in the infrastructure are used to implement the computing node cluster in the cloud service system of this application, the smart network cards in the infrastructure are used to implement the smart network card cluster in the cloud service system of this application, and the storage in the infrastructure is used to implement the storage node cluster in the cloud service system of this application. Virtual instances used to implement tenant services can be optionally deployed in the computing nodes of the computing node cluster. Tenants can send cloud service requests and related information to the computing nodes through their client 2. The computing nodes can process the cloud service requests and related information and provide cloud services to the tenants based on the processed cloud service requests and related information.

[0103] The cloud management platform can be logically divided into: tenant console, computing management service, network management service, storage management service, authentication service, and image management service. The tenant console provides an interface or application program interface (API) for interaction with tenants. The compute management service is used to manage servers running virtual instances and bare metal servers. The network management service is used to manage network services (such as gateways, firewalls, etc.). The storage management service is used to manage storage services (such as data bucket services). The authentication service is used to manage tenant accounts and passwords. The image management service is used to manage images of virtual instances.

[0104] In the implementation scenario shown in Figure 5, multiple servers are set up in a data center. The servers include a hardware layer and a software layer. The hardware layer is the conventional configuration of the server. The hardware layer deploys hardware devices such as processors, memory, network cards, disks, and buses. The software layer includes the operating system installed and running on the server. The operating system relative to the virtual machine can be called the host operating system. The host operating system runs a virtual machine manager (VMM, also known as a hypervisor). The role of the virtual machine manager is to realize the compute virtualization, network virtualization, and storage virtualization of the virtual machine, and to manage the virtual machine.

[0105] The virtual machine manager runs a cloud management platform client. The cloud management platform client can receive control plane commands sent by the cloud management platform, create virtual instances on the server according to the control plane commands, and perform full lifecycle management of the virtual instances. For example, the cloud management platform client can monitor the hardware resource usage of the server in real time and report it to the cloud management platform. When the cloud management platform confirms that a virtual instance needs to be created on a certain server, it will send a command to that server.The cloud management platform client on the server sends a virtual instance creation command. After receiving the command, the cloud management platform client creates a virtual instance on the server. In this way, tenants can create, manage, log in, and operate virtual instances in the data center through the cloud management platform.

[0106] The server can be used to run virtual machines of different specifications. Virtual machine specifications are divided into: general computing type, memory optimized type, ultra-large memory type, etc. Each type has specific specifications. After the tenant selects the virtual machine specification, the cloud management platform selects a server in the data center that supports the specification and determines that the server has sufficient idle hardware resources. Then, it creates a virtual machine with the specified specification on the server. By configuring the server through the cloud management platform, it is possible to analyze and plan the server hardware resources and plan the corresponding computing products of the physical hardware according to the server's hardware performance, such as planning virtual machines of different specifications to meet the differentiated needs of different tenants. Furthermore, based on the performance differences of virtual machines of different specifications, a differentiated pricing strategy can be implemented. For example, high-performance virtual instances can be sold at a higher price, while ordinary performance virtual instances can be sold at a lower price, so that tenants can purchase virtual instances as needed.

[0107] In one implementation, as shown in Figure 6, the location of basic resources in a data center can be described by cloud resource deployment regions (regions) and availability zones (AZs). Tenants can choose to deploy cloud services based on resources in specific regions and AZs. Regions are divided based on geographical location and network latency. Using the same resource pool within the same region can be understood as sharing public services such as elastic computing, block storage, object storage, virtual private cloud (VPC) networks, elastic internet protocol (EIP) addresses, and images. Regions are divided into general regions and dedicated regions. A general region refers to a region that provides general cloud services to public tenants. A dedicated region refers to a dedicated region that carries the same type of business or provides business services to specific tenants. A region typically includes multiple AZs. Multiple AZs within a region are connected via high-speed fiber optic cables to meet the needs of tenants building high-availability systems across AZs. An AZ is a collection of one or more data centers as shown in Figure 6. Computing, network, and storage resources within an AZ are logically divided into multiple clusters.

[0108] Tenants can send instructions to the cloud management platform through their client 2 to create, manage, log in to, and operate virtual instances on the server, and use the cloud services provided by those virtual instances. For example, the cloud management platform can provide access...Interface. The access interface can be provided in the form of a user interface or an API. Tenants can operate the client to remotely access the access interface to register a cloud account and password on the cloud management platform (page 13 / 28 of the specification, CN 121173485 A), and log in to the cloud management platform using the cloud account and password. The cloud management platform can also authenticate the cloud account and password. After successful authentication, the tenant can further select and pay for a virtual instance of a specific specification (processor, memory, disk) on the cloud management platform. After the tenant successfully pays for the virtual instance, the cloud management platform provides the tenant with the remote login account and password for the purchased virtual instance. The tenant can use the remote login account and password to remotely log in to the virtual instance on the client, install and run the tenant's application in the virtual instance, and realize the tenant's business through the application.

[0109] The client 2 can be a computer, personal computer, laptop computer, mobile phone, smartphone, tablet computer, cloud host, portable mobile terminal, multimedia player, e-book reader, wearable device, smart home appliance, artificial intelligence device, smart wearable device, smart vehicle device or Internet of Things device, etc.

[0110] In one implementation, the cloud service provision method provided in this application embodiment can be implemented by running an executable program on a computing device in data center 1. Optionally, the cloud service provision method provided in this application embodiment can be applied to a cloud service system. The cloud service system can implement the cloud service provision method provided in this application embodiment by running the executable program of the cloud service provision method provided in this application embodiment. Furthermore, the executable program implementing the cloud service provision method can be presented in the form of an application installation package. After the computing node installs the application installation package, it can implement the cloud service provision method provided in this application embodiment by running the executable program therein.

[0111] It should be understood that the above content is an exemplary description of the implementation scenario of the cloud service provision method provided in this application embodiment, and does not constitute a limitation on the implementation scenario of the cloud service provision method. Those skilled in the art will know that as business needs change, the implementation scenario can be adjusted according to application needs, and this application embodiment does not specifically limit it. For example, this application is also applicable to the process of sending and receiving network data in a pooled scenario of a virtual network.

[0112] The cloud service system based on public cloud technology provided in this application embodiment will be described below.

[0113] Figure 7 is a schematic diagram of the structure of a cloud service system based on public cloud technology provided in an embodiment of this application. As shown in Figure 7, the cloud service system includes: a computing node cluster, a smart network interface card (NIC) cluster, and a storage node cluster. The computing node cluster includes multiple computing nodes, which are used to provide computing resources to the cloud service. The smart NIC cluster includes multiple smart NICs, which are used to provide network resources to the cloud service. The storage node cluster includes multiple storage nodes, which are used to provide network resources to the cloud service.Storage resources are provided to the cloud service. Multiple computing nodes include a target computing node. A virtual machine manager and a virtual instance for implementing tenant services run on the target computing node. The virtual instance is mounted with a cloud hard disk obtained by simulating the device based on the storage node. The virtual instance can use the computing resources provided by the computing node to implement the tenant's services, use the cloud hard disk to store the data required to implement the tenant's services, and use the smart network card to transmit the data required to implement the tenant's services via the network.

[0114] In this cloud service system, the virtual machine manager in the target computing node is used to obtain the first access request of the virtual instance in the target computing node for the cloud hard disk, add the identifier of the target computing node to the first access request to obtain the second access request, and send the second access request to the first smart network card. The first access request and the second access request carry the disk information of the cloud hard disk and the logical address of the data that the virtual instance needs to access in the cloud hard disk. The logical address is, for example, the logical block address (LBA) of the cloud hard disk. The first smart network card is one of multiple smart network cards.

[0115] The first smart network interface card (NIC) is used to forward the second access request to the target storage node indicated by the disk information of the cloud disk after receiving the second access request, based on the identifier of the target computing node carried in the second access request and if it is determined that the target computing node has access rights to the cloud disk. If the first smart network interface card determines that the target computing node does not have access rights to the cloud disk based on the identifier of the target computing node, it will send information indicating an access error to the virtual instance to notify the virtual instance that it cannot access the cloud disk.

[0116] The target storage node is used to respond to the second access request after receiving it, and send an access response to the virtual instance through the first smart network interface card and the virtual machine manager on pages 14 / 28 of the specification (CN 121173485 A). The second access request can be either a read request or a write request. When the second access request is a read request, the target storage node's response to the second access request includes: the target storage node obtaining the logical address to be accessed carried in the second access request and reading the data recorded in the physical address corresponding to the logical address. When the second access request is a write request, and it also carries data to be written, the target storage node's response to the second access request includes: the target storage node obtaining the logical address to be accessed and the data to be written from the second access request, and writing the data to be written to the physical address corresponding to the logical address to be accessed. The process of the target storage node sending an access response to the virtual instance through the first smart network interface card (NIC) and the virtual machine manager includes: the target storage node sending an access response to the first smart NIC, the first smart NIC sending an access response to the virtual machine manager, and the virtual machine manager sending an access response to the virtual instance. Sending the access response...The response process can be regarded as the reverse process of sending an access request. However, in the process of sending an access response, it is not necessary to verify the access permissions of the cloud disk. Therefore, the implementation process of sending an access response can refer to the implementation process of sending an access request. This application embodiment will not elaborate on it. It should be noted that when a storage client is deployed in the smart network card, the operations performed by the smart client in this application are all performed by the storage client in the smart network card. The operations on the smart network card are all operations on the storage client in the smart network card. They will not be distinguished below.

[0117] In one possible implementation, as shown in FIG8, when the virtual instance in the target computing node needs to access the cloud disk, it can issue a first access request for the cloud disk through its virtual kernel (as shown in the application IO in FIG8). The first access request will be sent to the virtual machine manager of the target computing node. After the virtual machine manager obtains the first access request, it first parses the first access request, and then adds the identifier of the target computing node (as shown in the host ID in FIG8) to the parsed first access request, so as to identify the source of the first access request through the identifier of the target computing node. Then, the virtual machine manager repackages the first access request with the identifier of the target compute node to obtain the second access request, and sends the second access request to the storage client in the first smart network card. After receiving the second access request, the storage client in the first smart network card parses the second access request to obtain the identifier of the target compute node and the disk information and logical address of the cloud disk used to indicate the virtual instance access. Then, it determines whether the target compute node has access rights to the cloud disk based on the identifier of the target compute node. If the target compute node has access rights to the cloud disk, it repackages the second access request and forwards the repackaged second access request to the target storage node indicated by the disk information. After receiving the second access request, the target storage node parses and responds to the second access request, and sends an access response to the virtual instance through the first smart network card and the virtual machine manager.

[0118] Wherein, when the access rights of the cloud disk are controlled by the SCSI-3 lock, after the virtual instance accesses the cloud disk, its virtual kernel will package the first access request into a request that satisfies the SCSI protocol. Accordingly, after receiving the first access request, the virtual machine manager parses the request using the SCSI protocol and adds the target compute node's identifier to the request header. Then, it re-encapsulates the first access request with the added target compute node identifier using the SCSI protocol to obtain the second access request. Upon receiving the second access request, the first smart network interface card (NIC) first parses it using the SCSI protocol, extracts the added target compute node identifier from the parsed request, removes the identifier from the second access request, and then parses the original SCSI protocol content within the second access request.Furthermore, since the storage node is used to process requests using the storage protocol, the first smart NIC needs to re-encapsulate the second access request using the storage protocol before forwarding it to the target storage node. Correspondingly, after receiving the second access request, the target storage node will parse the second access request using the storage protocol.

[0119] In the smart NIC pooling scenario, since the smart NIC cluster includes multiple smart NICs, the virtual machine manager needs to determine the first smart NIC from among the multiple smart NICs before sending the second access request to the first smart NIC. There are multiple ways to determine the first smart NIC from among multiple smart NICs. For example, the virtual machine manager uses a load balancing strategy to determine the first smart NIC from among multiple smart NICs. For example, the first access request carries the logical address of the data that the virtual instance needs to access in the cloud disk. When this logical address is represented by LBA, after obtaining the first access request, the virtual machine manager can obtain the LBA from the first access request and perform scattering addressing through the LBA to obtain the smart network card (i.e., the first smart network card) used to forward the second access request. The implementation method of scattering addressing through LBA can be: taking the modulus of the specified value using LBA to obtain the modulus value, and then querying the pre-set correspondence between multiple modulus values ​​and multiple smart network cards based on the obtained modulus value, and determining the smart network card corresponding to the obtained modulus value as the first smart network card.

[0120] Optionally, as shown in Figures 8 and 9, each computing node may optionally be equipped with a data routing module. The data routing module in the same computing node establishes a communication connection with the virtual machine manager, and each data routing module establishes a communication connection with multiple smart network cards. At this time, the implementation method of the virtual machine manager sending the second access request to the first smart network card includes: the virtual machine manager sends the second access request to the data routing module, and the data routing module sends the second access request to the first smart network card.

[0121] It should be noted that when the cloud service system includes a data routing module, the operation of determining the first smart network card among multiple smart network cards can also be performed by the data routing module. For example, after receiving the second access request, the data routing module determines the first smart network card among multiple smart network cards and then sends the second access request to the first smart network card. The implementation method of the data routing module determining the first smart network card among multiple smart network cards is described in the corresponding implementation method of the virtual machine manager determining the first smart network card among multiple smart network cards, and will not be elaborated here.

[0122] Further, as shown in Figures 8 and 9, the cloud service system provided in this application embodiment may also include a high-speed interconnect device. Each computing node establishes a communication connection with multiple smart network cards through this high-speed interconnect device. Then the virtual machine manager...The second access request sent by the processor to the first smart network interface card (NIC) is transmitted to the first smart NIC via a high-speed interconnect device. For example, when the compute node includes a data routing module and a high-speed interconnect device, the data routing module establishes a communication connection with the high-speed interconnect device, and the high-speed interconnect device establishes communication connections with multiple smart NICs. After receiving the second access request from the virtual machine manager, the data routing module forwards the second access request to the high-speed interconnect device, which then sends the second access request to the first smart NIC. In one possible implementation, the high-speed interconnect device is implemented via a high-speed interconnect protocol bus. The high-speed interconnect protocol can be selected as the Compute Express Link (CXL) protocol or the Lingqu Bus (also known as the UB bus) protocol. In this case, the high-speed interconnect device enables rapid transmission of the second access request, significantly reducing the protocol stack latency for sending the second access request.

[0123] As can be seen, in the cloud service system provided in this application embodiment, since the virtual machine manager can add the identifier of the target computing node to the first access request, and the first smart network card can verify whether the target computing node has access to the cloud disk based on the identifier of the target computing node carried in the received second access request, it is equivalent to implementing access control of the cloud disk at the granularity of the computing node, rather than controlling access control of the cloud disk at the granularity of the smart network card or the storage client in the smart network card. In this way, regardless of whether the smart network card and the computing node are configured one-to-one or many-to-many, the storage client in the smart network card can accurately determine the computing node with access to the cloud disk, and can control access control of the cloud disk based on the computing node to which the access request belongs, thereby ensuring data consistency of the cloud disk through access control of the cloud disk. Furthermore, the improvements in this application are mainly made on the virtual machine manager and the smart network card, and the virtual instance is not improved, making the improvements in this application transparent to the virtual instance, and the virtual instance does not need to be aware of the specific architecture of the virtual machine manager and the storage system, and will not have a negative impact on the implementation of tenant services.

[0124] The above describes the process by which the cloud service system responds to the access request to the cloud disk after the virtual instance triggers the access request, based on the access permissions of the virtual instance to the cloud disk as specified in the cloud disk specification (pages 16 / 28, CN 121173485 A). Since the process of controlling the access permissions to the cloud disk also depends on acquiring and releasing the access permissions of the cloud disk, the implementation process of the target computing node acquiring and releasing the access permissions of the cloud disk will be described next. The implementation process of the target computing node acquiring the access permissions of the cloud disk will be described first below.

[0125] Before accessing the cloud disk, the virtual instance in the target computing node needs to acquire the target computing node's access permissions to the cloud disk.Access permissions. As shown in Figure 10, when a virtual instance needs to obtain access permissions for the target compute node to the cloud disk, it can trigger a first permission acquisition request and send it to the virtual machine manager. The virtual machine manager is then used to obtain the first permission acquisition request sent by the virtual instance, add the identifier of the target compute node (i.e., the host ID in Figure 10) to the first permission acquisition request to obtain a second permission acquisition request (i.e., the first permission acquisition request + host ID in Figure 10), and send the second permission acquisition request to the second smart network interface card (NIC). Both the first and second permission acquisition requests are used to obtain access permissions for the target compute node to the cloud disk. The second smart network interface card is one of multiple smart network interface cards. The second smart network interface card is used to forward the second permission acquisition request to the management node of the storage node cluster. When the target compute node has the conditions to access the cloud disk, the management node is used to send a first notification to multiple smart network interface cards based on the second permission acquisition request. The first notification is used to indicate that the target compute node has access permissions for the cloud disk. The multiple smart network interface cards are used to update their own configuration based on the first notification. The updated configuration indicates that the target compute node has access permissions for the cloud disk. The condition that the target computing node has access to the cloud disk refers to the current state of the cloud disk allowing the target computing node to access it. For example, when the cloud disk is not locked by any computing node, the current state of the cloud disk allows the target computing node to access it, and at this time, the target computing node is considered to have the condition to access the cloud disk. For example, when the access permission of the cloud disk is controlled by SCSI-3 lock, the virtual instance can trigger the first permission acquisition request through the write lock / preemption lock operation of PR OUT, and both the first permission acquisition request and the second permission acquisition request are write lock requests using the SCSI-3 protocol.

[0126] It should be noted that the operation of determining whether the target computing node has the condition to access the cloud disk can also be performed by the second smart network card, and this application embodiment does not specifically limit it. For example, the second smart network card is used to forward the second permission acquisition request to the management node of the storage node cluster when the target computing node has the condition to access the cloud disk. Upon receiving a second permission request, the management node determines that the target compute node has the necessary permissions to access the cloud disk. Based on the second permission request, it sends a first notification to multiple smart network interface cards (NICs), causing each NIC to update its configuration to indicate that the target compute node has cloud disk access permissions. Furthermore, when the target compute node has the necessary permissions to access the cloud disk, the second smart NIC can also optionally update its own configuration based on the second permission request, ensuring the updated configuration indicates that the target compute node has cloud disk access permissions, before sending the second permission request to the management node. Therefore, upon receiving the second permission request, the management node sends notifications to all smart NICs except the second smart NIC.The other smart network cards send the first notification. Correspondingly, the other smart network cards among the multiple smart network cards, except for the second smart network card, update their own configurations based on the first notification. The updated configurations indicate that the target computing node has access to the cloud disk.

[0127] Optionally, after determining that the target computing node has the conditions to access the cloud disk, the management node may first generate metadata indicating that the target computing node has access to the cloud disk based on the second permission acquisition request, persist the metadata, and send the first notification to the multiple smart network cards after completing the persistence of the metadata. Here, the management node persists the metadata, which means storing the metadata in the non-volatile storage medium in the storage node cluster. It should be noted that before sending the first notification to the multiple smart network cards, the management node may also execute some other configurations in the storage node cluster that indicate that the target computing node has access to the cloud disk. These will not be listed here.

[0128] Since the metadata is used to indicate the access permissions of the cloud disk, the main purpose of the metadata is to indicate the access permissions of the cloud disk. In one possible implementation scenario, when the third smart network interface card (NIC) loses the configuration information indicating access permissions to the cloud disk, it obtains metadata and updates the configuration indicating access permissions to the cloud disk based on the metadata. The third smart NIC is one of multiple smart NICs. For example, when a smart NIC is powered off and restarted, it may lose the configuration information indicating access permissions to the cloud disk. At this time, since the management node has completed the persistence of the metadata indicating that the target computing node has access permissions to the cloud disk, the smart NIC can read the metadata and update the configuration indicating access permissions to the cloud disk based on the metadata. It should be noted that other components that need to maintain the access permissions to the cloud disk can also obtain the metadata and configure it according to the metadata so as to maintain the access permissions to the cloud disk according to the instructions of the metadata, thereby ensuring the data consistency of the cloud disk.

[0129] After the updated configurations of multiple smart NICs all indicate that the target computing node has access permissions to the cloud disk, the management node can send an access permission acquisition response to the target computing node through the second smart NIC to indicate that the target computing node has obtained access permissions to the cloud disk. In one possible implementation, after any one of the multiple smart network interface cards (NICs) updates its own configuration based on the first notification, that NIC sends a notification to the management node indicating that the configuration update is complete. Upon receiving notifications from all the smart NICs indicating that the configuration update is complete, the management node determines that all the smart NICs have completed the configuration indicating that the target computing node has access to the cloud disk.

[0130] It should be noted that in the process of the target computing node obtaining access to the cloud disk, from the virtual reality...For details on the implementation of the process from triggering the first access request to the management node sending the access response to the target compute node, please refer to the relevant descriptions of the process from the virtual instance triggering the first access request to the management node sending the access response to the virtual instance. For example, as shown in Figure 10, when the access permissions of the cloud disk are controlled through a SCSI-3 lock, after the virtual instance triggers the first access request, its virtual kernel will package the first access request into a request that conforms to the SCSI protocol. Correspondingly, after receiving the first access request, the virtual machine manager will parse the first access request using the SCSI protocol, add the identifier of the target compute node to the first access request, and then repackage the first access request with the added identifier of the target compute node using the SCSI protocol. After receiving the second access request, the first smart NIC will repackage the second access request using the storage protocol. Similarly, before sending the second access request to the smart NIC, it is necessary to determine the smart NIC used to transmit the second access request from among multiple smart NICs, and this determination of the smart NIC can be performed by the virtual machine manager or the data routing module. Similarly, when the cloud service system also includes a high-speed interconnect device, the second permission acquisition request can be quickly transmitted through the high-speed interconnect device.

[0131] The implementation process of releasing the access permission of the cloud disk is described below. Releasing the access permission of the cloud disk includes releasing the access permission of the target computing node itself to the cloud disk and releasing the access permission of all computing nodes where virtual instances with cloud disks are mounted to the cloud disk. The implementation process of the target computing node releasing the access permission of the target computing node itself to the cloud disk is described below.

[0132] As shown in Figure 11, when a virtual instance in the target computing node needs to release the access permission of the target computing node to the cloud disk, the virtual instance can trigger a first permission release request and send the first permission release request to the virtual machine manager. The virtual machine manager is also used to obtain the first permission release request sent by the virtual instance, add the identifier of the target computing node to the first permission release request to obtain a second permission release request, and send the second permission release request to the fourth smart network card. Both the first permission release request and the second permission release request are used to indicate the cancellation of the access permission of the target computing node to the cloud disk. For example, when access permissions for a cloud disk are controlled via a SCSI-3 lock, a virtual instance can trigger a first permission release request through a PR OUT lock release operation. Both the first and second permission release requests are lock release requests using the SCSI-3 protocol. The fourth smart NIC is one of multiple smart NICs. The fourth smart NIC is used to forward the second permission release request to the management node of the storage node cluster. The management node is used to forward the second permission release request to multiple smart NICs based on the second permission release request. (See page 18 / 28 of the specification, 23 CN 121173485 A)The smart network interface card (NIC) sends a second notification, which instructs the target computing node to cancel its access to the cloud disk. Multiple smart NICs are specifically used to update their own configurations based on the second notification. The updated configuration indicates that the target computing node does not have access to the cloud disk. It should be noted that after receiving the second permission release request, the fourth smart NIC can also update its own configuration based on the second permission release request, with the updated configuration indicating that the target computing node does not have access to the cloud disk. The management node then sends the second notification to the other smart NICs among the multiple smart NICs, excluding the fourth smart NIC. The other smart NICs update their own configurations based on the second notification.

[0133] Optionally, when the management node has pre-persisted metadata indicating that the target computing node has access to the cloud disk, after receiving the second permission release request, the management node can optionally first delete the metadata indicating that the target computing node has access to the cloud disk based on the second permission release request. After deleting the metadata, it sends the second notification to the multiple smart NICs. Wherein, when the management node persists the metadata, it means storing the metadata in a non-volatile storage medium in the storage node cluster; deleting the metadata means deleting the metadata from the non-volatile storage medium. It should be noted that before sending the second notification to multiple smart network cards, the management node can also execute some other configurations in the storage node cluster to indicate the release of the target compute node's access rights to the cloud disk. These will not be listed here.

[0134] After multiple smart network cards have completed the configuration update based on the second notification, the management node can send a permission release response to the target compute node through the fourth smart network card to indicate that the target compute node's access rights to the cloud disk have been released. In one possible implementation, after any one of the multiple smart network cards updates its own configuration based on the second notification, that smart network card sends a notification to the management node indicating that the configuration update has been completed. After receiving the notifications indicating that the configuration update has been completed from all the smart network cards, the management node determines that the multiple smart network cards have completed the configuration indicating that the target compute node does not have access rights to the cloud disk.

[0135] It should be noted that, in the process of releasing the target compute node's access permissions to the cloud disk, the implementation details from the virtual instance triggering the first permission release request to the management node sending the permission release response to the target compute node are as follows: Please refer to the relevant descriptions of the process from the virtual instance triggering the first access request to the management node sending the access response to the virtual instance. For example, when the access permissions of the cloud disk are controlled through a SCSI-3 lock, after the virtual instance triggers the first permission release request, its virtual kernel will package the first permission release request into a request that satisfies the SCSI protocol. Correspondingly, after the virtual machine manager receives the first permission release request, it will use the SCSI protocol to parse the first permission release request and send the response to the target compute node.After adding the identifier of the target computing node to the first permission release request, the first permission release request with the added identifier of the target computing node is re-encapsulated using the SCSI protocol. After receiving the second permission release request, the first smart network card will re-encapsulate the second permission release request using the storage protocol. Similarly, before sending the second permission release request to the smart network card, it is necessary to determine the smart network card used to transmit the second permission release request among multiple smart network cards, and the operation of determining the smart network card can be performed by the virtual machine manager or the data routing module. Similarly, when the cloud service system may also include a high-speed interconnect device, the second permission release request can be transmitted quickly through the high-speed interconnect device.

[0136] The following describes the implementation process of the target computing node releasing the access permissions of all computing nodes with cloud disks mounted on them to the cloud disks.

[0137] When a virtual instance in the target computing node needs to release the access permissions of all computing nodes with cloud disks mounted on them to the cloud disks, the virtual instance can trigger a first permission clearing request and send the first permission clearing request to the virtual machine manager. The virtual machine manager is also used to obtain the first permission clearing request sent by the virtual instance and forward the first permission clearing request to the fifth smart network interface card (NIC). The first permission clearing request is used to instruct all compute nodes where virtual instances with cloud disks are located to grant access permissions to the cloud disks. The fifth smart network interface card is one of multiple smart network interface cards. The fifth smart network interface card is used to forward the first permission clearing request to the management node of the storage node cluster. The node is used to send a third notification to multiple smart network interface cards based on the first permission clearing request. The third notification is used to instruct all compute nodes where virtual instances with cloud disks are located to cancel their access permissions to the cloud disks. Multiple smart network interface cards are used to update their own configuration based on the third notification. The updated configuration indicates that all compute nodes where virtual instances with cloud disks are located do not have access permissions to the cloud disks. It should be noted that after receiving the first permission clearing request, the fifth smart network interface card can also update its own configuration based on the first permission clearing request. The updated configuration indicates that all compute nodes where virtual instances with cloud disks are located do not have access permissions to the cloud disks. The management node then sends a third notification to all smart network cards except the fifth smart network card. The other smart network cards update their configurations based on the third notification.

[0138] Optionally, when the management node has pre-persisted metadata indicating that the computing node has access to the cloud disk, after receiving the first permission clearing request, the management node may optionally first delete all metadata indicating that the computing node has access to the cloud disk based on the first permission clearing request. After completing the deletion of the metadata, it sends a notification to the multiple smart network cards.Third notification. It should be noted that before sending the third notification to multiple smart network cards, the management node can also execute some other configurations in the storage node cluster to indicate the release of access permissions of all indicated computing nodes to the cloud disk. These will not be listed here.

[0139] After multiple smart network cards have completed the configuration update based on the third notification, the management node can send a permission clearing response to the target computing node through the fifth smart network card to indicate that the access permissions of all indicated computing nodes to the cloud disk have been cleared. In one possible implementation, after any one of the multiple smart network cards updates its own configuration based on the third notification, that smart network card sends a notification to the management node indicating that the configuration update has been completed. After receiving the notifications indicating that the configuration update has been completed from all the smart network cards, the management node determines that the multiple smart network cards have completed the configuration to indicate that all indicated computing nodes do not have access permissions to the cloud disk.

[0140] The difference between the process of the target compute node releasing the access permissions of all compute nodes containing virtual instances with cloud disks and the process of the target compute node releasing its own access permissions to cloud disks is that the virtual machine manager does not need to add the target compute node's identifier to the first permission clear request. Therefore, for the process of the target compute node releasing the access permissions of all compute nodes containing virtual instances with cloud disks, please refer to the relevant description of the process of the target compute node releasing its own access permissions to cloud disks; it will not be repeated here.

[0141] The operations above for acquiring and releasing access permissions to cloud disks are all operations performed on the access permissions of cloud disks. These operations can be operations performed on reserved locks. For example, acquiring access permissions to cloud disks is the operation of acquiring a reserved lock for cloud disks, and releasing access permissions to cloud disks is the operation of releasing a reserved lock for cloud disks. Correspondingly, there are also operations on cloud disks such as acquiring and releasing registration locks. In the locking mechanism, a compute node can only acquire a reserved lock for a cloud disk after it has a registration lock for the cloud disk. Therefore, compute nodes can also perform operations such as acquiring reserved locks, releasing their own reserved locks, and releasing registration locks on all compute nodes hosting virtual instances with mounted cloud disks. For the implementation process of a target compute node acquiring a reserved lock, please refer to the relevant description of the implementation process of a target compute node acquiring access permissions to cloud disks; it will not be repeated here. Similarly, for the implementation process of a target compute node releasing its own reserved lock, please refer to the relevant description of the implementation process of a target compute node releasing its own access permissions to cloud disks; it will not be repeated here. Finally, for the implementation process of a target compute node releasing registration locks on all compute nodes hosting virtual instances with mounted cloud disks, please refer to the relevant description of the implementation process of a target compute node releasing registration locks on all compute nodes hosting virtual instances with mounted cloud disks.The relevant descriptions of the implementation process of node access permissions to cloud disks are not repeated here.

[0142] It can be seen that since the virtual machine manager can add the target computing node's identifier to the first access request, and the first smart network card can verify whether the target computing node has access permissions to the cloud disk based on the identifier of the target computing node carried in the received second access request, it is equivalent to implementing access control of cloud disks at the granularity of computing nodes, rather than controlling access permissions of cloud disks at the granularity of smart network cards or storage clients in smart network cards. In this way, regardless of whether the smart network card and computing node are configured one-to-one or many-to-many, the storage clients in the smart network card can accurately determine the computing node with access permissions to the cloud disk, and can implement access control of cloud disks based on the computing node to which the access request belongs, thereby ensuring data consistency of cloud disks through access control of cloud disks. Therefore, this application can ensure data consistency of cloud disks in smart network card pooling scenarios. For example, this application enables the storage node cluster to support the SCSI-3 lock protocol in a smart NIC pooling scenario, ensuring the realization of shared volume characteristics in a smart NIC pooling scenario, and thus ensuring data consistency based on cloud disks in the storage node cluster.

[0143] The cloud service system of the embodiments of this application has been described above. Correspondingly, the embodiments of this application also provide a computing node based on public cloud technology. The computing node runs a virtual machine manager and a virtual instance for implementing tenant services. The virtual instance is mounted with a cloud disk obtained by device simulation based on the storage node. The virtual machine manager is used to obtain the first access request of the virtual instance for the cloud disk, add the identifier of the computing node to the first access request to obtain a second access request, and send the second access request to the first smart NIC. The first access request and the second access request carry the disk information of the cloud disk; the virtual machine manager is also used to receive the access response sent by the first smart NIC for the second access request.

[0144] In one possible implementation, the virtual machine manager is further configured to obtain a first permission acquisition request sent by the virtual instance, add the identifier of the compute node to the first permission acquisition request to obtain a second permission acquisition request, and send the second permission acquisition request to the second smart network card. Both the first permission acquisition request and the second permission acquisition request are used to obtain access permissions to the cloud disk. The virtual machine manager is also configured to receive a permission acquisition response sent by the second smart network card in response to the second permission acquisition request.

[0145] In one possible implementation, the virtual machine manager is further configured to obtain a first permission release request sent by the virtual instance, add the identifier of the compute node to the first permission release request to obtain a second permission release request, and send the second permission release request to the fourth smart network card.The network card sends a second permission release request. Both the first and second permission release requests are used to indicate the cancellation of access permissions to the cloud disk. The virtual machine manager is also used to receive the permission release response sent by the fourth smart network card in response to the second permission release request.

[0146] In one possible implementation, the virtual machine manager is also used to obtain the first permission clearing request sent by the virtual instance and send the first permission clearing request to the fifth smart network card. The first permission clearing request is used to indicate the cancellation of access permissions to the cloud disk by the computing nodes where all virtual instances with cloud disks are mounted. The fifth smart network card is one of multiple smart network cards. The virtual machine manager is also used to receive the permission clearing response sent by the fifth smart network card in response to the first permission clearing request.

[0147] The cloud service system of the embodiments of this application has been described above. Correspondingly, the embodiments of this application also provide a smart network card based on public cloud technology. The smart network card includes a transceiver module and a processing module.

[0148] The transceiver module is used to receive a second access request sent by the virtual machine manager. The second access request carries disk information of the virtual instance managed by the virtual machine manager requesting access to the cloud disk and the identifier of the computing node where the virtual machine manager is located. The processing module is used to determine whether the computing node where the virtual machine manager is located has access to the cloud disk based on the identifier of the target computing node carried in the second access request. The transceiver module is also used to forward the second access request to the target storage node indicated by the disk information if the computing node where the virtual machine manager is located has access to the cloud disk. The transceiver module is also used to receive the access response of the target storage node to the second access request and send the access response to the virtual machine manager.

[0149] In one possible implementation, the processing module is also used to obtain metadata indicating that the computing node has access to the cloud disk when the configuration information indicating the access permission of the cloud disk is lost, and update the configuration indicating the access permission of the cloud disk based on the metadata.

[0150] The cloud service system of the embodiments of this application has been described above. Correspondingly, the embodiments of this application also provide a storage node based on public cloud technology. The storage node includes a transceiver module and a processing module.

[0151] The transceiver module is used to obtain a second permission acquisition request sent by the smart network card. The second permission acquisition request carries the identifier of the computing node and is used to obtain the computing node's access permission to the cloud disk obtained by device simulation based on the storage node. The processing module is used to determine whether the computing node has the conditions to access the cloud disk based on the identifier of the computing node carried in the second permission acquisition request. The transceiver module is also used to send a first notification to the smart network card based on the second permission acquisition request when the computing node has the conditions to access the cloud disk. The first notification is used to indicate that the computing node has the access permission to the cloud disk.

[0152] In one possible implementation, the processing module is further configured to, when the computing node has the conditions to access the cloud disk, generate metadata indicating that the computing node has access to the cloud disk based on the second permission acquisition request, persist the metadata, and send a first notification to the smart network card after the metadata persistence is completed.

[0153] In one possible implementation, the transceiver module is further configured to acquire a second permission release request sent by the smart network card, the second permission release request carrying the identifier of the computing node, the second permission release request being used to indicate the cancellation of the computing node's access to the cloud disk;

[0154] The transceiver module is further configured to, based on the second permission release request, send a second notification to the smart network card, the second notification being used to indicate the cancellation of the computing node's access to the cloud disk.

[0155] In one possible implementation, the transceiver module is specifically configured to, based on the second permission release request, delete the metadata indicating that the computing node has access to the cloud disk, and send a second notification to the smart network card.

[0156] In one possible implementation, the transceiver module is further configured to obtain a first permission clearing request sent by the smart network card, the first permission clearing request being used to instruct the computing nodes where all virtual instances mounted on the cloud disk are located to cancel their access permissions to the cloud disk; the transceiver module is further configured to send a third notification to the smart network card based on the first permission clearing request, the third notification being used to instruct the computing nodes where all virtual instances mounted on the cloud disk are located to cancel their access permissions to the cloud disk.

[0157] In one possible implementation, the transceiver module is specifically configured to delete all metadata indicating that the computing nodes have access permissions to the cloud disk based on the first permission clearing request, and send a third notification to the smart network card.

[0158] The functions of the computing node, smart network card, and storage node described above can all be implemented by software or by hardware. For example, the implementation of the computing node will be described below using the computing node as an example. Similarly, the implementation of the smart network card and storage node can refer to the implementation of the computing node.

[0159] As an example of a software functional unit, the computing node may include code running on the computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Furthermore, the aforementioned computing instance can be one or more. For example, a computing node can include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code can be distributed within the same region or in different regions. Further, the multiple hosts / virtual machines / containers used to run the code can be distributed within the same availability zone (AZ) or in different AZs, each AZ comprising one cloud data center or multiple geographically proximate cloud data centers. Typically, a region can...This includes multiple Availability Zones (AZs). See page 22 / 28 of the specification, 27 CN 121173485 A

[0160] Similarly, multiple hosts / virtual machines / containers used to run this code can be distributed within the same virtual private cloud (VPC) or across multiple VPCs. Typically, one VPC is set up within one region. Cross-region communication between two VPCs within the same region, and between VPCs in different regions, requires a communication gateway to be set up within each VPC. Interconnection between VPCs is achieved through the communication gateway.

[0161] As an example of a hardware functional unit, a computing node can include at least one computing device, such as a server. Alternatively, a computing node can be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD can be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0162] The computing nodes include multiple computing devices that can be distributed in the same region or in different regions. The computing nodes include multiple computing devices that can be distributed in the same Availability Zone (AZ) or in different AZs. Similarly, the computing nodes include multiple computing devices that can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0163] It should be noted that in other embodiments, the steps implemented by the computing nodes, smart network cards, and storage nodes can be specified as needed. The computing nodes, smart network cards, and storage nodes respectively implement different functions in the cloud service system to achieve all the functions of the cloud service system.

[0164] Those skilled in the art will clearly understand that, for the convenience and brevity of the description, the specific working process of each component described above can be referred to the corresponding content in the aforementioned cloud service system embodiments, and will not be repeated here.

[0165] The above describes the cloud service system based on public cloud technology according to the embodiments of this application. Correspondingly, the embodiments of this application also provide a cloud service provision method based on public cloud technology. Figure 12 is a basic embodiment provided by this application.A flowchart of a cloud service provision method based on public cloud technology. As shown in Figure 12, the method includes:

[0166] Step 1201: The virtual machine manager obtains a first access request from the virtual instance for the cloud disk, adds the identifier of the target computing node to the first access request to obtain a second access request, and sends the second access request to the first smart network card. The first access request and the second access request carry disk information of the cloud disk. The first smart network card is one of multiple smart network cards.

[0167] Step 1202: Under the condition that the target computing node has access rights to the cloud disk based on the identifier of the target computing node carried in the second access request, the first smart network card forwards the second access request to the target storage node indicated by the disk information. The target storage node is one of multiple storage nodes.

[0168] Step 1203: The target storage node responds to the second access request and sends an access response to the virtual instance through the first smart network card and the virtual machine manager.

[0169] Optionally, as shown in Figure 13, the method further includes:

[0170] Step 1204: The virtual machine manager obtains the first permission acquisition request sent by the virtual instance, adds the identifier of the target computing node to the first permission acquisition request to obtain a second permission acquisition request, and sends the second permission acquisition request to the second smart network card. Both the first permission acquisition request and the second permission acquisition request are used to obtain access permissions to the cloud disk. The second smart network card is one of multiple smart network cards.

[0171] Step 1205: The second smart network card forwards the second permission acquisition request to the management node of the storage node cluster.

[0172] Step 1206: When the target computing node has the conditions to access the cloud disk, the management node sends a first notification to multiple smart network cards based on the second permission acquisition request. The first notification is used to indicate that the target computing node has access permissions to the cloud disk.

[0173] Step 1207: Multiple smart network cards update their own configuration based on the first notification. The updated configuration indicates that the target computing node has access permissions to the cloud disk.

[0174] In one possible implementation, when the target computing node has the conditions to access the cloud disk, the management node sends a first notification to multiple smart network cards based on a second permission acquisition request, including: when the target computing node has the conditions to access the cloud disk, the management node generates metadata indicating that the target computing node has access to the cloud disk based on the second permission acquisition request, persists the metadata, and sends the first notification to multiple smart network cards after the metadata persistence is completed.

[0175] Optionally, as shown in FIG13, the method further includes:

[0176] Step 1208: when the third smart network card loses the configuration information indicating the access permission of the cloud disk, it obtains the metadata and updates the configuration indicating the access permission of the cloud disk based on the metadata. The third smart network card is multiple smart network cards.One of them.

[0177] Optionally, as shown in Figure 13, the method further includes:

[0178] Step 1209: The virtual machine manager obtains the first permission release request sent by the virtual instance, adds the identifier of the target computing node to the first permission release request to obtain a second permission release request, and sends the second permission release request to the fourth smart network card. Both the first permission release request and the second permission release request are used to indicate the cancellation of access to the cloud disk. The fourth smart network card is one of multiple smart network cards.

[0179] Step 1210: The fourth smart network card forwards the second permission release request to the management node of the storage node cluster.

[0180] Step 1211: Based on the second permission release request, the management node sends a second notification to multiple smart network cards. The second notification is used to indicate the cancellation of access to the cloud disk.

[0181] Step 1212: Based on the second notification, the multiple smart network cards update their own configuration. The updated configuration indicates that the target computing node does not have access to the cloud disk.

[0182] In one possible implementation, the management node sends a second notification to multiple smart network interface cards (NICs) based on a second permission release request, including: the management node deletes metadata indicating that the target compute node has access to the cloud disk based on the second permission release request, and sends the second notification to multiple smart NICs.

[0183] Optionally, the method further includes:

[0184] Step 1213: The virtual machine manager obtains a first permission clearing request sent by a virtual instance, and sends the first permission clearing request to a fifth smart NIC. The first permission clearing request is used to instruct the compute nodes where all virtual instances with mounted cloud disks reside to cancel their access to the cloud disks. The fifth smart NIC is one of multiple smart NICs.

[0185] Step 1214: The fifth smart NIC forwards the first permission clearing request to the management node of the storage node cluster.

[0186] Step 1215: Based on the first permission clearing request, the management node sends a third notification to multiple smart NICs. The third notification is used to instruct the compute nodes where all virtual instances with mounted cloud disks reside to cancel their access to the cloud disks.

[0187] Step 1216: Multiple smart network interface cards (NICs) update their configurations based on a third notification. The updated configuration indicates that all computing nodes containing virtual instances mounted with cloud disks do not have access permissions to the cloud disks.

[0188] In one possible implementation, the management node sends a third notification to multiple smart NICs based on a first permission clearing request, including: the management node deletes all metadata indicating that the computing nodes have access permissions to the cloud disks based on the first permission clearing request, and sends a third notification to multiple smart NICs.

[0189] The above describes a computing node based on public cloud technology in the embodiments of this application. Correspondingly, the embodiments of this application also provide a cloud service provision method based on public cloud technology. This cloud service provision method is applied to computing nodes.The compute node runs a virtual machine manager and a virtual instance for implementing tenant services. The virtual instance is mounted with a cloud disk obtained by device simulation based on the storage node (pages 24 / 28 of the specification, CN 121173485 A). Figure 14 is a flowchart of a cloud service provision method provided by an embodiment of this application. As shown in Figure 14, the method includes:

[0190] Step 1401: The virtual machine manager obtains a first access request from the virtual instance for the cloud disk, adds the identifier of the compute node to the first access request to obtain a second access request, and sends the second access request to the first smart network card. The first access request and the second access request carry disk information of the cloud disk.

[0191] Step 1402: The virtual machine manager receives the access response sent by the first smart network card for the second access request.

[0192] In one possible implementation, as shown in FIG15, the cloud service provision method further includes: step 1403, the virtual machine manager obtains a first permission acquisition request sent by the virtual instance, adds the identifier of the computing node to the first permission acquisition request to obtain a second permission acquisition request, and sends the second permission acquisition request to the second smart network card, wherein both the first permission acquisition request and the second permission acquisition request are used to obtain access permissions to the cloud disk; step 1404, the virtual machine manager receives the permission acquisition response sent by the second smart network card in response to the second permission acquisition request.

[0193] In one possible implementation, as shown in FIG15, the cloud service provision method further includes: step 1405, the virtual machine manager obtains a first permission release request sent by the virtual instance, adds the identifier of the computing node to the first permission release request to obtain a second permission release request, and sends the second permission release request to the fourth smart network card, wherein both the first permission release request and the second permission release request are used to indicate the cancellation of access permissions to the cloud disk; step 1406, the virtual machine manager receives the permission release response sent by the fourth smart network card in response to the second permission release request.

[0194] In one possible implementation, the cloud service provision method further includes: step 1407, the virtual machine manager obtains a first permission clearing request sent by a virtual instance, and sends a first permission clearing request to a fifth smart network card, the first permission clearing request being used to instruct the computing nodes where all virtual instances mounted on cloud disks reside to cancel their access permissions to the cloud disks, the fifth smart network card being one of multiple smart network cards; step 1408, the virtual machine manager receives a permission clearing response sent by the fifth smart network card in response to the first permission clearing request.

[0195] The above describes a smart network card based on public cloud technology in the embodiments of this application. Correspondingly, the embodiments of this application also provide a cloud service provision method based on public cloud technology, which is applied to a smart network card. Figure 16 is a flowchart of a cloud service provision method provided in the embodiments of this application. As shown in Figure 16, the method includes:

[0196] Step 1601: The smart network interface card (NIC) receives a second access request sent by the virtual machine manager. The second access request carries disk information of the virtual instance managed by the virtual machine manager requesting access to the cloud disk and the identifier of the computing node where the virtual machine manager is located.

[0197] Step 1602: The smart NIC determines whether the computing node where the virtual machine manager is located has access rights to the cloud disk based on the identifier of the target computing node carried in the second access request.

[0198] Step 1603: If the computing node where the virtual machine manager is located has access rights to the cloud disk, the smart NIC forwards the second access request to the target storage node indicated by the disk information.

[0199] Step 1604: The smart NIC receives the access response from the target storage node in response to the second access request and sends the access response to the virtual machine manager.

[0200] In one possible implementation, as shown in FIG17, the cloud service provision method further includes: Step 1605: When the smart NIC loses the configuration information indicating the access rights of the cloud disk, it obtains the metadata used to indicate that the computing node has access rights to the cloud disk, and updates the configuration indicating the access rights of the cloud disk based on the metadata.

[0201] The above describes a storage node based on public cloud technology in the embodiments of this application. Correspondingly, the embodiments of this application also provide a cloud service provision method based on public cloud technology, which is applied to a storage node. Figure 18 is a flowchart of a cloud service provision method provided in the embodiments of this application. As shown in Figure 18, the cloud service provider specification, pages 25 / 28, 30 CN 121173485 A, includes:

[0202] Step 1801: The storage node obtains a second permission acquisition request sent by the smart network card. The second permission acquisition request carries the identifier of the computing node and is used to obtain the computing node's access permission to the cloud hard disk obtained by device simulation based on the storage node.

[0203] Step 1802: The storage node determines whether the computing node has the conditions to access the cloud hard disk based on the identifier of the computing node carried in the second permission acquisition request.

[0204] Step 1803: When the computing node has the conditions to access the cloud hard disk, the storage node sends a first notification to the smart network card based on the second permission acquisition request. The first notification is used to indicate that the computing node has the access permission to the cloud hard disk.

[0205] In one possible implementation, when the computing node has the conditions to access the cloud disk, the storage node sends a first notification to the smart network interface card based on a second permission acquisition request, including: when the computing node has the conditions to access the cloud disk, the storage node generates metadata indicating that the computing node has access permissions to the cloud disk based on the second permission acquisition request, persists the metadata, and sends the first notification to the smart network interface card after the metadata persistence is completed.

[0206] In one possible implementation, as shown in Figure 19, the cloud service provision method further includes: step 1804, the storage node obtains a second permission release request sent by the smart network card, the second permission release request carrying the identifier of the computing node, the second permission release request being used to indicate the cancellation of the computing node's access permission to the cloud disk; step 1805, the storage node sends a second notification to the smart network card based on the second permission release request, the second notification being used to indicate the cancellation of the computing node's access permission to the cloud disk.

[0207] In one possible implementation, the storage node sending a second notification to the smart network card based on the second permission release request includes: the storage node deleting metadata indicating that the computing node has access permission to the cloud disk based on the second permission release request, and sending a second notification to the smart network card.

[0208] In one possible implementation, the cloud service provision method further includes: step 1806, whereby the storage node obtains a first permission clearing request sent by the smart network card, the first permission clearing request being used to instruct the computing nodes where all virtual instances mounted on the cloud disk are located to cancel their access permissions to the cloud disk; step 1807, whereby the storage node sends a third notification to the smart network card based on the first permission clearing request, the third notification being used to instruct the computing nodes where all virtual instances mounted on the cloud disk are located to cancel their access permissions to the cloud disk.

[0209] In one possible implementation, the storage node sending a third notification to the smart network card based on the first permission clearing request includes: the storage node deleting all metadata indicating that the computing nodes have access permissions to the cloud disk based on the first permission clearing request, and sending a third notification to the smart network card.

[0210] It should be noted that the order of steps in the cloud service provision method provided in this application embodiment can be appropriately adjusted, and the steps can also be added or removed as appropriate. Any variations that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the protection scope of this application, and therefore will not be elaborated further.

[0211] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of each step described above can be referred to the corresponding content in the aforementioned cloud service system embodiments, and will not be repeated here.

[0212] The basic hardware structure involved in the embodiments of this application is illustrated below.

[0213] This application also provides a computing device 2000. As shown in FIG20, the computing device 2000 includes: a bus 2002, a processor 2004, a memory 2006, and a communication interface 2008. The processor 2004, the memory 2006, and the communication interface 2008 communicate with each other through the bus 2002. The computing device 2000 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device 2000. Specification 26 / 28 pages 31 CN 121173485 A

[0214] Bus 2002 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. Buses can be divided into address buses, data buses, control buses, etc. For ease of representation, only one line is used in Figure 20, but this does not mean that there is only one bus or one type of bus. Bus 2002 may include a path for transmitting information between various components of computing device 2000 (e.g., memory 2006, processor 2004, communication interface 2008).

[0215] Processor 2004 may include any one or more processors such as a central processing unit (CPU), graphics processing unit (GPU), microprocessor (MP), or digital signal processor (DSP).

[0216] Memory 2006 may include volatile memory, such as random access memory (RAM). The processor 2004 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0217] The memory 2006 stores executable program code, which the processor 2004 executes to implement the functions of the aforementioned computing node, smart network card, and storage node, thereby realizing the cloud service provision method. That is, the memory 2006 stores instructions for executing the cloud service provision method.

[0218] The communication interface 2008 uses transceiver modules such as, but not limited to, network interface cards and transceivers to realize communication between the computing device 2000 and other devices or communication networks.

[0219] This application embodiment also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device may be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device may also be a desktop computer, a laptop computer, or a smartphone or other terminal device.

[0220] As shown in FIG21, the computing device cluster includes at least one computing device 2000. One of the computing device clusters...The memory 2006 of one or more computing devices 2000 may store the same instructions for executing the cloud service provision method.

[0221] In some possible implementations, the memory 2006 of one or more computing devices 2000 in the computing device cluster may also store a portion of the instructions for executing the cloud service provision method. In other words, a combination of one or more computing devices 2000 can jointly execute the instructions for executing the cloud service provision method.

[0222] It should be noted that the memory 2006 of different computing devices 2000 in the computing device cluster may store different instructions, which are used to execute a portion of the functions of the cloud service provision device. That is, the instructions stored in the memory 2006 of different computing devices 2000 can implement the functions of one or more modules among the computing nodes, smart network cards, and storage nodes.

[0223] In some possible implementations, one or more computing devices in the computing device cluster can be connected via a network. The network may be a wide area network or a local area network, etc. Figure 22 shows one possible implementation. As shown in Figure 22, two computing devices 2000A and 2000B are connected via a network. Specifically, they are connected to the network through the communication interfaces in each computing device. In this possible implementation, the memory 2006 in computing device 2000A stores instructions for performing the functions of the computing node and the smart network card. At the same time, the memory 2006 in computing device 2000B stores instructions for performing the functions of the storage node.

[0224] The connection method between the computing device clusters shown in Figure 22 can be considered because the cloud service provision method provided in this application requires a large amount of data storage, so the functions implemented by the storage node are considered to be performed by computing device 2000B.

[0225] It should be understood that the functions of computing device 2000A shown in Figure 22 can also be performed by multiple computing devices 2000. Similar to CN 121173485 A on pages 27 / 28 of the specification, the functions of computing device 2000B can also be performed by multiple computing devices 2000.

[0226] This application embodiment also provides another computing device cluster. The connection relationships between the computing devices in this computing device cluster can be similarly referenced to the connection methods of the computing device clusters in Figures 21 and 22. The difference is that the memory 2006 of one or more computing devices 2000 in this computing device cluster may store the same instructions for executing the cloud service provision method.

[0227] In some possible implementations, the memory 2006 of one or more computing devices 2000 in this computing device cluster may also each store a portion of the instructions for executing the cloud service provision method. In other words, a combination of one or more computing devices 2000 can jointly execute the instructions for executing the cloud service provision method.

[0228] This application embodiment also provides a computer program product containing instructions. The computer program product may be a software or program product containing instructions that can run on a computing device or be stored in any usable medium. When the computer program product runs on at least one computing device, it causes the at least one computing device to perform a cloud service provision method.

[0229] This application embodiment also provides a computer-readable storage medium. The computer-readable storage medium may be any usable medium that a computing device can store or a data storage device such as a data center containing one or more usable media. The usable medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive), etc. The computer-readable storage medium includes instructions that instruct the computing device to perform a cloud service provision method, or instruct the computing device to perform a cloud service provision method.

[0230] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware, or by a program instructing related hardware. The program may be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk, etc.

[0231] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of related data need to comply with the relevant laws, regulations and standards of relevant countries and regions. For example, the raw data and executable code involved in this application are obtained under full authorization.

[0232] In the embodiments of this application, the terms "first", "second" and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. The term "at least one" refers to one or more, and the term "multiple" refers to two or more, unless otherwise expressly defined.

[0233] The term "and / or" in this application is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent: A alone, A and B at the same time, and B alone. In addition, the character " / " in this document generally indicates that the related objects before and after are in an "or" relationship.

[0234] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention. SpecificationPage 28 / 28 33 CN 121173485 A Figure 1 Appendix 1 of the Instruction Manual Page 34 CN 121173485 A Figure 2 Appendix 2 of the Instruction Manual Page 35 CN 121173485 A Figure 3 Appendix 3 of the Instruction Manual Page 36 CN 121173485 A Figure 4 Appendix 4 of the Instruction Manual Page 37 CN 121173485 A Figure 5 Appendix 5 of the Instruction Manual Page 38 CN 121173485 A Figure 6 Figure 7 Appendix 6 of the Instruction Manual Page 39 CN 121173485 A Figure 8 Appendix 7 of the Instruction Manual Page 40 CN 121173485 A Figure 9 Appendix 8 of the Instruction Manual Page 41 CN 121173485 A Figure 10 Appendix 9 of the Instruction Manual Page 42 CN 121173485 A Figure 11 Figure 12 of Figure 12 (Page 43, CN 121173485 A) Figure 13 of Figure 14 (Page 44, CN 121173485 A) Figure 14 of Figure 15 (Page 46, CN 121173485 A) Figure 18 of Figure 19 (Page 48, CN 121173485 A) Figure 20 of Figure 21 (Page 49, CN 121173485 A) Figure 22 of Figure 22 (Page 50, CN 121173485 A) Abstract: This application discloses a cloud service system and a cloud service providing method based on public cloud technology, belonging to the field of cloud service. technology. In the cloud service system, a virtual machine manager obtains a first access request for a cloud harddisk from a virtual instance, adds an identifier of a target computing node to the first access request to obtain a second access request, and sends the second access request to a first smart network interface card, where both the first access request and the second access request carry disk information of the cloud hard disk; the first smart network interface card is configured to, upon determining that the target computing node has access permission for the cloud hard disk, forward the second access request to a target storage node indicated by the disk information; the target storage node is configured to respond to the second access request, and send an access response to the virtual instance via the first smart network interface card and the virtual machine manager. The present application implements access permission control for cloud hard disks at the granularity of computing nodes, and can ensure data consistency of cloud hard disks.

Claims

1. A cloud service system based on public cloud technology, characterized in that, The cloud service system includes: a computing node cluster, a smart network card cluster, and a storage node cluster. The computing node cluster includes multiple computing nodes, the smart network card cluster includes multiple smart network cards, the storage node cluster includes multiple storage nodes, and the multiple computing nodes include a target computing node. The target computing node runs a virtual machine manager and a virtual instance for implementing tenant services. The virtual instance is mounted with a cloud disk obtained by simulating the device based on the storage node. The virtual machine manager is used to obtain the first access request of the virtual instance for the cloud disk, add the identifier of the target computing node to the first access request to obtain a second access request, and send the second access request to the first smart network card. The first access request and the second access request carry the disk information of the cloud disk. The first smart network card is one of the plurality of smart network cards. The first smart network interface card is used to forward the second access request to the target storage node indicated by the disk information, provided that the target computing node has access to the cloud disk based on the identifier of the target computing node; the target storage node is one of the plurality of storage nodes. The target storage node is used to respond to the second access request and send an access response to the virtual instance through the first smart network card and the virtual machine manager.

2. The system as described in claim 1, characterized in that, The virtual machine manager is also used to obtain a first permission acquisition request sent by the virtual instance, add the identifier of the target computing node to the first permission acquisition request to obtain a second permission acquisition request, and send the second permission acquisition request to the second smart network card. Both the first permission acquisition request and the second permission acquisition request are used to obtain access permissions to the cloud disk. The second smart network card is one of the plurality of smart network cards. The second smart network interface card is used to forward the second permission acquisition request to the management node of the storage node cluster; When the target computing node has the conditions to access the cloud disk, the management node is used to send a first notification to the plurality of smart network cards based on the second permission acquisition request. The first notification is used to indicate that the target computing node has access to the cloud disk. The plurality of smart network interface cards are used to update their own configurations based on the first notification, and the updated configurations indicate that the target computing node has access to the cloud disk.

3. The system as described in claim 2, characterized in that, The management node is specifically used to generate metadata indicating that the target computing node has access to the cloud disk based on the second permission acquisition request when the target computing node has the conditions to access the cloud disk, persist the metadata, and send the first notification to the plurality of smart network cards after the persistence of the metadata is completed.

4. The system as described in claim 3, characterized in that, The third smart network interface card (NIC) is used to obtain the metadata when the configuration information indicating the access permissions of the cloud disk is lost, and to update the configuration indicating the access permissions of the cloud disk based on the metadata. The third smart NIC is one of the plurality of smart NICs.

5. The system as described in any one of claims 1 to 4, characterized in that, The virtual machine manager is also used to obtain a first permission release request sent by the virtual instance, add the identifier of the target computing node to the first permission release request to obtain a second permission release request, and send the second permission release request to the fourth smart network interface card. Both the first permission release request and the second permission release request are used to indicate the cancellation of access permissions to the cloud disk. The fourth smart network interface card is one of the plurality of smart network interface cards. The fourth smart network interface card is used to forward the second permission release request to the management node of the storage node cluster; The management node is used to send a second notification to the plurality of smart network cards based on the second permission release request, and the second notification is used to instruct the cancellation of access permissions to the cloud disk; The plurality of smart network interface cards are used to update their own configurations based on the second notification, and the updated configurations indicate that the target computing node does not have access to the cloud disk.

6. The system as described in claim 5, characterized in that, The management node is specifically used to delete metadata indicating that the target computing node has access to the cloud disk based on the second permission release request, and to send the second notification to the plurality of smart network cards.

7. The system as described in any one of claims 1 to 6, characterized in that, The virtual machine manager is also used to obtain the first permission clearing request sent by the virtual instance, and send the first permission clearing request to the fifth smart network card. The first permission clearing request is used to instruct the compute nodes where all virtual instances mounted on the cloud disk are located to cancel the access permissions of the cloud disk to the cloud disk. The fifth smart network card is one of the plurality of smart network cards. The fifth smart network interface card is used to forward the first permission clearing request to the management node of the storage node cluster; The management node is used to send a third notification to the plurality of smart network cards based on the first permission clearing request. The third notification is used to instruct the computing nodes where all virtual instances mounted on the cloud disk are located to cancel their access permissions to the cloud disk. The multiple smart network interface cards are used to update their own configurations based on the third notification. The updated configuration indicates that the computing nodes where all virtual instances mounted on the cloud disk reside do not have access permissions to the cloud disk.

8. The system as described in claim 7, characterized in that, The management node is specifically used to delete all metadata indicating that the computing node has access to the cloud disk based on the first permission clearing request, and to send the third notification to the multiple smart network cards.

9. A method for providing cloud services based on public cloud technology, characterized in that, The method is applied to a cloud service system, which includes: a compute node cluster, a smart NIC cluster, and a storage node cluster. The compute node cluster includes multiple compute nodes, the smart NIC cluster includes multiple smart NICs, and the storage node cluster includes multiple storage nodes. The multiple compute nodes include a target compute node. The target compute node runs a virtual machine manager and a virtual instance for implementing tenant services. The virtual instance is mounted with a cloud disk obtained by simulating devices based on the storage node. The method includes: The virtual machine manager obtains the first access request of the virtual instance for the cloud disk, adds the identifier of the target computing node to the first access request to obtain a second access request, and sends the second access request to the first smart network card. The first access request and the second access request carry the disk information of the cloud disk. The first smart network card is one of the plurality of smart network cards. If the first smart network card determines that the target computing node has access to the cloud disk based on the identifier of the target computing node carried in the second access request, the second access request is forwarded to the target storage node indicated by the disk information, and the target storage node is one of the plurality of storage nodes; The target storage node responds to the second access request and sends an access response to the virtual instance through the first smart network card and the virtual machine manager.

10. The method as described in claim 9, characterized in that, The method further includes: The virtual machine manager obtains the first permission acquisition request sent by the virtual instance, adds the identifier of the target computing node to the first permission acquisition request to obtain a second permission acquisition request, and sends the second permission acquisition request to the second smart network interface card. Both the first permission acquisition request and the second permission acquisition request are used to obtain access permissions to the cloud disk. The second smart network interface card is one of the plurality of smart network interface cards. The second smart network interface card forwards the second permission acquisition request to the management node of the storage node cluster; When the target computing node has the conditions to access the cloud disk, the management node sends a first notification to the plurality of smart network cards based on the second permission acquisition request. The first notification is used to indicate that the target computing node has access to the cloud disk. The multiple smart network interface cards update their configurations based on the first notification, and the updated configurations indicate that the target computing node has access to the cloud disk.

11. The method as described in claim 10, characterized in that, When the target computing node has the conditions to access the cloud disk, the management node sends a first notification to the plurality of smart network cards based on the second permission acquisition request, including: When the target computing node has the conditions to access the cloud disk, the management node generates metadata indicating that the target computing node has access to the cloud disk based on the second permission acquisition request, persists the metadata, and sends the first notification to the plurality of smart network cards after the metadata persistence is completed.

12. The method as described in claim 11, characterized in that, The method further includes: When the configuration information indicating access permissions to the cloud disk is lost, the third smart network interface card (NIC) obtains the metadata and updates the configuration indicating access permissions to the cloud disk based on the metadata. The third smart NIC is one of the plurality of smart NICs.

13. The method according to any one of claims 9 to 12, characterized in that, The method further includes: The virtual machine manager obtains the first permission release request sent by the virtual instance, adds the identifier of the target computing node to the first permission release request to obtain a second permission release request, and sends the second permission release request to the fourth smart network interface card. Both the first permission release request and the second permission release request are used to indicate the cancellation of access permissions to the cloud disk. The fourth smart network interface card is one of the plurality of smart network interface cards. The fourth smart network card forwards the second permission release request to the management node of the storage node cluster; Based on the second permission release request, the management node sends a second notification to the plurality of smart network cards, the second notification being used to instruct the cancellation of access permissions to the cloud disk; The multiple smart network interface cards update their configurations based on the second notification, and the updated configurations indicate that the target computing node does not have access to the cloud disk.

14. The method as described in claim 13, characterized in that, Based on the second permission release request, the management node sends a second notification to the plurality of smart network interface cards, including: The management node deletes the metadata indicating that the target computing node has access to the cloud disk based on the second permission release request, and sends the second notification to the plurality of smart network cards.

15. The method according to any one of claims 9 to 14, characterized in that, The method further includes: The virtual machine manager obtains the first permission clearing request sent by the virtual instance and sends the first permission clearing request to the fifth smart network interface card. The first permission clearing request is used to instruct the compute nodes where all virtual instances mounted on the cloud disk are located to cancel the access permissions of the cloud disk to the cloud disk. The fifth smart network interface card is one of the plurality of smart network interface cards. The fifth smart network card forwards the first permission clearing request to the management node of the storage node cluster; Based on the first permission clearing request, the management node sends a third notification to the plurality of smart network cards. The third notification is used to instruct the computing nodes where all virtual instances mounted on the cloud disk reside to cancel their access permissions to the cloud disk. The multiple smart network interface cards update their configurations based on the third notification. The updated configurations indicate that none of the computing nodes containing the virtual instances mounted on the cloud disk have access to the cloud disk.

16. The method as described in claim 15, characterized in that, Based on the first permission clearing request, the management node sends a third notification to the plurality of smart network interface cards, including: The management node deletes all metadata indicating that the computing node has access to the cloud disk based on the first permission clearing request, and sends the third notification to the multiple smart network cards.

17. A computing device cluster, characterized in that, The system includes multiple computing devices, each comprising multiple processors and multiple memories, the multiple memories storing program instructions, and the multiple processors executing the program instructions to cause the cluster of computing devices to perform the method of any one of claims 9 to 16.

18. A computer-readable storage medium, characterized in that, Includes program instructions that, when executed on a computing device, cause the computing device to perform the method as described in any one of claims 9 to 16.

19. A computer program product containing instructions, characterized in that, When the instruction is executed by the computing device cluster, the computing device cluster causes the computing device cluster to perform the method as described in any one of claims 9 to 16.

Images