Method for creating virtual instances based on cloud computing technology and cloud management platform

Abstract

The present invention discloses a virtual instance creation method based on cloud computing technology and a cloud management platform. The method includes: a cloud management platform acquiring a virtual instance creation request input by a tenant, the creation request including specification information of the virtual instance to be created, site information, and information about a cloud-native application to which the virtual instance to be created belongs. Based on the acquired information, the cloud management platform selects a computing node whose specification matches the specification information to create the virtual instance; the computing node is configured in a cloud data center that matches the site information; and the virtual instance is configured to run one or more microservices in the cloud-native application. Based on the acquired information about the cloud-native application, the cloud management platform configures a virtual instance manager in the computing node to mark service packets sent by the virtual instance with an identifier of the cloud-native application to implement identification and recognition of service packets of the virtual instance, thereby simplifying access permission configuration operations and improving security policy configuration efficiency.

Description

[Technical Field]

[0001] The present application relates to the field of cloud computing technology, and in particular to a virtual instance creation method based on cloud computing technology and a cloud management platform for implementing the method. [Background technology]

[0002] With the maturity of public cloud technology, cloud-native applications have been developed greatly, and more and more services are focusing on application development. However, the current cloud network architecture model complicates the operational processes of cloud-native applications, such as deployment, migration, interworking, and security, and cannot meet the requirements for convenient management, simplified security policy definition, and rapid deployment of cloud-native applications. Summary of the Invention [Means for solving the problem]

[0003] To solve the problems in the prior art, the present invention provides a virtual instance creation method based on cloud computing technology and a cloud management platform, which can solve the complex operational problems caused by the network model, such as permission management, security policy definition, and cloud native application deployment, and can implement efficient and convenient cloud resource management.

[0004] According to a first aspect, the present application provides a virtual instance creation method based on cloud computing technology. The method is applied to a cloud management platform. The cloud management platform is configured to manage an infrastructure including multiple cloud data centers deployed in a distributed manner. Each cloud data center is configured with multiple computing nodes. The method particularly includes the following steps: receiving a first virtual instance creation request input by a first tenant, the first virtual instance creation request including specification information of the first virtual instance to be created and information about a first cloud-native application to which the first virtual instance to be created belongs. Based on the received request, the cloud management platform selects a first computing node in the first cloud data center that can provide specifications that match the specification information to create the first virtual instance. The first virtual instance is configured to run the first cloud-native application or one or more microservices in the first cloud-native application. The multiple cloud data centers include the first cloud data center that provides the first computing node. Further, the cloud management platform is configured to configure the first virtual instance manager of the first computing node to mark service packets transmitted by the first virtual instance with an identifier of the first cloud-native application based on the information about the first cloud-native application.

[0005] In the solution provided in the present application, the cloud management platform can obtain a virtual instance creation request input by a tenant, determine virtual instance specification information and information about the cloud-native application, and further select a suitable computing node for creating the virtual instance based on the information. In this way, the virtual instance created by the cloud management platform can better match the actual requirements of the tenant. Based on this, the virtual instance manager is configured to mark service packets sent by the virtual instance with an identifier of the cloud-native application executed by the virtual instance, so that accurate management of interworking and access between virtual instances or different cloud-native applications can be implemented, and the transfer of information between cloud-native networks is simplified by using the identifier.

[0006] In relation to the first aspect, in a possible implementation form of the first aspect, the first virtual instance creation request further includes first site information, and specifically, the method further includes the following step: the cloud management platform selects, from a plurality of cloud data centers, a first cloud data center that matches the first site information.

[0007] In the solution provided in the present application, the virtual instance creation request input by the tenant and received by the cloud management platform further includes site information. Therefore, the cloud management platform can determine both the cloud data center, the computing node on which the virtual instance is located, and the site on which the virtual instance is executed based on the site information. Based on this, the cloud management platform can further configure, control, and manage network interworking of virtual instances at different sites to meet tenant requirements for access and interworking between cloud-native applications at different sites based on simplifying the cloud-native network architecture.

[0008] In relation to the first aspect, in a possible implementation of the first aspect, the cloud management platform receives a first security rule input by a first tenant, the first security rule indicating permission to access the first cloud-native application. The cloud management platform further configures a first virtual instance manager of the first computing node to record the first security rule. Specifically, the first virtual instance manager permits or prohibits, in accordance with the first security rule, transmission to the first virtual instance of a service packet transmitted to the first virtual instance by a virtual instance executing another cloud-native application or one or more microservices within the other cloud-native application.

[0009] In the solution provided in the present application, the cloud management platform performs configuration according to security rules entered by the tenant and records the security rules in the virtual instance manager. Based on this, when a virtual instance managed by the virtual instance manager is an access or interaction object and is accessed by a virtual instance in another cloud-native application or by a virtual instance in one or more microservices in another cloud-native application, the virtual instance manager determines or authenticates a service packet whose access target is a virtual instance managed by the virtual instance manager according to the security rules. If the identifier marked in the service packet belongs to the access range allowed by the virtual instance manager, the service packet is permitted to access the virtual instance. Alternatively, if the identifier marked in the service packet does not belong to the access range allowed by the virtual instance manager, the service packet is prohibited from accessing the virtual instance. Optionally, after a service packet is determined and authenticated by the virtual instance manager for the first time, the same service packet is not determined or authenticated again unless the security rules are changed.

[0010] In relation to the first aspect, in a possible implementation of the first aspect, a second virtual instance is deployed on a second computing node in the infrastructure, the second virtual instance is configured to run a second cloud-native application or one or more microservices in the second cloud-native application, and the second computing node is configured in one of a plurality of cloud data centers. The method further includes the following specific steps: receiving a second security rule input by a first tenant, the second security rule indicating permission of the first cloud-native application to access the second cloud-native application; and configuring a second virtual instance manager of the second computing node to record an identifier of the first cloud-native application and the second security rule. The destination address of a service packet sent by the first virtual instance is the second virtual instance. Upon determining that the identifier of the first cloud-native application with which the service packet transmitted by the first virtual instance is marked matches the identifier recorded by the second virtual instance manager, the second virtual instance manager allows or prohibits transmission of the first service packet to the second virtual instance in accordance with security rules.

[0011] In the solution provided in the present application, a cloud management platform can configure access permissions for a specific cloud-native application according to security rules entered by a tenant. Specifically, a first cloud-native application needs to access a second cloud-native application. To control the access permissions for the first cloud-native application, the cloud management platform receives the security rules entered by the first tenant and configures a virtual instance manager of the second cloud-native application, which is accessed to record the security rules and an identifier of the first cloud-native application. When the first cloud-native application accesses the second cloud-native application, the virtual instance manager of the second cloud-native application determines service packets sent by the virtual instance running the first cloud-native application. If the identifier recorded by the virtual instance manager of the second cloud-native application matches the identifier carried by the first cloud-native application, the virtual instance manager of the second cloud-native application further determines, according to the configured security rules, whether to allow or prohibit the service packets from accessing the virtual instance of the second cloud-native application. In this way, the permission for a cloud-native application to access another cloud-native application is controlled based on the identifiers of the different cloud-native applications. Security rules may also be configured across tenants. When a second virtual instance in a second cloud-native application is created by a second tenant, the second security rules entered by the first tenant can be configured by the cloud management platform to be recorded in the second virtual instance manager.Optionally, the second security rules may be configured by the cloud management platform based on the first tenant's permission to configure the second virtual instance.

[0012] In relation to the first aspect, in a possible implementation of the first aspect, before the cloud management platform receives security rules input by the tenant for the first cloud-native application, the method particularly further includes the following steps: receiving a second virtual instance creation request input by the first tenant or the second tenant, wherein the second virtual instance creation request includes specification information of the second virtual instance to be created and information about the second cloud-native application to which the second virtual instance belongs; selecting to create the second virtual instance on a second computing node that is in the second cloud data center and can provide a specification that matches the specification information; and configuring a second virtual instance manager of the second computing node to mark service packets sent by the second virtual instance with an identifier of the second cloud-native application based on the information about the second cloud-native application.

[0013] In the solution provided in the present application, the second virtual instance or another virtual instance may be created by the cloud management platform based on a creation request from a first tenant or based on a creation request from another tenant. Similarly, the creation of the second virtual instance should satisfy the specification information in the creation request. Optionally, the second virtual instance may be created on a first computing node in a first cloud data center or on a second computing node in a second cloud data center. In other words, mutual access between cloud-native applications may be performed across cloud data centers and computing nodes, and access permissions may be managed and controlled using identifiers and security rules. Based on this, the identifier of the second cloud-native application is used to mark service packets sent by the second virtual instance. When the second virtual instance accesses a virtual instance of another cloud-native application, the service packets sent by the second virtual instance carry the identifier of the second cloud-native application. In this way, access permissions may be controlled and managed based on the identifier.

[0014] In relation to the first aspect, in a possible implementation form of the first aspect, the method particularly further includes the following steps: configuring a first network interface for a first cloud-native application and binding at least one virtual instance running a microservice in the first cloud-native application to the first network interface, where the at least one virtual instance running a microservice in the first cloud-native application includes a first virtual instance, and the first network interface is configured in a first cloud datacenter indicated by the first site information; and configuring a second network interface for a second cloud-native application and binding at least one virtual instance running a microservice in the second cloud-native application to the second network interface, where the at least one virtual instance running a microservice in the second cloud-native application includes a second virtual instance, and the second network interface is configured in a second cloud datacenter indicated by the second site information. The first network interface and the second network interface are connected to each other via a cloud-native network set in the infrastructure.

[0015] In the solution provided in the present application, at least one virtual instance running a cloud-native application is coupled to one or more network interfaces. Different network interfaces are configured for corresponding cloud data centers based on site information. The network interfaces are connected to each other via a cloud-native network. For example, interworking between cloud data centers is implemented via a backbone network, a cloud private line, etc. In this way, when virtual instances in different cloud data centers access and interwork, the virtual instances can directly access through a boundary network interface to improve connection and access efficiency.

[0016] In relation to the first aspect, in a possible implementation of the first aspect, for the step of configuring the first virtual instance manager of the first computing node to mark service packets sent by the first virtual instance with an identifier of the first cloud-native application based on information about the first cloud-native application, the method particularly includes the following steps: configuring the first virtual instance manager to encapsulate the service packet in an inner packet of an overlay packet and set the identifier of the first cloud-native application in the outer packet of the overlay packet.

[0017] In the solution provided in the present application, the identifier in the service packet is configured based on information about the cloud-native application. Specifically, information about the cloud-native application is encapsulated in an outer packet of an overlay packet, and the service packet is encapsulated in an inner packet of the overlay packet. Therefore, upon receiving service packets sent by another virtual instance, the virtual instance manager can identify the identifier carried in each service packet by decapsulating the overlay packet. In this way, when the network interface associated with a virtual instance continuously changes, only the identifier of the cloud-native application to which the network interface belongs needs to be adjusted. The security policies of all computing nodes no longer need to be changed, and the efficiency of access and interworking between cloud-native applications can be improved.

[0018] Referring to the first aspect, in a possible implementation of the first aspect, the virtual instance includes a virtual machine or a container.

[0019] The second aspect or any implementation of the second aspect is an implementation of a device corresponding to the first aspect or any implementation of the first aspect. The description of the first aspect or any implementation of the first aspect is applicable to the second aspect or any implementation of the second aspect. Details will not be described again in this specification.

[0020] According to a third aspect, the present application further provides a cloud network system for cloud-native applications. The cloud-native network is configured to connect multiple network interfaces, each coupled to one virtual instance. The first virtual instance is coupled to a first network interface among the multiple network interfaces and configured to run a first cloud-native application or one or more microservices within the first cloud-native application. The second virtual instance is coupled to a second network interface among the multiple network interfaces and configured to run a second cloud-native application or one or more microservices within the second cloud-native application. The cloud management platform is for receiving security rules input by tenant A, the security rules indicating permission for the first cloud-native application to access the second cloud-native application. The first network interface and / or the second network interface use the security rules to determine whether to allow access packets to pass between the first virtual instance and the second virtual instance.

[0021] According to a fourth aspect, the present application provides a computing device cluster including at least one computing device, each computing device including a processor and a memory, wherein the processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, and the computing device cluster performs the method of the first aspect and any one of the implementations related to the first aspect.

[0022] According to a fifth aspect, the present application provides a computer program product including instructions that, when executed by a computing device cluster, enable the computing device cluster to perform the method of the first aspect and any one of the implementations associated with the first aspect.

[0023] According to a sixth aspect, the present application provides a computer-readable storage medium including computer program instructions that, when executed by a computing device cluster, cause the computing device cluster to perform the method of the first aspect and any one of the implementations associated with the first aspect. [Brief explanation of the drawings]

[0024] [Figure 1] FIG. 1 is a diagram of a scenario of a cloud management platform for virtual instance creation based on cloud computing technology according to an embodiment of the present invention. [Figure 2] 1 is an architecture diagram of a cloud management platform for virtual instance creation based on cloud computing technology according to an embodiment of the present invention. [Figure 3] 1 is an architecture diagram of a virtual instance creation method based on cloud computing technology according to an embodiment of the present invention; [Figure 4] 1 is a simplified flowchart of a virtual instance creation method based on cloud computing technology, according to an embodiment of the present invention. [Figure 5] 1 is a schematic flowchart of a virtual instance creation method based on cloud computing technology according to an embodiment of the present invention; [Figure 6] 4 is another schematic flowchart of a virtual instance creation method based on cloud computing technology according to an embodiment of the present invention; [Figure 7]1 is an architecture diagram of a virtual instance creation method based on cloud computing technology in an application-native cloud network scenario according to an embodiment of the present invention; [Figure 8] 1 is an architecture diagram of a virtual instance creation method based on cloud computing technology in a virtual machine scenario according to an embodiment of the present invention; [Figure 9] 1 is an architecture diagram of a virtual instance creation method based on cloud computing technology in a container scenario according to an embodiment of the present invention; [Figure 10] FIG. 10 is a diagram of a data format structure of an overlay packet in a virtual instance creation method based on cloud computing technology according to an embodiment of the present invention; [Figure 11] 1 is an architecture diagram of a cloud network system in a virtual instance creation method based on cloud computing technology according to an embodiment of the present invention; [Figure 12] 1 is a diagram of a structure of a cloud management platform in a virtual instance creation method based on cloud computing technology according to an embodiment of the present invention; [Figure 13] 1 is a diagram of a structure of a computing device in a virtual instance creation method based on cloud computing technology according to an embodiment of the present invention; [Figure 14] 1 is a diagram of a structure of a computing device cluster in a virtual instance creation method based on cloud computing technology according to an embodiment of the present invention; [Figure 15] FIG. 2 is a diagram of another structure of a computing device cluster in a virtual instance creation method based on cloud computing technology according to an embodiment of the present invention; [Figure 16] FIG. 2 is a diagram of another structure of a computing device cluster in a virtual instance creation method based on cloud computing technology according to an embodiment of the present invention; DETAILED DESCRIPTION OF THE INVENTION

[0025] The technical solutions in the embodiments of the present invention will be explicitly described below with reference to the accompanying drawings. It is clear that the described embodiments are only some embodiments of the present application, and not all embodiments. Any other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative efforts shall fall within the protection scope of the present application.

[0026] The term "embodiment" as used herein means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the present application. Phrases appearing in various places in this specification may not necessarily refer to the same embodiment, and are not independent or optional embodiments that do not intersect with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0027] References to "an embodiment" or "some embodiments" or the like described herein indicate that one or more embodiments of the present application include the particular feature, structure, or characteristic described with reference to the embodiment. Thus, statements such as "in an embodiment," "in some embodiments," "in some other embodiments," and "in other embodiments" appearing in different places in this specification do not necessarily mean to refer to the same embodiment. Instead, these statements mean "one or more, but not all, of the embodiments," unless specifically emphasized otherwise. The terms "comprising," "including," "having," and other variations thereof all mean "including but not limited to," unless specifically emphasized otherwise.

[0028] To help those skilled in the art better understand, some terms and related techniques of the present application will first be explained with reference to the accompanying drawings.

[0029] Tenant: A tenant is a user who rents infrastructure. A tenant may register an account with a cloud management platform operated by a public cloud service provider via a browser or other client. The public cloud service provider records the accounts of different tenants and segregates the public cloud services of different tenants based on the accounts.

[0030] Cloud management platform: A cloud management platform is a platform provided by a public cloud service provider for interacting with users. A user can register an account on the cloud management platform and use the account to rent a public cloud service, becoming a tenant of the public cloud service. The cloud management platform is further used to manage the infrastructure and isolate computing, network, and / or storage resources rented by different tenants based on the different tenants' accounts.

[0031] Virtual Instance: A virtual instance is an instance deployed in a cloud data center within an infrastructure and configured to run public cloud services. A virtual instance is an instance configured to provide computing, network, or storage resources. Examples of virtual instances include, but are not limited to, virtual machines or containers.

[0032] Infrastructure: The infrastructure is a facility that supports cloud computing services and includes at least one cloud data center. Each cloud data center includes multiple computing nodes. Virtual instances, such as virtual machines or containers, run on the computing nodes to implement the elastic cloud computing services. For example, if the infrastructure includes multiple cloud data centers, the data centers are remotely connected to each other via a backbone network.

[0033] Overlay packet: An overlay packet is an overlay network technology, specifically a Virtual Extensible Local Area Network (VXLAN) packet. A VXLAN packet includes an outer packet and an inner packet. The data portion of a UDP packet carries a VXLAN header, an inner Ethernet header, an inner IP header, and the data portion (payload) of an IP packet. The inner Ethernet header records the source MAC address and destination MAC address of the inner packet. The inner IP header records the source IP address and destination IP address of the inner packet. The outer packet includes an outer Ethernet header, an outer IP header, an outer User Datagram Protocol (UDP) header, and a VXLAN header.

[0034] Cloud-native applications: A cloud-native application is a collection of related but non-independent components (Services, Tasks, Workers) that are combined with composition and appropriately instantiated at runtime to achieve a unified functional purpose.

[0035] Application Native Cloud (ANC) Network: An application native cloud network is a network model used in cloud computing technology. The model can be used by tenants to create virtual instances on the cloud, and builds the network environment required by the tenant's cloud resources, such as computing, storage, and network resources. It is an implementation of a cloud native network.

[0036] Network Interface: In a cloud-native network, when a tenant creates a virtual instance, they must call a network interface and specify the site where the network interface is located and the cloud-native application to which the network interface belongs within the cloud-native network. Network interfaces of sites can interact directly with each other, creating a global cloud-native network environment.

[0037] Container: A container is a virtualization technology in computer operating systems. This technology allows processes to run in an isolated and separate environment (including an independent file system, namespace, resource view, etc.) to simplify software deployment procedures, enhance software portability and security, and improve system resource utilization. Container technology has been widely applied to service-oriented scenarios in the cloud computing field.

[0038] Region: Public cloud service providers set up public cloud data centers in regions located in different geographic locations. Public cloud devices in public cloud data centers in different regions need to communicate with each other through remote connection gateways.

[0039] Site: A site is a location attribute in an application-native cloud network. Cloud data centers may be configured in different geographic locations and provide cloud services to tenants within the coverage area of the cloud data center in that geographic location. A cloud data center deployed in a geographic location is a site. A site is a parallel model that includes a core site and an edge site. Alternatively, a site may be a data center configured locally by a tenant.

[0040] Global: Global is an attribute of location within an application-native cloud network, a higher level than the attribute of a site. This level allows you to manage cloud services deployed at different sites around the world.

[0041] To facilitate the description of a virtual instance creation method based on cloud computing technology in an embodiment of the present invention, reference will first be made to FIG. 1. FIG. 1 is a diagram of a scenario of a virtual instance creation method based on cloud computing technology in accordance with an embodiment of the present invention. As shown in FIG. 1, a cloud management platform 20 is used to manage an infrastructure 1. The infrastructure 1 includes cloud data center clusters configured in multiple regions. For example, the multiple regions include region 10, region 11, and region 12. One cloud data center cluster (not shown in the figure) is configured in each region, and each cloud data center cluster includes multiple cloud data centers. For example, the cloud data centers in region 10 include cloud data center 101, cloud data center 102, and cloud data center 103; the cloud data center cluster located in region 11 includes cloud data center 111, cloud data center 112, and cloud data center 113; and the cloud data center cluster located in region 12 includes cloud data center 121, cloud data center 122, and cloud data center 123. Each cloud data center further includes multiple computing nodes. For example, data center 101 includes computing node 1011, computing node 1012, ...

[0042] Continuing to refer to Figure 1, cloud management platform 20 is used to manage infrastructure 1. Tenant A connects to the Internet via client 21 and logs into cloud management platform 20 by using an account that has been pre-registered with cloud management platform 20 and is bound to tenant A. Cloud management platform 20 provides a configuration interface for configuring cloud services that run within the infrastructure.

[0043] For example, client 21 and client 22 may each be a terminal device such as a mobile phone, a personal computer, a personal digital assistant, or a thin client with network access functionality, or may be an in-vehicle host or other terminal device with network access functionality.

[0044] FIG. 2 is a diagram of a system structure of a cloud management platform for virtual instance creation based on cloud computing technology according to an embodiment of the present invention. Specifically, FIG. 2 illustrates a specific structure of the cloud data center shown in FIG. 1. As shown in FIG. 2, the cloud data center 101 includes multiple computing nodes 1011, 1012, etc., where the multiple computing nodes 1011 and 1012 are separately connected to a bandwidth allocation device 1010. The computing node 1011 includes a hardware layer and a software layer. A virtual instance 10111 is configured in the software layer of the computing node 1011. The software layer of the computing node 1011 further includes a host operating system 10113. A virtual instance manager 101131 is configured in the host operating system 10113. A cloud management platform client 1011311 is further configured in the virtual instance manager 101131. The virtual instance manager 101131 is configured to manage the virtual instance 10111, and the virtual instance manager 101131 communicates with the cloud management platform 20 via the cloud management platform client 1011311. When a service packet is sent by another computing node to access a virtual instance in the virtual instance manager 101131, the virtual instance manager 101131 decapsulates the packet and identifies the source virtual instance of the service packet. The computing node hardware layer of the computing node 1011 includes a memory 10114, a processor 10115, a network adapter 10116, and a hard disk drive 10117. The network adapter 10116 is connected to the bandwidth allocation device 1010 in the cloud data center. The virtual instance 10111 is connected to the Internet via the network adapter 10116.Network packets (including outgoing and incoming packets) of virtual instance 10111 communicate with internet devices via bandwidth allocation device 1010.

[0045] It should be noted that in this embodiment of the present invention, the number of virtual machines can be set as needed, which is not limited in this embodiment of the present invention.

[0046] In the public cloud systems shown in Figures 1 and 2, when a tenant creates a virtual instance in the public cloud system, especially when the tenant needs to perform networking and create multiple virtual instances to jointly form several services, the tenant must be familiar with multiple cloud products in the current cloud network model, such as virtual private cloud (VPC) networks, elastic load balancers (ELBs), and network address translation (NAT) gateways. In addition, network parameters such as private network segments and private network addresses must be classified during the configuration process. Due to the complexity of the network model and configuration parameters, when the virtual instances created by the tenant perform interactive access across regions and cloud data centers, service packets must pass through multiple layers. In particular, when network security policy management is performed for different virtual instances, the security policy of a computing node must be changed based on changes in the virtual instances running on the computing node. As a result, cloud resource management operations are complex. This contradicts the requirements for rapid development, deployment, and management of cloud-native applications.

[0047] To solve the above-mentioned problems, the present application provides a virtual instance creation method based on cloud computing technology. In this method, a virtual instance is created on a determined computing node based on specification information entered by a tenant and information about the cloud-native application to which the virtual instance belongs. Since the virtual instance is configured to run a cloud-native application or one or more microservices within the cloud-native application, a virtual instance manager managing the virtual instance is configured to record an identifier of the cloud-native application running on the virtual instance and mark service packets sent by the virtual instance using the identifier. In this way, the virtual instance manager determines a security policy based on the identifier. Furthermore, even if the virtual instance configured to run the cloud-native application does not change, the security policy does not need to be repeatedly changed on each computing node.

[0048] Based on the scenario described in FIG. 1 and FIG. 2, the virtual instance creation method based on cloud computing technology provided in the embodiment of the present invention will be described in detail below with reference to FIG.

[0049] 3 is an architecture diagram of a virtual instance creation method based on cloud computing technology according to an embodiment of the present invention.

[0050] Tenant A accesses cloud management platform 20 via client 21. Cloud management platform 20 is used to manage infrastructure 1. Computing nodes 1011, 1021, ..., etc. are configured in infrastructure 1. Referring to FIG. 1 , computing node 1011 is configured in cloud data center 101, and computing node 1021 is configured in cloud data center 102. A virtual instance 10111 that executes cloud-native application 41 or one or more microservices within cloud-native application 41 is configured on computing node 1011, and a virtual instance 10212 that executes cloud-native application 42 or one or more microservices within cloud-native application 42 is configured on computing node 1021. When cloud-native application 41 generates a service packet for accessing cloud-native application 42 during a running process, virtual instance 10111 sends the service packet to network interface 411, and network interface 411 encapsulates the service packet via virtual switch 400. Optionally, the network interface may be a network endpoint (NEP). Furthermore, the virtual switch 400 sends the encapsulated overlay packet from the computing node 1011 to the virtual switch 401 of the computing node 1021, and the virtual switch 401 then decapsulates the encapsulated overlay packet and forwards the decapsulated overlay packet to the network interface 421. Referring to Figure 1, the virtual instance manager 101131 is configured with the virtual switch 400, and the virtual instance manager 102131 is configured with the virtual switch 401.When a service packet sent by virtual instance 10111 is forwarded by virtual instance manager 101131, virtual instance manager 101131 marks the service packet. By using the cloud-native application's identifier, virtual instance manager 101131 marks the service packet sent by virtual instance 10111 based on information about cloud-native application 41. When decapsulating the overlay packet, virtual instance manager 102131 identifies that the service packet is from cloud-native application 41 and can therefore manage security policies for accessing cloud-native application 42 based on the identifier.

[0051] 4 is a simplified flowchart of a virtual instance creation method based on cloud computing technology according to an embodiment of the present invention. As shown in FIG. 4, the method includes, but is not limited to, the following steps:

[0052] Step S301: The cloud management platform receives a virtual instance creation request input by a tenant, where the virtual instance creation request includes information on the specifications of the virtual instance to be created and information on the cloud-native application to which the virtual instance to be created belongs.

[0053] 3, for example, the cloud management platform 20 receives a virtual instance creation request input by tenant A, and the virtual instance creation request includes specification information of the virtual instance 10111 to be created and information about the cloud-native application 41. The specification information may include a failure domain, a deployment set, a host health status, a host model, a processor architecture, the number of processor cores, a bandwidth, a memory size, the number of network adapters, etc. This is not a limitation of the present invention.

[0054] A virtual instance creation request input by a tenant is obtained so that a virtual instance that meets the requirements of the tenant's specifications can be provided to the tenant based on the tenant's actual requirements.

[0055] Step S302: Select to create a virtual instance on a computing node in a cloud data center that can provide specifications that match the specification information.

[0056] The cloud management platform selects a computing node that can meet the virtual instance specification information from the infrastructure based on the virtual instance specification information entered by the tenant, and creates the virtual instance. The virtual instance is configured to run a cloud-native application or one or more microservices within the cloud-native application. For example, referring to FIG. 3 , the cloud management platform 20 selects a computing node 1011 that can provide specifications that meet the specification information entered by the tenant, and creates a virtual instance 10111. The virtual instance 10111 runs the cloud-native application 41 or one or more microservices within the cloud-native application 41.

[0057] The virtual instance creation request input by the tenant includes specification information of the virtual instance to be created and information of the cloud native application. The cloud management platform can select a computing node that meets the specification information from the infrastructure based on the specification information. Optionally, if Tenant A inputs multiple virtual instance creation requests, the cloud management platform may provide virtual instances of different computing nodes or the same computing node that meet Tenant A's specification information. The different computing nodes may be configured in different cloud data centers or the same cloud data center, which is not a limitation in this embodiment of the present invention.

[0058] Step 303: Based on the information about the cloud-native application, configure the virtual instance manager of the computing node to mark service packets sent by the virtual instance with an identifier of the cloud-native application.

[0059] The cloud management platform can configure the virtual instance manager to mark packets sent by the virtual instance, encapsulate the packets in overlay packets, and send the overlay packets. As shown in FIG. 2, the virtual instance manager 101131 is configured in the computing node 1011 where the virtual instance 10111 is located. Referring to FIG. 3, when the virtual instance 10111 generates a service packet to access the virtual instance 10212 in the process of executing the cloud-native application 41, the service packet needs to pass through the network interface 411 and reach the virtual switch 400 for forwarding. The virtual switch 400 is managed by the virtual instance manager 101131 (not shown in the figure) of the computing node 1011. When the service packet passes through the virtual switch 400, the virtual instance manager 101131 marks the service packet by using an identifier of the cloud-native application 41 based on the configuration of the cloud management platform 20.

[0060] Based on the above steps, a virtual instance creation request input by a tenant is obtained, and a service packet sent by the virtual instance created in the running process is identified based on information about the cloud-native application in the virtual instance creation request. In this manner, the service packet is encapsulated to generate an access packet, and the access packet is then sent by the computing node to the access object. Note that the encapsulation may be completed by the virtual instance manager or may be implemented by the computing node's network adapter. Thus, the access packet can carry an identifier of the cloud-native application. When the destination computing node receives the access packet and decapsulates the service packet, the destination computing node can identify the identifier carried in the service packet. In this manner, the destination computing node manages access permissions for the service packet based on the identifier to control the security policy of the access object.

[0061] For a clearer explanation, please refer to Figure 5. Figure 5 is a schematic flowchart of a virtual instance creation method based on cloud computing technology according to an embodiment of the present invention. The details are as follows:

[0062] Figure 5 further details the virtual instance creation method provided in Figure 4. Referring to the structure shown in Figure 3, as further shown in Figure 5, the method includes the following steps:

[0063] S101: The client 21 transmits a virtual instance creation request input by the tenant A.

[0064] Tenant A logs in to the cloud management platform 20 via a client 21 and inputs a virtual instance creation request via an interface provided by the cloud management platform 20, where the virtual instance creation request includes information on the specifications of the virtual instance to be created and information on the cloud-native application to which the virtual instance to be created belongs.

[0065] It should be noted that the information about the cloud-native application may include information about the name of the cloud-native application, an identifier ID, information about a path, information about attributes, information about a user, etc., and one or more of the aforementioned information may identify a service packet, which is not limited in this embodiment of the present invention.

[0066] Optionally, the virtual instance creation request input by the tenant may further include site information. The site information specifically indicates sites deployed in a country or region to provide cloud services to tenants in a specific range of countries or regions. The site information includes geographical locations, service contents, coverage areas, etc. This is not limited in this embodiment of the present invention.

[0067] Additionally, in this embodiment of the present invention, the client 21 may be a terminal device such as a mobile phone, a personal computer, a personal digital assistant, or a thin client with network access capability, or may be an in-vehicle host or another terminal device with network access capability.

[0068] S102: The cloud management platform 20 receives a virtual instance creation request input by tenant A.

[0069] The cloud management platform 20 receives a virtual instance creation request input by tenant A on an interface provided by the cloud management platform 20 .

[0070] S103: Select a computing node 1011 that is in the cloud data center 101 and can provide specifications that match the specification information.

[0071] The cloud management platform 20 selects a computing node 1011 as a hardware carrier to carry the virtual instance 10111 for execution based on the specification information of the virtual instance 10111 and the information of the cloud native application 41 included in the virtual instance creation request input by tenant A. The cloud data center 101 can provide a computing node 1011 that matches the specification information.

[0072] The process of the cloud management platform 20 selecting computing nodes to create virtual instances may be performed based on the configuration input by tenant A, or the cloud management platform 20 may select computing nodes according to pre-set rules, which is not limited in this embodiment of the present invention.

[0073] Optionally, if the virtual instance creation request input by Tenant A includes site information, the cloud management platform 20 may select a computing node within the site's cloud data center from the site input by Tenant A that matches the specification information.

[0074] S104: Virtual instance 10111 is created.

[0075] Cloud management platform 20 creates virtual instance 10111 on computing node 1011. Virtual instance 10111 is configured to run cloud-native application 41 or one or more microservices within cloud-native application 41. Cloud-native application 41 may be configured by cloud management platform 20 based on information about cloud-native application 41 entered by tenant A, or may be configured by cloud management platform 20 based on information about cloud-native application 41 entered by another tenant with relevant permissions.

[0076] Optionally, virtual instance 10111 may be further configured to run some of the microservices in cloud-native application 41. This is not limited to this embodiment of the present invention.

[0077] S105: Based on the information about the cloud-native application 41, configure the virtual instance manager 101131 of the computing node 1011 to mark the service packet P1 sent by the virtual instance 10111 by using the identifier of the cloud-native application.

[0078] Based on information about the cloud native application 41, the cloud management platform 20 configures the virtual instance manager 101131 of the computing node 1011 to mark the service packet P1 sent by the virtual instance 10111 using the identifier of the cloud native application 41.

[0079] S106: The security rule R1 input by the tenant is transmitted.

[0080] Tenant A logs in to the cloud management platform 20 via a client 21 and inputs a security rule R1 via an interface provided by the cloud management platform 20. The security rule R1 is used to manage access permissions to the cloud-native application 41. When another cloud-native application generates a service packet for accessing the cloud-native application 41, the security rule R1 determines whether the service packet has permission to access the cloud-native application 41.

[0081] It should be noted that regardless of the virtual instance creation request or security rules entered by the tenant, the inputs described herein may be performed directly by the tenant on an input interface provided by the cloud management platform or may be selected by the tenant based on different options provided by the cloud management platform.

[0082] S107: Receive security rules R1 input by the tenant.

[0083] The cloud management platform 20 receives the security rule R1 input by tenant A.

[0084] S108: Configure the virtual instance manager 101131 of the computing node 1011 to record the security rule R1.

[0085] The cloud management platform 20 configures the virtual instance manager 101131 in the computing node 1011 to record the security rule R1 entered by the tenant.

[0086] S109: The virtual instance manager 101131 allows or prohibits, in accordance with security rule R1, sending to the virtual instance 10111 a service packet P2 sent to the virtual instance 10111 by another cloud-native application or a virtual instance running one or more microservices within another cloud-native application.

[0087] From step S105, it can be seen that the virtual instance manager 101131 marks the service packet P1 sent by the virtual instance 10111 running the cloud-native application 41 or one or more microservices within the cloud-native application 41 based on the identifier of the cloud-native application 41. Similarly, a virtual instance running another cloud-native application or one or more microservices within the other cloud-native application is further configured within the infrastructure. When the other virtual instance generates a service packet P2 for accessing the virtual instance 10111 in a running process, the service packet P2 is also marked with the identifier of the cloud-native application run by the other virtual instance. In this way, when the service packet P2 passes through the virtual instance manager 101131 in the computing node 1011, the virtual instance manager 101131 identifies the identifier with which the service packet P2 is marked, which is that of the cloud-native application to which another virtual instance belongs, and decides whether to send the service packet P2 to the virtual instance 10111 based on the permission of the service packet P2 to access the virtual instance 10111 recorded by the virtual instance manager 101131 and the permission found in the security rule R1.

[0088] Based on the above steps, access permissions and security policies are managed using the identifier of the cloud-native application. Specifically, the identifier of the cloud-native application is used to mark service packets sent by the virtual instance, and then the identifier of the cloud-native application is identified and authenticated. In this way, in the process of forwarding service packets, permission management and control can be performed without relying solely on the source IP address and the destination IP address. For example, there are multiple computing nodes, multiple cloud-native applications, and multiple virtual instances configured to run these cloud-native applications within an infrastructure. When a virtual instance invokes a different virtual instance to run multiple microservices within the same cloud-native application in the process of running a cloud-native application, the changing virtual instance needs to be configured with a correspondingly changing network interface. Security policies are managed based on the identifier of the cloud-native application, so that when an IP address changes due to a change in the network interface, security policy changes for all computing nodes can be avoided; only the identifier of the cloud-native application to which the changing network interface belongs needs to be configured. This simplifies security policy configuration and improves permission management efficiency.

[0089] In an embodiment of the present invention, Figure 6 is another schematic flowchart of a virtual instance creation method based on cloud computing technology according to an embodiment of the present invention, and the description is provided with reference to Figure 3. The details are as follows:

[0090] S101: A virtual instance 10211 is deployed on a computing node 1021.

[0091] Computing nodes 1021 configured in the cloud data center 102 are deployed on the infrastructure 1, and virtual instances 10211 are further configured on the computing nodes 1021. The virtual instances 10211 are configured to run a cloud-native application 42 or one or more microservices within the cloud-native application 42.

[0092] S102: The security rule R2 input by the tenant is transmitted.

[0093] Tenant A logs in to cloud management platform 20 via client 21 and inputs security rule R2 into an interface provided by cloud management platform 20, and security rule R2 is used to manage the access permissions for cloud native application 41 to access cloud native application 42.

[0094] S103: Receive security rules R2 input by the tenant.

[0095] The cloud management platform 20 receives the security rule R2 input by tenant A.

[0096] Optionally, the virtual instance 10211 may be instead created in the infrastructure based on a virtual instance creation request input by Tenant A or Tenant B. Specifically, before the cloud management platform 20 receives the security rule R2 input by Tenant A, the cloud management platform 20 may further receive, from a client corresponding to Tenant A or Tenant B, a virtual instance creation request for the virtual instance 10211 input by Tenant A or Tenant B. The virtual instance creation request includes specification information of the virtual instance 10211 and information about the cloud-native application 42. Based on the virtual instance creation request, the cloud management platform 20 selects a computing node 1021 that is in the cloud data center 102 and can provide specifications that match the specification information to create the virtual instance 10211. Based on this, the virtual instance manager 102131 that is set on the computing node 1021 and configured to manage the virtual instance 10211 is configured to mark service packets sent by the virtual instance 1021 with an identifier of the cloud-native application 42 based on the information about the cloud-native application 42.

[0097] S104: Configure the virtual instance manager 102131 of the computing node 1021 to record the identifier of the cloud native application 41 and the security rule R2.

[0098] The cloud management platform 20 configures the virtual instance manager 102131 set up on the computing node 1021 to record the identifier of the cloud native application 41 and the security rule R2.

[0099] S105: The destination address of the service packet P1 sent by the virtual instance 10111 is the virtual instance 10211.

[0100] In the process of executing the cloud native application 41 or one or more microservices within the cloud native application 41, the virtual instance 10111 generates a service packet P1 to access the virtual instance 10211, and the destination IP address of the service packet P1 is the virtual instance 10211.

[0101] S106: The virtual instance manager 102131 determines whether the identifier of the cloud native application 41 on which the service packet P1 sent by the virtual instance 10111 is marked matches the identifier recorded by the virtual instance manager 102131.

[0102] When the service packet P1 arrives at the computing node 1021, the virtual instance manager 102131 identifies the identifier contained in the service packet and determines whether the cloud native application 41 marked with the service packet P1 sent by the virtual instance 10111 matches the identifier recorded by the virtual instance manager 102131, and if there is a match, performs the following steps; if there is no match, prohibits the service packet P1 from accessing the virtual instance 10211.

[0103] S107: If the identifiers match, allow or prohibit the transmission of the service packet P1 to the virtual instance 10211 according to the security rule R2.

[0104] Upon determining that the identifier of the cloud native application 41 with which the service packet P1 is marked matches an identifier recorded by the virtual instance manager 102131, the virtual instance manager 102131 determines whether to allow or prohibit the transmission of the service packet P1 to the virtual instance 10211 in accordance with the recorded security rule R2.

[0105] S108: If security rule R2 allows transmission of service packet P1 to virtual instance 10211.

[0106] If the security rule R2 recorded by the virtual instance manager 102131 allows the transmission of the service packet P1 to the virtual instance 10211, the following steps are performed.

[0107] S109: The service packet P1 is sent to the virtual instance 10211.

[0108] The virtual instance manager 102131 transfers the received service packet P1 to the virtual instance 10211.

[0109] S110: When security rule R2 prohibits sending service packet P1 to virtual instance 10211.

[0110] If the security rule R2 recorded by the virtual instance manager 102131 prohibits the transmission of the service packet P1 to the virtual instance 10211, the service packet P1 is not forwarded by the virtual instance manager 102131.

[0111] S111: A packet indicating a transmission failure is fed back.

[0112] The virtual instance manager 102131 feeds back to the virtual instance 10111 a packet indicating the failure of the transmission of the service packet P1.

[0113] S112: A packet indicating a transmission failure is fed back.

[0114] The virtual instance manager 102131 feeds back a packet indicating the failure of the transmission of the service packet P1 to the cloud management platform 20, and the cloud management platform 20 records the failure of the transmission.

[0115] In an embodiment of the present invention, for example, an enterprise configures a financial cloud-native application and a human resources cloud-native application. The financial cloud-native application is executed by a virtual instance 10111, and the human resources cloud-native application is executed by a virtual instance 10211. The virtual instance 10111 is configured on a computing node 1011. The computing node 1011 and the computing node 1021 may be deployed in the same cloud data center or in different cloud data centers. Similarly, the computing node 1011 and the computing node 1021 may be deployed in the same site or in different sites. For ease of explanation, in this embodiment, the computing node 1011 is deployed in the cloud data center 101, the virtual instance 10211 is configured on the computing node 1021, and the computing node 1021 is deployed in the cloud data center 102. The computing node 1011 and the computing node 1021 belong to two different sites.

[0116] If the HR cloud-native application is not expected to be accessed by another cloud-native application or one or more microservices within another cloud-native application, the cloud management platform 20 can configure security rule R1 to prohibit another cloud-native application or one or more microservices within another cloud-native application from accessing the HR cloud-native application and configure the virtual instance manager 102131 in the computing node 1021 to record security rule R1. In the execution process, the virtual instance 10111 generates a service packet P1 for accessing the virtual instance 10211. The service packet P1 is marked by the virtual instance manager 101131 and carries an identifier of the Finance cloud-native application. When the service packet P1 arrives at the virtual instance manager 102131, the virtual instance manager 102131 determines that the identifier of the cloud-native application carried in the service packet P1 belongs to another cloud-native application or one or more microservices within the other cloud-native application, prohibits access of the service packet P1, and stops forwarding the service packet P1 to the virtual instance 10211.

[0117] If the HR cloud-native application prohibits access to only the financial cloud-native application or one or more microservices within the financial cloud-native application, while allowing access to another cloud-native application, the company can further configure security rule R2 via cloud management platform 20. Security rule R2 prohibits the financial cloud-native application from accessing the HR cloud-native application. Furthermore, virtual instance manager 102131 on computing node 1021 is configured to record security rule R2 and the identifiers of the financial cloud-native applications that are prohibited from accessing the HR cloud-native application. During the execution process, virtual instance 10111 generates service packet P1 for accessing virtual instance 10211. Service packet P1 is marked by virtual instance manager 101131 and carries the identifier of the financial cloud-native application. When service packet P1 arrives at virtual instance manager 102131, virtual instance manager 102131 determines that the identifier of the cloud-native application carried by virtual instance 10111 matches the identifier recorded by virtual instance manager 102131, and the recorded security rule R2 prohibits access for the service packet marked with the identifier, causing virtual instance manager 102131 to stop forwarding service packet P1 to virtual instance 10211.

[0118] In the aforementioned virtual instance creation method based on cloud computing technology, when a cloud-native application or one or more microservices within the cloud-native application needs to set precise security policies for managing access permissions for another cloud-native application or one or more microservices within the cloud-native application, this technical solution can implement permission management at the access end through identifier identification and destination end determination. In particular, when security policies are configured for a large number of cloud-native applications and microservices included in the cloud-native applications, the efficiency of configuration is improved and the complexity of configuration operations is significantly reduced.

[0119] Based on the virtual instance creation method implemented in the above steps, the present invention further provides an embodiment in an application-native cloud network. Figure 7 is an architecture diagram of a virtual instance creation method based on cloud computing technology in an application-native cloud network scenario according to an embodiment of the present invention. The details are as follows:

[0120] The application-native cloud network scenario includes a global management and control plane and a site-level controller. Global APIs can be called to configure address management, rule management, and application management on the global management and control plane. The ANC is a global model. This model includes a network address range specified by a tenant. If a tenant does not specify a network address range, the ANC can allocate the network address range to the tenant.

[0121] Specifically, the ANC can automatically allocate management addresses. The global management and control plane of the ANC divides the IP address pool included in the network address range of the tenant within the ANC into several smaller IP address pools. In other words, management is performed in an address segmentation manner. The following steps are included: (a) When a tenant creates a network interface in a site based on ANC, the address allocation module in the ANC's site-level controller automatically allocates an address from the site's address pool. (b) When the address pool of a site is exhausted, the address allocation module in the site-level controller requests new address space from the address management module at the global level. After receiving this request, the global address management module obtains a segment address pool from the segment address pool of the idle address pool and sends the segment address pool to the address allocation module at the site level to complete the address pool of the site. (c) After all addresses in the site-level controller's segment address pool are released, the segment is reclaimed from the site's address pool. In other words, the segment address pool no longer belongs to the site and is reclaimed into the ANC's idle address pool, where it can be assigned to another site in the future.

[0122] 3 , in an embodiment of the present invention, when creating a network interface based on ANC, the ANC management control plane assigns an address to the network interface, so the tenant does not need to specify an IP address, but needs to specify the site where the network interface is located and the cloud-native application to which the network interface is bound. When the network interface forwards service packets sent by the virtual instance where the cloud-native application is located, the network interface is configured by the virtual instance manager to integrate an identifier of the cloud-native application. Then, each packet sent from the network interface carries the identifier of the cloud-native application to which the network interface belongs.

[0123] Based on this, after the security rules entered by the tenant are obtained, IP addresses do not need to be configured, and only the access-end cloud-native applications that can be accessed need to be determined at the destination end. The security rules are distributed to the data plane via the management and control plane to deploy security policies.

[0124] In the above-mentioned ANC scenario, the embodiment of the present invention further discloses an implementation form of a virtual machine instance. Figure 8 is an architecture diagram of a virtual machine instance in a virtual instance creation method based on cloud computing technology according to an embodiment of the present invention. The details are as follows:

[0125] Virtual instance 10111, virtual instance 10112, virtual instance 10211, and virtual instance 10212 are all virtual machines. Virtual instance 10111 and virtual instance 10112 are configured to run cloud-native application 41. Virtual instance 10211 and virtual instance 10212 are configured to run cloud-native application 42. Cloud-native application 41 and cloud-native application 42 communicate in application-native cloud network 40. Virtual instance 10111 is deployed in cloud data center 101 in core site A and is coupled to a network interface 411 configured in the cloud data center 101 represented by core site A to implement network access. Virtual instance 10112 is deployed in cloud data center 101 of edge site B and is coupled to a network interface 412 configured in the cloud data center represented by edge site B to implement network access. A virtual instance 10211 is deployed in a cloud data center 102 in a core site C and coupled to a network interface 421 configured in the cloud data center 102 represented by the core site C to implement network access. A virtual instance 10212 is deployed in a private site D and coupled to a network interface 422 of a local data center represented by the private site D to implement network access. The edge site B, the core site A, and the core site C may be in the same geographic location or in different geographic locations. The private sites belong to the tenant's local data center.

[0126] For example, a tenant can use the interface to create a virtual machine and an auto scaling (AS) group. When creating a virtual machine, the tenant needs to invoke the virtual network interface to create a corresponding NEP. In this case, the tenant does not need to specify network-related parameters such as Region, VPC, Subnet, AZ, and other information, but only needs to specify the site where the NEP is located and the cloud-native application to which the NEP belongs to the ANC. On the network resource side, direct interworking between NEPs in different sites can be implemented by creating a global ANC network. In this way, the access permissions of cloud-native applications can be managed by configuring security policies for cloud-native applications according to the above embodiments.

[0127] In the ANC scenario, the embodiment of the present invention further discloses the implementation of a container instance. Figure 9 is an architecture diagram of a container instance in a container creation method based on cloud computing technology according to an embodiment of the present invention. The details are as follows:

[0128] The computing resources in the figure include virtual instance 10111, virtual instance 10112, virtual instance 10121, virtual instance 10122, virtual instance 10211, virtual instance 10212, virtual instance 10221, and virtual instance 10222. All of the virtual instances are containers. Virtual instance 10111, virtual instance 10112, virtual instance 10121, and virtual instance 10122 are configured to run cloud-native application 51. Virtual instance 10211, virtual instance 10212, virtual instance 10221, and virtual instance 10222 are configured to run cloud-native application 52. Cloud-native application 51 and cloud-native application 52 communicate in application-native cloud network 50. Virtual instance 10111 and virtual instance 10112 are deployed at core site A and are coupled to network interface 511 and network interface 512, respectively, to implement network access. Virtual instance 10121 and virtual instance 10122 are deployed at edge site B and are coupled to network interface 513 and network interface 514, respectively, to implement network access. Virtual instance 10211 and virtual instance 10212 are deployed at core site C and are coupled to network interface 521 and network interface 522, respectively, to implement network access. Virtual instance 10221 and virtual instance 10222 are deployed at private site D and are coupled to network interface 523 and network interface 524, respectively, to implement network access. Edge site B, core site A, and core site C may be in the same geographic location or in different geographic locations. The private sites belong to the tenant's local data center.

[0129] For example, in a container instance scenario, tenants do not need to worry about interactions between multiple regions. Instead, they only need to create a global ANC, and the NEPs of each site can interact directly with each other. Based on the automatic allocation of IP addresses by the ANC, in the process of creating a network interface for binding container instances, the IP address can be bound to the network interface without configuring a network address range. Based on the interconnection and site information, security policies are configured based on information about the cloud-native application to which each container instance belongs, using the cloud-native application's identifier as an identification object, simplifying access permission management. The specific configuration process is described in the preceding steps.

[0130] 10 is a diagram of a data format structure of an overlay packet in a virtual instance creation method based on cloud computing technology according to an embodiment of the present invention. As shown in FIG. 10, the overlay packet in this embodiment of the present invention can be encapsulated in VXLAN format. Details are as follows:

[0131] A VXLAN packet encapsulates an inner packet in the data portion (payload) of a UDP packet. The data portion of the UDP packet carries a VXLAN header, an inner Ethernet header, an inner IP header, and the data portion (payload) of the IP packet. The inner packet includes an inner Ethernet header, an inner IP header, and the data portion (payload) of the IP packet. The inner Ethernet header records the source MAC address and destination MAC address of the inner packet, and the inner IP header records the source IP address and destination IP address of the inner packet.

[0132] The VXLAN packet further includes a tunnel encapsulation header, which includes an outer Ethernet header, an outer IP header, an outer User Datagram Protocol (UDP) header, and a VXLAN header. The VXLAN header includes a VXLAN Flags field (8 bits), a VNI field (14 bits), and a Reserved field (24 bits).

[0133] The outer Ethernet header records the source MAC address of the VXLAN tunnel endpoint (VTEP) and the destination MAC address of the VXLAN tunnel terminal, while the outer IP header records the source IP address of the VXLAN tunnel terminal and the destination IP address of the VXLAN tunnel terminal.

[0134] A VXLAN tunnel endpoint is sometimes called a VTEP device. A VTEP device is the endpoint of a VXLAN tunnel and is configured to encapsulate an inner packet. An outer Ethernet header, an outer IP header, an outer User Datagram Protocol header, and a VXLAN header are added to the inner packet to generate a VXLAN packet, which is then sent to another VTEP device. A VXLAN packet received from another VTEP device can also be decapsulated. The outer Ethernet header, the outer IP header, the outer User Datagram Protocol header, and the VXLAN header are removed from the VXLAN packet to obtain the inner packet, and the VNI is obtained from the VXLAN header.

[0135] In this embodiment of the present invention, the virtual instance manager may be configured as a VXLAN tunnel terminal to encapsulate service packets sent by the virtual instance and encapsulate the service packets in the inner packet of the overlay packet, i.e., the payload portion within a UDP packet. The outer packet of the overlay packet is configured with a cloud-native application identifier. Specifically, the cloud-native application identifier may be configured in a VXLAN header using the VXLAN GPE protocol, and the VXLAN header is used as the outer packet. In this way, when the overlay packet arrives at the virtual instance manager at the destination end, the cloud-native application identifier may be identified in the process of decapsulating the overlay packet, and a security policy may then be determined according to the security rules.

[0136] It should be noted that VXLAN is only one type of overlay network technology, and in this embodiment of the present invention, VXLAN is only used as an example for explanation in this embodiment of the present invention, and the type of overlay packet is not limited.

[0137] Optionally, the virtual instance in this embodiment of the present invention is a virtual machine or a container.

[0138] The embodiment of the present invention further provides a cloud network system. Figure 11 is an architecture diagram of a cloud network system in a virtual instance creation method based on cloud computing technology according to an embodiment of the present invention. Details are as follows:

[0139] For example, the cloud network system includes a cloud-native network 40, a first virtual instance 10111, a second virtual instance 10211, and a cloud management platform 20. The cloud-native network 40 is configured to connect multiple network interfaces, each coupled to one virtual instance. The first virtual instance 10111 is coupled to a first network interface 411 among the multiple network interfaces and configured to run a first cloud-native application 41 or one or more microservices within the first cloud-native application 41. The second virtual instance 10211 is coupled to a second network interface 421 among the multiple network interfaces and configured to run a second cloud-native application 42 or one or more microservices within the second cloud-native application 42. The cloud management platform 20 is for receiving security rules input by tenant A, where the security rules indicate permission for the first cloud-native application 41 to access the second cloud-native application 42. The first network interface 411 and / or the second network interface 421 use security rules to determine whether to allow access packets to pass between the first virtual instance 10111 and the second virtual instance 10211.

[0140] The present application further provides a cloud management platform. Figure 12 is a structural diagram of a cloud management platform in a virtual instance creation method based on cloud computing technology according to an embodiment of the present invention. Details are as follows:

[0141] The request receiving module 301 is configured to receive a first virtual instance creation request input by a first tenant, the first virtual instance creation request including information on specifications of the first virtual instance to be created and information on a first cloud-native application to which the first virtual instance to be created belongs. The request receiving module 301 is further configured to receive a second virtual instance creation request input by the first tenant or a second tenant, the second virtual instance creation request including information on specifications of the second virtual instance to be created and information on a second cloud-native application to which the second virtual instance to be created belongs.

[0142] The instance creation module 302 is configured to select a first virtual instance to be created on a first computing node in a first cloud datacenter that can provide a specification that matches the specification information, the first virtual instance being configured to run the first cloud-native application or one or more microservices in the first cloud-native application, and the multiple cloud datacenters include the first cloud datacenter. The instance creation module 302 is further configured to select a second virtual instance to be created on a second computing node in a second cloud datacenter that can provide a specification that matches the specification information.

[0143] The configuration module 303 is configured to configure a first virtual instance manager of the first computing node to mark service packets transmitted by the first virtual instance with an identifier of the first cloud-native application based on information about the first cloud-native application. The configuration module 303 is further configured to configure the first virtual instance manager of the first computing node to record a first security rule. The configuration module 303 is further configured to configure a second virtual instance manager of the second computing node to record an identifier of the first cloud-native application and a second security rule. The configuration module 303 is further configured to configure a second virtual instance manager of the second computing node to mark service packets transmitted by the second virtual instance with an identifier of the second cloud-native application based on information about the second cloud-native application.

[0144] The rule receiving module 304 is configured to receive a first security rule input by a first tenant, the first security rule indicating access permissions to a first cloud-native application. The rule receiving module 304 is further configured to receive a second security rule input by the first tenant, the second security rule indicating permission for the first cloud-native application to access a second cloud-native application.

[0145] The interface setting module 305 is configured to configure a first network interface for a first cloud-native application and to couple at least one virtual instance running a microservice in the first cloud-native application to the first network interface, where the at least one virtual instance running a microservice in the first cloud-native application includes a first virtual instance, and the first network interface is configured to a first cloud datacenter indicated by the first site information. The interface setting module 305 is further configured to configure a second network interface for a second cloud-native application and to couple at least one virtual instance running a microservice in the second cloud-native application to the second network interface, where the at least one virtual instance running a microservice in the second cloud-native application includes a second virtual instance, and the second network interface is configured to a second cloud datacenter indicated by the second site information.

[0146] It should be noted that the tenants in the above embodiment may be replaced with multiple other tenants, and the above modules may implement corresponding technical functions, which is not limited in this embodiment of the present invention.

[0147] The request receiving module 301, the instance creating module 302, the configuration module 303, the rule receiving module 304, and the interface setting module 305 can all be implemented by using software or hardware. For example, the following describes the implementation of the request receiving module 301 by using the request receiving module 301 as an example. Similarly, for the implementation of the instance creating module 302, the configuration module 303, the rule receiving module 304, and the interface setting module 305, please refer to the implementation of the request receiving module 301.

[0148] This module is used as an example of a software functional unit, and the request receiving module 301 may include code running on a virtual instance. The virtual instance may include at least one of a physical host (computing device), a virtual machine, and a container. Furthermore, there may be one or more virtual instances. For example, the request receiving module 301 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers configured to run the code may be distributed in the same region or in different regions.

[0149] This module is used as an example of a hardware functional unit, and the request receiving module 301 may include at least one computing device, such as a server. Alternatively, the request receiving module 301 may be a device implemented by using an application-specific integrated circuit (ASIC), a programmable logic device (PLD), etc. The PLD may be implemented by a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0150] It should be noted that in another embodiment, the request receiving module 301 may be configured to perform any step of a virtual instance creation method based on cloud computing technology, the instance creation module 302 may be configured to perform any step of a virtual instance creation method based on cloud computing technology, the configuration module 303 may be configured to perform any step of a virtual instance creation method based on cloud computing technology, the rule receiving module 304 may be configured to perform any step of a virtual instance creation method based on cloud computing technology, and the interface setting module 305 may be configured to perform any step of a virtual instance creation method based on cloud computing technology. The steps that the request receiving module 301, the instance creation module 302, the configuration module 303, the rule receiving module 304, and the interface setting module 305 are responsible for implementing may be specified as needed. The request receiving module 301, the instance creation module 302, the configuration module 303, the rule receiving module 304, and the interface setting module 305 separately implement different steps of the virtual instance creation method based on cloud computing technology to implement all functions of the cloud management platform.

[0151] The above has described in detail the method, apparatus and system in the embodiments of the present application. In order to better implement the aforementioned solutions in the embodiments of the present application, the following correspondingly further provides related devices configured to cooperate in implementing the aforementioned solutions.

[0152] The present application provides a computing device. Figure 13 is a diagram of the structure of a computing device in a virtual instance creation method based on cloud computing technology according to an embodiment of the present invention. The computing device 300 includes a bus 307, a processor 308, a memory 306, and a communication interface 309. The processor 308, the memory 306, and the communication interface 309 communicate with each other via the bus 307. The computing device 300 may be a server or a terminal device. It should be understood that the number of processors and memories in the computing device 300 is not limited in the present application.

[0153] The bus 307 may be a peripheral component interconnect (PCI) bus, an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, the bus is shown in FIG. 13 using only one line. However, this does not imply that there is only one bus or only one type of bus. The bus 307 may include a path for transmitting information between components of the computing device 300 (e.g., the memory 306, the processor 308, and the communication interface 309).

[0154] The processor 308 may include any one or more processors, such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0155] The memory 306 may include volatile memory, such as random access memory (RAM). The processor 308 may further include non-volatile memory, such as read-only memory (ROM), flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0156] The memory 306 stores executable program code, and the processor 308 executes the executable program code to separately implement the functions of the request receiving module 301, the instance creating module 302, the configuration module 303, the rule receiving module 304, and the interface setting module 305, and to implement the virtual instance creation method based on cloud computing technology. In other words, the memory 306 stores instructions used by the cloud management platform to execute the virtual instance creation method based on cloud computing technology.

[0157] The communication interface 309 uses a transceiver module, such as, but not limited to, a network interface card or transceiver, to implement communications between the computing device 300 and another device or communication network.

[0158]

[0009] Embodiments of the present application further provide a computing device cluster. The computing device cluster includes at least one computing device. The computing device may be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device may alternatively be a terminal device, such as a desktop computer, a notebook computer, or a smartphone.

[0159] 14 is a diagram of a structure of a computing device cluster in a virtual instance creation method based on cloud computing technology according to an embodiment of the present application. As shown in FIG. 14, the computing device cluster includes at least one computing device 300, and the memory 306 in one or more computing devices 300 in the computing device cluster can store the same instructions used by the cloud management platform to execute the virtual instance creation method based on cloud computing technology.

[0160] In some possible implementations, one or more computing devices 300 in the computing device cluster may alternatively be configured to execute instructions used by a cloud management platform to perform a virtual instance creation method based on cloud computing technology. In other words, a combination of one or more computing devices 300 may collectively execute instructions used by a cloud management platform to perform a virtual instance creation method based on cloud computing technology.

[0161] It should be noted that the memories 306 in different computing devices 300 in the computing device cluster may store different instructions for performing certain functions of the cloud management platform. In other words, the instructions stored in the memories 306 in the different computing devices 300 may implement the functions of one or more of the request receiving module 301, the instance creating module 302, the configuration module 303, the rule receiving module 304, and the interface setting module 305.

[0162] 15 is a diagram of another structure of a computing device cluster in a virtual instance creation method based on cloud computing technology according to an embodiment of the present application. As shown in FIG. 15, two computing devices 300A and 300B are connected to each other via a communication interface 309. The memory in the computing device 300A stores instructions used to execute the functions of the instance creation module 302, the configuration module 303, and the interface setting module 305. The memory in the computing device 300B stores instructions used to execute the functions of the request receiving module 301 and the rule receiving module 304. In other words, the memories 306 of the computing devices 300A and 300B together store instructions used by the cloud management platform to execute the virtual instance creation method based on cloud computing technology.

[0163] 15 can take into account that the virtual instance creation method based on the cloud computing technology provided in the present application requires a large amount of computing to be performed when creating and configuring virtual instances and network interfaces, and that computing must be performed based on the simultaneous configuration of multiple tenants. Considering the data transmission workload of the request receiving module 301 and the rule receiving module 304, in order to avoid overloading operations on the computing device 300A, the functions implemented by the request receiving module 301 and the rule receiving module 304 are executed by the computing device 300B.

[0164] 15 may alternatively be completed by multiple computing devices 300. Similarly, the functions of computing device 300B may alternatively be completed by multiple computing devices 300.

[0165] FIG. 16 is a diagram of another structure of a computing device cluster in a virtual instance creation method based on cloud computing technology according to an embodiment of the present application. In some possible implementations, one or more computing devices in the computing device cluster may be connected to each other via a network. The network may be a wide area network, a local area network, or the like. FIG. 16 illustrates a possible implementation. As shown in FIG. 16, two computing devices 300C and 300D are connected to each other via a network. Specifically, each computing device is connected to the network via a communication interface of the computing device. In this possible implementation, the memory 306 in the computing device 300C stores instructions for executing the instance creation module 302, the configuration module 303, and the interface setting module 305. Furthermore, the memory 306 in the computing device 300D stores instructions for executing the functions of the request receiving module 301 and the rule receiving module 304.

[0166] The connection method between computing device clusters shown in FIG. 16 can take into account that the virtual instance creation method based on cloud computing technology provided in the present application requires a large amount of computing power to create and configure virtual instances and network interfaces, and that computing power must be based on the simultaneous configuration of multiple tenants. A network is also required for connection. These functions are performed independently. To achieve optimal storage and computation performance, the large-scale traffic data transmission function implemented by the request receiving module 301 and the rule receiving module 304 may be performed by the computing device 300D.

[0167] 16 may alternatively be completed by multiple computing devices 300. Similarly, the functions of computing device 300D may alternatively be completed by multiple computing devices 300.

[0168] In some possible implementations, the memory 306 in one or more computing devices 300 in the computing device cluster may alternatively separately store some of the instructions used to execute the virtual instance creation method based on cloud computing technology. In other words, a combination of one or more computing devices 300 may jointly execute the instructions used to execute the virtual instance creation method based on cloud computing technology.

[0169]

[0013] An embodiment of the present application further provides a computer program product including instructions. The computer program product may be software or a program product including instructions and capable of being executed on a computing device or stored in any available medium. When the computer program product is executed on at least one computing device, the at least one computing device is applied to a cloud management platform and is enabled to execute the above-mentioned virtual instance creation method based on cloud computing technology.

[0170] An embodiment of the present application further provides a computer-readable storage medium. The computer-readable storage medium may be any available medium accessible by a computing device, or a data memory device, such as a data center, that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk drive, or a magnetic tape), an optical medium (e.g., a DVD), a semiconductor medium (e.g., a solid-state drive), or the like. The computer-readable storage medium includes instructions that are applied to a cloud management platform to instruct a computing device to perform the above-described virtual instance creation method based on cloud computing technology.

[0171] Finally, it should be noted that the above embodiments are merely intended to illustrate the technical solutions of the present invention, and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that the technical solutions described in the above embodiments may still be modified, or some or all of their technical features may be equivalently replaced. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to depart from the protection and scope of the technical solutions in the embodiments of the present invention.

[0172] For the detailed operating processes of the aforementioned systems, devices and units, reference can be made to the corresponding processes in the above-mentioned method embodiments, which can be clearly understood by those skilled in the art, and the details will not be described again in this specification.

[0173] The above description is merely a specific implementation of the present invention and is not intended to limit the protection scope of the present invention. Any modifications or replacements that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention shall fall within the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims. [Explanation of symbols]

[0174] 1. Infrastructure 10 areas 11 areas 12 areas 20 Cloud Management Platform 21 clients 22 clients 40 Cloud Native Networks 41 Cloud Native Applications 42 Cloud Native Applications 50 Application Native Cloud Networks 51 Cloud Native Applications 52 Cloud Native Applications 101 Cloud Data Center 102 Cloud Data Center 103 Cloud Data Center 111 Cloud Data Center 112 Cloud Data Center 113 Cloud Data Center 121 Cloud Data Center 122 Cloud Data Center 123 Cloud Data Center 300 computing devices 300A Computing Device 300B Computing Device 300C Computing Device 300D Computing Device 301 Request Receiving Module 302 Instance Creation Module 303 Configuration Module 304 Rule Receiving Module 305 Interface Settings Module 306 memory 307 Bus 308 processors 309 Communication Interface 400 virtual switches 401 Virtual Switch 411 First Network Interface 421 Secondary Network Interface 421 Network Interface 422 network interface 511 Network Interface 512 network interface 513 network interface 514 network interface 521 network interface 522 network interface 523 network interface 524 network interface 1010 Bandwidth Allocation Device 1011 compute nodes 1012 compute nodes 1021 computing nodes 10111 First Virtual Instance 10111 Virtual Instance 10112 Virtual Instances 10113 Host Operating System 10114 memory 10115 processor 10116 Network Adapter 10117 Hard Disk Drive 10121 Virtual Instances 10122 Virtual Instances 10211 Virtual Instances 10212 Virtual Instances 10221 Virtual Instances 10222 virtual instances 101131 Virtual Instance Manager 102131 Virtual Instance Manager 1011311 Cloud Management Platform Client

Claims

1. A virtual instance creation method based on cloud computing technology, the method being applied to a cloud management platform, the cloud management platform being configured to manage an infrastructure, the infrastructure including a plurality of cloud data centers deployed in a distributed manner, and a plurality of computing nodes being configured in each cloud data center, the method comprising: receiving a first virtual instance creation request input by a first tenant, the first virtual instance creation request comprising information on specifications of the first virtual instance to be created and information on a first cloud-native application to which the first virtual instance to be created belongs; selecting to create the first virtual instance on a first computing node in a first cloud datacenter that can provide a specification that matches the specification information, the first virtual instance being configured to run the first cloud-native application or one or more microservices within the first cloud-native application, and the plurality of cloud datacenters comprising the first cloud datacenter; and configuring a first virtual instance manager of the first computing node to mark service packets transmitted by the first virtual instance with an identifier of the first cloud-native application based on the information about the first cloud-native application; A method comprising:

2. The first virtual instance creation request further comprises first site information, and the method further comprises: The method of claim 1 , further comprising selecting the first cloud data center from the plurality of cloud data centers that matches the first site information.

3. The method comprises: receiving a first security rule input by the first tenant, the first security rule indicating access permissions to the first cloud-native application; and configuring the first virtual instance manager of the first computing node to record the first security rule; 3. The method of claim 1, wherein the first virtual instance manager allows or prohibits transmission to the first virtual instance of a service packet that is to be sent to the first virtual instance by a virtual instance running another cloud-native application or one or more microservices within the other cloud-native application, in accordance with the first security rule.

4. a second virtual instance is deployed on a second computing node within the infrastructure, the second virtual instance configured to run a second cloud-native application or one or more microservices within the second cloud-native application, the second computing node being configured in one of the plurality of cloud datacenters; and the method further comprising: receiving a second security rule input by the first tenant, the second security rule indicating permission for the first cloud-native application to access the second cloud-native application; and configuring a second virtual instance manager of the second computing node to record an identifier of the first cloud-native application and the second security rule; 4. The method of claim 1, wherein if the destination address of the service packet sent by the first virtual instance is the second virtual instance and the identifier of the first cloud-native application with which the service packet sent by the first virtual instance is marked matches the identifier recorded by the second virtual instance manager, the second virtual instance manager allows or prohibits transmission of the service packet sent by the first virtual instance to the second virtual instance in accordance with the second security rule.

5. Before the security rules entered by the first tenant for the first cloud-native application are received, the method further comprises: receiving a second virtual instance creation request input by the first tenant or a second tenant, the second virtual instance creation request comprising information on specifications of the second virtual instance to be created and information on the second cloud-native application to which the second virtual instance to be created belongs; selecting a second computing node in a second cloud data center to create the second virtual instance on the second computing node that can provide a specification that matches the specification information; and configuring the second virtual instance manager of the second computing node to mark service packets transmitted by the second virtual instance with an identifier of the second cloud-native application based on the information about the second cloud-native application; The method of claim 4 further comprising:

6. The method comprises: Configuring a first network interface for the first cloud-native application and binding at least one virtual instance running the microservice in the first cloud-native application to the first network interface, wherein the at least one virtual instance running the microservice in the first cloud-native application comprises the first virtual instance, and the first network interface is configured on the first cloud data center indicated by the first site information; and configuring a second network interface for the second cloud-native application and binding at least one virtual instance running the microservice in the second cloud-native application to the second network interface, wherein the at least one virtual instance running the microservice in the second cloud-native application comprises the second virtual instance, and the second network interface is configured in the second cloud data center indicated by second site information; The method of claim 4 or 5, wherein the first network interface and the second network interface are connected to each other via a cloud-native network configured in the infrastructure.

7. configuring a first virtual instance manager of the first computing node to mark service packets transmitted by the first virtual instance with an identifier of the first cloud-native application based on the information about the first cloud-native application; 7. The method of claim 1, comprising: configuring the first virtual instance manager to encapsulate the service packet in an inner packet of an overlay packet and set the identifier of the first cloud-native application in the outer packet of the overlay packet.

8. The method of claim 1 , wherein the first virtual instance comprises a virtual machine or a container.

9. A cloud management platform configured to manage an infrastructure, the infrastructure comprising a plurality of cloud data centers deployed in a distributed manner, wherein a plurality of computing nodes are configured in each cloud data center, the cloud management platform comprising: a request receiving module configured to receive a first virtual instance creation request input by a first tenant, the first virtual instance creation request comprising information on specifications of the first virtual instance to be created and information on a first cloud-native application to which the first virtual instance to be created belongs; an instance creation module configured to select to create the first virtual instance on a first computing node in a first cloud datacenter that can provide a specification that matches information in the specification, the first virtual instance configured to run the first cloud-native application or one or more microservices within the first cloud-native application, and the plurality of cloud datacenters comprises the first cloud datacenter; and a configuration module configured to configure a first virtual instance manager of the first computing node to mark service packets transmitted by the first virtual instance with an identifier of the first cloud-native application based on the information about the first cloud-native application; A cloud management platform that includes:

10. the first virtual instance creation request further comprises first site information; The cloud management platform of claim 9 , wherein the instance creation module is further configured to select the first cloud data center from the plurality of cloud data centers that matches the first site information.

11. The cloud management platform further comprises a rule receiving module; The rule receiving module is configured to receive a first security rule input by the first tenant, the first security rule indicating permission to access the first cloud-native application; the configuration module is further configured to configure the first virtual instance manager of the first computing node to record the first security rule; 11. The cloud management platform of claim 9 or 10, wherein the first virtual instance manager allows or prohibits transmission of service packets to the first virtual instance that are to be sent to the first virtual instance by a virtual instance running another cloud-native application or one or more microservices within the other cloud-native application in accordance with the first security rule.

12. a second virtual instance is deployed on a second computing node within the infrastructure, the second virtual instance configured to run a second cloud-native application or one or more microservices within the second cloud-native application, the second computing node configured in one of the plurality of cloud datacenters; The rule receiving module is further configured to receive a second security rule input by the first tenant, the second security rule indicating permission for the first cloud-native application to access the second cloud-native application; the configuration module is further configured to configure a second virtual instance manager of the second computing node to record an identifier of the first cloud-native application and the second security rule; 12. The cloud management platform of claim 9, wherein if the second virtual instance manager determines that a destination address of the service packet sent by the first virtual instance is the second virtual instance and that the identifier of the first cloud-native application with which the service packet sent by the first virtual instance is marked matches the identifier recorded by the second virtual instance manager, the second virtual instance manager allows or prohibits transmission of the first service packet to the second virtual instance in accordance with the second security rule.

13. prior to receiving the security rules entered by the first tenant for the first cloud-native application; the request receiving module is further configured to receive a second virtual instance creation request input by the first tenant or the second tenant, the second virtual instance creation request comprising information on specifications of the second virtual instance to be created and information on the second cloud-native application to which the second virtual instance to be created belongs; the instance creation module is further configured to select a second computing node in a second cloud data center to create the second virtual instance on the second computing node that can provide a specification that matches the specification information; 13. The cloud management platform of claim 12, wherein the configuration module is further configured to configure the second virtual instance manager of the second computing node to mark service packets sent by the second virtual instance with an identifier of the second cloud-native application based on the information about the second cloud-native application.

14. The cloud management platform further comprises an interface setting module; the interface setting module is configured to set a first network interface for the first cloud-native application and bind at least one virtual instance running the microservice in the first cloud-native application to the first network interface, wherein the at least one virtual instance running the microservice in the first cloud-native application comprises the first virtual instance, and the first network interface is set to the first cloud data center indicated by the first site information; The interface configuration module is further configured to configure a second network interface for the second cloud-native application and bind at least one virtual instance running the microservice in the second cloud-native application to the second network interface, wherein the at least one virtual instance running the microservice in the second cloud-native application comprises the second virtual instance, and the second network interface is configured on the second cloud data center indicated by second site information; 14. The cloud management platform of claim 12 or 13, wherein the first network interface and the second network interface are connected to each other via a cloud-native network configured within the infrastructure.

15. configuring a first virtual instance manager of the first computing node to mark service packets transmitted by the first virtual instance with an identifier of the first cloud-native application based on the information about the first cloud-native application; 15. The cloud management platform of claim 9, wherein the configuration module is specifically configured to configure the first virtual instance manager to encapsulate the service packet in an inner packet of an overlay packet and set the identifier of the first cloud-native application in an outer packet of the overlay packet.

16. 16. The cloud management platform of claim 9, wherein the first virtual instance comprises a virtual machine or a container.

17. A cloud network system for cloud native applications, comprising: a cloud-native network configured to connect multiple network interfaces, each network interface being bound to one virtual instance; a first virtual instance coupled to a first network interface in the plurality of network interfaces and configured to run the first cloud-native application or one or more microservices within the first cloud-native application; a second virtual instance coupled to a second network interface in the plurality of network interfaces and configured to run a second cloud-native application or one or more microservices within the second cloud-native application; and 1. A cloud network system comprising: a cloud management platform configured to receive security rules input by a tenant, the security rules indicating permission for the first cloud-native application to access the second cloud-native application; and the cloud management platform determining whether to allow the first network interface and / or the second network interface to pass access packets between the first virtual instance and the second virtual instance in accordance with the security rules.

18. a computing device cluster comprising at least one computing device, each computing device comprising a processor and a memory; 9. A computing device cluster, wherein the processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, causing the computing device cluster to perform the method of any one of claims 1 to 8.

19. 9. A computer program product comprising instructions that, when executed by a computing device cluster, enable the computing device cluster to perform the method of any one of claims 1 to 8.

20. 9. A computer-readable storage medium comprising computer program instructions that, when executed by a computing device cluster, cause the computing device cluster to perform the method of any one of claims 1 to 8.

Images