Infrastructure system and communication method

Abstract

An infrastructure system and communication method are provided which, in an operating environment that uses a container, enable achieving network separation with a novel means. This infrastructure system (1) is provided with: a VM (2) which has resources for implementing a container having multiple virtual NICs, and which is provided with multiple virtual NICs connected to different logical networks; and a controller (3) which performs control such that communication paths are established by which each of the multiple virtual NICs of the VM is linked to one of the virtual NICs of the container.

Description

[Technical field]

[0001] The present disclosure relates to an infrastructure system and a communication method. [Background technology]

[0002] Containers are known as a virtual operating environment for software. For example, Patent Document 1 discloses that a processing unit provides a business service of a virtualized network function for a user terminal by using containers. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Special Publication No. 2019-519180 Summary of the Invention [Problem to be solved by the invention]

[0004] Containers, which provide highly scalable and flexible services, are beginning to be widely used mainly in the field of web services, mainly through CaaS (Container as a Service) platform software called Kubernetes. However, the general application area has been the area of ​​best-effort service provision. However, in recent years, communication volume has increased even in high-quality services, and use cases have arisen that require the scalability and flexibility of container implementation. In this type of use case, there is a demand to separate networks for each purpose and implement performance management, but due to the configuration of the CaaS platform, which only uses one network, there was a problem in that this demand could not be met.

[0005] Multus-CNI, a type of Container Network Interface (CNI), provides a function to separate container networks, but this function assumes that newly added networks will be managed outside the CaaS platform. For this reason, the adoption of this technology has been said to lead to reduced scalability and flexibility.

[0006] Therefore, one of the objectives that the embodiments disclosed in this specification aim to achieve is to provide an infrastructure system and a communication method that can achieve network separation in a novel manner in an operating environment using containers. [Means for solving the problem]

[0007] The infrastructure system according to the first aspect of the present disclosure includes: Resources for running containers with multiple virtual NICs (Network Interface Cards) are implemented, and a VM (Virtual Machine) with multiple virtual NICs connected to different logical networks is created. a controller that controls to configure a communication path that connects each of the plurality of virtual NICs of the VM to any one of the virtual NICs of the container; has.

[0008] In a communication method according to a second aspect of the present disclosure, A VM with multiple virtual NICs that connect to different logical networks runs a container with multiple virtual NICs, A controller performs control so that a communication path is configured that connects each of the multiple virtual NICs of the VM to one of the virtual NICs of the container. Effect of the Invention

[0009] According to the present disclosure, it is possible to provide a platform system and a communication method that can achieve network separation using a novel technique in an operating environment that uses containers. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a block diagram showing an example of a configuration of a base system according to an overview of an embodiment. [Diagram 2] FIG. 2 is a block diagram showing a configuration of a base system according to a comparative example. [Diagram 3] FIG. 1 is a block diagram showing an example of a configuration of a base system according to an embodiment. [Figure 4] FIG. 2 is a schematic diagram showing a logical network. [Diagram 5] FIG. 11 is a diagram showing a flow of communication from the outside to a container in a platform system according to a comparative example. [Figure 6] A diagram showing the flow of communication from the outside to a container in a base system according to an embodiment. [Figure 7] FIG. 11 is a diagram showing a flow of communication from a container to the outside in a platform system according to a comparative example. [Figure 8] 11 is a table showing an example of information associating destination subnets with logical networks. [Figure 9] 13 is a table showing an example of a routing table that the controller sets when starting a container. [Figure 10] A diagram showing the flow of communication from a container to the outside in a base system according to an embodiment. [Figure 11] FIG. 2 is a block diagram showing an example of a configuration of a computer. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] <Outline of the embodiment> Before describing the details of the embodiment, an overview of the embodiment will be described. FIG. 1 is a block diagram showing an example of a configuration of a platform system 1 according to the overview of the embodiment. As shown in FIG. 1, the platform system 1 includes a VM (Virtual Machine) 2 and a controller 3. Here, the VM 2 is a VM in which resources for executing a container having a plurality of virtual NICs (Network Interface Cards) are implemented, and is a VM equipped with a plurality of virtual NICs connected to different logical networks. In addition, the controller 3 controls so that a communication path is configured in which each of the plurality of virtual NICs of the VM 2 is connected to one of the virtual NICs of the container.

[0012] In the infrastructure system 1 having the above configuration, containers running on the VM 2 can use different logical networks for communication by using different interfaces of the VM 2. Therefore, the infrastructure system 1 can achieve network separation by a novel method in an operating environment using containers.

[0013] <Details of the embodiment> To help understand the details of the embodiment, a comparative example will be described first. FIG. 2 is a block diagram showing the configuration of a platform system 9 according to the comparative example. The configuration of the platform system 9 according to the comparative example is a configuration in which a CaaS platform is built on an IaaS (Infrastructure as a Service) platform. The overall configuration of the platform system 9 includes a controller 10, a load balancer 21 for appropriately distributing communications from the outside, and physical servers 30 and 31 for operating containers. In the example shown in FIG. 2, two physical servers 30 and 31 are shown, but the number of these physical servers is not limited, and any number of physical servers having similar configurations may be included. Note that these multiple physical servers are treated as a single resource as a whole by a general IaaS function. Note that the number of physical servers may be one.

[0014] Since the physical server 31 has the same configuration as the physical server 30, the description of the physical server 31 will be omitted. The physical server 30 includes a NIC 45, a virtual switch 40, and VMs 50 and 51. The NIC 45 is a physical NIC and is an interface used for communication from the physical server 30 and communication to the physical server 30. The virtual switch 40 is a virtual switch that realizes the network function of the IaaS function. That is, the virtual switch 40 is a virtual switch used for the network function provided by the IaaS service. The VMs 50 and 51 are VMs that are generated by the IaaS function and actually run containers. That is, the VMs 50 and 51 are VMs provided by the IaaS service, and containers run on these VMs. Note that, although two VMs 50 and 51 are shown in the example shown in FIG. 2, there is no limit to the number of VMs, and any number of VMs having similar configurations may be included. Note that the number of VMs may be one.

[0015] 2, containers 90 and 91 provided by the CaaS service are running on a VM 50. Note that the number of containers running on each VM is arbitrary.

[0016] The controller 10 is a device that manages containers and executes various management processes including container startup, container communication settings, etc. The controller 10 is a device that operates as a container orchestrator. The load balancer 21 appropriately balances external communications among all VMs with similar configurations, including VMs 50 and 51. Since the IaaS function treats the entire physical server as one resource, the CaaS function also treats all VMs across physical servers as one resource. In other words, in the CaaS service, all VMs included in the infrastructure system 9 are treated as one resource.

[0017] Since the VM51 has the same configuration as the VM50, a description of the VM51 will be omitted. The VM50 includes a virtual NIC61, a network function unit 70, and a bridge 81. The virtual NIC61 is a NIC for connecting to each of the networks into which the IaaS function is separated. That is, the VM51 connects to the network provided by the IaaS service via the virtual NIC61. The network function unit 70 is a processing unit that relays communications between the containers 90 and 91, and is used to realize container orchestration, etc. The bridge 81 is a virtual bridge that connects the containers 90 and 91 operating on the VM50 to the network function unit 70.

[0018] The containers 90 and 91 each have a virtual NIC 901, and when the containers 90 and 91 are started, a start-up process is performed so that the virtual NIC 901 of the containers 90 and 91 is connected to the bridge 81. It is also possible to add other virtual NICs (for example, virtual NICs 902 and 903 shown in FIG. 2) to the containers 90 and 91. However, these virtual NICs are generally not connected to the network function unit 70, which is a CaaS function, and the user must configure the network configuration by himself or herself.

[0019] 2, there is one communication route from the container 90 (container 91) to the outside of the platform system 9 within the VM 50. Similarly, in the configuration of the comparative example shown in FIG 2, there is one communication route from the outside of the platform system 9 to the container 90 (container 91) within the VM 50.

[0020] Next, the platform system 5 according to the embodiment will be described. FIG. 3 is a block diagram showing an example of the configuration of the platform system 5 according to the embodiment. Like the platform system 9, the platform system 5 is configured to build a CaaS platform on an IaaS platform. The controller 10 of the platform system 5 according to the embodiment corresponds to the controller 3 of FIG. 1. For this reason, the controller 10 controls to configure a communication path in which each of the multiple virtual NICs of the VM is connected to one of the virtual NICs of the container. The platform system 5 will be described below, but the same configuration and processing as the platform system 9 will be omitted as appropriate.

[0021] 3 shows an example of the infrastructure system 5 in which a total of three types of networks are configured, including a network for communication between containers (logical network 101 described later) and two types of external networks (logical networks 102 and 103). Note that, although two types of networks are assumed here as the external networks, there is no limit to the number of types of external networks.

[0022] 3, in the infrastructure system 5, load balancers 22 and 23 are added to the infrastructure system 9 of the comparative example. The same number of load balancers is required as the number of networks to be configured. Here, since three types of networks are configured as described above, the infrastructure system 5 includes three load balancers 21, 22, and 23. That is, the load balancers 21, 22, and 23 each perform load balancing for a different network.

[0023] In this embodiment, the VMs 50 and 51 are replaced with the VMs 50a and 51a. The VMs 50a and 51a correspond to the VM2 in FIG. 1. For this reason, the VMs 50a and 51a are VMs that provide resources for executing containers, and as described later, each VM has a plurality of virtual NICs 61, 62, and 63 that are connected to different logical networks. Since the VM 51a has the same configuration as the VM 50a, the description of the VM 51a is omitted. As shown in FIG. 3, the VM 50a is obtained by adding the virtual NICs 62 and 63 to the VM 50 shown in FIG. 2, and adding the bridges 82 and 83 corresponding to the virtual NICs. That is, the VM 50a has the virtual NIC 61 and the bridge 81 corresponding thereto, the virtual NIC 62 and the bridge 82 corresponding thereto, and the virtual NIC 63 and the bridge 83 corresponding thereto. The virtual NICs 61 to 63 and the bridges 81 to 83 each have the following IP (Internet Protocol) addresses. That is, each pair of the virtual NIC and the bridge has an IP address that belongs to a different subnetwork. That is, the virtual NIC 61 and the bridge 81 belong to a first subnetwork, the virtual NIC 62 and the bridge 82 belong to a second subnetwork, and the virtual NIC 63 and the bridge 83 belong to a third subnetwork.

[0024] Here, in this embodiment, as an example, it is assumed that a logical network as shown in FIG. 4 is constructed by the IaaS function. That is, a logical network as shown in FIG. 4 is provided by the IaaS service. Specifically, as shown in FIG. 4, three logical networks, logical networks 101, 102, and 103, are provided. The controller 10, the load balancer 21, and the virtual NIC 61 are connected to the logical network 101. In addition, another external node 111 is connected to the logical network 101 as necessary. In this way, the virtual NIC 61 is connected to the load balancer 21 via the logical network 101 created by the IaaS function, and is treated as one of the members under the load balancer 21. When there are multiple VMs, the load balancer 21 appropriately distributes the load. In addition, the load balancer 22 and the virtual NIC 62 are connected to the logical network 102. In addition, another external node 112 is connected to the logical network 102 as necessary. In this way, the virtual NIC 62 is connected to the load balancer 22 via the logical network 102 created by the IaaS function, and is treated as one of the members under the load balancer 22. When there are multiple VMs, the load balancer 22 performs appropriate load distribution. Similarly, the load balancer 23 and the virtual NIC 63 are connected to the logical network 103. In addition, another external node 113 is connected to the logical network 103 as necessary. In this way, the virtual NIC 63 is connected to the load balancer 23 via the logical network 103 created by the IaaS function, and is treated as one of the members under the load balancer 23. When there are multiple VMs, the load balancer 23 performs appropriate load distribution.

[0025] These three types of logical networks 101, 102, and 103 can be appropriately separated by an IaaS function. Separation is generally implemented by a VLAN (Virtual Local Area Network) or a VXLAN (Virtual eXtensible Local Area Network), but any method can be used.

[0026] The controller 10 manages and determines the subnetworks and IP addresses of the bridges 81 to 83. When the controller 10 starts the containers 90 and 91, the controller 10 makes the containers 90 and 91 have internal virtual NICs 901 to 903 that connect to the bridges 81 to 83, and assigns IP addresses to each of them. Here, the virtual NIC 901 is a virtual NIC for connecting to the bridge 81, the virtual NIC 902 is a virtual NIC for connecting to the bridge 82, and the virtual NIC 903 is a virtual NIC for connecting to the bridge 83. In addition, the containers 90 and 91 are set to use the IP address of the bridge 81 as the IP address of the bridge of the default network. The network function unit 70 has a NAT (Network Address Translation) function and a routing function, and converts the source IP address and the destination IP address according to the purpose. At that time, the network function unit 70 performs processing in cooperation with the CaaS controller function of the controller 10 as necessary. In addition, in the case of Linux (registered trademark), the above-mentioned processing of the network function unit 70 can be implemented by, for example, iptables.

[0027] Next, with reference to the figure, a method of communication from outside the CaaS platform to a container, and a method of communication from a container to outside the CaaS platform will be explained using HTTP communication, which is commonly used for container communication, as an example.

[0028] First, communication from the outside to the container will be described. FIG. 5 is a diagram showing a flow of communication from the outside to a container in the platform system 9 according to the comparative example shown in FIG. 2. This flow is one of the flow of communication by a general CaaS platform function, and the comparative example and the present embodiment will also be described assuming that communication is performed in this flow. When accessing the containers 90 and 91 from the outside, the access is performed as follows. That is, the access is performed by specifying the IP address of the load balancer 21 representing the entrance of the CaaS platform (platform system 9) and a port number or a path name that specifies the function to be accessed in the CaaS platform (platform system 9). For load balancing, the load balancer 21 appropriately distributes the load to one of the VMs (VM 50 or VM 51) and transfers the communication to the virtual NIC 61 of one of the VMs. The network function unit 70 is given information indicating which container the port number or path name corresponds to in advance from the controller 10. The network function unit 70 converts the destination to the IP address of either the container 90 or 91 as the destination of the communication, taking into account appropriate load balancing for the container that can provide the requested service. As a result, the network function unit 70 causes the communication to finally reach the container 90 or 91 through the bridge 81. Since NAT conversion is used, the return communication can be appropriately returned to the sender.

[0029] Fig. 6 is a diagram showing a flow of communication from the outside to a container in the infrastructure system 5 according to the embodiment shown in Fig. 3. Note that Fig. 6 shows an example of communication to a container via a load balancer 22. That is, Fig. 6 shows a flow of communication from an access source connected to the logical network 102 shown in Fig. 4 to a container.

[0030] In the infrastructure system 5, communication via the load balancer 21, the virtual NIC 61, and the bridge 81 is performed in the same manner as described above with reference to FIG. 5. That is, communication from an access source connected to the logical network 101 to a container reaches the network function unit 70 via the virtual NIC 61, and is transferred to the container 90 or 91 via the bridge 81 based on information set by the controller 10. At this time, the virtual NIC 901 is accessed. In the infrastructure system 5, a similar operation is also performed for communication via the load balancer 22, the virtual NIC 62, and the bridge 82. That is, communication from an access source connected to the logical network 102 to a container reaches the network function unit 70 via the virtual NIC 62, and is transferred to the container 90 or 91 via the bridge 82 based on information set by the controller 10. At this time, the virtual NIC 902 is accessed. Furthermore, in the infrastructure system 5, a similar operation is also performed for communication via the load balancer 23, the virtual NIC 63, and the bridge 83. That is, communication from an access source connected to the logical network 103 to a container reaches the network function unit 70 via the virtual NIC 63, and is transferred to the container 90 or 91 via the bridge 83 based on information set by the controller 10. At this time, the virtual NIC 903 is accessed. For this reason, in this embodiment, the controller 10 performs setting so that the above-mentioned transfer is possible not only when the virtual NIC 61 receives communication, but also when the virtual NIC 62 receives communication and when the virtual NIC 63 receives communication. That is, the controller 10 provides the network function unit 70 in advance with definition information of NAT conversion, that is, information indicating the correspondence between the port number or path name and the container. In this way, by linking the container function provided to the outside to the network, it is possible to separate the network for each container function.

[0031] As described above, in this embodiment, the controller 10 configures the NAT so that communication from outside the CaaS platform (platform system 5) to a container is transferred to a virtual NIC corresponding to the logical network used in the communication among multiple virtual NICs of the container. This allows multiple networks to be used for communication from outside to the container.

[0032] Here, the controller 10 may be set so as to be inaccessible from a specific network. This can be achieved by the controller 10 not providing the network function unit 70 with information for NAT conversion for routes to which access is prohibited. For example, consider a case where, among accesses to port number X, it is desired to disable access by communication through the load balancer 22. In this case, if the controller 10 does not provide the network function unit 70 with information for NAT conversion of communication of "destination virtual NIC 62, port number X", it will be impossible to access the function of port X from the network to which the load balancer 22 belongs.

[0033] In this way, the controller 10 may set the NAT so that address conversion is not performed for communications to a specific access destination among communications from outside the CaaS platform (platform system 5) to the container. In this way, access from a specific network can be disabled.

[0034] Next, communication from a container to the outside will be described. FIG. 7 is a diagram showing a flow of communication from a container to the outside in the platform system 9 according to the comparative example shown in FIG. 2. This flow is also one of the flow of communication by a general CaaS platform function, and the comparative example and the present embodiment will also be described assuming that communication is performed in this flow. When communicating from the container 90 to the outside of the CaaS platform (platform system 9), that is, to an IP address that does not exist inside the CaaS platform, communication is performed toward the bridge 81, which is a default gateway set in the container. Then, the network function unit 70 changes the source to the IP address of the virtual NIC 61, and communication is performed from the VM to the external IP address. Since NAT conversion is used, the return communication can be appropriately returned to the source.

[0035] On the other hand, in the infrastructure system 5 according to the present embodiment, the following information is registered in advance in the controller 10 in order to use different networks for communication from the container to the outside. That is, information associating a destination subnet with a logical network is registered in advance in the controller 10. FIG. 8 is a table showing an example of information associating a destination subnet with a logical network. In the example shown in FIG. 8, the subnet A of the external destination is associated with the logical network 102, the subnet B of the external destination is associated with the logical network 103, and the subnet C of the external destination is associated with the logical network 103. The controller 10 receives information indicating the correspondence as shown in FIG. 8 as an input, and when starting the container, the controller 10 that has received the input sets a routing table for the container so that communication goes out from the bridge corresponding to the destination. FIG. 9 shows an example of a routing table that the controller 10 sets when starting the container when the information indicating the correspondence as shown in FIG. 8 is registered in the controller 10. In the routing table shown in FIG. 9, the subnet A of the external destination is associated with the IP address of the bridge 82. In addition, in this routing table, the subnet B of the external destination is associated with the IP address of the bridge 83, and the subnet C of the external destination is associated with the IP address of the bridge 83. As a result, for example, when the destination of communication to the outside belongs to the subnet A, communication from the containers 90 and 91 to the destination is transferred to the network function unit 70 via the virtual NIC 902 and the bridge 82. The network function unit 70 is set as follows by the controller 10. That is, the network function unit 70 is set to convert the source into the IP address of the virtual NIC (i.e., any one of the virtual NICs 61, 62, or 63) corresponding to the bridge according to the subnet of the bridge of the source. In the example shown in this embodiment, the subnet of the bridge 81 is set to convert into the IP address of the virtual NIC 61, the subnet of the bridge 82 is set to convert into the IP address of the virtual NIC 62, and the subnet of the bridge 83 is set to convert into the IP address of the virtual NIC 63.

[0036] Fig. 10 is a diagram showing a flow of communication from a container to the outside in the infrastructure system 5 according to the embodiment shown in Fig. 3. Note that Fig. 10 shows, as an example, a flow of communication to the outside through a network connected to the virtual NIC 62. As described above, since routing settings have been made in advance, the container 90 communicates toward the bridge 82. At this time, the network function unit 70 changes the source to the IP address of the virtual NIC 62, and communicates from the VM to an external IP address.

[0037] As described above, in this embodiment, the controller 10 sets up routing so that a logical network corresponding to the access destination is used for communication from the container to the outside of the CaaS platform (platform system 5). The controller 10 then sets up NAT so that the source of communication from the container to the outside is the address of a virtual NIC connected to the logical network used in the communication, among multiple virtual NICs of the VM. This allows multiple networks to be used for communication from the container to the outside.

[0038] Here, the controller 10 may set the container so as not to connect to an external network. Specifically, when the controller 10 generates a container, the controller 10 sets the network function unit 70 so as not to NAT communication from a specific bridge, thereby making it possible to prevent the container from connecting to an external network. For example, if it is not desired to connect a specific container to a network connected to the virtual NIC 62, the container is configured to drop the IP address of the container without conversion when the IP address of the container is the source, so that the container cannot perform communication going out from the virtual NIC 62.

[0039] In this way, the controller 10 may configure the NAT so that address conversion is not performed for communications from a specific source among communications from the container to the outside of the CaaS platform (platform system 5). In this way, it is possible to restrict communications from the container to the outside.

[0040] The above describes the embodiment. In the above-mentioned infrastructure system 5, a container running on a VM can use different logical networks for communication by using different interfaces of the VM. In particular, according to the platform system 5, network separation according to the purpose can be realized while maintaining the scalability and flexibility realized by the CaaS platform. As a result, external communications are appropriately separated, and performance management using the header used for separation can also be realized. For example, important communications can be passed through one logical network, and the priority of that logical network can be maximized by manipulating the IaaS layer, so that only some communications can be passed with the highest priority. The reason for this is that the container communication interface is connected to the network provided by IaaS while maintaining the scalability and flexibility of the container by the function of container orchestration, which is an existing technology. In addition, according to the platform system 5, separated networks and containers can be linked, and container implementation functions that can be connected to each network can be managed. The reason for this is that by providing a virtual NIC of the VM used when communicating from the outside to the CaaS platform and a bridge used when communicating from the container to the outside for each network, access management based on their IP addresses has become possible.

[0041] The above-mentioned functions (processing) of the physical servers 30 and 31, the controller 10, or the load balancers 21, 22, and 23 may be realized by a computer 500 having the following configuration, for example.

[0042] 11 is a block diagram showing, as an example, the configuration of a computer 500 that realizes the processing of the physical servers 30 and 31, the controller 10, or the load balancers 21, 22, and 23. As shown in FIG.

[0043] The memory 501 is configured, for example, by a combination of a volatile memory and a non-volatile memory. The memory 501 is used to store software (computer programs) including one or more instructions to be executed by the processor 502.

[0044] The processor 502 reads out software (computer programs) from the memory 501 and executes them to perform processing for the physical servers 30 and 31, the controller 10, or the load balancers 21, 22, and 23.

[0045] The processor 502 may be, for example, a microprocessor, a microprocessor unit (MPU), a central processing unit (CPU), etc. The processor 502 may include multiple processors.

[0046] The above-mentioned program can be stored and supplied to a computer using various types of non-transitory computer readable media. The non-transitory computer readable medium includes various types of tangible storage media. Examples of the non-transitory computer readable medium include magnetic recording media (e.g., flexible disks, magnetic tapes, hard disk drives), magneto-optical recording media (e.g., magneto-optical disks), CD-ROM (Read Only Memory), CD-R, CD-R / W, and semiconductor memory (e.g., mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, RAM (Random Access Memory)). The program may also be supplied to a computer by various types of transitory computer readable media. Examples of the transitory computer readable medium include electric signals, optical signals, and electromagnetic waves. The transitory computer readable medium can supply the program to a computer via a wired communication path such as an electric wire and an optical fiber, or via a wireless communication path.

[0047] Although the present invention has been described above with reference to the embodiment, the present invention is not limited to the above. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the invention.

[0048] A part or all of the above-described embodiments may be described as, but is not limited to, the following supplementary notes. (Appendix 1) Resources for running containers with multiple virtual NICs (Network Interface Cards) are implemented, and a VM (Virtual Machine) with multiple virtual NICs connected to different logical networks is created. a controller that controls to configure a communication path that connects each of the plurality of virtual NICs of the VM to any one of the virtual NICs of the container; A base system with: (Appendix 2) The controller performs NAT (Network Address Translation) settings so that communication from outside the infrastructure system to the container is forwarded to a virtual NIC corresponding to the logical network used in the communication among the plurality of virtual NICs of the container. 2. The infrastructure system described in Appendix 1. (Appendix 3) The controller sets the NAT so that address conversion is not performed for communications to a predetermined access destination among communications from outside the infrastructure system to the container. 2. The infrastructure system described in Appendix 2. (Appendix 4) The controller: Routing is set so that the logical network corresponding to the access destination is used for communication from the container to the outside of the infrastructure system; NAT is configured so that the source of communication from the container to the outside of the infrastructure system is the address of the virtual NIC connected to the logical network used in the communication, among the multiple virtual NICs of the VM. 2. The infrastructure system described in Appendix 1. (Appendix 5) The controller sets the NAT so that address conversion is not performed for communications from a predetermined source among communications from the container to the outside of the infrastructure system. 6. The infrastructure system described in Appendix 4. (Appendix 6) A VM with multiple virtual NICs that connect to different logical networks runs a container with multiple virtual NICs, A controller performs control so that a communication path is configured such that each of the plurality of virtual NICs of the VM is connected to any one of the virtual NICs of the container. Communication methods. [Explanation of symbols]

[0049] 1. Infrastructure System 2 VM 3. Controller 5. Infrastructure System 9. Infrastructure System 10 Controller 21 Load Balancer 22 Load Balancer 23 Load Balancer 30 Physical Servers 31 Physical Servers 40 Virtual Switch 61 Virtual NICs 62 Virtual NICs 63 Virtual NICs 70 Network Functions Department 81 Bridge 82 Bridge 83 Bridge 90 Container 91 Container 101 Logical Network 102 Logical Networks 103 Logical Network 111 Nodes 112 nodes 113 nodes 500 Computers 501 Memory 502 processor 901 Virtual NICs 902 Virtual NICs 903 Virtual NICs

Claims

1. A VM (Virtual Machine) having a resource for executing a container having a plurality of virtual network interface cards (NICs) and connected to different logical networks; a controller that controls to configure a communication path that connects each of the plurality of virtual NICs of the VM to any one of the virtual NICs of the container; A base system with:

2. The controller performs NAT (Network Address Translation) settings so that communication from outside the infrastructure system to the container is forwarded to a virtual NIC corresponding to the logical network used in the communication among the plurality of virtual NICs of the container. The infrastructure system of claim 1 .

3. The controller sets the NAT so that address conversion is not performed for communications to a predetermined access destination among communications from outside the infrastructure system to the container. The infrastructure system according to claim 2 .

4. The controller: Routing is set so that the logical network corresponding to the access destination is used for communication from the container to the outside of the infrastructure system; A NAT is configured so that the source of communication from the container to the outside of the infrastructure system is the address of the virtual NIC connected to the logical network used in the communication, among the multiple virtual NICs of the VM. The infrastructure system of claim 1 .

5. The controller sets the NAT so that address conversion is not performed for communications from a predetermined source among communications from the container to the outside of the infrastructure system. The infrastructure system according to claim 4 .

6. A VM with multiple virtual NICs that connect to different logical networks runs a container with multiple virtual NICs; A controller performs control so that a communication path is configured in which each of the plurality of virtual NICs of the VM is connected to any one of the virtual NICs of the container. Communication methods.

Images