【作者】 徐飞；

【导师】 蔡亮；

【作者基本信息】 浙江大学 ， 计算机科学与技术， 2017， 硕士

【摘要】 多年以来企业和云提供商一直使用虚拟化的云平台运行应用程序,并且都是在虚拟机中运行。虚拟机技术提供整个硬件层的虚拟化,虽然实现了资源的隔离与控制,但使用成本较高。容器技术亦能提供资源的隔离与控制,却更节约成本,所以虚拟机技术逐渐地被容器技术取代。随着容器技术的日益普及,越来越多的应用使用容器的方式开发、部署和运维,给用户提供便捷的服务,如迅速崛起的Docker容器技术。容器集群管理系统Kubernetes是用于在多宿主机中管理容器化应用程序的开源系统,为容器化的应用提供资源调度、部署运行、服务发现、扩容缩容等一整套的功能。本文分析了 Kubernetes系统的网络模式,并对现有的容器网络解决方案进行对比,发现现有的解决方案在多租户网络隔离方面的功能还很有限,并不能满足复杂云环境下网络的安全需求。本文针对以上问题,通过研究发现Openstack项目中的Neutron网络子系统不仅提供了多租户的二层网络隔离,还提供了丰富的API接口。遵循Kubernetes插件化的网络模式,基于Neutron网络系统,本文设计了独立的网络插件系统,该插件系统包括Kubernetes端插件、独立网络管理模块、网络管理客户端三个模块。Kubenetes端插件实现了对独立网络管理模块的调用,并且在Kubelet启动时加载该插件系统;独立网络管理模块实现了对网络资源的管理以及对Pod网络的配置;网络管理客户端主要通过调用独立网络管理模块来管理用户的网络。此外,针对改造后的多租户网络模式,对集群中应用的负载均衡模式进行了改造。本文不仅提出了独立的网络插件系统解决方案,也通过实际开发实现了该解决方案,最后通过实验验证了其隔离效果与性能,可以满足Kubernetes平台对多租户网络隔离的需求。更多还原

【Abstract】 For many years,enterprises and cloud providers have been using virtualization to run their workloads.For a long time,the application is ran in the virtual machine.Because the virtual machine provides the entire virtualization hardware layer,although it can provide resource isolation and control,the cost is significantly higher.While containers can also provide resource isolation and restrictions,but more cheaper.So virtual machines are increasingly replaced by containers.As the popularity of container technology grows,many applications are being developed,deployed and managed as groups of containers to deliver the desired service to users,as evidenced by the rapid rise of Docker.Kubernetes is an open source system for managing containerized applications in multihomed hosts.It provides the functions of resource scheduling,deployment operation,service discovery,and capacity reduction for containerized applications.In this dissertation,the network model of Kubernetes is analyzed.By comparing the existing container network solutions,it is found that the existing solutions are limited in multi-tenant network isolation and can not satisfy the security demand of complex cloud environments.In order to solve those problems,this dissertation compares the existing container network tools in the industry and finds that the Neutron network system in Openstack project not only provides multi-tenant network isolation,but also provides rich API interface.Following the Kubernetes plugin network design pattern,this dissertation designs an independent network management module based on Neutron network system,including Kubernetes neutron-plugin,the independent network management module,and the network management client.Kubernetes neutron-plugin implements the call to the independent network management module,and loads the plugin when the Kubelet starts.The independent network management module realizes the management of the network resources and the configuration of the Pod network.The network management client mainly calls the independent network management module to manage the user’s network.And for the transformation of the multi-tenant network model,the application of the cluster load balancing model has been modifieds.This dissertation not only proposes the independent network plugin system solution,but also achieves the solution through the actual development.Finally,the isolation effect and performance of the multi-tenant network are verified by the experiment,which can meet the requirement of Kubernetes platform for multi-tenant network isolation.更多还原