基于Kubernetes的多租户网络隔离的设计与实现

发布时间：2018-03-06 06:24

本文选题：云计算　切入点：容器　出处：《浙江大学》2017年硕士论文　论文类型：学位论文

【摘要】：多年以来企业和云提供商一直使用虚拟化的云平台运行应用程序,并且都是在虚拟机中运行。虚拟机技术提供整个硬件层的虚拟化,虽然实现了资源的隔离与控制,但使用成本较高。容器技术亦能提供资源的隔离与控制,却更节约成本,所以虚拟机技术逐渐地被容器技术取代。随着容器技术的日益普及,越来越多的应用使用容器的方式开发、部署和运维,给用户提供便捷的服务,如迅速崛起的Docker容器技术。容器集群管理系统Kubernetes是用于在多宿主机中管理容器化应用程序的开源系统,为容器化的应用提供资源调度、部署运行、服务发现、扩容缩容等一整套的功能。本文分析了 Kubernetes系统的网络模式,并对现有的容器网络解决方案进行对比,发现现有的解决方案在多租户网络隔离方面的功能还很有限,并不能满足复杂云环境下网络的安全需求。本文针对以上问题,通过研究发现Openstack项目中的Neutron网络子系统不仅提供了多租户的二层网络隔离,还提供了丰富的API接口。遵循Kubernetes插件化的网络模式,基于Neutron网络系统,本文设计了独立的网络插件系统,该插件系统包括Kubernetes端插件、独立网络管理模块、网络管理客户端三个模块。Kubenetes端插件实现了对独立网络管理模块的调用,并且在Kubelet启动时加载该插件系统;独立网络管理模块实现了对网络资源的管理以及对Pod网络的配置;网络管理客户端主要通过调用独立网络管理模块来管理用户的网络。此外,针对改造后的多租户网络模式,对集群中应用的负载均衡模式进行了改造。本文不仅提出了独立的网络插件系统解决方案,也通过实际开发实现了该解决方案,最后通过实验验证了其隔离效果与性能,可以满足Kubernetes平台对多租户网络隔离的需求。
[Abstract]:For many years, enterprises and cloud providers have been running applications on virtualized cloud platforms, all running in virtual machines. Virtual machine technology provides virtualization of the entire hardware layer, although resources are isolated and controlled. But the cost of use is high. Container technology can also provide isolation and control of resources, but more cost savings, so virtual machine technology is gradually replaced by container technology. More and more applications are developed, deployed and operated using containers to provide users with convenient services. The container cluster management system (Kubernetes) is an open source system for managing container applications in multiple hosts, providing resource scheduling, deployment and service discovery for container applications. This paper analyzes the network mode of Kubernetes system, compares the existing container network solutions, and finds that the functions of the existing solutions in multi-tenant network isolation are still very limited. In view of the above problems, this paper finds that the Neutron network subsystem in the Openstack project not only provides multi-tenant two-layer network isolation, but also can not meet the security requirements of the network in complex cloud environment. Following the network mode of Kubernetes plug-in and based on Neutron network system, this paper designs an independent network plug-in system, which includes Kubernetes terminal plug-in, independent network management module. The three modules of network management client .Kubenetes implement the call to the independent network management module, and load the plug-in system when the Kubelet starts, the independent network management module realizes the management of the network resources and the configuration of the Pod network. The network management client mainly manages the user's network by calling the independent network management module. This paper not only proposes an independent network plug-in system solution, but also realizes the solution through practical development. Finally, the isolation effect and performance are verified by experiments. It can meet the requirements of Kubernetes platform for multi-tenant network isolation.
【学位授予单位】：浙江大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.09

【相似文献】