Warden多租户网络隔离设计与实现

发布时间：2018-06-27 01:39

本文选题：容器 + 多租户　；参考：《浙江大学》2016年硕士论文

【摘要】：近年来云计算不断发展,生态圈趋于成熟,云计算被越来越多的企业所接受。容器技术很早就已经出现,但是未受到足够的重视,近几年随着以Docker, LXC, Warden为代表的容器技术在资源利用上优势,越来越多的企业开始在在生产环境中使用容器技术。容器技术提供资源限制以及资源隔离,但是在资源隔离方面内核仅仅提供PID, NETWORK, IPC, UTS, MOUNT, USER等六种资源隔离,要做到安全使用还是存在一定差距。本文从Warden源码开始,从Warden服务端,客户端,通信协议三方面对Warden的设计与实现进行分析。从目前Warden网络架构出发,分析目前Warden容器存在缺陷,指出Warden不支持多租户网络隔离以及容器之间通信方式局限等问题。从路由,隧道,桥接三种方式分析跨宿主机连通方案,并分析其优缺点,最终选择桥接作为跨宿主机连通方案。采用VLAN技术进行容器网络隔离,分析新版Warden引入租户网关之后存在的问题,采用Iptables实现网关隔离。为给容器提供全局IP地址,引入IP地址分配,介绍IP地址分配器实现,最后介绍带宽分配算法的设计与实现。对Warden进行功能测试以及性能测试,验证多租户隔离效果与性能。
[Abstract]:In recent years, cloud computing has been developing and the ecosystem is becoming mature. Cloud computing has been accepted by more and more enterprises. Container technology has appeared for a long time, but has not received enough attention. In recent years, with the advantage of container technology represented by Docker, LXC, Warden in resource utilization, more and more enterprises begin to use container technology in production environment. Container technology provides resource restriction and resource isolation, but in the aspect of resource isolation, the kernel only provides six kinds of resource isolation, such as PID, NETWORK, IPC, UTS, MOUNT, user, etc. This paper starts with Warden source code and analyzes the design and implementation of Warden from three aspects: Warden server, client and communication protocol. Based on the current Warden network architecture, the defects of the current Warden container are analyzed, and it is pointed out that Warden does not support multi-tenant network isolation and the limitation of communication between containers. This paper analyzes the connectivity scheme of cross-host from three ways: routing, tunneling and bridging, and analyzes its advantages and disadvantages. Finally, bridging is chosen as the connectivity scheme of cross-host. The container network isolation is carried out by using VLAN technology. The problems existing after the new Warden is introduced into the tenant gateway are analyzed. IptabLes is used to implement the gateway isolation. In order to provide the global IP address to the container, the IP address allocation is introduced, and the implementation of the IP address allocator is introduced. Finally, the design and implementation of the bandwidth allocation algorithm are introduced. The function test and performance test of Warden are carried out to verify the effectiveness and performance of multi-tenant isolation.
【学位授予单位】：浙江大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP393.09

【相似文献】