WO2023231982A1 - 一种基于公有云的vpc之间的通信方法及相关产品 - Google Patents

一种基于公有云的vpc之间的通信方法及相关产品 Download PDF

Info

Publication number
WO2023231982A1
WO2023231982A1 PCT/CN2023/096910 CN2023096910W WO2023231982A1 WO 2023231982 A1 WO2023231982 A1 WO 2023231982A1 CN 2023096910 W CN2023096910 W CN 2023096910W WO 2023231982 A1 WO2023231982 A1 WO 2023231982A1
Authority
WO
WIPO (PCT)
Prior art keywords
vpc
global
network prefix
management platform
cloud management
Prior art date
Application number
PCT/CN2023/096910
Other languages
English (en)
French (fr)
Inventor
朱小平
Original Assignee
华为云计算技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为云计算技术有限公司 filed Critical 华为云计算技术有限公司
Publication of WO2023231982A1 publication Critical patent/WO2023231982A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/141—Setup of application sessions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming

Definitions

  • the embodiments of the present application relate to the field of cloud computing technology, and in particular to a communication method and related products between virtual private clouds (VPC) based on public clouds.
  • VPC virtual private clouds
  • VPC is a virtual network environment created by tenants. It supports tenants' independent configuration and management. It also has many advantages such as security and reliability, so it is widely used. In actual applications, there is a need for communication between different VPCs. However, due to private address planning and other reasons, there may be overlapping private addresses between the VPCs that need to communicate, which will cause the above-mentioned VPCs to be unable to communicate.
  • VPC peering VPC peering
  • Transit gateway to connect the different VPCs mentioned above.
  • the embodiments of this application provide a communication method and related products between VPCs based on the public cloud, which can realize communication between different VPCs. On this basis, it can also ensure the bandwidth of communication between different VPCs, and the bandwidth in different VPCs. Resources can also be migrated to each other on demand. In addition, it can also achieve unified management of VPC network addresses and routing, reducing manual workload.
  • embodiments of the present application provide a communication method between VPCs based on a public cloud.
  • the method includes the following steps: the cloud management platform determines the first configuration information input or selected by the tenant, and creates a global configuration based on the first configuration information. VPC; the cloud management platform determines the second configuration information input or selected by the tenant, allocates the first network prefix to the first VPC located in the first region through the above-mentioned global VPC according to the second configuration information, and assigns the first network prefix to the first VPC located in the second region through the above-mentioned global VPC.
  • the second VPC allocates a second network prefix, where the above-mentioned global VPC is used to implement cross-region communication between the first VPC and the second VPC based on the first network prefix and the second network prefix. It can be seen that by implementing the above method, the first VPC and the second VPC have different network prefixes, so that communication between the first VPC and the second VPC can be achieved.
  • the above method further includes: the cloud management platform allocates a network prefix to the global VPC, where the first network prefix and the second network prefix also include the network prefix of the global VPC.
  • the above method further includes: the cloud management platform establishing a network connection between the first VPC and the global VPC, and a network connection between the second VPC and the global VPC. It should be understood that by establishing a network connection between the first VPC and the global VPC, the first VPC and the global VPC can communicate. Similarly, by establishing a network connection between the second network prefix and the global VPC, the second VPC can be enabled. Can communicate with global VPC. In this way, the first VPC and the second VPC can communicate through the global VPC.
  • the global VPC stores a first network prefix, a second network prefix, and a routing relationship between the first network prefix and the second network prefix. In this way, the global VPC can be used to realize automatic management of the network addresses of the first VPC and the second VPC and the routes between them.
  • the first VPC does not support communication with the third VPC.
  • the first VPC and the third VPC are isolated from each other, which improves the security of services deployed in the first VPC and the third VPC.
  • the above method also includes: the cloud management platform sets an access control list (access control list, ACL) of the first VPC, wherein the ACL includes a method for blocking the first VPC and Table entries for communication between third VPCs.
  • ACL access control list
  • the first VPC cannot receive the data flow from the third VPC and cannot send the data flow to the third VPC, thus achieving isolation between the first VPC and the third VPC.
  • the first VPC includes the first subnet
  • the above method further includes: the cloud management platform allocates a network prefix to the first subnet through the global VPC, where the network of the first subnet The prefix includes the first network prefix and subnet identification.
  • the global VPC can manage the network address of the subnet in the first VPC.
  • the first subnet includes a virtual machine (VM), and the above method further includes: the cloud management platform allocates a network prefix to the VM through the global VPC or the first VPC, where the VM The zone identifier in the network prefix is used to indicate that the VM supports migration to a VPC under the jurisdiction of the global VPC that can communicate with the first VPC.
  • VPCs under the jurisdiction of the global VPC that can communicate with the first VPC refer to VPCs that are assigned network prefixes by the global VPC and can communicate with the first VPC through the global VPC.
  • the area identifier in the network prefix of the VM is different from the area identifier in the network prefix of any VPC under the jurisdiction of the global VPC.
  • VPCs under the jurisdiction of the global VPC that can communicate with the first VPC include a second VPC
  • the above method further includes: the cloud management platform migrates the above VM from the first VPC to the third VPC.
  • the network prefix of the migrated VM is the same as the network prefix of the pre-migration VM.
  • VMs in the first VPC can be migrated to other VPCs across regions, improving the flexibility of business deployment.
  • the above method further includes: the cloud management platform allocates bandwidth to the global VPC, where the data flow passing through the global VPC meets the above bandwidth requirements.
  • the above method further includes: the cloud management platform adds a corresponding flow label to the data flow passing through the global VPC according to the identifier of the global VPC, and then obtains the above bandwidth requirement based on the flow label, and then Then, the forwarding of the data flow is instructed according to the bandwidth requirement.
  • the communication between the first VPC and the second VCP needs to pass through the global VPC. Therefore, when the data flow passing through the global VPC can meet the above bandwidth requirements, the communication between the first VPC and the second VPC can also meet the requirements. The above bandwidth requirements thus improve the quality of communication between the first VPC and the second VPC.
  • the network prefix of the global VPC is the IPv6 applied for by the cloud management platform.
  • the prefix is either the IPv6 prefix generated by the cloud management platform or the IPv6 prefix applied by the tenant.
  • embodiments of the present application provide a cloud management platform, which includes a determination module and a control module.
  • the determination module is used to determine the first configuration information and the second configuration information input or selected by the tenant;
  • the control module is used to create a global VPC based on the first configuration information, and use the global VPC to provide information to users located in the first region based on the second configuration information.
  • the first VPC is assigned a first network prefix
  • the second VPC located in the second region is assigned a second network prefix
  • the global VPC is used to implement the connection between the first VPC and the second VPC based on the first network prefix and the second network prefix. cross-regional communication.
  • the area identifier in the first network prefix is different from the area identifier in the second network prefix.
  • the area identifier in the first network prefix is used to identify the first VPC
  • the area identifier in the second network prefix is used to identify the second VPC.
  • the above control module is also used to allocate a network prefix to the global VPC, where the first network prefix and the second network prefix also include the network prefix of the global VPC.
  • the above device further includes a network configuration module, which is used to establish a network connection between the first VPC and the global VPC, and a network connection between the second VPC and the global VPC. .
  • the above-mentioned global VPC stores a first network prefix, a second network prefix, and a routing relationship between the first network prefix and the second network prefix.
  • the first VPC does not support communication with the third VPC.
  • the network configuration module is further configured to set an ACL of the first VPC, where the ACL includes an entry for blocking communication between the first VPC and the third VPC.
  • the first VPC includes a first subnet
  • the control module is further configured to allocate a network prefix to the first subnet through the global VPC, where the network prefix of the first subnet includes First network prefix and subnet identification.
  • the first subnet includes a VM
  • the control module is further configured to allocate a network prefix to the VM through the global VPC or the first VPC, where the area in the network prefix of the VM
  • the identifier is used to indicate that the VM supports migration to a VPC under the jurisdiction of the global VPC that can communicate with the first VPC.
  • VPCs under the jurisdiction of the global VPC that can communicate with the first VPC refer to VPCs that are assigned network prefixes by the global VPC and can communicate with the first VPC through the global VPC.
  • the area identifier in the network prefix of the VM is different from the area identifier in the network prefix of any VPC under the jurisdiction of the global VPC.
  • VPCs under the jurisdiction of the global VPC that can communicate with the first VPC include a second VPC, and the above control module is also used to migrate the above VM from the first VPC to the second VPC.
  • the migrated VM is located in the second subnet of the second VPC, and the subnet identifier in the network prefix of the second subnet is the same as the subnet identifier in the network prefix of the first subnet.
  • the network prefix of the migrated VM is the same as the network prefix of the pre-migration VM.
  • the above control module is also used to allocate bandwidth to the global VPC, where the data flow passing through the global VPC meets the above bandwidth requirements.
  • the above-mentioned control module is also used to add corresponding flow labels to the data flows passing through the global VPC according to the identifier of the global VPC, obtain the above-mentioned bandwidth requirements according to the flow labels, and according to the above-mentioned Bandwidth requirements dictate the forwarding of the above traffic.
  • the network prefix of the global VPC is the IPv6 prefix applied by the cloud management platform, or the IPv6 prefix generated by the cloud management platform, or the IPv6 prefix applied by the tenant.
  • embodiments of the present application provide a communication system, which includes the cloud management platform described in the foregoing first aspect and any implementation of the first aspect, and further includes a global VPC, a third VPC located in the first region, One VPC and a second VPC located in the second region.
  • inventions of the present application provide a computing device.
  • the computing device includes a processor and a memory.
  • the processor executes the computer program code in the memory to implement the aforementioned first aspect and any implementation manner of the first aspect. Describe some or all of the methods.
  • embodiments of the present application provide a computer-readable storage medium.
  • the computer storage medium stores computer program code.
  • the computer program code is executed by a computing device, the computing device executes the foregoing first and third aspects. Any implementation of an aspect describes some or all of the methods.
  • Figure 1 is a schematic structural diagram of a communication system provided by an embodiment of the present application.
  • Figure 2 is a schematic diagram of a deployment method of a cloud management platform provided by an embodiment of the present application
  • Figure 4 is a schematic diagram of an application scenario of another cloud management platform provided by an embodiment of the present application.
  • Figure 5 is a schematic diagram of a deployment method of a client that can communicate with a cloud management platform provided by an embodiment of the present application;
  • Figure 6 is a schematic flowchart of a communication method between VPCs based on a public cloud provided by an embodiment of the present application
  • Figure 7 is a schematic diagram of a global VPC creation interface provided by an embodiment of the present application.
  • FIG. 8 is a schematic diagram of another global VPC creation interface provided by an embodiment of the present application.
  • Figure 9 is a schematic diagram of a first VPC creation interface provided by an embodiment of the present application.
  • Figure 10 is a schematic diagram of a resource creation interface provided by an embodiment of the present application.
  • Figure 11 is a schematic diagram of the format of a network prefix of a resource provided by an embodiment of the present application.
  • Figure 12 is a schematic diagram of the format of a network prefix of another resource provided by an embodiment of the present application.
  • Figure 13 is a schematic flowchart of a VM migration method provided by an embodiment of the present application.
  • Figure 14 is a schematic structural diagram of a cloud management platform provided by an embodiment of the present application.
  • Figure 15 is a schematic structural diagram of a computing device provided by an embodiment of the present application.
  • Figure 16 is a schematic diagram of a computing device system provided by an embodiment of the present application.
  • Security groups can provide access policies to cloud servers, cloud containers, cloud databases and other instances that have the same security protection requirements and trust each other in the VPC.
  • Network ACL controls the data flow in and out of the subnet through multiple outbound and inbound rules associated with the subnet.
  • tenants can also customize routing tables to provide a basis for forwarding data flows within the VPC.
  • VPC also supports resource migration. Take VM migration as an example. VM migration refers to moving a VM from One host is migrated to another host, but the business is required not to be interrupted during the migration process. To achieve this, it should be ensured that parameters such as the Internet protocol (IP) address and media access control (MAC) address of the VM remain unchanged before and after migration.
  • IP Internet protocol
  • MAC media access control
  • VPC virtualized computing resources
  • storage resources including computing resources, storage resources, and network resources
  • VPCs created by tenants may need to communicate with each other.
  • their branches and businesses are distributed in multiple regions, so such enterprises generally deploy VPCs in multiple regions and hope that these VPCs can communicate with each other.
  • the enterprise will deploy corresponding VPC in Region A to provide cloud services for the above-mentioned service population.
  • the service population of the enterprise is moved from Region A to Region B, in order to save Cost, the enterprise hopes to directly migrate the resources deployed in the VPC in Region A to the VPC deployed in Region B.
  • FIG. 1 exemplarily shows the structural diagram of the above communication system.
  • the communication system 100 includes a cloud management platform 110, a global VPC (global VPC) 120, multiple regional VPCs (region VPC) 130 and multiple interfaces. Starting at entry point 140, various parts of the communication system 100 are briefly described below.
  • the cloud management platform 110 is used to confirm the configuration information entered or selected by the tenant, and is also used to create a global VPC 120 and multiple regional VPCs 130 based on the above configuration information.
  • global VPC 120 and regional VPC 130 are both VPCs, their functions are different.
  • the global VPC 120 is used to allocate network prefixes to the regional VPC 130 and the subnets in the regional VPC 130.
  • Different regional VPCs 130 can communicate through the global VPC 120; the global VPC 120 also has a network address management function and can store and Manage network prefixes for multiple regional VPCs 130, as well as network prefixes for subnets within each regional VPC 130.
  • Regional VPC 130 is a VPC created by tenants in a designated region based on business needs.
  • the above-mentioned "region” refers to a collection of basic resources (including computing resources, storage resources, and network resources), such as a data center established by a cloud service provider. , so tenants can deploy services in regional VPC 130 and use the basic resources in regional VPC 130 to execute services.
  • the cloud management platform 110 is also used to allocate network prefixes to the global VPC 120, and allocate different network prefixes to multiple regional VPCs 130 through the global VPC 120.
  • the network prefix of each regional VPC 130 includes the network prefix of the global VPC 120 and the identifier of the regional VPC 130 (hereinafter referred to as the regional identifier).
  • the regional identifiers in the network prefixes of the VPC 130 in different regions are different. In this way, it can be ensured that the network prefixes of VPCs 130 in different regions are different, which facilitates communication between VPCs 130 in different regions.
  • the cloud management platform 110 is also used to create multiple access points 140.
  • the multiple access points 140 may specifically include gateways (such as routers, switches, etc.), gateway services (such as virtual machines with gateway functions). or server) etc.
  • Multiple access points 140 are used to establish communication connections between the global VPC 120 and multiple regional VPCs 130 through the network prefix of the global VPC 120 and the network prefixes of multiple regional VPCs 130, thereby realizing communication between multiple regional VPCs 130 Communication.
  • the cloud management platform 110 is also used to configure an ACL on the access point 140 to provide security protection for the regional VPC 130 connected to the access point 140 .
  • the above-mentioned ACL includes at least one entry, and the access point 140 controls the data flow in and out of the regional VPC 130 through the at least one entry.
  • the plurality of regional VPCs 130 include a first VPC, a second VPC, and a third VPC
  • the plurality of access points 140 include a first access point, a second access point, and a third access point
  • the first VPC The global VPC 120 is connected through the first access point
  • the second VPC is connected to the global VPC 120 through the second access point
  • the third VPC is connected to the global VPC 120 through the third access point.
  • the first VPC, The second VPC and the third VPC can communicate through the global VPC 120.
  • tenants may hope that the first VPC and the second VPC can communicate, but the first VPC and the third VPC are isolated from each other.
  • the cloud management platform 110 can connect to the first VPC.
  • Configure an ACL on the access point The ACL on the first access point includes entries for blocking communication between the first VPC and the third VPC.
  • the cloud management platform 110 can also configure an ACL on the third access point.
  • the ACL on the third access point includes an entry that blocks communication between the first VPC and the third VPC.
  • the third access point When the point receives the data flow from the first VPC or sends the data flow to the first VPC, the third access point can discard the above data flow according to the local ACL, thus blocking the connection between the first VPC and the third VPC. Communication.
  • the cloud management platform 110 is also used to instruct the global VPC 120 to allocate different network prefixes to the subnets in the multiple regional VPCs 130.
  • the network prefix of the subnet includes the network prefix and subnet identifier of the regional VPC 130 to which it belongs.
  • the subnet identifier is used to identify the subnet, that is, the subnet identifiers in the network prefixes of different subnets in the same regional VPC 130 are different.
  • the cloud management platform 110 is also used to deploy resources (including VMs, containers, sandboxes, etc.) in subnets of multiple regional VPCs 130, and allocate network prefixes to the resources.
  • the network prefix of the resource includes a region identifier, and the region identifier in the network prefix of the resource is used to indicate whether the resource supports migration from the regional VPC to which it belongs to other regional VPCs. In this way, the cloud management platform 110 can determine whether the resource can be migrated from the regional VPC to which it belongs to other regional VPCs based on the network prefix of the resource.
  • the cloud management platform 110 is also used to allocate bandwidth to the global VPC 120 so that the data flow passing through the global VPC 120 is within the above allocated bandwidth range. In this way, the bandwidth for communication between regional VPC 130 can be guaranteed.
  • this device can also realize automatic management of network addresses of multiple regional VPCs 130 and enable different Resources in VPCs can be migrated to each other based on actual business needs.
  • the bandwidth for communication between VPCs can be guaranteed to provide tenants with higher-quality cloud services.
  • the above functions provided by the cloud management platform 110 can be implemented by software devices, hardware devices, or a combination of software devices and hardware devices.
  • the deployment of the cloud management platform 110 is flexible, and it can be deployed in a cloud environment.
  • the cloud environment is an entity that uses basic resources to provide cloud services to tenants under the cloud computing model.
  • the cloud environment includes a cloud data center.
  • the cloud data center includes a large number of basic resources (including computing resources, storage resources and network resources) owned by the cloud service provider. ), the computing resources included in the cloud data center can include a large number of computing devices (such as servers). Therefore, the cloud management platform 110 can be one or more servers in a cloud data center, or a software device deployed on a server or virtual machine in a cloud data center.
  • the software device can be deployed in a distributed manner on multiple servers. on a server, or distributed on multiple VMs, or distributed on a server and VMs.
  • the cloud management platform 110 is deployed in a cloud data center by a cloud service provider, and the cloud service provider provides functions provided by the cloud management platform 110 as cloud services to tenants.
  • tenants can register an account on the cloud management platform 110, log in to the cloud management platform 110 through the account, and send relevant configuration information to the cloud management platform 110. After that, the cloud management platform 110 will provide cloud services. Points (including multiple basic resources in the cloud data center) provide corresponding cloud services to tenants.
  • the tenant sends configuration information to the cloud management platform 110.
  • the above configuration information includes deploying the global VPC 120 and the regional VPC 130 (including regional VPC 1 to regional VPC 6). Relevant information (such as deployment area). Therefore, the cloud management platform 110 creates global VPC 120 in region 0 and 1 Create region VPC 1, create region VPC 2 in region 2, create region VPC 3 in region 3, create region VPC 4 in region 4, create region VPC 5 in region 5, and create region VPC 6 in region 6.
  • area 1, area 2 and area 3 are edge areas
  • area 4 and area 5 are central areas
  • area 6 is a resource area.
  • the above configuration information also includes deploying subnets and VMs in the subnets in regional VPC 1 to regional VPC 6. Therefore, the cloud management platform 110 also deploys subnets and VMs in the subnets in regional VPC 1 to regional VPC 6. VMs and assign network prefixes to the subnet and the VMs in the subnet. Among them, since regional VPC 2 to regional VPC 6 can communicate across regions, VMs in regional VPC 2 to regional VPC 6 can migrate to each other according to business needs. For example, VMs in regional VPC 2 can be migrated to regional VPC 6. You can also migrate to regional VPC 3. VMs in regional VPC 4 can be migrated to regional VPC 3, or to regional VPC 5.
  • VMs in regional VPC 5 can be migrated to regional VPC 6. That is to say, the tenant's business can be migrated between edge areas, central areas and resource areas, or between edge areas, between central areas or between resource areas. In this way, it can not only improve the flexibility of business deployment, but also improve tenants' requirements for performance, cost, and capacity. For example, when the load on a certain region's VPC is too much or the capacity is insufficient, the cloud management platform 110 can run the VPC in that region.
  • Part of the business in the regional VPC is migrated to other regional VPCs; for another example, when the tenant's business needs change, it wants to create a new regional VPC (region VPC 7) and run the business in regional VPC 2 on regional VPC 7 As shown in Figure 4, after the cloud management platform 110 creates regional VPC 7, the business running on regional VPC 2 can be directly migrated to regional VPC 7.
  • the cloud management platform 110 can also allocate bandwidth to the global VPC 120 to ensure that the data flow passing through the global VPC 120 is always within the appropriate bandwidth range. It should be understood that since the communication between regional VPC 2 and regional VPC 6 needs to pass through the global VPC 120, therefore, by ensuring the bandwidth of the data flow passing through the global VPC 120, the bandwidth of the communication between regional VPCs can be guaranteed, thereby reducing the regional VPC The difficulty of communication (including resource migration) between
  • the cloud services provided by the cloud management platform 110 to tenants can be divided into two parts: VPC services and cross-region VPC communication services.
  • VPC services refer to the regional VPC 130 that tenants can deploy on the cloud (such as the above-mentioned regional VPC 1 to regional VPC 6). These services can be provided to tenants for free; cross-regional VPC communication services refer to regional VPCs located in different regions. 130 communication services, these services can be provided to tenants for free, or they can be purchased by tenants (annual or monthly subscription, or recharged in advance and settled based on final resource usage) before being provided to tenants.
  • a client that can communicate with the cloud management platform 110 can be deployed in the edge environment, for example: a client provided by a cloud service provider that can communicate with the cloud management platform 110 Applications; can also be deployed on terminal computing devices, such as browsers, to receive configuration information input by tenants; part of the application can also be deployed in the edge environment, and part of it can be deployed on terminal computing devices.
  • the edge environment is an environment that includes a collection of edge computing devices that are close to the terminal computing device.
  • the edge computing device includes edge servers, edge stations with computing power, etc.
  • the terminal computing device includes terminal servers, smartphones, laptops, tablets, etc. Computers, personal desktop computers, smart cameras, etc.
  • the cloud management platform 110 determines the configuration information A entered or selected by the tenant, and creates a global VPC 120 based on the configuration information A.
  • the cloud management platform 110 provides a user interface (UI) or an application programming interface (API), and tenants provide information to the cloud management platform 110 by operating (including input or selection) on the UI or API. Send configuration information A. After the cloud management platform 110 determines the configuration information A, it creates a global VPC 120 based on the configuration information A.
  • UI user interface
  • API application programming interface
  • the configuration information A includes the bandwidth information of the global VPC 120, which may specifically include at least one of the maximum bandwidth and the minimum bandwidth, to ensure that the data flow passing through the global VPC 120 meets at least one of the following conditions: less than or equal to the maximum bandwidth, greater than or equal to the minimum bandwidth.
  • configuration information A can also include the location, name and other information of global VPC 120.
  • Figure 7 shows a UI for creating a global VPC 120.
  • the interface includes multiple options such as "name”, "region", and "bandwidth”.
  • the tenant fills in the name of the global VPC 120 after the "Name” option according to the interface prompts, selects the geographical location where the global VPC 120 is deployed after the "Region” option, and selects the minimum bandwidth and maximum bandwidth after the "Bandwidth” option.
  • the cloud management platform 110 will receive the configuration information A and create the global VPC 120 based on the configuration information A; if the tenant clicks the "Cancel” option, the cloud management platform 110 will not After receiving configuration information A, global VPC 120 will not be created.
  • the cloud management platform 110 allocates a network prefix to the global VPC 120.
  • the network prefix of global VPC 120 can be an IPv4 network prefix or an IPv6 network prefix.
  • S102 taking the network prefix of global VPC 120 as an IPv6 network prefix as an example.
  • the cloud management platform 110 can allocate a network prefix to the global VPC 120 in any of the following ways:
  • Configuration information A can also include the network prefix of the global VPC 120. Therefore, the network prefix of the global VPC 120 can also be specified by the tenant. For example, the global routing prefix applied by the tenant from the IPv6 address management agency.
  • the cloud management platform 110 after receiving the configuration information A, obtains the network prefix specified by the tenant for the global VPC 120 based on the configuration information A, and uses the network prefix specified by the tenant as the network prefix of the global VPC 120.
  • Method 2 The cloud management platform 110 applies for a global routing prefix (global routing prefix) from the IPv6 address management agency, and then uses the applied global routing prefix as the network prefix of the global VPC 120.
  • a global routing prefix global routing prefix
  • the global routing prefix applied by a tenant from the IPv6 address management agency can only be used by the tenant, and the global routing prefix applied by the cloud management platform 110 (i.e., the cloud service provider) from the IPv6 address management agency It can be provided to only one tenant, or it can be provided to multiple tenants to save address resources.
  • the cloud management platform 110 can add the tenant identifier to the network prefix of the global VPC 120. Specifically, The cloud management platform 110 can allocate network prefixes to the global VPC 120 through method 3.
  • Method 3 The cloud management platform 110 applies for a global routing prefix from the IPv6 address management agency, and then generates the network prefix of the global VPC 120 based on the applied global routing prefix and tenant ID.
  • the network prefix of global VPC 120 includes global route prefix and tenant ID.
  • the tenant identifier may be the tenant's ID, or information that can identify the tenant, such as a number set by the cloud management platform 110 for the tenant, which is not limited in the embodiment of this application.
  • Method 4 The cloud management platform 110 randomly generates a network prefix and uses the randomly generated network prefix as the global VPC. 120 network prefix.
  • the global routing prefix applied by the cloud management platform 110 or the tenant from the IPv6 address management agency can generally be routed directly on the Internet, while the network prefix randomly generated by the cloud management platform 110 generally cannot be routed directly on the Internet.
  • the cloud management platform 110 uses method 4 to allocate network prefixes to the global VPC 120, when the global VPC 120 or a certain regional VPC 130 needs to access the Internet, additional steps are required. Deploy network address translation (NAT) gateways locally. Therefore, in actual applications, the cloud management platform 110 can choose an appropriate method to allocate network prefixes to the global VPC 120 based on the tenant's business needs.
  • NAT network address translation
  • the cloud management platform 110 can allocate network prefixes to the global VPC 120.
  • the management platform 110 can use any of the methods 1 to 3 to allocate network prefixes to the global VPC 120.
  • the cloud management platform 110 can Use method 4 to assign a network prefix to global VPC 120.
  • the UI or API provided by the cloud management platform 110 for creating the global VPC 120 includes configuration information of the network prefix of the global VPC 120, and the configuration information is used to instruct the cloud management platform 110 to use an appropriate Method to assign network prefix to global VPC 120.
  • Figure 8 shows another UI for creating a global VPC. Compared with the interface shown in Figure 7, the interface shown in Figure 8 has a new "Network Prefix” option, which has three configuration methods. , namely "auto-configuration - routable on the Internet", “auto-configuration - not routable on the Internet”, "manual configuration".
  • the cloud management platform 110 When the tenant selects the "Automatic configuration - not routable on the Internet” option, the cloud management platform 110 will use method 2 or method 4 to allocate a network prefix to the global VPC 120; when the tenant selects the "automatic configuration - not routable on the Internet” option , the cloud management platform 110 will use method 4 to allocate a network prefix to the global VPC 120; when the tenant selects the "manual configuration” option, the tenant also needs to fill in the network prefix in the box after the option, so that the cloud management platform 110 can Use method 1 to assign a network prefix to global VPC 120.
  • the cloud management platform 110 allocates the network prefix to the global VPC 120 in a manner similar to the above-mentioned methods 1 to 4. For the sake of simplicity, they will not be expanded here. describe.
  • the cloud management platform 110 determines the configuration information B input or selected by the tenant, and creates the first VPC based on the configuration information B.
  • the tenant sends configuration information B to the cloud management platform 110 by operating (including input or selection) on the UI or API provided by the cloud management platform 110.
  • the cloud management platform 110 determines the configuration information B, it creates the third configuration information B according to the configuration information B.
  • One VPC One VPC.
  • configuration information B includes information such as the location and name of the first VPC.
  • Figure 9 shows a UI for creating a regional VPC 130.
  • the interface includes multiple options such as "name” and "region”.
  • the tenant fills in the name of the first VPC after the "Name” option according to the prompts on the interface, and selects the geographical location where the first VPC is deployed after the "Region” option. It should be understood that in actual applications, tenants can choose an appropriate region to deploy the first VPC based on business needs, which can reduce network latency, increase access speed, and thereby improve cloud service quality.
  • the cloud management platform 110 can receive the configuration information B and create the first VPC based on the configuration information B; if the tenant clicks the "Cancel” option, the cloud management platform 110 can return to the previous page.
  • First-level menu the UI for creating the global VPC 120 as shown in Figure 7 or Figure 8
  • the cloud management platform 110 will not receive the configuration information B, nor will the first VPC be created.
  • the cloud management platform 110 allocates a network prefix to the first VPC through the global VPC 120.
  • the network prefix of the first VPC includes the network prefix of the global VPC 120 and the identifier of the first VPC (hereinafter referred to as the first region identifier).
  • the first region identifier may be the number of the first VPC in the plurality of regional VPCs 130, or the ID of the first VPC, or the identifier of the geographical location where the first VPC is located, or other information that can identify the first VPC.
  • the application examples are not limiting.
  • the cloud management platform 110 After the cloud management platform 110 creates the first VPC, it generates the first region identifier. Afterwards, the cloud management platform 110 sends a first configuration command to the global VPC 120, where the first configuration command includes the first region identifier. After receiving the above-mentioned first configuration command, the global VPC 120 obtains the first area identifier according to the first configuration command, and then generates the network prefix of the first VPC based on the first area identifier and the network prefix of the global VPC 120. Finally, the cloud management platform 110 obtains the network prefix of the first VPC from the global VPC 120, and allocates the obtained network prefix to the first VPC.
  • the network prefix of the first VPC also includes the tenant identifier mentioned above, and the above-mentioned first configuration command may also include the above-mentioned tenant identifier.
  • the global VPC 120 After the global VPC 120 generates the network prefix of the first VPC, it stores the network prefix of the first VPC.
  • the cloud management platform 110 establishes a network connection between the global VPC 120 and the first VPC based on the network prefix of the global VPC 120 and the first VPC.
  • the cloud management platform 110 creates a first access point, where the first access point may be a gateway (such as a router, a switch, etc.), or a gateway service (such as a virtual machine or server with a gateway function). Afterwards, the cloud management platform 110 configures the routing relationship between the network prefix of the global VPC 120 and the network prefix of the first VPC on the first access point. In this way, the global VPC 120 and the first VPC can be configured according to the first access point. Implement network connectivity.
  • the first access point may be a gateway (such as a router, a switch, etc.), or a gateway service (such as a virtual machine or server with a gateway function).
  • the cloud management platform 110 configures the routing relationship between the network prefix of the global VPC 120 and the network prefix of the first VPC on the first access point. In this way, the global VPC 120 and the first VPC can be configured according to the first access point. Implement network connectivity.
  • the cloud management platform 110 may also perform the following steps: configure an ACL on the first access point, where the ACL includes at least one of the following entries: deny data from one or more services in the third VPC flow and refuse to release the data flow sent to one or more services in the third VPC.
  • the above-mentioned "Reject data flow from one or more services in the third VPC" entry is used to instruct the first access point to reject the data flow from one or more services in the above-mentioned third VPC. Discard, so that the services deployed on the first VPC will not be accessed by one or more services from the third VPC; the above "refuse to release data flows sent to one or more services in the third VPC"
  • the entry is used to instruct the first access point to discard the data stream sent by the first VPC to one or more services in the third VPC. In this way, the services in the first VPC cannot access the third VPC.
  • the ACL on the first access point includes denying data flows from all services in the third VPC and refusing to release data flows sent to all services in the third VPC
  • the first VPC and the third VPC VPCs are isolated from each other, that is, they cannot communicate with each other.
  • the cloud management platform 110 allocates a network prefix to the subnet in the first VPC through the global VPC 120.
  • the first VPC includes at least one subnet, and the number of subnets in the first VPC can be preset by the tenant.
  • configuration information B includes the number of subnets that need to be deployed in the first VPC; the number of subnets in the first VPC The number can also be dynamically adjusted by the cloud management platform 110 according to the actual situation; the number of subnets in the first VPC can also be preset by the cloud service provider (such as 256), which is not limited in the embodiment of this application.
  • the network prefix of each subnet includes the network prefix of the first VPC and the subnet identifier.
  • the subnet identifier may be a number set by the cloud management platform 110 or the tenant for the subnet, or a subnet ID or other information that can identify the subnet.
  • the network prefix of each subnet can also include the tenant identifier mentioned above.
  • the cloud management platform 110 allocates network prefixes to the subnet in the first VPC through the global VPC 120, including: the cloud management platform 110 Send a second configuration command to the global VPC 120, where the second configuration command includes an identifier of the first subnet (hereinafter referred to as the first subnet identifier).
  • the global VPC 120 obtains the first subnet identifier according to the second configuration command, and then generates the network prefix of the first subnet according to the first subnet identifier and the locally stored network prefix of the first VPC.
  • the cloud management platform 110 obtains the network prefix of the first subnet from the global VPC 120 and allocates the obtained network prefix to the first subnet.
  • the global VPC 120 After the global VPC 120 generates the network prefix of the subnet in the first VPC, it stores the network prefix of the subnet in the first VPC.
  • the cloud management platform 110 determines the configuration information C entered or selected by the tenant, creates resources in the first VPC based on the configuration information C, and allocates network prefixes to the resources.
  • the resources created by the cloud management platform 110 in the first VPC may include various types such as VMs, containers, and sandboxes.
  • the configuration information C includes the deployment location of the resource, that is, in which subnet in the first VPC the resource is deployed. Furthermore, the deployment location of the resource can also be specific to which host in the subnet.
  • the configuration information C also includes representation information of the resource migration attribute. This information is used to indicate whether the resource supports migration from the first VPC to a VPC under the jurisdiction of the global VPC 120 that can communicate with the first VPC, where the VPC under the jurisdiction of the global VPC 120 VPC refers to: the VPC that is assigned a network prefix by the global VPC 120, including the above-mentioned multiple regional VPCs 130.
  • the VPC under the jurisdiction of the global VPC 120 that can communicate with the first VPC refers to: the VPC that is assigned a network prefix by the global VPC 120 and can A VPC that communicates with the first VPC through global VPC 120, such as a second VPC.
  • the configuration information C may also include the type of resource (such as VM, container, sandbox), the memory size of the resource, the operating system of the resource, etc.
  • the network prefix of the resource includes the network prefix, region identifier, and subnet identifier of the global VPC 120.
  • the network prefix of the resource may also include the tenant identifier mentioned above.
  • the area identifier in the network prefix of the resource has different functions from the area identifier in the network prefix of the first VPC described in S104 above, and the area identifier in the network prefix of the subnet in the first VPC described in S106 above.
  • the zone identifier in the network prefix of the resource is used to indicate whether the resource supports migration from the first VPC to a VPC under the jurisdiction of global VPC 120 that can communicate with the first VPC.
  • the subnet identifier in the network prefix of a resource is used to identify the subnet where the resource is deployed. That is, the subnet identifier in the network prefix of the resource is the same as the subnet identifier in the network prefix of the subnet where the resource is deployed.
  • the characterization information of the resource migration attribute includes the area identifier in the network prefix of the resource.
  • the region identifier in the network prefix of the resource is different from the network of any VPC under the jurisdiction of the global VPC 120 The regional identifier in the prefix.
  • the regional identifiers in the network prefixes of multiple regional VPC 130 are 1 to N (N is a positive integer greater than 0)
  • the regional identifier in the network prefix of the resource can be different from Any number from 1 to N (such as 0); when the resource does not support migration from the first VPC to a VPC under the jurisdiction of global VPC 120 that can communicate with the first VPC, the region identifier in the network prefix of the resource can be First area identifier.
  • the characterization information of the resource migration attribute may also include other types of information, for example, the "migrate across VPC" and "do not migrate across VPC" options shown in Figure 8 .
  • the tenant can send the configuration information C to the cloud management platform 110 by operating (including input or selection) on the UI or API provided by the cloud management platform 110 .
  • Figure 10 exemplarily shows a UI for creating resources.
  • the interface includes multiple options such as "name” and "network prefix”.
  • Tenants can enter the name of the resource in the fill-in box after the "Name” option.
  • the "Network Prefix” option has two configuration methods, namely "Manual Configuration” and "Automatic Configuration”.
  • the tenant selects "Manual Configuration”
  • the tenant can enter the zone ID and subnet ID in the corresponding address bar. Among them, the tenant can Select the appropriate region identifier based on business needs.
  • the tenant can choose the region identifier to be 0.
  • the tenant can choose the region identifier. Identifies the first area.
  • Tenants can also select the appropriate subnet identifier based on business needs, that is, the identifier of the subnet where the above VM needs to be deployed.
  • the tenant selects "Automatic Configuration”
  • the tenant needs to select the identification of the subnet where the above VM needs to be deployed in the selection box after the "Deployment Location” option.
  • the tenant You can check the "Migrate across VPC" option.
  • the tenant can check the "Do not migrate across VPC" option. Afterwards, if the tenant clicks the "Confirm” option, the cloud management platform 110 can receive the configuration information C; if the tenant clicks the "Cancel” option, the cloud management platform 110 can return to the previous menu (the UI for creating the first VPC as shown in Figure 9), so that the cloud management platform 110 Configuration information C will not be received.
  • the cloud management platform 110 allocates a network prefix to the above created resources, including: the cloud management platform 110 obtains the deployment location of the resource and the characterization information of the resource migration attribute based on the configuration information C input by the tenant.
  • the cloud management platform 110 allocates a network prefix to the resource through the global VPC 120; when the resource
  • the cloud management platform 110 allocates a network prefix to the resource through the first VPC.
  • the cloud management platform 110 allocates network prefixes to the resources through the global VPC 120.
  • the specific process is: the cloud management platform 110 sends a third configuration command to the global VPC 120, where the third configuration command includes the deployment location of the above resources.
  • the global VPC 120 determines the subnet identifier in the network prefix of the resource based on the third configuration command, and generates a region identifier different from the network prefix of any VPC under the jurisdiction of the global VPC 120. Then combine the network prefix of the global VPC stored locally to generate the network prefix of the resource.
  • the cloud management platform 110 obtains the network prefix of the resource from the global VPC 120 and allocates the obtained network prefix to the above resources.
  • the cloud management platform 110 allocates a network prefix to the resource through the first VPC.
  • the specific process is: the cloud management platform 110 sends a third configuration command to the first VPC, where the third configuration command includes the deployment location of the above resource.
  • the first VPC determines the subnet identifier in the network prefix of the resource based on the third configuration command, and then combines it with the locally stored network prefix of the first VPC to generate the network prefix of the resource.
  • the cloud management platform 110 obtains the network prefix of the resource from the first VPC and allocates the obtained network prefix to the above-mentioned resource.
  • the cloud management platform 110 allocates a network prefix to the above-mentioned created resources, including: the cloud management platform 110 allocates a network prefix to the above-mentioned resources through the global VPC 120. Specifically, the cloud management platform 110 obtains the deployment location of the resource and the representation information of the resource migration attribute based on the configuration information C input by the tenant, and then sends the third configuration command to the global VPC 120, where the third configuration command includes the deployment of the above resources. Representation information of location and resource migration attributes.
  • the global VPC 120 After receiving the above third configuration command, the global VPC 120 determines the subnet identifier in the network prefix of the resource based on the deployment location of the resource, and determines whether the resource supports migration from the first VPC to the jurisdiction of the global VPC 120 based on the characterization information of the resource migration attribute. A VPC that can communicate with the first VPC.
  • the global VPC 120 When the representation information of the resource migration attribute indicates that the resource supports migration from the first VPC to a VPC under the jurisdiction of the global VPC 120 that can communicate with the first VPC, the global VPC 120 generates a Different from the region identifier in the network prefix of any VPC under the jurisdiction of the global VPC 120; when the representation information of the resource migration attribute indicates that the resource does not support migration from the first VPC to the jurisdiction of the global VPC 120, it can communicate with the first VPC When using a VPC, the global VPC 120 determines the first zone identifier. Afterwards, the global VPC 120 generates the network prefix of the resource based on the network prefix of the locally stored global VPC and the determined subnet identifier and region identifier. Finally, the cloud management platform 110 obtains the network prefix of the resource from the global VPC 120 and allocates the obtained network prefix to the above resources.
  • the cloud management platform 110 sends the network prefix of the resource to the host where the resource is deployed.
  • the IP address of the resource can be an IPv4 address or an IPv6 address.
  • IPv6 address the following describes the process of the host generating the IP address of the resource based on the network prefix of the resource:
  • the length of an IPv6 address is 128 bits.
  • the IPv6 address includes two parts: one part is the network prefix, and the other part is the interface ID.
  • the length of both parts is 64 bits. . Therefore, when the IP address of a resource is an IPv6 address, the address consists of a 64-bit network prefix and a 64-bit interface identifier, where, The network prefix in the address includes the network prefix assigned to the resource by the cloud management platform 110, and the interface identifier in the address includes the MAC address of the host interface.
  • the network prefix in the address includes the network prefix assigned to the resource by the cloud management platform 110
  • the interface identifier in the address includes the MAC address of the host interface.
  • One thing worth noting is that different resources deployed in the host machine correspond to different interfaces of the host machine.
  • the interface identifiers in the IPv6 addresses of different resources deployed in the same host machine are different. Then, the above host generates the IP address of the resource based on the network prefix of the resource, including: the above host generates an interface identifier based on the MAC address of the interface corresponding to the resource, and then generates the IP address of the resource based on the network prefix of the resource and the above interface identifier ( i.e. IPv6 address).
  • the network prefix assigned to the resource by the cloud management platform 110 is 64 bits.
  • the network prefix of a resource can include the network prefix of the global VPC 120, the region identifier, the subnet identifier, and can also include the tenant identifier. Therefore, the network prefix of the resource has multiple formats. Figures 11 and 12 respectively show the network prefix of the resource in different formats.
  • the network prefix of the resource includes the network prefix, regional identifier, and subnet identifier of the global VPC 120.
  • the network prefix of the global VPC 120 is 48 bits
  • the regional identifier is 8 bits
  • the subnet identifier is 8 bits.
  • the network prefix of the resource includes the network prefix, regional identifier, tenant identifier and subnet identifier of the global VPC 120.
  • the network prefix of the global VPC 120 is 32 bits
  • the regional identifier is 8 bits
  • the tenant identifier is 16 bits.
  • bit the subnet identification is 8 bits.
  • the global routing prefix applied by tenants from the IPv6 address management agency is 48 bits
  • the cloud management platform 110 applies for the global routing prefix from the IPv6 address management agency, it can negotiate with the IPv6 address management agency, so as to You can apply for global routing prefixes of different lengths (such as 20 bits, 32 bits, and 48 bits). Therefore, the network prefix of the 48-bit global VPC 120 shown in Figure 11 may be applied by the tenant from the IPv6 address management agency, or the cloud management platform 110 may apply from the IPv6 address management agency, or the cloud management platform 110 may apply from the IPv6 address management agency.
  • the global routing prefix and tenant ID applied for by the address management agency may be randomly generated by the cloud management platform 110 .
  • the network prefix of the 32-bit global VPC 120 shown in Figure 12 can be applied by the cloud management platform 110 from the IPv6 address management agency.
  • the length of each part of the network prefix of the resource can be flexibly set, and the position of each part can also be flexibly adjusted, for example , the tenant identification may be located before the distinguishing identification, which is not limited in the embodiment of this application.
  • the cloud management platform 110 can allocate appropriate network prefixes to resources according to the configuration information input by the tenant (including configuration information A, configuration information B, and configuration information C).
  • the generation process is similar to the generation process of the IPv6 address of the above resource.
  • the IPv4 address of the resource also has multiple formats and can be obtained by analogy with the IPv6 address of the resource. Therefore, in order to For simplicity, the embodiments of this application will not be described further.
  • the first VPC and the resources in the first VPC can be created through the above S101-S109.
  • the cloud management platform 110 can also create the second VPC and the resources in the second VPC.
  • the specific process can be found in S101- S109, for simplicity, will not be described here.
  • the global VPC 120 implements cross-region communication between the first VPC and the second VPC based on the first network prefix and the second network prefix.
  • the global VPC 120 stores the routing relationship between the network prefix of the first VPC and the network prefix of the second VPC.
  • the global VPC 120 stores the first routing table entry and the second routing table entry. At least one, wherein the source address in the first routing table entry is the network prefix of the first VPC, and the destination address is the network prefix of the second VPC; The source address in the second routing table entry is the network prefix of the second VPC, and the destination address is the network prefix of the first VPC.
  • the global VPC 120 implements cross-region communication between the first VPC and the second VPC based on the first network prefix and the second network prefix. It includes: the global VPC 120 receives the data flow A sent by the first VPC through the first access point, and then sends the data flow A through the second access point to the second VPC according to the first routing table entry, that is, the data flow A
  • the forwarding path is the first VPC ⁇ the first access point ⁇ global VPC 120 ⁇ the second access point ⁇ the second VPC.
  • the cloud management platform 110 In order to improve the quality of communication between the first VPC and the second VPC, optionally, the cloud management platform 110 also performs the following steps: allocate bandwidth to the global VPC 120 so that the data flow passing through the global VPC 120 meets the above bandwidth requirements.
  • the above-mentioned bandwidth may be preset by the tenant.
  • configuration information A includes bandwidth information.
  • the cloud management platform 110 may allocate bandwidth to the global VPC 120 based on configuration information A.
  • the above bandwidth can also be dynamically adjusted by the cloud management platform 110 according to the actual situation. For example, the cloud management platform 110 adjusts the above bandwidth according to the load condition of the global VPC 120 and the current network status.
  • the cloud management platform 110 can make the data flow passing through the global VPC 120 meet the above bandwidth requirements in the following manner: the cloud management platform 110 maintains a mapping table, which includes at least one VPC identifier, at least one flow label, and at least one flow label.
  • VPC identifier includes the identifier of the global VPC 120
  • at least one flow label includes the flow label corresponding to the identifier of the global VPC 120
  • the target flow label since the cloud management platform 110 can create multiple global VPCs according to the needs of tenants, the above-mentioned at least one VPC identifier may also include the identifiers of other global VPCs.
  • the above-mentioned at least one flow label may also include other global VPC identifiers.
  • the flow label corresponding to the VPC ID can be preset by the tenant or set by the cloud management platform 110.
  • the identity of the global VPC 120 can be the tenant identity.
  • the identifier of the global VPC 120 can be the ID of the global VPC 120, or the number of the global VPC 120, or other information that can identify the global VPC 120.
  • the target flow label is used to identify the data flow passing through the global VPC 120.
  • the cloud management platform 110 assigns an identifier to the global VPC 120, and then adds a corresponding flow label to the data flow passing through the global VPC 120 according to the identifier of the global VPC 120, and then obtains the above bandwidth requirement based on the above flow label, and finally according to the above Bandwidth requirements dictate the forwarding of the above data flows.
  • the underlying network when the underlying network forwards data flow A, it can obtain the target flow label, thereby determining the bandwidth allocated by the cloud management platform 110 to the global VPC 120, and then configures it to forward data flow A according to the above bandwidth requirements.
  • Quality of service (QoS) queue to complete the forwarding of data flow A. In this way, the bandwidth of data stream A can be guaranteed, thereby ensuring the quality of communication between the first VPC and the second VPC.
  • S201 The VM in the first VPC sends a migration request to the cloud management platform 110.
  • the migration request includes the IP address of the VM, the MAC address of the VM, and the IP address of the first host.
  • S202 The cloud management platform 110 determines whether the VM supports migration from the first VPC to the second VPC based on the above migration request. If the VM supports migration from the first VPC to the second VPC, S203-S205 is performed. If the VM does not support migration from the first VPC to the second VPC, the cloud management platform 110 does not perform migration of the VM from the first VPC to the second VPC. VPC related operations.
  • the cloud management platform 110 obtains the region identifier in the IP address of the VM based on the above migration request, and then determines whether the VM supports migration from the first VPC to the second VPC based on the region identifier in the IP address of the VM. Among them, if the region identifier in the IP address of the VM is different from the region identifier in the network prefix of any regional VPC 130, the cloud management platform 110 determines that the VM supports migration from the first VPC to the second VPC; if the IP address of the VM If the region identifier in is the same as the first region identifier, the cloud management platform 110 determines that the VM does not support migration from the first VPC to the second VPC.
  • S203 The cloud management platform 110 determines the second host according to the above migration request.
  • the cloud management platform 110 obtains the subnet identifier in the IP address of the VM based on the above migration request, and then determines the second subnet based on the subnet identifier in the IP address of the VM, thereby determining the second host.
  • the second host is located on the second subnet
  • the second subnet is a network segment in the second VPC
  • the subnet identifier in the network prefix of the second subnet is the same as the subnet in the network prefix of the first subnet.
  • the logo is the same.
  • the cloud management platform 110 establishes a network connection between the first host and the second host.
  • the cloud management platform 110 obtains the IP address of the first host according to the above migration request, and then establishes a link between the first host and the second host based on the IP address of the first host and the IP address of the second host. Internet connection.
  • S205 The cloud management platform 110 migrates the VM from the first host to the second host.
  • the cloud management platform 110 sends a migration instruction to the first host.
  • the first host first transfers the configuration of the VM (such as the operating system) and device information (such as memory size) are sent to the second host, and then the VM's memory (such as the VM's initial memory, memory change fragmentation) is synchronized to the second host. Then, the VM is paused on the first host, and the last memory changed fragment is transferred to the second host. Finally, stop the VM on the first host and resume the VM on the second host to complete the VM migration.
  • the configuration of the VM such as the operating system
  • device information such as memory size
  • the VM's memory such as the VM's initial memory, memory change fragmentation
  • the cloud management platform 110 needs to transfer data from other VMs. The stream is sent to the first host. After the VM migration is completed, if other VMs access the VM, the cloud management platform 110 needs to send data streams from other VMs to the second host.
  • Figure 14 exemplarily shows a schematic structural diagram of the cloud management platform 110.
  • the cloud management platform 110 includes a determination module 111 , a control module 112 and a network configuration module 113 .
  • the determination module 111, the control module 112 and the network configuration module 113 work together to implement the steps performed by the cloud management platform 110 in the above method embodiment.
  • the determination module 111 is used to perform the step of determining the configuration information A input or selected by the tenant in S101, the step of determining the configuration information B input or selected by the tenant in S103, and the determination of the configuration input or selected by the tenant in S107.
  • the determining module 111 is also configured to send the above configuration information A, configuration information B and configuration information C to the control module 112 .
  • the control module 112 is used to execute the step of creating the global VPC 120 based on the configuration information A in the above-mentioned S101, the step of creating the first VPC based on the configuration information B in the above-mentioned S103, and creating resources in the first VPC based on the configuration information C in the above-mentioned S107, and
  • the control module 112 is also used to execute the above-mentioned S102-S104, S106, S108 and S110.
  • the network configuration module 113 is used to execute the above S105.
  • the determination module 111 is also configured to receive a migration request sent by the VM, and send the migration request to the control Module 112; the control module 112 is also used to execute the above S202-S205.
  • control module 112 is also used to perform related steps to ensure bandwidth when the first VPC and the second VPC communicate, for example, allocate bandwidth to the global VPC 120, add flow labels to the amount of data passing through the global VPC 120, etc.
  • each module within the cloud management platform 110 may be a software module or a hardware module, or may be partly a software module and partly a hardware module.
  • FIG. 15 shows a schematic structural diagram of a computing device provided by an embodiment of the present application.
  • the above-mentioned cloud management platform 110 can be deployed on the computing device.
  • the computing device can be a computing device (for example, a server) in a cloud environment, or Computing devices in edge environments, or end computing devices.
  • the computing device 200 includes a memory 210 , a processor 220 , a communication interface 230 and a bus 240 .
  • the memory 210 , the processor 220 and the communication interface 230 realize communication connections with each other through the bus 240 .
  • the memory 210 may include a read-only memory (ROM), a static storage device, a dynamic storage device, a random access memory (RAM), a hard disk, etc.
  • the memory 210 may store programs, for example, programs in the determination module 111, programs in the control module 112, programs in the network configuration module 113, and the like.
  • the processor 220 and the communication interface 230 are used to execute the method executed by the cloud management platform 110 (including the methods described in S101-S110, S201-S205 above, and the guarantee Steps related to bandwidth when communicating between the first VPC and the second VPC).
  • the memory 210 may also store data, such as intermediate data or result data generated by the processor 220 during execution, such as the network prefix, ACL, etc. of the global VPC 120.
  • the processor 220 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a graphics processing unit (GPU), or one or more integrated circuits.
  • CPU central processing unit
  • ASIC application specific integrated circuit
  • GPU graphics processing unit
  • the processor 220 may also be an integrated circuit chip with signal processing capabilities. During the implementation process, some functions of the cloud management platform 110 may be completed through instructions in the form of hardware integrated logic circuits or software in the processor 220 .
  • the processor 220 can also be a general-purpose processor, a digital signal processor (DSP), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, Discrete hardware components can implement or execute the methods, steps and logical block diagrams disclosed in the embodiments of this application.
  • the general processor can be a microprocessor or the processor can be any conventional processor, etc.
  • the method disclosed in combination with the embodiments of the present application can be directly implemented as a hardware decoding processor to complete the execution, or can be performed using decoding processing.
  • the combination of hardware and software modules in the device is executed.
  • the software module can be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other mature storage media in this field.
  • the storage medium is located in the memory 210.
  • the processor 220 reads the information in the memory 210 and completes some or all functions of the cloud management platform 110 in combination with its hardware.
  • the communication interface 230 uses a transceiver module, such as but not limited to a transceiver, to implement communication between the computing device 200 and other devices or communication networks. For example, the configuration information (including configuration information A, configuration information B, and configuration information C) sent by the tenant is received through the communication interface 230.
  • a transceiver module such as but not limited to a transceiver
  • Bus 240 may include a path that carries information between various components in computing device 200 (eg, memory 210, processor 220, and communication interface 230).
  • FIG 16 shows a schematic structural diagram of a computing device system provided by an embodiment of the present application.
  • the computing device system includes multiple computing devices.
  • the above-mentioned cloud management platform 110 can be deployed in a distributed manner on multiple computing devices in the computing device system. superior.
  • the computing device system 300 includes multiple computing devices 400.
  • Each computing device 400 includes a memory 410, a processor 420, a communication interface 430, and a bus 440.
  • the memory 410, the processor 420, and the communication interface 430 pass through Bus 440 implements communication connections between each other.
  • Memory 410 may include ROM, RAM, static storage devices, dynamic storage devices, hard disks (eg, SSD, HDD), etc.
  • the memory 410 may store program codes, for example, a part of the program in the determination module 111, a part of the program in the control module 112, a part of the program in the network configuration module 113, and so on.
  • the processor 420 and the communication interface 430 are used to execute part of the methods executed by the cloud management platform 110 (including part of the methods described in S101-S110 and S201-S205 above, and related steps to ensure the bandwidth when communicating between the first VPC and the second VPC).
  • the memory 410 may also store data, such as intermediate data or result data generated by the processor 420 during execution, such as the network prefix, ACL, etc. of the global VPC 120.
  • Processor 420 may employ a CPU, GPU, ASIC, or one or more integrated circuits.
  • the processor 420 may also be an integrated circuit chip with signal processing capabilities.
  • some functions of the cloud management platform 110 may be implemented by instructions in the form of hardware integrated logic circuits or software in the processor 420 .
  • the processor 420 can also be a DSP, FPGA, general-purpose processor, other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components, and can implement or execute some of the methods, steps, and logical block diagrams disclosed in the embodiments of this application.
  • the general processor may be a microprocessor or the processor may be any conventional processor, etc.
  • the steps of the method disclosed in conjunction with the embodiments of the present application may be directly implemented as a hardware decoding processor, or may be executed using a decoding processor.
  • the combination of hardware and software modules in the code processor is executed.
  • the software module can be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other mature storage media in this field.
  • the storage medium is located in the memory 410.
  • the processor 420 reads the information in the memory 410 and completes some functions of the cloud management platform 110 in combination with its hardware.
  • the communication interface 430 uses a transceiver module, such as but not limited to a transceiver, to implement communication between the computing device 400 and other computing devices or communication networks.
  • a transceiver module such as but not limited to a transceiver, to implement communication between the computing device 400 and other computing devices or communication networks.
  • the configuration information (including configuration information A, configuration information B, and configuration information C) sent by the tenant is received through the communication interface 430.
  • Bus 440 may include a path that carries information between various components in computing device 400 (eg, memory 410, processor 420, and communication interface 430).
  • Any computing device may be a computing device (eg, a server) in a cloud environment, a computing device in an edge environment, or a terminal computing device.
  • the above embodiments it may be implemented in whole or in part by software, hardware, or a combination thereof.
  • software it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product may include computing instructions executed by one or more cloud management platforms 110. When these computer program instructions are loaded and executed on the computer, the processes or functions described in the embodiments of the present application are generated in whole or in part.
  • the above-mentioned computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the above computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the above-mentioned computer instructions may be transmitted from a website, computer, server or data
  • the data center transmits to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, twisted pair or wireless (such as infrared, wireless, microwave), etc.) means.
  • the computer-readable storage medium stores computer program instructions for execution by the cloud management platform 110 .
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more integrated media.
  • the above available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, optical disk), or semiconductor media (eg, solid state disk (SSD)).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例提供了一种基于公有云的VPC之间的通信方法及相关产品，该方法包括以下步骤：云管理平台确定租户输入或选择的第一配置信息，根据第一配置信息创建全局VPC；云管理平台确定租户输入或选择的第二配置信息，根据第二配置信息通过上述全局VPC给位于第一区域的第一VPC分配第一网络前缀，通过上述全局VPC给位于第二区域的第二VPC分配第二网络前缀，其中，上述全局VPC用于根据第一网络前缀和第二网络前缀实现第一VPC和第二VPC之间的跨区域通信。

Description

一种基于公有云的VPC之间的通信方法及相关产品
本申请要求于2022年5月30日提交中国专利局、申请号为202210601054.8、申请名称为“一种基于公有云的VPC之间的通信方法及相关产品”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及云计算技术领域，尤其涉及一种基于公有云的虚拟私有云(virtual private cloud,VPC)之间的通信方法及相关产品。
背景技术
VPC是租户创建的虚拟网络环境，支持租户自主配置和管理，同时具有安全可靠等诸多优势，因而受到了广泛地使用。在实际应用中，不同VPC之间存在通信的诉求，但由于私有地址规划等原因，需要通信的VPC之间可能存在私有地址重叠的情况，这会造成上述VPC之间不能进行通信。
目前，主要采用以下两种方法来实现具有相同私有地址的VPC间的通信：①在上述VPC之间创建VPC对等连接(VPC peering)。②使用中转网关(transitgateway)来连接上述不同的VPC。上述两种方法都需要租户来管理VPC的私有地址，而且，VPC中的资源不能互相迁移，VPC之间的通信也没有带宽保障。
因此，如何实现VPC之间的通信仍然是当前云计算技术领域中急需解决的问题。
发明内容
本申请实施例提供了一种基于公有云的VPC之间的通信方法及相关产品，能够实现不同VPC之间的通信，在此基础上，还能够保证不同VPC通信时的带宽，不同VPC中的资源还能够按需相互迁移，除此之外，还能够实现VPC的网络地址和路由的统一管理，减少人工的工作量。
第一方面，本申请实施例提供了一种基于公有云的VPC之间的通信方法，该方法包括以下步骤：云管理平台确定租户输入或选择的第一配置信息，根据第一配置信息创建全局VPC；云管理平台确定租户输入或选择的第二配置信息，根据第二配置信息通过上述全局VPC给位于第一区域的第一VPC分配第一网络前缀，通过上述全局VPC给位于第二区域的第二VPC分配第二网络前缀，其中，上述全局VPC用于根据第一网络前缀和第二网络前缀实现第一VPC和第二VPC之间的跨区域通信。可以看出，通过实施上述方法，第一VPC和第二VPC具有不同的网络前缀，从而可以实现第一VPC和第二VPC之间的通信。
在第一方面的一种可能的实现方式中，第一网络前缀中的区域标识与第二网络前缀中的区域标识不同。其中，第一网络前缀中的区域标识用于标识第一VPC，第二网络前缀中的区域标识用于标识第二VPC。如此，第一网络前缀和第二网络前缀不同，使得第一VPC和第二VPC之间的通信成为可能。
在第一方面的一种可能的实现方式中，上述方法还包括：云管理平台给全局VPC分配网络前缀，其中，第一网络前缀和所第二网络前缀还包括全局VPC的网络前缀。
在第一方面的一种可能的实现方式中，上述方法还包括：云管理平台建立第一VPC和全局VPC之间的网络连接，以及第二VPC和全局VPC之间的网络连接。应理解，通过建立第一VPC和全局VPC之间的网络连接，可以使得第一VPC和全局VPC通信，同样的，通过建立第二网络前缀和全局VPC之间的网络连接，可以使得第二VPC和全局VPC可以通信。如此，第一VPC和第二VPC便可以通过全局VPC实现通信。
在第一方面的一种可能的实现方式中，全局VPC存储有第一网络前缀、第二网络前缀以及第一网络前缀和第二网络前缀之间的路由关系。如此，利用全局VPC可以实现第一VPC和第二VPC的网络地址、以及二者之间的路由的自动管理。
在第一方面的一种可能的实现方式中，第一VPC不支持与第三VPC通信。如此，第一VPC与第三VPC之间是相互隔离的，提高部署在第一VPC和第三VPC中的业务的安全性。
在第一方面的一种可能的实现方式中，上述方法还包括：云管理平台设置第一VPC的访问控制列表(access control lists,ACL)，其中，该ACL包括用于阻断第一VPC与第三VPC之间通信的表项。如此，可以第一VPC便无法接收到来自第三VPC的数据流，也无法将数据流发送至第三VPC，从而实现第一VPC与第三VPC之间的隔离。
在第一方面的一种可能的实现方式中，第一VPC包括第一子网，上述方法还包括：云管理平台通过全局VPC给第一子网分配网络前缀，其中，第一子网的网络前缀包括第一网络前缀和子网标识。如此，可以实现由全局VPC管理第一VPC中子网的网络地址。
在第一方面的一种可能的实现方式中，第一子网包括虚拟机(virtualmachine,VM)，上述方法还包括：云管理平台通过全局VPC或第一VPC给VM分配网络前缀，其中，VM的网络前缀中的区域标识用于表示VM支持迁移至全局VPC管辖下的、可与第一VPC通信的VPC。全局VPC管辖下的、可与第一VPC通信的VPC是指：由全局VPC分配网络前缀的、可通过全局VPC与第一VPC通信的VPC。
在第一方面的一种可能的实现方式中，上述VM的网络前缀中的区域标识不同于全局VPC管辖下的任一个VPC的网络前缀中的区域标识。
在第一方面的一种可能的实现方式中，全局VPC管辖下的、可与第一VPC通信的VPC包括第二VPC，上述方法还包括：云管理平台将上述VM从第一VPC迁移至第二VPC，其中，迁移后的VM位于第二VPC的第二子网中，第二子网的网络前缀中的子网标识与第一子网的网络前缀中的子网标识相同。
在第一方面的一种可能的实现方式中，迁移后的VM的网络前缀与迁移前的VM的网络前缀相同。
通过上述实现方式，第一VPC中的VM可以跨区域迁移至其他的VPC，提高了业务部署的灵活性。
在第一方面的一种可能的实现方式中，上述方法还包括：云管理平台给全局VPC分配带宽，其中，经过全局VPC的数据流满足上述带宽的要求。
在第一方面的一种可能的实现方式中，上述方法还包括：云管理平台根据全局VPC的标识给经过全局VPC的数据流打上相应的流标签，然后根据流标签获得上述带宽的要求，之后再根据上述带宽的要求指示上述数据流的转发。
应理解，第一VPC和第二VCP之间的通信需要经过全局VPC，因此，当经过全局VPC的数据流可以满足上述带宽的要求时，第一VPC和第二VPC之间的通信也可以满足上述带宽的要求，从而提高了第一VPC和第二VPC之间通信时的质量。
在第一方面的一种可能的实现方式中，全局VPC的网络前缀是云管理平台申请到的IPv6 前缀，或者是云管理平台生成的IPv6前缀，又或者是租户申请到的IPv6前缀。
第二方面，本申请实施例提供了一种云管理平台，该云管理平台包括确定模块和控制模块。其中，确定模块用于确定租户输入或选择的第一配置信息和第二配置信息；控制模块用于根据第一配置信息创建全局VPC，以及根据第二配置信息通过全局VPC给位于第一区域的第一VPC分配第一网络前缀，给位于第二区域的第二VPC分配第二网络前缀，其中，全局VPC用于根据第一网络前缀和第二网络前缀实现第一VPC和第二VPC之间的跨区域通信。
在第二方面的一种可能的实现方式中，第一网络前缀中的区域标识与第二网络前缀中的区域标识不同。其中，第一网络前缀中的区域标识用于标识第一VPC，第二网络前缀中的区域标识用于标识第二VPC。
在第二方面的一种可能的实现方式中，上述控制模块还用于给全局VPC分配网络前缀，其中，第一网络前缀和第二网络前缀还包括全局VPC的网络前缀。
在第二方面的一种可能的实现方式中，上述装置还包括网络配置模块，该模块用于建立第一VPC和全局VPC之间的网络连接，以及第二VPC和全局VPC之间的网络连接。
在第二方面的一种可能的实现方式中，上述全局VPC存储有第一网络前缀、第二网络前缀以及第一网络前缀和第二网络前缀之间的路由关系。
在第二方面的一种可能的实现方式中，第一VPC不支持与第三VPC通信。
在第二方面的一种可能的实现方式中，上述网络配置模块还用于设置第一VPC的ACL，其中，该ACL包括用于阻断第一VPC与第三VPC之间通信的表项。
在第二方面的一种可能的实现方式中，第一VPC包括第一子网，上述控制模块还用于通过全局VPC给第一子网分配网络前缀，其中，第一子网的网络前缀包括第一网络前缀和子网标识。
在第二方面的一种可能的实现方式中，第一子网包括VM，上述控制模块还用于通过全局VPC或第一VPC给上述VM分配网络前缀，其中，上述VM的网络前缀中的区域标识用于表示该VM支持迁移至全局VPC管辖下的、可与第一VPC通信的VPC。全局VPC管辖下的、可与第一VPC通信的VPC是指：由全局VPC分配网络前缀的、可通过全局VPC与第一VPC通信的VPC。
在第二方面的一种可能的实现方式中，上述VM的网络前缀中的区域标识不同于全局VPC管辖下的任一个VPC的网络前缀中的区域标识。
在第二方面的一种可能的实现方式中，全局VPC管辖下的、可与第一VPC通信的VPC包括第二VPC，上述控制模块还用于将上述VM从第一VPC迁移至第二VPC，其中，迁移后的VM位于第二VPC的第二子网中，第二子网的网络前缀中的子网标识与第一子网的网络前缀中的子网标识相同。
在第二方面的一种可能的实现方式中，迁移后的VM的网络前缀与迁移前的VM的网络前缀相同。
在第二方面的一种可能的实现方式中，上述控制模块还用于给全局VPC分配带宽，其中，经过全局VPC的数据流满足上述带宽的要求。
在第二方面的一种可能的实现方式中，上述控制模块还用于根据全局VPC的标识给经过全局VPC的数据流打上相应的流标签，根据该流标签获得上述带宽的要求，以及根据上述带宽的要求指示上述数据流的转发。
在第二方面的一种可能的实现方式中，全局VPC的网络前缀是云管理平台申请到的IPv6前缀，或者是云管理平台生成的IPv6前缀，又或者是租户申请到的IPv6前缀。
第三方面，本申请实施例提供了一种通信***，该***包括前述第一方面及第一方面的任一种实现方式所描述的云管理平台，还包括全局VPC、位于第一区域的第一VPC以及位于第二区域的第二VPC。
第四方面，本申请实施例提供了一种计算设备，该计算设备包括处理器和存储器，处理器执行存储器中的计算机程序代码以实现前述第一方面及第一方面的任一种实现方式所描述部分或全部方法。
第五方面，本申请实施例提供了一种计算机可读存储介质，该计算机存储介质存储有计算机程序代码，当所述计算机程序代码被计算设备执行时，该计算设备执行前述第一方面及第一方面的任一种实现方式所描述部分或全部方法。
附图说明
图1是本申请实施例提供的一种通信***的结构示意图；
图2是本申请实施例提供的一种云管理平台的部署方式示意图；
图3是本申请实施例提供的一种云管理平台的应用场景示意图；
图4是本申请实施例提供的另一种云管理平台的应用场景示意图；
图5是本申请实施例提供的一种可与云管理平台通信的客户端的部署方式示意图；
图6是本申请实施例提供的一种基于公有云的VPC之间的通信方法的流程示意图；
图7是本申请实施例提供的一种全局VPC的创建界面的示意图；
图8是本申请实施例提供的另一种全局VPC的创建界面的示意图；
图9是本申请实施例提供的一种第一VPC的创建界面的示意图；
图10是本申请实施例提供的一种资源创建界面的示意图；
图11是本申请实施例提供的一种资源的网络前缀的格式示意图；
图12是本申请实施例提供的另一种资源的网络前缀的格式示意图；
图13是本申请实施例提供的一种VM迁移方法的流程示意图；
图14是本申请实施例提供的一种云管理平台的结构示意图；
图15是本申请实施例提供的一种计算设备的结构示意图；
图16是本申请实施例提供的一种计算设备***的示意图。
具体实施方式
为了使本申请实施例提供的方案更清晰，在具体描述本申请实施例提供的方案之前，首先介绍本申请实施例涉及到的相关术语。
VPC是公有云中由租户创建的私密的、隔离的虚拟网络环境，也就是说，不同VPC之间在逻辑上是相互隔离的。VPC支持租户自主配置和管理。例如，租户可以在VPC内创建多个子网，子网是VPC内的IP地址块，可以将VPC的网段分成若干块，子网划分可以帮助租户合理规划IP地址资源。租户还可以在子网中部署资源，包括VM、容器(container)、沙盒(sandbox)等，以为租户提供云服务。又例如，租户还可以在VPC内设置安全组和网络ACL等安全防护策略，其中，安全组能够给VPC内具有相同安全保护需求并相互信任的云服务器、云容器、云数据库等实例提供访问策略，网络ACL通过多个与子网关联的出方向规则和入方向规则控制出入子网的数据流。又例如，租户还可以自定义路由表，以为VPC内数据流的转发提供依据。除此之外，VPC还支持资源的迁移，以VM迁移为例，VM迁移是指将VM从 一台宿主机迁移到另一台宿主机，但是要求在迁移过程中业务不能中断。要实现这一点，应保证VM迁移前后，其网际协议(internet protocol,IP)地址、媒体存取控制(media access control,MAC)地址等参数维持不变。
正因VPC具有的上述功能，越来越多的租户选择将业务所需的资源(包括计算资源、存储资源、网络资源)部署在VPC上。而且，为了提高业务的安全性和及时性，租户还可以选择将业务所需的资源分布式地部署在多个VPC上。
在实际应用中，租户创建的多个VPC之间可能存在互相通信的需求。例如，对于跨国企业来说，其分支机构和业务分布在多个地区，因此这类企业一般会在多个地区部署VPC，并希望这些VPC之间能够通信。又例如，某企业面向的服务人群位于区域A时，该企业会在区域A部署相应的VPC以为上述服务人群提供云服务，当该企业面向的服务人群从区域A迁移至区域B时，为了节省成本，企业希望能够直接将部署在区域A的VPC中的资源迁移到部署在区域B的VPC中。
针对上述问题，本申请实施例提供了一种通信***。图1示例性的展示了上述通信***的结构示意图，如图1所示，通信***100包括云管理平台110、全局VPC(global VPC)120、多个区域VPC(region VPC)130以及多个接入点140，下面简单描述通信***100中的各个部分。
云管理平台110用于确认租户输入或选择的配置信息，也用于根据上述配置信息创建全局VPC 120和多个区域VPC 130。需要说明的是，虽然全局VPC 120和区域VPC 130均是VPC，但二者的功能并不相同。其中，全局VPC 120用于给区域VPC 130以及区域VPC 130中的子网分配网络前缀，不同的区域VPC 130之间可以通过全局VPC 120通信；全局VPC 120还具有网络地址管理功能，能够存储并管理多个区域VPC 130的网络前缀，以及每个区域VPC 130中的子网的网络前缀。区域VPC 130是租户根据业务需求在指定的区域创建的VPC，其中，上述“区域”是指基础资源(包括计算资源、存储资源和网络资源)的集合，例如，云服务提供商建立的数据中心，因此租户可以将业务部署在区域VPC 130，借助区域VPC 130中的基础资源来执行业务。
云管理平台110还用于给全局VPC 120分配网络前缀，以及通过全局VPC 120给多个区域VPC 130分配不同的网络前缀。其中，每个区域VPC 130的网络前缀包括全局VPC 120的网络前缀和区域VPC 130的标识(以下称为区域标识)，不同区域VPC 130的网络前缀中的区域标识不同。如此，可以保证不同区域VPC 130的网络前缀不同，便于不同区域VPC 130之间通信。
可选的，云管理平台110还用于创建多个接入点140，多个接入点140具体可以包括网关(gateway)(如路由器、交换机等)、网关服务(如具有网关功能的虚拟机或服务器)等。多个接入点140用于通过全局VPC 120的网络前缀和多个区域VPC 130的网络前缀，建立全局VPC 120与多个区域VPC 130之间的通信连接，从而实现多个区域VPC 130之间的通信。
可选的，云管理平台110还用于在接入点140上配置ACL，以用于对与接入点140连接的区域VPC 130进行安全防护。在一些实施例中，上述ACL包括至少一个表项，接入点140通过上述至少一个表项控制出入区域VPC 130的数据流。例如，多个区域VPC 130包括第一VPC、第二VPC以及第三VPC，多个接入点140包括第一接入点、第二接入点以及第三接入点，其中，第一VPC通过第一接入点与全局VPC 120连接，第二VPC通过第二接入点与全局VPC 120连接，第三VPC通过第三接入点与全局VPC 120连接，在这种情况下，第一VPC、 第二VPC以及第三VPC便可以通过全局VPC 120实现通信。在实际应用中，租户可能希望第一VPC和第二VPC之间能够通信，而第一VPC和第三VPC之间是相互隔离的，在这种情况下，云管理平台110可以在第一接入点上配置ACL，第一接入点上的ACL包括用于阻断第一VPC和第三VPC之间通信的表项。如此，当第一接入点接收到来自第三VPC的数据流或向第三VPC发送数据流时，第一接入点根据本地ACL即可将上述数据流丢弃，从而阻断了第一VPC和第三VPC之间的通信。类似的，云管理平台110也可以在第三接入点上配置ACL，第三接入点上的ACL包括阻断第一VPC和第三VPC之间通信的表项，那么当第三接入点接收到来自第一VPC的数据流或向第一VPC发送数据流时，第三接入点根据本地ACL即可将上述数据流丢弃，从而也可以阻断第一VPC和第三VPC之间的通信。
可选的，云管理平台110还用于指示全局VPC 120给多个区域VPC 130中的子网分配不同的网络前缀。其中，子网的网络前缀包括所属的区域VPC 130的网络前缀和子网标识，子网标识用于标识该子网，即同一个区域VPC 130中不同子网的网络前缀中的子网标识不同。
可选的，云管理平台110还用于在多个区域VPC 130的子网中部署资源(包括VM、容器、沙盒等)，以及给资源分配网络前缀。其中，资源的网络前缀包括区域标识，资源的网络前缀中的区域标识用于表示该资源是否支持从所属的区域VPC迁移至其他的区域VPC。这样，云管理平台110便可以根据资源的网络前缀确定该资源是否可以从所属的区域VPC迁移至其他的区域VPC。
可选的，云管理平台110还用于给全局VPC 120分配带宽，使得经过全局VPC 120的数据流在上述分配的带宽范围内。如此，可以保证区域VPC 130之间通信时的带宽。
正是由于云管理平台110具备的上述功能，实现了多个区域VPC 130中的不同VPC间的通信，而且，通过该装置还能够实现多个区域VPC 130的网络地址的自动管理，并使得不同VPC中的资源能够根据实际的业务需求相互迁移，除此之外，还能够保证VPC间通信时带宽，以给租户提供更高质量的云服务。
本申请实施例中，云管理平台110具备的上述功能既可以由软件装置实现、也可以由硬件设备实现、还可以由软件装置和硬件设备结合实现。
云管理平台110的部署灵活，它可以部署在云环境中。其中，云环境是云计算模式下利用基础资源向租户提供云服务的实体，云环境包括云数据中心，云数据中心包括云服务提供商拥有的大量基础资源(包括计算资源、存储资源和网络资源)，云数据中心包括的计算资源可以包括大量的计算设备(如服务器)。因此，云管理平台110可以是云数据中心中的一台或多台服务器，也可以是部署在云数据中心中的服务器或虚拟机上的软件装置，该软件装置可以分布式地部署在多台服务器上、或者分布式地部署在多个VM上、或者分布式地部署在服务器和VM上。
如图2所示，云管理平台110由云服务提供商部署在云数据中心，云服务提供商将云管理平台110提供的功能作为云服务提供给租户。在使用云服务时，租户可以在云管理平台110上注册账号，通过账号登录到云管理平台110后，向云管理平台110发送相关的配置信息，之后，云管理平台110便会通过云服务提供点(包括云数据中心中的多个基础资源)向租户提供相应的云服务。
比如说，如图3所示，租户登录云管理平台110后，向云管理平台110发送配置信息，其中，上述配置信息包括部署全局VPC 120和区域VPC 130(包括区域VPC 1至区域VPC 6)的相关信息(如部署区域)。因此，云管理平台110分别在区域0创建全局VPC 120，在区域 1创建区域VPC 1，在区域2创建区域VPC 2，在区域3创建区域VPC 3，在区域4创建区域VPC 4、在区域5创建区域VPC 5，在区域6创建区域VPC 6。其中，区域1、区域2以及区域3是边缘区域，区域4和区域5是中心区域，区域6是资源区域，边缘区域是指距离用户终端较近的、基础资源(包括计算资源、存储资源和网络资源)较少区域，中心区域是指距离用户终端集中的地区(如北京、上海、广州等)较近的、基础资源较丰富的区域，资源区域是指基础资源丰富的区域(如建立有大型数据中心)。云管理平台110还为全局VPC 120分配网络前缀，以及通过全局VPC 120分别为区域VPC 1至区域VPC 6分配不同的网络前缀。上述配置信息还包括区域VPC 1和其他区域VPC之间不通信，为此，云管理平台110在与区域VPC 1连接的接入点上配置ACL，以用于阻断区域VPC 1和其他区域VPC之间的通信。而区域VPC 2至区域VPC 6通过全局VPC 120可以实现彼此间的通信。
进一步地，上述配置信息还包括在区域VPC 1至区域VPC 6中部署子网以及子网中的VM，因此，云管理平台110还在区域VPC 1至区域VPC 6中部署子网以及子网中的VM，并给子网以及子网中的VM分配网络前缀。其中，由于区域VPC 2至区域VPC 6之间可以跨区域通信，因此区域VPC 2至区域VPC 6中的VM可以根据业务需求相互迁移，例如，区域VPC 2中的VM可以迁移至区域VPC 6，也可以迁移至区域VPC 3，区域VPC 4中的VM可以迁移至区域VPC 3，也可以迁移至区域VPC 5，区域VPC 5中的VM可以迁移至区域VPC 6。也就是说，租户的业务可以在边缘区域、中心区域以及资源区域之间迁移，也可以在边缘区域之间、中心区域之间或者资源区域之间迁移。如此，不仅能够提高业务部署的灵活性，还能够提高租户对性能、成本以及容量的需求，例如，当某一区域VPC上的负载过多或容量不够时，云管理平台110可以将运行在该区域VPC上的一部分业务迁移至其他区域VPC；又例如，当租户的业务需求发生变化，即希望创建一个新的区域VPC(区域VPC 7)，并在区域VPC 7上运行区域VPC 2上的业务时，如图4所示，云管理平台110创建区域VPC 7之后，可以直接将运行在区域VPC 2上的业务迁移至区域VPC 7。
除此之外，云管理平台110还可以给全局VPC 120分配带宽，以保证经过全局VPC 120的数据流始终在合适的带宽范围内。应理解，由于区域VPC 2至区域VPC 6之间的通信均需要通过全局VPC 120，因此，通过保证经过全局VPC 120的数据流的带宽可以保证区域VPC间的通信时的带宽，从而降低区域VPC之间的通信(包括资源的迁移)的难度。
在具体实现中，作为一种实施例，云管理平台110向租户提供的云服务可分为两部分：VPC服务和跨区域的VPC通信服务。其中，VPC服务是指租户可在云上部署区域VPC 130(如上述区域VPC 1至区域VPC 6)，这部分服务可以免费提供给租户；跨区域的VPC通信服务是指位于不同区域的区域VPC 130之间的通信服务，这部分服务可以免费提供给租户，也可以是租户购买(可包年或包月，或预先充值再根据最终资源的使用情况进行结算)后再提供给租户。
如图5所示，当云管理平台110设置在云环境中时，可与云管理平台110通信的客户端可以部署在边缘环境中，例如：云服务提供商提供的可与云管理平台110通信的应用程序；也可以部署在终端计算设备上，例如：浏览器，以用于接收租户输入的配置信息；还可以一部分部署在边缘环境中，一部分部署在终端计算设备上。其中，边缘环境是包括距离终端计算设备较近的边缘计算设备集合的环境，边缘计算设备包括边缘服务器、拥有计算力的边缘小站等，终端计算设备包括终端服务器、智能手机、笔记本电脑、平板电脑、个人台式电脑、智能摄像机等。
下面结合图6描述的VPC间的通信方法进一步介绍上述云管理平台110如何实现不同区域VPC 130之间的通信。需要说明的是，为了简便，此处将以多个区域VPC 130中的第一VPC和第二VPC之间的通信为例展开描述。
S101：云管理平台110确定租户输入或选择的配置信息A，根据配置信息A创建全局VPC 120。
具体地，云管理平台110提供用户界面(user interface,UI)或应用程序编程接口(application programming interface,API)，租户通过在上述UI或API上操作(包括输入或选择)来向云管理平台110发送配置信息A。云管理平台110确定配置信息A后，根据配置信息A创建全局VPC 120。
可选的，配置信息A包括全局VPC 120的带宽信息，具体可以包括最大带宽和最小带宽中的至少一个，以保证经过全局VPC 120的数据流满足以下至少一个条件：小于或等于最大带宽，大于或等于最小带宽。除此之外，配置信息A还可以包括全局VPC 120所在的位置、名称等信息。
示例性的，图7展示了一个用于创建全局VPC 120的UI，如图7所示，该界面包括“名称”、“区域”、“带宽”等多个选项。租户根据界面的提示在“名称”选项后填写全局VPC 120的名称，在“区域”选项后选择部署全局VPC 120的地理位置，在“带宽”选项后选择最小带宽和最大带宽。之后，如果租户点击“确认”选项，则云管理平台110即可接收到配置信息A，并根据配置信息A创建出全局VPC 120；如果租户点击“取消”选项，则云管理平台110将不会接收到配置信息A，也不会创建全局VPC 120。
S102：云管理平台110给全局VPC 120分配网络前缀。
其中，全局VPC 120的网络前缀可以是IPv4网络前缀，也可以是IPv6网络前缀。下面将以全局VPC 120的网络前缀是IPv6网络前缀为例，对S102进行描述。具体地，云管理平台110可以通过以下任意一种方式给全局VPC 120分配网络前缀：
方式1、配置信息A还可以包括全局VPC 120的网络前缀，因此全局VPC 120的网络前缀还可以是租户指定的，例如，租户从IPv6地址管理机构申请的全球路由前缀。具体实现中，云管理平台110接收配置信息A后，根据配置信息A获得租户给全局VPC 120指定的网络前缀，并将租户指定的网络前缀作为全局VPC 120的网络前缀。
方式2、云管理平台110从IPv6地址管理机构申请一个全球路由前缀(global routing prefix)，然后将申请到的全球路由前缀作为全局VPC 120的网络前缀。
需要说明的是，一般情况下，租户从IPv6地址管理机构申请的全球路由前缀仅能由该租户使用，而云管理平台110(即云服务提供商)从IPv6地址管理机构申请到的全球路由前缀可以仅提供给一个租户使用，也可以为了节省地址资源，而提供给多个租户使用。当云管理平台110从IPv6地址管理机构申请到的全球路由前缀需要提供给多个租户使用时，为了区分不同租户，云管理平台110可以在全局VPC 120的网络前缀中添加租户标识，具体地，云管理平台110可以通过方式3来给全局VPC 120分配网络前缀。
方式3、云管理平台110从IPv6地址管理机构申请一个全球路由前缀，然后根据申请到的全球路由前缀和租户标识生成全局VPC 120的网络前缀。可选的，全局VPC 120的网络前缀包括全球路由前缀和租户标识。
其中，租户标识可以是租户的ID，或者是云管理平台110给租户设定的编号等能够标识租户的信息，本申请实施例不作限定。
方式4、云管理平台110随机生成一个网络前缀，并将随机生成的网络前缀作为全局VPC  120的网络前缀。
需要说明的是，云管理平台110或者租户从IPv6地址管理机构申请的全球路由前缀一般都可以直接在互联网上路由，而云管理平台110随机生成的网络前缀一般不可以直接在互联网上路由。也就是说，相较于方式1至方式3，如果云管理平台110采用方式4给全局VPC 120分配网络前缀，则当全局VPC 120或者某个区域VPC 130有访问互联网的需求时，还需要额外地部署网络地址转换(network address translation,NAT)网关。因此，在实际应用中，云管理平台110可以根据租户的业务需求选择合适的方式给全局VPC 120分配网络前缀，比如说，当全局VPC 120或者某个区域VPC 130有访问互联网的需求时，云管理平台110可以采用方式1至方式3中的任一种方式给全局VPC 120分配网络前缀，相反地，当全局VPC 120和多个区域VPC 130均没有访问互联网的需求时，云管理平台110可以采用方式4给全局VPC 120分配网络前缀。
在一种可能的实现方式中，云管理平台110提供的用于创建全局VPC 120的UI或API中包括全局VPC 120的网络前缀的配置信息，该配置信息用于指示云管理平台110采用合适的方式来给全局VPC 120分配网络前缀。示例性的，图8展示了另一个用于创建全局VPC的UI，相较于图7示出的界面，图8示出的界面新增了“网络前缀”选项，该选项具有3种配置方式，即“自动配置-可在互连网上路由”、“自动配置-不可在互联网上路由”、“手动配置”。当租户选择“自动配置-可在互连网上路由”选项时，云管理平台110将采用方式2或方式4给全局VPC 120分配网络前缀；当租户选择“自动配置-不可在互联网上路由”选项时，云管理平台110将采用方式4给全局VPC 120分配网络前缀；当租户选择“手动配置”选项时，租户还需在该选项后的方框内填写网络前缀，这样，云管理平台110便可以采用方式1给全局VPC 120分配网络前缀。
应理解，当全局VPC 120的网络前缀是IPv4地址中的网络前缀时，云管理平台110给全局VPC 120分配的网络前缀的方式与上述方式1至方式4类似，为了简便，此处不再展开描述。
S103：云管理平台110确定租户输入或选择的配置信息B，根据配置信息B创建第一VPC。
具体地，租户通过在云管理平台110提供的UI或API上操作(包括输入或选择)来向云管理平台110发送配置信息B，云管理平台110确定配置信息B后，根据配置信息B创建第一VPC。
可选的，配置信息B包括第一VPC所在的位置、名称等信息。示例性的，图9展示了一个用于创建区域VPC 130的UI，如图9所示，该界面包括“名称”、“区域”等多个选项。租户根据界面的提示在“名称”选项后填写第一VPC的名称，在“区域”选项后选择部署第一VPC的地理位置。应理解，在实际应用中，租户可以根据业务需求选择合适的区域来部署第一VPC，如此可以降低网络时延、提高访问速度，从而提高云服务质量。之后，如果租户点击“确认”选项，则云管理平台110即可接收到配置信息B，并根据配置信息B创建出第一VPC；如果租户点击“取消”选项，则云管理平台110可以返回上一级菜单(如图7或图8示出的用于创建全局VPC 120的UI)，这样云管理平台110将不会接收到配置信息B，也不会创建第一VPC。
S104：云管理平台110通过全局VPC 120给第一VPC分配网络前缀。
其中，第一VPC的网络前缀包括全局VPC120的网络前缀和第一VPC的标识(以下简称为第一区域标识)。第一区域标识可以是第一VPC在多个区域VPC 130中的编号，或者是第一VPC的ID，又或者是第一VPC所在的地理位置的标识等能够标识第一VPC的信息，本 申请实施例不作限定。
具体地，云管理平台110创建好第一VPC后，生成第一区域标识。之后，云管理平台110向全局VPC 120发送第一配置命令，其中，第一配置命令包括第一区域标识。全局VPC 120接收到上述第一配置命令后，根据第一配置命令获得第一区域标识，然后根据第一区域标识和全局VPC 120的网络前缀生成第一VPC的网络前缀。最后，云管理平台110从全局VPC 120中获取第一VPC的网络前缀，并将获取到的网络前缀分配给第一VPC。
可选的，第一VPC的网络前缀还包括前文所述的租户标识，上述第一配置命令也可以包括上述租户标识。
可选的，全局VPC 120生成第一VPC的网络前缀之后，存储第一VPC的网络前缀。
S105：云管理平台110根据全局VPC 120的网络前缀和第一VPC的网络前缀，建立全局VPC 120和第一VPC之间的网络连接。
具体地，云管理平台110创建第一接入点，其中，第一接入点可以是网关(如路由器、交换机等)，或者是网关服务(如具有网关功能的虚拟机或服务器)。之后，云管理平台110在第一接入点上配置全局VPC 120的网络前缀和第一VPC的网络前缀之间的路由关系，这样，全局VPC 120和第一VPC便可以根据第一接入点实现网络连接。
考虑实际应用中，为了保护第一VPC上的业务数据的安全性，部署在第一VPC上的业务需要与第三VPC上的业务相互隔离的，或者部署在第一VPC上的业务不支持被部署第三VPC中的某个或某些业务访问。因此，可选的，云管理平台110还可以执行以下步骤：在第一接入点上配置ACL，其中，ACL包括以下至少一条表项：拒绝来自第三VPC中的一个或多个业务的数据流、拒绝放通向第三VPC中的一个或多个业务发送的数据流。上述“拒绝来自第三VPC中的一个或多个业务的数据流”表项用于指示第一接入点在接收到来自上述第三VPC中的一个或多个业务的数据流时，将其丢弃，如此，部署第一VPC上的业务便不会被上述来自第三VPC中的一个或多个业务访问；上述“拒绝放通向第三VPC中的一个或多个业务发送的数据流”表项用于指示第一接入点在接收到第一VPC向上述第三VPC中的一个或多个业务发送的数据流时，将其丢弃，如此，第一VPC中的业务便无法访问第三VPC中的某个或某些业务。
应理解，当第一接入点上的ACL包括拒绝来自第三VPC中的所有业务的数据流，以及拒绝放通向第三VPC中的所有业务发送的数据流时，第一VPC与第三VPC相互隔离，即彼此之间不能通信。
S106：云管理平台110通过全局VPC 120给第一VPC中的子网分配网络前缀。
其中，第一VPC包括至少一个子网，第一VPC中子网的数量可以是租户预设的，例如，配置信息B包括需要在第一VPC部署的子网的数量；第一VPC中子网的数量也可以是云管理平台110根据实际情况动态调整的；第一VPC中子网的数量还可以是云服务提供商预先设定的(如256个)，本申请实施例不作限定。每个子网的网络前缀包括第一VPC的网络前缀和子网标识，子网标识可以是云管理平台110或租户给子网设定的编号、或者是子网ID等能够标识子网的信息。可选的，每个子网的网络前缀还可以包括前文所述的租户标识。
在一些实施例中，以第一VPC中的一个子网(第一子网)为例，云管理平台110通过全局VPC 120给第一VPC中的子网分配网络前缀，包括：云管理平台110向全局VPC 120发送第二配置指令，其中，第二配置命令包括第一子网的标识(以下简称为第一子网标识)。全局VPC 120接收到上述第二配置命令后，根据第二配置命令获得第一子网标识，然后根据第一子网标识和本地存储的第一VPC的网络前缀生成第一子网的网络前缀。最后，云管理平台 110从全局VPC 120中获取第一子网的网络前缀，并将获取到的网络前缀分配给第一子网。
可选的，全局VPC 120生成第一VPC中的子网的网络前缀之后，存储第一VPC中的子网的网络前缀。
S107：云管理平台110确定租户输入或选择的配置信息C，根据配置信息C在第一VPC内创建资源，并给资源分配网络前缀。
其中，云管理平台110在第一VPC内创建的资源可以包括VM、容器、沙盒等多种类型。配置信息C包括资源的部署位置，即将资源部署在第一VPC中的哪个子网中，进一步地，资源的部署位置还可以具体到子网中哪个的宿主机上。配置信息C还包括资源迁移属性的表征信息，该信息用于表示资源是否支持从第一VPC迁移至全局VPC 120管辖下的、可与第一VPC通信的VPC，其中，全局VPC 120管辖下的VPC是指：由全局VPC 120分配网络前缀的VPC，包括上述多个区域VPC 130，全局VPC 120管辖下的、可与第一VPC通信的VPC是指：由全局VPC 120分配网络前缀的、能够通过全局VPC 120与第一VPC通信的VPC，例如第二VPC。除此之外，配置信息C还可以包括资源的类型(如VM、容器、沙盒)、资源的内存大小、资源的操作***等。
资源的网络前缀包括全局VPC 120的网络前缀、区域标识以及子网标识，可选的，资源的网络前缀还可以包括前文所述租户标识。其中，资源的网络前缀中的区域标识与上述S104所描述的第一VPC的网络前缀中的区域标识，以及上述S106所描述的第一VPC中的子网的网络前缀中的区域标识的作用不同，资源的网络前缀中的区域标识用于表示资源是否支持从第一VPC迁移至全局VPC 120管辖下的、可与第一VPC通信的VPC。资源的网络前缀中的子网标识用于标识部署有该资源的子网，即资源的网络前缀中的子网标识与部署有该资源的子网的网络前缀中的子网标识相同。
可选的，资源迁移属性的表征信息包括资源的网络前缀中的区域标识。具体地，当资源支持从第一VPC迁移至全局VPC 120管辖下的、可与第一VPC通信的VPC时，资源的网络前缀中的区域标识不同于全局VPC 120管辖下的任一个VPC的网络前缀中的区域标识，例如，假设多个区域VPC 130的网络前缀中的区域标识分别是1至N(N是大于0的正整数)，那么，资源的网络前缀中的区域标识可以是不同于1至N中的任意一个数字(如0)；当资源不支持从第一VPC迁移至全局VPC 120管辖下的、可与第一VPC通信的VPC时，资源的网络前缀中的区域标识可以是第一区域标识。应理解，除区域标识外，资源迁移属性的表征信息还可以包括其他类型的信息，例如，图8所示的“跨VPC迁移”和“不跨VPC迁移”选项。
在一些实施例中，租户可以通过在云管理平台110提供的UI或API上操作(包括输入或选择)来向云管理平台110发送配置信息C。图10示例性地展示了一个用于创建资源的UI，如图10所示，该界面包括“名称”、“网络前缀”等多个选项。租户可以在“名称”选项后的填写框中输入资源的名称。“网络前缀”选项具有2种配置方式，即“手动配置”和“自动配置”，当租户选择“手动配置”时，租户可以在相应的地址栏内输入区域标识和子网标识，其中，租户可以根据业务需求选择合适的区域标识，例如，当该VM需要从第一VPC迁移至其他VPC时，租户可以选择区域标识为0，当该VM仅需要在第一VPC内迁移，租户可以选择区域标识为第一区域标识。租户还可以根据业务需求选择合适的子网标识，即需要部署上述VM的子网的标识。当租户选择“自动配置”时，租户需要在“部署位置”选项后的选择框中选择出需要部署上述VM的子网的标识，另外，如果VM需要从第一VPC迁移至其他VPC，则租户可以勾选“跨VPC迁移”选项，如果VM不需要从第一VPC迁移至其他VPC，则租户可以勾选“不跨VPC迁移”选项。之后，如果租户点击“确认”选项，则云管理平台 110即可接收到配置信息C；如果租户点击“取消”选项，则云管理平台110可以返回上一级菜单(如图9示出的用于创建第一VPC的UI)，这样云管理平台110将不会接收到配置信息C。
在一些实施例中，云管理平台110给上述创建好的资源分配网络前缀，包括：云管理平台110基于租户输入的配置信息C，获得资源的部署位置以及资源迁移属性的表征信息。当资源迁移属性的表征信息表示该资源支持从第一VPC迁移至全局VPC 120管辖下的、可与第一VPC通信的VPC时，云管理平台110通过全局VPC 120给资源分配网络前缀；当资源迁移属性的表征信息表示该资源不支持从第一VPC迁移至全局VPC 120管辖下的、可与第一VPC通信的VPC时，云管理平台110通过第一VPC给资源分配网络前缀。
进一步地，云管理平台110通过全局VPC 120给资源分配网络前缀，具体过程是：云管理平台110向全局VPC 120发送第三配置指令，其中，第三配置命令包括上述资源的部署位置。全局VPC 120接收到上述第三配置命令后，基于第三配置命令确定资源的网络前缀中的子网标识，并生成一个不同于全局VPC 120管辖下的任一个VPC的网络前缀中的区域标识，再结合本地存储的全局VPC的网络前缀生成资源的网络前缀。最后，云管理平台110从全局VPC 120中获取资源的网络前缀，并将获取到的网络前缀分配给上述资源。
云管理平台110通过第一VPC给资源分配网络前缀，具体过程是：云管理平台110向第一VPC发送第三配置指令，其中，第三配置命令包括上述资源的部署位置。第一VPC接收到上述第三配置命令后，基于第三配置命令确定资源的网络前缀中的子网标识，再结合本地存储的第一VPC的网络前缀生成资源的网络前缀。最后，云管理平台110从第一VPC中获取资源的网络前缀，并将获取到的网络前缀分配给上述资源。
在另一些实施例中，云管理平台110给上述创建好的资源分配网络前缀，包括：云管理平台110通过全局VPC 120给上述资源分配网络前缀。具体地，云管理平台110基于租户输入的配置信息C，获得资源的部署位置以及资源迁移属性的表征信息，然后向全局VPC 120发送第三配置指令，其中，第三配置命令包括上述资源的部署位置和资源迁移属性的表征信息。全局VPC 120接收到上述第三配置命令后，基于资源的部署位置确定资源的网络前缀中的子网标识，基于资源迁移属性的表征信息确定资源是否支持从第一VPC迁移至全局VPC 120管辖下的、可与第一VPC通信的VPC，当资源迁移属性的表征信息表示该资源支持从第一VPC迁移至全局VPC 120管辖下的、可与第一VPC通信的VPC时，全局VPC 120生成一个不同于全局VPC 120管辖下的任一个VPC的网络前缀中的区域标识；当资源迁移属性的表征信息表示该资源不支持从第一VPC迁移至全局VPC 120管辖下的、可与第一VPC通信的VPC时，全局VPC 120确定第一区域标识。之后，全局VPC 120基于本地存储的全局VPC的网络前缀以及上述经过确定得到的子网标识和区域标识，生成资源的网络前缀。最后，云管理平台110从全局VPC 120中获取资源的网络前缀，并将获取到的网络前缀分配给上述资源。
S108：云管理平台110将资源的网络前缀发送至部署有该资源的宿主机。
S109：上述宿主机接收到资源的网络前缀后，根据资源的网络前缀生成资源的IP地址。
其中，资源的IP地址可以是IPv4地址，也可以是IPv6地址。下面以资源的IP地址是IPv6地址为例，对上述宿主机根据资源的网络前缀生成资源的IP地址的过程进行描述：
首先，需要说明的是，IPv6地址的长度是128位(bit)，IPv6地址包括两个部分：一部分是网络前缀，另一部分是接口标识(interface ID)，这两个部分的长度均是64比特。因此，当资源的IP地址是IPv6地址时，该地址由64位的网络前缀和64位接口标识组成，其中， 该地址中的网络前缀包括云管理平台110给资源分配的网络前缀，该地址中的接口标识包括宿主机接口的MAC地址。值得注意的一点是：部署在宿主机中的不同资源对应宿主机的不同接口，换言之，部署在同一宿主机中的不同资源的IPv6地址中的接口标识不同。那么，上述宿主机根据资源的网络前缀生成资源的IP地址，包括：上述宿主机根据该资源对应的接口的MAC地址生成接口标识，然后根据资源的网络前缀以及上述接口标识生成资源的IP地址(即IPv6地址)。
在一些实施例中，云管理平台110给资源分配的网络前缀(即资源的网络前缀)是64位。由前文可知，资源的网络前缀可以包括全局VPC 120的网络前缀、区域标识、子网标识，还可以包括租户标识。因此，资源的网络前缀具有多种格式，图11-图12分别示出了不同格式的资源的网络前缀。
如图11所示，资源的网络前缀包括全局VPC 120的网络前缀、区域标识以及子网标识，其中，全局VPC 120的网络前缀是48位，区域标识是8位，子网标识是8位。
如图12所示，资源的网络前缀包括全局VPC 120的网络前缀、区域标识、租户标识以及子网标识，其中，全局VPC 120的网络前缀是32位，区域标识是8位，租户标识是16位，子网标识是8位。
需要说明的是，一般情况下，租户从IPv6地址管理机构申请的全球路由前缀是48位，而云管理平台110从IPv6地址管理机构申请全球路由前缀时，可以与IPv6地址管理机构进行协商，从而可以申请到不同长度(如20位、32位、48位)的全球路由前缀。因此，图11所示的48位的全局VPC 120的网络前缀可以是租户从IPv6地址管理机构申请的、或者是云管理平台110从IPv6地址管理机构申请的、又或者包括云管理平台110从IPv6地址管理机构申请到的全球路由前缀和租户标识、又或者是云管理平台110随机生成的。图12所示的32位的全局VPC 120的网络前缀可以是云管理平台110从IPv6地址管理机构申请的。
还需要说明的是，资源的网络前缀中的各个部分(包括全局VPC 120的网络前缀、区域标识、子网标识、租户标识)的长度可以灵活设置，而且各个部分的位置也可以灵活调整，例如，租户标识可以位于区别标识之前，本申请实施例不作限定。在实际应用中，云管理平台110可以根据租户输入的配置信息(包括配置信息A、配置信息B和配置信息C)给资源分配合适的网络前缀。
应理解，当资源的IP地址是IPv4地址时，其生成过程与上述资源的IPv6地址的生成过程类似，而且，资源的IPv4地址也具有多种格式，可以通过类比资源的IPv6地址得到，因此为了简便，本申请实施例不再展开描述。
通过上述S101-S109即可实现第一VPC以及第一VPC中的资源的创建，类似的，云管理平台110还可以创建出第二VPC以及第二VPC中的资源，其具体过程可参见S101-S109，为了简便，此处不再展开描述。
S110：全局VPC 120根据第一网络前缀和第二网络前缀实现第一VPC和第二VPC之间的跨区域通信。
应理解，由于第一VPC和全局VPC之间通过第一接入点建立有网络连接(上述S105)，第二VPC和全局VPC之间通过第二接入点建立有网络连接，而且第一VPC的网络前缀和第二VPC的网络前缀不同，因此，第一VPC和第二VPC可以通过全局VPC 120实现通信。
在一些实施例中，全局VPC 120存储有第一VPC的网络前缀和第二VPC的网络前缀之间的路由关系，例如：全局VPC 120存储有第一路由表项和第二路由表项中的至少一个，其中，第一路由表项中的源地址是第一VPC的网络前缀，目的地址是第二VPC的网络前缀； 第二路由表项中的源地址是第二VPC的网络前缀，目的地址是第一VPC的网络前缀。那么，以第一VPC向第二VPC发送数据流(如数据流A)为例，全局VPC 120根据第一网络前缀和第二网络前缀实现第一VPC和第二VPC之间的跨区域通信，包括：全局VPC 120接收第一VPC通过第一接入点发送的数据流A，然后根据第一路由表项将该数据流A通过第二接入点发送至第二VPC，即数据流A的转发路径是第一VPC→第一接入点→全局VPC 120→第二接入点→第二VPC。
为了提高第一VPC和第二VPC之间通信时的质量，可选的，云管理平台110还执行以下步骤：给全局VPC 120分配带宽，使得经过全局VPC 120的数据流满足上述带宽的要求。其中，上述带宽可以是租户预设的，例如，配置信息A包括带宽信息，那么，云管理平台110可以根据配置信息A给全局VPC 120分配带宽。上述带宽也可以是云管理平台110根据实际情况动态地调整的，例如，云管理平台110根据全局VPC 120的负载情况，以及当前的网络状态调整上述带宽。
进一步地，云管理平台110可以通过以下方式使得经过全局VPC 120的数据流满足上述带宽的要求：云管理平台110维护一张映射表，该映射表包括至少一个VPC标识、至少一个流标签以及至少一个VPC标识和至少一个流标签之间的对应关系，其中，至少一个VPC标识包括全局VPC 120的标识，至少一个流标签包括全局VPC 120的标识对应的流标签(以下称为目标流标签)，除此之外，由于云管理平台110可以根据租户的需求创建出多个全局VPC，因此，上述至少一个VPC标识还可以包括其他全局VPC的标识，对应的，上述至少一个流标签还包括其他全局VPC的标识对应的流标签。全局VPC 120的标识可以是租户预设的，也可以是云管理平台110设定的，当租户仅创建了一个全局VPC 120时，全局VPC 120的标识可以是租户标识，当租户创建了多个全局VPC 120时，全局VPC 120的标识可以是全局VPC 120的ID、或者是全局VPC 120的编号等能够标识全局VPC 120的信息。目标流标签用于标识经过全局VPC 120的数据流。具体实现中，云管理平台110给全局VPC 120分配标识，然后根据全局VPC 120的标识给经过全局VPC 120的数据流打上相应的流标签，然后根据上述流标签获得上述带宽的要求，最后根据上述带宽的要求来指示上述数据流的转发。
举例说明，假设第一VPC通过全局VPC 120向第二VPC发送数据流A，当全局VPC 120接收到数据流A时，云管理平台110根据上述映射表确定目标流标签，然后使用目标流标签对数据流A进行封装(例如，将目标流标签添加在数据流A的IPv6头部中的flow label字段中，或者将目标流标签添加在数据流A的IPv4头部中的自定义字段中)，之后，再指示全局VPC 120将封装后的数据流A发送至第二VPC。通过上述操作，底层(underlay)网络在转发数据流A时，可以获得目标流标签，从而确定云管理平台110给全局VPC 120分配的带宽，然后，根据上述带宽的要求配置用于转发数据流A的服务质量(quality of service,QoS)队列，从而完成数据流A的转发。这样，就可以保证数据流A的带宽，从而保证第一VPC与第二VPC之间的通信的质量。
基于本申请实施例提供的上述方法，除了能够实现第一VPC和第二VPC之间的通信，还能够实现第一VPC与第二VPC中的资源按需迁移。下面以第一VPC中的VM向第二VPC中迁移为例，结合图13对上述迁移过程进行描述。
S201：第一VPC内的VM向云管理平台110发送迁移请求。
其中，当前VM位于第一宿主机上，第一宿主机位于第一VPC中的第一子网上，迁移请求包括VM的IP地址、VM的MAC地址以及第一宿主机的IP地址。
S202：云管理平台110根据上述迁移请求判断VM是否支持从第一VPC迁移至第二VPC。如果VM支持从第一VPC迁移至第二VPC，则执行S203-S205，如果VM不支持从第一VPC迁移至第二VPC，则云管理平台110不执行将VM从第一VPC迁移至第二VPC的相关操作。
具体地，云管理平台110根据上述迁移请求获得VM的IP地址中的区域标识，然后根据VM的IP地址中的区域标识判断VM是否支持从第一VPC迁移至第二VPC。其中，如果VM的IP地址中的区域标识不同于任意一个区域VPC 130的网络前缀中的区域标识，则云管理平台110确定该VM支持从第一VPC迁移至第二VPC；如果VM的IP地址中的区域标识与第一区域标识相同，则云管理平台110确定该VM不支持从第一VPC迁移至第二VPC。
S203：云管理平台110根据上述迁移请求确定第二宿主机。
具体地，云管理平台110根据上述迁移请求获得VM的IP地址中的子网标识，然后根据VM的IP地址中的子网标识确定第二子网，从而确定第二宿主机。其中，第二宿主机位于第二子网上，第二子网是第二VPC中的一个网段，第二子网的网络前缀中的子网标识与第一子网的网络前缀中的子网标识相同。
S204：云管理平台110建立第一宿主机和第二宿主机之间的网络连接。
具体地，云管理平台110根据上述迁移请求获得第一宿主机的IP地址，然后根据第一宿主机的IP地址和第二宿主机的IP地址建立第一宿主机和第二宿主机之间的网络连接。
S205：云管理平台110将VM从第一宿主机迁移至第二宿主机。
具体地，第一宿主机和第二宿主机之间的网络连接建立之后，云管理平台110向第一宿主机发送迁移指令，第一宿主机接收到上述迁移指令后，先将VM的配置(如操作***)、设备信息(如内存大小)发送至第二宿主机，再将VM的内存(如VM的初始内存、内存变更分片)同步至第二宿主机。然后，在第一宿主机上暂停VM，再将最后的内存变更分片传送至第二宿主机。最后，在第一宿主机上停止VM，并在第二宿主机上恢复VM，从而完成VM的迁移。
值得注意的是，在VM迁移过程中，可能存在其他VM(如部署在第一VPC或其他VPC上的VM)访问该VM，在这种情况下，云管理平台110需要将来自其他VM的数据流发送至第一宿主机。在VM迁移完成后，如果存在其他VM访问该VM，这时，云管理平台110需要将来自其他VM的数据流发送至第二宿主机。
前文中结合图6-图13描述的方法，详细描述了云管理平台110的功能，下面结合图14-图16，从云管理平台110的结构方面，更详细地描述云管理平台110。
图14示例性地展示了云管理平台110的结构示意图。如图14所示，云管理平台110包括确定模块111、控制模块112以及网络配置模块113。其中，确定模块111、控制模块112以及网络配置模块113协同工作，以实现上述方法实施例中云管理平台110执行的步骤。具体地，确定模块111用于执行上述S101中确定租户输入或选择的配置信息A的步骤，上述S103中确定租户输入或选择的配置信息B的步骤，以及上述S107中确定租户输入或选择的配置信息C的步骤，确定模块111还用于将上述配置信息A、配置信息B以及配置信息C发送至控制模块112。控制模块112用于执行上述S101中根据配置信息A创建全局VPC 120的步骤、上述S103中根据配置信息B创建第一VPC的步骤、上述S107中根据配置信息C在第一VPC内创建资源，并给资源分配网络前缀的步骤，控制模块112还用于执行上述S102-S104、S106、S108以及S110。网络配置模块113用于执行上述S105。
可选的，确定模块111还用于接收VM发送的迁移请求，并将上述迁移请求发送至控制 模块112；控制模块112还用于执行上述S202-S205。
可选的，控制模块112还用于执行保证第一VPC和第二VPC通信时的带宽的相关步骤，例如，给全局VPC 120分配带宽，给经过全局VPC 120的数据量打上流标签等。
应理解，图14所示的结构示意图仅仅是根据功能对云管理平台110进行划分的一种示例性的结构划分方式，本申请实施例并不对云管理平台110的结构的具体划分方式进行限定，本领域技术人员根据本申请方法实施例记载的方案，可以将云管理平台110的内部功能进行合理划分，从而使得云管理平台110的内部功能模块可以实现方法实施例中云管理平台110作为执行主体的各个步骤。还应理解，云管理平台110内部的各个模块可以是软件模块，也可以是硬件模块，也可以部分是软件模块部分是硬件模块。
图15示出了本申请实施例提供的一种计算设备的结构示意图，上述云管理平台110可以部署在该计算设备上，该计算设备可以是云环境中的计算设备(例如，服务器)，或边缘环境中的计算设备，或终端计算设备。如图15所示，计算设备200包括存储器210、处理器220、通信接口230以及总线240，其中，存储器210、处理器220、通信接口230通过总线240实现彼此之间的通信连接。
存储器210可以包括只读存储器(read only memory,ROM)、静态存储设备、动态存储设备或者随机存取存储器(random access memory,RAM)、硬盘等。存储器210可以存储程序，例如，确定模块111中的程序、控制模块112中的程序以及网络配置模块113中的程序等。当存储器210中存储的程序代码被处理器220执行时，处理器220和通信接口230用于执行云管理平台110所执行的方法(包括上述S101-S110、S201-S205所描述的方法、以及保证第一VPC和第二VPC通信时的带宽的相关步骤)。存储器210还可以存储数据，例如：处理器220在执行过程中产生的中间数据或结果数据，例如，全局VPC 120的网络前缀、ACL等。
处理器220可以采用中央处理器(central processing unit,CPU)、专用集成电路(application specificintegrated circuit,ASIC)、图形处理器(graphics processing unit,GPU)或者一个或多个集成电路。
处理器220还可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，云管理平台110的部分功能可以通过处理器220中的硬件的集成逻辑电路或者软件形式的指令完成。处理器220还可以是通用处理器、数据信号处理器(digital signal process,DSP)、现场可编程逻辑门阵列(field programmable gate array,FPGA)或者其他可编程逻辑器件，分立门或者晶体管逻辑器件，分立硬件组件，可以实现或者执行本申请实施例中公开的方法、步骤及逻辑框图。其中，通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等，结合本申请实施例所公开的方法可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器、闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器210，处理器220读取存储器210中的信息，结合其硬件完成云管理平台110的部分或全部功能。
通信接口230使用例如但不限于收发器一类的收发模块，来实现计算设备200与其他设备或通信网络之间的通信。示例性的，通过通信接口230接收租户发送的配置信息(包括配置信息A、配置信息B和配置信息C)。
总线240可以包括在计算设备200中的各个部件(例如，存储器210、处理器220以及通信接口230)之间传送信息的通路。
图16示出本申请实施例提供的一种计算设备***的结构示意图，该计算设备***包括多个计算设备，上述云管理平台110可以分布式地部署在该计算设备***中的多个计算设备上。如图16所示，计算设备***300包括多个计算设备400，每个计算设备400包括存储器410、处理器420、通信接口430以及总线440，其中，存储器410、处理器420、通信接口430通过总线440实现彼此之间的通信连接。
存储器410可以包括ROM、RAM、静态存储设备、动态存储设备、硬盘(例如SSD、HDD)等。存储器410可以存储程序代码，例如，确定模块111中的一部分程序、控制模块112中的一部分程序以及网络配置模块113中的一部分程序等。当存储器410中存储的程序代码被处理器420执行时，处理器420和通信接口430用于执行云管理平台110所执行的部分方法(包括上述S101-S110、S201-S205所描述的部分方法，以及保证第一VPC和第二VPC通信时的带宽的相关步骤)。存储器410还可以存储数据，例如：处理器420在执行过程中产生的中间数据或结果数据，例如，全局VPC 120的网络前缀、ACL等。
处理器420可以采用CPU、GPU、ASIC或者一个或多个集成电路。处理器420还可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，云管理平台110的部分功能可用通过处理器420中的硬件的集成逻辑电路或者软件形式的指令完成。处理器420还可以是DSP、FPGA、通用处理器、其他可编程逻辑器件，分立门或者晶体管逻辑器件、分立硬件组件，可以实现或者执行本申请实施例中公开的部分方法、步骤及逻辑框图。其中，通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等，结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器、闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器410，处理器420读取存储器410中的信息，结合其硬件完成云管理平台110的部分功能。
通信接口430使用例如但不限于收发器一类的收发模块，来实现计算设备400与其他计算设备或通信网络之间的通信。例如，通过通信接口430接收租户发送的配置信息(包括配置信息A、配置信息B和配置信息C)。
总线440可以包括在计算设备400中的各个部件(例如，存储器410、处理器420以及通信接口430)之间传送信息的通路。
上述多个计算设备400之间通过通信网络建立通信通路，以实现云管理平台110的功能。任一计算设备可以是云环境中的计算设备(例如，服务器)，或边缘环境中的计算设备，或终端计算设备。
上述各个附图对应的流程的描述各有侧重，某个流程中没有详细描述的部分，可以参见其他流程的相关描述。
在上述实施例中，可以全部或部分地通过软件、硬件或者其组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。该计算机程序产品可包括一个或多个云管理平台110执行的计算指令，在计算机上加载和执行这些计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。
上述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。上述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，上述计算机指令可以从一个网站站点、计算机、服务器或数 据中心通过有线(例如，同轴电缆、光纤、双绞线或无线(例如，红外、无线、微波)等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。上述计算机可读存储介质存储有提供云管理平台110执行的计算机程序指令。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个介质集成的服务器、数据中心等数据存储设备。上述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，光盘)、或者半导体介质(例如，固态硬盘(solid state disk,SSD))。

Claims (37)

  1. 一种基于公有云的虚拟私有云VPC之间的通信方法，其特征在于，包括：
    云管理平台确定租户输入或选择的第一配置信息，根据所述第一配置信息创建全局VPC；
    所述云管理平台确定所述租户输入或选择的第二配置信息，根据所述第二配置信息通过所述全局VPC给位于第一区域的第一VPC分配第一网络前缀，通过所述全局VPC给位于第二区域的第二VPC分配第二网络前缀，其中，所述全局VPC用于根据所述第一网络前缀和所述第二网络前缀实现所述第一VPC和所述第二VPC之间的跨区域通信。
  2. 根据权利要求1所述的方法，其特征在于，所述第一网络前缀中的区域标识与所述第二网络前缀中的区域标识不同。
  3. 根据权利要求2所述的方法，其特征在于，还包括：
    所述云管理平台给所述全局VPC分配网络前缀，其中，所述第一网络前缀和所述第二网络前缀还包括所述全局VPC的网络前缀。
  4. 根据权利要求3所述的方法，其特征在于，还包括：
    所述云管理平台建立所述第一VPC和所述全局VPC之间的网络连接，以及所述第二VPC和所述全局VPC之间的网络连接。
  5. 根据权利要求4所述的方法，其特征在于，所述全局VPC存储有所述第一网络前缀、所述第二网络前缀以及所述第一网络前缀和所述第二网络前缀之间的路由关系。
  6. 根据权利要求1-5任一项所述的方法，其特征在于，所述第一VPC不支持与第三VPC通信。
  7. 根据权利要求6所述的方法，其特征在于，还包括：
    所述云管理平台设置所述第一VPC的访问控制列表ACL，其中，所述ACL包括用于阻断所述第一VPC与所述第三VPC之间通信的表项。
  8. 根据权利要求1-7任一项所述的方法，其特征在于，所述第一VPC包括第一子网，所述方法还包括：
    所述云管理平台通过所述全局VPC给所述第一子网分配网络前缀，其中，所述第一子网的网络前缀包括所述第一网络前缀和子网标识。
  9. 根据权利要求8所述的方法，其特征在于，所述第一子网包括虚拟机VM，所述方法还包括：
    所述云管理平台通过所述全局VPC或所述第一VPC给所述VM分配网络前缀，其中，所述VM的网络前缀中的区域标识用于表示所述VM支持迁移至所述全局VPC管辖下的、可与所述第一VPC通信的VPC。
  10. 根据权利要求9所述的方法，其特征在于，所述VM的网络前缀中的区域标识不同于所述全局VPC管辖下的任一个VPC的网络前缀中的区域标识。
  11. 根据权利要求10所述的方法，其特征在于，所述全局VPC管辖下的、可与所述第一VPC通信的VPC包括所述第二VPC，所述方法还包括：
    所述云管理平台将所述VM从所述第一VPC迁移至所述第二VPC，其中，所述迁移后的VM位于所述第二VPC的第二子网中，所述第二子网的网络前缀中的子网标识与所述第一子网的网络前缀中的子网标识相同。
  12. 根据权利要求11所述的方法，其特征在于，所述迁移后的VM的网络前缀与所述迁 移前的VM的网络前缀相同。
  13. 根据权利要求1-12任一项所述的方法，其特征在于，还包括：
    所述云管理平台给所述全局VPC分配带宽，其中，经过所述全局VPC的数据流满足所述带宽的要求。
  14. 根据权利要求13所述的方法，其特征在于，还包括：
    所述云管理平台根据所述全局VPC的标识给所述经过所述全局VPC的数据流打上相应的流标签；
    所述云管理平台根据所述流标签获得所述带宽的要求，并根据所述带宽的要求指示所述数据流的转发。
  15. 根据权利要求3-14任一项所述的方法，其特征在于，所述全局VPC的网络前缀是所述云管理平台申请到的第六版网际协议IPv6前缀。
  16. 根据权利要求3-14任一项所述的方法，其特征在于，所述全局VPC的网络前缀是所述云管理平台生成的IPv6前缀。
  17. 根据权利要求3-14任一项所述的方法，其特征在于，所述全局VPC的网络前缀是所述租户申请到的IPv6前缀。
  18. 一种云管理平台，其特征在于，包括：
    确定模块，用于确定租户输入或选择的第一配置信息和第二配置信息；
    控制模块，用于根据所述第一配置信息创建全局虚拟私有云VPC，以及根据所述第二配置信息通过所述全局VPC给位于第一区域的第一VPC分配第一网络前缀，通过所述全局VPC给位于第二区域的第二VPC分配第二网络前缀，其中，所述全局VPC用于根据所述第一网络前缀和所述第二网络前缀实现所述第一VPC和所述第二VPC之间的跨区域通信。
  19. 根据权利要求18所述的云管理平台，其特征在于，所述第一网络前缀中的区域标识与所述第二网络前缀中的区域标识不同。
  20. 根据权利要求19所述的云管理平台，其特征在于，
    所述控制模块，还用于给所述全局VPC分配网络前缀，其中，所述第一网络前缀和所述第二网络前缀还包括所述全局VPC的网络前缀。
  21. 根据权利要求20所述的云管理平台，其特征在于，还包括：
    网络配置模块，用于建立所述第一VPC和所述全局VPC之间的网络连接，以及所述第二VPC和所述全局VPC之间的网络连接。
  22. 根据权利要求21所述的云管理平台，其特征在于，所述全局VPC存储有所述第一网络前缀、所述第二网络前缀以及所述第一网络前缀和所述第二网络前缀之间的路由关系。
  23. 根据权利要求18-22任一项所述的云管理平台，其特征在于，所述第一VPC不支持与第三VPC通信。
  24. 根据权利要求23所述的云管理平台，其特征在于，
    所述网络配置模块，还用于设置所述第一VPC的访问控制列表ACL，其中，所述ACL包括用于阻断所述第一VPC与所述第三VPC之间通信的表项。
  25. 根据权利要求18-24任一项所述的云管理平台，其特征在于，所述第一VPC包括第一子网，
    所述控制模块，还用于通过所述全局VPC给所述第一子网分配网络前缀，其中，所述第一子网的网络前缀包括所述第一网络前缀和子网标识。
  26. 根据权利要求25所述的云管理平台，其特征在于，所述第一子网包括虚拟机VM，
    所述控制模块，还用于通过所述全局VPC或所述第一VPC给所述VM分配网络前缀，其中，所述VM的网络前缀中的区域标识用于表示所述VM支持迁移至所述全局VPC管辖下的、可与所述第一VPC通信的VPC。
  27. 根据权利要求26所述的云管理平台，其特征在于，所述VM的网络前缀中的区域标识不同于所述全局VPC管辖下的任一个VPC的网络前缀中的区域标识。
  28. 根据权利要求27所述的云管理平台，其特征在于，所述全局VPC管辖下的、可与所述第一VPC通信的VPC包括所述第二VPC，
    所述控制模块，还用于将所述VM从所述第一VPC迁移至所述第二VPC，其中，所述迁移后的VM位于所述第二VPC的第二子网中，所述第二子网的网络前缀中的子网标识与所述第一子网的网络前缀中的子网标识相同。
  29. 根据权利要求25所述的云管理平台，其特征在于，所述迁移后的VM的网络前缀与所述迁移前的VM的网络前缀相同。
  30. 根据权利要求18-29任一项所述的云管理平台，其特征在于，
    所述控制模块，还用于给所述全局VPC分配带宽，其中，经过所述全局VPC的数据流满足所述带宽的要求。
  31. 根据权利要求30所述的云管理平台，其特征在于，
    所述控制模块，还用于根据所述全局VPC的标识给所述经过所述全局VPC的数据流打上相应的流标签，根据所述流标签获得所述带宽的要求，以及根据所述带宽的要求指示所述数据流的转发。
  32. 根据权利要求20-31任一项所述的云管理平台，其特征在于，所述全局VPC的网络前缀是所述云管理平台申请到的第六版网际协议IPv6前缀。
  33. 根据权利要求20-31任一项所述的云管理平台，其特征在于，所述全局VPC的网络前缀是所述云管理平台生成的IPv6前缀。
  34. 根据权利要求20-31任一项所述的云管理平台，其特征在于，所述全局VPC的网络前缀是所述租户申请到的IPv6前缀。
  35. 一种通信***，其特征在于，包括前述权利要求1-17任一项所述的云管理平台，全局虚拟私有云VPC、位于第一区域的第一VPC以及位于第二区域的第二VPC。
  36. 一种计算设备，其特征在于，包括处理器和存储器，所述处理器执行所述存储器中的计算机程序代码以实现前述权利要求1-17所述的任一项方法。
  37. 一种计算机可读存储介质，其特征在于，存储有计算机程序代码，当所述计算机程序代码被计算设备执行时，所述计算设备执行前述权利要求1-17任一项所述的方法。
PCT/CN2023/096910 2022-05-30 2023-05-29 一种基于公有云的vpc之间的通信方法及相关产品 WO2023231982A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210601054.8 2022-05-30
CN202210601054.8A CN117201574A (zh) 2022-05-30 2022-05-30 一种基于公有云的vpc之间的通信方法及相关产品

Publications (1)

Publication Number Publication Date
WO2023231982A1 true WO2023231982A1 (zh) 2023-12-07

Family

ID=89000273

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/096910 WO2023231982A1 (zh) 2022-05-30 2023-05-29 一种基于公有云的vpc之间的通信方法及相关产品

Country Status (2)

Country Link
CN (1) CN117201574A (zh)
WO (1) WO2023231982A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117785483B (zh) * 2024-02-26 2024-05-03 江苏未来网络集团有限公司 跨域异构算力资源高效互联和统一管理***

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150036535A1 (en) * 2013-08-01 2015-02-05 Palo Alto Research Center Incorporated Method and apparatus for configuring routing paths in a custodian-based routing architecture
CN106559511A (zh) * 2016-10-18 2017-04-05 上海优刻得信息科技有限公司 云***、云端公共服务***及用于云***的互访方法
CN112688847A (zh) * 2020-08-17 2021-04-20 紫光云技术有限公司 一种云网络环境下vpc对等连接的实现方法
US11171878B1 (en) * 2020-09-21 2021-11-09 Vmware, Inc. Allocating additional bandwidth to resources in a datacenter through deployment of dedicated gateways

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150036535A1 (en) * 2013-08-01 2015-02-05 Palo Alto Research Center Incorporated Method and apparatus for configuring routing paths in a custodian-based routing architecture
CN106559511A (zh) * 2016-10-18 2017-04-05 上海优刻得信息科技有限公司 云***、云端公共服务***及用于云***的互访方法
CN112688847A (zh) * 2020-08-17 2021-04-20 紫光云技术有限公司 一种云网络环境下vpc对等连接的实现方法
US11171878B1 (en) * 2020-09-21 2021-11-09 Vmware, Inc. Allocating additional bandwidth to resources in a datacenter through deployment of dedicated gateways

Also Published As

Publication number Publication date
CN117201574A (zh) 2023-12-08

Similar Documents

Publication Publication Date Title
US10469442B2 (en) Adaptive resolution of domain name requests in virtual private cloud network environments
CN111885075B (zh) 容器通信方法、装置、网络设备及存储介质
US11409550B2 (en) Low latency connections to workspaces in a cloud computing environment
US11509577B2 (en) Linking resource instances to virtual network in provider network environments
US20170353394A1 (en) Resource placement templates for virtual networks
WO2021135344A1 (zh) 虚拟私有云与云下数据中心通信、配置方法及相关装置
US10645060B2 (en) Method, device and system for forwarding message
US20190182256A1 (en) Private network layering in provider network environments
TW201815131A (zh) 一種資料傳輸的方法及網路設備
WO2017113300A1 (zh) 路由确定方法、网络配置方法以及相关装置
WO2022001669A1 (zh) 建立vxlan隧道的方法及相关设备
EP4221103A1 (en) Public cloud network configuration method, and related device
WO2023231982A1 (zh) 一种基于公有云的vpc之间的通信方法及相关产品
US20230345273A1 (en) Fault processing method, control plane network element, steering decision-making network element, and related device
WO2018161795A1 (zh) 一种路由优先级配置方法、设备以及控制器
CN115150224A (zh) 一种集群间网络二层打通方法、装置、设备及存储介质
CN115412527A (zh) 虚拟私有网络之间单向通信的方法及通信装置
US11012357B2 (en) Using a route server to distribute group address associations
CN111935336A (zh) 基于IPv6的网络治理方法及***
CN114531320A (zh) 通信方法、装置、设备、***及计算机可读存储介质
CN112994928A (zh) 一种虚拟机的管理方法、装置及***
WO2024037619A1 (zh) 一种基于云计算技术的虚拟实例创建方法和云管理平台
US11909624B2 (en) Communication method, apparatus, device, system, and computer-readable storage medium
EP4175247A1 (en) Packet transmission method, apparatus, and system, and storage medium
WO2022232445A2 (en) System, classifier and method for network policy-based traffic management of data flows

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23815161

Country of ref document: EP

Kind code of ref document: A1