The control plane uses a centralized control and distributed agent architecture. Through an ANS controller cluster composed of 3 or 5 controller nodes, it provides centralized management of ACOS (AVE) clusters and deploys the ANS agent on each node to handle virtual machine IP address learning and security rule generation.
ANS controller cluster
Composed of 3 or 5 controller nodes, each controller consumes minimal resources, without any single point of failure.
The controller cluster uses etcd for leader election and real-time monitoring. When a node changes or goes offline, the cluster immediately detects the node's health status and switches the primary and secondary nodes to ensure workload continuity. etcd also provides data persistence for the control plane.
The controller cluster also provides scalable northbound and southbound interfaces: The northbound interface is the declarative API, and the southbound interface is used for communicating with ANS agents.
Control agent
Deployed on each node, it is responsible for learning virtual machine IP addresses and managing IP address timeouts. It communicates with the controller via the southbound interface to subscribe to security group information and its changes corresponding to security policies generated by the controller. It then converts security policies into security rules and edits the security rule forwarding table for the VDS data forwarding plane on the node through the Datapath interface.
AOC plugin
The controller virtual machine uses the AOC plugin to subscribe to all firewall policy-related events that occur in the management console, such as security policies, security groups, virtual machine labels, and virtual machine editing operations, and then creates, deletes, and updates security rules accordingly.
K8sMgmt plugin
The controller virtual machine uses the K8sMgmt plugin to subscribe to workload cluster-related events from the container management platform, such as workload cluster creation and deletion, and certificate updates.
AIC plugin
The controller virtual machine uses the AIC plugin to connect to each workload cluster, subscribe to Pod change events in the workload cluster, and update or delete the relevant security rules.
Declarative API
Compared with traditional imperative APIs, the declarative API is more concise and provides better abstraction. With the declarative API, users only need to submit a defined API object to declare the desired final state, without worrying about the execution process.
Controller southbound interface
The interface is responsible for communicating with ANS agents.
The control plane primarily calculates based on virtual machine label information, security group information, policy objects, and protocol information in security policies. It expands security policies defined by virtual machine labels, security groups, and protocols into the corresponding VM groups, Pod groups, and IP address information, to which the agents subscribe in order to generate the corresponding security rules. Whenever virtual machine labels or security groups are updated, the controller automatically recalculates and updates the security rules.
The labels and security groups associated with a virtual machine do not change during hot migration or workload adjustments. Security rules are dynamically updated as the virtual machine's corresponding host node changes, ensuring operations are transparent to workloads without affecting workload connectivity.
