Traffic management method, service grid system, device and cluster

Abstract

The invention provides a traffic management method, a service grid system, a device and a cluster. The method comprises the following steps: a first L4 agent receives a first data packet sent by a first service container group; the first L4 agent sends the identifier of the first tenant and the first data packet to a first L7 agent; the first L7 agent identifies configuration information of a first service in configuration information of multiple services based on the identifier of the first tenant, and the first service belongs to the first tenant; and the first L7 agent performs flow management on the first data packet based on the configuration information of the first service. According to the method, the computing resource utilization rate of the service grid system can be improved.

Description

[0001] This application claims the priority of a Chinese patent application with the application number 202311817785.7 and the application title "A Service Mesh System" submitted to the China National Intellectual Property Administration on December 25, 2023, the entire content of which is incorporated herein by reference. Technical Field

[0002] This application relates to the field of data processing technologies, and in particular, to a traffic management method, a service mesh system, a device, and a cluster. Background Art

[0003] Currently, typical service mesh technologies use sidecars to implement traffic management between services such as traffic routing, load balancing, and traffic control. Sidecars are injected into container groups, and restarting the container group is required for installing and upgrading sidecars, which increases the workload of the nodes where the container groups are located.

[0004] The industry has proposed a service mesh technology in the ambient mode. The ambient mode is also called the sidecarless mode, which splits the functions of the sidecar into a transport layer proxy and an application layer proxy, and the transport layer proxy and the application layer proxy are separated from the container group, thus avoiding the defect of the sidecar increasing the workload of the nodes where the container groups are located.

[0005] In the existing ambient mode, each tenant exclusively occupies the application layer proxy, and one application layer proxy is only used for traffic management of the services of one tenant. Since each application layer proxy occupies independent computing resources, a large amount of computing resources are inevitably idle during the idle stage of the tenant's business, resulting in low utilization rate of computing resources. Summary of the Invention

[0006] Embodiments of this application provide a traffic management method, a service mesh system, a device, and a cluster, which can improve the utilization rate of computing resources of the service mesh system.

[0007] In a first aspect, a traffic management method is provided. This method is applied to a service mesh system, which includes a first business node and an agent cluster. Among them, the first business node runs a first transport layer L4 agent and a first business container group of a first tenant. The agent cluster runs a first application layer L7 agent, and the first L7 agent includes configuration information of multiple services. Different services among the multiple services belong to the same tenant or different tenants, and the configuration information of the services is used for the first L7 agent to perform traffic management on the data packets of the services. The method includes: the first L4 agent receives a first data packet sent by the first business container group; the first L4 agent sends the identifier of the first tenant and the first data packet to the first L7 agent; the first L7 agent, based on the identifier of the first tenant, identifies the configuration information of the first service in the configuration information of the multiple services, and the first service belongs to the first tenant; the first L7 agent performs traffic management on the first data packet based on the configuration information of the first service.

[0008] Through the method provided in the first aspect, the same L7 agent can include the configuration information of the services of multiple tenants. When it is necessary to perform traffic management on the data packets of the services of a tenant, the L7 agent obtains the identifier of the tenant, and based on the identifier of the tenant, obtains the configuration information of the services of the tenant from the configuration information of the services of multiple tenants, and then can perform traffic management on the data packets of the services of the tenant based on the configuration information of the services of the tenant. In this way, the same L7 agent can perform traffic management on the data packets of the services of multiple tenants, realizing the sharing of the L7 agent by multiple tenants. The sharing of the L7 agent by multiple tenants can improve the utilization rate of the computing resources of the L7 agent, reduce the scheduling pressure of the L7 agent, etc., for the following reasons.

[0009] First of all, the idle phases of the services of different tenants are often not exactly the same, that is, the idle phases of different tenants are usually different. When the services of some tenants are in the idle phase, the services of some other tenants may be in the busy phase. In this way, it can be avoided that the L7 agent is in an idle state, and the utilization rate of the computing resources of the L7 agent is improved.

[0010] Secondly, multiple tenants share the L7 agent, and there is no need for each tenant to create an L7 agent, which can reduce the number of L7 agents in the service mesh system. This can not only reduce the computing resources required to deploy the L7 agent in the service mesh system, but also reduce the scheduling pressure of the L7 agent.

[0011] In addition, the L7 proxy is shared by multiple tenants, indicating that there is no need to create L7 proxies at the tenant granularity. The administrator of the service mesh system can pre-create one or more L7 proxies in the proxy cluster. Whenever a new service is created, the console of the service mesh system can send the configuration information of the service to the L7 proxy, enabling the L7 proxy to perform traffic management on the data packets of the service based on the configuration information of the service. This improves the timeliness of traffic management for new services.

[0012] Moreover, the L7 proxy is shared by multiple tenants and is not exclusive to a particular tenant, which allows the L7 proxy to be uniformly created by the administrator and can control the redundancy of the service configuration information. Specifically, whenever a new service is created, the console of the service mesh system can send the configuration information of the service to N L7 proxies, where N is an integer greater than or equal to 1, and the value of N can be set by the administrator. In this way, it is possible to avoid storing the service configuration information in the L7 proxy with high redundancy, saving the memory resources of the L7 proxy.

[0013] In a possible implementation, the first service node also runs a second business container group of a second tenant; the method includes: the first L4 proxy receives a second data packet sent by the second business container group; the first L4 proxy sends the identifier of the second tenant and the second data packet to the first L7 proxy; the first L7 proxy identifies the configuration information of a second service belonging to the second tenant from the configuration information of multiple services based on the identifier of the second tenant; the first L7 proxy performs traffic management on the second data packet based on the configuration information of the second service.

[0014] In this implementation, the first L7 proxy can perform traffic management on the data packets of the services of the first tenant and the second tenant. That is to say, the first tenant and the second tenant can share the first L7 proxy, thereby improving the utilization rate of the computing resources of the first L7 proxy and reducing the scheduling pressure of the L7 proxy, etc.

[0015] In a possible implementation, the first service includes the service corresponding to the first data packet and other services; the first L7 proxy performs traffic management on the first data packet based on the configuration information of the first service, including: the first L7 proxy identifies the configuration information of the service corresponding to the first data packet from the configuration information of the first service based on the identifier of the service corresponding to the first data packet; the first L7 proxy performs traffic management on the first data packet based on the configuration information of the service corresponding to the first data packet.

[0016] The first L7 proxy can perform traffic management on data packets of multiple services of the first tenant. When the first L7 proxy needs to perform traffic management on the data packets of a certain service, it can identify the configuration information of the service in the configuration information of multiple services of the first tenant based on the identifier of the service, and then can perform traffic management on the data packets of the service based on the configuration information of the service.

[0017] In a possible implementation, there are multiple L7 proxies running in the proxy cluster; the first L4 proxy sends the identifier of the first tenant and the first data packet to the first L7 proxy, including: the first L4 proxy identifies the L7 proxy including the configuration information of the services of the first tenant from multiple L7 proxies based on the identifier of the first tenant; the first L4 proxy identifies the L7 proxy including the configuration information of the service corresponding to the first data packet from the L7 proxies including the configuration information of the services of the first tenant, and obtains the first L7 proxy.

[0018] When there are multiple L7 proxies running in the proxy cluster, the L4 proxy can identify the L7 proxy including the configuration information of the services of the first tenant from the multiple L7 proxies based on the identifier of the tenant, so as to send the data packets of the services of the first tenant to the L7 proxy including the configuration information of the services of the first tenant, and then can perform traffic management on the data packets of the services of the first tenant through this L7 proxy.

[0019] In a possible implementation, the proxy cluster also runs a second L7 proxy, and the second L7 proxy includes the configuration information of at least one service; the first L4 proxy sends the identifier of the first tenant and the first data packet to the first L7 proxy, including: when the number of services belonging to the first tenant among multiple services is greater than the number of services belonging to the first tenant among at least one service, the first L4 proxy sends the identifier of the first tenant and the first data packet to the first L7 proxy.

[0020] For ease of description, the L7 proxy including the configuration information of the service can be called the L7 proxy supporting the service. It is preferable to select the L7 proxy supporting more services of the first tenant to perform traffic management on the data packets of the services of the first tenant, which can save the data transmission between the business container groups of the first tenant for the following reasons.

[0021] Two or more services of the same tenant may be executed sequentially, that is, the output of one service is the input of the next service. When the L7 proxy manages the traffic of the data packets of two or more services of the same tenant, these two or more services share a routing cache. Among them, the routing cache stores the addresses of the target service instances (i.e., one or some specific business container groups) of the two or more services. When two or more services can be provided by the same business container group, by sharing the addresses in the routing cache, the L7 proxy can send the data packets of these two or more services to the same target service instance, so as to schedule the data packets of these two or more services into the same business container group. In this way, the processing of the data packets of these two or more services can be completed in the same business container group, saving the data transmission between business container groups.

[0022] The greater the possibility that the L7 proxy supporting more services of the first tenant supports two or more sequentially executed services in the first tenant, and the services that require traffic management may belong to two or more services. Therefore, it is preferred to select the L7 proxy that supports more services of the first tenant to manage the traffic of the data packets of the services of the first tenant, which increases the probability that the data packets of two or more services of the first tenant are processed by the same business container group, thus saving the data transmission between business container groups.

[0023] In a possible implementation, the proxy cluster also runs a second L7 proxy, and the second L7 proxy also includes the configuration information of the first service; the first L4 proxy sends the identifier of the first tenant and the first data packet to the first L7 proxy, including: when the load of the second L7 proxy is greater than the load of the first L7 proxy, the first L4 proxy sends the identifier of the first tenant and the first data packet to the first L7 proxy.

[0024] In this implementation, it is preferred to select the L7 proxy with a small load to manage the traffic of the service that currently requires traffic management, ensuring the load balance among multiple L7 proxies and improving the overall resource utilization rate of multiple L7 proxies.

[0025] In a possible implementation, the service mesh system further includes: a console connected to the proxy cluster; the method further includes: the console sends the configuration information of two or more services to the same L7 proxy in the proxy cluster; among them, the two or more services belong to the same tenant, or the output of one service among the two or more services is the input of another service.

[0026] Send the configuration information of two or more services that need to be executed sequentially to the same L7 proxy, so that the same L7 proxy can be used to manage the traffic of the data packets of the two or more services, so that the data packets of the two or more services can be scheduled to the same business container group, and the data packets of the two or more services are processed by the same business container group, thereby saving data transmission between business container groups.

[0027] In a possible implementation, there are multiple L7 proxies running in the proxy cluster; among them, among the multiple L7 proxies, the same L7 proxy includes the configuration information of the least number of services, or the same L7 proxy includes the configuration information of the least number of tenants.

[0028] In this implementation, when selecting an L7 proxy to support a newly created service, preferentially select an L7 proxy that supports fewer services. In this way, the load balance between multiple L7 proxies can be guaranteed. Or, when selecting an L7 proxy to support a newly created service, preferentially select an L7 proxy that supports fewer tenants. In this way, it is possible to avoid the same L7 proxy from becoming the affinity L7 proxy of multiple tenants at the same time, and avoid excessive load on the L7 proxy.

[0029] In a possible implementation, the service mesh system further includes a second service node, and a second L4 proxy and a third business container group are running on the second service node; the first L7 proxy manages the traffic of the first data packet based on the configuration information of the first service, including: the first L7 proxy selects the third business container group as the target container group of the first data packet; the first L7 proxy sends the first data packet and the identifier of the first tenant to the second L4 proxy; the method further includes: the second L4 proxy confirms that the first tenant and the tenant to which the third business container group belongs are the same tenant based on the identifier of the first tenant; the second L4 proxy sends the first data packet to the third business container group.

[0030] In this implementation, the L4 proxy in the outbound direction of the service mesh sends the data packet to the target business container group only when it confirms that the tenant to which the data packet belongs and the tenant to which the target business container group of the data packet belongs are the same tenant. In this way, the isolation between tenants is guaranteed.

[0031] In a second aspect, a service mesh system is provided. The service mesh system includes a first business node and an agent cluster. Among them, the first business node runs a first L4 agent and a first business container group of a first tenant. The agent cluster runs a first L7 agent, and the first L7 agent includes configuration information of multiple services. Different services among the multiple services belong to the same tenant or different tenants. The configuration information of the services is used for the first L7 agent to perform traffic management on the data packets of the services. Among them, the first L4 agent is used to: receive a first data packet sent by the first business container group; the first L4 agent is used to: send the identifier of the first tenant and the first data packet to the first L7 agent; the first L7 agent is used to: based on the identifier of the first tenant, identify the configuration information of a first service in the configuration information of the multiple services, and the first service belongs to the first tenant; the first L7 agent is used to: based on the configuration information of the first service, perform traffic management on the first data packet.

[0032] In a possible implementation, the first business node also runs a second business container group of a second tenant. The first L4 agent is also used to: receive a second data packet sent by the second business container group; the first L4 agent is also used to: send the identifier of the second tenant and the second data packet to the first L7 agent; the first L7 agent is also used to: based on the identifier of the second tenant, identify the configuration information of a second service in the configuration information of the multiple services, and the second service belongs to the second tenant; the first L7 agent is also used to: based on the configuration information of the second service, perform traffic management on the second data packet.

[0033] In a possible implementation, the first service includes the service corresponding to the first data packet and other services. The first L7 agent is used to: based on the identifier of the service corresponding to the first data packet, identify the configuration information of the service corresponding to the first data packet in the configuration information of the first service; based on the configuration information of the service corresponding to the first data packet, perform traffic management on the first data packet.

[0034] In a possible implementation, the agent cluster also runs a second L7 agent, and the second L7 agent includes configuration information of at least one service. The first L4 agent is used to: when the number of services belonging to the first tenant among the multiple services is greater than the number of services belonging to the first tenant among the at least one service, send the identifier of the first tenant and the first data packet to the first L7 agent.

[0035] In a possible implementation, the agent cluster also runs a second L7 agent, and the second L7 agent also includes the configuration information of the first service. The first L4 agent is used to: when the load of the second L7 agent is greater than the load of the first L7 agent, send the identifier of the first tenant and the first data packet to the first L7 agent.

[0036] In a possible implementation, the service mesh system further includes: a console connected to the proxy cluster; the console is configured to: send the configuration information of two or more services to the same L7 proxy in the proxy cluster; wherein, the two or more services belong to the same tenant, or the output of one of the two or more services is the input of another service.

[0037] In a possible implementation, the service mesh system further includes a second service node, and a second L4 proxy and a third service container group are running on the second service node; the first L7 proxy is configured to: select the third service container group as the target container group for the first data packet; send the first data packet and the identifier of the first tenant to the second L4 proxy; the second L4 proxy is configured to: based on the identifier of the first tenant, confirm that the first tenant and the tenant to which the third service container group belongs are the same tenant; send the first data packet to the third service container group.

[0038] In a third aspect, a traffic management method is provided. The method is applied to the first L7 proxy in the service mesh system. The service mesh system includes a first service node and a proxy cluster; wherein, a first L4 proxy and a first service container group of the first tenant are running on the first service node; the first L7 proxy runs in the proxy cluster, and the first L7 proxy includes the configuration information of multiple services. Different services among the multiple services belong to the same tenant or different tenants, and the configuration information of the services is used for the first L7 proxy to perform traffic management on the data packets of the services; the method includes: the first L7 proxy receives the identifier of the first tenant and the first data packet sent by the first L4 proxy, and the first data packet is received by the first L4 proxy from the first service container group; the first L7 proxy, based on the identifier of the first tenant, identifies the configuration information of the first service in the configuration information of the multiple services, and the first service belongs to the first tenant; the first L7 proxy, based on the configuration information of the first service, performs traffic management on the first data packet.

[0039] In a possible implementation, a second service container group of a second tenant is also running on the first service node; the method includes: the first L7 proxy receives the identifier of the second tenant and the second data packet sent by the first L4 proxy, and the second data packet is received by the first L4 proxy from the second service container group; the first L4 proxy sends the identifier of the second tenant and the second data packet to the first L7 proxy; the first L7 proxy, based on the identifier of the second tenant, identifies the configuration information of the second service in the configuration information of the multiple services, and the second service belongs to the second tenant; the first L7 proxy, based on the configuration information of the second service, performs traffic management on the second data packet.

[0040] In a possible implementation, the first service includes the service corresponding to the first data packet and other services; the first L7 proxy performs traffic management on the first data packet based on the configuration information of the first service, including: the first L7 proxy identifies the configuration information of the service corresponding to the first data packet in the configuration information of the first service based on the identifier of the service corresponding to the first data packet; the first L7 proxy performs traffic management on the first data packet based on the configuration information of the service corresponding to the first data packet.

[0041] In a possible implementation, a second L7 proxy also runs in the proxy cluster, and the second L7 proxy includes the configuration information of at least one service; the first L7 proxy receives the identifier of the first tenant and the first data packet sent by the first L4 proxy, including: when the number of services belonging to the first tenant among the multiple services is greater than the number of services belonging to the first tenant among the at least one service, the first L7 proxy receives the identifier of the first tenant and the first data packet sent by the first L4 proxy.

[0042] In a possible implementation, a second L7 proxy also runs in the proxy cluster, and the second L7 proxy also includes the configuration information of the first service; the first L7 proxy receives the identifier of the first tenant and the first data packet sent by the first L4 proxy, including: when the load of the second L7 proxy is greater than the load of the first L7 proxy, the first L7 proxy receives the identifier of the first tenant and the first data packet sent by the first L4 proxy.

[0043] In a possible implementation, the service mesh system further includes: a console connected to the proxy cluster; the method further includes: the first L7 proxy receives and records the configuration information of two or more services from the console; wherein, the two or more services belong to the same tenant, or the output of one of the two or more services is the input of another service.

[0044] In a possible implementation, the service mesh system further includes a second service node, and a second L4 proxy and a third service container group run on the second service node; the first L7 proxy performs traffic management on the first data packet based on the configuration information of the first service, including: the first L7 proxy selects the third service container group as the target container group for the first data packet; the first L7 proxy sends the first data packet and the identifier of the first tenant to the second L4 proxy; wherein, the second L4 proxy is used to: confirm that the first tenant and the tenant to which the third service container group belongs are the same tenant based on the identifier of the first tenant; send the first data packet to the third service container group.

[0045] Fourthly, a traffic management device is provided. The device is configured in the first L7 proxy in the service mesh system, and the service mesh system includes a first service node and a proxy cluster. The first service node runs a first L4 proxy and a first service container group of a first tenant. The first L7 proxy runs in the proxy cluster. The first L7 proxy includes configuration information of multiple services, and different services among the multiple services belong to the same tenant or different tenants. The configuration information of the services is used for the first L7 proxy to perform traffic management on the data packets of the services. The device includes: a receiving module, configured to receive the identifier of the first tenant and a first data packet sent by the first L4 proxy, where the first data packet is received by the first L4 proxy from the first service container group; an identifying module, configured to identify the configuration information of a first service in the configuration information of the multiple services based on the identifier of the first tenant, where the first service belongs to the first tenant; and a management module, configured to perform traffic management on the first data packet based on the configuration information of the first service.

[0046] In a possible implementation, the first service node also runs a second service container group of a second tenant. The receiving module is further configured to: receive the identifier of the second tenant and a second data packet sent by the first L4 proxy, where the second data packet is received by the first L4 proxy from the second service container group; the identifying module is further configured to: identify the configuration information of a second service in the configuration information of the multiple services based on the identifier of the second tenant, where the second service belongs to the second tenant; and the management module is further configured to: perform traffic management on the second data packet based on the configuration information of the second service.

[0047] In a possible implementation, the first service includes the service corresponding to the first data packet and other services. The management module is configured to: identify the configuration information of the service corresponding to the first data packet in the configuration information of the first service based on the identifier of the service corresponding to the first data packet; and perform traffic management on the first data packet based on the configuration information of the service corresponding to the first data packet.

[0048] In a possible implementation, a second L7 proxy also runs in the proxy cluster. The second L7 proxy includes configuration information of at least one service. The receiving module is configured to: when the number of services belonging to the first tenant among the multiple services is greater than the number of services belonging to the first tenant among the at least one service, receive the identifier of the first tenant and the first data packet sent by the first L4 proxy.

[0049] In a possible implementation, a second L7 proxy also runs in the proxy cluster. The second L7 proxy also includes the configuration information of the first service. The receiving module is configured to: when the load of the second L7 proxy is greater than the load of the first L7 proxy, receive the identifier of the first tenant and the first data packet sent by the first L4 proxy.

[0050] In a possible implementation, the service mesh system further includes: a console connected to the proxy cluster; a receiving module configured to: receive and record configuration information of two or more services from the console; wherein the two or more services belong to the same tenant, or the output of one of the two or more services is the input of another service.

[0051] In a possible implementation, the service mesh system further includes a second service node, and a second L4 proxy and a third service container group are running on the second service node; a management module is configured to: the first L7 proxy selects the third service container group as the target container group for the first data packet; the first L7 proxy sends the first data packet and the identifier of the first tenant to the second L4 proxy; wherein the second L4 proxy is configured to: based on the identifier of the first tenant, confirm that the first tenant and the tenant to which the third service container group belongs are the same tenant; send the first data packet to the third service container group.

[0052] In a fifth aspect, a computing device cluster is provided, including at least one computing device, and each computing device includes a processor and a memory; the processor of at least one computing device is configured to execute instructions stored in the memory of at least one computing device, so that the computing device cluster executes the method provided in the second aspect.

[0053] In a sixth aspect, a computer-readable storage medium is provided, including computer program instructions, and when the computer program instructions are executed by the computing device cluster, the computing device cluster executes the method provided in the second aspect.

[0054] In a seventh aspect, a computer program product including instructions is provided, and when the instructions are run by a computer device cluster, the computer device cluster is caused to execute the method provided in the second aspect.

[0055] For the beneficial effects of the second aspect to the seventh aspect, reference may be made to the introduction of the beneficial effects of the first aspect above, and details are not described herein again. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 A schematic structural diagram of a service mesh system provided by an embodiment of the present application;

[0057] Figure 2 A schematic structural diagram of the L7 proxy provided by an embodiment of the present application;

[0058] Figure 3 A schematic diagram of a service configuration method provided by an embodiment of the present application;

[0059] Figure 4 A schematic diagram of a service configuration method provided by an embodiment of the present application;

[0060] Figure 5Flowchart of a service configuration method provided by an embodiment of the present application;

[0061] Figure 6 Flowchart of a traffic management method provided by an embodiment of the present application;

[0062] Figure 7 Flowchart of a traffic management method provided by an embodiment of the present application;

[0063] Figure 8 Schematic structural diagram of a traffic management device provided by an embodiment of the present application;

[0064] Figure 9 Schematic structural diagram of a computing device provided by an embodiment of the present application;

[0065] Figure 10 Schematic structural diagram of a computing device cluster provided by an embodiment of the present application;

[0066] Figure 11 Schematic structural diagram of a computing device cluster connected through a network provided by an embodiment of the present application. Detailed implementation manners

[0067] The solutions provided by the embodiments of the present application will be described below with reference to the accompanying drawings. Among them, in the embodiments of the present application, "a plurality of" means two or more. "First", "second", etc. are only used to distinguish similar objects and do not have to be used to describe a specific order or the number of objects.

[0068] To facilitate the understanding of the solutions provided by the embodiments of the present application, the technical terms that may be involved in the embodiments of the present application will be introduced first.

[0069] Microservice architecture: It is a service-oriented architecture (SOA) that divides a complex system into multiple small services or applications. These small services or applications can be called microservices. Each microservice is responsible for implementing an independent business logic. Microservices are built around business functions and can be deployed independently. Microservices depend on each other to provide a series of functions. Microservices are easy to understand and modify, bringing flexibility in language and framework selection. Microservices can run in containers. Among them, containers where multiple microservices with high mutual dependencies are located can form a container group. Among them, in the K8S (kubernetes) system, a container group can be encapsulated into a pod.

[0070] Business container: It refers to a container that runs microservices.

[0071] Business container group: A container group composed of multiple business container groups. Usually, the microservices running in the business containers within the same container group have a relatively high degree of dependence.

[0072] Service mesh: That is, service mesh, which is a technology for service governance of the services (such as microservices) provided by business containers through a data proxy outside the business containers. Specifically, the data proxy obtains the data packets sent by the business containers and performs service governance (such as traffic management) on the data packets to send the data packets to the data proxy of the target container group. The data proxy of the target container group sends the data packets to the target container group. Among them, the behavior of the data packets sent by the container group being obtained by the data proxy can be called entering the service mesh, and the behavior of the data proxy sending the data packets to the target container group can be called exiting the service mesh.

[0073] Service governance: Also known as SOA governance (SOA governance), it is a general term for the means used to ensure that each microservice instance in the microservice architecture can work properly and that different microservice instances can communicate with each other normally. Among them, the microservice instance can also be called a service instance or a business container instance.

[0074] Traffic management: Also known as traffic service governance, which is a type of service governance. Traffic management usually includes traffic routing, load balancing, traffic control, traffic observation, etc.

[0075] Configuration information of the service: It is the information used by the data proxy to perform traffic management on the data packets of the service. Among them, the data packets of the service are the data packets sent to the service instances of the service. The configuration information of the service can include the number of service instances of the service, the addresses of the service instances, the maximum processing capacity of the service instances, etc. Exemplarily, the maximum processing capacity of the service instance can be the throughput of the service instance.

[0076] Data proxy: Also known as the data plane proxy, it is a module or device for service governance of service instances on the data plane. The data proxy can be a process, and the data proxy process can run in a container. In the sidecar mode, the data proxy is the sidecar. In the ambient mode, the data proxy includes a transport layer proxy and an application layer proxy. In the Open System Interconnection (OSI) network model, the transport layer is the fourth layer (L4), and the application layer is the seventh layer (L7). Therefore, the transport layer proxy can also be called the L4 proxy, and the application layer proxy can also be called the L7 proxy. Among them, the L4 proxy is used to implement low-level traffic management, such as routing data packets based on the Transmission Control Protocol (TCP). The L7 proxy is used to implement high-level traffic management, such as routing data packets based on the metadata information of the service in the data packet (such as service name, version, etc.). The functions of the L4 proxy and the L7 proxy will be specifically introduced below and will not be elaborated here.

[0077] Node: Used to run business container groups and / or data proxies. Typical nodes include virtual machines (VMs), computers (such as servers), bare metal servers, etc. Among them, the node used to run the business container group can be called a business node. In the embodiments of the present application, the L4 proxy also runs in the business node. The node used to run the L7 proxy can be called a proxy node. One or more business nodes can form a business cluster, and one or more proxy nodes can form a proxy cluster. The proxy cluster can also be called a managed cluster or a proxy managed cluster.

[0078] In the related art, in order to achieve isolation between different tenants, each tenant exclusively occupies an L7 proxy. Specifically, the tenant is responsible for creating and maintaining the L7 proxy of the tenant, and the L7 proxy of the tenant only performs traffic management on the data packets sent by the business container group of the tenant. There are a large number of tenants in the service mesh system, and each tenant may create multiple L7 proxies, which results in a large number of L7 proxies in the service mesh system. Among them, each L7 proxy runs in a separate container, and a large number of proxies require a large number of containers. Each container has exclusive and fixed computing resources, such as a central processing unit (CPU), memory resources, etc. Usually, the business of the tenant has busy and idle phases. During the idle phase of the tenant's business, the L7 proxy of the tenant is in an idle state, resulting in low utilization of computing resources.

[0079] Moreover, the scheduling pressure of a large number of L7 proxies is relatively high. For example, a large amount of work is required to select nodes for deploying L7 proxies.

[0080] Moreover, since the L7 proxy is exclusive to a tenant and the number of services of different tenants may vary, the number of L7 proxies required also varies. Therefore, it is difficult for the administrator of the service mesh system to uniformly create and maintain L7 proxies, and the tenant needs to create and maintain the L7 proxy by itself. The tenant's maintenance of the L7 proxy increases the workload of the tenant. Moreover, tenants often lack professional knowledge and it is difficult to professionally maintain the L7 proxy, resulting in a relatively high risk of the L7 proxy malfunctioning. For example, when upgrading the L7 proxy, due to the lack of professional knowledge of the tenant, there is a great risk of misidentification in the L7 proxy upgrade.

[0081] In addition, tenants often create multiple L7 proxies, and the number of L7 proxies exceeds the business needs of the tenant, which results in a waste of computing resources. Moreover, whenever the console in the related technology detects the creation of an L7 proxy, it sends the configuration information of all services of the tenant to which the L7 proxy belongs to the L7 proxy. That is to say, each L7 proxy of the tenant stores the configuration information of all services of the tenant, which results in the configuration information of the services being stored in the L7 proxy with high redundancy, consuming a large amount of memory resources.

[0082] Refer to Figure 1 In the service mesh system provided by the embodiment of the present application, a plurality of tenants share the L7 proxy, which improves the utilization rate of the computing resources of the L7 proxy. Specifically, the idle phases of the services of different tenants are usually different. When the services of some tenants are in the idle phase, the services of another part of the tenants may be in the busy phase. In this way, it is possible to avoid the L7 proxy being in an idle state and improve the utilization rate of the computing resources of the L7 proxy.

[0083] In the service mesh system provided by the embodiment of the present application, a plurality of tenants share the L7 proxy, which improves the utilization rate of the computing resources of the L7 proxy. Specifically, the idle phases of the services of different tenants are usually different. When the services of some tenants are in the idle phase, the services of another part of the tenants may be in the busy phase. In this way, it is possible to avoid the L7 proxy being in an idle state and improve the utilization rate of the computing resources of the L7 proxy.

[0084] Moreover, multiple tenants share the L7 proxy, eliminating the need for each tenant to create an L7 proxy, which can reduce the number of L7 proxies in the service mesh system. This can not only reduce the computing resources required to deploy L7 proxies in the service mesh system but also reduce the scheduling pressure on the L7 proxies.

[0085] In addition, since the L7 proxy is shared by multiple tenants, there is no need to create L7 proxies at the tenant granularity. The administrator of the service mesh system can pre-create one or more L7 proxies in the proxy cluster. Whenever a new service is created, the console of the service mesh system can send the configuration information of the service to the L7 proxy, enabling the L7 proxy to manage the traffic of the data packets of the service based on the configuration information of the service.

[0086] Furthermore, since the L7 proxy is uniformly created by the administrator, the redundancy of the service configuration information can be controlled. Specifically, whenever a new service is created, the console of the service mesh system can send the configuration information of the service to N L7 proxies, where N is an integer greater than or equal to 1, and the value of N can be set by the administrator. In this way, it is possible to avoid storing the service configuration information redundantly in the L7 proxy, saving the memory resources of the L7 proxy.

[0087] Next, a specific introduction to the service mesh system provided by the embodiments of the present application will be given.

[0088] As Figure 1 shown, the service mesh system includes multiple business nodes, such as business node 100 and business node 200. A business node can deploy multiple business container groups and at least one L4 proxy. For example, business node 100 deploys business container group 110, business container group 120, and L4 proxy 130, etc. For another example, business node 200 deploys business container group 210, business container group 220, and L4 proxy 230, etc. Among them, different business container groups in the same business node can belong to different tenants or the same tenant. The same tenant can deploy business container groups in different business nodes. For example, business container group 110 and business container group 210 belong to tenant A1, and business container group 120 and business container group 220 belong to tenant A2. The L4 proxy is at the node level, that is, the L4 proxy can manage the data packets sent by multiple business container groups in the business node where the L4 proxy is located. For example, select an L7 proxy for the data packets sent by the business container group and establish a connection (such as a TCP connection) between the L4 proxy and the selected L7 proxy.

[0089] The service mesh system includes a proxy cluster 300. The proxy cluster 300 consists of at least one proxy node. One or more L7 proxies, such as L7 proxy 310 and / or L7 proxy 320, can be deployed in the proxy cluster 300. Among them, one L7 proxy can run in one or more proxy nodes in the proxy cluster 300. Additionally, one proxy node can run one or more L7 proxies.

[0090] The L7 proxy can include configuration information of multiple services. The L7 proxy can perform traffic management on the data packets of the service based on the configuration information of the service. Among them, different services among the multiple services can belong to the same tenant or different tenants. That is, different services among the multiple services can be services provided by the business container groups of the same tenant or services provided by the business container groups of different tenants. In other words, the L7 proxy no longer performs traffic management at the tenant granularity, but at the service granularity.

[0091] In some embodiments, as Figure 2 shown, the L4 proxy 130 has an interception module 131, an acquisition module 132, and a sending module 133. The interception module 131 can intercept the data packets sent by the business container groups in the business node 100, so that the data packets sent by the business container groups enter the service mesh. For example, the business container group 110 sends a data packet 111, and the interception module 131 intercepts the data packet 111. The acquisition module 132 can parse the data packet 111 to obtain the identifier of the business container group 110. Exemplarily, the identifier of the container group can be the internet protocol (IP) address of the container group. Among them, the acquisition module 132 can parse the data packet 111 to obtain the source IP (SrcIP) address, so as to obtain the IP address of the business container group 110. Then, the acquisition module 132 can obtain the identifier of the tenant to which the business container group 110 belongs from the mesh console 400 of the service mesh system based on the identifier of the business container group 110.

[0092] Among them, the mesh console can also be referred to as the mesh control plane or console, which is used to control L7 proxies, L4 proxies, etc. in the service mesh system, and provide an interface (such as an application programming interface (API)) for the administrator of the service mesh system to manage the service mesh system, etc.

[0093] The sending module 133 in the L4 proxy 130 can send the data packet 111 and the identifier of the tenant to the L7 proxy 310.

[0094] In some embodiments, as Figure 2As shown, the L7 proxy 310 includes one or more listeners, such as listener 311, listener 312, etc. In one example, the data packet 111 may include a service identifier for the service requested by the data packet 111. In one example, the service identifier may be a service IP (Svc IP). Different listeners in the L7 proxy 310 correspond to different services, and the listener is used to listen for data packets of the service corresponding to the listener. Among them, the listener can detect the service identifier in the data packet sent to the L7 proxy 310. If the service represented by the service identifier is the service corresponding to the listener, the listener receives the data packet.

[0095] In some embodiments, as Figure 2 shown, the L7 proxy 310 includes multiple tenant listeners. Among them, different tenant listeners among the multiple tenant listeners are used to listen for and receive data packets of different tenant services. For example, the listener of tenant A1 is used to listen for and receive data packets of the service of tenant A1 (such as data packet 111), and the listener of tenant A2 is used to listen for and receive data packets of the service of tenant A2 (such as data packet 121).

[0096] The L7 proxy 310 includes multiple tenant service listeners. Among them, the tenant service listener is used to listen for and receive a certain service of the tenant. Among them, since the service identifiers of the services of different tenants may be the same, in the L7 proxy, the service identifier combined with the tenant identifier is used to identify the service. That is to say, the unique identifier of the service is composed of the service identifier of the service and the identifier of the tenant of the service. For example, the unique identifier of service 1 of tenant A1 is composed of the identifier of service 1 and the identifier of tenant A1, and the unique identifier of service 2 of tenant A2 is composed of the identifier of service 2 and the identifier of tenant A2.

[0097] Continuing to refer to Figure 2 , the L7 proxy 310 includes a traffic management module 313. After receiving the data packet 111, the traffic management module 313 can obtain the configuration information of the service of tenant A1 from the saved configuration information of multiple services, and then perform traffic management on the data packet 111 based on the configuration information of the service of tenant A1. For example, based on the service instance load balance (LB) policy, select the target service instance of the data packet 111, and send the data packet 111 to the selected target service instance.

[0098] In some embodiments, the L7 proxy 310 further includes an observation module 314. Among them, the observation module 314 is used to observe and statistically analyze information such as the path and time of sending data packets to a certain service instance. The observation module 314 obtains an observation report based on the observed information and reports the observation report to the observation center of the service mesh system.

[0099] The above briefly introduced the functions of the L7 proxy. Next, the deployment method of the L7 proxy will be introduced.

[0100] In the embodiments of the present application, the L7 proxy deployed in the proxy cluster 300 is created by the administrator of the service mesh system. In some embodiments, before the service mesh system is officially put into use, the administrator of the service mesh system can create one or more L7 proxies in the proxy cluster 300. For example, the administrator of the service mesh system can create a corresponding number of L7 proxies based on the capacity of the service mesh system. Herein, the capacity of the service mesh system refers to the maximum number of business container groups that can be deployed in the service mesh system.

[0101] Refer to Figure 3 , whenever a tenant's service is created, the grid console 400 can send the configuration information of the service, the identifier of the service, and the identifier of A1 to one or more L7 proxies, so that the L7 proxy can perform traffic management on the data packets of the service based on the configuration information of the service. In some embodiments, as Figure 3 shown, when creating the service of tenant A1 in the business node, the business node can execute step 301 to send the configuration information of the service, the identifier of the service, and the identifier of tenant A1 to the grid console 400. The grid console 400 can execute step 302 to select an L7 proxy for the service.

[0102] After selecting the L7 proxy, the grid console 400 executes step 303a to send the configuration information of the service, the identifier of the service, and the identifier of tenant A1 to the selected L7 proxy. When the L7 proxy receives the configuration information of the service, the identifier of the service, and the identifier of tenant A1, it can associate the configuration information of the service, the identifier of the service, and the identifier of tenant A1 to obtain the association relationship of the configuration information of the service, the identifier of the service, and the identifier of tenant A1. For example, in the association list, record the configuration information of the service, the identifier of the service, and the identifier of tenant A1. In this way, the configuration information of tenant A1's service can be obtained through the identifier of tenant A1, and the configuration information of this service of tenant A1 can be obtained through the identifier of tenant A1 and the identifier of the service.

[0103] The grid console also executes step 303b to send the association relationship between the selected L7 proxy and tenant A1 to the L4 proxy in each business node of the service mesh system, so that the L4 proxy can identify the L7 proxy including the configuration information of tenant A1's service based on this association relationship.

[0104] A business container group may include multiple containers. Each of these containers, as a service instance, can provide a service. The services provided by the containers within the same business container group are closely related. For example, the output of the service provided by one container is often the input of the service provided by another container. The containers within the same container group share storage space, which can be memory or cache. Thus, if the data packets of two or more services that need to be executed sequentially are scheduled into the same business container group and processed by the containers within the same business container group, there is no need to transfer relevant data between container groups. For example, container B11 and container B12 in business container group B1 provide service C1 and service C2 respectively, and container B21 and container B22 in business container group B2 also provide service C1 and service C2 respectively, and the output of service C1 is the input of service C2. The data packets of service C1 and the data packets of service C2 are data packets that need to be processed sequentially. If the data packets of these two services are both scheduled into business container group B1, the result of container B11 processing the data packets of service C1 (i.e., the output of service C1) can be saved in the storage space shared by container B11 and container B12. When container B12 processes the data packets of service C2, it can obtain the output of service C1 from this storage space, thus saving data transmission between business container groups. If the data packets of service C1 are scheduled into business container group B1 and the data packets of service C2 are scheduled into business container group B2, then when business container group B2 processes the data packets of service C2, it needs to obtain the output of service C1 from business container group B1, which requires data transmission between business container groups.

[0105] Refer to Figure 4 , at step 302, the grid console 400 selects an L7 proxy based on the affinity between services to send the configuration information of multiple services with affinity to the same L7 proxy.

[0106] In some embodiments, there is affinity between the services of the same tenant. Therefore, the configuration information of the services of the same tenant can be sent to the same L7 proxy. When the L7 proxy performs traffic management on the data packets of two or more services of the same tenant, the data packets of these two or more services share a routing cache. The routing cache stores the addresses of the target service instances (i.e., one or some specific business container groups) of the data packets. When these two or more services can be provided by the same business container group, by sharing the addresses in the routing cache, the L7 proxy can send the data packets of these two or more services to the same target service instance, thereby scheduling the data packets of these two or more services into the same business container group. Among them, these two or more services can be two or more services that need to be executed sequentially. Thus, data transmission between business container groups can be saved.

[0107] In some embodiments, there is an affinity between two or more services that need to be executed sequentially. Therefore, the configuration information of two or more services that need to be executed sequentially can be sent to the same L7 proxy. When the L7 proxy performs traffic management on the data packets of the two or more services, the two or more services share a routing cache. The routing cache stores the addresses of the target service instances of the data packets. When the two or more services are provided by the same business container group, by sharing the addresses in the routing cache, the L7 proxy can send the data packets of the two or more services to the same target service instance, thereby scheduling the data packets of the two or more services into the same business container group. In this way, data transmission between business container groups can be saved.

[0108] Among them, services with affinity refer to services of the same tenant or services that need to be executed sequentially. Among them, the services in the services that need to be executed sequentially also belong to the same tenant. Therefore, services with affinity are at the tenant granularity. An L7 proxy including the configuration information of services with affinity for a certain tenant can be called the affinity L7 proxy of that tenant.

[0109] In some embodiments, the proxy cluster 300 runs multiple L7 proxies. In step 302, an L7 proxy including the configuration information of the least number of services can be selected from the multiple L7 proxies. That is, when a service is created, the configuration information of the created service is sent to the L7 proxy including the configuration information of the least number of services. In one example, when selecting an L7 proxy based on the affinity between services, an L7 proxy including the configuration information of the least number of services is selected from the multiple L7 proxies to send the configuration information of the created service to the L7 proxy including the configuration information of the least number of services, so that the L7 proxy including the configuration information of the least number of services performs traffic management on the data packets of the created service to achieve load balancing.

[0110] In some embodiments, the proxy cluster 300 runs multiple L7 proxies. When selecting an L7 proxy based on the affinity between services, an L7 proxy including the configuration information of the least number of tenants is selected from the multiple L7 proxies to send the configuration information of the created service to the L7 proxy including the configuration information of the least number of tenants, so that the L7 proxy including the configuration information of the least number of tenants performs traffic management on the data packets of the created service. The configuration information of a tenant is the configuration information of the tenant's services. Sending the services with affinity for a certain tenant to the L7 proxy with the configuration information of the least number of tenants can avoid the same L7 proxy being simultaneously the affinity proxy of multiple tenants, or rather, reduce the risk of the same L7 proxy being simultaneously the affinity L7 proxy of multiple tenants.

[0111] In some embodiments, the annotation section of the YAML file for creating a service records the affinity between services. The mesh console 400 can obtain the annotation section of the YAML file for the service, and through the annotation section of the YAML file for the service, it can be obtained which services have affinity with each other. Among them, YAML is a markup language and also a format for expressing data serialization, and is often used to create services. Among them, creating a service can specifically be creating a container that provides the service.

[0112] In some embodiments, the L7 proxy can be deployed by Figure 5 the method shown.

[0113] First, the administrator of the service mesh system can, through step 501, create one or more L7 proxies such as the L7 proxy 310 in the proxy cluster 300.

[0114] Tenant A1 can, through step 502, create service A11 on the business node 200. Among them, creating a service means creating a business container group, and the containers in the created business container group provide the service. The business node 200 can, through step 503, send the configuration information of service A11, the identifier of service A11, and the identifier of tenant A1 to the mesh console 400.

[0115] The mesh console 400 can, in step 504, select an L7 proxy for service A11. Among them, an L7 proxy can be selected for service A11 based on the affinity between services. For specific reference to the above introduction, it will not be elaborated here.

[0116] It can be set that in step 504, the L7 proxy selected by the mesh console 400 is the L7 proxy 310. Then in step 505, the mesh console 400 sends the configuration information of service A11, the identifier of service A11, and the identifier of tenant A1 to the L7 proxy 310.

[0117] The L7 proxy 310 can establish an association relationship among the configuration information of service A11, the identifier of service A11, and the identifier of tenant A1. The L7 proxy 310 can save the configuration information of service A11 and this association relationship. In some embodiments, the L7 proxy 310 can, in step 506, create a tenant A1 listener. The tenant A1 listener is used to listen for data packets of the services of tenant A1. In some embodiments, the L7 proxy 310 can, in step 507, create a tenant A1 service A11 listener. The tenant A1 service A11 listener is used to listen for data packets of the service A11 of tenant A1.

[0118] The L7 proxy 310 can also, in step 508, establish an association relationship between the L7 proxy and tenant A1, and in step 509, send the association relationship between the L7 proxy and tenant A1 to the mesh console 400. The mesh console 400 can send the association relationship between the L7 proxy and tenant A1 to each L4 proxy in the service mesh system. The L4 proxy can save the received association relationship.

[0119] In some embodiments, the association relationship between the L7 proxy and tenant A1 includes the association relationship between the L7 proxy and service A11 of tenant A1. In some embodiments, the association relationship between the L7 proxy and tenant A1 is specifically the association relationship between the identifier of the L7 proxy and the identifier of tenant A1. Among them, the identifier of the L7 proxy and the identifier of tenant A1 can be recorded in the association list to associate the L7 proxy and tenant A1.

[0120] In this way, the deployment of the L7 proxy can be completed, and the L7 proxy can manage the traffic of data packets of services of relevant tenants. Among them, through the traffic management method provided by the embodiments of the present application, the L7 proxy can implement traffic management of data packets of services of relevant tenants.

[0121] Next, in combination with Figure 6 , taking the L7 proxy 310 and tenant A1 as examples, the traffic management method provided by the embodiments of the present application will be introduced.

[0122] Among them, the L7 proxy 310 includes configuration information of multiple services. Different services among the multiple services belong to the same tenant or different tenants. The configuration information of the service is used for the L7 proxy 310 to manage the traffic of data packets of the service. As Figure 6 shown, the method is as follows.

[0123] Step 601, the service container group 110 sends out a data packet 111. Among them, the service container group 110 belongs to tenant A1. The data packet 111 can be a data packet for requesting access to service A11 of tenant A1, that is, the data packet 111 is a service request for requesting access to service A11. The service container group 110 includes at least one service container, and the data packet 111 can specifically be sent by one or more service containers among the at least one service container.

[0124] The L4 proxy 130 in the service node where the service container group 110 is located (i.e., service node 100), as the L4 proxy for the inbound direction of the service mesh, can intercept the data packet 111. When the L4 proxy 130 intercepts the data packet 111, it can obtain the identifier of the service container group 110. For example, the L4 proxy 130 resolves the data packet 111 to obtain the Src IP of the data packet 111. The Src IP of the data packet 111 is the IP address of the service container group 110 and is a kind of identifier of the service container group 110. In step 602, the L4 proxy 130 can obtain the identifier of the tenant (i.e., tenant A1) to which the service container group 110 belongs based on the identifier of the service container group 110. Exemplarily, the L4 proxy 130 can query the identifier of tenant A1 in the mesh console 400 based on the identifier of the service container group 110.

[0125] In step 603, the L4 proxy 130 can filter out the L7 proxies that include the configuration information of the services of tenant A1 from the L7 proxies deployed in the proxy cluster 300 based on the identifier of tenant A1. Generally, multiple L7 proxies are deployed in the proxy cluster 300, and some of the L7 proxies include the configuration information of the services of tenant A1. Therefore, it is necessary to filter out the L7 proxies that include the configuration information of the services of tenant A1 from the multiple L7 proxies based on the identifier of tenant A1. Among them, the L4 proxy stores the association relationship between the L7 proxy and the tenant, and the L7 proxy associated with the tenant includes the configuration information of the services of this tenant. The L4 proxy 130 can obtain the L7 proxy associated with tenant A1 based on the identifier of tenant A1 and the association relationship between the L7 proxy and the tenant, that is, obtain the L7 proxy that includes the configuration information of the services of tenant A1.

[0126] In some embodiments, tenant A1 may have multiple services, and the configuration information of these multiple services may be in different L7 proxies. That is to say, it is possible that not all L7 proxies that include the services of tenant A1 include the configuration information of service A11. In step 603, filter out the L7 proxy that includes the configuration information of service A11 of tenant A1. Among them, the L7 proxies that include the configuration information of the services of tenant A1 can be filtered out first based on the identifier of tenant A1. Then, based on the identifier of service A11, filter out the L7 proxies that include the configuration information of service A11 from the L7 proxies that include the configuration information of the services of tenant A1.

[0127] When there is only one L7 proxy that includes the configuration information of service A11, the L7 proxy that includes the configuration information of service A11 of tenant A1 is used as the target L7 proxy of the data packet 111.

[0128] When there are multiple L7 proxies that include the configuration information of service A11, the L4 proxy 130 can select the target L7 proxy of the data packet 111 from these multiple L7 proxies.

[0129] In some embodiments, the more services supported by the L7 proxy for tenant A1, the greater the likelihood that the L7 proxy becomes the target L7 proxy for data packet 111. Herein, an L7 proxy supporting a service means that the L7 proxy includes the configuration information of the service. That is to say, an L7 proxy including the configuration information of a certain service can be referred to as the L7 proxy supporting the service. For example, L7 proxy 310 includes the configuration information of N services, L7 proxy 320 includes the configuration information of M services, and both the N services and the M services include service A11. Herein, both N and M are integers greater than or equal to 1. When the number of services belonging to tenant A1 among the N services is greater than the number of services belonging to tenant A1 among the M services, L4 proxy 130 selects L7 proxy 310 as the target L7 proxy for data packet 111. That is to say, when the number of services belonging to tenant A1 supported by L7 proxy 310 is greater than the number of services belonging to tenant A1 supported by L7 proxy 320, L7 proxy 310 is used as the target L7 proxy for data packet 111.

[0130] In some embodiments, the lower the load of the L7 proxy, the greater the likelihood that the L7 proxy becomes the target L7 proxy for data packet 111. For example, both L7 proxy 310 and L7 proxy 320 include the configuration information of service A11. When the load of L7 proxy 320 is greater than the load of L7 proxy 310, L7 proxy 310 is used as the target L7 proxy for data packet 111. Herein, the load of the L7 proxy can be represented by the ratio of the used capacity to the maximum capacity of the L7 proxy. This ratio is positively correlated with the load of the L7 proxy. In one example, the maximum capacity refers to the maximum number of connections, and the used capacity refers to the number of used connections or the actual number of connections. Herein, the connection refers to the connection between the L7 proxy and the service container group that sends the data packet. Specifically, the data packets for which the L7 proxy performs traffic management are sent by the service container group. When the L4 proxy selects an L7 proxy to perform traffic management on the data packets sent by a certain service container group, the L4 proxy establishes a connection between the L7 proxy and the service container group. Therefore, the maximum number of connections can also be referred to as the maximum number of service container groups that the L7 proxy can connect to at most, and the number of used connections can also be referred to as the number of service container groups that the L7 proxy has connected to. In one example, the maximum capacity refers to the maximum number of data packets that the L7 proxy can receive at most per unit time, and the used capacity refers to the number of data packets that the L7 proxy actually receives per unit time.

[0131] In some embodiments, the scheduling coefficient of each L7 proxy including the configuration information of service A11 can be calculated, and then the L7 proxy with the largest scheduling coefficient is used as the target L7 proxy for data packet 111. The calculation formula for the scheduling coefficient is as follows.

[0132] Scheduling coefficient of the L7 proxy = weight of the tenant × (number of services belonging to tenant A1 among the services supported by the L7 proxy / total number of services supported by the L7 proxy) × (1 - used capacity of the L7 proxy / maximum capacity of the L7 proxy).

[0133] Among them, the weight of the tenant can be a preset value. The administrator can set different weights for different L7 proxies for a certain tenant to set the priority for traffic management of the data packets of the services of this tenant by the L7 proxy.

[0134] Through the above method, the target L7 proxy for data packet 111 can be obtained.

[0135] It can be set that the target L7 proxy for the obtained data packet 111 is L7 proxy 310. The L4 proxy 130 sends the data packet 111 and the identifier of tenant A1 to the L7 proxy 310 through step 605. In some embodiments, the L4 proxy 130 can send the data packet 111 and the identifier of tenant A1 to the L7 proxy 310 through a destination network address translation (DNAT) operation.

[0136] In step 606, the L7 proxy can identify the configuration information of the services of tenant A1 from the configuration information of multiple services included in the L7 proxy 310 based on the identifier of tenant A1. As described above, there is an association relationship between the identifier of tenant A1 and the configuration information of the services of tenant A1. The L7 proxy can identify the configuration information of the services of tenant A1 based on this association relationship and the identifier of tenant A1.

[0137] Next, in step 607, the L7 proxy can perform traffic management on the data packet 111 based on the configuration information of the services of tenant A1 identified in step 606.

[0138] Among them, the data packet 111 is the data packet of service A11 of tenant A1. If the configuration information of the services of tenant A1 identified in step 606 is the configuration information of this service A11, then in step 607, traffic management can be directly performed on the data packet 111 based on the configuration information of the services of tenant A1 identified in step 606.

[0139] If the configuration information of the services of tenant A1 identified in step 606 includes not only the configuration information of this service A11 but also the configuration information of other services of tenant A1, then in step 607, first identify the configuration information of this service A11 from the configuration information of the services of tenant A1 identified in step 606. Then, based on the configuration information of this service A11, perform traffic management on the data packet 111.

[0140] Among them, the data packet 111 includes the identifier of the service requested by the data packet 111, that is, the identifier of service A11. The L7 proxy 310 can parse the data packet 111 to obtain the identifier of service A11. Then, based on the identifier of service A11, the L7 proxy 310 identifies the configuration information of service A11 from the configuration information of the services of tenant A1 identified in step 606. Specifically, as described above, there is an association relationship between the identifier of a service and the configuration information of the service. The L7 proxy 310 can identify the configuration information of service A11 based on this association relationship and the identifier of service A11.

[0141] In some embodiments, the traffic management of the L7 proxy 310 for the data packet 111 may include: selecting a target service instance for the data packet 111. For example, if the data packet 111 is a service request, the L7 proxy 310 can select a service instance for executing the service request. It can be set that the L7 proxy 310 selects the service container group 210 as the target service instance for the data packet 111, that is, selects the service containers in the service container group 210 to process the data packet 111. At this time, the L7 proxy 310 can, through step 608, send the data packet 111 to the L4 proxy (i.e., L4 proxy 230) in the service node where the service container group 210 is located (i.e., service node 200). In step 610, the L4 proxy 230, as the L4 proxy in the outbound direction of the service mesh, can forward the received data packet 111 to the service container group 210. In some embodiments, the L4 proxy 230 can send the data packet 111 to the service container group 210 through DNAT operation.

[0142] In some embodiments, in step 608, the L7 proxy 310 sends the data packet 111 and the identifier of tenant A1 to the L4 proxy 230. The L4 proxy 230 can execute step 609 to verify whether tenant A1 and the tenant to which the service container group 210 belongs are the same based on the identifier of tenant A1. Specifically, when the L7 proxy 310 selects the service container group 210 as the service instance for the data packet 111, it can add the identifier of the service container group 210 to the data packet 111. For example, the identifier of the service container group 210 is the address of the service container group 210, and the L7 proxy 310 adds the address of the service container group 210 to the field corresponding to the destination address of the data packet 111. The L4 proxy 230 can parse the data packet 111 to obtain the identifier of the service container group 210. Then, the L4 proxy 230 can query the tenant to which the service container group 210 belongs in the grid console 400 based on the identifier of the service container group 210. In step 609, the L4 proxy 230 can determine whether the identifier of tenant A1 is the same as the identifier of the tenant to which the service container group 210 belongs. If they are the same, then tenant A1 and the tenant to which the service container group 210 belongs are the same. If they are not the same, then tenant A1 and the tenant to which the service container group 210 belongs are different.

[0143] The L4 proxy 230 performs step 610 only when it confirms that tenant A1 and the tenant to which the business container group 210 belongs are the same. This further ensures isolation between tenants.

[0144] In some embodiments, when the L4 proxy 230 confirms that tenant A1 and the tenant to which the business container group 210 belongs are different, the L4 proxy 230 may issue an alarm or an error message.

[0145] In some embodiments, in addition to supporting the services of tenant A1, the L7 proxy 310 also executes the services of other tenants, such as the services of tenant A2. That is to say, the L7 proxy 310 also includes the configuration information of the services of tenant A2. It can be set that the business container group 120 of tenant A2 runs in the business node 100. When the business container group 120 sends a data packet 121, the L4 proxy 130 may send the data packet 121 and the identifier of tenant A2 to the L7 proxy 310. The L7 proxy 310 may identify the configuration information of tenant A2 from the configuration information of multiple services included in the L7 proxy 310 based on the identifier of tenant A2. Then, the L7 proxy 310 may perform traffic management on the data packet 121 based on the configuration information of tenant A2. Exemplarily, through traffic management, the L7 proxy 310 selects the business container group 220 in the business node 200 as the target service instance for the data packet 121. The L7 proxy 310 sends the data packet 121 and the identifier of tenant A2 to the L4 proxy 230. The L4 proxy 230 sends the data packet 121 to the business container group 220 when it confirms that tenant A2 and the tenant to which the business container group 220 belongs are the same based on the identifier of tenant A2.

[0146] In summary, the same L7 proxy can perform traffic management on data packets of the services of multiple tenants, realizing multi-tenant sharing of the L7 proxy. This can improve the utilization rate of the computing resources of the L7 proxy, reduce the scheduling pressure of the L7 proxy, etc.

[0147] Based on the content described above, an embodiment of the present application further provides a traffic management method. This method can be executed by a first L7 proxy in a service mesh system. The service mesh system includes a first business node and a proxy cluster; wherein, the first business node runs a first L4 proxy and a first business container group of a first tenant; the first L7 proxy runs in the proxy cluster, the first L7 proxy includes the configuration information of multiple services, different services among the multiple services belong to the same tenant or different tenants, and the configuration information of the services is used for the first L7 proxy to perform traffic management on the data packets of the services. Wherein, the service mesh system here can be Figure 1In the service mesh system shown, the proxy cluster may be the proxy cluster 300 described above, the first L7 proxy may specifically be the L7 proxy 310 described above, the first service node may be the service node 100 described above, the first L4 proxy may be the L4 proxy 130 described above, and the first tenant may be the tenant A1 described above. As Figure 7 shown, the method includes the following steps.

[0148] Step 701, the first L7 proxy receives the identifier of the first tenant and a first data packet sent by the first L4 proxy, and the first data packet is received by the first L4 proxy from the first service container group. Among them, the first service container group may be the service container group 110 described above, and the first data packet may be the data packet 111 described above. The specific implementation manner of step 701 may refer to the introduction of steps 601 - 605 in Figure 6 above, which will not be elaborated here.

[0149] Step 702, the first L7 proxy identifies the configuration information of a first service in the configuration information of the multiple services based on the identifier of the first tenant, and the first service belongs to the first tenant. The specific implementation manner of step 702 may refer to the introduction of step 606 in Figure 6 above, which will not be elaborated here.

[0150] Step 703, the first L7 proxy performs traffic management on the first data packet based on the configuration information of the first service. The specific implementation manner of step 702 may refer to the introduction of step 607 in Figure 6 above, which will not be elaborated here.

[0151] In some embodiments, a second service container group of a second tenant also runs on the first service node; the method includes: the first L7 proxy receives the identifier of the second tenant and a second data packet sent by the first L4 proxy, and the second data packet is received by the first L4 proxy from the second service container group; the first L4 proxy sends the identifier of the second tenant and the second data packet to the first L7 proxy; the first L7 proxy identifies the configuration information of a second service in the configuration information of the multiple services based on the identifier of the second tenant, and the second service belongs to the second tenant; the first L7 proxy performs traffic management on the second data packet based on the configuration information of the second service. Among them, the second tenant may be the tenant A2 described above, the second service container group may be the service container group 120 described above, and the second data packet may be the data packet 121 described above.

[0152] In some embodiments, the first service includes the service corresponding to the first data packet and other services; the first L7 proxy performs traffic management on the first data packet based on the configuration information of the first service, including: the first L7 proxy identifies the configuration information of the service corresponding to the first data packet in the configuration information of the first service based on the identifier of the service corresponding to the first data packet; the first L7 proxy performs traffic management on the first data packet based on the configuration information of the service corresponding to the first data packet. Wherein, the service corresponding to the first data packet may be the service A11 described above. The specific implementation manner of this embodiment may refer to the introduction of Figure 6 step 606 above and will not be elaborated here.

[0153] In some embodiments, the proxy cluster also runs a second L7 proxy, and the second L7 proxy includes the configuration information of at least one service; the first L7 proxy receives the identifier of the first tenant and the first data packet sent by the first L4 proxy, including: when the number of services belonging to the first tenant among the multiple services is greater than the number of services belonging to the first tenant among the at least one service, the first L7 proxy receives the identifier of the first tenant and the first data packet sent by the first L4 proxy. Wherein, the second L7 proxy may be the L7 proxy 320 described above. The specific implementation manner of this embodiment may refer to the introduction of Figure 6 steps 603 - 605 above and will not be elaborated here.

[0154] In some embodiments, the proxy cluster also runs a second L7 proxy, and the second L7 proxy also includes the configuration information of the first service; the first L7 proxy receives the identifier of the first tenant and the first data packet sent by the first L4 proxy, including: when the load of the second L7 proxy is greater than the load of the first L7 proxy, the first L7 proxy receives the identifier of the first tenant and the first data packet sent by the first L4 proxy. Wherein, the second L7 proxy may be the L7 proxy 320 described above. The specific implementation manner of this embodiment may refer to the introduction of Figure 6 steps 603 - 605 above and will not be elaborated here.

[0155] In some embodiments, the service mesh system further includes: a console connected to the proxy cluster; the method further includes: the first L7 proxy receives and records the configuration information of two or more services from the console; wherein, the two or more services belong to the same tenant, or the output of one service among the two or more services is the input of another service. The specific implementation manner of this embodiment may refer to the introduction of Figures 3 - 5The introduction of the illustrated embodiments will not be elaborated here.

[0156] In some embodiments, the service mesh system further includes a second service node, on which a second L4 proxy and a third service container group are running; based on the configuration information of the first service, the first L7 proxy performs traffic management on the first data packet, including: the first L7 proxy selects the third service container group as the target container group for the first data packet; the first L7 proxy sends the first data packet and the identifier of the first tenant to the second L4 proxy; wherein, the second L4 proxy is configured to: based on the identifier of the first tenant, confirm that the first tenant and the tenant to which the third service container group belongs are the same tenant; send the first data packet to the third service container group. The second service node may be the service node 200 described above, and the third service container group may also be the service container group 210 described above. The specific implementation manner of this embodiment may refer to the introduction of Figure 6 Steps 608 - 610 in the above, which will not be elaborated here.

[0157] Through the above method, the same L7 proxy can include the configuration information of services of multiple tenants. When traffic management needs to be performed on the data packets of a tenant's service, the L7 proxy obtains the identifier of the tenant, and based on the identifier of the tenant, obtains the configuration information of the tenant's service from the configuration information of services of multiple tenants, and then can perform traffic management on the data packets of the tenant's service based on the configuration information of the tenant's service. In this way, the same L7 proxy can perform traffic management on the data packets of services of multiple tenants, realizing multi-tenant sharing of the L7 proxy. Multi-tenant sharing of the L7 proxy can improve the utilization rate of the computing resources of the L7 proxy, reduce the scheduling pressure of the L7 proxy, etc.

[0158] Referring to Figure 8 , an embodiment of the present application provides a traffic management device 800. Among them, the device 800 is configured in the first L7 proxy in the service mesh system, and the service mesh system includes a first service node and a proxy cluster; wherein, the first service node runs a first L4 proxy and a first service container group of a first tenant; the first L7 proxy runs in the proxy cluster, and the first L7 proxy includes the configuration information of multiple services, and different services among the multiple services belong to the same tenant or different tenants, and the configuration information of the service is used for the first L7 proxy to perform traffic management on the data packets of the service. As Figure 8 shown, the device 800 includes:

[0159] A receiving module 810, configured to receive the identifier of the first tenant and the first data packet sent by the first L4 proxy, where the first data packet is received by the first L4 proxy from the first service container group;

[0160] An identification module 820, configured to identify configuration information of a first service from the configuration information of the multiple services based on the identification of the first tenant, where the first service belongs to the first tenant;

[0161] A management module 830, configured to perform traffic management on the first data packet based on the configuration information of the first service.

[0162] In some embodiments, a second service container group of a second tenant also runs on the first service node; the receiving module 810 is further configured to: receive the identification of the second tenant and a second data packet sent by the first L4 proxy, where the second data packet is received by the first L4 proxy from the second service container group; the identification module 820 is further configured to: identify configuration information of a second service from the configuration information of the multiple services based on the identification of the second tenant, where the second service belongs to the second tenant; the management module 830 is further configured to: perform traffic management on the second data packet based on the configuration information of the second service.

[0163] In some embodiments, the first service includes the service corresponding to the first data packet and other services; the management module 830 is configured to: identify the configuration information of the service corresponding to the first data packet from the configuration information of the first service based on the identification of the service corresponding to the first data packet; perform traffic management on the first data packet based on the configuration information of the service corresponding to the first data packet.

[0164] In some embodiments, a second L7 proxy also runs on the proxy cluster, and the second L7 proxy includes configuration information of at least one service; the receiving module 810 is configured to: when the number of services belonging to the first tenant among the multiple services is greater than the number of services belonging to the first tenant among the at least one service, receive the identification of the first tenant and the first data packet sent by the first L4 proxy.

[0165] In some embodiments, a second L7 proxy also runs on the proxy cluster, and the second L7 proxy also includes the configuration information of the first service; the receiving module 810 is configured to: when the load of the second L7 proxy is greater than the load of the first L7 proxy, receive the identification of the first tenant and the first data packet sent by the first L4 proxy.

[0166] In some embodiments, the service mesh system further includes: a console connected to the proxy cluster; the receiving module 810 is configured to: receive and record the configuration information of two or more services from the console; wherein, the two or more services belong to the same tenant, or, the output of one of the two or more services is the input of another service.

[0167] In some embodiments, the service mesh system further includes a second service node, and the second service node runs a second L4 proxy and a third service container group; the management module 830 is configured to: the first L7 proxy selects the third service container group as the target container group for the first data packet; the first L7 proxy sends the first data packet and the identifier of the first tenant to the second L4 proxy; wherein, the second L4 proxy is configured to: based on the identifier of the first tenant, confirm that the first tenant and the tenant to which the third service container group belongs are the same tenant; send the first data packet to the third service container group.

[0168] Among them, the receiving module 810, the recognition module 820, and the management module 830 can all be implemented by software or by hardware. Exemplarily, next, taking the receiving module 810 as an example, the implementation manner of the receiving module 810 will be introduced. Similarly, the implementation manners of the recognition module 820 and the management module 830 can refer to the implementation manner of the receiving module 810.

[0169] As an example of a software functional unit, the receiving module 810 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above computing instance may be one or more. For example, the receiving module 810 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers for running this code may be distributed in the same region or in different regions. Further, the multiple hosts / virtual machines / containers for running this code may be distributed in the same availability zone AZ or in different AZs, and each AZ includes one data center or multiple geographically proximate data centers. Among them, generally one region may include multiple AZs.

[0170] Similarly, the multiple hosts / virtual machines / containers for running this code may be distributed in the same VPC or in multiple VPCs. Among them, generally one VPC is set within one region. For cross-region communication between two VPCs within the same region and between VPCs in different regions, a communication gateway needs to be set in each VPC, and the interconnection between VPCs is achieved through the communication gateway.

[0171] As an example of a hardware functional unit, the receiving module 810 may include at least one computing device, such as a server, etc. Alternatively, the receiving module 810 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). Among them, the above PLD may be implemented by a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0172] The multiple computing devices included in the receiving module 810 may be distributed in the same region or in different regions. The multiple computing devices included in the receiving module 810 may be distributed in the same availability zone (AZ) or in different AZs. Similarly, the multiple computing devices included in the receiving module 810 may be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Among them, the multiple computing devices may be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0173] It should be noted that in other embodiments, the receiving module 810 may be used to execute Figure 7 any step in the method shown, the identification module 820 may be used to execute Figure 7 any step in the method shown, and the management module 830 may be used to execute Figure 7 any step in the method shown. The steps to be implemented by the receiving module 810, the identification module 820, and the management module 830 can be specified as needed, and all functions of the traffic management device 800 are implemented by respectively implementing Figure 7 different steps in the method shown.

[0174] This application also provides a computing device 900. As Figure 9 shown, the computing device 900 includes: a bus 902, a processor 904, a memory 906, and a communication interface 908. The processor 904, the memory 906, and the communication interface 908 communicate with each other through the bus 902. The computing device 900 may be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device 900.

[0175] The bus 902 can be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The bus can be divided into an address bus, a data bus, a control bus, etc. For the sake of representation, Figure 9 only one line is used in Figure 9 , but it does not mean that there is only one bus or one type of bus. The bus 902 can include a path for transmitting information between various components of the computing device 900 (e.g., the memory 906, the processor 904, the communication interface 908).

[0176] The processor 904 can include any one or more of processors such as a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), a Micro Processor (MP), or a Digital Signal Processor (DSP).

[0177] The memory 906 can include volatile memory, such as Random Access Memory (RAM). The memory 906 can also include non-volatile memory, such as Read-Only Memory (ROM), flash memory, a Hard Disk Drive (HDD), or a Solid State Drive (SSD).

[0178] The memory 906 stores executable program code, and the processor 904 executes the executable program code to respectively implement the functions of the foregoing receiving module 810, identifying module 820, and management module 830, thereby implementing Figure 7 the method shown. That is, the memory 906 stores instructions for executing Figure 7 the method shown.

[0179] The communication interface 908 uses a transceiver module such as, but not limited to, a network interface card, a transceiver, to implement communication between the computing device 900 and other devices or a communication network.

[0180] The embodiments of the present application also provide a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.

[0181] As Figure 10 shown, the computing device cluster includes at least one computing device 900. Instructions for executing the Figure 7 shown method can be stored in the memories 906 of one or more of the computing devices 900 in the computing device cluster.

[0182] In some possible implementation manners, instructions for executing the Figure 7 shown method can also be stored separately in the memories 906 of one or more of the computing devices 900 in the computing device cluster. In other words, a combination of one or more computing devices 900 can jointly execute the instructions for executing the Figure 7 shown method.

[0183] It should be noted that the memories 906 in different computing devices 900 in the computing device cluster can store different instructions, which are respectively used to execute some functions of the traffic management device 800. That is, the instructions stored in the memories 906 of different computing devices 900 can implement the functions of one or more of the receiving module 810, the identifying module 820, and the management module 830.

[0184] In some possible implementation manners, one or more computing devices in the computing device cluster can be connected through a network. Among them, the network can be a wide area network or a local area network, etc. Figure 11 shows a possible implementation manner. As Figure 11 shown, two computing devices 900A and 900B are connected through a network. Specifically, they are connected to the network through the communication interfaces in each computing device. In this type of possible implementation manner, instructions for executing the function of the receiving module 810 are stored in the memory 906 of the computing device 900A. At the same time, instructions for executing the functions of the identifying module 820 and the management module 830 are stored in the memory 906 of the computing device 900B.

[0185] It should be understood that Figure 11 the function of the computing device 900A shown in

[0186] The embodiments of the present application also provide another computing device cluster. The connection relationship between the computing devices in the computing device cluster can be similarly referred to Figure 10 and Figure 11 the connection manner of the computing device cluster. The difference is that the memory 906 in one or more computing devices 900 in the computing device cluster may store the same instructions for executing Figure 7 the method shown.

[0187] In some possible implementation manners, the memory 906 in one or more computing devices 900 in the computing device cluster may also separately store partial instructions for executing Figure 7 the method shown. In other words, the combination of one or more computing devices 900 can jointly execute the instructions for executing Figure 7 the method shown.

[0188] The embodiments of the present application also provide a computer program product containing instructions. The computer program product may be software or a program product containing instructions that can run on a computing device or be stored in any available medium. When the computer program product runs on at least one computing device, it causes at least one computing device to execute Figure 7 the method shown.

[0189] The embodiments of the present application also provide a computer-readable storage medium. The computer-readable storage medium may be any available medium that a computing device can store or a host migration device such as a data center containing one or more available media. The available medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid-state drive), etc. The computer-readable storage medium includes instructions that instruct the computing device to execute Figure 7 the method shown.

[0190] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and are not intended to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A traffic management method, characterized in that: The method is applied to a service grid system, the service grid system includes a first service node and an agent cluster; wherein the first service node runs a first transport layer L4 agent and a first service container group of a first tenant; the agent cluster runs a first application layer L7 agent, the first L7 agent includes configuration information of multiple services, different services in the multiple services belong to the same tenant or different tenants, and the configuration information of the service is used by the first L7 agent to perform traffic management on the data packets of the service; the method includes: The first L4 agent receives a first data packet sent by the first service container group; The first L4 agent sends the identifier of the first tenant and the first data packet to the first L7 agent; The first L7 agent identifies, based on the identifier of the first tenant, configuration information of a first service from the configuration information of the plurality of services, the first service belonging to the first tenant; The first L7 agent performs traffic management on the first data packet based on the configuration information of the first service.

2. The method according to claim 1, characterized in that The first service node also runs a second service container group of a second tenant; and the method includes: The first L4 agent receives a second data packet sent by the second service container group; The first L4 agent sends the identifier of the second tenant and the second data packet to the first L7 agent; The first L7 agent identifies, based on the identifier of the second tenant, configuration information of a second service from the configuration information of the plurality of services, where the second service belongs to the second tenant; The first L7 agent performs traffic management on the second data packet based on the configuration information of the second service.

3. The method according to claim 1 or 2, characterized in that: The first service includes the service corresponding to the first data packet and other services; The first L7 agent performs traffic management on the first data packet based on the configuration information of the first service, including: The first L7 agent identifies, based on the identifier of the service corresponding to the first data packet, the configuration information of the service corresponding to the first data packet in the configuration information of the first service; The first L7 agent performs traffic management on the first data packet based on configuration information of a service corresponding to the first data packet.

4. The method according to claim 3, characterized in that The proxy cluster runs multiple L7 proxies; The first L4 agent sends the identifier of the first tenant and the first data packet to the first L7 agent, including: The first L4 agent identifies, from the plurality of L7 agents, an L7 agent including configuration information of the service of the first tenant based on the identifier of the first tenant; The first L4 agent identifies, based on the identifier of the service corresponding to the first data packet, an L7 agent including the configuration information of the service corresponding to the first data packet from the L7 agents including the configuration information of the service of the first tenant, and obtains the first L7 agent.

5. The method according to any one of claims 1 to 4, characterized in that The proxy cluster also runs a second L7 proxy, wherein the second L7 proxy includes configuration information of at least one service; The first L4 agent sends the identifier of the first tenant and the first data packet to the first L7 agent, including: When the number of services belonging to the first tenant in the multiple services is greater than the number of services belonging to the first tenant in the at least one service, the first L4 agent sends the identifier of the first tenant and the first data packet to the first L7 agent.

6. The method according to any one of claims 1 to 4, characterized in that The proxy cluster also runs a second L7 proxy, and the second L7 proxy also includes configuration information of the first service; The first L4 agent sends the identifier of the first tenant and the first data packet to the first L7 agent, including: When the load of the second L7 agent is greater than the load of the first L7 agent, the first L4 agent sends the identifier of the first tenant and the first data packet to the first L7 agent.

7. The method according to any one of claims 1 to 6, characterized in that The service grid system further comprises: a console connected to the proxy cluster; The method also includes: the console sending configuration information of two or more services to the same L7 agent in the agent cluster; wherein the two or more services belong to the same tenant, or the output of one of the two or more services is the input of another service.

8. The method according to claim 7, characterized in that The proxy cluster runs multiple L7 proxies; wherein, among the multiple L7 proxies, the same L7 proxy includes configuration information of a minimum number of services, or the same L7 proxy includes configuration information of a minimum number of tenants.

9. The method according to any one of claims 1 to 8, characterized in that The service grid system further includes a second service node, wherein the second service node runs a second L4 proxy and a third service container group; The first L7 agent performs traffic management on the first data packet based on the configuration information of the first service, including: The first L7 proxy selects the third service container group as the target container group of the first data packet; The first L7 agent sends the first data packet and the identifier of the first tenant to the second L4 agent; The method further comprises: The second L4 agent confirms, based on the identifier of the first tenant, that the first tenant and the tenant to which the third service container group belongs are the same tenant; The second L4 agent sends the first data packet to the third service container group.

10. A service grid system, characterized in that: The service grid system includes a first service node and an agent cluster; wherein the first service node runs a first L4 agent and a first service container group of a first tenant; the agent cluster runs a first L7 agent, the first L7 agent includes configuration information of multiple services, different services in the multiple services belong to the same tenant or different tenants, and the configuration information of the service is used by the first L7 agent to perform traffic management on the data packets of the service; wherein, The first L4 agent is used to: receive a first data packet sent by the first service container group; The first L4 agent is used to: send the identifier of the first tenant and the first data packet to the first L7 agent; The first L7 agent is used to: identify, based on the identifier of the first tenant, configuration information of a first service from the configuration information of the multiple services, the first service belonging to the first tenant; The first L7 agent is used to: perform traffic management on the first data packet based on configuration information of the first service.

11. The service grid system according to claim 10, characterized in that: The first service node also runs a second service container group of a second tenant; The first L4 agent is further used to: receive a second data packet sent by the second service container group; The first L4 agent is further used to: send the identifier of the second tenant and the second data packet to the first L7 agent; The first L7 agent is further used to: identify, based on the identifier of the second tenant, configuration information of a second service in the configuration information of the plurality of services, the second service belonging to the second tenant; The first L7 agent is further used to: perform traffic management on the second data packet based on the configuration information of the second service.

12. The service grid system according to claim 10 or 11, characterized in that: The first service includes the service corresponding to the first data packet and other services; The first L7 proxy is used to: Based on the identifier of the service corresponding to the first data packet, identifying the configuration information of the service corresponding to the first data packet in the configuration information of the first service; Based on the configuration information of the service corresponding to the first data packet, traffic management is performed on the first data packet.

13. The service grid system according to any one of claims 10 to 12, characterized in that: The proxy cluster also runs a second L7 proxy, wherein the second L7 proxy includes configuration information of at least one service; The first L4 agent is configured to send the identifier of the first tenant and the first data packet to the first L7 agent when the number of services belonging to the first tenant in the multiple services is greater than the number of services belonging to the first tenant in the at least one service.

14. The service grid system according to any one of claims 10 to 12, characterized in that: The proxy cluster also runs a second L7 proxy, and the second L7 proxy also includes configuration information of the first service; The first L4 agent is used for sending the identifier of the first tenant and the first data packet to the first L7 agent when the load of the second L7 agent is greater than the load of the first L7 agent.

15. The service grid system according to any one of claims 10 to 14, characterized in that: The service grid system further comprises: a console connected to the proxy cluster; The console is used to send configuration information of two or more services to the same L7 agent in the agent cluster; wherein the two or more services belong to the same tenant, or the output of one of the two or more services is the input of another service.

16. The service grid system according to any one of claims 10-15, characterized in that: The service grid system further includes a second service node, wherein the second service node runs a second L4 proxy and a third service container group; The first L7 proxy is used to: Selecting the third service container group as the target container group of the first data packet; Sending the first data packet and the identifier of the first tenant to the second L4 agent; The second L4 proxy is used to: Based on the identifier of the first tenant, confirm that the first tenant and the tenant to which the third business container group belongs are the same tenant; The first data packet is sent to the third service container group.

17. A traffic management method, characterized in that: The method is applied to a first L7 agent in a service grid system, the service grid system comprising a first service node and an agent cluster; wherein the first service node runs a first L4 agent and a first service container group of a first tenant; the first L7 agent runs in the agent cluster, the first L7 agent comprises configuration information of a plurality of services, different services in the plurality of services belong to the same tenant or different tenants, and the configuration information of the service is used by the first L7 agent to perform traffic management on data packets of the service; the method comprises: The first L7 agent receives the identifier of the first tenant and a first data packet sent by the first L4 agent, where the first data packet is received by the first L4 agent from the first service container group; The first L7 agent identifies, based on the identifier of the first tenant, configuration information of a first service from the configuration information of the plurality of services, the first service belonging to the first tenant; The first L7 agent performs traffic management on the first data packet based on the configuration information of the first service.

18. The method according to claim 17, characterized in that The first service node also runs a second service container group of a second tenant; and the method includes: The first L7 agent receives the identifier of the second tenant and a second data packet sent by the first L4 agent, where the second data packet is received by the first L4 agent from the second service container group; The first L4 agent sends the identifier of the second tenant and the second data packet to the first L7 agent; The first L7 agent identifies, based on the identifier of the second tenant, configuration information of a second service from the configuration information of the plurality of services, where the second service belongs to the second tenant; The first L7 agent performs traffic management on the second data packet based on the configuration information of the second service.

19. The method according to claim 17 or 18, characterized in that The first service includes the service corresponding to the first data packet and other services; The first L7 agent performs traffic management on the first data packet based on the configuration information of the first service, including: The first L7 agent identifies, based on the identifier of the service corresponding to the first data packet, the configuration information of the service corresponding to the first data packet in the configuration information of the first service; The first L7 agent performs traffic management on the first data packet based on configuration information of a service corresponding to the first data packet.

20. The method according to any one of claims 17 to 19, characterized in that The proxy cluster also runs a second L7 proxy, wherein the second L7 proxy includes configuration information of at least one service; The first L7 agent receives the identifier of the first tenant and the first data packet sent by the first L4 agent, including: When the number of services belonging to the first tenant in the multiple services is greater than the number of services belonging to the first tenant in the at least one service, the first L7 agent receives the identifier of the first tenant and the first data packet sent by the first L4 agent.

21. The method according to any one of claims 17 to 20, characterized in that The proxy cluster also runs a second L7 proxy, and the second L7 proxy also includes configuration information of the first service; The first L7 agent receives the identifier of the first tenant and the first data packet sent by the first L4 agent, including: When the load of the second L7 agent is greater than the load of the first L7 agent, the first L7 agent receives the identifier of the first tenant and the first data packet sent by the first L4 agent.

22. The method according to any one of claims 17 to 21, characterized in that The service grid system further comprises: a console connected to the proxy cluster; The method also includes: the first L7 agent receives and records configuration information of two or more services from the console; wherein the two or more services belong to the same tenant, or the output of one of the two or more services is the input of another service.

23. The method according to any one of claims 17 to 22, characterized in that The service grid system further includes a second service node, wherein the second service node runs a second L4 proxy and a third service container group; The first L7 agent performs traffic management on the first data packet based on the configuration information of the first service, including: The first L7 proxy selects the third service container group as the target container group of the first data packet; The first L7 agent sends the first data packet and the identifier of the first tenant to the second L4 agent; Wherein, the second L4 agent is used for: Based on the identifier of the first tenant, confirm that the first tenant and the tenant to which the third business container group belongs are the same tenant; The first data packet is sent to the third service container group.

24. A flow management device, characterized in that: The device is configured in a first L7 agent in a service grid system, the service grid system includes a first service node and an agent cluster; wherein the first service node runs a first L4 agent and a first service container group of a first tenant; the first L7 agent runs in the agent cluster, the first L7 agent includes configuration information of multiple services, different services in the multiple services belong to the same tenant or different tenants, and the configuration information of the service is used by the first L7 agent to perform traffic management on data packets of the service; the device includes: a receiving module, configured to receive an identifier of the first tenant and a first data packet sent by the first L4 agent, where the first data packet is received by the first L4 agent from the first service container group; an identification module, configured to identify, based on the identifier of the first tenant, configuration information of a first service from the configuration information of the plurality of services, the first service belonging to the first tenant; A management module is used to perform traffic management on the first data packet based on the configuration information of the first service.

25. The device according to claim 24, characterized in that The first service node also runs a second service container group of a second tenant; The receiving module is further used to: receive the identifier of the second tenant and a second data packet sent by the first L4 agent, where the second data packet is received by the first L4 agent from the second service container group; The identification module is further used to: identify the configuration information of the second service in the configuration information of the plurality of services based on the identifier of the second tenant, the second service belonging to the second tenant; The management module is further used to: perform traffic management on the second data packet based on the configuration information of the second service.

26. The device according to claim 24 or 25, characterized in that The first service includes the service corresponding to the first data packet and other services; The management module is used for: Based on the identifier of the service corresponding to the first data packet, identifying the configuration information of the service corresponding to the first data packet in the configuration information of the first service; Based on the configuration information of the service corresponding to the first data packet, traffic management is performed on the first data packet.

27. The device according to any one of claims 24 to 26, characterized in that The proxy cluster also runs a second L7 proxy, wherein the second L7 proxy includes configuration information of at least one service; The receiving module is used to: when the number of services belonging to the first tenant in the multiple services is greater than the number of services belonging to the first tenant in the at least one service, receive the identifier of the first tenant and the first data packet sent by the first L4 agent.

28. The device according to any one of claims 24 to 26, characterized in that The proxy cluster also runs a second L7 proxy, and the second L7 proxy also includes configuration information of the first service; The receiving module is used for: when the load of the second L7 agent is greater than the load of the first L7 agent, receiving the identifier of the first tenant and the first data packet sent by the first L4 agent.

29. The device according to any one of claims 24 to 28, characterized in that The service grid system further comprises: a console connected to the proxy cluster; The receiving module is used to: receive and record configuration information of two or more services from the console; wherein the two or more services belong to the same tenant, or the output of one of the two or more services is the input of another service.

30. The device according to any one of claims 24 to 29, characterized in that The service grid system further includes a second service node, wherein the second service node runs a second L4 proxy and a third service container group; The management module is used for: The first L7 proxy selects the third service container group as the target container group of the first data packet; The first L7 agent sends the first data packet and the identifier of the first tenant to the second L4 agent; Wherein, the second L4 agent is used for: Based on the identifier of the first tenant, confirm that the first tenant and the tenant to which the third business container group belongs are the same tenant; The first data packet is sent to the third service container group.

31. A computing device cluster, characterized in that: comprising at least one computing device, each computing device comprising a processor and a memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 17 to 23.

32. A computer-readable storage medium, characterized in that: The method comprises computer program instructions, which, when executed by a computing device cluster, perform the method as claimed in any one of claims 17 to 23.

33. A computer program product comprising instructions, characterized in that When the instructions are executed by a computer device cluster, the computer device cluster executes the method according to any one of claims 17 to 23.

Images