Application layer service traffic communication using data center network fabric as proxy

Abstract

A system for providing services for microservice applications is described herein. In one embodiment, the system includes multiple container environments, each of which includes a host node. A virtual fabric edge instance executes on each host node. The host nodes are interconnected through multiple switches. A fabric controller manages the multiple switches and implements policies through the virtual fabric edge instance executed on each host node. The fabric controller also provides services to the application instance through the virtual fabric edge instance by routing traffic, data, queries from an application or proxy instance to another application or proxy instance in the container environment through the virtual fabric edge instance.

Description

[0001] This application was filed as a PCT international patent application on January 3, 2020, and claims the benefit of priority to U.S. Provisional Patent Application Serial No. 62 / 243,945 filed on January 9, 2019, the entire disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0002] One technical area of ​​the present disclosure is the deployment of a data center structure. Another technical area is the implementation of a service mesh for microservices deployed in a data center. Background Art

[0003] The approaches described in this section are approaches that could be taken, but not necessarily approaches that have been previously conceived or taken. Therefore, unless otherwise indicated, it should not be assumed that any approach described in this section is considered prior art simply because it is included in this section.

[0004] In the modern service-oriented architectural paradigm, there is increasing interest in using service meshes to provide layer 7 services for microservice applications. For example, a microservice application executing on different host nodes in a data center may require health checks for the application, service discovery for the application, or global rate limiting for the application.

[0005] Sidecar proxies are often used to provide commonly needed layer 7 services to applications. A sidecar proxy is a proxy instance dedicated to a specific application instance and communicates with other sidecar proxies executing on different nodes to obtain information about that application.

[0006] Sidecar proxies are often used due to their practicality and reliability in providing the required services. For example, an intermediate proxy is not close enough to the workload to obtain information about the application instance without sending queries to each node. Additionally, the intermediate proxy may be a single point of failure among multiple nodes. Sidecar proxies address these issues by operating in conjunction with the application instances and providing a distributed source of information so that the failure of one point does not bring down the entire system.

[0007] The sidecar proxy also allows microservices to be multi-tenanted by providing a separate sidecar proxy for each application instance. If end-to-end encryption is required, the sidecar proxy can perform encryption or decryption on behalf of the microservice application.

[0008] The main problem with sidecar proxies is that they are inefficient in getting information about application instances (executing on other nodes). Since there is no central repository for application information, the sidecar proxy must communicate with the sidecar proxy on each node that executes an application instance for a microservice application to get information about things like global rate limits, service discovery, or the overall health of discovered services.

[0009] Therefore, there is a need for a system that efficiently provides services for Layer 7 applications close to the workload, avoids single points of failure, provides capabilities for multi-tenancy, and provides end-to-end encryption of application traffic. Summary of the invention

[0010] The following claims serve as the inventive summary of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In the attached picture:

[0012] Figure 1 Depicted is an example system for providing a middle proxy for a service mesh of containerized microservices in a datacenter deployment.

[0013] Figure 2 A method for providing a middle proxy for a service mesh of containerized microservices in a data center deployment is described.

[0014] Figure 3 is a block diagram illustrating an example computer system that can be used to implement embodiments. DETAILED DESCRIPTION

[0015] In the following description, for the purpose of explanation, many specific details are set forth in order to provide a thorough understanding of the present invention. However, it will be apparent that the present invention can be practiced without these specific details. In other examples, in order to avoid unnecessarily obscuring the present invention, well-known structures and devices are shown in the form of block diagrams.

[0016] 1. General Overview

[0017] This document describes a method for improving the implementation of a service mesh by leveraging a data center fabric. According to one embodiment, a data center fabric is managed by a fabric controller that communicates with a virtual fabric edge executing on a host node in a data center. Application traffic from microservice application instances is routed through the virtual fabric edge, giving the fabric controller global visibility into the services and traffic flows being executed. The fabric controller can provide policies or statistics for the service mesh agent to implement through the virtual fabric edge. End-to-end encryption can be performed through API interactions between the fabric controller and the container orchestrator. Multi-tenancy can be provided by using a VxLAN overlay provided by the virtual fabric edge when routing outgoing traffic.

[0018] In one embodiment, a system includes multiple container environments, each container environment includes a host node; multiple switches configured to interconnect the multiple container environments; a fabric controller configured to manage the multiple switches and implement policies through a virtual fabric edge instance executed on each host node; the fabric controller is further configured to implement application functions through the virtual fabric edge by routing application traffic from application instances in the container environment through the virtual fabric edge instance.

[0019] In one embodiment, the application functionality includes one or more of a service discovery functionality or an application health check functionality.

[0020] In one embodiment, the system further comprises a service mesh agent executed in each of the plurality of container environments, the service mesh agent in each container environment being configured to query the virtual fabric edge instance for data about the application function. In one embodiment, the fabric controller is configured to: in response to the service mesh agent querying the virtual fabric edge instance for data about the application function, download the data about the application function to a switch connected to the container environment containing the service mesh agent.

[0021] In one embodiment, the virtual fabric edge instance is configured to use a VxLAN overlay to provide isolation between different application instances in a container environment.

[0022] In one embodiment, the fabric controller is further configured to obtain an encryption key for the application instance from the container orchestrator and securely distribute the encryption key to the virtual fabric edge instance.

[0023] In one embodiment, the fabric controller is configured to store data defining a rate limiting policy for an application and to enforce the rate limiting policy via the virtual fabric edge instance.

[0024] In one embodiment, a method includes: storing a virtual fabric edge instance on a host node in a virtual container environment, the virtual fabric edge instance being configured to implement a data center policy received by a fabric controller; executing an application instance of an application in the virtual container environment; and routing application traffic from the application instance in the container environment to one or more switches through the virtual fabric edge instance.

[0025] In one embodiment, the method further comprises: sending data describing routed application instance traffic from the virtual fabric edge instance to the fabric controller; receiving, at the virtual fabric edge instance, a query for data about the application instance from an application instance agent in a container environment; routing the query from the virtual fabric instance through one or more switches; downloading a response to the query from the fabric controller to the one or more switches; caching the response to the query at the virtual fabric instance. In one embodiment, the query comprises a request for data about one or more of: service discovery, or application health check.

[0026] In one embodiment, the method further includes storing a rate limiting policy for the application on the fabric controller; and limiting application traffic of the application instance through the virtual fabric edge instance using the rate limiting policy for the application stored on the fabric controller.

[0027] In one embodiment, the method further includes: receiving encrypted application traffic for the application instance at the virtual fabric edge; requesting an encryption key from the container orchestrator using the fabric controller; receiving the encryption key at the fabric controller and sending the encryption key to the virtual fabric edge to decrypt the application traffic.

[0028] In one embodiment, the method further includes providing isolation between the application instance and the second application instance using a VxLAN overlay.

[0029] 2. Structure and Function Examples

[0030] Figure 1 Depicted is an example system for providing a middle proxy for a service mesh of containerized microservices in a datacenter deployment. Figure 1 The various elements of communicate over a network using a network switch, such as via a leaf-spine architecture (e.g., a CLOS network topology), but embodiments are not limited to this example and are applicable to any data center fabric monitored by a fabric controller.

[0031] The host node 102 can be any computer system configured to communicate in a data center. The host node 102 can host one or more container environments, such as Docker or Kubernetes containers. For example, a Docker or Kubernetes container can be hosted on a server computer. Each container environment is an independent executable software package that provides a specific service, which includes everything needed to run the software package, including code, runtime, system libraries, settings, etc. The container environment can implement the container network interface (CNI) networking model or container network model (CNM), which is used by popular container orchestrators to perform local programming.

[0032] The host node 102 executes one or more application instances 104. The application instance 104 includes a microservice that is executed in a container environment. Different host nodes can execute application instances of various microservices. In order to provide a clear example of a network topology, each host node 102 is depicted as executing an application instance 104, but the application instances executed on the various host nodes may differ in configuration and / or application type. The application instance can be executed as part of a service mesh, such as the Istio / Envoy service mesh commercially available on GitHub. The service mesh includes a configurable infrastructure layer for one or more microservice applications.

[0033] The host nodes 102 each include a virtual fabric edge instance (VFE) 106 executing on the host node. The VFE 106 includes executable software configured to cause the host node to perform the following operations: identify and authenticate endpoints, and register endpoint identification information in a fabric host tracking database. The VFE may include ports in each container pod namespace and act as a bridge between the host node 102 and a top of rack (ToR) switch 108.

[0034] In one embodiment, the VFE is configured to route network traffic through a top-of-rack (ToR) switch 108. The ToR switch 108 comprises a network switch configured to interconnect host nodes in a data center. The ToR switch 108 may be connected to a spine 110 based on a leaf / spine data center structure such as a CLOS network topology.

[0035] The fabric controller 112 comprises a central entity configured to manage the operation of the network fabric, for example, by providing overlay reachability information and endpoint to route location mapping. An example of a fabric controller is the Cisco Application Policy Infrastructure Controller (APIC), which is the automation and management unification point for the Cisco Application Centric Infrastructure (ACI) fabric. The fabric controller 112 may be implemented on a computing system that is communicatively coupled to the host nodes via a network fabric architecture.

[0036] The container orchestrator 114 comprises a central entity that acts as a resource manager for the container environment operating on the host node. The container orchestrator may be configured to allocate and provide resources to the container environment, provide instructions to the system instructions that execute the container environment, obtain and distribute attribute data about the container environment, and otherwise manage the deployment and implementation of the container environment. Example container orchestrators 114 include, but are not limited to: Docker Swarm provided by Docker, Kubernetes container orchestration tools provided by Google, and Marathon container orchestration framework provided by Apache.

[0037] 3. Use data center structures as intermediary proxies

[0038] Figure 2 Described is a method for providing a middle proxy for a service mesh of containerized microservices in a data center deployment.

[0039] In one embodiment, the application instance is executed in a container environment as part of a service mesh for microservice applications. Figure 2 A single application instance is depicted, but embodiments may be performed using multiple application instances corresponding to different applications.

[0040] In one embodiment, the application agent 204 is additionally executed in the container environment. The application agent 204 can be configured to implement the implementation of policies related to the application instance. As an example, the Envoy sidecar agent can be additionally executed to implement policies for the Envoy service grid. The application agent 204 can be further configured to communicate with the VFE 106 to obtain information about the application. For example, by allowing the VFE 106 to provide key services to either the application instance 104 or the application agent 204, the data center structure can be integrated with the service grid.

[0041] In one embodiment, VFE 106 is used to monitor application data associated with application instance 104. For example, Figure 2In step 210 of , the application instance executing in the container environment on the host node sends outgoing traffic to the VFE 106. In one embodiment, the VFE 106 acts as a proxy for any Layer 7 service where the network fabric provides policy or statistics for implementation. Thus, the microservice application can be pre-identified as a delegated service or a non-delegated service, so that the host node can determine whether to route outgoing traffic through the VFE 106 if the service has been pre-identified as a delegated service.

[0042] At step 212, the VFE 106 routes the outgoing traffic to the ToR switch 108. For example, the VFE may route the outgoing traffic through a next-hop proxy. In the CLOS architecture, the ToR switch is connected to multiple spines, thereby ensuring multiple levels of redundancy for data related to the microservice application.

[0043] At step 214, the VFE 106 sends the traffic updates to the fabric controller 112. For example, the fabric controller may receive data about the routed traffic directly from the VFE host node or indirectly through the data center fabric architecture. By allowing the fabric controller to monitor the application traffic routed by the VFE, the system provides multiple levels of redundancy through the spine of the data center architecture while leveraging the VFE close to the microservice workloads.

[0044] By routing all outgoing application traffic through the VFE on each container environment, the system is able to provide the benefits of having the sidecar proxy close to the workload. By leveraging the data center fabric, the system is able to provide multiple levels of redundancy and eliminate the single point of failure of the intermediate proxy. Additionally, by leveraging the network fabric, application instance data from other nodes is readily available and can be served more efficiently without having to send queries to multiple different host nodes.

[0045] In one embodiment, the system integrates the data center fabric with the container orchestrator. The data center fabric has global visibility of the executed services, while the container orchestrator stores information about the deployed services. Therefore, the fabric controller 112 can request application data through an API transaction with the container orchestrator to request information about the deployed services for responding to requests from the VFE.

[0046] 3.1. Cooperation between structure and application agents

[0047] In one embodiment, the VFE works with the application agent to provide policies or statistics for implementation, while leaving the actual implementation to the application agent. For example, at step 220, the application agent sends a query to the VFE 106. The query includes a request for information related to the implementation of the microservice application. For example, the query can be a service discovery query and / or a request to assist in health checks of various discovered services.

[0048] At step 222, the VFE 106 requests a response to the query from the fabric controller 112. For example, the VFE may route the query to a next hop ToR switch for routing to the fabric controller. Although embodiments are described using an application proxy, in other embodiments, the VFE may communicate directly with the application instance.

[0049] In one embodiment, the VFE executing on the host node performs endpoint discovery and reports the endpoints to the fabric controller. The fabric controller uses endpoint learning, querying, and aging to assist in performing service discovery and health checks.

[0050] In one embodiment, the query includes a request to perform global rate limiting on the microservice application. Additionally or alternatively, the fabric controller can facilitate global rate limiting without receiving a query from the VFE. In one embodiment, the rate limiting data is defined in an application policy in the fabric controller. The fabric controller can send the rate limiting policy to the VFE that routes traffic for the microservice application. The VFE can communicate the rate limiting policy to the application proxy, which implements the rate limiting policy.

[0051] At step 224, the fabric controller caches the query response at the VFE level. For example, if the query is a request to perform service discovery, the fabric controller may route data including data identifying the discovered service to the VFE through the ToR switch. If the query is a request to perform a health check, the fabric controller may route data including data describing the health of the microservice application based on other interactions with the microservice application from the VFE executing on a different host node to the VFE through the ToR switch.

[0052] At step 226, the VFE 106 sends the response to the application proxy. For example, the VFE may respond to the application proxy using a cached response. Although the embodiments describe the VFE requesting data in response to a query from the application proxy, in embodiments, the fabric controller may periodically update the VFE with discovered services, health check data, or rate limiting policies. The VFE may cache data received from the fabric controller and respond to queries from the application proxy using the cached data.

[0053] 3.2. Provide encryption

[0054] In one embodiment, the data center structure can be used to provide end-to-end encryption for microservices. For example, in step 230, the VFE 106 can identify encrypted traffic for an application instance. Although steps 230-236 are described with respect to decrypted traffic, a similar method can be performed to encrypt traffic for sending to different nodes. For example, step 230 can include identifying traffic for an application to be encrypted. Identifying encrypted traffic can include determining that a microservice application designated to use end-to-end encryption has sent data through the VFE. Identifying traffic for an application to be encrypted can similarly include determining that a microservice application designated to use end-to-end encryption is requesting to send outgoing data through the VFE.

[0055] At step 232, fabric controller 112 requests encryption keys from container orchestrator 206. For example, container orchestrator 206 may store encryption keys for each microservice application. Fabric controller 112 may communicate with container orchestrator via API interactions to request encryption keys for microservice applications that have traffic being routed through the VFE. At step 234, container orchestrator 206 provides the encryption keys to fabric controller 112, for example, via the described API interactions.

[0056] At step 236, the fabric controller 112 securely distributes the encryption key to the VFE 106. For example, the fabric controller may route the encryption key directly to the VFE through the ToR switch. The VFE may then use the encryption key to encrypt outgoing traffic or decrypt incoming traffic. In this way, the VFE only stores and uses the encryption key when routing encrypted traffic. This allows end-to-end encryption to be performed by the VFE without storing encryption keys for each microservice application on each host node.

[0057] 3.3. Provide multiple rental

[0058] In one embodiment, the data center structure can be used to provide multi-tenancy for applications. The proxy by node does not allow microservices to be multi-tenanted. On the other hand, VFE can provide multi-tenancy for applications by isolating between different microservice instances.

[0059] In one embodiment, the VFE uses a VxLAN overlay to provide isolation between different microservice instances. For example, the VFE can specify a VxLAN identification number for each microservice instance. The VFE can then use the VxLAN overlay to route traffic to other host nodes in collaboration with the fabric controller and container orchestrator, which then use the VxLAN identification number to identify the microservice instance.

[0060] Integrating the data center fabric with a service mesh for microservices provides many benefits of using a sidecar proxy model. VFE is able to provide application information close to the workload of the microservice on each node. The use of a leaf / spine architecture eliminates the single point of failure problem of an intermediate proxy. The use of a VxLAN overlay allows VFE to provide multi-tenancy for microservices. Additionally, VFE can provide end-to-end encryption through collaboration between the fabric controller and the container orchestrator.

[0061] Additionally, the use of the fabric controller allows for more efficient service discovery, health checking, and global rate limiting, since the fabric controller has global visibility into executed services and traffic flows. The use of the fabric controller allows for simplified service mesh implementations by removing the sidecar proxy. Additionally, the use of the fabric controller allows for efficient use of endpoint learning at the network fabric level to avoid redundant data collection at the service mesh level, thereby saving network bandwidth for layer 7 applications.

[0062] 4. Implementation Example - Hardware Overview

[0063] According to one embodiment, the techniques described herein are implemented by at least one computing device. These techniques may be implemented in whole or in part using a combination of at least one server computer and / or other computing devices coupled using a network such as a packet data network. The computing device may be hardwired to perform these techniques; or may include digital electronic devices such as at least one application specific integrated circuit (ASIC) or a field programmable gate array (FPGA) permanently programmed to perform these techniques; or may include at least one general-purpose hardware processor programmed to perform these techniques according to program instructions in firmware, memory, other storage devices, or a combination. Such a computing device may also combine customized hardwired logic, ASICs, or FPGAs with customized programming to implement the described techniques. The computing device may be a server computer, a workstation, a personal computer, a portable computer system, a handheld device, a mobile computing device, a wearable device, a body-mounted or implantable device, a smart phone, a smart appliance, a network interconnected device, an autonomous or semi-autonomous device (e.g., a robot or an unmanned ground vehicle or aerial vehicle), any other electronic device that incorporates hardwired and / or program logic to implement the described techniques, one or more virtual computing machines or instances in a data center, and / or a network of server computers and / or personal computers.

[0064] Figure 3 is a block diagram illustrating an example computer system that can be used to implement an embodiment. Figure 3In the example of FIG. 1 , a computer system 300 and instructions for implementing the disclosed techniques in hardware, software, or a combination of hardware and software are schematically represented as, for example, boxes and circles, with the same level of detail that a person of ordinary skill in the art to which the present disclosure pertains to is typically used to convey information about computer architectures and computer system implementations.

[0065] Computer system 300 includes an input / output (I / O) subsystem 302, which may include a bus and / or (one or more) other communication mechanisms for communicating information and / or instructions between components of computer system 300 via electronic signal paths. I / O subsystem 302 may include an I / O controller, a memory controller, and at least one I / O port. Electronic signal paths are schematically represented in the figures as, for example, lines, unidirectional arrows, or bidirectional arrows.

[0066] At least one hardware processor 304 is coupled to the I / O subsystem 302 for processing information and instructions. The hardware processor 304 may include, for example, a general purpose microprocessor or microcontroller and / or a special purpose microprocessor, such as an embedded system or a graphics processing unit (GPU) or a digital signal processor or an ARM processor. The processor 304 may include an integrated arithmetic logic unit (ALU) or may be coupled to a separate ALU.

[0067] The computer system 300 includes one or more units of memory 306 (e.g., main memory) coupled to the I / O subsystem 302 for electronically digitally storing data and instructions to be executed by the processor 304. The memory 306 may include volatile memory, such as various forms of random access memory (RAM) or other dynamic storage devices. The memory 306 may also be used to store temporary variables or other intermediate information during the execution of instructions to be executed by the processor 304. When stored in a non-transitory computer-readable storage medium accessible to the processor 304, these instructions may cause the computer system 300 to appear as a special-purpose machine customized to perform the operations specified in the instructions.

[0068] Computer system 300 also includes non-volatile memory (e.g., read-only memory (ROM) 308 or other static storage device coupled to I / O subsystem 302) for storing information and instructions for processor 304. ROM 308 may include various forms of programmable ROM (PROM), such as erasable PROM (EPROM) or electrically erasable PROM (EEPROM). Units of permanent storage 310 may include various forms of non-volatile RAM (NVRAM), such as flash memory, or solid-state storage devices, magnetic disks, or optical disks (e.g., CD-ROM or DVD-ROM), and may be coupled to I / O subsystem 302 for storing information and instructions. Storage 310 is an example of a non-transitory computer-readable medium that may be used to store instructions and data that, when executed by processor 304, cause execution of a computer-implemented method to perform the techniques herein.

[0069] The instructions in the memory 306, ROM 308 or storage device 310 may include one or more groups of instructions organized as modules, methods, objects, functions, routines or calls. These instructions may be organized as one or more computer programs, operating system services, or applications including mobile apps. The instructions may include operating systems and / or system software; one or more libraries for supporting multimedia, programming or other functions; data protocol instructions or stacks to implement TCP / IP, HTTP or other communication protocols; file format processing instructions for parsing or presenting files encoded using HTML, XML, JPEG, MPEG or PNG; user interface instructions for presenting or interpreting commands for graphical user interfaces (GUIs), command line interfaces or text user interfaces; application software, such as office suites, Internet access applications, design and manufacturing applications, graphics applications, audio applications, software engineering applications, educational applications, games or other applications. These instructions may implement a web server, a web application server or a web client. The instructions may be organized into a presentation layer, an application layer and a data storage layer, such as a relational database system, object storage, a graph database, a flat file system or other data storage device using structured query language (SQL) or not using SQL.

[0070] The computer system 300 can be coupled to at least one output device 312 via the I / O subsystem 302. In one embodiment, the output device 312 is a digital computer display. Examples of displays that can be used in various embodiments include a touch screen display or a light emitting diode (LED) display or a liquid crystal display (LCD) or an electronic paper display. As an alternative or in addition to the display device, the computer system 300 may include (one or more) other types of output devices 312. Examples of other output devices 312 include a printer, a ticket printer, a plotter, a projector, a sound card or video card, a speaker, a buzzer or piezoelectric device or other audible device, a light or LED or LCD indicator, a tactile device, an actuator, or a servo.

[0071] At least one input device 314 is coupled to I / O subsystem 302 for communicating signals, data, command selections, or gestures to processor 304. Examples of input device 314 include touch screens, microphones, still and video digital cameras, alphanumeric and other keys, keypads, keyboards, graphics tablets, image scanners, joysticks, clocks, switches, buttons, dials, sliders, and / or various types of sensors (e.g., force sensors, motion sensors, thermal sensors, accelerometers, gyroscopes, and inertial measurement unit (IMU) sensors) and / or various types of transceivers (e.g., wireless (such as cellular or Wi-Fi), radio frequency (RF) or infrared (IR) transceivers, and global positioning system (GPS) transceivers).

[0072] Another type of input device is a control device 316, which can replace the input function or perform cursor control or other automatic control functions in addition to the input function, such as navigating in a graphical interface on a display screen. The control device 316 can be a touch pad, a mouse, a trackball, or a cursor direction key, which is used to convey direction information and command selection to the processor 304 and to control the cursor movement on the display 312. The input device can have at least two degrees of freedom on two axes (a first axis (e.g., x) and a second axis (e.g., y)), which allows the device to specify a position in a plane. Another type of input device is a wired, wireless or optical control device, such as a joystick, a stick, a console, a steering wheel, a pedal, a gearshift mechanism, or other types of control devices. The input device 314 can include a combination of multiple different input devices (e.g., a camera and a depth sensor).

[0073] In another embodiment, computer system 300 may include an Internet of Things (IoT) device in which one or more of output device 312, input device 314, and control device 316 are omitted. Alternatively, in such an embodiment, input device 314 may include one or more cameras, motion detectors, thermometers, microphones, earthquake detectors, other sensors or detectors, measurement devices, or encoders, and output device 312 may include a dedicated display (e.g., a single-line LED or LCD display), one or more indicators, display panels, meters, valves, solenoids, actuators, or servos.

[0074] When the computer system 300 is a mobile computing device, the input device 314 may include a GPS receiver coupled to a global positioning system (GPS) module capable of triangulating a plurality of GPS satellites to determine and generate geographic location or positioning data, such as latitude-longitude values ​​for the geophysical location of the computer system 300. The output device 312 may include hardware, software, firmware, and interfaces for generating position report packets, notifications, pulse or heartbeat signals, or other cyclic data transmissions specifying the location of the computer system 300, directed to the host 324 or server 330, either alone or in combination with other application-specific data.

[0075] The computer system 300 may implement the techniques described herein using custom hardwired logic, at least one ASIC or FPGA, firmware, and / or program instructions or logic that, when loaded and used or executed in conjunction with the computer system, cause the computer system or programmed computer system to operate as a special purpose machine. According to one embodiment, the techniques herein are performed by the computer system 300 in response to the processor 304 executing at least one sequence of at least one instruction contained in the main memory 306. Such instructions may be read into the main memory 306 from another storage medium such as the storage device 310. Execution of the sequence of instructions contained in the main memory 306 causes the processor 304 to perform the processing steps described herein. In alternative embodiments, hardwired circuitry may be used in place of or in combination with software instructions.

[0076] As used herein, the term "storage medium" refers to any non-transitory medium that stores data and / or instructions that cause a machine to operate in a particular manner. Such storage media may include non-volatile media and / or volatile media. Non-volatile media include, for example, optical or magnetic disks, such as storage device 310. Volatile media include dynamic memory, such as memory 306. Common forms of storage media include, for example, hard disks, solid-state drives, flash drives, magnetic data storage media, any optical or physical data storage media, memory chips, etc.

[0077] Storage media are distinct from, but may be used in conjunction with, transmission media. Transmission media participate in the transfer of information between storage media. For example, transmission media include coaxial cables, copper wires, and optical fibers, including the wires that make up the bus of I / O subsystem 302. Transmission media may take the form of sound or light waves such as those generated during radio wave and infrared data communications.

[0078] When at least one sequence of at least one instruction is carried to the processor 304 for execution, various forms of media may be involved. For example, the instruction may initially be carried on a disk or solid-state drive of a remote computer. The remote computer may load the instruction into its dynamic memory and send the instruction over a communication link (e.g., an optical fiber or coaxial cable or a telephone line) using a modem. A modem or router local to the computer system 300 may receive data over the communication link and convert the data into a format that the computer system 300 may read. For example, a receiver such as a radio frequency antenna or an infrared detector may receive data carried in a wireless or optical signal, and an appropriate circuit system may provide the data to the I / O subsystem 302, such as placing the data on a bus. The I / O subsystem 302 carries the data to the memory 306, where the processor 304 retrieves and executes the instruction from the memory 306. The instruction received by the memory 306 may optionally be stored on the storage device 310 (before or after being executed by the processor 304).

[0079] The computer system 300 also includes a communication interface 318 coupled to the bus 302. The communication interface 318 provides a two-way data communication coupled to (one or more) network links 320, wherein the (one or more) network links 320 are directly or indirectly connected to at least one communication network, such as a network 322 or a public or private cloud on the Internet. For example, the communication interface 318 can be an Ethernet networking interface, an integrated services digital network (ISDN) card, a cable modem, a satellite modem, or a modem for providing a data communication connection to a corresponding type of communication line (e.g., an Ethernet cable or any kind of metal cable or fiber optic line or telephone line). The network 322 broadly represents a local area network (LAN), a wide area network (WAN), a campus network, an internet network, or any combination thereof. The communication interface 318 may include a LAN card to provide a data communication connection to a compatible LAN; or may include a cellular radiotelephone interface that is wired to send or receive cellular data according to a cellular radiotelephone wireless networking standard; or may include a satellite radio interface that is wired to send or receive digital data according to a satellite wireless networking standard. In any such implementation, communication interface 318 sends and receives electrical, electromagnetic or optical signals over signal paths that carry digital data streams representing various types of information.

[0080] The network link 320 typically provides electrical, electromagnetic or optical data communication directly to other data devices or through at least one network to other data devices using, for example, satellite, cellular, Wi-Fi or BLUETOOTH technology. For example, the network link 320 may provide a connection to a host computer 324 through a network 322.

[0081] In addition, the network link 320 can provide a connection through the network 322 or to other computing devices via a network interconnect device and / or a computer operated by an Internet Service Provider (ISP) 326. ISP 326 provides data communication services through a global packet data communication network represented as the Internet 328. Server computer 330 can be coupled to the Internet 328. Server 330 broadly represents any computer, data center, virtual machine or virtual computing instance with or without a hypervisor, or a computer that executes a containerized program system such as DOCKER or KUBERNETES. Server 330 can represent an electronic digital service that is implemented using more than one computer or instance and can be accessed and used by sending a web service request, a uniform resource locator (URL) string with parameters in an HTTP payload, an API call, an app service call, or other service call. Computer system 300 and server 330 can form an element of a distributed computing system that includes other computers, processing clusters, server groups, or other computer organizations that collaborate to perform tasks or execute applications or services. The server 330 may include one or more groups of instructions organized as modules, methods, objects, functions, routines, or calls. The instructions may be organized as one or more computer programs, operating system services, or applications including mobile apps. The instructions may include operating systems and / or system software; one or more libraries for supporting multimedia, programming, or other functions; data protocol instructions or stacks for implementing TCP / IP, HTTP, or other communication protocols; file format processing instructions for parsing or presenting files encoded using HTML, XML, JPEG, MPEG, or PNG; user interface instructions for presenting or interpreting commands for graphical user interfaces (GUIs), command line interfaces, or text user interfaces; application software, such as office suites, Internet access applications, design and manufacturing applications, graphics applications, audio applications, software engineering applications, educational applications, games, or other applications. The server 330 may include a web application server that hosts a presentation layer, an application layer, and a data storage layer, such as a relational database system, object storage, a graph database, a flat file system, or other data storage device using structured query language (SQL) or not using SQL.

[0082] Computer system 300 may send messages and receive data and instructions (including program code) through the network(s), network link 320, and communication interface 318. In the Internet example, server 330 may send the requested code for an application program through Internet 328, ISP 326, local network 322, and communication interface 318. The received code may be executed by processor 304 as it is received, and / or may be stored in storage device 310 or other non-volatile storage for later execution.

[0083] The execution of the instructions described in this section can implement a process in the form of an instance of a computer program being executed, which consists of program code and its current activity. Depending on the operating system (OS), a process can consist of the execution of multiple threads that execute instructions simultaneously. In this case, a computer program is a passive collection of instructions, and a process can be the actual execution of these instructions. Several processes can be associated with the same program; for example, opening several instances of the same program often means that more than one process is being executed. Multitasking can be implemented to allow multiple processes to share the processor 304. When each processor 304 or processor core executes a single task at a time, the computer system 300 can be programmed to implement multitasking to allow each processor to switch between the tasks being executed without having to wait for each task to complete. In one embodiment, switching can be performed in the following circumstances: when a task performs an input / output operation, when a task indicates that it can be switched, or when a hardware interrupt occurs. Time-sharing can be implemented by the following operations to allow a fast response to interactive user applications: fast execution context switching to provide a presentation of concurrent execution of multiple processes at the same time. In one embodiment, for security and reliability, the operating system may prevent direct communication between independent processes to provide an inter-process communication function that is strictly mediated and controlled.

[0084] In summary, a system for providing services for microservice applications is described herein. In one embodiment, the system includes multiple container environments, each of which includes a host node. A virtual fabric edge instance executes on each host node. The host nodes are interconnected through multiple switches. A fabric controller manages the multiple switches and implements policies through the virtual fabric edge instance executed on each host node. The fabric controller also provides services for application instances through the virtual fabric edge instance in the following manner: routing traffic, data, queries from an application or proxy instance to another application or proxy instance in the container environment through the virtual fabric edge instance.

[0085] In the foregoing description, embodiments of the present invention have been described with reference to many specific details that may vary depending on the implementation. Therefore, the description and drawings are to be considered in an illustrative rather than a restrictive sense. Applicants intend that the only and exclusive indication of the scope of the present invention is the literal and equivalent scope of the set of claims set forth in this application (in the specific form in which such claims are set forth), including any subsequent corrections.

Claims

1. A system for providing services for microservice applications, comprising: Multiple host nodes, each host node includes a container environment; a plurality of switches configured to interconnect the plurality of host nodes; a fabric controller configured to manage the plurality of switches and implement policies through a virtual fabric edge instance executing on each host node; The fabric controller is further configured to implement application functions through the virtual fabric edge instance by: routing application traffic from the application instance in the container environment through the virtual fabric edge instance, The system further includes a service grid agent executed in each container environment of the plurality of container environments, wherein the service grid agent in each container environment is configured to query the virtual fabric edge instance for data about application functions.

2. The system of claim 1, wherein: The application functions include one or more of the following: a service discovery function, or an application health status check function.

3. The system of claim 1, wherein: The fabric controller is configured to, in response to the service mesh agent querying the virtual fabric edge instance for data about the application function, download data about the application function to a switch connected to the container environment including the service mesh agent.

4. The system according to any one of claims 1 to 3, wherein: The virtual fabric edge instance is configured to use a VxLAN overlay to provide isolation between different application instances in a container environment.

5. The system according to any one of claims 1 to 3, wherein: The fabric controller is further configured to obtain an encryption key for an application instance from a container orchestrator, and securely distribute the encryption key to the virtual fabric edge instance.

6. The system according to any one of claims 1 to 3, wherein: The fabric controller is configured to store data defining a rate limiting policy for an application and to implement the rate limiting policy through the virtual fabric edge instance.

7. A method for providing services for a microservice application, comprising: storing a virtual fabric edge instance on a host node including a virtual container environment, the virtual fabric edge instance configured to implement a data center policy received by the fabric controller; executing an application instance of an application in the virtual container environment; routing application traffic from the application instance in the container environment to one or more switches through the virtual fabric edge instance; receiving, at the virtual fabric edge instance, a query for data about the application instance from an application instance agent in the container environment; routing the query from the virtual fabric edge instance through the one or more switches; downloading a response to the query from the fabric controller to the one or more switches; as well as The response to the query is cached at the virtual fabric edge instance.

8. The method of claim 7, further comprising: The following data is sent from the virtual fabric edge instance to the fabric controller: the data describing the routed application instance traffic.

9. The method of claim 8, wherein: The query includes a request for data related to one or more of: service discovery, or application health check.

10. The method according to any one of claims 7 to 9, further comprising: storing a rate limiting policy for the application on the fabric controller; Using the rate limiting policy for the application stored on the fabric controller, application traffic of the application instance is limited through the virtual fabric edge instance.

11. The method according to any one of claims 7 to 9, further comprising: receiving, at the virtual fabric edge instance, encrypted application traffic for the application instance; Using the fabric controller, requesting an encryption key from a container orchestrator; The encryption key is received at the fabric controller and sent to the virtual fabric edge instance to decrypt the application traffic.

12. The method according to any one of claims 7 to 9, further comprising: Using a VxLAN overlay provides isolation between the application instance and the second application instance.

13. One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors, cause the following operations to be performed: storing a virtual fabric edge instance on a host node including a virtual container environment, the virtual fabric edge instance configured to implement a data center policy received by the fabric controller; executing an application instance of an application in the virtual container environment; routing application traffic from the application instance in the container environment to one or more switches through the virtual fabric edge instance; receiving, at the virtual fabric edge instance, a query for data about the application instance from an application instance agent in the container environment; routing the query from the virtual fabric edge instance through the one or more switches; downloading a response to the query from the fabric controller to the one or more switches; as well as The response to the query is cached at the virtual fabric edge instance.

14. One or more non-transitory computer readable media as claimed in claim 13, wherein: When the instructions are executed by the one or more processors, the following operations are also performed: The following data is sent from the virtual fabric edge instance to the fabric controller: the data describing the routed application instance traffic.

15. One or more non-transitory computer readable media as claimed in claim 14, wherein: The query includes a request for data related to one or more of: service discovery, or application health check.

16. One or more non-transitory computer readable media as claimed in any one of claims 13 to 15, wherein: When the instructions are executed by the one or more processors, the following operations are also performed: storing a rate limiting policy for the application on the fabric controller; Using the rate limiting policy for the application stored on the fabric controller, application traffic of the application instance is limited through the virtual fabric edge instance.

17. One or more non-transitory computer readable media as claimed in any one of claims 13 to 15, wherein: When the instructions are executed by the one or more processors, the following operations are also performed: receiving, at the virtual fabric edge instance, encrypted application traffic for the application instance; Using the fabric controller, requesting an encryption key from a container orchestrator; The encryption key is received at the fabric controller and sent to the virtual fabric edge instance to decrypt the application traffic.

18. One or more non-transitory computer readable media as claimed in any one of claims 13 to 15, wherein: The instructions, when executed by the one or more processors, further cause the following operations to be performed: using a VxLAN overlay to provide isolation between the application instance and the second application instance.

19. A device for providing services for a microservice application, comprising: means for storing, on a host node including a virtual container environment, a virtual fabric edge instance, the virtual fabric edge instance being configured to implement a data center policy received by a fabric controller; means for executing an application instance of an application in the virtual container environment; means for routing application traffic from said application instances in said container environment to one or more switches through said virtual fabric edge instance; means for receiving, at the virtual fabric edge instance, a query for data regarding the application instance from an application instance agent in the container environment; means for routing the query from the virtual fabric edge instance through the one or more switches; means for downloading a response to said query from said fabric controller to said one or more switches; as well as Means for caching the response to the query at the virtual fabric edge instance.

20. The apparatus of claim 19, further comprising: An apparatus for implementing the method according to any one of claims 8 to 12.

21. A computer program product comprising instructions which, when executed by a computer, cause the computer to perform the steps of the method of any one of claims 7 to 12.

Images