A method and system for service governance of microservices

Abstract

The application provides a method and system for service governance of microservices, the system comprising: a service requester, a service provider, a service governance platform, and a database; the service provider provides a service interface and performs authentication verification when the service interface is called by the service requester; the service requester applies for authorization of service interface calling before calling the service interface; preset service authentication rules are stored in the service governance platform, the service provider regularly acquires the service authentication rules from the service governance platform to the memory, the service authentication provides authentication switch control, interface white list control, and service white list control according to priority, and realizes service management and control of the service governance strategy; the database stores service governance data, and the service governance platform calls the service governance data in the database. The application controls and manages the interface calling between microservices, and guarantees the overall availability of the system.

Description

Technical Field

[0001] This invention relates to the field of microservice architecture technology, and in particular to a method and system for service governance of microservices. Background Technology

[0002] As business expands, existing application frameworks can no longer meet the demands. Therefore, by using a distributed service framework, development capabilities are improved, and the problem of inconsistencies between development results and implementation processes is resolved. Microservices are a very popular system architecture solution in the tech world recently. Microservice architecture creates a mesh-like topology between microservices, which brings many challenges to availability and maintainability. Complex call chains make it difficult to pinpoint call details; errors in one part of the chain can affect the whole system, thus impacting overall availability. The increased number of nodes also presents performance challenges.

[0003] Chinese invention patent title: Microservice Governance Method and Apparatus, patent number: CN112506709A, discloses a microservice governance method and apparatus. The method includes: sending a microservice registration request to a registry center through a predefined YAML template; when the microservice is successfully registered, configuring the microservice according to its governance strategy type; and when the configured microservice is called, restarting the configured microservice container according to the governance strategy type corresponding to the configured microservice without modifying the microservice code.

[0004] The conventional technical solution involves using coding standards to constrain behavior, followed by code reviews to identify unreasonable service interface calls. This works well for small teams with a manageable number of microservices and interfaces, but becomes difficult to manage effectively in large teams with numerous microservices. Furthermore, current common service interface authentication and circuit breaking are mostly handled centrally by the gateway, which fails to effectively control internal calls between service interfaces after authentication. Summary of the Invention

[0005] To address the problems existing in the prior art, this invention provides a method and system for service governance of microservices. Based on the microservice architecture, this invention provides a service governance method for internal interface calls of microservices, which manages and controls interface calls between services. The service provider provides the service interface, and the service requester needs to apply for interface call authorization before calling the interface. The authorization rules are managed in the service governance platform.

[0006] The technical solution adopted in this invention is as follows:

[0007] A system for service governance of microservices includes: a service requester, a service provider, a service governance platform, and a database; the service provider provides service interfaces and performs authentication verification when the service requester calls the service interfaces; the service requester applies for service interface call authorization before calling the service interfaces; the service governance platform has preset service authentication rules, and the service provider periodically retrieves the service authentication rules from the service governance platform into memory; service authentication provides authentication switch control, interface whitelist control, and service whitelist control according to priority to realize service control of service governance strategies; the database stores service governance data, and the service governance platform calls the service governance data in the database.

[0008] A method for service governance of microservices includes the following steps:

[0009] Determine whether a circuit breaker mechanism needs to be started during service startup initialization. If not, the service requester encapsulates the request information in the request header and sends the request information to the service provider; if so, execute the local circuit breaker.

[0010] The service provider provides the API for the service requester;

[0011] After the service provider starts, it obtains the service governance switch from Nacos. Once the service governance switch is turned on, the underlying dependency periodically obtains data from the service governance platform. The first time, it directly pulls the data. Before pulling the data again, it performs an MD5 value comparison. When the MD5 values ​​are inconsistent, it pulls the authentication and verification rules of the current service from the service governance platform based on the current service name.

[0012] The service provider obtains the authentication information of the interface through the service governance platform and performs authentication verification. If the verification fails, the service provider sends an exception notification to the service requester.

[0013] The beneficial effects of this invention are as follows:

[0014] The service circuit breaker mechanism of this invention operates before business requests. Therefore, after the circuit breaker is triggered, the local circuit breaker method is executed, and subsequent interface calls and business logic processing are no longer executed. When a service governance rule is added, the current service automatically obtains the new rule from the service governance platform within a specified time window. After obtaining the new rule, the current service will recover from the circuit breaker state. Compared to placing the authentication logic in the service governance platform, this design places the authentication logic in each service, which can avoid performance issues such as slow access and request failures caused by excessive access pressure. Moreover, placing the authentication and circuit breaker logic in each service will not cause global problems due to the abnormality of a few service nodes, thereby ensuring the overall availability of the system.

[0015] After the service provider of this invention starts, it obtains the service governance switch from Nacos. Once the switch is turned on, the underlying dependency periodically retrieves data from the service governance platform. The first time, it directly pulls the data. In subsequent retrievals, it first performs an MD5 value comparison. When the MD5 values ​​do not match, it retrieves the authentication and verification rules for the current service from the service governance platform based on the current service name. This invention reduces data transmission costs and places the service authentication and verification logic in the service provider, eliminating the need for third-party processing. Since the number of interfaces provided by each microservice is limited, the local cached data is generally no more than 10MB, and resource consumption is negligible. Attached Figure Description

[0016] Figure 1 This invention provides a schematic diagram of a system architecture for service governance of microservices;

[0017] Figure 2 The present invention also provides a flowchart of a method for service governance of microservices. Detailed Implementation

[0018] The present invention will be further described below with reference to the accompanying drawings and embodiments: To clearly illustrate the technical features of this solution, the present invention will be described in detail below through specific embodiments and with reference to the accompanying drawings. The following disclosure provides many different embodiments or examples for implementing different structures of the present invention. To simplify the disclosure of the present invention, components and arrangements of specific examples are described below. Furthermore, the present invention may repeat reference numerals and / or letters in different examples. Such repetition is for simplification and clarity and does not in itself indicate the relationship between the various embodiments and / or arrangements discussed. It should be noted that the components illustrated in the drawings are not necessarily drawn to scale. The present invention omits descriptions of well-known components and processing techniques and processes to avoid unnecessarily limiting the present invention.

[0019] like Figure 1 As shown, this invention provides a system for service governance of microservices, including: a service requester, a service provider, a service governance platform, and a database; the service provider provides service interfaces and performs authentication verification when the service requester calls the service interfaces; the service requester applies for service interface call authorization before calling the service interfaces; the service governance platform has preset service authentication rules, and the service provider periodically retrieves the service authentication rules from the service governance platform into memory; service authentication provides authentication switch control, interface whitelist control, and service whitelist control according to priority, realizing service control of service governance strategies; the database stores service governance data, and the service governance platform calls the service governance data in the database. The service governance platform periodically retrieves service governance data from the database, and the service governance data is calculated by MD5 and stored in the memory of the service requester in JSON format.

[0020] like Figure 2 As shown, the present invention also provides a method for service governance of microservices, comprising the following steps:

[0021] Determine whether a circuit breaker mechanism needs to be started during service startup initialization. If not, the service requester encapsulates the request information in the request header and sends the request information to the service provider; if so, execute the local circuit breaker.

[0022] The service provider provides the API for the service requester;

[0023] After the service provider starts, it obtains the service governance switch from Nacos. Once the service governance switch is turned on, the underlying dependency periodically obtains data from the service governance platform. The first time, it directly pulls the data. Before pulling the data again, it performs an MD5 value comparison. When the MD5 values ​​are inconsistent, it pulls the authentication and verification rules of the current service from the service governance platform based on the current service name.

[0024] The service provider obtains the authentication information of the interface through the service governance platform and performs authentication verification. If the verification fails, the service provider sends an exception notification to the service requester.

[0025] The technical solution provided by the present invention will be explained below with reference to specific embodiments. The terms involved in this embodiment are as follows:

[0026] Microservice A (server-A): refers to the service requester;

[0027] Microservice B (server-B): refers to the service provider;

[0028] Service governance platform: Used to dynamically manage and maintain service governance-related data.

[0029] The service governance strategies provided by this invention include: 1) whether to start the circuit breaker mechanism during service startup initialization; 2) the circuit breaker mechanism can be dynamically enabled or disabled during service operation, and the switch configuration can support both Nacos configuration and database configuration methods simultaneously; 3) support for adding a whitelist mechanism for specific URL requests or specified microservices; 4) if multiple governance rules simultaneously meet the request policy, the first matching rule will be used for processing.

[0030] The service circuit breaker mechanism operates before business requests are made. Therefore, once the circuit breaker is triggered, the local circuit breaker method is executed, and subsequent API calls and business logic processing are no longer executed. When a service governance rule is added, the current service automatically retrieves the new rule from the service governance platform within a specified time window. After retrieving the new rule, the current service will return to a normal state from the circuit breaker state.

[0031] If you enable service circuit breaking only in the development and testing environments and not in the production environment, you can turn off the initialization switch. After the project starts, all requests will not be intercepted by the Feign interface, and data will not be retrieved from the service governance platform periodically. All service governance operations will not be executed.

[0032] To minimize the impact on business processes, several measures are provided to promptly detect issues when service circuit breakers occur or the service governance platform becomes unavailable. 1) When a service circuit breaker is triggered, different error codes can be used to determine the circuit breaker scenario; 2) If the business process involves calls to more than three microservice interfaces, the interception information will clearly specify key information such as the upstream service name, downstream service name, and request interface, helping to quickly locate and identify the circuit breaker node in multiple request chains; 3) In case of emergency issues such as the service governance platform becoming unavailable or being unable to connect to the service governance platform due to network problems, the circuit breaker mechanism can be disabled by modifying the Nacos configuration switch, or all requests can be allowed through database configuration changes to prioritize the normal operation of business processes.

[0033] This invention provides a method for service governance of microservices as follows:

[0034] 1. Microservice architectures all introduce the underlying dependency Spring Cloud Server, which is invoked via the Feign interface. Spring Cloud Server serves three purposes:

[0035] 1) Encapsulate the Feign request by adding the name of the current microservice to the request header;

[0036] 2) Regularly retrieve service governance data from the service governance platform;

[0037] 3) Intercept all HTTP requests and verify them based on the header identifier.

[0038] 2. The service governance platform periodically (default 30 seconds, configurable) retrieves service governance data from the database. The data is first MD5-valued and then stored in memory in JSON format. This method effectively reduces the frequency of database access; only the timing needs to be adjusted to ensure eventual data consistency. Service governance data is divided into whitelisted and non-whitelisted data:

[0039] 1) Whitelist data:

[0040] Whitelists are divided into URL whitelists and service name whitelists. For example, access to Swagger is unrestricted, and requests are forwarded through the login gateway.

[0041] 2) Non-whitelist data:

[0042] Non-whitelisted data refers to interface authentication and verification data, which is formatted as the authorized interface and authorization format. Taking a request from microservice A (server-A) to the api / query / userinfo interface of microservice B (server-B) as an example, the data from server-B / api / query / userinfo and server-A is stored in the database.

[0043] 3. After microservice B starts, it obtains the service governance switch from Nacos. Once the switch is turned on, Spring Cloud Server periodically retrieves data from the service governance platform. The first retrieval directly pulls the data; subsequent retrievals perform an MD5 comparison before each new retrieval. If the MD5 values ​​do not match, the authentication and verification rules for the current service are retrieved from the service governance platform based on the service name `server-B`. This approach reduces data transmission costs and allows the service authentication and verification logic to be processed within microservice B, eliminating the need for third-party processing. Since each microservice provides a limited number of interfaces, the local cached data is generally no more than 10MB, and resource consumption is negligible.

[0044] 4. The authentication logic adopts Spring's AntPathMatcher matching method, which is naturally adapted to Feign interfaces. It can meet the requirements of fine-grained interface matching for server-B / api / query / userinfo, as well as coarse-grained interface matching for server-B / api / query / **, and can also adapt to all interfaces under server-B.

[0045] 5. In some special scenarios, such as when microservice B needs to send a Feign request to call its own interface, Spring Cloud Server will obtain the name of the current microservice based on the information in the request header. By default, when the current service calls its own interface, it will not be intercepted and can be allowed directly.

[0046] 6. Interface verification adopts a whitelist interception mechanism. That is, if the server-B / api / query / userinfo interface is added to the service governance platform, all services accessing this interface need to be authorized. Services that have not been authorized will trigger the interface circuit breaker through the verification mechanism of Spring Cloud Server when accessing the interface.

[0047] Following the above process, when service governance data changes, the update of each data in the cloud health microservice can be completed in about 1 minute, effectively ensuring high concurrency and robustness.

[0048] 7. The service governance function is equipped with multiple on / off control mechanisms.

[0049] Example 1

[0050] Embodiment 1 of this invention explains the technical solution through the implementation method of the development environment:

[0051] The microservice registry uses Nacos. When developers test their business logic, they need to start a local service. If multiple developers make business logic changes in the microservice server-C, then during testing, multiple server-C services in the development environment will register with Nacos. The Feign+Ribbon load balancing strategy makes it uncertain which server-C service will be sent to.

[0052] To avoid this problem, a custom suffix is ​​usually added to the service name to distinguish each microservice. For example, Zhang San would add a custom suffix -zhangsan to his service name to change it to...

[0053] server-C-zhangsan.

[0054] To avoid data redundancy, the service governance platform normally only maintains rules with the service name server-C. When testing with the service name server-C-zhangsan, a service circuit breaker may be triggered due to unauthorized access.

[0055] To resolve this issue, you can add a service whitelist named *-local-test to the whitelist. This means microservices ending with -local-test can be authenticated.

[0056] For example: server-C-zhangsan-local-test. This allows local developers to perform normal connection debugging tests.

[0057] For other test scenarios, such as requests sent through a browser, Postman, or Swagger, the requests will be blocked due to the fact that the initiator of the request is not the Cloud Health microservice. In contrast, in formal business scenarios, the requests will be processed uniformly through the gateway and will include a header identifier.

[0058] To facilitate development and debugging, browser requests can have their request headers configured via browser plugins, while Postman and Swagger can have their headers customized. Based on the test scenario, configure the respective header information and categorize them into the following whitelists:

[0059] Local browser: test-web;

[0060] swagger: test-swagger;

[0061] Postman: test-postman;

[0062] Manual task: test-job-manual;

[0063] Automatic task: test-job-auto.

[0064] Example 2

[0065] Embodiment 2 of the present invention explains the technical solution through the implementation method of the testing environment:

[0066] When releasing and submitting for testing in the test environment, a designated person is responsible for pulling the code from Git via Jenkins and releasing the microservice. The microservice naming must also conform to the standard. Therefore, the management process can avoid dirty data in the service governance data in the test environment.

[0067] The testing and development environments are separate, and service governance data is physically isolated to avoid data impact caused by cross-use of environments.

[0068] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for service governance of microservices, characterized in that, The method utilizes a system for service governance of microservices, comprising: a service requester, a service provider, a service governance platform, and a database. The service provider provides service interfaces and performs authentication verification when the service requester calls these interfaces. Before calling the service interface, the service requester applies for service interface call authorization. The service governance platform pre-sets service authentication rules, and the service provider periodically retrieves these rules from the platform into memory. Service authentication is prioritized and includes authentication switch control, interface whitelist control, and service whitelist control to achieve service control of the service governance strategy. The database stores service governance data, which the service governance platform accesses. The service governance platform periodically retrieves service governance data from the database, and this data, after MD5 hashing, is stored in the service requester's memory in JSON format. The method includes the following steps: Determine whether a circuit breaker mechanism needs to be started during service startup initialization. If not, the service requester encapsulates the request information in the request header and sends the request information to the service provider; if so, execute the local circuit breaker. The service provider provides the API for the service requester; After the service provider starts, it obtains the service governance switch from Nacos. Once the service governance switch is turned on, the underlying dependency periodically obtains data from the service governance platform. The first time, it directly pulls the data. Before pulling the data again, it performs an MD5 value comparison. When the MD5 values ​​are inconsistent, it pulls the authentication and verification rules of the current service from the service governance platform based on the current service name. The service provider obtains the authentication information of the interface through the service governance platform and performs authentication verification. If the verification fails, the service provider sends an exception notification to the service requester.

2. The method for governing microservices as described in claim 1, characterized in that, After a service governance rule is added, the current service will automatically obtain the new rule from the service governance platform within a specified time window. After obtaining the new rule, the current service will return to normal from the circuit breaker state.

3. The method for governing microservices as described in claim 1, characterized in that, During service operation, the system can dynamically enable or disable the circuit breaker mechanism, and the service switch supports Nacos configuration and database configuration.

4. The method for governing microservices as described in claim 3, characterized in that, If service circuit breaking is enabled only in the development and testing environments and not in the production environment, the system will disable the initialization switch. After the project starts, all requests will not be intercepted by the Feign interface, and data will not be periodically retrieved from the service governance platform.

5. The method for governing microservices as described in claim 1, characterized in that, When a service circuit breaker occurs or the service governance platform becomes unavailable, the specific measures taken by the system include: When a service circuit breaker is triggered, the system determines the circuit breaker scenario based on the error code. If the business process involves calls to three or more microservice interfaces, the interception information will explicitly specify the key information, which includes: the upstream service name, the downstream service name, and the requested interface. If the service governance platform is unavailable, the system will either disable the circuit breaker mechanism by modifying the Nacos configuration or allow all requests by modifying the database configuration.

6. The method for governing microservices as described in claim 1, characterized in that, The authentication logic of the system's authentication verification rules adopts Spring's AntPathMatcher matching method to adapt to the Feign interface.

7. The method for governing microservices as described in claim 1, characterized in that, The authentication and verification of the interface adopts a whitelist interception mechanism. Specifically, all services accessing the interface need to add authorization information. If a service without authorization information accesses the interface, the circuit breaker is triggered through the underlying verification mechanism.

8. A computer storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it is used to perform the method as described in any one of claims 1-7.

Images