Distributed flow limiting method and device based on DPU service grid, equipment and medium

Abstract

The embodiment of the invention relates to a distributed current limiting method, device and equipment based on a DPU service grid and a medium. According to the method, each Sidecar agent corresponding to each service on a host is unloaded, and a centralized agent corresponding to each service is installed on a DPU, and the method comprises the following steps: the centralized agent receives a service request and obtains a target service; determining whether to execute flow limiting based on the target service and a pre-cached flow limiting rule; requesting a distributed lock corresponding to the target service from the Kubernetes through a control plane component on the host under the condition of executing the current limiting; when the centralized agent receives the distributed lock sent by the control plane component, the current residual flow limiting quota of the distributed lock is obtained; and when the request flow of the service request is less than or equal to the current residual flow limiting quota, responding to the service request. Therefore, the flow limiting execution is unloaded to the DPU, the burden of the host CPU is reduced, the flow limiting processing is performed through the centralized proxy, and the processing efficiency and accuracy are improved.

Description

Technical Field

[0001] The present disclosure relates to the technical field of cloud computing, and in particular to a distributed current limiting method, device, equipment and medium based on a DPU (Data Processing Unit) service grid. Background Art

[0002] Generally, in complex microservice systems, the control and management of service traffic is crucial. Rate limiting is an important means to protect services from overload and abuse. By limiting the number of requests or concurrent connections per unit time, it prevents services from being overwhelmed by surging traffic and ensures the stability and availability of services.

[0003] Traditional current limiting methods are usually implemented by the service application itself or its front-end API (Application Programming Interface) gateway. In a service mesh, the Sidecar (a dedicated transparent network proxy (such as Envoy)) proxy is naturally suitable as the execution point of the current limiting strategy because it is on the service communication path and can flexibly control all traffic in and out of the service.

[0004] However, in the distributed architecture of the service mesh, the Sidecar proxy of each service instance usually works independently and lacks global coordination. When the traffic of multiple service replicas converges to the downstream service, the actual traffic may exceed the expected value. Summary of the invention

[0005] In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a distributed flow limiting method, device, equipment and medium based on DPU service grid.

[0006] The embodiment of the present disclosure provides a distributed current limiting method based on a DPU service grid, uninstalling each Sidecar agent corresponding to each service on a host, and installing a centralized agent corresponding to each service on a DPU, the method comprising:

[0007] The centralized agent receives the service request and obtains the target service;

[0008] Determining whether to perform current limiting based on the target service and the pre-cached current limiting rules;

[0009] In the case of current limiting, requesting a distributed lock corresponding to the target service from the container orchestration platform Kubernetes through the control plane component on the host;

[0010] When the centralized agent receives the distributed lock sent by the control plane component, it obtains the current remaining current limiting quota of the distributed lock;

[0011] When the request flow of the service request is less than or equal to the current remaining flow limiting quota, respond to the service request.

[0012] The embodiment of the present disclosure further provides a distributed current limiting device based on a DPU service grid, which uninstalls each Sidecar agent corresponding to each service on a host, and installs a centralized agent corresponding to each service on a DPU, wherein the device includes:

[0013] A receiving and obtaining module, used for the centralized agent to receive a service request and obtain a target service;

[0014] A determination module, used to determine whether to perform current limiting based on the target service and the pre-cached current limiting rules;

[0015] A request module, used to request a distributed lock corresponding to the target service from the container orchestration platform Kubernetes through a control plane component on the host when current limiting is performed;

[0016] An acquisition module, configured to acquire the current remaining current limiting quota of the distributed lock when the centralized agent receives the distributed lock sent by the control plane component;

[0017] The response module is used to respond to the service request when the request flow of the service request is less than or equal to the current remaining flow limiting quota.

[0018] An embodiment of the present disclosure also provides an electronic device, comprising: a processor; a memory for storing executable instructions of the processor; the processor is used to read the executable instructions from the memory and execute the instructions to implement a distributed current limiting method based on a DPU service grid as provided in an embodiment of the present disclosure.

[0019] An embodiment of the present disclosure also provides a computer-readable storage medium, which stores a computer program, and the computer program is used to execute the DPU service grid-based distributed current limiting method provided in the embodiment of the present disclosure.

[0020] The technical solution provided by the embodiments of the present disclosure has the following advantages over the prior art: the distributed current limiting solution based on the DPU service grid provided by the embodiments of the present disclosure uninstalls each Sidecar agent corresponding to each service on the host, and installs a centralized agent corresponding to each service on the DPU, and the method includes: the centralized agent receives a service request and obtains a target service; determines whether to execute current limiting based on the target service and the pre-cached current limiting rules; when executing current limiting, requests a distributed lock corresponding to the target service from Kubernetes through the control plane component on the host; when the centralized agent receives the distributed lock sent by the control plane component, it obtains the current remaining current limiting quota of the distributed lock; when the request flow of the service request is less than or equal to the current remaining current limiting quota, responds to the service request. Therefore, the DPU hardware unloads the Sidecar agent. In the traditional service mesh solution, the Sidecar agent is deployed on the same host as the application, which occupies a large amount of CPU and memory resources and affects the performance of the application. By unloading the Sidecar agent to the smart network card DPU, the high-performance network processing capability of the DPU is used to perform traffic management and current limiting functions, which greatly reduces the resource overhead of the host and improves the performance and scalability of the service mesh. In addition, the control plane component on the host side requests a distributed lock to ensure the consistency and accuracy of the current limiting, and the current limiting rule management of the centralized agent also simplifies the update and distribution of the current limiting strategy, thereby improving the scalability of the service mesh. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0022] Figure 1A An example diagram of independent processing current limiting based on DPU provided in an embodiment of the present disclosure;

[0023] Figure 1B Another example diagram of independent processing current limiting based on DPU provided in an embodiment of the present disclosure;

[0024] Figure 2 A flow chart of a distributed current limiting method based on a DPU service grid provided in an embodiment of the present disclosure;

[0025] Figure 3 A schematic diagram of another process of a distributed current limiting method based on a DPU service grid provided in an embodiment of the present disclosure;

[0026] Figure 4 An example diagram of distributed current limiting based on a DPU service grid provided in an embodiment of the present disclosure;

[0027] Figure 5 Another example diagram of distributed current limiting based on DPU service grid provided in an embodiment of the present disclosure;

[0028] Figure 6 A structural schematic diagram of a distributed current limiting device based on a DPU service grid provided in an embodiment of the present disclosure;

[0029] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0030] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0031] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0032] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0033] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0034] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0035] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0036] Service Mesh is an architectural pattern for managing inter-service communication in microservice applications. It separates service communication functions from application code and implements it as an independent infrastructure layer, thus providing a transparent, reliable and flexible service communication mechanism. Service Mesh is usually composed of a series of lightweight network proxies (such as Envoy), which are deployed together with application services to take over the network communication of services and implement functions such as service discovery, load balancing, traffic management, security authentication, and observability.

[0037] The disclosed embodiment of offloading the Sidecar proxy in the service grid from the host where the application is located to the smart network card (such as DPU) is an emerging hardware acceleration technology. DPU is a programmable smart network card with powerful network processing and computing capabilities. By offloading the Sidecar proxy from the host to the DPU, the CPU and memory load of the host can be reduced, saving valuable computing resources for the application itself. At the same time, the hardware acceleration and dedicated processing provided by the DPU can greatly improve the network performance and throughput of the proxy, achieving more efficient service communication.

[0038] Understandably, in the distributed architecture of the service mesh, the Sidecar proxy of each service instance usually works independently and lacks global coordination. When the traffic of multiple service replicas converges to the downstream service, the actual traffic may exceed the expected value.

[0039] To solve the above problems, a centralized current limiting mechanism is needed to coordinate the current limiting behavior of all distributed proxies. As a mature container orchestration platform, Kubernetes provides etcd distributed key-value storage, which is suitable as a configuration center for centralized current limiting rules. Through etcd's distributed lock and transaction mechanism, the allocation and use of current limiting quotas can be safely coordinated among all proxies, thereby achieving a globally consistent current limiting effect.

[0040] Kubernetes is a widely used container orchestration platform that provides a series of mechanisms to manage and coordinate large-scale containerized applications. Distributed lock etcd is a key component of Kubernetes, serving as the basis for implementing core functions such as cluster configuration storage and distributed locks.

[0041] Among them, etcd is a highly available distributed key-value storage system that uses the Raft consensus algorithm to ensure strong data consistency and fault tolerance. Kubernetes uses etcd to persist all configuration information of the cluster, including the status data of various resources such as nodes, services, Pods, and network policies. In addition to being a reliable storage, etcd also provides a distributed lock function, which ensures that only one of multiple competitors obtains the lock and accesses the shared resource at the same time until the lock is released actively or the session times out. This distributed lock mechanism is widely used in various distributed system scenarios that require global coordination and mutually exclusive access to resources.

[0042] The distributed current limiting method based on the DPU service grid provided in the embodiment of the present disclosure utilizes the distributed lock feature of Kubernetes etcd to solve the problem of traffic exceeding the limit caused by independent current limiting of multiple centralized agents, and realizes precise global current limiting control.

[0043] Specifically, the current limiting rule configuration in this solution is issued and dynamically updated by the agent component (control plane component) of the host, maintaining a certain degree of decentralization and flexibility. When actually executing the current limiting action, the centralized agent will request an etcd distributed lock from the Kubernetes cluster on the host side. When multiple agents request concurrently, only one agent can successfully obtain the lock, and the other agents need to wait or retry. The agent that obtains the lock will query the current global current limiting quota usage, make a decision to release or reject based on the size of the requested traffic, and release the lock after completing the processing, and update the global quota information. Due to the mutual exclusion of etcd locks, at most only one agent can process requests and consume the current limiting quota at the same time, thus avoiding the problem of total traffic exceeding the limit caused by the convergence of multiple inlet traffic.

[0044] Specifically, the problem of total traffic exceeding the limit caused by the convergence of multiple inlet traffic. In the distributed deployment environment of the service grid, the same service may have multiple instances running on different nodes, and each instance has a corresponding centralized proxy. These proxies independently limit the inlet traffic. When traffic from multiple inlets converges to the same service instance at the same time, the actual total traffic may exceed the preset limit threshold, affecting the stability of the service.

[0045] For example, Figure 1A As shown in the figure, we can see that the access of Node1's Pod-A service to Node2's Pod-B service is restricted by the Node1 DPU SOC (System On Chip, the operating system deployed on the DPU) side agent. Figure 1BAs shown in the figure, you can see that external traffic accessing Node2's Pod-B service is limited by the Node2 DPU SOC-side proxy. Assume that there is a service mesh in which the instance of service B, Pod-B, is deployed on the Node2 node. The centralized proxy of service B sets a traffic limit of 100MB / s. Now there are two inlet flows accessing service B at the same time: Pod-A on Node1 initiates a request to service B, and the request traffic is 100MB / s. At the same time, an external user request also directly accesses service B through the proxy on Node2, and the traffic is also 100MB / s.

[0046] Specifically, the working steps are as follows: 1. Pod-A's request first reaches the centralized proxy on Node1. 2. Node1's proxy performs flow limiting on the request and finds that the requested traffic is 100MB / s, which is exactly equal to the flow limiting threshold, so the request is released. 3. Pod-A's request is forwarded to the Pod-B instance on Node2 through the routing mechanism of the service grid. 4. At the same time, the external user's request arrives at the ingress gateway of Node2 and is forwarded to Node2's centralized proxy. 5. Node2's proxy also independently limits the request and also releases the 100MB / s traffic. 6. The external request is also forwarded to the Pod-B instance.

[0047] Therefore, in the above process, although the agents of Node1 and Node2 correctly implemented the 100MB / s flow limit, since they are processed independently, the traffic at both entrances is released, and the total traffic finally converged to the Pod-B instance reaches 200MB / s, which significantly exceeds the preset 100MB / s flow limit threshold and may cause Pod-B to be overloaded or unstable.

[0048] Among them, Pod is the smallest basic unit of deployment and management in the kubernetes cluster, with collaborative addressing and collaborative scheduling. Pod is a collection of one or more containers, an abstract collection of one or a group of services (processes). Pod can share network and storage (it can be simply understood as a logical virtual machine, but it is not a virtual machine); bridge is a network bridge, agent is a control plane component, and docker is an open source application container engine.

[0049] Specifically, Figure 2A flow chart of a distributed current limiting method based on a DPU service grid provided in an embodiment of the present disclosure is provided. The method can be performed by a distributed current limiting device based on a DPU service grid, wherein the device can be implemented by software and / or hardware and can generally be integrated in an electronic device. Uninstall each Sidecar agent corresponding to each service on the host, and install a centralized agent corresponding to each service on the DPU, such as Figure 2 As shown, the method includes:

[0050] Step 101: The centralized agent receives a service request and obtains a target service.

[0051] Specifically, one or more Pods in Kubernetes can simultaneously initiate a request for the same service or multiple services. Therefore, the centralized proxy receives the service request. It can be understood that the service request includes information such as the service identifier, so that the service request can be analyzed to obtain the target service, such as the aforementioned Figure 1A and Figure 1B In the example, Pod-B, an instance of service B, is deployed on Node2. Pod-A on Node1 initiates a service request to service B. It can be determined that the target service is service B.

[0052] Step 102: Determine whether to perform current limiting based on the target service and the pre-cached current limiting rules.

[0053] In the disclosed embodiment, a centralized control plane component is deployed on the host side of the Kubernetes cluster, which is responsible for monitoring service changes, dynamically generating and sending current limiting rules to the centralized agent of the DPU.

[0054] Specifically, the control plane component monitors the dynamic changes of services in the Kubernetes cluster, including events such as service creation, destruction, scaling, etc.; based on service changes and preset current limiting strategies, it dynamically generates and updates current limiting rules for each service, and sends the current limiting rules to the centralized agent on the DPU SOC side corresponding to the service instance, so that it can perform current limiting locally.

[0055] Therefore, after obtaining the target service, a match is performed based on the target service identifier and the current limiting rule, and whether to perform current limiting is determined based on the matching result.

[0056] Specifically, the flow limiting strategy and flow limiting rules of each centralized proxy may be different. The flow limiting rules usually include service identification, which uses the service name, namespace, etc. to uniquely identify the service; flow limiting threshold, which specifies the maximum flow limit of the service, such as the number of requests per second (QPS, Queries-Per-Second) or the amount of data per second (BPS, Bits Per Second); flow limiting algorithm, which specifies the implementation algorithm of flow limiting, such as token bucket, leaky bucket, etc.; flow limiting behavior, which specifies the processing behavior when the threshold is exceeded, such as rejecting requests, queuing, etc.; priority, which specifies the priority of the service, which is used to determine the order of flow limiting when resources are insufficient.

[0057] For example, suppose a service named "my-service" is created in the K8s cluster on the Host side. The control plane component monitors the events of the Kubernetes API Server and finds that a new service has been created. It may generate the following current limiting rules: {"service": "my-service", "namespace": "default", "maxQPS": 1000, "algorithm": "token-bucket", "behavior": "reject", "priority": "medium"}. This current limiting rule specifies that the maximum QPS of "my-service" is 1000, uses the token bucket algorithm, and directly rejects requests when the limit is exceeded. The priority is medium.

[0058] Step 103: When current limiting is performed, the control plane component on the host requests the distributed lock corresponding to the target service from the container orchestration platform Kubernetes.

[0059] Step 104: When the centralized proxy receives the distributed lock sent by the control plane component, it obtains the current remaining current limiting quota of the distributed lock.

[0060] Step 105: When the request flow of the service request is less than or equal to the current remaining flow limit quota, respond to the service request.

[0061] In the embodiment of the present disclosure, when it is determined to perform current limiting, the control plane component on the host requests the distributed lock corresponding to the target service from the container orchestration platform Kubernetes. If the centralized agent successfully obtains the distributed lock, that is, the etcd lock, it means that it is currently the only agent in the world that has the right to handle the current limiting of the service. It will query the current remaining current limiting quota recorded in etcd.

[0062] Furthermore, the centralized proxy compares the request flow with the current remaining flow-limiting quota. If the request flow is less than or equal to the current remaining flow-limiting quota, the centralized proxy will release the request, that is, respond to the service request.

[0063] The DPU service grid-based distributed current limiting solution provided by the embodiment of the present disclosure uninstalls each Sidecar agent corresponding to each service on the host, and installs a centralized agent corresponding to each service on the DPU, and the method includes: the centralized agent receives a service request and obtains a target service; determines whether to perform current limiting based on the target service and the pre-cached current limiting rules; when performing current limiting, requests a distributed lock corresponding to the target service from Kubernetes through a control plane component on the host; when the centralized agent receives the distributed lock sent by the control plane component, it obtains the current remaining current limiting quota of the distributed lock; and responds to the service request when the request flow of the service request is less than or equal to the current remaining current limiting quota. Therefore, the DPU hardware unloads the Sidecar agent. In the traditional service mesh solution, the Sidecar agent is deployed on the same host as the application, which occupies a large amount of CPU and memory resources and affects the performance of the application. By unloading the Sidecar agent to the smart network card DPU, the high-performance network processing capability of the DPU is used to perform traffic management and current limiting functions, which greatly reduces the resource overhead of the host and improves the performance and scalability of the service mesh. In addition, the control plane component on the host side requests a distributed lock to ensure the consistency and accuracy of the current limiting, and the current limiting rule management of the centralized agent also simplifies the update and distribution of the current limiting strategy, thereby improving the scalability of the service mesh.

[0064] Figure 3 A flow chart of another DPU service grid distributed current limiting method provided in an embodiment of the present disclosure, the method comprising:

[0065] Step 201, the centralized proxy receives the current limiting rules corresponding to each service sent by the control plane component on the host and caches them; wherein the control plane component monitors the update events of the services in the container orchestration platform Kubernetes cluster, and generates the current limiting rules corresponding to the services based on the update events and the preset current limiting policies.

[0066] Step 202: The centralized proxy receives the service request, obtains the target service, obtains the service identifier of the target service, performs matching based on the service identifier and the current limiting rule, and determines whether to perform current limiting based on the matching result.

[0067] Step 203: When current limiting is performed, a distributed lock corresponding to the target service is requested from the container orchestration platform Kubernetes through the control plane component on the host. When the centralized agent receives the distributed lock sent by the control plane component, the current remaining current limiting quota of the distributed lock is obtained.

[0068] Step 204: When the request flow of the service request is less than or equal to the current remaining flow limit quota, respond to the service request, update the current remaining flow limit quota and release the distributed lock.

[0069] Step 205: When the request flow is greater than the current remaining flow limit quota, retry or reject the service request and release the distributed lock.

[0070] Step 206: When the centralized agent does not receive the distributed lock sent by the control plane component, it requests the distributed lock corresponding to the target service from the container orchestration platform Kubernetes through the control plane component on the host after a preset time period or rejects the service request.

[0071] Step 207: The centralized agent sends current limiting execution feedback information to the control plane component on the host; wherein the current limiting execution feedback information is used to instruct the control plane component to perform global process monitoring and analysis.

[0072] Specifically, the Sidecar proxy is unloaded from the host where the application is located to the smart network card DPU, and the high-performance network processing capability of the DPU is used to perform traffic management and current limiting functions to reduce the burden on the host CPU; the control plane on the host side deploys a centralized control plane component on the host side of the Kubernetes cluster, which is responsible for monitoring service changes, dynamically generating and sending current limiting rules to the centralized agent of the DPU; global current limiting scheduling based on etcd distributed lock: using the distributed lock mechanism of Kubernetes etcd, coordinate the current limiting behavior of multiple centralized agents to ensure that the global current limiting quota is not overused.

[0073] For example, Figure 4 As shown in the figure, the functions or working steps of the Host-side agent component include: 1. Monitoring the dynamic changes of services in the Kubernetes cluster, including events such as service creation, destruction, scaling, etc.; 2. Dynamically generating and updating the current limiting rules for each service according to the changes in the services and the preset current limiting strategies; 3. Sending the current limiting rules to the centralized agent on the DPU SOC side corresponding to the service instance for it to execute the current limiting locally; collecting feedback information on the execution of current limiting from the SOC agent in a timely manner to perform global traffic monitoring and analysis; initializing the etcd distributed lock of the Kubernetes cluster for the SOC agent.

[0074] The feedback information may be, for example, flow limiting statistics, including the total number of requests, flow limiting times, rejection times, queue times, etc. for each service or interface, as well as corresponding derived indicators such as QPS and success rate, which can help the control plane understand the actual traffic situation of the service and evaluate the effectiveness of the flow limiting rules.

[0075] Specifically, the functions or working steps of the centralized proxy component on the DPU SOC side include: 1. The centralized proxy receives a service request and matches the current limiting rules of the local cache according to the target service and related metadata of the request; 2. If the request needs to be limited, the centralized proxy will try to apply for a distributed lock for the service from Kubernetes etcd; 3. If the centralized proxy successfully obtains the etcd lock, it means that it is currently the only centralized proxy globally authorized to handle the current limiting of the service, and it will query the current remaining current limiting quota recorded in etcd; 4. The centralized proxy compares the requested traffic with the remaining quota: a. If the requested traffic is less than or equal to the current remaining quota, the proxy will release the request, write the consumed quota back to etcd, and then release the lock; b. If the requested traffic exceeds the remaining quota, the proxy will reject the request, directly release the lock, and not consume the quota. 5. If the proxy does not obtain the etcd lock, it means that other proxies are currently processing the current limiting of the service, and the current proxy will enter the retry waiting preset time period, or directly reject the request; wherein, the preset time period can be set according to application needs.

[0076] Among them, there are many ways to match the local cached current limiting rules according to the target service and related metadata of the request, such as using a linear table (such as an array or a list) to store all the current limiting rules, and then traversing and matching each service request. Some optimizations can also be made to improve the matching efficiency, such as setting indexes and filtering. When storing current limiting rules, indexes can be created for key fields (such as service name, namespace, priority, etc.) to speed up the search; when matching, the centralized proxy can use the index to quickly locate the candidate current limiting rules based on the attributes of the service request, and then perform further comparison and filtering to find the final applicable current limiting rules.

[0077] As an example, Figure 5 As shown, step 5.1 the service request arrives at the centralized proxy; step 5.2 whether the service request needs to be limited; if so, execute step 5.3 to match the current limiting rules corresponding to the service request; step 5.4 try to obtain the etcd distributed lock; if the acquisition is successful, execute step 5.5 to query the remaining quota in etcd; if the request flow is less than or equal to the remaining quota, execute step 5.6 to release the service request and update the etcd quota; if the request flow is greater than the remaining quota, execute step 5.7 to retry or reject the request. In addition, if the etcd distributed lock is not obtained, also execute step 5.7 to retry or reject the request; step 5.8 releases the etcd distributed lock; if no current limiting is required, execute step 5.9 to release the service request; step 5.10 The service request is processed.

[0078] Therefore, the Sidecar proxy is unloaded through the DPU hardware. In the traditional service grid solution, the Sidecar proxy and the application are deployed on the same host, which occupies a large amount of CPU and memory resources and affects the performance of the application. The disclosed embodiment unloads the Sidecar proxy to the smart network card DPU, and uses the high-performance network processing capability of the DPU to perform traffic management and current limiting functions, which greatly reduces the resource overhead of the host and improves the performance and scalability of the service grid.

[0079] Therefore, the centralized flow limiting rule management, the disclosed embodiment introduces a control plane component deployed on the host side, which is responsible for monitoring the dynamic changes of services in the Kubernetes cluster, automatically generating and sending flow limiting rules to the centralized agent of the DPU; this centralized flow limiting rule management simplifies the operation and maintenance work, and improves the consistency and real-time performance of the flow limiting strategy. Compared with traditional manual configuration or template generation, this solution realizes the automation and intelligence of flow limiting rules.

[0080] Therefore, based on the global current limiting coordination of etcd distributed locks and utilizing the distributed lock mechanism of Kubernetes etcd, the problem of global traffic exceeding the limit caused by independent current limiting of multiple centralized proxies in the service mesh is cleverly solved; by competing for etcd locks, at most only one proxy can consume the global current limiting quota at the same time, ensuring the consistency and accuracy of current limiting across proxies.

[0081] Therefore, by integrating the Kubernetes ecosystem, the disclosed embodiment fully utilizes various native components and mechanisms of the Kubernetes platform, such as etcd, service discovery, configuration management, etc., so that the current limiting solution can be seamlessly integrated into the Kubernetes environment, reducing the complexity of implementation and operation and maintenance. At the same time, the disclosed embodiment also embodies a best practice of combining service grid with Kubernetes, showing the advantages of cloud-native architecture.

[0082] Therefore, high performance and scalability, through DPU hardware offloading and centralized flow control management, the disclosed implementation can support high-performance traffic control of large-scale service grids, offloading the Sidecar proxy from the host to the DPU, which not only reduces the host overhead, but also uses the high-speed network processing capabilities of the DPU to improve the throughput of the proxy and reduce latency. At the same time, centralized flow control rule management also simplifies the update and distribution of flow control policies, improving the scalability of the service grid.

[0083] In the above embodiments, the high-performance network processing capability of the DPU hardware is fully utilized to offload the current limiting execution to the SOC side, thereby reducing the burden on the host CPU; the configuration management of the current limiting rules is centralized on the agent component on the host side, thereby simplifying the operation and maintenance work and improving the consistency of the current limiting strategy; the agent component is connected to the Kubernetes cluster to automatically generate and distribute the current limiting rules by monitoring the dynamic changes of the service instances, thereby reducing the errors and delays of manual configuration; finally, with the help of the distributed lock mechanism of Kubernetes etcd, the agent component coordinates the current limiting behaviors of multiple SOC agents to ensure that the global current limiting quota is not overused.

[0084] Figure 6 The present invention provides a structural diagram of a distributed current limiting device based on a DPU service grid, which can be implemented by software and / or hardware and can generally be integrated into an electronic device. Figure 6 As shown, each Sidecar agent corresponding to each service on the host is uninstalled, and a centralized agent corresponding to each service is installed on the DPU. The device includes:

[0085] Receiving and obtaining module 601, used for the centralized agent to receive service requests and obtain target services;

[0086] A determination module 602 is used to determine whether to perform current limiting based on the target service and the pre-cached current limiting rules;

[0087] The request module 603 is used to request the distributed lock corresponding to the target service from the container orchestration platform Kubernetes through the control plane component on the host when current limiting is performed;

[0088] An acquisition module 604 is configured to acquire the current remaining current limiting quota of the distributed lock when the centralized agent receives the distributed lock sent by the control plane component;

[0089] The response module 605 is used to respond to the service request when the request flow of the service request is less than or equal to the current remaining flow limiting quota.

[0090] Optionally, the device further includes:

[0091] The update release module is used to update the current remaining current limiting quota and release the distributed lock.

[0092] Optionally, the device further includes:

[0093] A retry rejection module is used to retry or reject the service request and release the distributed lock when the request flow is greater than the current remaining flow limit quota.

[0094] Optionally, the device further includes:

[0095] A processing module is used for requesting the distributed lock corresponding to the target service from the container orchestration platform Kubernetes through the control plane component on the host after a preset time period when the centralized agent fails to receive the distributed lock sent by the control plane component, or rejecting the service request.

[0096] Optionally, the device further includes:

[0097] The first sending module is used for the centralized agent to receive and cache the flow limiting rules corresponding to each service sent by the control plane component on the host; wherein the control plane component monitors the update events of the services in the container orchestration platform Kubernetes cluster, and generates the flow limiting rules corresponding to the services based on the update events and the preset flow limiting strategy.

[0098] Optionally, the device further includes:

[0099] The second sending module is used for the centralized agent to send current limiting execution feedback information to the control plane component on the host; wherein the current limiting execution feedback information is used to instruct the control plane component to perform global process monitoring and analysis.

[0100] The determining module 602 is specifically configured to:

[0101] Obtaining a service identifier of the target service;

[0102] A match is performed based on the service identifier and the current limiting rule, and whether to perform current limiting is determined based on the matching result.

[0103] The DPU service grid-based distributed current limiting device provided in the embodiments of the present disclosure can execute the DPU service grid-based distributed current limiting method provided in any embodiment of the present disclosure, and has the corresponding functional modules and beneficial effects of the execution method.

[0104] An embodiment of the present disclosure also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the DPU service grid-based distributed current limiting method provided by any embodiment of the present disclosure.

[0105] Figure 7 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure. Figure 7, which shows a schematic diagram of the structure of an electronic device 700 suitable for implementing the embodiment of the present disclosure. The electronic device 700 in the embodiment of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0106] like Figure 7 As shown, the electronic device 700 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage device 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the electronic device 700 are also stored. The processing device 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0107] Typically, the following devices may be connected to the I / O interface 705: an input device 706 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 707 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 708 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 709. The communication device 709 may allow the electronic device 700 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 7 The electronic device 700 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0108] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 709, or installed from the storage device 708, or installed from the ROM 702. When the computer program is executed by the processing device 701, the above functions defined in the DPU service grid distributed current limiting method of the embodiment of the present disclosure are executed.

[0109] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0110] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (Hyper Text Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0111] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0112] The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: generates a high-availability data processing unit DPU group; wherein the high-availability DPU group includes at least two DPUs, and each DPU has a corresponding priority identifier; generates a logical router, and configures the logical port of the logical router according to the corresponding priority identifier of each DPU; when creating a container, configures the network mode information corresponding to the container; wherein the network mode information corresponds to the logical port of the logical router.

[0113] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0114] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0115] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit does not, in some cases, constitute a limitation on the unit itself.

[0116] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0117] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0118] According to one or more embodiments of the present disclosure, the present disclosure provides an electronic device, including:

[0119] processor;

[0120] a memory for storing instructions executable by the processor;

[0121] The processor is used to read the executable instructions from the memory and execute the instructions to implement any DPU service grid distributed current limiting method provided in the present disclosure.

[0122] According to one or more embodiments of the present disclosure, the present disclosure provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program is used to execute any of the DPU service grid-based distributed flow limiting methods provided by the present disclosure.

[0123] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0124] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0125] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A distributed current limiting method based on DPU service grid, characterized in that: Uninstalling each Sidecar agent corresponding to each service on the host, and installing a centralized agent corresponding to each service on the DPU, the method comprising: The centralized agent receives the service request and obtains the target service; Determining whether to perform current limiting based on the target service and the pre-cached current limiting rules; In the case of current limiting, requesting a distributed lock corresponding to the target service from the container orchestration platform Kubernetes through the control plane component on the host; When the centralized agent receives the distributed lock sent by the control plane component, it obtains the current remaining current limiting quota of the distributed lock; When the request flow of the service request is less than or equal to the current remaining flow limiting quota, respond to the service request.

2. The distributed current limiting method based on DPU service grid according to claim 1 is characterized in that: After responding to the service request, the method further includes: The current remaining current limiting quota is updated and the distributed lock is released.

3. The distributed current limiting method based on DPU service grid according to claim 1 is characterized in that: The method further comprises: When the request flow is greater than the current remaining flow limit quota, the service request is retried or rejected and the distributed lock is released.

4. The distributed current limiting method based on DPU service grid according to claim 1 is characterized in that: The method further comprises: When the centralized agent does not receive the distributed lock sent by the control plane component, it requests the distributed lock corresponding to the target service from the container orchestration platform Kubernetes through the control plane component on the host after a preset time period or rejects the service request.

5. The distributed current limiting method based on DPU service grid according to claim 1 is characterized in that: The method further comprises: The centralized agent receives and caches the flow limiting rules corresponding to each service sent by the control plane component on the host; wherein the control plane component monitors the update events of the services in the container orchestration platform Kubernetes cluster, and generates the flow limiting rules corresponding to the services based on the update events and the preset flow limiting strategies.

6. The distributed current limiting method based on DPU service grid according to claim 1 is characterized in that: The method further comprises: The centralized agent sends current limiting execution feedback information to the control plane component on the host; wherein the current limiting execution feedback information is used to instruct the control plane component to perform global process monitoring and analysis.

7. The distributed current limiting method based on DPU service grid according to claim 1 is characterized in that: The determining whether to perform current limiting based on the target service and the pre-cached current limiting rule includes: Obtaining a service identifier of the target service; A match is performed based on the service identifier and the current limiting rule, and whether to perform current limiting is determined based on the matching result.

8. A distributed current limiting device based on a DPU service grid, characterized in that: Uninstalling each Sidecar agent corresponding to each service on the host, and installing a centralized agent corresponding to each service on the DPU, the device comprising: A receiving and obtaining module, used for the centralized agent to receive a service request and obtain a target service; A determination module, used to determine whether to perform current limiting based on the target service and the pre-cached current limiting rules; A request module, used to request a distributed lock corresponding to the target service from the container orchestration platform Kubernetes through the control plane component on the host when current limiting is performed; An acquisition module, configured to acquire the current remaining current limiting quota of the distributed lock when the centralized agent receives the distributed lock sent by the control plane component; The response module is used to respond to the service request when the request flow of the service request is less than or equal to the current remaining flow limiting quota.

9. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing instructions executable by the processor; The processor is used to read the executable instructions from the memory and execute the instructions to implement the DPU service grid distributed current limiting method described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and the computer program is used to execute the DPU service grid distributed current limiting method described in any one of claims 1 to 7.

Images