Service providing method and device

Abstract

The invention provides a service providing method and device, and relates to the technical field of cloud computing. The method comprises the following steps: a data plane communication agent module in a first container cluster receives a first domain name resolution request of a first client for the domain name, and queries whether the domain name is a global domain name from a grid control module, and if so, the grid control module resolves a global private network IP address corresponding to the global domain name; if not, the data plane communication agent module sends the first domain name resolution request to a domain name resolution module in the first container cluster; the domain name analysis module analyzes a private network IP address in the first container cluster corresponding to the domain name according to the domain name. For the services with the same domain name in the multiple container clusters, if the domain name is the global domain name, the client of any container cluster can access any service instance corresponding to the global domain name according to the global private network IP address, and conflicts of the services with the same name in the multiple container clusters are avoided.

Description

[0001] This application claims the priority of the Chinese patent application filed with the China Patent Office on August 14, 2023, with application number 202311020384.9 and application name “Grid Global Service Resolution Method and Device”, all contents of which are incorporated by reference in this application. Technical Field

[0002] The present application relates to the field of cloud computing technology, and more specifically, to a service providing method and device. Background Art

[0003] Microservices is a distributed software architecture style that is based on small building blocks that focus on a single responsibility and function. It uses a modular approach to combine complex large applications. Each building block uses an application programming interface (API) set to communicate with each other.

[0004] Service mesh technology can separate the non-functional service governance logic in distributed applications of microservice architecture from the business process and transfer the non-functional service governance logic to the sidecar module.

[0005] Service mesh can be applied to multiple container cluster scenarios. How to avoid conflicts between services with the same name in multiple container clusters is an urgent problem to be solved. Summary of the invention

[0006] The present application provides a service providing method and device, which can avoid conflicts between services with the same name in multiple container clusters.

[0007] In a first aspect, a service provision method is provided, which is applied to a service grid system, wherein the service grid system includes a first container cluster, a second container cluster and a grid control module, wherein the first container cluster is configured with at least one first service instance running a first service, and the second container cluster is configured with at least one second service instance running a second service, wherein the first service and the second service are set with the same domain name in the service grid system, and the grid control module is used to record whether the domain name is a global domain name, wherein the method includes: a data plane communication agent module in the first container cluster receives a first domain name resolution request for the domain name from a first client; the data plane communication agent module in the first container cluster queries the grid control module whether the domain name is a global domain name, and if so, the grid control module resolves a global private Internet Protocol (IP) address corresponding to the global domain name; if not, the data plane communication agent module in the first container cluster sends the first domain name resolution request to the domain name resolution module in the first container cluster; the domain name resolution module in the first container cluster resolves the domain name corresponding to the private IP address in the first container cluster according to the domain name.

[0008] In the embodiment of the present application, the service with a global domain name has a global private IP address, and the service without a global domain name only has a private IP address within the container cluster. Therefore, for services with the same domain name in multiple container clusters, as long as the domain name is a global domain name, then the client in any container cluster can access any service instance corresponding to the global domain name based on the global private IP address, thereby avoiding conflicts between services with the same name in multiple container clusters. In addition, the data plane communication proxy module at the service grid level and the domain name resolution module at the container cluster level are cascaded. If the domain name is not a global domain name, the private IP address in the container cluster can be easily found based on the domain name resolution module, thereby improving the applicability of the provided method.

[0009] In combination with the first aspect, in some implementations of the first aspect, the method also includes: the data plane communication proxy module in the second container cluster receives a second domain name resolution request for the domain name from the second client; the data plane communication proxy module in the second container cluster queries the grid control module whether the domain name is a global domain name, and if so, the grid control module resolves the global private IP address corresponding to the global domain name; if not, the data plane communication proxy module in the second container cluster sends the second domain name resolution request to the domain name resolution module in the second container cluster; the domain name resolution module in the second container cluster resolves the private IP address in the second container cluster corresponding to the domain name according to the domain name.

[0010] The access process of the second container cluster is similar to that of the first container cluster, which further illustrates that for services with the same domain name in multiple container clusters, as long as the domain name is a global domain name, then the client in any container cluster can access any service instance corresponding to the global domain name based on the global private IP address, thereby avoiding conflicts between services with the same name in multiple container clusters.

[0011] In combination with the first aspect, in some implementations of the first aspect, the service mesh system also includes a sidecar module, and the method also includes: the data plane communication proxy module in the first container cluster sends the global private network IP address to the first client; the first client forwards the first access request for the global private network IP address to the service instance among the at least one first service instance and the at least one second service instance through the sidecar module; or, the sidecar module intercepts the first access request for the global private network IP address; the sidecar module forwards the first access request to the service instance among the at least one first service instance and the at least one second service instance.

[0012] Based on the above solution, in the scenario where multiple container clusters with services with the same global domain name are merged, clients in any container cluster can implement advanced service governance through the sidecar module through the global private IP address, thereby improving the service quality provided by the container cluster.

[0013] In combination with the first aspect, in some implementations of the first aspect, the method further includes: a domain name resolution module in the first container cluster sends the private IP address in the first container cluster to the first client; the first client forwards the second access request for the private IP address in the first container cluster to a service instance in the at least one first service instance through the container proxy module in the first container cluster; or, the container proxy module in the first container cluster intercepts the second access request for the private IP address in the first container cluster; the container proxy module in the first container cluster forwards the second access request to the service instance in the at least one first service instance.

[0014] Based on the above scheme, when the access request is for a service that cannot apply the sidecar module for advanced service governance, compared to the scheme of first intercepting the access request into the sidecar module and then forwarding it to the container proxy module for load balancing, the service provision method of the embodiment of the present application will not additionally intercept the access request into the sidecar module, but will directly perform load balancing through the container proxy module, thereby reducing overhead and improving the efficiency of providing services.

[0015] In combination with the first aspect, in certain implementations of the first aspect, before the data plane communication proxy module in the first container cluster receives the first domain name resolution request for the domain name from the first client, the method also includes: receiving indication information, the indication information is used to instruct the target service to join the service grid system, wherein the target service includes the first service and / or the second service; determining that the target service is a grid-level service; the grid control module records the domain name as the global domain name, and creates the global private network IP address.

[0016] Based on the above solution, when the target service is a grid-level service, a global private IP address is created for the target service, so that the target service can use the global private IP address for service management, avoiding conflicts between services with the same domain name, and enabling the target service to apply advanced service management functions.

[0017] In combination with the first aspect, in certain implementations of the first aspect, determining that the target service is a grid-level service includes: determining that the target service is a grid-level service when the service policy of the service grid system is that the default service is a grid-level service, and the configuration file of the target service does not include comments; or determining that the target service is a grid-level service when the service policy of the service grid system is that the default service is a non-grid-level service, and the configuration file of the target service includes comments.

[0018] Based on the above scheme, users can flexibly configure whether a service is a grid-level service. For grid-level services, a service grid address can be generated and high-level service governance can be applied. For non-grid-level services, a simple load balancing connection to the backend instance can be used without being redundantly intercepted by the sidecar module. Therefore, the service provision method of the embodiment of the present application can improve the efficiency of service provision.

[0019] In combination with the first aspect, in some implementations of the first aspect, the method further includes: the grid control module generates a first interception rule, and the first interception rule is used to intercept the domain name resolution request to the data plane communication proxy module.

[0020] Based on the above solution, the domain name resolution request is intercepted by the data plane communication proxy module, and then the global private network IP address is found. The service providing method of the embodiment of the present application can accurately obtain the global private network IP address, thereby preventing conflicts between services with the same domain name.

[0021] In combination with the first aspect, in some implementations of the first aspect, the method further includes: the grid control module generates a second interception rule, and the second interception rule is used to intercept the first access request for the global private network IP address to the sidecar module.

[0022] The related technical solution only generates interception rules for private IP addresses in the container cluster, which will cause conflicts when multiple container clusters with services with the same domain name are merged. The second interception rule of the embodiment of the present application can intercept access requests for global private IP addresses to the sidecar module, which can avoid conflicts between services with the same name in the container cluster, and enable any container cluster in multiple container clusters to apply advanced service governance, thereby improving the quality of service provision.

[0023] In combination with the first aspect, in some implementations of the first aspect, at least one first service instance and at least one second service instance are implemented through a container group.

[0024] In combination with the first aspect, in some implementations of the first aspect, the first client is set in the first container cluster, and the second client is set in the second container cluster.

[0025] In a second aspect, an embodiment of the present application provides a service providing device, which includes a module for implementing the first aspect or any possible implementation method of the first aspect.

[0026] According to a third aspect, a computing device is provided, including a processor and a memory, wherein the processor is configured to execute instructions stored in the memory so that the computing device executes the service providing method of the first aspect or any possible implementation of the first aspect.

[0027] According to a fourth aspect, a computer program product comprising instructions is provided. When the instructions are executed by a computing device, the computing device executes the service providing method according to the first aspect or any possible implementation of the first aspect.

[0028] In a fifth aspect, a computer-readable storage medium is provided, comprising computer program instructions. When the computer program instructions are executed by a computing device, the computing device executes the service providing method of the first aspect or any possible implementation of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a schematic block diagram of a service grid system.

[0030] Figure 2 It is a schematic diagram of a service provision method.

[0031] Figure 3 It is a schematic flowchart of a service providing method provided in an embodiment of the present application.

[0032] Figure 4 It is a schematic flowchart of another service providing method provided in an embodiment of the present application.

[0033] Figure 5 It is a schematic block diagram of a service providing device provided in an embodiment of the present application.

[0034] Figure 6 It is a schematic block diagram of a computing device provided in an embodiment of the present application.

[0035] Figure 7 It is a schematic block diagram of a computing device cluster provided in an embodiment of the present application.

[0036] Figure 8 It is a schematic block diagram of another computing device cluster provided in an embodiment of the present application. DETAILED DESCRIPTION

[0037] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0038] The present application will present various aspects, embodiments or features around a system that may include multiple devices, components, modules, etc. It should be understood and appreciated that each system may include additional devices, components, modules, etc., and / or may not include all of the devices, components, modules, etc. discussed in conjunction with the figures. In addition, combinations of these schemes may also be used.

[0039] In addition, in the embodiments of the present application, words such as "exemplary" and "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present concepts in a concrete way.

[0040] The business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Ordinary technicians in this field can know that with the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0041] References to "one embodiment" or "some embodiments" etc. described in this specification mean that a particular feature, structure or characteristic described in conjunction with the embodiment is included in one or more embodiments of the present application. Thus, the phrases "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. appearing in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0042] Service mesh technology can separate the non-functional service governance logic in the distributed application of microservice architecture from the business process and transfer the non-functional service governance logic to the sidecar module. For example, the non-functional service governance logic can include the use of the transport layer security (TLS) protocol to encrypt connections with other services, routing according to the hypertext transfer protocol (HTTP) and uniform resource locator (URL), gray release according to the content carried in the HTTP header, call chain tracking, traffic restriction and other capabilities.

[0043] In addition, service mesh technology provides each service with inter-service connectivity, security, traffic control, grayscale release, observation and other capabilities in a non-invasive manner, achieving lightweight business and infrastructure-based service governance. For example, service mesh can be implemented through the Istio system.

[0044] The service mesh can be applied to a single container cluster scenario or to multiple container cluster scenarios. The container cluster here can refer to the helmsman (kubernetes, K8s) cluster, which can include a control node (also called a master node) and a controlled node (also called a node node). In addition, the service mesh can include a control plane and a data plane. The control plane is used to control the various functions of the data plane (such as a container cluster).

[0045] Among them, the master node is responsible for controlling the scheduling. For example, the master node can include a scheduling (kube-schedule) component, and the kube-schedule component can select a node for the newly created pod. A pod can include multiple containers, and a pod can be the smallest deployment unit in a container cluster. In other words, a pod can be regarded as a container group. Each microservice can be set or run in a pod. Microservices can also be called microservice applications, which can implement an independent business logic. Multiple microservices can provide corresponding business functions through calling and being called relationships.

[0046] Among them, the node is responsible for the workload. For example, the node may include a container proxy module, which may also be called a kube-proxy component. The kube-proxy component may perform load balancing and evenly distribute the traffic received by the node to each pod mounted under the node.

[0047] In the scenario of a service grid with a single container cluster, only one container cluster can be added to each service grid. When creating a service, the container cluster can control the newly created domain name to not conflict with the existing domain name in the container cluster. In other words, the container cluster can control the domain name to be unique and non-conflicting. The domain name here can be the name of the service (SVC). SVC defines the logical set of pods and the policy for accessing the logical set. In other words, in the scenario of a service grid with a single container cluster, an SVC in a container cluster corresponds to a group of pods in the container cluster.

[0048] In the scenario of a service grid with multiple container clusters, each service grid can contain multiple container clusters. When creating a service grid, if you can strictly require the container cluster and do not allow the container cluster to create SVC in advance, then you can control the domain name of the newly added SVC to be unique and non-conflicting through the control plane of the service grid (such as the control plane of istio). However, if container clusters with existing SVCs are allowed to be added to the service grid, it is possible that multiple container clusters will contain SVCs with the same domain name that have been created. At this time, how to globally handle these SVCs added to the grid will cause usage problems. The following is combined with Figure 1 Detailed introduction.

[0049] Figure 1 is a schematic block diagram of a service grid system 100. Figure 1 The service mesh system 100 includes a mesh control module 110, which can be a control plane of the service mesh. The service mesh system 100 also includes a container cluster 120 and a container cluster 130, and the mesh control module 110 is used to control the container cluster 120 and the container cluster 130, which can also be regarded as a data plane.

[0050] Assume that container cluster 120 is a cluster pre-created in service grid system 100, and container cluster 130 is a cluster that joins service grid system 100 later. In other words, container cluster 120 is a cluster that reports to grid control module 110 first, and container cluster 130 is a cluster that reports to grid control module 110 later.

[0051] Assume that the domain name of an SVC running in container cluster 120 is SVC1, and the cluster private Internet protocol (cluster IP) address corresponding to SVC1 is 10.1.1.1, which is created by container cluster 120 for SVC1 in container cluster 120, and the address 10.1.1.1 corresponds to service instances pod1 and pod2. The domain name of another SVC running in container cluster 130 is also SVC1, and the cluster IP address corresponding to SVC1 is 10.2.2.2, which is created by container cluster 130 for SVC1 in container cluster 130, and the address corresponds to service instances pod3 and pod4.

[0052] It should be noted that the above assumption is only for the convenience of description, and does not limit the address of the container cluster to 10.1.1.1 or 10.2.2.2. Obviously, the address can also be set to other settings, such as 20.2.2.2.

[0053] The same-named SVCs of the above two different container clusters correspond to different private IP addresses. This is because, at the beginning, the container cluster 130 is not added to the service grid system 100, and the user needs to distinguish the SVCs in the two container clusters so that the service address segment of the SVC (such as the clusterIP domain name segment) and the address segment of the pod do not conflict and can be connected to each other.

[0054] However, later, container cluster 130 joins service grid system 100, and a conflict occurs because container cluster 120 and container cluster 130 include SVCs with the same name. The specific conflict process can be found below. Here, some embodiments of service grid system 100 are first introduced, and the specific conflict process is not repeated.

[0055] Each container cluster may also include a domain name resolution module 140 and a container proxy module 150. The domain name resolution module 140 may also be referred to as a core domain name system (coreDNS), and the domain name resolution module 140 may be used to resolve the SVC address of the container cluster; the container proxy module 150 may also be referred to as kube-proxy, and the container proxy module 150 may distribute traffic to the pods under the container cluster according to the inherent iptables rules of the container cluster to achieve simple load balancing.

[0056] The service grid system 100 also includes an interception module 160 and a sidecar module 170. After the grid control module 110 monitors the existence of SVC and the corresponding backend pod instance in the service grid system 100, on the one hand, it can send the service grid configuration to the sidecar module 170. The service grid configuration includes information such as the governed service address, governance policy, and pod address that can be allocated in load balancing. For example, the governed service address is the address of a certain order service request, and the governance policy is to deny access when the HTTP header of the order service request contains a certain identifier. For another example, the governed service address is the address of a certain payment service request, and the governance policy is to forward the payment service request to pod1 when the HTTP header of the payment service request contains certain information. On the other hand, in order to realize the requirement of transparently intercepting client requests to the sidecar module 170, a newly added iptables rule can be sent to the interception module 160. The interception module 160 can intercept the corresponding access request to the sidecar module 170 according to the iptables rule. For example, the iptables rule can be 10.x, so that before container cluster 130 is added, the traffic that wants to access SVC1 of container cluster 120 will be blocked. "Newly added iptables rules" are relative to the inherent iptables rules of the container cluster. Generally speaking, the newly added iptables rules are more complex and flexible, and can achieve more advanced traffic distribution functions and more effective load balancing.

[0057] A more detailed description of the domain name resolution module 140 , the container proxy module 150 , the interception module 160 , and the sidecar module 170 may be found later and will not be repeated here.

[0058] It is worth noting that the domain name resolution module 140 and the container proxy module 150 can be located in each container cluster to resolve the SVC address of the container cluster. Although the interception module 160 and the sidecar module 170 can also be located in each container cluster, they can be at the service grid level. That is to say, for the service grid system 100, the interception module 160 and the sidecar module 170 can work on the container cluster 120 and the container cluster 130, and are not limited to the container cluster 120 or the container cluster 130. The interception module 160 can correspond to one or more nodes, one or more pods, or one or more container clusters. The sidecar module 170 can correspond to one or more nodes, one or more pods, or one or more container clusters.

[0059] Figure 2 2 is a schematic diagram of a service providing method 200. The method 200 may be directed to the service grid system 100.

[0060] When the container cluster 130 is not added to the service mesh system 100, the service mesh system 100 includes the container cluster 120. The client 121 is located in the container cluster 120 and can access the pods of the container cluster 120, such as pod1 and pod2. The client 131 is located in the container cluster 130 and can access the pods of the container cluster 130, such as pod3 and pod4.

[0061] At present, after the container cluster 130 joins the service mesh system 100, the clusterIP address corresponding to the SVC can be determined according to the order of joining, that is, pod3 and pod4 also correspond to 10.1.1.1, rather than 10.2.2.2. In general, if the container cluster 120 joins the service mesh system 100 first, and the container cluster 130 joins the service mesh system 100 later, then no matter which container cluster is used to access SVC1, as long as the traffic is intercepted by the interception module 160 and enters the sidecar module 170, the service mesh configuration corresponding to the SVC can only be found in the sidecar module 170 according to the address 10.1.1.1, and the addresses of other SVCs are considered to be free of governance and enter the passthrough process.

[0062] Specifically, on the one hand, when the grid control module 110 sends the service grid configuration to the sidecar module 170, the clusterIP address corresponding to SVC1 is 10.1.1.1 (container cluster 120), and the service grid configuration includes backend services pod1 to pod4 involving two container clusters, so that requests to access 10.1.1.1 can not only access pod1 and pod2, but also pod3 and pod4. On the other hand, the grid control module 110 sends the newly added iptables rules to the sidecar module 170, and the newly added iptables rules are still used to intercept the client's access to the address 10.x. However, due to the addition of the container cluster 130, requests to access 10.2.2.2 will also be intercepted.

[0063] The following takes the access initiated by the client 121 and the client 131 as examples to introduce various actions included in the service request resolution method 200 and the specific conflict process of the same-name service.

[0064] S211, the client 121 accesses SVC1, or in other words, the client 121 sends an access request to SVC1.

[0065] S212, the access request is first intercepted by the iptables rules inherent in the container cluster 120, generating a DNS query request with port 53, and then transferring the DNS query request to the domain name resolution module 140 in the container cluster 120 for resolution. The resolution result is the 10.1.1.1 address (hereinafter referred to as clusterIP1).

[0066] S213, the access to the clusterIp1 address is intercepted by the newly added iptables rule and enters the sidecar module 170. In other words, 10.1.1.1 is intercepted by the newly added iptables rule (10.x) and enters the sidecar module 170.

[0067] S214, the sidecar module 170 performs service governance according to the service grid configuration to match the governed service address and governance policy corresponding to clusterIp1, and can select the backend instance of pod1~pod4 in the load balancing stage, and then send the access request to the selected pod.

[0068] It can be seen that, for the access initiated by the client 121 , the service grid system 100 can parse and select pods in the original container cluster 120 and the newly added container cluster 130 .

[0069] In fact, the reason why users add two container clusters to the service grid is often to hope that no matter in which cluster, the client accessing SVC1 should be able to correctly enter the data plane proxy and use all pod1 to pod4 backend instances. If only the access initiated by client 121 is considered, method 200 can meet the requirements. However, this is not the case for the access initiated by client 131. The access initiated by client 131 cannot meet the above requirements, as described below.

[0070] S231, the client 131 accesses SVC1, or in other words, the client 131 sends an access request to SVC1.

[0071] S232, the access request is first intercepted by the iptables rules inherent in the container cluster 130, generating a DNS query request with port 53, and then transferring the DNS query request to the domain name resolution module 140 in the container cluster 130 for resolution. The resolution result is the address 10.2.2.2 (hereinafter referred to as clusterIP2).

[0072] S233, due to the newly added iptables rule issued by the grid control module 110, the access to the clusterIp2 address is intercepted by the newly added iptables rule and enters the sidecar module 170. In other words, 10.2.2.2 is intercepted by the newly added iptables rule (10.x) and enters the sidecar module 170.

[0073] S234, because the service address to be governed in the service grid configuration sent by the grid control module 110 to SVC1 is clusterIp1 (i.e. 10.1.1.1), the service address 10.2.2.2 will not match the governance policy. Therefore, 10.2.2.2 will be treated as a direct connection request to an unknown address. At this time, the sidecar module 170 will directly create a connection to this address and forward the access request to the container proxy module 150 in the container cluster 130.

[0074] In addition, in order to prevent the traffic sent from the sidecar module 170 from being intercepted by the interception module 160 again and entering the sidecar module 170, the process identifier (PID), user identifier (UID) or group identifier (GID) can be monitored. Only when the PID, UID or GID of the access request is not related to the sidecar module 170 and complies with the newly added iptables rules, the interception module 160 will intercept the access request into the sidecar module 170.

[0075] S235, the container proxy module 150 performs simple load balancing according to the inherent iptables rules of the container cluster 130, finds the backend pod3 or pod4, and forwards the access request to the corresponding pod.

[0076] It can be seen that for the access initiated by the client 131, the service grid system 100 can only select the pod in the container cluster 130 where the client 131 is located for load balancing, and cannot use the pod in the container cluster 120, which deviates from the original intention of the user to merge the two clusters. In addition, for the access initiated by the client 131, only the inherent iptables rules can be used for simple load balancing (for example, sending traffic to each pod in turn), and the service governance capabilities of the sidecar module 170 or more advanced load balancing (for example, identifying the information carried in the HTTP header and forwarding it to the corresponding pod) cannot be applied. Not only that, but if there is no sidecar module 170, the access initiated by the client 131 can also be simply load balanced through the inherent iptables rules of the container cluster 130. This method 200 allows the access request to be intercepted in the sidecar module 170 first, but the sidecar module 170 does not do any meaningful processing, thus causing unnecessary performance overhead and reducing system efficiency.

[0077] Therefore, how to avoid conflicts between services with the same name in multiple container clusters is an urgent problem to be solved.

[0078] Figure 3 3 is a schematic flow chart of a service providing method 300 provided in an embodiment of the present application. The method 300 can avoid the conflict problem of services with the same name in the above-mentioned multiple container clusters.

[0079] The above method 300 can be applied to a service grid system 100, which includes a first container cluster, a second container cluster and a grid control module 110. The first container cluster is configured with at least one first service instance running a first service, and the second container cluster is configured with at least one second service instance running a second service. The first service and the second service are set with the same domain name in the service grid system 100, and the grid control module 110 is used to record whether the domain name is a global domain name.

[0080] For example, the first container cluster can be Figure 1 In the container cluster 120, the second container cluster may be Figure 1 The first service may be a service with a domain name SVC1 in the container cluster 120, and the first service instance may be pod1 and pod2. The second service may be a service with a domain name SVC1 in the container cluster 130, and the second service instance may be pod3 and pod4.

[0081] S310: The data plane communication proxy module 180 in the first container cluster receives a first domain name resolution request from a first client for the domain name.

[0082] The present application does not limit the data plane communication proxy module 180, and the data plane communication proxy module 180 can process the first domain name resolution request. For example, the data plane communication proxy module 180 can be a pilot-agent module, which is a process associated with the data plane proxy in a service grid, and can be used to be responsible for the communication transfer and certificate rotation between the data plane processing process of the service grid and the control plane. Domain name resolution capability can be added to the pilot-agent module so that the pilot-agent module can process domain name resolution requests.

[0083] The first domain name resolution request may be generated according to the first access request. For example, the first access request may be used to request access to a domain name (e.g. Figure 1 The first container cluster can generate a first domain name resolution request according to the first access request. The first domain name resolution request can also be called a DNS query request.

[0084] The data plane communication proxy module 180 in the first container cluster receives the first domain name resolution request, which can also be understood as the interception module 160 intercepting the first domain name resolution request into the data plane communication proxy module 180 in the first container cluster.

[0085] S320, the data plane communication proxy module 180 in the first container cluster queries the grid control module 110 whether the domain name is a global domain name, if yes, execute S330; if not, execute S340 and S350.

[0086] S330: The grid control module 110 resolves the global private IP address corresponding to the global domain name.

[0087] That is, when the domain name is a global domain name, the grid control module 110 resolves the global private network IP address.

[0088] The global private IP address is a service grid-level address, or may be referred to as a "global address" in the service grid system 100. In one embodiment, the global private IP address is different from the private IP address of the container cluster. For example, the private IP address of SVC1 in the container cluster 120 is 10.1.1.1, the private IP address of SVC1 in the container cluster 130 is 10.2.2.2, and the global private IP address of SVC1 in the service grid system 100 may be 244.1.1.1. In another embodiment, the global private IP address may also be the same as the private IP address of the container cluster, for example, the global private IP address may also be 10.1.1.1 or 10.2.2.2.

[0089] In some embodiments, the grid control module 110 may maintain a mapping table of domain names and global private network IP addresses. In this way, the grid control module 110 may match the domain name in the mapping table. If the global private network IP address corresponding to the domain name can be matched, it means that the domain name is a global domain name, and S330 is executed; if the global private network IP address corresponding to the domain name cannot be matched, it means that the domain name is not a global domain name, and S340 is executed.

[0090] S340: The data plane communication proxy module 180 in the first container cluster sends the first domain name resolution request to the domain name resolution module 140 in the first container cluster.

[0091] S350: The domain name resolution module 140 in the first container cluster resolves the domain name to obtain a private network IP address in the first container cluster corresponding to the domain name.

[0092] That is, when the domain name is not a global domain name, the domain name resolution module 140 resolves the private IP address in the first container cluster.

[0093] The difference between the global private IP address and the private IP address of the container cluster is that the global private IP address is at the service grid level, while the private IP address of the container cluster is only at the cluster level. In the scenario of a service grid with multiple container clusters, a service may correspond to multiple instances on multiple container clusters. For example, see Figure 1 , SVC1 runs on container cluster 120 and container cluster 130, corresponding to pod1, pod2, and pod3, pod4 respectively.

[0094] The service grid-level address is completely different from the cluster-level address. Through the global private IP address, clients in any container cluster can access the target service through the service grid address. For example, clients in container cluster 120 can access pod1 to pod4 through the global private IP address, and clients in container cluster 130 can access pod1 to pod4 through the global private IP address. In other words, through the global private IP address, clients in any container cluster can access any backend instance of the target service.

[0095] For the private IP address of a container cluster, not any client in the container cluster can access any backend instance of the target service. For example, see Figure 2 For the container cluster that joins first, that is, client 121 in container cluster 120, pod1 to pod4 can be accessed through the private IP address. However, for the container cluster that joins later, that is, client 131 in container cluster 130, pod3 or pod4 can only be accessed through the private IP address.

[0096] In the embodiment of the present application, the service with a global domain name has a global private IP address, and the service without a global domain name only has a private IP address within the container cluster. Therefore, for services with the same domain name in multiple container clusters, as long as the domain name is a global domain name, then the client in any container cluster can access any service instance corresponding to the global domain name based on the global private IP address, thereby avoiding conflicts between services with the same name in multiple container clusters. In addition, the data plane communication proxy module 180 at the service grid level and the domain name resolution module 140 at the container cluster level are cascaded. If the domain name is not a global domain name, the private IP address in the container cluster can be easily found based on the domain name resolution module 140, thereby improving the applicability of the provided method.

[0097] In some embodiments, the method 300 also includes: the data plane communication agent module 180 in the second container cluster receives a second domain name resolution request for the domain name from the second client; the data plane communication agent module 180 in the second container cluster queries the grid control module 110 whether the domain name is a global domain name, and if so, the grid control module 110 resolves the global private IP address corresponding to the global domain name; if not, the data plane communication agent module 180 in the second container cluster sends the second domain name resolution request to the domain name resolution module 140 in the second container cluster; the domain name resolution module 140 in the second container cluster resolves the private IP address in the second container cluster corresponding to the domain name according to the domain name.

[0098] The second domain name resolution request may be generated according to the second access request. For example, the second access request may be used to request access to a domain name (e.g. Figure 1 The second container cluster can generate a second domain name resolution request according to the second access request. The second domain name resolution request can also be called a DNS query request.

[0099] The data plane communication proxy module 180 in the second container cluster receives the second domain name resolution request, which can also be understood as the interception module 160 intercepting the second domain name resolution request into the data plane communication proxy module 180 in the second container cluster.

[0100] The access process of the second container cluster is similar to that of the first container cluster, which further illustrates that for services with the same domain name in multiple container clusters, as long as the domain name is a global domain name, then the client in any container cluster can access any service instance corresponding to the global domain name based on the global private IP address, thereby avoiding conflicts between services with the same name in multiple container clusters.

[0101] In some embodiments, the service mesh system also includes a sidecar module 170, and the method 300 also includes: the data plane communication agent module 180 in the first container cluster sends the global private IP address to the first client; the first client forwards the first access request for the global private IP address to the service instance of the at least one first service instance and the at least one second service instance through the sidecar module 170; or, the sidecar module 170 intercepts the first access request for the global private IP address; the sidecar module 170 forwards the first access request to the service instance of the at least one first service instance and the at least one second service instance.

[0102] The above embodiment can be understood as two solutions. One solution can be understood as, after obtaining the global private network IP address, returning the global private network IP address to the first client, and then the first client performs service management through the sidecar module 170. Another solution can be understood as, after obtaining the global private network IP address, it can be directly intercepted to the sidecar module 170, and the sidecar module 170 performs service management.

[0103] For example, by Figure 1 The interception module 160 in the sidecar module 170 can intercept the first access request into the sidecar module 170. The interception module 160 can be any module with computing function.

[0104] It is understandable that the above embodiment is also applicable to the second client. For example, the data plane communication proxy module 180 in the second container cluster sends the global private network IP address to the second client; the second client forwards the third access request for the global private network IP address to the service instance of the at least one first service instance and the at least one second service instance through the sidecar module 170; or, the sidecar module 170 intercepts the third access request for the global private network IP address; the sidecar module 170 forwards the second access request to the service instance of the at least one first service instance and the at least one second service instance.

[0105] Among them, the third access request is initiated by the second client, and the other meanings are similar to the first access request, which will not be repeated here.

[0106] The sidecar module 170 forwards the access request for the global private IP address to the service instance in at least one first service instance and at least one second service instance. In other words, the sidecar module 170 can forward the access request for the global private IP address to any instance configured on the service with the same global domain name.

[0107] Based on the above solution, in the scenario where multiple container clusters with services with the same global domain name are merged, through the global private IP address, the client in any container cluster can implement advanced service governance through the sidecar module 170, thereby improving the service quality provided by the container cluster.

[0108] In some embodiments, the method 300 also includes: the domain name resolution module 140 in the first container cluster sends the private IP address in the first container cluster to the first client; the first client forwards the second access request for the private IP address in the first container cluster to the service instance in the at least one first service instance through the container proxy module 150 in the first container cluster; or, the container proxy module 150 in the first container cluster intercepts the second access request for the private IP address in the first container cluster; the container proxy module 150 in the first container cluster forwards the second access request to the service instance in the at least one first service instance.

[0109] The above embodiment can be understood as two solutions. One solution can be understood as, after obtaining the private IP address in the container cluster, returning the private IP address to the first client, and then the first client performs service management through the sidecar module 170. Another solution can be understood as, after obtaining the global private IP address, it can be directly intercepted to the sidecar module 170, and the sidecar module 170 performs service management.

[0110] For example, by Figure 1 The interception module 160 in the container can intercept the second access request into the container proxy module 150. The interception module 160 can be any module with computing function.

[0111] The container proxy module 150 forwards the access request for the private IP address to the service instance in at least one first service instance. That is, the container proxy module 150 can forward the access request for the private IP address of a container cluster to the service instance configured on the service with the domain name in the container cluster. It is worth noting that the container proxy module 150 cannot forward the access request for the private IP address to the service instance in at least one second service instance, that is, the container proxy module 150 cannot forward the access request for the private IP address of a container cluster to the service instance configured on the service outside the container cluster.

[0112] It is understandable that the above embodiment is also applicable to the second client. For example, the domain name resolution module 140 in the second container cluster sends the private IP address in the second container cluster to the second client; the second client forwards the fourth access request for the private IP address in the second container cluster to the service instance in the at least one second service instance through the container proxy module 150 in the second container cluster; or, the container proxy module 150 in the second container cluster intercepts the second access request for the private IP address in the second container cluster; the container proxy module 150 in the second container cluster forwards the second access request to the service instance in the at least one second service instance.

[0113] Similar to the above, the container proxy module 150 can only forward access requests for private IP addresses to service instances in at least one second service instance, but cannot forward access requests for the private IP address of a container cluster to service instances configured on services outside the container cluster.

[0114] As can be seen from the above solution, the global private IP address is completely different from the private IP address in the cluster. In the process of accessing through the service grid-level address, the service grid's service governance capabilities can be applied, and advanced service governance can be performed through the sidecar module 170. In the process of accessing through the cluster-level address, the service grid's service governance capabilities may not be applied, and only simple load balancing can be performed using the container proxy module 150.

[0115] Based on the above scheme, when the access request is for a service that cannot apply the sidecar module 170 for advanced service governance, compared to the scheme of first intercepting the access request in the sidecar module 170 and then forwarding it to the container proxy module 150 for load balancing, the service provision method of the embodiment of the present application will not additionally intercept the access request in the sidecar module 170, but will directly perform load balancing through the container proxy module 150, thereby reducing overhead and improving the efficiency of providing services.

[0116] Some embodiments of service mesh configurations are described below.

[0117] In some embodiments, before the data plane communication proxy module 180 in the first container cluster receives the first domain name resolution request for the domain name from the first client, the method 300 also includes: receiving indication information, the indication information is used to indicate that the target service joins the service grid system 100, wherein the target service includes the first service and / or the second service; determining that the target service is a grid-level service; the grid control module 110 records the domain name as the global domain name, and creates the global private network IP address.

[0118] Based on the above solution, when the target service is a grid-level service, a global private IP address is created for the target service, so that the target service can use the global private IP address for service management, avoiding conflicts between services with the same domain name, and enabling the target service to apply advanced service management functions.

[0119] In some embodiments, determining that the target service is a grid-level service includes: determining that the target service is a grid-level service when the service policy of the service grid system is that the default service is a grid-level service, and the configuration file of the target service does not include comments; or determining that the target service is a grid-level service when the service policy of the service grid system is that the default service is a non-grid-level service, and the configuration file of the target service includes comments.

[0120] In other words, there are two ways to configure whether the target service is a grid-level service.

[0121] First, global whitelist and individual blacklist. The service policy of the service grid system is set to default the service as a grid-level service. For non-grid-level services, it can be determined by adding annotations. In other words, if the configuration file of the target service does not include annotations, the target service can be determined to be a grid-level service. On the contrary, if the configuration file of the target service includes annotations, the target service can be determined to be a non-grid-level service.

[0122] Second, global blacklist and individual whitelist. The service policy of the service grid system is set to set the default service as a non-grid-level service. For a grid-level service, it can be determined by adding comments. In other words, if the configuration file of the target service does not include comments, it can be determined that the target service is a grid-level service. On the contrary, if the configuration file of the target service does not include comments, it can be determined that the target service is a non-grid-level service.

[0123] This application does not limit the specific method of configuring whether the target service is a grid-level service, and other methods are obviously possible. For example, the service policy of the service grid system can be set to set the default service as a grid-level service, and non-grid-level services are not allowed. For another example, the service policy of the service grid system can be set to set the default service as a non-grid-level service, and grid-level services are not allowed. For another example, the service policy may not be set, and only the annotated target service is determined as a grid-level service. For another example, the service policy may not be set, and only the annotated target service is determined as a non-grid-level service.

[0124] Exemplarily, the configuration file may be a yaml file.

[0125] Based on the above scheme, users can flexibly configure whether a service is a grid-level service. For grid-level services, a service grid address can be generated and high-level service governance can be applied. For non-grid-level services, a backend instance can be connected through a simple load balancing, without being redundantly intercepted by the sidecar module 170. Therefore, the service provision method of the embodiment of the present application can improve the efficiency of service provision.

[0126] In some embodiments, the method 300 further includes: receiving configuration information, where the configuration information is used to add the comment to the configuration file.

[0127] In some embodiments, the method 300 further includes: the grid control module 110 generates a first interception rule, where the first interception rule is used to intercept the domain name resolution request to the data plane communication proxy module 180 .

[0128] Exemplarily, the grid control module 110 can add a first interception rule (also called an iptables rule) for domain name resolution requests (or DNS query requests) for port 53 to all nodes or pods where the sidecar modules 170 are located. In this way, when a domain name resolution request is generated, it will not be intercepted to the domain name resolution module 140 first, but will be intercepted to the data plane communication proxy module 180.

[0129] It should be noted that the original interception rules for domain name resolution requests for port 53 in each node or pod have not become invalid, but the priority of the original interception rules is lower than the above-mentioned newly added first interception rule. In this way, if the data plane communication proxy module 180 fails to query the global private network IP address, the domain name resolution request can be forwarded. At this time, the original interception rules for domain name resolution requests for port 53 in each node or pod take effect, and the domain name resolution request is intercepted into the domain name resolution module 140 in the container cluster. After the domain name resolution module 140 resolves the private network IP address in the container cluster, the container proxy module 150 in the container cluster can perform simple load balancing.

[0130] Based on the above solution, the domain name resolution request is intercepted by the data plane communication proxy module 180, and then the global private network IP address is found. The service providing method of the embodiment of the present application can accurately obtain the global private network IP address, thereby preventing conflicts between services with the same domain name.

[0131] In some embodiments, the method 300 further includes: the grid control module 110 generates a second interception rule, and the second interception rule is used to intercept the first access request for the global private network IP address to the sidecar module 170.

[0132] The second interception rule may be an iptables rule, which includes a global private network IP address. In this way, when the data plane communication proxy module 180 finds the global private network IP address, the access request corresponding to the global private network IP address may be intercepted by the iptables rule and processed in the sidecar module 170, thereby realizing high-level service management of the access request.

[0133] The related technical solution only generates interception rules for private IP addresses in the container cluster, which will cause conflicts when multiple container clusters with services with the same domain name are merged. The second interception rule of the embodiment of the present application can intercept access requests for global private IP addresses to the sidecar module 170, which can avoid conflicts between services with the same name in the container cluster, and enable any container cluster in multiple container clusters to apply advanced service governance, thereby improving the quality of service provision.

[0134] In some embodiments, the at least one first service instance and the at least one second service instance are implemented by a container group.

[0135] That is, the at least one first service instance and the at least one second service instance may be implemented in the form of a pod.

[0136] In some embodiments, the first client is set in the first container cluster, and the second client is set in the second container cluster.

[0137] Figure 4 It is a schematic flowchart of another service providing method 400 provided in an embodiment of the present application. Figure 4 Can be used with Figure 3 combined with the scheme.

[0138] S410, the service grid system 100 receives an access request to SVC1.

[0139] SVC1 is the service that the access request wants to access. For example, SVC1 can be the first service or the second service mentioned above. The subject that initiates the access request can be called a client, and the client can also exist as a service, and the client can run on a container cluster.

[0140] Exemplarily, the access request may carry information such as the domain name SVC1 and the container cluster where the client is located.

[0141] The service grid system 100 may receive an access request from a client 121 (located in the container cluster 120 ), and may also receive an access request from a client 131 (located in the container cluster 120 ).

[0142] S310, the data plane communication proxy module 180 receives a domain name resolution request for SVC1. For details, please refer to the above description of S310, which will not be repeated here.

[0143] After executing S310, S320 is executed to determine whether SVC1 is a global domain name. If SVC1 is a global domain name, the service grid system 100 can execute S330 to resolve the global private network IP address (eg, 244.1.1.1), and then execute S420.

[0144] In S420, the sidecar module 170 intercepts the access request for the global private network IP address. It should be noted that in other embodiments, after the global private network IP address is parsed, S420 may not be executed, but the global private network IP address may be returned to the client (e.g., client 121 or client 131), and the client initiates access based on the global private network IP address.

[0145] S430, the sidecar module 170 forwards the access request for the global private network IP to the service instance corresponding to SVC1.

[0146] It can be seen that when SVC1 is a global domain name, the global private IP address 244.1.1.1 can be resolved. The sidecar module 170 includes iptables rules for 244.1.1.1 and a service grid configuration for service governance for 244.1.1.1. In this way, the service SVC1 with a global domain name can apply advanced service governance, and no matter which container cluster (container cluster 120 or container cluster 130) the client (client 121 or client 131) initiates access, it can access all backend service instances (pod1 to pod4) for SVC1.

[0147] See also Figure 4 If SVC1 is not a global domain name, the service grid system 100 may execute S340 to send the domain name resolution request to the domain name resolution module 140. The service grid system 100 may execute S350, and the domain name resolution module 140 may query the private IP address of SVC1 in the container cluster (for example, the private IP address of the container cluster 120 is 10.1.1.1, and the private IP address of the container cluster 130 is 10.2.2.2).

[0148] There are different processing methods for clients of different container clusters.

[0149] In response to the access request initiated by the client 121 , the container cluster 120 executes S440 and S450 .

[0150] S440 , the domain name resolution module 140 in the container cluster 120 sends an access request for the private IP address 10.1.1.1 to the container proxy module 150 in the container cluster 120 .

[0151] S450 , the container proxy module 150 in the container cluster 120 forwards the access request for the private IP address 10.1.1.1 to the service instances (pod1, pod2) corresponding to SVC1 in the container cluster 120 .

[0152] In response to the access request initiated by the client 131 , the container cluster 130 executes S460 and S470 .

[0153] S460 , the domain name resolution module 140 in the container cluster 130 sends an access request for the private IP address 10.2.2.2 to the container proxy module 150 in the container cluster 130 .

[0154] S470 , the container proxy module 150 in the container cluster 130 forwards the access request for the private IP address 10.2.2.2 to the service instances ( pod3 , pod4 ) corresponding to SVC1 in the container cluster 130 .

[0155] It should be noted that Figure 4 The domain name resolution module 140 and container proxy module 150 in the example are at the container cluster level, that is, they are only valid in a certain container cluster. For other container clusters, there are other domain name resolution modules 140 and container proxy modules 150. The data plane communication proxy module 180 is at the service grid level, and the data plane communication proxy module 180 can also intercept access requests initiated by clients in other container clusters other than a certain container cluster.

[0156] The method embodiments of the present application are described in detail above. The device embodiments of the present application are described below. The device embodiments correspond to the method embodiments, so the parts not described in detail can refer to the previous method embodiments. The device can implement any possible implementation of the above method.

[0157] Figure 5 It is a schematic block diagram of a service providing device 500 provided in an embodiment of the present application.

[0158] The above-mentioned device 500 is applied to a service grid system 100, which includes a first container cluster, a second container cluster and a grid control module 110. The first container cluster is configured with at least one first service instance running a first service, and the second container cluster is configured with at least one second service instance running a second service. The first service and the second service are set with the same domain name in the service grid system 100, and the grid control module 110 is used to record whether the domain name is a global domain name.

[0159] The data plane communication proxy module 180 in the first container cluster is used to receive a first domain name resolution request for the domain name from the first client, and to query the grid control module 110 whether the domain name is a global domain name. If so, the grid control module 110 is also used to resolve the global private IP address corresponding to the global domain name; if not, the data plane communication proxy module 180 in the first container cluster is also used to send the first domain name resolution request to the domain name resolution module 140 in the first container cluster; the domain name resolution module 140 in the first container cluster is used to resolve the private IP address corresponding to the domain name in the first container cluster according to the domain name.

[0160] In a possible embodiment, the data plane communication proxy module 180 in the second container cluster is used to receive a second domain name resolution request for the domain name from the second client, and to query the grid control module 110 whether the domain name is a global domain name. If so, the grid control module 110 is used to resolve the global private IP address corresponding to the global domain name; if not, the data plane communication proxy module 180 in the second container cluster is used to send the second domain name resolution request to the domain name resolution module 140 in the second container cluster; the domain name resolution module 140 in the second container cluster is used to resolve the private IP address in the second container cluster corresponding to the domain name according to the domain name.

[0161] In a possible embodiment, the service mesh system also includes a sidecar module 170, wherein the data plane communication agent module 180 in the first container cluster is further used to send the global private IP address to the first client; the first client is used to forward the first access request for the global private IP address to the service instance of the at least one first service instance and the at least one second service instance through the sidecar module 170; or, the sidecar module 170 is used to intercept the first access request for the global private IP address, and to forward the first access request to the service instance of the at least one first service instance and the at least one second service instance.

[0162] In a possible embodiment, the domain name resolution module 140 in the first container cluster is further used to send the private IP address in the first container cluster to the first client; the first client is further used to forward the second access request for the private IP address in the first container cluster to the service instance in the at least one first service instance through the container proxy module 150 in the first container cluster; or, the container proxy module 150 in the first container cluster is used to intercept the second access request for the private IP address in the first container cluster, and to forward the second access request to the service instance in the at least one first service instance.

[0163] In a possible embodiment, the device 500 also includes: a receiving module, used to receive indication information, the indication information is used to indicate the target service to join the service grid system 100, wherein the target service includes the first service and / or the second service; a processing module, used to determine that the target service is a grid-level service; the grid control module 110 is also used to record the domain name as the global domain name and create the global private network IP address.

[0164] In a possible embodiment, the processing module is specifically used to: determine that the target service is a grid-level service when the service policy of the service grid system 100 is that the default service is a grid-level service, and the configuration file of the target service does not include comments; or determine that the target service is a grid-level service when the service policy of the service grid system 100 is that the default service is a non-grid-level service, and the configuration file of the target service includes comments.

[0165] In a possible embodiment, the grid control module 110 is further used to generate a first interception rule, where the first interception rule is used to intercept the domain name resolution request to the data plane communication proxy module 180 .

[0166] In a possible embodiment, the grid control module 110 is further used to generate a second interception rule, where the second interception rule is used to intercept the first access request for the global private network IP address to the sidecar module 170 .

[0167] Specifically, the specific implementation of various operations of the service providing method performed by the device 500 can refer to the description of the relevant content in the above method embodiment, which will not be repeated here.

[0168] Among them, the grid control module 110, the domain name resolution module 140, the container proxy module 150, the sidecar module 170, the data plane communication proxy module 180, the receiving module and the processing module can all be implemented by software, or can be implemented by hardware. Exemplarily, the implementation of the grid control module 110 is introduced below by taking the grid control module 110 as an example. Similarly, the implementation of the domain name resolution module 140, the container proxy module 150, the sidecar module 170, the data plane communication proxy module 180, the receiving module and the processing module can refer to the implementation of the grid control module 110.

[0169] As an example of a software functional unit, the grid control module 110 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the grid control module 110 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region (region) or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one data center or multiple data centers with similar geographical locations. Among them, usually a region may include multiple AZs.

[0170] Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

[0171] As an example of a hardware functional unit, the grid control module 110 may include one or more computing devices, such as a server, etc. Alternatively, the grid control module 110 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0172] The multiple computing devices included in the grid control module 110 can be distributed in the same region or in different regions. The multiple computing devices included in the grid control module 110 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the grid control module 110 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0173] It should be noted that, in other embodiments, the grid control module 110 can be used to execute any step in the service provision method, the domain name resolution module 140 can be used to execute any step in the service provision method, the container agent module 150 can be used to execute any step in the service provision method, the sidecar module 170 can be used to execute any step in the service provision method, the data plane communication agent module 180 can be used to execute any step in the service provision method, the receiving module can be used to execute any step in the service provision method, and the processing module can be used to execute any step in the service provision method.

[0174] The steps that the grid control module 110, the domain name resolution module 140, the container proxy module 150, the sidecar module 170, the data plane communication proxy module 180, the receiving module and the processing module are responsible for implementing can be specified as needed. The grid control module 110, the domain name resolution module 140, the container proxy module 150, the sidecar module 170, the data plane communication proxy module 180, the receiving module and the processing module respectively implement different steps in the service provision method to achieve all the functions of the service provision device 500.

[0175] The present application also provides a computing device 600. Figure 6 As shown, computing device 600 includes: bus 602, processor 604, memory 606 and communication interface 608. Processor 604, memory 606 and communication interface 608 communicate through bus 602. Computing device 600 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in computing device 600.

[0176] The bus 602 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 The bus 602 may include a path for transmitting information between various components of the computing device 600 (eg, the memory 606, the processor 604, and the communication interface 608).

[0177] The processor 604 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0178] The memory 606 may include a volatile memory, such as a random access memory (RAM). The memory 606 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0179] The memory 606 stores executable program codes, and the processor 604 executes the executable program codes to respectively implement the functions of the aforementioned grid control module 110, the domain name resolution module 140, and the data plane communication proxy module 180, thereby implementing the service provision method. That is, the memory 606 stores instructions for executing the service provision method.

[0180] The communication interface 608 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 600 and other devices or communication networks.

[0181] The embodiment of the present application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.

[0182] like Figure 7 As shown, the computing device cluster includes at least one computing device 600. The memory 606 in one or more computing devices 600 in the computing device cluster may store the same instructions for executing the service providing method.

[0183] In some embodiments, the memory 606 of one or more computing devices 600 in the computing device cluster may also store partial instructions for executing the service providing method. In other words, the combination of one or more computing devices 600 may jointly execute instructions for executing the detection service providing method.

[0184] It should be noted that the memory 606 in different computing devices 600 in the computing device cluster may store different instructions, which are respectively used to execute part of the functions of the service providing apparatus 500. That is, the instructions stored in the memory 606 in different computing devices 600 may implement the functions of one or more modules among the grid control module 110, the domain name resolution module 140 and the data plane communication proxy module 180.

[0185] In some embodiments, one or more computing devices in the computing device cluster may be connected via a network, which may be a wide area network or a local area network, etc.

[0186] Figure 8 A possible implementation method is proposed. Figure 8 As shown, two computing devices 600A and 600B are connected via a network. Specifically, the network is connected via a communication interface in each computing device. In this type of possible implementation, the memory 606 in the computing device 600A stores instructions for executing the functions of the grid control module 110 and the domain name resolution module 140. At the same time, the memory 606 in the computing device 600B stores instructions for the functions of the data plane communication proxy module 180.

[0187] Figure 8The connection method between the computing device clusters shown may be based on the consideration that the service provision method provided by the present application needs to process a large number of domain name resolution requests, and therefore it is considered that the functions implemented by the data plane communication agent module 180 are handed over to the computing device 600B for execution.

[0188] It should be understood that Figure 8 The functions of the computing device 600A shown in FIG. 6A may also be completed by multiple computing devices 600. Similarly, the functions of the computing device 600B may also be completed by multiple computing devices 600.

[0189] In some embodiments, the memory 606 of one or more computing devices 600 in the computing device cluster may also store partial instructions for executing the service providing method. In other words, the combination of one or more computing devices 600 may jointly execute instructions for executing the service providing method.

[0190] The embodiment of the present application also provides a computer program product including instructions. The computer program product may be a software or program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes the above-mentioned service providing method.

[0191] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by the computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute the above-mentioned service providing method.

[0192] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0193] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0194] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0195] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0196] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0197] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0198] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A service providing method, characterized in that: The method is applied to a service grid system, the service grid system comprising a first container cluster, a second container cluster and a grid control module, the first container cluster is configured with at least one first service instance running a first service, the second container cluster is configured with at least one second service instance running a second service, the first service and the second service are set with the same domain name in the service grid system, the grid control module is used to record whether the domain name is a global domain name, wherein the method comprises: The data plane communication proxy module in the first container cluster receives a first domain name resolution request from a first client for the domain name; The data plane communication proxy module in the first container cluster queries the grid control module whether the domain name is a global domain name, in the case of, The grid control module resolves the global private Internet Protocol IP address corresponding to the global domain name; If no, The data plane communication proxy module in the first container cluster sends the first domain name resolution request to a domain name resolution module in the first container cluster; The domain name resolution module in the first container cluster resolves the domain name to obtain a private network IP address in the first container cluster corresponding to the domain name.

2. The method according to claim 1, characterized in that: Also includes: The data plane communication proxy module in the second container cluster receives a second domain name resolution request from a second client for the domain name; The data plane communication proxy module in the second container cluster queries the grid control module whether the domain name is a global domain name. in the case of, The grid control module resolves the global private network IP address corresponding to the global domain name; If no, The data plane communication proxy module in the second container cluster sends the second domain name resolution request to the domain name resolution module in the second container cluster; The domain name resolution module in the second container cluster resolves the domain name to obtain a private network IP address in the second container cluster corresponding to the domain name.

3. The method according to claim 1 or 2, characterized in that: The service mesh system further includes a sidecar module, and the method further includes: The data plane communication proxy module in the first container cluster sends the global private network IP address to the first client; The first client forwards the first access request for the global private network IP address to a service instance among the at least one first service instance and the at least one second service instance through the sidecar module; or, The sidecar module intercepts a first access request for the global private network IP address; The sidecar module forwards the first access request to a service instance among the at least one first service instance and the at least one second service instance.

4. The method according to any one of claims 1 to 3, characterized in that Also includes: The domain name resolution module in the first container cluster sends the private IP address in the first container cluster to the first client; The first client forwards the second access request for the private IP address in the first container cluster to a service instance in the at least one first service instance through the container proxy module in the first container cluster; or, The container proxy module in the first container cluster intercepts a second access request for a private IP address in the first container cluster; The container proxy module in the first container cluster forwards the second access request to a service instance in the at least one first service instance.

5. The method according to any one of claims 1 to 4, characterized in that: Before the data plane communication proxy module in the first container cluster receives a first domain name resolution request from a first client for the domain name, the method further includes: receiving indication information, where the indication information is used to instruct a target service to join the service grid system, wherein the target service includes the first service and / or the second service; Determining that the target service is a grid-level service; The grid control module records the domain name as the global domain name, and creates the global private network IP address.

6. The method according to claim 5, characterized in that Determining that the target service is a grid-level service includes: In the case where the service policy of the service grid system is that the default service is a grid-level service and the configuration file of the target service does not include a comment, determining that the target service is a grid-level service; or, When the service policy of the service grid system is that the default service is a non-grid-level service and the configuration file of the target service includes a comment, it is determined that the target service is a grid-level service.

7. The method according to any one of claims 1 to 6, characterized in that: Also includes: The grid control module generates a first interception rule, where the first interception rule is used to intercept the domain name resolution request to the data plane communication proxy module.

8. The method according to any one of claims 1 to 7, characterized in that Also includes: The grid control module generates a second interception rule, where the second interception rule is used to intercept a first access request for the global private network IP address to a sidecar module.

9. The method according to any one of claims 1 to 8, characterized in that The at least one first service instance and the at least one second service instance are implemented by a container group.

10. The method according to any one of claims 1 to 9, characterized in that The first client is set in the first container cluster, and the second client is set in the second container cluster.

11. A service providing device, characterized in that: The device is applied to a service grid system, the service grid system includes a first container cluster, a second container cluster and a grid control module, the first container cluster is configured with at least one first service instance running a first service, the second container cluster is configured with at least one second service instance running a second service, the first service and the second service are set with the same domain name in the service grid system, and the grid control module is used to record whether the domain name is a global domain name, wherein, The data plane communication proxy module in the first container cluster is used to receive a first domain name resolution request from a first client for the domain name, and to query the grid control module whether the domain name is a global domain name. in the case of, The grid control module is also used to resolve the global private network Internet Protocol IP address corresponding to the global domain name; If no, The data plane communication proxy module in the first container cluster is further used to send the first domain name resolution request to the domain name resolution module in the first container cluster; The domain name resolution module in the first container cluster is used to resolve the domain name according to the domain name to obtain a private network IP address in the first container cluster corresponding to the domain name.

12. The device according to claim 11, characterized in that The data plane communication proxy module in the second container cluster is used to receive a second domain name resolution request from a second client for the domain name, and to query the grid control module whether the domain name is a global domain name. in the case of, The grid control module is used to resolve the global private network IP address corresponding to the global domain name; If no, The data plane communication proxy module in the second container cluster is used to send the second domain name resolution request to the domain name resolution module in the second container cluster; The domain name resolution module in the second container cluster is used to resolve the private network IP address in the second container cluster corresponding to the domain name according to the domain name.

13. The device according to claim 11 or 12, characterized in that The service mesh system also includes a sidecar module, wherein: The data plane communication proxy module in the first container cluster is further used to send the global private network IP address to the first client; The first client is used to forward the first access request for the global private network IP address to a service instance among the at least one first service instance and the at least one second service instance through the sidecar module; or, The sidecar module is used to intercept a first access request for the global private IP address, and to forward the first access request to a service instance among the at least one first service instance and the at least one second service instance.

14. The device according to any one of claims 11 to 13, characterized in that The domain name resolution module in the first container cluster is further used to send the private network IP address in the first container cluster to the first client. The first client is also used to forward the second access request for the private network IP address in the first container cluster to the service instance in the at least one first service instance through the container proxy module in the first container cluster; or, The container proxy module in the first container cluster is used to intercept a second access request for a private IP address in the first container cluster, and to forward the second access request to a service instance in the at least one first service instance.

15. The device according to any one of claims 11 to 14, characterized in that The device also includes: A receiving module, used to receive indication information, where the indication information is used to instruct a target service to join the service grid system, wherein the target service includes the first service and / or the second service; A processing module, used for determining that the target service is a grid-level service; The grid control module is further used to record the domain name as the global domain name and create the global private network IP address.

16. The device according to claim 15, characterized in that The processing module is specifically used for: In the case where the service policy of the service grid system is that the default service is a grid-level service and the configuration file of the target service does not include a comment, determining that the target service is a grid-level service; or, When the service policy of the service grid system is that the default service is a non-grid-level service and the configuration file of the target service includes a comment, it is determined that the target service is a grid-level service.

17. The device according to any one of claims 11 to 16, characterized in that The grid control module is further used to generate a first interception rule, where the first interception rule is used to intercept the domain name resolution request to the data plane communication proxy module.

18. The device according to any one of claims 11 to 17, characterized in that The grid control module is further used to generate a second interception rule, where the second interception rule is used to intercept a first access request for the global private network IP address to a sidecar module.

19. The device according to any one of claims 11 to 18, characterized in that The at least one first service instance and the at least one second service instance are implemented by a container group.

20. The device according to any one of claims 11 to 19, characterized in that The first client is set in the first container cluster, and the second client is set in the second container cluster.

21. A computing device cluster, characterized in that: comprising at least one computing device, each computing device comprising a processor and a memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1 to 10.

22. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device cluster, the computing device cluster is caused to perform the method according to any one of claims 1 to 10.

23. A computer-readable storage medium, characterized in that: The method comprises computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster performs the method according to any one of claims 1 to 10.

Images