Service access method and system based on reverse proxy and wildcard domain name

Abstract

The invention relates to a service access method and system based on a reverse proxy and a wildcard character domain name, and the method comprises the following steps: a client accesses a domain name server to obtain an IP of the reverse proxy, a gateway domain name, a reverse proxy port and a service name are defined in a URL of the client, the gateway domain name adopts a wildcard character domain name, and the reverse proxy port adopts a service name; the wildcard domain name matches all sub-domain names meeting conditions under a specified main domain name; the domain name server returns a reverse proxy IP of the client; the client accesses the reverse proxy service; the reverse proxy service forwards the request of the client to a specific cluster gateway through the proxy of the domain name rule; the cluster gateway finds a specific cluster service through a forwarding rule of a client URL, and the cluster service enters a correct micro-service program through a service network in a cluster and a network in a container. Compared with the prior art, the method has the advantages that each sub-domain name does not need to be manually configured, and a user can conveniently access the micro-service.

Description

Technical Field

[0001] The present invention relates to the technical field of microservices within a cluster, and in particular to a service access method and system based on reverse proxy and wildcard domain name. Background Art

[0002] As applications become microservices and containers, applications are deployed from a single point to microservices in a container cluster. CoreDNS in the Kubernetes cluster provides a mechanism for service discovery and service access within the cluster, such as Figure 1 However, there is no unified solution for service discovery and service access outside the cluster.

[0003] Currently, there are several ways to access microservices in a cluster from outside the cluster:

[0004] 1. Use NodeIP to access. Figure 2 As shown in the figure, its advantages are simplicity, no need to deploy additional components, and native K8s cluster support. Its disadvantages are: (1) It uses IP and port access, which is cumbersome and difficult for general users to remember, especially in the case of a large number of microservices. It is basically difficult to remember and very inconvenient to use. (2) The traffic entrance is not unified, the network traffic is complicated, and there are many inconveniences in security control and measurement statistics.

[0005] 2. Use the gateway IP to access. Figure 3 As shown in the figure, its advantage is that the traffic entry is unified, which is convenient for security management and measurement statistics. Its disadvantages are: (1) It is cumbersome to use IP and port access, which is difficult for general users to remember, especially in the case of a large number of microservices. It is basically difficult to remember and very inconvenient to use. (2) A gateway needs to be deployed.

[0006] In comparison, in order to unify the traffic entrance and facilitate security control and measurement statistics, the gateway IP is generally used to access the microservices in the cluster. Envoy, as a component that can be customized to enhance security control, is often selected as the gateway of the cluster. At present, one solution on the production cluster is to deploy an envoy customized reverse proxy gateway, and the traffic inside and outside the cluster is uniformly forwarded by URL through envoy. For example, if you need to access service A in the business area cluster, you can use [gateway IP]: [gateway PORT] / serviceA to achieve it. The above solution is feasible in the production environment. The production cluster generally uses Apache or Nginx to expose a unified entrance for external services. The traffic access is also relatively fixed. The number of microservices in the production environment is also relatively small, and the cost of IP usage is acceptable.

[0007] However, in the development and testing environment, there are many differences compared to the production environment:

[0008] 1. In scenarios such as joint debugging and integrated testing systems, application microservices often need to be disassembled. If the disassembled microservices are all accessed using IP, the user's usage cost will be very high.

[0009] 2. The resources of the development and testing environment are limited, and one cluster is needed to simulate the mutual access between multiple clusters online. Summary of the invention

[0010] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and to provide a service access method and system based on reverse proxy and wildcard domain name. On the basis of gateway-based access to services within the cluster, a layer of reverse proxy and domain name resolution service is added to achieve the purpose of simulating the production environment and facilitating user access to microservices.

[0011] The purpose of the present invention can be achieved by the following technical solutions:

[0012] According to a first aspect of the present invention, a service access method based on reverse proxy and wildcard domain name is provided, the method comprising the following steps:

[0013] The client accesses the domain name server to obtain the reverse proxy IP, wherein the gateway domain name, reverse proxy port and service name are defined in the client URL. The gateway domain name uses a wildcard domain name, which matches all qualified subdomains under the specified primary domain name;

[0014] The domain name server returns the IP address of the client's reverse proxy.

[0015] The client accesses the reverse proxy service;

[0016] The reverse proxy service forwards the client's request to a specific cluster gateway through a proxy with domain name rules;

[0017] The cluster gateway finds a specific cluster service through the forwarding rules of the client URL, and the cluster service enters the correct microservice program through the service network within the cluster and the network within the container.

[0018] As a preferred technical solution, the format of the gateway domain name is expressed as: [gateway type].[simulated gateway zone].[DNS domain], wherein the gateway type includes a front-end gateway, a back-end gateway, and a management gateway; the simulated gateway zone defines a namespace, a production cluster corresponds to a namespace, a development and testing cluster includes multiple namespaces, one of which simulates a production cluster; the DNS domain represents the naming of the production cluster.

[0019] As a preferred technical solution, the matching of the gateway domain name and the corresponding gateway is achieved by a reverse proxy.

[0020] As a preferred technical solution, the reverse proxy port is configured as the default port 80 of http, so that the client is exempted from inputting the port when performing URL matching.

[0021] According to a second aspect of the present invention, there is provided a service access system based on a reverse proxy and a wildcard domain name, comprising:

[0022] The client accesses the domain name server to obtain the reverse proxy IP, and accesses the cluster reverse proxy server according to the obtained reverse proxy IP, wherein the gateway domain name, reverse proxy port and service name are defined in the client URL, and the gateway domain name adopts a wildcard domain name, which matches all qualified subdomains under the specified primary domain name;

[0023] Domain name server, which returns the IP address of the client's reverse proxy.

[0024] The cluster reverse proxy server receives requests from clients and forwards them to a specific cluster gateway through a proxy based on domain name rules;

[0025] The cluster gateway finds a specific cluster service through the forwarding rules of the client URL. The cluster service enters the correct microservice program through the service network within the cluster and the network within the container.

[0026] Microservice programs within the cluster are used to provide related services.

[0027] As a preferred technical solution, the format of the gateway domain name is expressed as: [gateway type].[simulated gateway zone].[DNS domain], wherein the gateway type includes a front-end gateway, a back-end gateway, and a management gateway; the simulated gateway zone defines a namespace, a production cluster corresponds to a namespace, a development and testing cluster includes multiple namespaces, one of which simulates a production cluster; the DNS domain represents the naming of the production cluster.

[0028] As a preferred technical solution, the matching of the gateway domain name and the corresponding gateway is achieved by a reverse proxy.

[0029] As a preferred technical solution, the reverse proxy port is configured as the default port 80 of http, so that the client is exempted from inputting the port when performing URL matching.

[0030] According to a third aspect of the present invention, there is provided an electronic device, comprising a memory and a processor, wherein a computer program is stored in the memory, and the method described above is implemented when the processor executes the program.

[0031] According to a fourth aspect of the present invention, there is provided a computer-readable storage medium having a computer program stored thereon, wherein the program implements the method described when executed by a processor.

[0032] Compared with the prior art, the present invention has the following beneficial effects:

[0033] (1) The present invention uses wildcard domain names to simplify the management of gateway domain names and avoids manually configuring records for each subdomain name.

[0034] (2) The present invention uses the reverse proxy domain name rule forwarding to forward traffic to the correct simulated gateway. The format of the gateway domain name is designed as: [gateway type]. [simulated gateway zone]. [DNS domain]. K8s's Namespace is used to simulate the production gateway. The designed format can well use the reverse proxy domain name rule forwarding to forward traffic to the correct simulated gateway. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A schematic diagram of service discovery and access of microservices in a cluster in the prior art;

[0036] Figure 2 A schematic diagram of using NodeIP access in the prior art;

[0037] Figure 3 A schematic diagram of IP access using a gateway in the prior art;

[0038] Figure 4 is a flow chart of the method of the present invention;

[0039] Figure 5 It is a system structure diagram of the present invention. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0041] Unless otherwise defined, the technical terms or scientific terms involved in this application should be understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the" and the like involved in this application do not indicate a quantitative limitation, and may represent the singular or plural. The terms "include", "comprise", "have" and any of their variations involved in this application are intended to cover non-exclusive inclusions; for example, a process, method, system, product or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units that are not listed, or may also include other steps or units inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there may be three relationships, for example, "A and / or B" can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects before and after are in an "or" relationship. The terms "first", "second", "third", etc. involved in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0042] Before describing the present invention in detail, the following concepts are first introduced.

[0043] 1. Reverse Proxy: A reverse proxy is a proxy server located between the client and the server. It receives requests from the client and forwards them to the backend server for processing. Unlike a forward proxy, a reverse proxy is transparent to the client, that is, the client does not know that the resource it requested is forwarded through a proxy server.

[0044] The main functions of a reverse proxy include:

[0045] Load balancing: The reverse proxy can distribute client requests to multiple backend servers to balance the load of each server and improve the system's processing power and stability.

[0046] Enhanced security: The reverse proxy can hide the real IP address of the backend server and protect the server from being directly exposed to the Internet, thereby improving security.

[0047] Cache: The reverse proxy can cache the response results of the backend server and directly return the cached results when there is the same request, reducing the burden on the server and speeding up the response.

[0048] SSL / TLS termination: The reverse proxy can handle SSL / TLS encryption, alleviating computing pressure on the backend servers.

[0049] Common reverse proxy server software includes Nginx, HAProxy, and Apache.

[0050] 2. Domain Name Service (DNS) is a system that converts human-readable domain names (such as example.com) into computer-understandable IP addresses (such as 192.168.1.1). Because Internet communications rely on IP addresses, the existence of domain name services allows users to access websites through simple domain names without having to remember complex IP addresses.

[0051] DNS works roughly like this:

[0052] User request: When a user enters a domain name (such as www.example.com) in a browser, the browser sends a request to the DNS server, asking for the IP address corresponding to the domain name.

[0053] DNS resolution: The DNS server begins to resolve the request, first checking whether the IP address of the domain name is stored in the local cache. If not, it will continue to query other upper-level DNS servers until the corresponding IP address is found.

[0054] Return IP address: After the DNS server finds the IP address of the domain name, it returns it to the user's browser.

[0055] Visit a website: The browser uses the obtained IP address to send a request to the target server to load the website content.

[0056] The main components of DNS are:

[0057] Domain Name Resolver: A DNS server located on the client or local network, responsible for querying and caching the IP address of a domain name.

[0058] Root name server: The top of the DNS architecture, responsible for handling the highest-level domain name requests and directing resolvers to the correct top-level domain name (TLD) server.

[0059] Top-level domain name server (TLD Server): responsible for the resolution of specific top-level domain names (such as .com, .org, .net).

[0060] Authoritative DNS server: stores the IP address records of specific domain names and is the server that ultimately returns the resolution results.

[0061] Through DNS, the mapping of domain names and IP addresses is achieved, allowing users to access resources on the Internet conveniently and quickly.

[0062] This embodiment provides a service access method based on reverse proxy and wildcard domain name, such as Figure 4 As shown, the method comprises the following steps:

[0063] Step (1) The client accesses the domain name server to obtain the IP address of the reverse proxy.

[0064] In this embodiment, the gateway domain name, reverse proxy port and service name are defined in the client URL.

[0065] a. Gateway domain name

[0066] The format of the gateway domain name is: [gateway type].[simulated gateway zone].[DNS domain], where the gateway types include front-end gateway, back-end gateway and management gateway, and their English names are: front, backend, manager; the simulated gateway zone defines the namespace, one production cluster corresponds to one namespace, and one development and test cluster includes multiple namespaces, one of which simulates a production cluster; the DNS domain represents the naming of the production cluster.

[0067] For example, the gateway domain name is: front.M10-biz-docker.k8s.example.net

[0068] Indicates: The code example organizes a k8s cluster, which simulates the domain name of a front-end gateway in the biz-docker zone in M10 production.

[0069] The gateway domain name uses a wildcard domain name, which matches all eligible subdomains under the specified primary domain name. Although there are multiple gateway domain names, they are all under one wildcard domain name. The wildcard domain name allows all eligible subdomains (such as front.M10-biz-docker.k8s.example.net, backend.M10-biz-docker.k8s.example.net) to be matched under the specified primary domain name (such as k8s.example.net) without having to configure each subdomain one by one. This configuration simplifies the management of gateway domain names and avoids manually configuring records for each subdomain.

[0070] The matching of the specific gateway domain name and the corresponding gateway is implemented by the reverse proxy.

[0071] b. Reverse proxy port

[0072] Configuring the reverse proxy port to the default http port 80 allows clients to avoid entering the port when matching URLs.

[0073] c. / Service Name

[0074] The cluster gateway finds the corresponding service in the cluster through this URL configuration.

[0075] The overall client URL example is similar to the following:

[0076] front.M10-biz-docker.k8s.example.net / serviceA

[0077] backend.M10-biz-docker.k8s.example.net / serviceB

[0078] Step (2) The domain name server returns the IP address of the client's reverse proxy.

[0079] Step (3) The client accesses the reverse proxy service.

[0080] Step (4) The reverse proxy service forwards the client's request to a specific cluster gateway through a proxy based on domain name rules.

[0081] Step (5) The cluster gateway finds a specific cluster service through the forwarding rules of the client URL, and the cluster service enters the correct microservice program through the service network within the cluster and the network within the container.

[0082] The above method effectively solves the two difficulties encountered in the development and testing environment. It allows users to conveniently access each service through [service domain name]: [reverse proxy port] / service name, and simulates multiple online clusters in one cluster.

[0083] This embodiment also provides a service access system based on reverse proxy and wildcard domain name, such as Figure 5 As shown, including:

[0084] The client accesses the domain name server to obtain the reverse proxy IP, and accesses the cluster reverse proxy server according to the obtained reverse proxy IP, wherein the gateway domain name, reverse proxy port and service name are defined in the client URL, and the gateway domain name adopts a wildcard domain name, which matches all qualified subdomains under the specified primary domain name;

[0085] Domain name server, which returns the IP address of the client's reverse proxy.

[0086] The cluster reverse proxy server receives requests from clients and forwards them to a specific cluster gateway through a proxy based on domain name rules;

[0087] The cluster gateway finds a specific cluster service through the forwarding rules of the client URL. The cluster service enters the correct microservice program through the service network within the cluster and the network within the container.

[0088] Microservice programs within the cluster are used to provide related services.

[0089] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of each of the above modules can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0090] The electronic device of the present invention includes a central processing unit (CPU), which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) or loaded from a storage unit into a random access memory (RAM). In the RAM, various programs and data required for device operation can also be stored. The CPU, ROM and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0091] Multiple components in the device are connected to the I / O interface, including: input units, such as keyboards, mice, etc.; output units, such as various types of displays, speakers, etc.; storage units, such as disks, optical disks, etc.; and communication units, such as network cards, modems, wireless communication transceivers, etc. The communication unit allows the device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunication networks.

[0092] The processing unit performs the various methods and processes described above, such as steps (1)-step (5). For example, in some embodiments, steps (1)-step (5) can be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program can be loaded and / or installed on the device via a ROM and / or a communication unit. When the computer program is loaded into the RAM and executed by the CPU, one or more steps of steps (1)-step (5) described above can be executed. Alternatively, in other embodiments, the CPU can be configured to execute steps (1)-step (5) by any other appropriate means (for example, by means of firmware).

[0093] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0094] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0095] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0096] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A service access method based on reverse proxy and wildcard domain name, characterized in that: The method comprises the following steps: The client accesses the domain name server to obtain the reverse proxy IP, wherein the gateway domain name, reverse proxy port and service name are defined in the client URL. The gateway domain name uses a wildcard domain name, which matches all qualified subdomains under the specified primary domain name; The domain name server returns the IP address of the client's reverse proxy. The client accesses the reverse proxy service; The reverse proxy service forwards the client's request to a specific cluster gateway through a proxy with domain name rules; The cluster gateway finds a specific cluster service through the forwarding rules of the client URL, and the cluster service enters the correct microservice program through the service network within the cluster and the network within the container.

2. A service access method based on reverse proxy and wildcard domain name according to claim 1, characterized in that: The format of the gateway domain name is expressed as: [gateway type].[simulated gateway zone].[DNS domain], wherein the gateway type includes front-end gateway, back-end gateway and management gateway; the simulated gateway zone defines a namespace, one production cluster corresponds to one namespace, and one development and testing cluster includes multiple namespaces, one of which simulates a production cluster; the DNS domain represents the naming of the production cluster.

3. A service access method based on reverse proxy and wildcard domain name according to claim 1, characterized in that: The matching of the gateway domain name and the corresponding gateway is achieved by the reverse proxy.

4. A service access method based on reverse proxy and wildcard domain name according to claim 1, characterized in that: The reverse proxy port is configured as the default port 80 of http, so that the client does not need to enter the port when performing URL matching.

5. A service access system based on reverse proxy and wildcard domain name, characterized in that: include: The client accesses the domain name server to obtain the reverse proxy IP, and accesses the cluster reverse proxy server according to the obtained reverse proxy IP, wherein the gateway domain name, reverse proxy port and service name are defined in the client URL, and the gateway domain name adopts a wildcard domain name, which matches all qualified subdomains under the specified primary domain name; Domain name server, which returns the IP address of the client's reverse proxy. The cluster reverse proxy server receives requests from clients and forwards them to a specific cluster gateway through a proxy based on domain name rules; The cluster gateway finds a specific cluster service through the forwarding rules of the client URL. The cluster service enters the correct microservice program through the service network within the cluster and the network within the container. Microservice programs within the cluster are used to provide related services.

6. A service access system based on reverse proxy and wildcard domain name according to claim 5, characterized in that: The format of the gateway domain name is expressed as: [gateway type].[simulated gateway zone].[DNS domain], wherein the gateway type includes front-end gateway, back-end gateway and management gateway; the simulated gateway zone defines a namespace, one production cluster corresponds to one namespace, and one development and testing cluster includes multiple namespaces, one of which simulates a production cluster; the DNS domain represents the naming of the production cluster.

7. A service access system based on reverse proxy and wildcard domain name according to claim 5, characterized in that: The matching of the gateway domain name and the corresponding gateway is achieved by the reverse proxy.

8. A service access system based on reverse proxy and wildcard domain name according to claim 5, characterized in that: The reverse proxy port is configured as the default port 80 of http, so that the client does not need to enter the port when performing URL matching.

9. An electronic device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: When the processor executes the program, the method according to any one of claims 1 to 4 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images