Service communication method and service mesh system

Abstract

The embodiment of the application discloses a service communication method and a service grid system. The method is applied to a service grid system, the service grid system comprises a first Pod, a network management Pod and a second Pod, the first Pod comprises a first service container, and the second Pod comprises a second service container; the method comprises the following steps: using the first service container to send target data to the network management Pod based on a first redirection rule, the target data being data required by the first service container to send to the second service container; and using the network management Pod to send the target data to the second service container based on a second redirection rule after the network management Pod acquires the target data sent by the first service container. The service communication method and the service grid system can optimize the data transmission path and improve the management efficiency of network traffic.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a service communication method and a service mesh system. BACKGROUND

[0002] A service mesh is a kind of infrastructure layer used for processing inter-service communication in a micro-service architecture, and its main function is to provide reliable network communication between services. At present, a service mesh implements functions such as traffic management by deploying a lightweight proxy, such as a Sidecar proxy, in an application. By deploying a Sidecar proxy for each service instance, the Sidecar proxy can be responsible for intercepting all traffic in and out of the service and performing traffic management.

[0003] Taking the traffic sent by service A to service B as an example, the path of the traffic transmission is usually service container in service A-Sidecar proxy of service A-control plane (such as Istio control plane)-Sidecar proxy of service B-service container in service B, which results in a long traffic transmission path and low efficiency of network traffic management. SUMMARY

[0004] Embodiments of the present application disclose a service communication method and a service mesh system, which can optimize the data transmission path and improve the management efficiency of network traffic.

[0005] Embodiments of the present application disclose a service communication method applied to a service mesh system, wherein the service mesh system comprises a first Pod, a network management Pod and a second Pod, the first Pod comprises a first service container, the second Pod comprises a second service container, the first Pod and the network management Pod run on the same node, and the node is a computing device or a virtual machine running on a computing device; the method comprises the following steps:

[0006] using the first service container to send target data to the network management Pod based on a first redirection rule, the target data being data that the first service container needs to send to the second service container, and the first redirection rule being used to indicate that data sent by the first service container to the second service container is sent to the network management Pod;

[0007] after the network management Pod obtains the target data sent by the first service container, using the network management Pod to send the target data to the second service container based on a second redirection rule, and the second redirection rule being used to indicate that the network management Pod sends data received and sent to the second service container to the second service container.

[0008] In this embodiment, the service mesh system can manage the traffic between the service containers in different Pods through the network management Pod running in each node. The first service container in the first Pod can send target data to be sent to the second service container in the second Pod to the network management Pod based on the first redirection rule. The network management Pod can send the target data to the second service container based on the second redirection rule. The target data does not need to pass through the Sidecar agents of the first Pod and the second Pod, which can optimize the transmission path of the data, reduce the number of hops of the data in the network, and improve the management efficiency of the network traffic. Moreover, the egress and ingress traffic of the service containers of each Pod is uniformly collected to the network management Pod, and the traffic management is performed through the network management Pod, which adopts a global network management mode. The Sidecar agent does not need to be deployed in each Pod to manage the traffic of the service containers, which can reduce the resource overhead of network management.

[0009] In some optional embodiments, before the first service container sends the target data to the network management Pod based on the first redirection rule, the method further includes:

[0010] In the case where the first Pod is added to the service mesh system, the network management Pod loads a target program according to a traffic event of the first Pod, and configures the second redirection rule through the target program. The traffic event includes Pod information corresponding to the first Pod and Pod information of other Pods communicating with the first Pod.

[0011] In this embodiment, in the case where the first Pod is added to the service mesh system, the network management Pod can load a target program according to a traffic event of the first Pod, and configure the second redirection rule related to the first Pod. The event-driven configuration of the redirection rule ensures the normal communication between the service containers in different Pods.

[0012] In some optional embodiments, before the first service container sends the target data to the network management Pod based on the first redirection rule, the method further includes:

[0013] In the case where the first Pod is added to the service mesh system, the first Pod loads the target program in the shared data volume, and configures the first redirection rule through the target program.

[0014] In this embodiment, the Pod added to the service grid can load the target program in the shared data volume, configure the redirection rule, thereby realizing the aggregation of the traffic of the service container in each Pod to the network management Pod for management, and improving the overall network performance.

[0015] In some optional embodiments, after the first Pod corresponding redirection rule and the network management Pod corresponding redirection rule are configured by the target program, the method further comprises:

[0016] storing the second redirection rule into a global forwarding information base (FIB) by using the network management Pod.

[0017] In this embodiment, the network management Pod can maintain and manage the configured redirection rule in the FIB, thereby realizing the traffic governance between different Pods across the network namespace, better optimizing the traffic of the service capacity of each Pod in the node, and improving the overall network performance.

[0018] In some optional embodiments, the first Pod, the network management Pod and the second Pod run on the same node, the first redirection rule is used to indicate that the first service container sends data sent to the second service container belonging to the same node to the network management Pod.

[0019] The second redirection rule is used to indicate that the network management Pod sends the received data sent to the second service container of the same node to the second service container.

[0020] In this embodiment, the traffic of the service container in each Pod in the same node can be uniformly aggregated to the network management Pod in the node, the traffic of the service container in each Pod in the same node is managed through the network management Pod, the transmission path of data can be optimized, the management efficiency of network traffic can be improved, and the network management resource overhead can be reduced without deploying a Sidecar agent in each Pod for traffic management.

[0021] In some optional embodiments, the first Pod and the network management Pod run on a first node, the second Pod runs on a second node, and the first node is different from the second node; the first redirection rule is used to indicate that the first Pod sends data sent to the second service container belonging to a different node to the network management Pod, and the second redirection rule is used to indicate that the network management Pod of the first node sends the received data sent to the second service container of a different node to the network management Pod of the second node.

[0022] The network management Pod of the first node sends the target data to the network management Pod of the second node based on the first redirection rule.

[0023] The network management Pod of the first node sends the target data to the network management Pod of the second node based on the first redirection rule.

[0024] After the network management Pod of the second node obtains the target data sent by the network management Pod of the first node, the network management Pod of the second node sends the target data to the second service container based on a third redirection rule, and the third redirection rule is used to instruct the network management Pod of the second node to send the received data sent to the second service container of the same node to the second service container.

[0025] In this embodiment, the network management Pods are deployed in different nodes in the service mesh system, and the network management Pods in different nodes can realize cross-node communication. The traffic of the service containers of the Pods running in each node in the service mesh system can be aggregated to the network management Pod deployed in each node for management, thereby optimizing the traffic transmission path and improving the management efficiency of network traffic.

[0026] In some optional embodiments, the redirection rules include a first type of rule, a second type of rule, a third type of rule, and a fourth type of rule; wherein,

[0027] The first type of rule is used to instruct the network management Pod to send data sent by a service container to other service containers belonging to the same node to the network management Pod.

[0028] The second type of rule is used to instruct the network management Pod to send data sent by a service container to other service containers belonging to different nodes to the network management Pod.

[0029] The third type of rule is used to instruct the network management Pod to send the received data sent to other service containers belonging to different nodes to the network management Pod of the node where the other service containers are located.

[0030] The fourth type of rule is used to instruct the network management Pod to send the received data sent to other service containers belonging to the same node to the other service containers.

[0031] In the embodiment, based on the configured redirection rules, the traffic of the service containers in different Pods in the service network system can be uniformly aggregated to the network management Pod for management, and the communication between the service containers in different Pods in the same node and the communication between the service containers in different Pods across nodes can be implemented, so as to ensure the stability of the communication between different services in the service network system.

[0032] The embodiment of the application discloses a service mesh system, which comprises a first Pod, a network management Pod and a second Pod, the first Pod comprises a first service container, the second Pod comprises a second service container, and the first Pod and the network management Pod run on the same node; wherein the first Pod and the network management Pod are connected through a border gateway protocol (BGP), and the network management Pod and the second Pod are connected through the BGP;

[0033] The first service container is configured to send target data to the network management Pod, wherein the target data is data that the first service container needs to send to the second service container.

[0034] The network management Pod is configured to send the target data to the second service container after obtaining the target data sent by the first service container.

[0035] In the embodiment, the traffic of the service containers of each Pod in the service mesh system can be aggregated to the network management Pod by using the traffic rules of the BGP, so that no conflict with the iptables network rules adopted by the host is caused, and the traffic management path is optimized. Moreover, the egress and ingress traffic of the service containers of each Pod is uniformly aggregated to the network management Pod, and the traffic management is performed through the network management Pod, so that a global network management mode is adopted, the Sidecar agent does not need to be deployed in each Pod to manage the traffic of the service containers, and the resource overhead of network management can be reduced.

[0036] In some optional embodiments, the first service container is further configured to send target data to the network management Pod based on a first redirection rule, wherein the first redirection rule is used to indicate that the data sent by the first service container to the second service container is sent to the network management Pod.

[0037] The network management Pod is further configured to send the target data to the second service container based on a second redirection rule after obtaining the target data sent by the first service container, wherein the second redirection rule is used to indicate that the network management Pod sends the received data sent to the second service container to the second service container.

[0038] In this embodiment, the first service container in the first Pod can send target data that needs to be sent to the second service container of the second Pod to the network management Pod based on the first redirection rule, and the network management Pod can send the target data to the second service container based on the second redirection rule, thereby optimizing the data transmission path based on the redirection rule, reducing the number of hops of data in the network, and improving the management efficiency of network traffic.

[0039] In some optional embodiments, the network management Pod is further configured to load a target program according to a traffic event corresponding to the first Pod and configure the second redirection rule through the target program when the first Pod is added to the service mesh system; the traffic event includes Pod information corresponding to the first Pod and Pod information of other Pods that communicate with the first Pod.

[0040] In this embodiment, when the first Pod is added to the service mesh system, the network management Pod can load a target program according to a traffic event of the first Pod and configure a second redirection rule related to the first Pod, thereby ensuring normal communication between service containers in different Pods through event-driven configuration of the redirection rule.

[0041] In some optional embodiments, when the first Pod is added to the service mesh system, the first Pod is further configured to load the target program in the shared data volume and configure the first redirection rule through the target program.

[0042] In this embodiment, the Pod added to the service mesh can configure the redirection rule by loading the target program in the shared data volume, thereby realizing the aggregation of traffic of service containers in each Pod to the network management Pod for management, and improving the overall network performance.

[0043] In some optional embodiments, the network management Pod is further configured to store the second redirection rule in a global forwarding information base (FIB).

[0044] In this embodiment, the network management Pod can maintain and manage the configured redirection rule in the FIB, thereby realizing traffic governance between different Pods across network namespaces, better optimizing the traffic of service containers of each Pod in a node, and improving the overall network performance.

[0045] In some optional embodiments, the first Pod and the network management Pod run on a first node, and the second Pod runs on a second node, the first node being different from the second node.

[0046] The network management Pod of the first node is further configured to send the target data to the network management Pod of the second node.

[0047] The network management Pod of the second node is further configured to send the target data to the second service container after obtaining the target data sent by the network management Pod of the first node.

[0048] In this embodiment, the network management Pods of different nodes in the service mesh system can communicate across nodes, and the traffic of the service containers of the Pods running in the nodes in the service mesh system can be aggregated to the network management Pods deployed in the nodes for management, thereby optimizing the traffic transmission path and improving the management efficiency of network traffic.

[0049] In some optional embodiments, the network management Pod of the second node is further configured to send the target data to the second service container based on a third redirection rule after obtaining the target data sent by the network management Pod of the first node, where the third redirection rule is used to instruct the network management Pod of the second node to send the data received and sent to the second service container of the same node to the second service container.

[0050] In this embodiment, the network management Pods of different nodes can communicate across nodes, and the network management Pods can send the data sent by the network management Pods of other nodes to the service containers of the same nodes based on the redirection rules, thereby ensuring the communication stability between the service containers of different nodes.

[0051] Embodiments of the present application disclose a service communication device applied to a service mesh system, where the service mesh system includes a first Pod, a network management Pod and a second Pod, the first Pod includes a first service container, the second Pod includes a second service container, the first Pod and the network management Pod run in the same node, and the node is a computing device or a virtual machine running on a computing device; the device includes:

[0052] A first sending module is configured to send target data to the network management Pod based on a first redirection rule using the first service container, the target data is data that needs to be sent by the first service container to the second service container, and the first redirection rule is used to instruct the data sent by the first service container to the second service container to be sent to the network management Pod.

[0053] A second sending module is configured to, after the network management Pod obtains the target data sent by the first service container, send the target data to the second service container based on a second redirection rule using the network management Pod, where the second redirection rule is used to instruct the network management Pod to send the received data sent to the second service container to the second service container.

[0054] The embodiment of the present application discloses a computing device, comprising a memory and a processor, the memory stores a computer program, and the computer program is executed by the processor to make the processor implement the method in any one of the above embodiments.

[0055] The embodiment of the present application discloses a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method in any one of the above embodiments.

[0056] The embodiment of the present application discloses a computer program product, comprising a computer program, and the computer program is executed by a processor to implement the method in any one of the above embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative effort on the basis of these drawings.

[0058] Figure 1A The application scenario diagram of the service communication method in an embodiment;

[0059] Figure 1A The system architecture diagram of the service communication method in an embodiment;

[0060] Figure 2 The flowchart of the service communication method in an embodiment;

[0061] Figure 3 The schematic diagram of cross-node service communication in an embodiment;

[0062] Figure 4 The flowchart of the service communication method in another embodiment;

[0063] Figure 5 The schematic diagram of loading a target program by each Pod in a node through a shared data volume in an embodiment;

[0064] Figure 6 The flowchart of communication between services across nodes in an embodiment;

[0065] Figure 7 An illustration of implementing communication between different services in one embodiment;

[0066] Figure 8 A block diagram of a service communication device in one embodiment;

[0067] Figure 9 A structural block diagram of a computing device in one embodiment. DETAILED DESCRIPTION

[0068] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work are within the scope of protection of the present application.

[0069] It should be noted that the terms “include” and “have” and any variations thereof in the embodiments of the present application and the drawings are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but can optionally include other steps or units not listed or can optionally include other steps or units inherent to the process, method, product or device.

[0070] It can be understood that the terms “first”, “second” and the like used in the present application can be used herein to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from another element. For example, without departing from the scope of the present application, the first service container can be referred to as the second service container, and similarly, the second service container can be referred to as the first service container. The first service container and the second service container are both service containers, but they are not necessarily the same service container. The term “multiple” used in the present application refers to two and more than two.

[0071] Some terms that may be involved in the present application will be explained and described below:

[0072] Service mesh: is a kind of infrastructure layer used to process communication between services in microservice architecture. Its main function is to provide reliable network communication between services, and to realize load balancing, traffic management, security authentication, monitoring and fault handling in service communication. It can help developers to build and manage microservice architecture more easily.

[0073] Microservice architecture: is a cloud-native architecture method that can decompose an application into loosely coupled and independently deployable small components or services.

[0074] Sidecar mode: In a service mesh, a Sidecar proxy is deployed for each service instance, running in a container within the Pod of the service instance. The Sidecar proxy is responsible for intercepting all traffic to and from the service container in the Pod and managing the traffic.

[0075] Service instance: Refers to a specific implementation or deployment of a microservice in runtime.

[0076] Pod: The smallest unit of resource management in a Kubernetes (K8s) cluster, each Pod can include one or more containers, and containers in the same Pod can share storage, network and namespace.

[0077] Container: A convenient and lightweight virtualization technology, containers can be used to encapsulate applications, application configuration files, etc., to run in various environments.

[0078] Node: Refers to a machine in a Kubernetes cluster that carries workloads, nodes can be virtual machines or physical machines, and nodes contain services required to run Pods.

[0079] Network namespace: A method of isolating network resources in an operating system, allowing different processes or containers to run in different network environments without interfering with each other; each network namespace has its own IP address, routing table and firewall rules, etc., to achieve network isolation.

[0080] BGP (Border Gateway Protocol) is an autonomous system routing protocol that can be used to exchange routing information between different autonomous systems (AS), and can build and maintain routing tables globally, suitable for complex Internet structures.

[0081] Control plane: Refers to the part of the network that controls data forwarding, which determines the transmission path between the source and destination of data.

[0082] Istio: A service mesh solution that can be used to manage and route traffic between microservices, detect and prevent attacks between services, and monitor service performance.

[0083] Veth Pair (Virtual Ethernet Pair): Refers to a pair of virtual network cards, which is a pair of virtual communication interfaces, data sent from one virtual communication interface can be directly sent to the other virtual communication interface.

[0084] Figure 1A An application scenario diagram of a service communication method in an embodiment. As shown in the figure, the method can be applied to a service network system 100, which can include one or more computing devices 110, which can include devices such as servers, and the plurality of computing devices 110 can form a server cluster and be built with a cluster management architecture such as a Kubernetes cluster. Figure 1A

[0085] Optionally, the computing device 110 can serve as a host to provide a virtualization environment for container running in the Kubernetes cluster. One computing device 110 or one virtual machine running in the computing device 110 can be considered as one node of the Kubernetes cluster. A service mesh can be deployed in the Kubernetes cluster, and one or more services (one service can correspond to one service instance) can be deployed in each node. Different services in the same node and services between different nodes can communicate with each other.

[0086] Exemplarily, Figure 1B A system architecture diagram of a service communication method in an embodiment. In each node (Node) of the Kubernetes cluster, one or more services can be deployed. Exemplarily, one or more Pods can be run in each node, one service can correspond to one Pod, and one Pod can correspond to one network namespace. For example, service A (i.e., Pod-A) and service B (i.e., Pod-B) are deployed in the node, the network namespace corresponding to service A (i.e., Pod-A) can be Network-A, and the network namespace corresponding to service B (i.e., Pod-B) can be Network-B.

[0087] Each Pod can include one or more service containers, which can refer to containers used for service business, for example, Pod-A can include a service container used for service A business, and Pod-B can include a service container used for service B business.

[0088] In the embodiments of the present application, in each node (Node) of the Kubernetes cluster, a network management Pod can also be deployed, which can be used for traffic management of each service container in the node. The outgoing and incoming traffic of the service containers in each Pod in the node can be uniformly collected to the network management Pod, and traffic management can be performed through the network management Pod.

[0089] ​Exemplarily, taking the traffic transmission from a service A (i.e., a Pod-A) in a node to a service B (i.e., a Pod-B) as an example, the path of the traffic transmission is a service container of the Pod-A-network management Pod-a service container of the Pod-B. Compared with the path of the traffic transmission in the Sidecar mode, the number of hops of the data in the network can be reduced, and thus the management efficiency of the network traffic is improved.

[0090] As shown in Figure 2 In one embodiment, a service communication method is provided, which can be applied to the service network system described above. The method can include the following steps:

[0091] In step 210, a first service container sends target data to a network management Pod based on a first redirection rule, the target data being data that the first service container needs to send to a second service container.

[0092] In step 220, after the network management Pod obtains the target data sent by the first service container, the network management Pod sends the target data to the second service container based on a second redirection rule.

[0093] In the service network system, one or more services can be deployed in a server cluster, and the server cluster can include one or more nodes, each of which can be a computing device or a virtual machine running on a computing device. A network management Pod can be run in each node, and one or more Pods corresponding to the services can also be run in each node, and the Pods corresponding to the services can be used to process the business of the services to provide functions related to the services. One or more service containers can be included in each Pod corresponding to the services, and the service containers can be used to process the business of the services.

[0094] The network management Pod running in each node can uniformly manage the traffic of the service containers in each Pod in the node.

[0095] It should be noted that one service can also correspond to multiple Pods, and the Pods corresponding to the same service can belong to the same network namespace, and each network namespace has an independent network configuration, such as a network device, routing information, or forwarding rules.

[0096] In some embodiments, for each Pod corresponding to a service in the service network system, a corresponding redirection rule can be pre-configured, which can be used to define a data transmission path between the service container in the Pod and the service container in another Pod. The data transmission path between the service containers in the two Pods can include at least two redirection rules, which can be used to indicate that the data between the service containers in the two Pods is first sent from one service container to the network management Pod, and then sent from the network management Pod to the other service container, so as to realize the aggregation of data between different services to the network management Pod for unified management.

[0097] For example, the service network system can include a first Pod, a network management Pod and a second Pod, the first Pod can include a first service container, and the second Pod can include a second service container, and the first Pod and the network management Pod can run on the same node, wherein the first Pod and the second Pod can be Pods corresponding to different services in the service network system.

[0098] The first Pod can correspond to a first service, and the first service container can be used to perform the business of the first service; the second Pod can correspond to a second service, and the second service container can be used to perform the business of the second service, and the first service and the second service are different services in the service network system. The second Pod can run on the same node as the first Pod or on a different node.

[0099] In the case that the first service container of the first Pod needs to send target data to the second service container of the second Pod, the first service container can send the target data to the network management Pod of the node where the first Pod is located based on the first redirection rule. After the network management Pod receives the target data sent by the first service container, the network management Pod can send the target data to the second service container of the second Pod based on the second redirection rule.

[0100] The first redirection rule can be used to indicate that the data sent from the first service container to the second service container is sent to the network management Pod, and the second redirection rule can be used to indicate that the network management Pod sends the received data sent to the second service container to the second service container. Optionally, the first redirection rule and the second redirection rule can constitute a data transmission path from the first service container to the second service container.

[0101] As an implementation, the storage space corresponding to the first Pod can store the redirection rule corresponding to the first Pod, which can be one or multiple, for example, multiple other Pods that communicate with the first Pod can be configured with multiple redirection rules corresponding to the other Pods respectively, and further, the redirection rule corresponding to the first Pod can be used to indicate the service container in the first Pod to send data to the service container in the other Pod to the network management Pod.

[0102] Each Pod running in the node can be a virtual network device and be assigned with a corresponding virtual communication interface, which can be represented by an IP (Internet Protocol) address and / or a port number, and each virtual network device can communicate through the virtual communication interface.

[0103] For example, the redirection rule corresponding to the first Pod can be the virtual communication interface corresponding to the first Pod (such as the IP address and / or port number of the first Pod) and the virtual communication interface corresponding to the network management Pod (such as the IP address and / or port number of the network management Pod).

[0104] It should be noted that the storage space corresponding to the first Pod can store the redirection rule contained in the complete data transmission path between the service container of the first Pod and the service container of the other Pod, or can only store the redirection rule corresponding to the partial data transmission path between the service container of the first Pod and the service container of the other Pod, for example, only the redirection rule corresponding to the data transmission path from the service container of the first Pod to the network management Pod can be stored.

[0105] When the first service container in the first Pod obtains target data that needs to be sent to the second service container in the second Pod, the target data can carry the virtual communication interface corresponding to the second Pod, and the first service container can find the first redirection rule matched with the virtual communication interface corresponding to the second Pod in the stored redirection rule corresponding to the first Pod according to the virtual communication interface corresponding to the second Pod, and send the target data to the network management Pod based on the first redirection rule.

[0106] As an implementation, the storage space corresponding to the network management Pod in the node can store the redirection rule related to the Pod corresponding to each service in the node, and for the Pod corresponding to each service in the node, the network management Pod can store one or multiple redirection rules, for example, for multiple other Pods that communicate with the first Pod, the network management Pod can store the redirection rule corresponding to the communication between the first Pod and each other Pod.

[0107] It should be noted that the network management Pod can store the complete data transmission path between the service container of the first Pod and the service container of the second Pod, and the redirection rule corresponding to the partial data transmission path between the network management Pod and the service container of the second Pod in the storage space corresponding to the network management Pod. For example, for the communication between the first Pod and the second Pod, the network management Pod can only store the redirection rule from the network management Pod to the service container of the second Pod.

[0108] After the network management Pod obtains the target data sent by the first service container of the first Pod, the target data carries the virtual communication interface corresponding to the second Pod. The network management Pod can find the second redirection rule matched with the virtual communication interface corresponding to the second Pod in the stored redirection rule according to the virtual communication interface corresponding to the second Pod, and send the target data to the second service container of the second Pod based on the second redirection rule.

[0109] Optionally, the network management Pod can realize the communication between the Pods of different services in the same node. The first Pod and the second Pod can run in the same node. The network management Pod can forward the target data sent by the first Pod to the second service container of the second Pod based on the second redirection rule.

[0110] For example, as shown in Figure 1B Service A (i.e. Pod-A) in the node sends data to service B (i.e. Pod-B), and the service container of Pod-A sends the data to the network management Pod first, and then the network management Pod forwards the data to the service container of Pod-B. Compared with the data transmission path in the Sidecar mode in the related art, the number of hops of the data in the network can be reduced, and the management efficiency of the network traffic can be improved.

[0111] In some embodiments, the network management Pod can also realize the communication between the Pods of different services across nodes. The first Pod and the second Pod can run in different nodes, and the network management Pod can communicate with the network management Pods of other nodes. The network management Pod can forward the target data sent by the first Pod to the network management Pod in the destination node based on the second redirection rule, and then the network management Pod in the destination node forwards the target data to the second service container of the second Pod; wherein the destination node is the node to which the second Pod belongs.

[0112] For example, Figure 3 is a schematic diagram of service communication across nodes in an embodiment. As shown in Figure 3As shown, if the service of node 1 (i.e., Pod-A) sends data to the service of node 2 (i.e., Pod-C), the service container of Pod-A first sends the data to the network management Pod-1 of node 1, and then the network management Pod-1 of node 1 forwards the data to the network management Pod-2 of node 2, and the network management Pod-2 of node 2 can forward the data to the service container of Pod-C. Compared with the data transmission path in the Sidecar mode in the related art, the number of hops of the data in the network can be reduced, and the management efficiency of the network traffic is improved.

[0113] As an implementation, the communication between different services can be implemented based on the BGP protocol, and the different nodes in the Kubernetes cluster can interact with routing information, so as to realize the communication between the services on the different nodes. The routing information can include the redirection rules of the Pods corresponding to the services, and the redirection rules can be used to construct the data transmission paths between different services in the same node and between different services of different nodes, so as to realize the communication between different services.

[0114] In the embodiments of the present application, the network management Pod can realize the communication between different services in the same node and the communication between different services of different nodes, and the traffic of the service containers of the services of the nodes in the service mesh system can be all collected to the network management Pod deployed in each node for management, so that the traffic transmission path is optimized, the management efficiency of the network traffic is improved, and the original network configuration of the Kubernetes cluster does not need to be modified, which is a non-intrusive design, provides a more flexible network traffic management mode, and can adapt to different network environments and requirements.

[0115] In the embodiments of the present application, the service mesh system can manage the traffic between the service containers in different Pods through the network management Pod running in each node, and the first service container in the first Pod can send target data to be sent to the second service container of the second Pod to the network management Pod based on the first redirection rule, and the network management Pod can send the target data to the second service container based on the second redirection rule. The target data does not need to pass through the Sidecar agents of the first Pod and the second Pod, the transmission path of the data can be optimized, the number of hops of the data in the network can be reduced, and the management efficiency of the network traffic is improved. Moreover, the incoming and outgoing traffic of the service containers of each Pod is uniformly collected to the network management Pod, and the traffic management is performed through the network management Pod, a global network management mode is adopted, the Sidecar agent does not need to be deployed in each Pod to manage the traffic of the service containers, and the resource overhead of the network management can be reduced.

[0116] As Figure 4As shown, in another embodiment, a service communication method is provided, which can be applied to the computing device described above, and can include the following steps:

[0117] At step 402, in the case of adding the first Pod to the service mesh system, the target program is loaded according to the traffic event of the first Pod using the network management Pod, and the second redirection rule is configured through the target program.

[0118] The redirection rule corresponding to the first Pod can be configured when the first Pod is added to the service mesh system. The first Pod can be a Pod originally running in the computing device or a newly started Pod when it is added to the service mesh system.

[0119] In some embodiments, when the first Pod is added to the service mesh system, the traffic event corresponding to the first Pod can be registered in the network management Pod, which can be used to monitor the service configuration process of the first Pod, such as monitoring the service processing process between the first Pod and other Pods, which can be the process of sending data from the service container in the first Pod to the service container in other Pods, or the process of bidirectional communication between the service container in the first Pod and the service container in other Pods, etc.

[0120] As a specific implementation, the cni Pod corresponding to the istio-cni plug-in can be deployed in the node in the service network system, and when the cni Pod detects that the first Pod needs to be added to the service mesh system, the network management Pod can be sent the push information corresponding to the first Pod to make the network management Pod register the traffic event corresponding to the first Pod.

[0121] Optionally, when the cni instance detects that the first Pod needs to be added to the service mesh system, the target label can be assigned to the first Pod, so that the network management Pod manages the traffic of the first Pod. The target label can be used to indicate that the first service corresponding to the first Pod needs to be managed by the network management Pod. Optionally, the label content of the target label can be set according to actual needs, which can be composed of one or more of numbers, letters, characters and symbols.

[0122] After the target label is assigned to the first Pod, the running of the service containers in the first Pod can be blocked first, the traffic event corresponding to the first Pod is registered in the network management Pod, and the redirection rule corresponding to the first Pod is configured. After the redirection rule corresponding to the first Pod is configured, the service containers in the first Pod can be run. Specifically, the cni Pod in the node can prevent the service containers in the first Pod from starting when the first Pod is added to the service mesh system, and wait until the network management Pod successfully registers the traffic event of the first Pod and configures the redirection rule corresponding to the first Pod. Then the service containers in the first Pod can be created and run, which can ensure the accuracy of the first Pod processing business, and the first Pod only needs to focus on business implementation, which can improve the efficiency of business processing and reduce resource overhead.

[0123] It should be noted that there can also be services with target labels running in the service network system. The service without a target label can be a service that needs to manage traffic by itself, and the Pod corresponding to the service can not be assigned a target label. The traffic of the service containers in the Pod without a target label will not be aggregated in the network management Pod for unified management. Whether the traffic of the service containers is managed by the network management Pod can be set according to actual needs. By adding labels, the flexibility of traffic management of each service in the service network system can be improved, and the network performance can be improved.

[0124] The traffic event corresponding to the first Pod can include Pod information corresponding to the first Pod and Pod information of other Pods communicating with the first Pod. Optionally, the other Pods communicating with the first Pod can be opposite Pods communicating with the first Pod, such as Pods corresponding to other services receiving data sent by the service containers of the first Pod.

[0125] In some embodiments, the Pod information corresponding to the first Pod can include one or more of, but is not limited to, a network namespace corresponding to the first Pod, a Pod name (or a service name), network communication information, and the like. The network communication information can include a virtual communication interface corresponding to the first Pod, such as an IP address and / or a port number, and the like.

[0126] The Pod information of the other Pods communicating with the first Pod can include one or more of, but is not limited to, a network namespace corresponding to the other Pods, a Pod name (or a service name), network communication information, and the like. The network communication information can include a virtual communication interface corresponding to the other Pods, such as an IP address and / or a port number, and the like.

[0127] By associating the traffic event corresponding to the first Pod with the Pod information corresponding to the first Pod and the Pod information of other Pods communicating with the first Pod, it is convenient to subsequently monitor the service processing flow configured between the first Pod and the other Pods, so as to trigger the configuration of the corresponding redirection rule.

[0128] After registering the traffic event in the network management Pod, if the network management Pod listens to the service configuration operation conforming to the traffic event according to the traffic event, the target program can be loaded, and the redirection rule corresponding to the service configuration operation is configured through the target program.

[0129] Since the traffic event includes the Pod information corresponding to the first Pod and the Pod information of one or more other Pods communicating with the first Pod, when the first Pod performs the service configuration operation, the service configuration operation is used to configure the service processing flow between the service container of the first Pod and the service container of any other Pod, and the Pod information of the first Pod and the Pod information of any other Pod communicating are defined in the service configuration operation, so the service configuration operation conforms to the traffic event corresponding to the first Pod. The network management Pod can obtain the service configuration operation conforming to the traffic event and the Pod information of the first Pod and the Pod information of any other Pod communicating defined in the service configuration operation, load the target program, and configure the redirection rule corresponding to the service configuration operation. The redirection rule corresponding to the service configuration operation can be used to help implement the service processing flow configured in the service configuration operation.

[0130] Exemplarily, when the first Pod performs the service configuration operation corresponding to the second Pod, the service configuration operation is used to configure the service processing flow of the first service container of the first Pod sending data to the second service container of the second Pod, which conforms to the traffic event corresponding to the first Pod, and the network management Pod can configure the corresponding redirection rule of the first service container of the first Pod sending data to the second service container of the second Pod. For example, the network management Pod can configure the second redirection rule for instructing the network management Pod to send the received data sent to the second service container to the second service container, and optionally, the network management Pod can also configure the first redirection rule for instructing the data sent by the first service container to the second service container to be sent to the network management Pod.

[0131] In some embodiments, the redirection rule can include a first type of rule, a second type of rule, a third type of rule, and a fourth type of rule; wherein,

[0132] The first type of rule is used to instruct the data sent by the service container to the other service container belonging to the same node to be sent to the network management Pod;

[0133] The second type of rule is used to indicate that the data sent by the service container to other service containers belonging to different nodes is sent to the network management Pod;

[0134] The third type of rule is used to indicate that the network management Pod sends the received data sent to other service containers belonging to different nodes to the network management Pod of the node where the other service containers are located;

[0135] The fourth type of rule is used to indicate that the network management Pod sends the received data sent to other service containers belonging to the same node to the other service containers.

[0136] Among them, the first type of rule and the fourth type of rule can be used to realize the communication between different services in the same node, and the second type of rule and the third type of rule can be used to realize the communication between different services across nodes.

[0137] In this embodiment, based on the configured redirection rules of various types, the traffic of service containers in different Pods in the service network system can be uniformly aggregated to the network management Pod for management, and the communication between service containers in different Pods in the same node can be realized, and the communication between service containers in different Pods across nodes can also be realized, thereby ensuring the stability of the communication between different services in the service network system.

[0138] The target program can refer to a program for adding redirection rules. Optionally, the target program can include a first function, a second function, a third function, and a fourth function. The first function can be used to configure the first type of rule described above, the second function can be used to configure the second type of rule described above, the third function can be used to configure the third type of rule described above, and the fourth function can be used to configure the fourth type of rule described above.

[0139] As an embodiment, the communication between different services can be realized based on the BGP protocol, and the target program can be a BGP redirection extension program, which can be used to provide redirection rules under the BGP protocol.

[0140] Exemplarily, the BGP redirection extension program realizes the configuration of the redirection rules, which can mainly use the following functions:

[0141] Hook_ingress(from-netdev) can be used to realize the redirection rule configuration of the traffic of the network device (i.e., the network interface) in the same node entering the network management Pod. The function Hook_ingress(from-netdev) can be used to configure the first type of rule described above;

[0142] Hook ingress (from-overlay), which can be used to configure the redirection rule of the traffic entering the network management Pod of the network device, and then communicating with other network management Pods of other nodes, belongs to the redirection rule of the overlay network, and the function Hook ingress (from-overlay) can be used to configure the second type of rule described above;

[0143] Hook egress (to-overlay), which can be used to configure the redirection rule of the traffic flowing out of the network management Pod to the network device, and then communicating with other network management Pods of other nodes, belongs to the redirection rule of the overlay network, and the function Hook egress (to-overlay) can be used to configure the third type of rule described above;

[0144] Hook egress (to-netdev), which can be used to configure the redirection rule of the traffic flowing out of the network management Pod to the network device in the same node, and the function Hook egress (to-netdev) can be used to configure the fourth type of rule described above.

[0145] The redirection rules of the Pods corresponding to each service can be formulated based on several functions in the target program described above.

[0146] Taking the first service container in the first Pod sending data to the second service container in the second Pod as an example, the redirection rules contained in the data transmission path from the first service container in the first Pod to the second service container in the second Pod are configured. If the first Pod and the second Pod run in the same node, the function Hook ingress (from-netdev) can be called to configure the first redirection rule (used to instruct the first service container to send the data sent to the second service container belonging to the same node to the network management Pod), and the first redirection rule can be the first type of rule. The function Hook egress (to-netdev) is called to configure the second redirection rule (used to instruct the network management Pod to send the received data sent to the second service container of the same node to the second service container), and the second redirection rule can be the fourth type of rule.

[0147] If the first Pod and the second Pod run on different nodes, the Hook_ingress(from-overlay) function can be called to configure a first redirection rule (used to indicate that the first service container sends data sent to the second service container belonging to a different node to the network management Pod), which can be a second type of rule; the Hook_egress(to-overlay) function is called to configure a second redirection rule (used to indicate that the network management Pod sends data received and sent to the second service container on a different node to the network management Pod on the node where the second service container is located), which can be a third type of rule; and the Hook_egress(to-netdev) function is also called to configure a third redirection rule (used to indicate that the network management Pod on the node where the second service container is located sends data received from the second service container on the same node to the second service container), which can be a fourth type of rule.

[0148] For example, the configured redirection rules can be represented by network interface information corresponding to the Pod, for example, the data transmission path corresponding to the communication between the first Pod and the second Pod on the same node can be represented as: IP address of the first Pod-IP address of the network management Pod-IP address of the second Pod, where the IP address of the first Pod-IP address of the network management Pod can be a first redirection rule, and the IP address of the network management Pod-IP address of the second Pod can be a second redirection rule.

[0149] For example, the data transmission path corresponding to the communication between the first Pod and the second Pod on different nodes can be represented as: IP address of the first Pod-IP address of the network management Pod on the node where the first Pod is located-IP address of the network management Pod on the node where the second Pod is located-IP address of the second Pod.

[0150] In the embodiments of the present application, when the first Pod is added to the service mesh system, the network management Pod can load a target program according to the traffic event of the first Pod, and configure a second redirection rule related to the first Pod, so as to ensure normal communication between service containers in different Pods by event-driven configuration of the redirection rule.

[0151] After the network management Pod configures the redirection rule corresponding to the first Pod, the redirection rule can be stored in a global Forward Information dataBase (FIB), for example, after the network management Pod configures the second redirection rule described above, the network management Pod can be used to store the second redirection rule in the FIB.

[0152] Optionally, each node can maintain a FIB, which can store redirection rules of Pods corresponding to various services in the node. By maintaining and managing the configured redirection rules in the FIB, traffic management between different Pods across network namespaces can be implemented, and the service capacity of various Pods in the node can be better optimized, thereby improving the overall network performance.

[0153] At step 404, in the case of adding the first Pod to the service mesh system, the target program in the shared data volume is loaded by the first Pod, and the first redirection rule is configured by the target program.

[0154] In some embodiments, the target program can be stored in the shared data volume of the node, which can refer to a data volume shared by all Pods in the node, and the shared data volume can be accessed by Pods corresponding to various services and network management Pods running in the node. In the case of adding the first Pod to the service mesh system, the target program in the shared data volume can be loaded by the first Pod, and the redirection rule corresponding to the first Pod can be configured by the target program.

[0155] In the case of adding the first Pod to the service mesh system, when the first Pod performs a business configuration operation, the target program in the shared data volume can be loaded by the first Pod, and the redirection rule corresponding to the business configuration operation can be configured.

[0156] For example, when the first Pod performs a business configuration operation corresponding to the second Pod, the business configuration operation is used to configure a business processing flow of the first service container of the first Pod sending data to the second service container of the second Pod, the target program in the shared data volume can be loaded by the first Pod, and the corresponding redirection rule of the first service container of the first Pod sending data to the second service container of the second Pod can be configured by the target program. For example, the first Pod can configure a first redirection rule of the data sent by the first service container to the second service container to the network management Pod by the target program.

[0157] As an implementation, the network management Pod can configure various redirection rules contained in the data transmission path from the first service container of the first Pod to the second service container of the second Pod, and then send the configured various redirection rules to each Pod in the data transmission path. For example, the network management Pod can send the configured first redirection rule to the first Pod for storage, and the first Pod can not configure the redirection rule. For another example, the network management Pod can also send the configured third redirection rule to the network management Pod of the node where the second service container is located for storage, and so on.

[0158] As another implementation, the network management Pod can configure the redirection rule for part of the data transmission path from the first service container of the first Pod to the second service container of the second Pod, for example, only the second redirection rule can be configured, and the first Pod can configure the first redirection rule.

[0159] Exemplarily, Figure 5 A schematic diagram for loading a target program by each Pod in a node in an embodiment. As shown in the figure, each Pod corresponding to a service in the node, such as Pod-A and Pod-B, can load a BGP redirection extension program through a shared data volume to configure a redirection rule, and the network management Pod can also run the BGP redirection extension program through the shared data volume to configure the redirection rule of each Pod corresponding to a service. Figure 5

[0160] Optionally, after configuring the redirection rule, the first Pod can store the configured redirection rule in the FIB, for example, after configuring the first redirection rule described above, the first Pod can store the first redirection rule in the FIB.

[0161] In the embodiments of the present application, each Pod corresponding to a service added to the service network system can configure a redirection rule by loading a target program in a shared data volume, so as to realize the aggregation of the traffic of the service containers in each Pod to the network management Pod for management, thereby improving the overall network performance.

[0162] Step 406, using the first service container to send target data to the network management Pod based on the first redirection rule, the target data being data that the first service container needs to send to the second service container.

[0163] Step 408, after the network management Pod obtains the target data sent by the first service container, using the network management Pod to send the target data to the second service container based on the second redirection rule.

[0164] The description of steps 406-408 can refer to the related description in the above embodiments, which will not be repeated here.

[0165] In the embodiments of the present application, in the case of adding the first Pod to the service grid system, the network management Pod can load a target program and configure the redirection rule corresponding to the first Pod, so as to realize the aggregation of the traffic of the service containers in each Pod to the network management Pod for management, thereby improving the overall network performance.

[0166] Exemplarily, Figure 6 ​As shown, in some embodiments, the first Pod and the network management Pod run on the first node, the second Pod runs on the second node, the first node is different from the second node, and the service communication method can include the following steps:

[0167] In step 602, the first service container sends target data to the network management Pod of the first node based on a first redirection rule, the target data being data that the first service container needs to send to the second service container; the first redirection rule being used to instruct the first Pod to send data sent to the second service container of a different node to the network management Pod of the first node.

[0168] In step 604, after the network management Pod of the first node obtains the target data sent by the first service container, the network management Pod of the first node sends the target data to the network management Pod of the second node based on a second redirection rule; the second redirection rule being used to instruct the network management Pod of the first node to send data received and sent to the second service container of a different node to the network management Pod of the second node.

[0169] In step 606, after the network management Pod of the second node obtains the target data sent by the network management Pod of the first node, the network management Pod of the second node sends the target data to the second service container based on a third redirection rule, the third redirection rule being used to instruct the network management Pod of the second node to send data received and sent to the second service container of the same node to the second service container.

[0170] In the case where the first Pod and the second Pod run on different nodes respectively, the communication interaction between the network management Pods on different nodes can be used to realize the communication between services across nodes. The first service container of the first Pod can send target data to the network management Pod of the same node (i.e., the first node) based on a first redirection rule, and the network management Pod sends the target data to the network management Pod of the second node based on a second redirection rule.

[0171] As an implementation, the second redirection rule can include network interface information of the network management Pod of the first node, network interface information of the physical network card of the first node, network interface information of the physical network card of the second node, and network interface information of the network management Pod of the second node. The network management Pod of the first node can send the target data to the physical network card of the first node based on the second redirection rule, forward the target data to the physical network card of the second node through the physical network card of the first node, and then transmit the target data to the network management Pod of the second node through the physical network card of the second node, so as to realize the communication interaction between the network management Pods across nodes.

[0172] In some embodiments, for each Pod corresponding to a service in the service mesh system, a Veth Pair device can be set up, one end of which can be set up in the Pod corresponding to the service, and the other end of which can be set up in the network management Pod, thereby building a communication channel between the Pod corresponding to the service and the network management Pod.

[0173] Further, the Veth Pair device corresponding to each Pod can be configured with a redirection rule, such as a first redirection rule for transmitting data from the virtual communication interface (i.e., Veth interface) of the first Pod to the virtual communication interface of the network management Pod, and / or a redirection rule for transmitting data from the virtual communication interface of the network management Pod to the virtual communication interface of the second Pod, etc.

[0174] Alternatively, the network management Pod can also form a Veth Pair device with the physical network card or virtual network card of the node, thereby building a communication channel between the virtual communication interface of the network management Pod and the network interface of the physical network card of the node.

[0175] For example, Figure 7 A schematic diagram for implementing communication between different services in one embodiment is shown. As Figure 7 shown, veth1 in service A (i.e., Pod-A) in the node and veth0 in the network management Pod form a Veth Pair device, veth2 in service B (i.e., Pod-B) and veth0 in the network management Pod form a Veth Pair device, and veth0 in the network management Pod and eth0 of the physical network card form a Veth Pair device. Wherein veth0, veth1, veth2, and eth0 can represent the names of the Veth Pair devices, each of which can be configured with an IP address.

[0176] As an implementation, the first Pod and the second Pod run on the same node, and the first service container in the first Pod can send target data to the Veth interface of the network management Pod through the Veth interface of the first Pod based on the first redirection rule, and the network management Pod can send the target data to the Veth interface of the second Pod through the Veth interface of the network management Pod based on the second redirection rule, thereby transmitting to the second service container of the second Pod.

[0177] As another implementation, the first Pod and the second Pod run on different nodes, and the first service container in the first Pod can send the target data to the Veth interface of the network management Pod of the first node through the Veth interface of the first Pod based on the first redirection rule. The network management Pod of the first node can send the target data to the Veth interface of the physical network card of the first node through the Veth interface of the network management Pod based on the second redirection rule. The physical network card of the first node forwards the target data to the physical network card of the second node, and the physical network card of the second node sends the target data to the Veth interface of the network management Pod of the second node through the Veth interface of the physical network card. The network management Pod of the second node sends the target data to the Veth interface of the second service container of the second Pod through the Veth interface of the network management Pod of the second node based on the third redirection rule, so as to be transmitted to the second service container of the second Pod.

[0178] As an implementation, the Pod corresponding to each service in the node and the network management Pod can also be connected through a bridge, which can be equivalent to a switch and used for transferring the traffic of two network namespaces. For each Pod corresponding to each service in the node and the network management Pod, a Veth Pair device can be set, one end of which can be set in the Pod and the other end of which can be set in the bridge. The data output by the Veth interface of the first Pod can be transmitted to the bridge and then sent to the Veth interface of the network management Pod by the bridge; the data output by the Veth interface of the network management Pod can be transmitted to the bridge and then forwarded to the Veth interface of the second Pod by the bridge. By using the bridge connection mode, the connection between complex network devices can be better implemented, and the accuracy of data transmission and the network transmission performance are ensured.

[0179] It should be noted that the communication between the Pod corresponding to each target service in the node and the network management Pod can also be implemented by other modes, and is not limited to the mode of setting the Veth Pair device.

[0180] In some embodiments, the network management Pod can send the target data to the second service container based on the network management strategy.

[0181] After the traffic corresponding to each service container in the node is aggregated to the network management Pod, the network management Pod can manage the traffic of each service container based on the network management strategy.

[0182] Exemplarily, the network management strategy can include adjusting the data transmission rate based on the load of the Pod. The network management Pod can obtain the load of the Pod corresponding to each service, and control the speed of transmitting data to the service container of each service according to the load of the Pod corresponding to each service. The load of the Pod can be resource usage, such as CPU (Central Processing Unit) usage, memory usage, etc. The network management Pod controls the speed of transmitting data to the second Pod. If the load of the second Pod is large (for example, the resource usage is high), the speed of transmitting data to the second Pod can be reduced; if the load of the second Pod is small (for example, the resource usage is small), the speed of transmitting data to the second Pod can be increased, which can better balance the load of the second Pod.

[0183] Exemplarily, the network management strategy can include limiting unauthorized access traffic. After the network management Pod obtains the target data, it can determine whether the first Pod sending the target data has access permission to the second Pod. If the first Pod does not have the access permission, the data can not be forwarded to the second Pod, thereby improving the security.

[0184] It should be noted that the network management strategy is not limited to the above-mentioned several strategies, and other strategies can also be used, which are not limited herein.

[0185] The network management Pod can manage the traffic of each service container based on the network management strategy, dynamically adjust the network traffic and optimize the traffic, and improve the overall network performance.

[0186] In the embodiments of the present application, the network management Pod is deployed in each node in the service mesh system, and the network management Pods in different nodes can realize cross-node communication. The service containers of the Pods running in each node in the service mesh system can be aggregated to the network management Pod deployed in each node for management, which optimizes the traffic transmission path and improves the management efficiency of network traffic.

[0187] In some embodiments, a service mesh system is provided, which includes a first Pod, a network management Pod and a second Pod, the first Pod includes a first service container, the second Pod includes a second service container, and the first Pod and the network management Pod run in the same node; wherein the first Pod and the network management Pod are connected through BGP communication, and the network management Pod and the second Pod are connected through BGP communication.

[0188] The first service container is configured to send target data to the network management Pod, and the target data is data that the first service container needs to send to the second service container.

[0189] The network management Pod is configured to send the target data to the second service container after obtaining the target data sent by the first service container.

[0190] In some embodiments, the first service container is further configured to send the target data to the network management Pod based on a first redirection rule, the first redirection rule being configured to instruct the first service container to send data sent to the second service container to the network management Pod.

[0191] The network management Pod is further configured to send the target data to the second service container based on a second redirection rule after obtaining the target data sent by the first service container, the second redirection rule being configured to instruct the network management Pod to send data received and sent to the second service container to the second service container.

[0192] In some embodiments, the network management Pod is further configured to load the target program according to a traffic event corresponding to the first Pod and configure the second redirection rule through the target program in a case where the first Pod is added to the service mesh system, the traffic event including Pod information corresponding to the first Pod and Pod information of other Pods communicating with the first Pod.

[0193] In some embodiments, the first Pod is further configured to load the target program in the shared data volume and configure the first redirection rule through the target program in a case where the first Pod is added to the service mesh system.

[0194] In some embodiments, the network management Pod is further configured to store the second redirection rule in a global forwarding information base (FIB).

[0195] In some embodiments, the first Pod and the network management Pod run on a first node, and the second Pod runs on a second node, the first node being different from the second node.

[0196] The network management Pod of the first node is further configured to send the target data to the network management Pod of the second node.

[0197] The network management Pod of the second node is further configured to send the target data to the second service container after obtaining the target data sent by the network management Pod of the first node.

[0198] In some embodiments, the network management Pod of the second node is further configured to send the target data to the second service container based on a third redirection rule after obtaining the target data sent by the network management Pod of the first node, the third redirection rule being configured to instruct the network management Pod of the second node to send data received and sent to the second service container of the same node to the second service container.

[0199] In this embodiment, the service mesh system can manage traffic between service containers in different Pods through a network management Pod running within each node. This optimizes data transmission paths, reduces the number of hops in the network, and improves network traffic management efficiency. Furthermore, by aggregating the inbound and outbound traffic of service containers from each Pod to the network management Pod and managing traffic through it, a global network management model is adopted. This eliminates the need to deploy a sidecar agent in each Pod to manage service container traffic, thus reducing the resource overhead of network management.

[0200] like Figure 8 As shown, in one embodiment, a service communication device 800 is provided, which can be applied to the service mesh system described above. The service communication device 800 may include a first sending module 810 and a second sending module 820.

[0201] The first sending module 810 is used to send target data to the network management Pod using the first service container based on the first redirection rule. The target data is the data that the first service container needs to send to the second service container. The first redirection rule is used to instruct the data that the first service container is supposed to send to the second service container to be sent to the network management Pod.

[0202] The second sending module 820 is used to send the target data sent by the first service container to the second service container after the network management Pod obtains the target data. The second redirection rule is used to instruct the network management Pod to send the data received to the second service container back to the second service container.

[0203] In some embodiments, the service communication device 800 further includes a rule configuration module.

[0204] The rule configuration module is used to load the target application based on the traffic events of the first Pod when the first Pod is added to the service mesh system, and to configure the second redirection rule through the target application. The traffic events include the Pod information corresponding to the first Pod and the Pod information of other Pods communicating with the first Pod.

[0205] In some embodiments, the rule configuration module is further configured to, when the first Pod is added to the service mesh system, use the first Pod to load the target program in the shared data volume, and configure the first redirection rule through the target program.

[0206] In some embodiments, the service communication device 800 further includes a storage module.

[0207] The storage module is configured to store the second redirection rule into a global forwarding information base (FIB) by using the network management pod.

[0208] In some embodiments, the first pod, the network management pod and the second pod run on the same node, the first redirection rule is used to instruct the first service container to send data sent to the second service container belonging to the same node to the network management pod.

[0209] The second redirection rule is used to instruct the network management pod to send the received data sent to the second service container of the same node to the second service container.

[0210] In some embodiments, the first pod and the network management pod run on the first node, and the second pod runs on the second node, the first node being different from the second node; the first redirection rule is used to instruct the first pod to send data sent to the second service container of the different node to the network management pod, and the second redirection rule is used to instruct the network management pod of the first node to send the received data sent to the second service container of the different node to the network management pod of the second node.

[0211] The second sending module 820 is further configured to send the target data to the network management pod of the second node based on the second redirection rule by using the network management pod of the first node; after the network management pod of the second node obtains the target data sent by the network management pod of the first node, the network management pod of the second node sends the target data to the second service container based on the third redirection rule, the third redirection rule being used to instruct the network management pod of the second node to send data sent to the second service container of the same node to the second service container.

[0212] In the embodiments of the present application, the service mesh system can manage the traffic between the service containers in different pods through the network management pods running in each node, which can optimize the transmission path of data, reduce the hop count of data in the network, and improve the management efficiency of network traffic. Moreover, the egress and ingress traffic of the service containers of each pod is uniformly collected to the network management pod, and the traffic management is performed through the network management pod, a global network management mode is adopted, and there is no need to deploy a Sidecar proxy in each pod to manage the traffic of the service containers, which can reduce the resource overhead of network management.

[0213] Figure 9 is a structural block diagram of a computing device in one embodiment. As Figure 9As shown, the computing device 900 can include one or more of the following components: a processor 910, a memory 920 coupled with the processor 910, wherein the memory 920 can store one or more computer programs which can be configured to implement the methods described in the above embodiments when executed by the one or more processors 910.

[0214] The processor 910 can include one or more processing cores. The processor 910 connects various parts within the entire computing device 900 by running or executing instructions, programs, code sets or instruction sets stored in the memory 920, and calling data stored in the memory 920, to perform various functions and process data of the computing device 900. Optionally, the processor 910 can be implemented in at least one of a hardware form of a digital signal processing (DSP), a field-programmable gate array (FPGA), a programmable logic array (PLA). The processor 910 can integrate a combination of one or more of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU is mainly used to process operating systems, user interfaces, and application programs; the GPU is used to render and draw display content; and the modem is used to process wireless communication. It can be understood that the above-mentioned modem can also not be integrated into the processor 910, but can be implemented by a separate communication chip.

[0215] The memory 920 can include a random access memory (RAM) and can also include a read-only memory (ROM). The memory 920 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 920 can include a program storage area and a data storage area, wherein the program storage area can store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playing function, an image playing function, etc.), instructions for implementing the above-mentioned various method embodiments, etc. The data storage area can also store data created by the computing device 900 in use, etc.

[0216] It can be understood that the computing device 900 can include more or less structural elements than those in the above structural block diagram, for example, including a radio frequency module, a power module, a physical button, a WiFi (Wireless Fidelity) module, a speaker, a Bluetooth module, a sensor, etc., which are not limited herein.

[0217] The embodiments of the present application disclose a computer readable storage medium storing a computer program, wherein the computer program is executed by a processor to implement the method described in the above embodiments.

[0218] The embodiments of the present application disclose a computer program product, which comprises a non-transitory computer readable storage medium storing a computer program, and the computer program is executable by a processor to implement the method described in the above embodiments.

[0219] A person of ordinary skill in the art can understand that all or part of the above-mentioned embodiment methods can be completed by a computer program instructing related hardware, and the program can be stored in a non-volatile computer readable storage medium. When the program is executed, it can include the processes of the above-mentioned embodiments. The storage medium can be a magnetic disc, an optical disc, a ROM, etc.

[0220] As used herein, any reference to memory, storage, a database or other medium can include non-volatile and / or volatile storage. Suitable non-volatile storage can include ROM, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), or flash memory. Volatile storage can include random access memory (RAM), which acts as external cache. By way of illustration and not limitation, RAM can be SRAM, DRAM, synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), Rambus DRAM (RDRAM), direct Rambus dynamic RAM (DRDRAM), and / or other volatile storage devices.

[0221] It is to be understood that the terminology "one embodiment" or "an embodiment" used throughout this specification can denote a particular feature, structure, or characteristic included in at least one embodiment of the application. Accordingly, the appearances of "in one embodiment" or "in an embodiment" in various places throughout this specification are not necessarily referring to the same embodiment. Furthermore, these particular features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It is also to be understood that the embodiments described herein are optional embodiments, and that the acts and modules thereof are not necessarily required by the application.

[0222] In various embodiments of the present application, it should be understood that the magnitude of the serial number of each process described above does not mean the inevitable sequence of execution order, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0223] The units described as separate parts above can or can not be physically separate, and the parts displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0224] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0225] Each technical feature of the above-described embodiments can be combined arbitrarily, and in order to make the description concise, not all possible combinations of each technical feature in the above-described embodiments are described, however, as long as the combination of the technical features does not exist, it should be considered as the scope of the present application.

[0226] The service communication method and the service mesh system disclosed in the embodiments of the present application are described in detail above, and the principle and implementation manner of the present application are described by applying specific examples. The above embodiment description is only used to help understand the method of the present application and its core idea. Meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation manner and application range will be changed. In summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A service communication method characterized by, The application is applied to a service mesh system, the service mesh system comprises a first Pod, a network management Pod and a second Pod, the first Pod comprises a first service container, the second Pod comprises a second service container, the first Pod and the network management Pod run on the same node, the node is a computing device or a virtual machine running on a computing device; the method comprises: using the first service container to send target data to the network management Pod based on a first redirection rule, the target data is data that the first service container needs to send to the second service container, the first redirection rule is used to instruct the data sent by the first service container to the second service container to be sent to the network management Pod; after the network management Pod obtains the target data sent by the first service container, using the network management Pod to send the target data to the second service container based on a second redirection rule, the second redirection rule is used to instruct the network management Pod to send the received data sent to the second service container to the second service container.

2. The method of claim 1, wherein, Before the use of the first service container based on the first redirection rule to send the target data to the network management Pod, the method further comprises: in the case of joining the first Pod to the service mesh system, using the network management Pod to load a target program according to the traffic event of the first Pod, and configuring the second redirection rule through the target program, the traffic event comprises the Pod information corresponding to the first Pod and the Pod information of other Pods communicating with the first Pod.

3. The method of claim 2, wherein, Before the use of the first service container based on the first redirection rule to send the target data to the network management Pod, the method further comprises: in the case of joining the first Pod to the service mesh system, using the first Pod to load the target program in the shared data volume, and configuring the first redirection rule through the target program.

4. The method of claim 3, wherein, After the target program is configured to correspond to the redirection rule of the first Pod and the redirection rule of the network management Pod, the method further comprises: using the network management Pod to store the second redirection rule into a global forwarding information base (FIB).

5. The method according to any one of claims 1 to 4, characterized in that, The first Pod, the network management Pod and the second Pod run on the same node, the first redirection rule is used to instruct the first service container to send the data sent to the second service container belonging to the same node to the network management Pod; the second redirection rule is used to instruct the network management Pod to send the received data sent to the second service container belonging to the same node to the second service container.

6. The method according to any one of claims 1 to 4, characterized in that, The first Pod and the network management Pod run on a first node, the second Pod runs on a second node, the first node is different from the second node; the first redirection rule is used to instruct the first Pod to send data sent to a second service container belonging to a different node to the network management Pod, and the second redirection rule is used to instruct the network management Pod of the first node to send data received and sent to a second service container of a different node to the network management Pod of the second node; The network management Pod sends the target data to the second service container based on the second redirection rule, and the method comprises the following steps of: The network management Pod of the first node sends the target data to the network management Pod of the second node based on the second redirection rule; After the network management Pod of the second node obtains the target data sent by the network management Pod of the first node, the network management Pod of the second node sends the target data to the second service container based on a third redirection rule, and the third redirection rule is used to instruct the network management Pod of the second node to send data received and sent to a second service container of the same node to the second service container.

7. A service mesh system, comprising: The service mesh system comprises a first Pod, a network management Pod and a second Pod, the first Pod comprises a first service container, the second Pod comprises a second service container, and the first Pod and the network management Pod run on the same node; wherein the first Pod and the network management Pod are connected through a border gateway protocol (BGP), and the network management Pod and the second Pod are connected through the BGP. The first service container is configured to send target data to the network management Pod, and the target data is data that the first service container needs to send to the second service container. The network management Pod is configured to send the target data to the second service container after obtaining the target data sent by the first service container.

8. The service mesh system of claim 7, wherein, The first service container is further configured to send target data to the network management Pod based on a first redirection rule, and the first redirection rule is used to instruct the first service container to send data sent to the second service container to the network management Pod. The network management Pod is further configured to send the target data to the second service container based on a second redirection rule after obtaining the target data sent by the first service container, and the second redirection rule is used to instruct the network management Pod to send data received and sent to the second service container to the second service container.

9. The service mesh system of claim 8, wherein, The network management Pod is further configured to load a target program according to a traffic event corresponding to the first Pod and configure the second redirection rule through the target program in a case where the first Pod is added to the service mesh system; the traffic event includes Pod information corresponding to the first Pod and Pod information of other Pods that communicate with the first Pod.

10. The service mesh system of claim 9, wherein, In a case where the first Pod is added to the service mesh system, the first Pod is further configured to load the target program in a shared data volume and configure the first redirection rule through the target program.

11. The service mesh system of claim 9, wherein, The network management Pod is further configured to store the second redirection rule in a global forwarding information base (FIB).

12. The service mesh system of claim 7, wherein, The first Pod and the network management Pod run on a first node, and the second Pod runs on a second node, the first node being different from the second node. The network management Pod of the first node is further configured to send the target data to the network management Pod of the second node. The network management Pod of the second node is further configured to send the target data to the second service container after obtaining the target data sent by the network management Pod of the first node.

13. The service mesh system of claim 12, wherein, The network management Pod of the second node is further configured to send the target data to the second service container based on a third redirection rule after obtaining the target data sent by the network management Pod of the first node, the third redirection rule being used to instruct the network management Pod of the second node to send data received and sent to the second service container of the same node to the second service container.

Images