Distributed load balancing management method, system and electronic device based on multi-tenancy

Abstract

The present disclosure relates to the technical field of distributed system management and load balancing, and specifically to a distributed load balancing management method, system and electronic device based on multi-tenants. The system includes: an account management module, an SLB management module, a security management module and a forwarding engine management module. The account management module creates tenants, roles and users according to the business management classification information input by the user. The security management module generates security policies and certificates associated with the tenants according to the policy certificate information input by the user. The forwarding engine management module allows the user to configure and create forwarding engines and forwarding engine clusters associated with tenants. The SLB management module generates virtual services for tenants based on the server pool configuration input by the user, combined with the forwarding engine, security policy and certificate. Thus, through modular design and the introduction of a multi-tenant mechanism, efficient, flexible and fine-grained management of the distributed load balancing system is achieved, meeting the needs of complex business scenarios.

Description

Technical Field

[0001] The present disclosure relates to the technical field of distributed system management and load balancing, and in particular to a distributed load balancing management method, system and electronic device based on multi-tenancy. Background Art

[0002] In the traditional load balancing architecture, the management plane is tightly coupled with the data plane. This design is applicable in the dual-machine active-standby working mode, especially in environments with a small number of users and low system complexity. In this environment, professional operation and maintenance personnel, as system administrators, can achieve basic authority management and operation control through clear role division and functional boundaries.

[0003] However, with the development of technology and the increasing complexity of business needs, this simple role allocation model can no longer meet the needs of large-scale distributed load balancing systems, and it is increasingly difficult to control costs. First, the intensification of market competition has prompted enterprises to pursue more sophisticated user experience in the blue ocean market to meet users' high standards for personalized services, which has led to the rapid iteration and deployment of various applications, thereby increasing the complexity and labor costs of system management; second, as the system architecture changes from tight coupling to decoupling modes such as microservices, developers can unleash their creativity and achieve independent and rapid iteration of application components, significantly improving the release frequency, but at the same time, it also puts forward higher requirements for the flexibility and automation of the load balancing system, otherwise it will be difficult to reduce the additional IT costs brought about by this; third, the diversified market demands brought about by globalization require enterprises to be able to customize the delivery of applications to adapt to the specific preferences of users in different regions, which further increases the complexity of system configuration and the labor costs of operation and maintenance. Finally, the use of innovative technologies such as low-code platforms, cloud native technologies, and artificial intelligence has greatly reduced the development threshold and improved development efficiency, but how to effectively integrate these technologies into the load balancing system to achieve automated management and intelligent scheduling, thereby reducing IT costs and labor costs, has become a new challenge.

[0004] In summary, the traditional load balancing system based on functions, roles, and users cannot meet the needs of large-scale distributed load balancing systems. This is mainly due to the following reasons:

[0005] 1. Lack of flexibility and high cost. Traditional load balancing systems usually preset fixed roles and functional divisions. This static design is difficult to adapt to rapidly changing business needs and evolving technical environments. In ultra-large clusters and complex business scenarios, fixed roles and functions often cannot cover all fine-grained permission requirements, resulting in overly extensive or insufficient permission management. At the same time, a large amount of manpower is required for manual adjustment and maintenance, which increases labor costs.

[0006] 2. It is difficult to achieve unified management and fine-grained control, and the efficiency is low. In large-scale distributed systems, it is necessary to uniformly manage many business data planes, while implementing fine-grained control on each data plane. Traditional systems often cannot achieve this balance. Either management is too centralized, resulting in inefficiency and requiring more manpower for coordination; or control is too decentralized, resulting in security risks and operational confusion, increasing the maintenance cost and risk of the system.

[0007] 3. The binding of roles and permissions is too rigid, increasing the cost of collaboration. In traditional systems, the binding of roles and permissions is often rigid and difficult to dynamically adjust according to specific business scenarios. This makes permission management complicated and difficult to coordinate when cross-departmental and cross-role collaboration is required, which not only affects work efficiency, but also increases labor and time costs.

[0008] How to break through the limitations of traditional load balancing architecture, achieve efficient, flexible and fine-grained management of distributed load balancing systems, meet the needs of large-scale and complex business scenarios, and reduce IT costs and labor costs is an urgent problem to be solved. Summary of the invention

[0009] In order to solve the problems in the related art, the embodiments of the present disclosure provide a multi-tenant-based distributed load balancing management method, system and electronic device.

[0010] In a first aspect, an embodiment of the present disclosure provides a multi-tenant-based distributed load balancing management system, the system comprising: an account management module, an SLB management module, a security management module and a forwarding engine management module, the account management module comprising: a tenant management module, a role management module and a user management module, wherein:

[0011] The account management module is configured to: obtain the business management classification information input by the first user, and create a business account according to the business management classification information, including: based on the role management module, obtain the role information in the business management classification information, and create a role according to the role information; based on the tenant management module, obtain the tenant information in the business management classification information, and create a tenant according to the tenant information; based on the user management module, obtain the user information in the business management classification information, and create a user according to the user information, wherein the user information includes information of one or more tenants associated with the specified user, and information of a role uniquely corresponding to each of the one or more tenants;

[0012] The security management module is configured to: obtain the policy information and certificate information input by the second user, and generate a security policy and certificate associated with the created designated tenant according to the policy information and the certificate information respectively;

[0013] The forwarding engine management module is configured to: obtain the forwarding engine configuration parameters input by the third user, create a forwarding engine associated with the specified tenant according to the forwarding engine configuration parameters; and generate a forwarding engine cluster associated with the specified tenant according to the multiple forwarding engines that have been created;

[0014] The SLB management module is configured to: obtain the server pool configuration parameters input by the fourth user, and create a server pool according to the server pool configuration parameters; generate a virtual service uniquely belonging to the designated tenant according to the designated forwarding engine cluster or the designated forwarding engine associated with the designated tenant, as well as the server pool, the security policy and the certificate, so as to perform one or more business operations and management in the system based on the designated tenant.

[0015] According to an embodiment of the present disclosure, the system further includes: a monitoring and alarm module, wherein the monitoring and alarm module is configured to:

[0016] Acquire the monitoring and alarm strategy configuration parameters input by the fifth user, and generate the monitoring and alarm strategy according to the monitoring and alarm strategy configuration parameters; the monitoring and alarm strategy includes: a monitoring strategy and an alarm strategy;

[0017] Based on the monitoring strategy, collect monitoring data of the forwarding engines in one or more forwarding engine clusters in the system, and perform structured processing and display of the collected monitoring data according to business logic;

[0018] It is determined whether the system is in an abnormal mode based on the monitored network traffic and business performance parameters. If the system is in an abnormal mode, corresponding alarm data is generated and displayed based on the alarm strategy and the abnormal mode.

[0019] According to an embodiment of the present disclosure, the monitoring data includes: CPU usage, and the monitoring and alarm module is further configured to:

[0020] Obtaining CPU usage of forwarding engines in one or more forwarding engine clusters in the system within a preset time period;

[0021] The obtained CPU usage of each forwarding engine is judged. If the CPU usage exceeds a first preset threshold, then:

[0022] Obtain a resource consumption indicator of a virtual service on a forwarding engine corresponding to a CPU usage exceeding the first preset threshold, and judge the obtained resource consumption indicator; if the resource consumption indicator exceeds a second preset threshold, then: expand the capacity of the virtual service corresponding to the resource consumption indicator exceeding the second preset threshold, and the expansion includes: increasing computing resources by modifying the configuration of the virtual service, and / or distributing the load by increasing the number of forwarding engines or virtual services; if the resource consumption indicator does not exceed the second preset threshold, then: migrate a preset number of virtual services on the forwarding engine corresponding to the CPU usage exceeding the first preset threshold according to preset rules, and the migration includes: migrating the preset number of virtual services out of the corresponding forwarding engine, and migrating them to an idle forwarding engine or a newly added forwarding engine in the forwarding engine cluster to which they belong;

[0023] If the CPU usage is lower than a third preset threshold, then: the forwarding engines corresponding to the CPU usage lower than the third preset threshold are scaled down, and the scaling down includes: reducing the number of forwarding engines in the forwarding engine cluster.

[0024] According to an embodiment of the present disclosure, the first user, the second user, the third user, the fourth user and the fifth user are all associated with the designated tenant and correspond to designated roles, the roles include: a first role, a second role, a third role, a fourth role and a fifth role, the first role is a system administrator, the second role is a security administrator, the third role is a tenant administrator, the fourth role is an application administrator, and the fifth role is an application operation and maintenance administrator, the first user, the second user, the third user, the fourth user and the fifth user are all associated with the designated tenant and correspond to designated roles, including:

[0025] The first user, the second user, the third user, the fourth user and the fifth user all correspond to the first role; or,

[0026] The first user corresponds to the first role, the second user corresponds to the second role, the third user corresponds to the third role, the fourth user corresponds to the third role or the fourth role, and the fifth user corresponds to the fifth role; or

[0027] The first user corresponds to the first role, the second user and the third user both correspond to the third role, the fourth user corresponds to the third role or the fourth role, and the fifth user corresponds to the fifth role.

[0028] According to an embodiment of the present disclosure,

[0029] When the second user corresponds to the first role or the second role, the security policy and certificate associated with the created designated tenant are also associated with other created tenants except the designated tenant;

[0030] When the second user corresponds to the third role, the security policy and the certificate are only associated with the designated tenant, and are not associated with other tenants except the designated tenant.

[0031] According to an embodiment of the present disclosure, the tenant is bound to a specified cloud infrastructure resource or to a specified organizational structure. When the tenant is bound to a specified cloud infrastructure resource, creating a forwarding engine associated with the specified tenant according to the forwarding engine configuration parameters includes:

[0032] Creating a forwarding engine associated with the designated tenant on a cloud platform corresponding to the cloud infrastructure resource according to the forwarding engine configuration parameters;

[0033] When the forwarding engine group is shared by multiple designated tenants, the forwarding engine management module is further configured to: configure an independent virtual routing VRF instance for each of the multiple designated tenants on the forwarding engine group to isolate traffic between the multiple designated tenants.

[0034] According to an embodiment of the present disclosure, the tenant information includes: whether to share a forwarding engine cluster tag. Among the multiple tenants that have been created, if the whether to share a forwarding engine cluster tag in the tenant information of the multiple tenants indicates a shared forwarding engine cluster, then one or more specified forwarding engine clusters are shared between the multiple tenants; if the whether to share a forwarding engine cluster tag in the tenant information of the multiple tenants indicates that the forwarding engine cluster is not shared, then the multiple tenants independently deploy their respective forwarding engine clusters.

[0035] In a second aspect, an embodiment of the present disclosure provides a multi-tenant-based distributed load balancing management method, the method being applied to a distributed load balancing management system, the method comprising:

[0036] Acquiring business management classification information input by a first user, and creating a business account according to the business management classification information, including: acquiring role information in the business management classification information, and creating a role according to the role information; acquiring tenant information in the business management classification information, and creating a tenant according to the tenant information; acquiring user information in the business management classification information, and creating a user according to the user information, wherein the user information includes information of one or more tenants associated with a specified user, and information of a role uniquely corresponding to each of the one or more tenants;

[0037] Acquire the policy information and certificate information input by the second user, and generate a security policy and certificate associated with the created designated tenant according to the policy information and the certificate information respectively;

[0038] Acquire the forwarding engine configuration parameters input by the third user, and create a forwarding engine associated with the specified tenant according to the forwarding engine configuration parameters; generate a forwarding engine cluster associated with the specified tenant according to the multiple forwarding engines that have been created;

[0039] Obtain server pool configuration parameters input by a fourth user, and create a server pool according to the server pool configuration parameters; generate a virtual service uniquely corresponding to the designated tenant according to a designated forwarding engine cluster or a designated forwarding engine associated with the designated tenant, as well as the server pool, the security policy and the certificate, so as to perform various business operations and management in the system based on the designated tenant.

[0040] According to an embodiment of the present disclosure, the method further includes:

[0041] Acquire the monitoring and alarm strategy configuration parameters input by the fifth user, and generate the monitoring and alarm strategy according to the monitoring and alarm strategy configuration parameters; the monitoring and alarm strategy includes: a monitoring strategy and an alarm strategy;

[0042] Based on the monitoring strategy, collect monitoring data of the forwarding engines in one or more forwarding engine clusters in the system, and perform structured processing and display of the collected monitoring data according to business logic;

[0043] It is determined whether the system is in an abnormal mode based on the monitored network traffic and business performance parameters. If the system is in an abnormal mode, corresponding alarm data is generated and displayed based on the alarm strategy and the abnormal mode.

[0044] According to an embodiment of the present disclosure, the monitoring data includes: CPU usage, and the method further includes:

[0045] Obtaining CPU usage of forwarding engines in one or more forwarding engine clusters in the system within a preset time period;

[0046] The obtained CPU usage of each forwarding engine is judged. If the CPU usage exceeds a first preset threshold, then:

[0047] Obtain a resource consumption indicator of a virtual service on a forwarding engine corresponding to a CPU usage exceeding the first preset threshold, and judge the obtained resource consumption indicator; if the resource consumption indicator exceeds a second preset threshold, then: expand the capacity of the virtual service corresponding to the resource consumption indicator exceeding the second preset threshold, and the expansion includes: increasing computing resources by modifying the configuration of the virtual service, and / or distributing the load by increasing the number of forwarding engines or virtual services; if the resource consumption indicator does not exceed the second preset threshold, then: migrate a preset number of virtual services on the forwarding engine corresponding to the CPU usage exceeding the first preset threshold according to preset rules, and the migration includes: migrating the preset number of virtual services out of the corresponding forwarding engine, and migrating them to an idle forwarding engine or a newly added forwarding engine in the forwarding engine cluster to which they belong;

[0048] If the CPU usage is lower than a third preset threshold, then: the forwarding engines corresponding to the CPU usage lower than the third preset threshold are scaled down, and the scaling down includes: reducing the number of forwarding engines in the forwarding engine cluster.

[0049] The tenant is bound to a specified cloud infrastructure resource or to a specified organizational structure. When the tenant is bound to a specified cloud infrastructure resource, creating a forwarding engine associated with the specified tenant according to the forwarding engine configuration parameters includes:

[0050] Creating a forwarding engine associated with the designated tenant on a cloud platform corresponding to the cloud infrastructure resource according to the forwarding engine configuration parameters;

[0051] When the forwarding engine group is shared by multiple designated tenants, an independent virtual routing VRF instance is configured on the forwarding engine group for each of the multiple designated tenants to isolate traffic between the multiple designated tenants.

[0052] In a third aspect, an embodiment of the present disclosure provides an electronic device, comprising a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement any method described in the second aspect.

[0053] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium on which computer instructions are stored. When the computer instructions are executed by a processor, the method described in any one of the second aspects is implemented.

[0054] In a fifth aspect, a computer program product is provided in an embodiment of the present disclosure, including a computer program, and when the computer program is executed by a processor, the method described in any one of the second aspects is implemented.

[0055] According to the technical solution provided in the embodiment of the present disclosure, a multi-tenant distributed load balancing management system is proposed. The system includes: an account management module, an SLB management module, a security management module and a forwarding engine management module. This modular design makes the functions of each part of the system clear, facilitates independent development and maintenance, and improves management efficiency.

[0056] Specifically, the account management module is responsible for dynamically creating tenants, roles, and users based on the business management classification information input by the user, thereby realizing fine-grained management of business accounts. This multi-level account system allows the system to create customized accounts for different tenants, roles, and users, meeting the management needs of users of different levels and types in large-scale and complex business scenarios, thereby realizing precise control of permissions and resources. In addition, user information includes information about one or more tenants associated with the specified user, as well as information about the role uniquely corresponding to each tenant. This design enables users to perform flexible business operations and management based on different tenants and roles, thereby improving the flexibility of the system.

[0057] The security management module generates security policies and certificates associated with tenants based on the policy certificate information entered by the user, allowing each tenant to customize security policies according to their own needs. This fine-grained security control ensures the security of each tenant's data and business operations.

[0058] The forwarding engine management module allows users to configure and create forwarding engines and clusters associated with tenants, supporting flexible business deployment. This flexibility enables the system to dynamically adjust the configuration and performance of the forwarding engine according to actual needs. In addition, fine-grained forwarding control enables the system to perform precise traffic distribution and load balancing according to the specific needs of tenants.

[0059] The SLB management module generates virtual services for tenants based on the server pool configuration input by the user, combined with the forwarding engine, security policy and certificate, to achieve personalized customization of business operations. On the one hand, the design of virtual services enables the system to provide independent and customized load balancing services to different tenants in large-scale and complex business scenarios. In addition, the unique ownership and configurability of virtual services enable the system to easily cope with business growth and changes, and meet the dynamic needs in large-scale and complex business scenarios. On the other hand, this personalized customization capability enables each tenant to perform independent business operations and management in the system according to their own business needs.

[0060] In addition, each module of the system supports automated creation and management based on configuration parameters input by the user, reducing the cost of human intervention and manual configuration. Moreover, centralized account management, security management, forwarding engine management, and SLB management enable each system user to perform all management and operations on a unified platform, reducing the complexity and cost of IT management.

[0061] Therefore, the present disclosure achieves efficient, flexible and fine-grained management of the distributed load balancing system through modular design and the introduction of a multi-tenant mechanism, meets the needs of large-scale and complex business scenarios, and reduces IT costs and labor costs.

[0062] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Other features, objectives and advantages of the present disclosure will become more apparent through the following detailed description of non-limiting embodiments in conjunction with the accompanying drawings. In the accompanying drawings:

[0064] Figure 1 A structural block diagram of a multi-tenant distributed load balancing management system according to an embodiment of the present disclosure is shown.

[0065] Figure 2 A structural block diagram of another multi-tenant-based distributed load balancing management system according to an embodiment of the present disclosure is shown.

[0066] Figure 3 A schematic diagram of a multi-level account management structure according to an embodiment of the present disclosure is shown.

[0067] Figure 4 A flow chart of a method for using expansion, reduction and migration strategies of elastic virtual services according to an embodiment of the present disclosure is shown.

[0068] Figure 5 A flow chart of a multi-tenant-based distributed load balancing management method according to an embodiment of the present disclosure is shown.

[0069] Figure 6 A flow chart of another multi-tenant-based distributed load balancing management method according to an embodiment of the present disclosure is shown.

[0070] Figure 7 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0071] Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement them. In addition, for the sake of clarity, parts not related to the description of the exemplary embodiments are omitted in the accompanying drawings.

[0072] In the present disclosure, it should be understood that terms such as "include" or "have" are intended to indicate the presence of features, numbers, steps, behaviors, components, parts, or a combination thereof disclosed in the present specification, and are not intended to exclude the possibility that one or more other features, numbers, steps, behaviors, components, parts, or a combination thereof exist or are added.

[0073] It should also be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other. The present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0074] As mentioned above, due to some inherent characteristics and factors of the traditional load balancing system, the traditional load balancing system based on functions, roles, and users can no longer meet the needs of large-scale distributed load balancing systems.

[0075] In order to break through the limitations of traditional load balancing architecture, achieve efficient, flexible and fine-grained management of distributed load balancing systems, meet the needs of large-scale complex business scenarios, and reduce IT costs and labor costs, the inventors of the present invention, after repeated demonstrations and careful research, combined with modular design ideas and the introduction of multi-tenant mechanisms, proposed a distributed load balancing management system based on multi-tenants, specifically dividing the distributed load balancing management system into multiple independent modules, including an account management module, an SLB management module, a security management module and a forwarding engine management module.

[0076] Through modular design, each module can be independently developed, tested and maintained, which improves the maintainability and scalability of the system and reduces IT maintenance costs. In addition, loose coupling is adopted between modules to reduce the dependencies between modules, making the system more flexible and able to adapt more easily to changes in business needs and technical environment.

[0077] The introduction of the multi-tenant mechanism enables the system to support a multi-tenant environment. On the one hand, it allows the creation of multiple independent tenant environments in a single physical or logical system. Each tenant has its own independent resources, data, and configuration. In this way, the system can be easily expanded to support new tenants without making major changes to the existing structure. At the same time, the resources and data between tenants are isolated from each other. This isolation not only improves the security and flexibility of the system, but also prevents data leakage and interference between different tenants, meeting the high requirements of enterprises for data security. On the other hand, the multi-tenant mechanism enables the system to easily respond to the business needs and changes of different tenants. Each tenant can configure and manage its own resources and services according to its own needs. As the business develops, new tenants can easily It can be added to the system without large-scale modification or reconstruction of the system, which improves the scalability and flexibility of the system. In addition, in the tenant-based management model, since resources (such as servers, storage, etc.) are dynamically allocated according to the needs of tenants, this avoids resource waste and improves resource utilization. In addition, through the multi-tenant mechanism, the system can perform fine-grained management of each tenant, including role allocation, permission control, resource allocation, etc., to meet the refined management needs in large-scale and complex business scenarios. This fine-grained management not only improves management efficiency, but also reduces management costs. The system can allocate and optimize resources according to the needs and configurations of tenants, reducing the workload of manual intervention and manual adjustment, thereby reducing IT costs and labor costs.

[0078] Figure 1 FIG. 1 shows a structural block diagram of a distributed load balancing management system based on multiple tenants according to an embodiment of the present disclosure. Figure 1 As shown, the distributed load balancing management system 100 includes: an account management module, an SLB management module, a security management module and a forwarding engine management module, and the account management module includes: a tenant management module, a role management module and a user management module. Among them:

[0079] The account management module is configured to: obtain business management classification information input by the first user, and create a business account according to the business management classification information, including: based on the role management module, obtaining role information in the business management classification information, and creating a role according to the role information; based on the tenant management module, obtaining tenant information in the business management classification information, and creating a tenant according to the tenant information; based on the user management module, obtaining user information in the business management classification information, and creating a user according to the user information, wherein the user information includes information of one or more tenants associated with the specified user, and information of a role uniquely corresponding to each of the one or more tenants.

[0080] The security management module is configured to: obtain the policy information and certificate information input by the second user, and generate a security policy and certificate associated with the created designated tenant according to the policy information and the certificate information respectively.

[0081] The forwarding engine management module is configured to: obtain forwarding engine configuration parameters input by a third user, create a forwarding engine associated with the specified tenant according to the forwarding engine configuration parameters; and generate a forwarding engine cluster associated with the specified tenant according to the multiple forwarding engines that have been created.

[0082] The SLB management module is configured to: obtain the server pool configuration parameters input by the fourth user, and create a server pool according to the server pool configuration parameters; generate a virtual service uniquely belonging to the designated tenant according to the designated forwarding engine cluster or the designated forwarding engine associated with the designated tenant, as well as the server pool, the security policy and the certificate, so as to perform one or more business operations and management in the system based on the designated tenant.

[0083] Figure 2 FIG. 2 shows a structural block diagram of another multi-tenant-based distributed load balancing management system according to an embodiment of the present disclosure. Figure 2 As shown, the distributed load balancing management system 200 includes, in addition to the account management module, the SLB management module, the security management module and the forwarding engine management module, a monitoring and alarm module, wherein:

[0084] The monitoring and alarm module is configured to: obtain the monitoring and alarm policy configuration parameters input by the fifth user, and generate a monitoring and alarm policy according to the monitoring and alarm policy configuration parameters; the monitoring and alarm policy includes: a monitoring policy and an alarm policy; based on the monitoring policy, collect monitoring data of the forwarding engines in one or more forwarding engine clusters in the system, and perform structured processing and display of the collected monitoring data according to business logic; determine whether the system is in an abnormal mode based on the monitored network traffic and business performance parameters, and if in an abnormal mode, generate and display corresponding alarm data based on the alarm policy and the abnormal mode.

[0085] The following describes in detail the account management module, SLB management module, security management module, forwarding engine management module and monitoring and alarm module in the multi-tenant distributed load balancing management system.

[0086] For the Account Management module:

[0087] Figure 3 A schematic diagram of a multi-level account management structure according to an embodiment of the present disclosure is shown. Figure 3As shown, the present disclosure provides a multi-level account management structure, in which the concepts of users, roles and tenants are introduced.

[0088] The user in this disclosure is the direct operator or user of the system, which can be a customer or a business person of a department, for example: Figure 3 User A in the figure is a platform operation and maintenance manager in the operation and maintenance / network department, and user C is a business person in the application group 1 of the development department. By opening the system to business people, they can directly use load balancing resources to solve specific problems based on understanding business needs, which greatly improves the speed of application delivery and the efficiency of troubleshooting. Each user has a unique identifier (such as a user name or user ID), and the authentication information (such as a password or biometric data) and permissions associated with it. Permissions are usually determined by the role and tenant to which the user belongs. Users log in to the system to access and use the functions and services provided by the system.

[0089] The role in this disclosure is an abstract representation of a responsibility or function that a user undertakes in the system. It defines a set of permissions and limits the functions that a user can perform. These permissions determine which operations a user can perform and which resources a user can access. The role is the core of permission management. Each role has its own specific permission set. By assigning different roles to users, fine-grained control and management of user permissions can be achieved. In a specific example, Figure 3 As shown, the present disclosure provides five roles according to the module structure of the load balancing management system: the first role, the second role, the third role, the fourth role and the fifth role, wherein the first role is the system administrator, the second role is the security administrator, the third role is the tenant administrator, the fourth role is the application administrator, and the fifth role is the application operation and maintenance administrator. The system administrator and the security administrator are related to the system functions, while the tenant administrator, the application administrator and the application operation and maintenance administrator directly correspond to the tenants in the system. In the specific implementation, in addition to these five roles, other corresponding roles can also be set according to the implementation requirements of the system.

[0090] The tenant in this disclosure is an abstract representation of different organizations or business units at the management level, which is used to isolate management contexts and resources. In a distributed load balancing management system, a tenant can represent a department, a project team, a customer, or a business partner, etc. Each tenant has its own users, roles, and resources. The resources contained in the tenant can be isolated between tenants, or some resources can be shared while others are isolated. The resource isolation mechanism is used to ensure data security and privacy, while the resource sharing mechanism is used to improve resource utilization efficiency. For example: Figure 3As shown, the system contains three tenants, among which some resources of Tenant 1 and Tenant 2 (such as certificates on the management level and forwarding engine clusters on the data level) are shared, other resources (such as virtual services, server pools, and policies) are isolated, and Tenant 3 is completely isolated from Tenant 1 and Tenant 2.

[0091] The relationship between users, roles and tenants can be: a designated user can correspond to one or more tenants, but the designated user can only play one role in a designated tenant, that is, a user can manage multiple tenants, but can only play one role in each tenant. Figure 3 As shown, user A and user B both manage tenant 1, tenant 2, and tenant 3 at the same time. User A serves as the "system administrator" role in each tenant, while user B serves as the tenant administrator in tenant 1 and tenant 2, and as the application administrator in tenant 3. In this way, on the one hand, through the association between tenants and users, the system can more easily manage a large number of users. For example, when a new user joins a tenant, it is only necessary to assign the user a role within the tenant without reconfiguring the user rights of the entire system, which greatly simplifies the complexity of user management; on the other hand, associating a user with multiple tenants but limiting the user to only one role in each tenant has the following beneficial technical effects:

[0092] 1. Refinement and clarity of permission management. By associating users with multiple tenants but limiting users to only one role in each tenant, the system can achieve more refined permission division, ensuring that the user's responsibilities and permissions in each tenant are clear and consistent, avoiding confusion or conflict of permissions.

[0093] 2. Improve the security and controllability of the system. Since the user's role in each tenant is unique, the system can more easily track and audit the user's behavior, which helps to timely detect and prevent potential security threats or improper operations, thereby improving the overall security and controllability of the system.

[0094] 3. Enhance the flexibility and scalability of the system. The solution allows users to manage multiple tenants, which increases the flexibility of the system. Users can switch between different tenants and perform corresponding duties according to business needs. At the same time, as the business develops, the system can easily add new tenants and roles without complex permission adjustments for existing users.

[0095] 4. Promote the integration and collaboration of business and IT. By assigning users cross-tenant permissions but limiting specific roles in each tenant, this solution promotes collaboration between business and IT personnel. Business personnel can participate more directly in the management of IT resources, while IT personnel can better understand and meet business needs, thereby improving the efficiency and response speed of the overall business.

[0096] 5. Simplify user management and maintenance. Since users can only play one role in each tenant, system administrators can be more concise and efficient when performing user management and maintenance. For example, when a user resigns or changes positions, the administrator only needs to adjust the association between the user and the tenant or role, without having to modify the user permissions in each tenant one by one.

[0097] 6. Support complex multi-tenant environments. In large enterprises or cloud service providers, it is often necessary to support multiple tenants and complex permission structures. This solution provides an effective permission management solution for such complex environments by allowing users to manage multiple tenants but limiting the roles in each tenant.

[0098] When the account management module is specifically implemented, corresponding interfaces can be provided in the tenant management module, role management module and user management module respectively to obtain the corresponding information (role information, tenant information and user information) input by the first user, so that the system can create a corresponding business account according to the obtained information, and provide corresponding viewing, editing and deletion operation options in the corresponding interface to implement the corresponding account management function. Here, the first user corresponds to the first role, which is the system administrator. Since account management is directly related to the security and access control of the system, it is managed by the system administrator with the highest authority, so as to ensure that the creation, allocation and permission setting of the account are in compliance with the security policy of the system and prevent unauthorized access or operation.

[0099] Specifically, role information includes, but is not limited to, role name and role permissions. Different permission levels can be set, such as read-write permission, read-only permission, and no permission. When setting the role permissions of a specified role, the management rights involved in the system can be listed, and the corresponding permission level can be set for each management right. For example, the system administrator has read-write permissions for all management rights, the security administrator has read-write permissions only for security management, and has no permissions for other management rights (such as account management, policy management, etc.), the application administrator has read-write permissions for SLB application management, policy management, monitoring and alarm, has read-only permissions for traffic group management and deployment topology in the infrastructure, and has no permissions for account management and system management.

[0100] In addition to basic user-related information (such as user name, login password, department, etc.), user information also includes the correspondence information of tenants and roles. A user can add multiple sets of correspondence information of specified tenants and specified roles. When setting the correspondence between tenants and roles, you can do so by clicking on the created tenants and roles.

[0101] Tenant information includes but is not limited to: tenant name and tenant description information. When a tenant is created, all users associated with the tenant can be displayed in the corresponding tenant list information to facilitate viewing which users manage the tenant.

[0102] Regarding the correspondence between users and roles, according to an embodiment of the present disclosure, the first user, the second user, the third user, the fourth user, and the fifth user are all associated with the designated tenant and correspond to the designated role, including:

[0103] The first user, the second user, the third user, the fourth user and the fifth user all correspond to the first role, that is, the first user, the second user, the third user, the fourth user and the fifth user are all system administrators. In other words, the system administrator has the authority to manage all functional modules in the system, and the tenant-related resources in each functional module are created and managed by the system administrator. In this application scenario, the tenant created and configured by the system administrator is a super tenant. The super tenant has the highest level of authority in the system and can access and manage the resources of all functional modules in the system, including but not limited to account management, SLB management, security management, forwarding engine management, monitoring and alarming, etc.

[0104] Alternatively, the first user corresponds to the first role, the second user corresponds to the second role, the third user corresponds to the third role, the fourth user corresponds to the third role or the fourth role, and the fifth user corresponds to the fifth role. That is, the first user is a system administrator, the second user is a security administrator, the third user is a tenant administrator, the fourth user is a tenant administrator or an application administrator, and the fifth user is an application operation and maintenance administrator. In this application scenario, the security policy and certificate created by the second user can be used by all tenants, and the forwarding engine cluster or forwarding engine created by the third user is only used by the tenant that the third user is responsible for.

[0105] Alternatively, the first user corresponds to the first role, the second user and the third user both correspond to the third role, the fourth user corresponds to the third role or the fourth role, and the fifth user corresponds to the fifth role. That is, the first user is a system administrator, the second user and the third user are both tenant administrators (the second user and the third user are the same user), the fourth user is a tenant administrator or an application administrator, and the fifth user is an application operation and maintenance administrator. In this application scenario, the security policies and certificates of a specified tenant (which can refer to one or more specific tenants) as well as the forwarding engine and forwarding engine cluster are all created by the tenant administrator, then these security policies and certificates as well as the forwarding engine and forwarding engine cluster are only used by the tenants that the tenant administrator is responsible for.

[0106] Among them, when the second user corresponds to the first role or the second role, the security policy and certificate associated with the created designated tenant are also associated with other tenants created except the designated tenant. That is, when the security policy and certificate are created by the system administrator or security administrator, the security policy and certificate created by them are not only used by a specific tenant, but can be used by all tenants in the system. When the second user corresponds to the third role, the security policy and certificate are only associated with the designated tenant, but not with other tenants except the designated tenant. That is, when the security policy and certificate are created by the tenant administrator, the security policy and certificate created by them can only be used by the designated tenant managed by the tenant administrator, but cannot be used by other tenants except the designated tenant.

[0107] For the Security Management Module:

[0108] In a distributed load balancing management system, security management mainly involves the creation and management of policies and certificates. The management of policies and certificates is a key component to ensure the safe and efficient operation of the system.

[0109] The policies involved in this disclosure include but are not limited to: SSL policy, WAF policy, access policy, health check and distribution rules. Among them, SSL (Secure Sockets Layer) policy mainly involves data encryption, identity authentication and security configuration of communication protocols. In the load balancing system, SSL policy ensures the confidentiality and integrity of data during transmission and prevents data from being eavesdropped or tampered with. WAF (Web Application Firewall) policy is a security protection strategy designed to protect Web applications from various network attacks. WAF policy is usually deployed in combination with a load balancer. The load balancer is responsible for allocating client requests to different servers, while WAF is responsible for security detection before the request reaches the server. This combined deployment method can ensure that the security of Web applications is effectively protected while improving system performance. Access policy defines who can access which resources and how to access these resources. In a load balancing system, access policy can be refined to specific service, interface or data levels to ensure that only authorized users or systems can access specific resources.

[0110] The certificates involved in this disclosure include but are not limited to SSL certificates. SSL certificates are digital certificates used for secure communication on the Internet. They verify the identity of the server and ensure the security of data transmission. In a load balancing system, SSL certificates are the basis for establishing a secure connection.

[0111] The present disclosure authorizes users with designated roles (second users) to create and manage these policies and certificates. The designated role can be the security administrator and system administrator as described above, or the tenant administrator as described above, that is, the security administrator, system administrator, and tenant administrator have the authority to manage the security management module at the same time. Figure 3As shown, user E is a security administrator who is responsible for the policy and certificate management of three tenants (tenant 1, tenant 2 and tenant 3) at the same time. The certificates and policies uploaded by him can be used by the application administrators in the three tenants when creating virtual services. That is to say, when the security management module is managed by the security administrator and the system administrator, the policies and certificates created by the security administrator and the system administrator can be associated with all tenants in the system, then the users who use these policies and certificates corresponding to each tenant can see them in the corresponding interface; when the security management module is managed by the tenant administrator at the same time, since the tenant administrator is only responsible for the management of one or more designated tenants in the system, the policies and certificates created by the tenant administrator are only associated with the one or more designated tenants, and not with other tenants except the designated tenants. Then, only the users who use these policies and certificates corresponding to the one or more designated tenants can see them in the corresponding interface, while users of other tenants cannot see them.

[0112] The present disclosure authorizes security administrators and system administrators to uniformly create and manage policies and certificates, and at the same time combines personalized management of policies and certificates of designated tenants by tenant administrators. On the one hand, for unified management, security administrators and system administrators can uniformly plan and manage policies and certificates in the system from a global perspective to ensure that all tenants follow unified security standards and specifications, which helps to reduce potential security risks caused by inconsistent security policies between tenants and improve the security level of the entire system. At the same time, policies and certificates created and managed by security administrators and system administrators can be shared by multiple tenants, avoiding the overhead of repeatedly creating and managing the same resources. This resource sharing mechanism improves resource utilization efficiency and reduces management costs. In addition, when a security incident or failure occurs, it can respond quickly and make unified adjustments to global policies and certificates to quickly restore the security status of the system. This rapid response capability helps reduce the impact of security incidents on tenants' businesses and improves system stability and availability. On the other hand, for personalized management, tenant administrators can create and manage policies and certificates that meet their characteristics based on the specific business needs and security requirements of their respective tenants. This personalized management enables tenants to more flexibly respond to security challenges in their business environment and improve business security and competitiveness. At the same time, tenant administrators have greater autonomy and control over their respective tenants' policies and certificates, and can flexibly adjust them according to actual conditions. This enhanced autonomy helps improve tenants' satisfaction and trust in the system. In addition, the policies and certificates created by tenant administrators are only associated with the tenants they are responsible for and will not be accessed or modified by other tenants. This isolation mechanism helps protect tenants' sensitive information and business data and prevent security risks caused by operations of other tenants.

[0113] By combining unified management with personalized management, the system can maintain global security and consistency while meeting the personalized needs of tenants. This balance makes the system more flexible and scalable, able to adapt to the needs of different tenants and business scenarios. At the same time, combined management allows security administrators and tenant administrators to perform their respective duties and jointly maintain the security of the system. This division of labor and cooperation management method improves management efficiency, reduces management costs, and contributes to the long-term stable operation of the system.

[0114] When the security management module is specifically implemented, a corresponding interface can be provided in the security management module to obtain the corresponding information (policy information and certificate information) input by the second user, so that the system can generate security policies and certificates based on the information obtained. These security policies and certificates are associated with specified tenants (one, multiple or all tenants in the system), and corresponding viewing, editing and deletion operation options are provided in the corresponding interface to implement the management functions of the corresponding policies and certificates. Here, the second user can correspond to the first role, the second role, and the third role. In other words, the second user can be both a security administrator and a tenant administrator. In this case, the purpose of combining unified security management with personalized management is achieved.

[0115] Specifically, the policy information includes but is not limited to: policy name, policy template and policy configuration parameters (such as: supported SSL protocol, security suite), etc., and the certificate information includes but is not limited to: certificate name, certificate type and expiration time, etc. In the specific implementation, it can be flexibly defined according to system requirements.

[0116] For the forwarding engine management module:

[0117] The forwarding engine management module in the present disclosure is mainly responsible for creating forwarding engines and forwarding engine clusters associated with one or more specified tenants. Among them, the forwarding engine is a key component for processing tenant business traffic, and it is responsible for forwarding client requests to servers in the appropriate server pool; the forwarding engine cluster is a collection of multiple forwarding engines, which can provide higher throughput and availability, ensuring that the tenant's business can run efficiently and stably. Through the forwarding engine or forwarding engine cluster, the system can intelligently distribute requests to different servers according to factors such as the server's load and health status to achieve load balancing.

[0118] When the forwarding engine management module is specifically implemented, a corresponding interface can be provided in the forwarding engine management module to obtain the corresponding information (forwarding engine configuration parameters) input by the third user, so that the system can create a forwarding engine and a forwarding engine cluster according to the obtained information. When creating a forwarding engine, the system internally creates or configures a new forwarding engine instance according to these configuration parameters, including steps such as allocating resources for the forwarding engine, setting network configuration, and applying user credentials for access control. Finally, the system associates the newly created forwarding engine with the specified tenant so that the tenant can manage and use it. When associating a forwarding engine or a forwarding engine cluster with a specified tenant, it can be implemented according to which tenants the user who created the forwarding engine is associated with. For example: if the forwarding engine or forwarding engine cluster is created by a tenant administrator, then the forwarding engine or forwarding engine cluster can only be used by the tenant responsible for the tenant administrator; if the forwarding engine or forwarding engine cluster is created by a system administrator, then the forwarding engine or forwarding engine cluster can be shared among multiple specified tenants. When creating a forwarding engine cluster, it can be implemented by associating multiple created forwarding engines and setting the cluster network policy used by the forwarding engine cluster.

[0119] Specifically, the forwarding engine configuration parameters include, but are not limited to: forwarding engine name, communication address, and user credentials, etc. Among them, the forwarding engine name is usually an identifier or label, which is used to uniquely identify a forwarding engine in the system. It can be any string or number combination, which is convenient for users to identify and manage different forwarding engines; the communication address usually refers to the location of the forwarding engine in the network, which can be an aggregate interface, VLAN, IP address, SNAT address pool, port number, or a combination of IP and port (such as IP: port). This address is used to determine how to communicate with the forwarding engine over the network; user credentials are information used to verify user identity and permissions, including user name, password, token, etc. When creating a forwarding engine, user credentials are used to set access control to ensure that only authorized users or system components can configure or manage the forwarding engine.

[0120] The present disclosure authorizes users with designated roles to create and manage forwarding engines and forwarding engine clusters. In addition to the first role, i.e., the system administrator with the highest management authority, the designated role may also correspond only to the third role, i.e., the tenant administrator as described above. In other words, in addition to the system administrator, the forwarding engine management module in the present disclosure only opens management authority to the tenant administrator. Figure 3 As shown in the figure, user B is the tenant administrator of tenant 1 and tenant 2. He is responsible for managing the network addresses of all forwarding engines of tenant 1 and tenant 2. Therefore, the elements such as IP addresses he creates for the forwarding engines can be viewed and used by roles with corresponding permissions under these two tenants.

[0121] The present disclosure has the following beneficial technical effects by authorizing the forwarding engine management module to be managed by the tenant administrator:

[0122] 1. Enhanced tenant autonomy: Tenant administrators can directly manage the forwarding engine under their own tenants without relying on system administrators, which improves the autonomy and flexibility of tenant operations.

[0123] 2. Improve management efficiency: Tenant administrators have a better understanding of their tenants' business needs and forwarding engine configuration requirements, so they can configure and manage more quickly and accurately, improving overall management efficiency.

[0124] 3. Enhanced security: By limiting the ability of only tenant administrators to manage the forwarding engine under their own tenant, access rights can be more effectively controlled to prevent unauthorized access or modification, thereby enhancing the security of the system.

[0125] 4. Promote resource isolation: After the forwarding engine is associated with the tenant, effective resource isolation can be achieved. The forwarding engines between different tenants are independent of each other, avoiding resource confusion or conflict.

[0126] It should be noted that: in addition to being bound to a specified organizational structure, the tenants in this disclosure can also be bound to specified cloud infrastructure resources. The specified cloud infrastructure resources here can be IaaS (Infrastructure as a Service) cloud resources, including: a public cloud or OpenStack, etc. The tenant is bound to the organizational structure, which means that each tenant (usually representing an enterprise or organization) is associated with a specific organizational structure, which can be a departmental structure, business unit within the enterprise, or a certain hierarchical relationship defined by the cloud service provider. Through this binding, it can be ensured that the tenant's resources, permissions, access control, etc. are closely related to its organizational structure, thereby achieving more refined management and isolation. The tenant is bound to the specified cloud infrastructure resources, which means that in a cloud computing environment, a specific tenant (i.e., a customer or organization using cloud services) is directly associated and bound to the underlying specified cloud infrastructure resources. This binding enables the tenant to more directly and efficiently use the resources provided by the cloud infrastructure, such as computing, storage, network, etc., to meet its business needs.

[0127] According to an embodiment of the present disclosure, when the tenant is bound to a specified cloud infrastructure resource, creating a forwarding engine associated with the specified tenant according to the forwarding engine configuration parameters includes:

[0128] A forwarding engine associated with the designated tenant is created on a cloud platform corresponding to the cloud infrastructure resource according to the forwarding engine configuration parameters.

[0129] Specifically, in the cloud computing platform, each tenant is assigned a unique identifier to distinguish different tenants. When a tenant is bound to the IaaS cloud infrastructure, this identifier is associated with the resources in the cloud infrastructure (such as virtual machines, storage volumes, network devices, etc.). Through this association, the cloud platform can know which resources belong to which tenant, so as to allocate, manage and bill resources. When a tenant needs to create a new resource (such as a virtual machine, network device, etc.), the cloud platform will allocate resources to it in the corresponding IaaS cloud infrastructure according to the tenant's identifier. Similarly, when a tenant no longer needs certain resources, the cloud platform will also find and recycle these resources according to the tenant's identifier. In this process, the forwarding engine cluster (if it is exclusive to the tenant) can directly create or recycle the forwarding engine from the IaaS corresponding to the tenant, realizing rapid response and efficient utilization of resources.

[0130] When the forwarding engine group is shared by multiple designated tenants, the forwarding engine management module is also configured to: configure an independent virtual routing VRF instance for each of the multiple designated tenants on the forwarding engine group to isolate the traffic between the multiple designated tenants. That is to say, in the scenario where multiple tenants share a forwarding engine cluster, the traffic of different tenants shares the same forwarding engine cluster. In order to ensure the isolation and security of traffic between different tenants, the cloud platform will adopt virtual routing VRF (Virtual Routing and Forwarding) technology. Through VRF technology, each tenant will be assigned an independent virtual routing table to control the forwarding path of its traffic. In this way, even if multiple tenants share the same forwarding engine cluster, their traffic will not interfere with or leak each other.

[0131] The present disclosure can also realize the automation and intelligent management of resources by binding tenants with IaaS cloud infrastructure. The cloud platform can automatically adjust the resource allocation and recovery strategy according to the tenant's business needs and resource usage to meet the dynamic needs of the tenant. At the same time, the cloud platform can also provide rich monitoring and alarm functions to help tenants understand the usage and performance status of their resources in real time. This provides tenants with a better and more reliable cloud service experience. Moreover, in this way, the distributed load balancing system can not only achieve scalability at the physical resource level, but also achieve on-demand allocation at the cloud computing resource level, thereby providing enterprises with more flexible and cost-effective services. This elasticity can effectively reduce the TCO cost of an enterprise. For example, after a financial institution applied the elastic solution, it reduced the number of X86 CPU cores used for load balancing by 40%.

[0132] In addition, according to an embodiment of the present disclosure, the tenant information includes: whether to share a forwarding engine cluster mark. In this way, among the multiple tenants that have been created, if the whether to share a forwarding engine cluster mark in the tenant information of the multiple tenants indicates a shared forwarding engine cluster, then the multiple tenants share one or more specified forwarding engine clusters, thereby achieving sharing between multiple tenants at the data level. For some less core businesses, their needs can be met by sharing a large forwarding engine cluster. This sharing not only improves the efficiency of IT equipment use, but also helps to reduce static IT costs and achieve optimal resource allocation. If the whether to share a forwarding engine cluster mark in the tenant information of the multiple tenants indicates that the forwarding engine cluster is not shared, then the multiple tenants independently deploy their own forwarding engine clusters. In this way, the businesses of different tenants will not affect each other, thereby achieving isolation between multiple tenants at the data level. Figure 3 As shown, tenant 1 and tenant 2 share a forwarding engine cluster, while tenant 3 independently has its own forwarding engine cluster.

[0133] Through this tenant plus role and user management system, the distributed load balancing system in this disclosure can provide enterprises with highly flexible, secure and efficient load balancing services. Whether it is a business that requires strict isolation or a business that can share resources, you can find a solution that suits you under this system. This solution not only improves the manageability and scalability of the system, but also provides a solid technical foundation for the digital transformation and business innovation of enterprises.

[0134] For the SLB management module:

[0135] The SLB management module in the present disclosure is mainly responsible for managing the server load balancing device, including: creating a server pool used for virtual services, and virtual services that are unique to tenants, etc. In a distributed load balancing management system, tenants are the core users of the system, and they manage and use their own business resources through the system. Server pools and virtual services are both important components of tenant business resources. Tenants can create and manage their own server pools and virtual services according to their business needs, and ensure the normal operation and security of the business through functions such as load balancing and security policies provided by the system. Among them, the server pool is a collection of a group of servers that jointly handle requests or tasks from clients. The server pool is usually used to provide services with high availability and scalability. Through load balancing technology, the system can evenly distribute client requests to each server in the server pool, thereby optimizing resource utilization and improving performance. Virtual service is an abstract concept that represents a collection of a group of backend services. It is a form of high availability of business through distributed clusters, and provides a unified access interface or address to the outside world. For example: a web page under a domain name is a virtual service, and the user authentication OPENAPI within the enterprise is also a virtual service. A virtual service will expose one (or more) IP addresses and ports to the outside, but in fact it may be a cluster consisting of many machines providing services at the same time. In a distributed load balancing management system, a virtual service is associated with a specific tenant and provides services based on the tenant's needs and configuration. A virtual service can contain a variety of configuration information such as load balancing policies, security policies, certificates, etc. to ensure the availability, security and performance of the service. For example: the system ensures the isolation of business operations by creating an independent virtual service for each tenant on the management plane. In this way, the business team corresponding to each tenant can independently configure and manage its own services within its own management area without being affected by other businesses.

[0136] When the SLB management module is specifically implemented, a corresponding interface can be provided in the SLB management module to obtain the corresponding information (server pool configuration parameters and other parameters related to virtual service configuration) input by the fourth user, so that the system can create a server pool and a virtual service of a specified tenant according to the obtained information. The server pool configuration parameters include but are not limited to: server pool name, load balancing algorithm, health check strategy, number of nodes, etc.

[0137] The present disclosure authorizes a user with a specified role (fourth user) to manage the SLB management module. In addition to corresponding to the first role, that is, the system administrator with the highest management authority, the specified role can also correspond to the third role and the fourth role, that is, the tenant administrator and the application administrator as mentioned above. In other words, the application administrator, the system administrator and the tenant administrator have the authority to manage the SLB management module at the same time. Figure 3 As shown, user B is the application administrator of tenant 3, user C is the application administrator of tenant 1, and user D is the application administrator of tenant 2. That is, each tenant is managed by an independent user.

[0138] When creating a virtual service for a specified tenant, the corresponding virtual service can be created based on the server pool, and the forwarding engine or forwarding engine cluster, policy and certificate created in the security management module and forwarding engine management module as above. The created virtual service uniquely corresponds to the tenant associated with the user who created the virtual service. For example: Figure 3 The virtual service created by user B in the example belongs only to tenant 3, and the virtual service created by user C belongs only to tenant 1. When a specified certificate can be used by administrators of multiple tenants when creating virtual services, the specified certificate is shared among the multiple tenants, thereby achieving sharing at the management level. This sharing mechanism not only improves the efficiency of resource utilization, but also simplifies the complexity of certificate management.

[0139] The present disclosure has the following beneficial technical effects by authorizing the SLB management module to be managed by a tenant administrator or an application administrator:

[0140] 1. Improve business flexibility. The tenant administrator or application administrator directly manages the SLB management module and can quickly adjust the configuration of the server pool and virtual services according to business needs to meet the dynamic changes in business needs. This flexibility is crucial for tenants because it helps them better adapt to market changes and business growth.

[0141] 2. Enhance business security. Through the SLB management module, tenant administrators or application administrators can configure sophisticated security policies and certificates for tenants to ensure the security and privacy of business data. This is especially important for tenants who need to process sensitive data or comply with strict security regulations.

[0142] 3. Optimize resource utilization. Tenant administrators or application administrators can dynamically adjust the resource allocation and load balancing strategy of the server pool according to the business load, thereby maximizing resource utilization and reducing operating costs. For tenants, this means that they can obtain higher business performance and availability at a lower cost.

[0143] 4. Improve management efficiency. Authorizing the SLB management module to tenant administrators or application administrators can simplify tenants' business management processes and reduce unnecessary communication and coordination costs. Tenant administrators or application administrators can directly configure and manage the system to improve management efficiency and response speed.

[0144] For the monitoring and alarm module:

[0145] The monitoring and alarm module in the present disclosure is mainly responsible for generating monitoring and alarm strategies, and generating corresponding monitoring data and alarm data according to the monitoring strategies and alarm strategies, respectively, so that relevant users can locate problems and solve them according to these monitoring data and alarm data.

[0146] When the monitoring and alarm module is specifically implemented, a corresponding interface can be provided in the monitoring and alarm module to obtain the corresponding information (monitoring and alarm strategy configuration parameters) input by the fifth user, so that the system generates monitoring strategies and alarm strategies according to the information obtained. Among them, the monitoring and alarm strategy configuration parameters include but are not limited to: monitoring indicators (such as CPU usage, memory occupancy, network throughput, etc.), monitoring frequency, monitoring objects (such as specific forwarding engines, server pools, etc.) and alarm thresholds of various monitoring indicators. When generating the corresponding monitoring strategy according to the monitoring and alarm strategy configuration parameters, specific monitoring rules can be generated according to the parsed parameters. These rules define how to collect, process and store monitoring data, and then generate monitoring tasks according to the monitoring rules, and add them to the monitoring task queue, which is executed by a special monitoring process or thread according to the set frequency. When generating the corresponding alarm strategy according to the monitoring and alarm strategy configuration parameters, it can be determined that when the monitoring data exceeds or falls below these alarm thresholds, an alarm will be triggered. In addition, in addition to simple threshold triggering, the alarm strategy can also include more complex conditional logic, such as combination judgment of multiple monitoring indicators, time series analysis, etc. Fifth, users can configure the alarm notification method, such as email, SMS, system log, etc., as well as the recipient of the alarm notification. For different types of alarms, different processing procedures can be formulated, including automatic recovery measures, manual intervention steps, etc.

[0147] The present disclosure processes monitoring data in a structured manner and displays it in a clear and organized manner, so that administrators can quickly understand the meaning and status of the data and make accurate decisions. At the same time, structured monitoring data facilitates data analysis. Administrators can find anomalies or trends by comparing data from different time periods and different forwarding engines, and then conduct troubleshooting and performance optimization. In addition, the structured data format is easier to be processed and parsed by the automated system, thereby supporting automated monitoring and alarm processes, reducing manual intervention, and improving operation and maintenance efficiency.

[0148] Wherein, the monitoring data includes: CPU utilization rate. When multiple tenants share the data plane, the CPU, network bandwidth, memory, etc. of the forwarding engine are shared by the services under different tenants. At this time, when a sudden surge in traffic of a certain service is detected through the monitoring and alarm module, the present disclosure adopts an automated migration or expansion strategy for this situation to avoid affecting the availability of certain services. If the CPU utilization rate of the virtual service on multiple forwarding engines is relatively low, it may mean that the current resource configuration exceeds the demand. In this case, the present disclosure takes capacity reduction measures for this situation, automatically reducing the number of instances of the forwarding engine, thereby saving resources and reducing costs.

[0149] Figure 4 A flow chart of a method for using the expansion, reduction and migration strategies of elastic virtual services according to an embodiment of the present disclosure is shown. Figure 4 As shown, it can be implemented through the following steps S410-470:

[0150] In step S410, the CPU usage of the forwarding engines in one or more forwarding engine clusters in the system within a preset time period is obtained.

[0151] In step S420, the obtained CPU usage of each forwarding engine is judged. If the CPU usage exceeds the first preset threshold, step S430 is executed; if the CPU usage is lower than the third preset threshold, step S470 is executed.

[0152] For example, if it is detected that the CPU usage of a forwarding engine has exceeded 85% in the last 15 minutes, it indicates that the forwarding engine may need stronger processing power to cope with the current load. At this time, two strategies can be adopted to improve the processing power: expansion or migration.

[0153] The expansion strategy refers to adding computing resources vertically on the existing forwarding engine (such as modifying the configuration of the virtual machine), or adding new forwarding engine instances horizontally to share the load. The new instance can be an idle instance in the forwarding engine cluster to which it belongs, or it can be directly connected to the OpenStack and Kubernetes Master of the IaaS layer to allocate a new forwarding engine instance. The migration strategy refers to dynamically migrating the virtual services on the forwarding engine to other forwarding engines in grayscale.

[0154] In step S430, a resource consumption index of a virtual service on the forwarding engine corresponding to the CPU usage exceeding the first preset threshold is obtained.

[0155] The choice of expansion or migration strategy depends on whether there are any "big consumers" of CPU resources on the forwarding engine. To this end, it is necessary to monitor the resource consumption indicators of each virtual service on the forwarding engine, such as the number of packets processed per second (Packets Per Second, PPS).

[0156] In step S440, the obtained resource consumption index is judged. If the resource consumption index exceeds the second preset threshold, step S450 is executed. If the resource consumption index does not exceed the second preset threshold, step S460 is executed.

[0157] For example, if the PPS of a virtual service exceeds 70%, it means that migration is difficult to solve the problem, and the virtual service needs to be expanded to allocate resources more effectively. On the contrary, it means that multiple virtual services together cause a high CPU load, and the migration strategy is more appropriate. By migrating one or more virtual services to other idle forwarding engines, the burden of the current forwarding engine can be reduced and resource allocation can be optimized.

[0158] In step S450, the virtual service corresponding to the resource consumption indicator exceeding the second preset threshold is expanded, and the expansion includes: increasing computing resources by modifying the configuration of the virtual service, and / or distributing the load by increasing the number of forwarding engines or virtual services.

[0159] Specifically, capacity expansion is divided into vertical expansion and horizontal expansion. Among them, vertical expansion, also known as vertical expansion or upward expansion, refers to the method of solving resource bottlenecks by increasing the computing power of a single server or virtual service node. This usually involves improving hardware specifications, such as increasing the number of CPU cores, increasing memory size, using faster storage devices, etc., or optimizing software to make more efficient use of existing hardware resources. By enhancing the computing power of the node, the traffic of the service can be more efficiently processed, thereby reducing resource pressure; horizontal expansion, also known as horizontal expansion or outward expansion, refers to the method of distributing the load and improving the overall processing power by increasing the number of servers or virtual service nodes. This method does not rely on the performance improvement of a single node, but rather shares the workload by adding more nodes. By adding more forwarding engines or virtual service nodes and migrating some virtual services to these new nodes, the load of the entire system can be balanced, resource allocation can be optimized, and the overall performance and stability of the system can be improved.

[0160] In step S460, a preset number of virtual services on the forwarding engine corresponding to the CPU usage exceeding the first preset threshold are migrated according to preset rules, and the migration includes: migrating the preset number of virtual services out of the corresponding forwarding engine and migrating them to an idle forwarding engine or a newly added forwarding engine in the forwarding engine cluster to which it belongs.

[0161] In step S470, the forwarding engines corresponding to the CPU usage rates lower than the third preset threshold are scaled down, and the scaling down includes: reducing the number of forwarding engines in the forwarding engine cluster.

[0162] The present disclosure has the following beneficial technical effects by authorizing the monitoring and alarm module to be managed by users with designated roles (application operation and maintenance administrator, application administrator or tenant administrator):

[0163] 1. Improve system stability and availability. Through the monitoring and alarm module, the status of the forwarding engine cluster and forwarding engine used by tenants can be monitored in real time, and potential problems can be discovered and solved in a timely manner; through the alarm strategy, the administrator can be quickly notified when an abnormality occurs in the system, thereby shortening the fault recovery time and improving the overall stability and availability of the system.

[0164] 2. Optimize resource allocation and performance. Monitoring data provides real-time information about key indicators such as network traffic and business performance parameters. Administrators can dynamically adjust resources based on this data to optimize resource allocation. In addition, by analyzing monitoring data, administrators can identify performance bottlenecks or inefficient forwarding engines, and then perform performance tuning to improve overall business performance.

[0165] 3. Enhanced security. The monitoring and alarm module can monitor the implementation of security policies, and promptly detect and report security violations. In addition, administrators can quickly respond to security threats based on alarm data and take necessary measures to protect tenants' data and business security.

[0166] 4. Improve operation and maintenance efficiency. The automated monitoring and alarm mechanism reduces the frequency of manual inspections and reduces operation and maintenance costs. In addition, administrators can quickly locate problems through structured monitoring data and improve the efficiency of problem solving.

[0167] 5. Support business decision-making. Long-term monitoring data provides tenants with insights into business operations, supporting tenants in making business decisions and optimizations. In addition, administrators can analyze business trends based on monitoring data and provide tenants with targeted suggestions and solutions.

[0168] Figure 5 A flow chart of a distributed load balancing management method based on multi-tenants according to an embodiment of the present disclosure is shown. The method is applied to a distributed load balancing management system, such as Figure 5 As shown, the method includes the following steps S510 to S540:

[0169] In step S510, business management classification information input by the first user is obtained, and a business account is created according to the business management classification information, including: obtaining role information in the business management classification information, and creating a role according to the role information; obtaining tenant information in the business management classification information, and creating a tenant according to the tenant information; obtaining user information in the business management classification information, and creating a user according to the user information, wherein the user information includes information about one or more tenants associated with the specified user, and information about a role uniquely corresponding to each of the one or more tenants.

[0170] In step S520, the policy information and certificate information input by the second user are obtained, and a security policy and certificate associated with the created designated tenant are generated according to the policy information and the certificate information respectively.

[0171] In step S530, the forwarding engine configuration parameters input by the third user are obtained, and a forwarding engine associated with the designated tenant is created according to the forwarding engine configuration parameters; and a forwarding engine cluster associated with the designated tenant is generated according to the created multiple forwarding engines.

[0172] In step S540, the server pool configuration parameters input by the fourth user are obtained, and a server pool is created according to the server pool configuration parameters; based on the designated forwarding engine cluster or designated forwarding engine associated with the designated tenant, as well as the server pool, the security policy and the certificate, a virtual service uniquely corresponding to the designated tenant is generated, so as to perform various business operations and management in the system based on the designated tenant.

[0173] Figure 6 A flow chart of another multi-tenant-based distributed load balancing management method according to an embodiment of the present disclosure is shown. The method is applied to a distributed load balancing management system, such as Figure 6 As shown, in addition to the above steps S510 to 540, the method further includes the following step S550:

[0174] In step S550, the monitoring and alarm policy configuration parameters input by the fifth user are obtained, and a monitoring and alarm policy is generated according to the monitoring and alarm policy configuration parameters; the monitoring and alarm policy includes: a monitoring policy and an alarm policy; based on the monitoring policy, monitoring data of forwarding engines in one or more forwarding engine clusters in the system are collected, and the collected monitoring data is structured and displayed according to business logic; whether the system is in an abnormal mode is determined according to the monitored network traffic and business performance parameters, and if in an abnormal mode, corresponding alarm data is generated and displayed based on the alarm policy and the abnormal mode.

[0175] Figure 71 shows a structural block diagram of an electronic device according to an embodiment of the present disclosure. Figure 7 As shown, the electronic device includes a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method described in any one of the above method embodiments.

[0176] The present disclosure also provides a computer-readable storage medium, which may be a computer-readable storage medium included in the electronic device or computer system in the above embodiment; or a computer-readable storage medium that exists independently and is not assembled into a device. The computer-readable storage medium stores one or more programs, and the programs are used by one or more processors to execute the method described in the present disclosure.

[0177] The present disclosure also provides a computer program product, including a computer program, which implements any method described in the present disclosure when the computer program is executed by a processor.

[0178] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present disclosure is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the inventive concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other.

Claims

1. A distributed load balancing management system based on multi-tenants, characterized in that: The system includes: an account management module, an SLB management module, a security management module and a forwarding engine management module, wherein the account management module includes: a tenant management module, a role management module and a user management module, wherein: The account management module is configured to: obtain the business management classification information input by the first user, and create a business account according to the business management classification information, including: based on the role management module, obtain the role information in the business management classification information, and create a role according to the role information; based on the tenant management module, obtain the tenant information in the business management classification information, and create a tenant according to the tenant information; based on the user management module, obtain the user information in the business management classification information, and create a user according to the user information, wherein the user information includes information of one or more tenants associated with the specified user, and information of a role uniquely corresponding to each of the one or more tenants; The security management module is configured to: obtain the policy information and certificate information input by the second user, and generate a security policy and certificate associated with the created designated tenant according to the policy information and the certificate information respectively; The forwarding engine management module is configured to: obtain the forwarding engine configuration parameters input by the third user, create a forwarding engine associated with the specified tenant according to the forwarding engine configuration parameters; and generate a forwarding engine cluster associated with the specified tenant according to the multiple forwarding engines that have been created; The SLB management module is configured to: obtain the server pool configuration parameters input by the fourth user, and create a server pool according to the server pool configuration parameters; generate a virtual service uniquely belonging to the designated tenant according to the designated forwarding engine cluster or the designated forwarding engine associated with the designated tenant, as well as the server pool, the security policy and the certificate, so as to perform one or more business operations and management in the system based on the designated tenant.

2. The system according to claim 1, characterized in that The system further comprises: a monitoring and alarm module, wherein the monitoring and alarm module is configured to: Acquire the monitoring and alarm strategy configuration parameters input by the fifth user, and generate the monitoring and alarm strategy according to the monitoring and alarm strategy configuration parameters; the monitoring and alarm strategy includes: a monitoring strategy and an alarm strategy; Based on the monitoring strategy, collect monitoring data of the forwarding engines in one or more forwarding engine clusters in the system, and perform structured processing and display of the collected monitoring data according to business logic; It is determined whether the system is in an abnormal mode based on the monitored network traffic and business performance parameters. If the system is in an abnormal mode, corresponding alarm data is generated and displayed based on the alarm strategy and the abnormal mode.

3. The system according to claim 2, characterized in that in, The monitoring data includes: CPU usage rate, and the monitoring and alarm module is further configured to: Obtaining CPU usage of forwarding engines in one or more forwarding engine clusters in the system within a preset time period; The obtained CPU usage of each forwarding engine is judged. If the CPU usage exceeds a first preset threshold, then: Obtain a resource consumption indicator of a virtual service on a forwarding engine corresponding to a CPU usage exceeding the first preset threshold, and judge the obtained resource consumption indicator; if the resource consumption indicator exceeds a second preset threshold, then: expand the capacity of the virtual service corresponding to the resource consumption indicator exceeding the second preset threshold, and the expansion includes: increasing computing resources by modifying the configuration of the virtual service, and / or distributing the load by increasing the number of forwarding engines or virtual services; if the resource consumption indicator does not exceed the second preset threshold, then: migrate a preset number of virtual services on the forwarding engine corresponding to the CPU usage exceeding the first preset threshold according to preset rules, and the migration includes: migrating the preset number of virtual services out of the corresponding forwarding engine, and migrating them to an idle forwarding engine or a newly added forwarding engine in the forwarding engine cluster to which they belong; If the CPU usage is lower than a third preset threshold, then: the forwarding engines corresponding to the CPU usage lower than the third preset threshold are scaled down, and the scaling down includes: reducing the number of forwarding engines in the forwarding engine cluster.

4. The system according to claim 2, characterized in that in, The first user, the second user, the third user, the fourth user and the fifth user are all associated with the designated tenant and correspond to designated roles, the roles include: a first role, a second role, a third role, a fourth role and a fifth role, the first role is a system administrator, the second role is a security administrator, the third role is a tenant administrator, the fourth role is an application administrator, and the fifth role is an application operation and maintenance administrator, the first user, the second user, the third user, the fourth user and the fifth user are all associated with the designated tenant and correspond to designated roles, including: The first user, the second user, the third user, the fourth user and the fifth user all correspond to the first role; or, The first user corresponds to the first role, the second user corresponds to the second role, the third user corresponds to the third role, the fourth user corresponds to the third role or the fourth role, and the fifth user corresponds to the fifth role; or The first user corresponds to the first role, the second user and the third user both correspond to the third role, the fourth user corresponds to the third role or the fourth role, and the fifth user corresponds to the fifth role.

5. The system according to claim 4, characterized in that in, When the second user corresponds to the first role or the second role, the security policy and certificate associated with the created designated tenant are also associated with other created tenants except the designated tenant; When the second user corresponds to the third role, the security policy and the certificate are only associated with the designated tenant, and are not associated with other tenants except the designated tenant.

6. The system according to claim 1, characterized in that in, The tenant is bound to a specified cloud infrastructure resource or to a specified organizational structure. When the tenant is bound to the specified cloud infrastructure resource, creating a forwarding engine associated with the specified tenant according to the forwarding engine configuration parameters includes: Creating a forwarding engine associated with the designated tenant on a cloud platform corresponding to the cloud infrastructure resource according to the forwarding engine configuration parameters; When the forwarding engine group is shared by multiple designated tenants, the forwarding engine management module is further configured to: configure an independent virtual routing VRF instance for each of the multiple designated tenants on the forwarding engine group to isolate traffic between the multiple designated tenants.

7. The system according to claim 1, characterized in that in, The tenant information includes: whether to share a forwarding engine cluster tag. Among the multiple tenants that have been created, if the whether to share a forwarding engine cluster tag in the tenant information of the multiple tenants indicates a shared forwarding engine cluster, one or more specified forwarding engine clusters are shared between the multiple tenants; if the whether to share a forwarding engine cluster tag in the tenant information of the multiple tenants indicates a non-shared forwarding engine cluster, the multiple tenants independently deploy their own forwarding engine clusters.

8. A distributed load balancing management method based on multi-tenants, characterized in that: The method is applied to a distributed load balancing management system, and the method comprises: Acquiring business management classification information input by a first user, and creating a business account according to the business management classification information, including: acquiring role information in the business management classification information, and creating a role according to the role information; acquiring tenant information in the business management classification information, and creating a tenant according to the tenant information; acquiring user information in the business management classification information, and creating a user according to the user information, wherein the user information includes information of one or more tenants associated with a specified user, and information of a role uniquely corresponding to each of the one or more tenants; Acquire the policy information and certificate information input by the second user, and generate a security policy and certificate associated with the created designated tenant according to the policy information and the certificate information respectively; Acquire the forwarding engine configuration parameters input by the third user, and create a forwarding engine associated with the specified tenant according to the forwarding engine configuration parameters; generate a forwarding engine cluster associated with the specified tenant according to the multiple forwarding engines that have been created; Obtain server pool configuration parameters input by a fourth user, and create a server pool according to the server pool configuration parameters; generate a virtual service uniquely corresponding to the designated tenant according to a designated forwarding engine cluster or a designated forwarding engine associated with the designated tenant, as well as the server pool, the security policy and the certificate, so as to perform various business operations and management in the system based on the designated tenant.

9. The method according to claim 8, characterized in that The method further comprises: Acquire the monitoring and alarm strategy configuration parameters input by the fifth user, and generate the monitoring and alarm strategy according to the monitoring and alarm strategy configuration parameters; the monitoring and alarm strategy includes: a monitoring strategy and an alarm strategy; Based on the monitoring strategy, collect monitoring data of the forwarding engines in one or more forwarding engine clusters in the system, and perform structured processing and display of the collected monitoring data according to business logic; It is determined whether the system is in an abnormal mode based on the monitored network traffic and business performance parameters. If the system is in an abnormal mode, corresponding alarm data is generated and displayed based on the alarm strategy and the abnormal mode.

10. An electronic device, characterized in that: The method comprises a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method according to any one of claims 8 to 9.

11. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed by a processor, the method according to any one of claims 8 to 9 is implemented.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 8 to 9 is implemented.

Images