A service access method, apparatus and related equipment

Abstract

This application relates to the field of container technology, and particularly to a service access method, apparatus, and related equipment. The method includes: receiving routing information reported by a node, wherein when a node detects the creation of a service of a specified type, it constructs routing information with the destination address being the address of the service and the next-hop information being the address of the node; determining the authentication device to which the node accesses based on the node's address; and sending the routing information to the authentication device, wherein the authentication device synchronizes the routing information to Border devices in the network, so that the Border devices generate routing table entries with the destination address being the address of the service and the next-hop information being the address of the authentication device, based on the routing information; the Border devices determine routing table entries for forwarding the user request based on the address of the service carried in a received user request, and forward the user request to the corresponding authentication device based on the routing table entries.

Description

Technical Field

[0001] This application relates to the field of container technology, and in particular to a service access method, apparatus and related equipment. Background Technology

[0002] A Kubernetes Service is an abstraction used to define access policies for a group of Pods (encapsulations of one or more containers). It provides a stable network identity and routes traffic to these Pods through load balancing. For certain Pod applications (e.g., frontends), users may want to expose them externally, meaning the service can be accessed from outside the cluster.

[0003] In Kubernetes clusters, there are three main types of Service:

[0004] ClusterIP type: Exposes the service through an internal virtual IP address within the cluster. This type of service's virtual IP address is accessible only within the cluster. NodePort type: Exposes the service through a static port (NodePort) on each node's IP address. Kubernetes also assigns a cluster virtual IP address to this type of service for both internal and external access. LoadBalancer type: Exposes the service to the outside world using an external load balancer. Kubernetes does not directly provide a load balancing component; a third-party load balancing component must be provided, or the Kubernetes cluster must be integrated with a cloud provider. Kubernetes also assigns a cluster virtual IP address to this type of service for internal cluster access.

[0005] Currently, services are typically exposed using NodePort and Loadbalancer types. When using a NodePort type service, users access a static port on a node, sending packets to that node, which then forwards them to the backend service for a response. When using a Loadbalancer type service, users access a load balancer outside the Kubernetes cluster; the load balancer forwards traffic to a node, which in turn forwards the traffic to the backend service for a response.

[0006] However, using the NodePort method leads to a concentration of external requests on a single node, which can easily cause network congestion and expose the node's real IP address. If that node fails, the service will become unavailable, failing to meet high availability requirements. Using the LoadBalancer method requires the use of the cloud provider's load balancing component, whose load balancing strategy is determined by the cloud platform, requiring users to incur higher usage and maintenance costs. Summary of the Invention

[0007] This application provides a service access method, apparatus, and related equipment.

[0008] Firstly, this application provides a service access method applied to a controller in a network, the method comprising:

[0009] The receiving node reports routing information. When a node detects the creation of a service of a specified type, it constructs the routing information corresponding to that service. The destination address of the routing information is the address of the service, and the next hop information is the address of the node.

[0010] Based on the node addresses included in the routing information, determine the authentication device that the node is connected to;

[0011] The routing information is sent to the authentication device, which then synchronizes the routing information to the border device in the network. This allows the border device to generate a routing table entry with the destination address of the service and the next-hop information as the routing table entry of the authentication device. When the border device receives a user request to access the service, it determines the routing table entry for forwarding the user request based on the address of the service carried in the user request, and forwards the user request to the corresponding authentication device based on the routing table entry.

[0012] Optionally, the specified service type is a ClusterIP type service.

[0013] Secondly, this application provides a service access method applied to authentication devices in a network, the method comprising:

[0014] The node receives routing information sent by the controller. When a node detects the creation of a service of a specified type, it constructs routing information with the destination address of the service as the address of the service and the next hop information as the address of the node. Based on the address of the node included in the routing information, the node determines the authentication device to which it is connected and sends the routing information to the authentication device.

[0015] The routing information is synchronized to the border devices in the network so that the border devices can generate routing table entries with the destination address of the service and the next hop information of the authentication device based on the routing information. When the border device receives a user request to access the service, it determines the routing table entry for forwarding the user request based on the address of the service carried in the user request, and forwards the user request to the corresponding authentication device based on the routing table entry.

[0016] Optionally, the Border device maintains at least two routing table entries for forwarding the user request. When the Border device receives a user request to access the service, it determines at least two routing table entries for forwarding the user request based on the address of the service carried in the user request, and determines the target routing table entry for forwarding the user request from the at least two routing table entries based on a preset load balancing strategy, and forwards the user request to the corresponding authentication device based on the target routing table entry.

[0017] Thirdly, this application provides a service access device for use in a network controller, the device comprising:

[0018] The receiving unit is used to receive routing information reported by nodes. When a node detects the creation of a service of a specified type, it constructs the routing information corresponding to the service. The destination address of the routing information is the address of the service, and the next-hop information is the address of the node.

[0019] The determining unit is used to determine the authentication device that the node is connected to based on the address of the node included in the routing information;

[0020] The sending unit is used to send the routing information to the authentication device, wherein the authentication device synchronizes the routing information to the border device in the network, so that the border device generates a routing table entry with the destination address of the service and the next hop information of the authentication device based on the routing information. When the border device receives a user request to access the service, it determines the routing table entry for forwarding the user request based on the address of the service carried in the user request, and forwards the user request to the corresponding authentication device based on the routing table entry.

[0021] Optionally, the specified service type is a ClusterIP type service.

[0022] Fourthly, this application provides a service access device for use in authentication devices within a network, the device comprising:

[0023] The receiving unit is used to receive routing information sent by the controller. When a node detects the creation of a service of a specified type, it constructs routing information with the destination address of the service as the address of the service and the next hop information as the address of the node. Based on the address of the node included in the routing information, it determines the authentication device that the node is connected to and sends the routing information to the authentication device.

[0024] The synchronization unit is used to synchronize the routing information to the border devices in the network, so that the border devices can generate a routing table entry with the destination address of the service and the next hop information of the authentication device based on the routing information. When the border device receives a user request to access the service, it determines the routing table entry for forwarding the user request based on the address of the service carried in the user request, and forwards the user request to the corresponding authentication device based on the routing table entry.

[0025] Optionally, the Border device maintains at least two routing table entries for forwarding the user request. When the Border device receives a user request to access the service, it determines at least two routing table entries for forwarding the user request based on the address of the service carried in the user request, and determines the target routing table entry for forwarding the user request from the at least two routing table entries based on a preset load balancing strategy, and forwards the user request to the corresponding authentication device based on the target routing table entry.

[0026] Fifthly, embodiments of this application provide a service access device, which includes:

[0027] Memory, used to store program instructions;

[0028] A processor is configured to invoke program instructions stored in the memory and execute the steps of the method as described in any one of the first aspects above, according to the obtained program instructions.

[0029] In a sixth aspect, embodiments of this application also provide a computer-readable storage medium storing computer-executable instructions for causing the computer to perform the steps of the method as described in any of the first aspects above.

[0030] In a seventh aspect, embodiments of this application provide a service access device, the service access device comprising:

[0031] Memory, used to store program instructions;

[0032] A processor is configured to invoke program instructions stored in the memory and execute the steps of the method as described in any one of the second aspects above, according to the obtained program instructions.

[0033] Eighthly, embodiments of this application also provide a computer-readable storage medium storing computer-executable instructions for causing the computer to perform the steps of the method as described in any of the second aspects above.

[0034] In summary, the service access method provided in this application receives routing information reported by nodes. When a node detects the creation of a service of a specified type, it constructs routing information corresponding to that service. The destination address of this routing information is the address of the service, and the next-hop information is the address of the node. Based on the node address included in the routing information, it determines the authentication device to which the node accesses. The routing information is then sent to the authentication device, which synchronizes this routing information to the border device in the network. This allows the border device to generate a routing table entry with the destination address of the service and the next-hop information of the authentication device. When the border device receives a user request to access the service, it determines a routing table entry for forwarding the user request based on the address of the service carried in the request, and forwards the user request to the corresponding authentication device based on this routing table entry.

[0035] Using the service access method provided in this application, services deployed by users within a Kubernetes cluster can be published externally via ClusterIP. External users can access services within the cluster through this IP, and leaf devices perform load balancing through equal-cost routing. This avoids the network congestion and single-node failure issues associated with the NodePort method, and also eliminates the need for the additional costs of a cloud platform load balancer as with the Loadbalancer method. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments of this application or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings of the embodiments of this application.

[0037] Figure 1 A detailed flowchart of a service access method provided in an embodiment of this application;

[0038] Figure 2 A detailed flowchart of another service access method provided in an embodiment of this application;

[0039] Figure 3This application provides a service IP external publishing architecture diagram.

[0040] Figure 4 This is a schematic diagram of the structure of a service access device provided in an embodiment of this application;

[0041] Figure 5 A schematic diagram of another service access device provided in an embodiment of this application;

[0042] Figure 6 A schematic diagram of the hardware architecture of a service access device provided in an embodiment of this application;

[0043] Figure 7 This is a schematic diagram of the hardware architecture of another service access device provided in an embodiment of this application. Detailed Implementation

[0044] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the application. The singular forms “a,” “the,” and “the” as used in this application and claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to any and all possible combinations comprising one or more of the associated listed items.

[0045] It should be understood that although the terms first, second, third, etc., may be used to describe various information in embodiments of this application, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" may also be interpreted as "when," "when," or "in response to a determination."

[0046] For example, see Figure 1 The diagram shown is a detailed flowchart of a service access method provided in an embodiment of this application. This method is applied to a controller in a network and includes the following steps:

[0047] Step 100: Receive routing information reported by nodes. When a node detects the creation of a service of a specified type, it constructs the routing information corresponding to the service. The destination address of the routing information is the address of the service, and the next hop information is the address of the node.

[0048] In this embodiment, when a service of a specified type is created on a node in the cluster, the node detects the service creation and constructs corresponding routing information based on its IP address and the service's IP address. It should be noted that the destination address of this routing information is the service's IP address, and the next-hop information is the node's IP address. After constructing the routing table entry corresponding to the service, the node reports this routing table entry to the controller.

[0049] In this embodiment of the application, the specified type of service is a ClusterIP type service.

[0050] Specifically, nodes can access the controller's API interface and send the routing table entries that need to be reported to the controller through the API interface.

[0051] Step 110: Based on the node addresses included in the routing information, determine the authentication device that the node is connected to.

[0052] In practical applications, the controller maintains the topology information of each device in the managed network. When it receives the routing information corresponding to a specified type of service reported by a node, it determines the authentication device that the node accesses based on the next-hop address information (e.g., the node's IP address) included in the routing information. The authentication device refers to the device that performs online authentication on the node when it comes online (e.g., the Leaf device in a Spine-Leaf network).

[0053] Step 120: Send the routing information to the authentication device.

[0054] In this embodiment, the authentication device synchronizes the routing information to the border device in the network, so that the border device generates a routing table entry with the destination address of the service and the next hop information of the authentication device based on the routing information. When the border device receives a user request to access the service, it determines the routing table entry for forwarding the user request based on the address of the service carried in the user request, and forwards the user request to the corresponding authentication device based on the routing table entry.

[0055] In this embodiment of the application, after receiving the routing information corresponding to each specified type of service reported by the node, the controller sends the routing information to the authentication device corresponding to the node. After receiving the routing information sent by the controller, the authentication device synchronizes the routing information to the border device (e.g., the Border device) in the network. In actual application, after receiving the routing information synchronized by the authentication device, the Border device generates a routing table entry with the IP address of the service as the destination address and the IP address of the authentication device as the next hop information based on the address (IP address) of the service included in the routing information.

[0056] In this way, when a user accesses the service through a Border or authentication device, the Border device, upon receiving the user's request to access the service, can determine the routing table entry for forwarding the request based on the destination IP address (the IP address of the service being accessed) carried in the request, and then route the request to the corresponding authentication device.

[0057] For example, see Figure 2 The diagram shown is a detailed flowchart of a service access method provided in an embodiment of this application. This method is applied to authentication devices in a network and includes the following steps:

[0058] Step 200: Receive routing information sent by the controller.

[0059] When a node detects the creation of a service of a specified type, it constructs routing information with the destination address of the service as the service address and the next-hop information as the address of the node. Based on the node address included in the routing information, it determines the authentication device that the node is connected to and sends the routing information to the authentication device.

[0060] Step 210: Synchronize the routing information to the border devices in the network.

[0061] In this embodiment of the application, the Border device generates a route table entry for the authentication device based on the routing information, with the destination address being the address of the service and the next-hop information being the routing table entry of the authentication device. When the Border device receives a user request to access the service, it determines a route table entry for forwarding the user request based on the address of the service carried in the user request, and forwards the user request to the corresponding authentication device based on the route table entry.

[0062] In this embodiment of the application, the Border device maintains at least two routing table entries for forwarding the user request. When the Border device receives a user request to access the service, it determines at least two routing table entries for forwarding the user request based on the address of the service carried in the user request, and determines the target routing table entry for forwarding the user request from the at least two routing table entries based on a preset load balancing strategy, and forwards the user request to the corresponding authentication device based on the target routing table entry.

[0063] The following describes in detail the process of externally publishing the service IP provided in this application embodiment, using specific application scenarios as examples. For instance, please refer to... Figure 3 The diagram shown is an architecture diagram for external service IP publication provided in an embodiment of this application.

[0064] 1) The CNI-Agent (the agent program on the node) constructs a routing table entry for this node based on the service's forwarding policy (the destination address is ClusterIp (service IP), and the next hop is the address of this node) and notifies the controller.

[0065] Specifically, it adds routing table entries to the routing table associated with the Vrouter where the controller resides for the cluster. The node (cni-agent) is an API interface that can access the DC controller, informing the controller of the routing table entry information to be added (local routing table entries constructed based on forwarding policies, for each service).

[0066] 2) The controller determines the Leaf device (the authenticated device that is online on the node) based on the next-hop node address of the route, and sends a specific Clusterip routing table entry to the Leaf device (the destination address is the service IP, and the next-hop information is the node IP).

[0067] 3) The Leaf device synchronizes the Clusterip routing table entries (destination address (e.g., service IP1), next hop (node ​​IP1)) - Leaf1; destination address (service IP1), next hop (node ​​IP2)) - Leaf2 to the Border device.

[0068] Generate a routing table entry to Leaf1 (there may be multiple entries); destination address (service IP), next hop (LeafIP).

[0069] In this way, after receiving a request to access service 1, the Border device will randomly select one from Leaf1 or Leaf2.

[0070] 4) When a user accesses the cluster IP via Border or Leaf, Border and Leaf perform random load balancing through equal-cost routing, forwarding packets to the next-hop node (the real node). The node then forwards the request to the backend service for response (forwarding to the Pod).

[0071] For example, see Figure 4 The diagram shown is a structural schematic of a service access device provided in an embodiment of this application. This device is applied to a controller in a network and includes:

[0072] The receiving unit 40 is used to receive routing information reported by nodes. When a node detects the creation of a service of a specified type, it constructs routing information corresponding to the service. The destination address of the routing information is the address of the service, and the next-hop information is the address of the node.

[0073] The determining unit 41 is used to determine the authentication device accessed by the node based on the address of the node included in the routing information;

[0074] The sending unit 42 is used to send the routing information to the authentication device, wherein the authentication device synchronizes the routing information to the border device in the network, so that the border device generates a routing table entry with the destination address of the service and the next hop information of the authentication device based on the routing information. When the border device receives a user request to access the service, it determines the routing table entry for forwarding the user request based on the address of the service carried in the user request, and forwards the user request to the corresponding authentication device based on the routing table entry.

[0075] Optionally, the specified service type is a ClusterIP type service.

[0076] For example, see Figure 5 The diagram shown is a structural schematic of a service access device provided in an embodiment of this application. This device is applied to authentication equipment in a network and includes:

[0077] The receiving unit 50 is used to receive routing information sent by the controller, wherein when a node detects the creation of a service of a specified type, it constructs routing information with the destination address of the service as the address of the service and the next hop information as the address of the node, and determines the authentication device to which the node is connected based on the address of the node included in the routing information, and sends the routing information to the authentication device.

[0078] Synchronization unit 51 is used to synchronize the routing information to the border device in the network, so that the border device generates a routing table entry with the destination address of the service and the next hop information of the authentication device based on the routing information. When the border device receives a user request to access the service, it determines the routing table entry for forwarding the user request based on the address of the service carried in the user request, and forwards the user request to the corresponding authentication device based on the routing table entry.

[0079] Optionally, the Border device maintains at least two routing table entries for forwarding the user request. When the Border device receives a user request to access the service, it determines at least two routing table entries for forwarding the user request based on the address of the service carried in the user request, and determines the target routing table entry for forwarding the user request from the at least two routing table entries based on a preset load balancing strategy, and forwards the user request to the corresponding authentication device based on the target routing table entry.

[0080] These units can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more digital signal processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when one of these units is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these units can be integrated together to form a system-on-a-chip (SOC).

[0081] Furthermore, regarding the service access device provided in this application embodiment, from a hardware perspective, the hardware architecture diagram of the service access device can be found in [reference needed]. Figure 6 As shown, the service access device may include: a memory 60 and a processor 61.

[0082] The memory 60 is used to store program instructions; the processor 61 calls the program instructions stored in the memory 60 and executes the method embodiment applied to the controller according to the obtained program instructions. The specific implementation and technical effects are similar, and will not be described again here.

[0083] Optionally, this application also provides a controller, including at least one processing element (or chip) for performing the above-described method embodiments applied to the controller.

[0084] Optionally, this application also provides a program product, such as a computer-readable storage medium storing computer-executable instructions for causing the computer to perform the above-described method embodiments applied to the controller.

[0085] Furthermore, regarding the service access device provided in this application embodiment, from a hardware perspective, the hardware architecture diagram of the service access device can be found in [reference needed]. Figure 7 As shown, the service access device may include: a memory 70 and a processor 71.

[0086] The memory 70 is used to store program instructions; the processor 71 calls the program instructions stored in the memory 70 and executes the method embodiment applied to the authentication device as described above according to the obtained program instructions. The specific implementation and technical effects are similar, and will not be described again here.

[0087] Optionally, this application also provides an authentication device, including at least one processing element (or chip) for performing the above-described method embodiments applied to the authentication device.

[0088] Optionally, this application also provides a program product, such as a computer-readable storage medium storing computer-executable instructions for causing the computer to execute the above-described method embodiments applied to the authentication device.

[0089] Here, a machine-readable storage medium can be any electronic, magnetic, optical, or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, a machine-readable storage medium can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard disk drives), solid-state drives, any type of storage disk (such as optical discs, DVDs, etc.), or similar storage media, or combinations thereof.

[0090] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0091] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0092] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0093] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0094] Furthermore, these computer program instructions can also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in the process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0095] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0096] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A service access method, characterized in that, The method, applied to a controller in a network, includes: The receiving node reports routing information. When a node detects the creation of a service of a specified type, it constructs the routing information corresponding to that service. The destination address of the routing information is the address of the service, and the next hop information is the address of the node. Based on the node addresses included in the routing information, determine the authentication device that the node is connected to; The routing information is sent to the authentication device, which then synchronizes the routing information to the border device in the network. This allows the border device to generate a routing table entry with the destination address of the service and the next-hop information of the authentication device based on the routing information. When the border device receives a user request to access the service, it determines at least two routing table entries for forwarding the user request based on the address of the service carried in the user request. It also determines the target routing table entry to be used based on a preset load balancing strategy and forwards the user request to the corresponding authentication device based on the target routing table entry. The specified service type is a ClusterIP type service.

2. A service access method, characterized in that, The method, applied to authentication devices in a network, includes: The system receives routing information sent by the controller. When a node detects the creation of a service of a specified type, it constructs routing information with the destination address of the service as the address of the service and the next hop information as the address of the node. Based on the address of the node included in the routing information, the system determines the authentication device to which the node is connected and sends the routing information to the authentication device. The specified type of service is a ClusterIP type service. The routing information is synchronized to the border devices in the network so that the border devices can generate routing table entries with the destination address of the service and the next-hop information of the authentication device based on the routing information. When the border device receives a user request to access the service, it determines at least two routing table entries for forwarding the user request based on the address of the service carried in the user request, determines the target routing table entry to be used based on a preset load balancing strategy, and forwards the user request to the corresponding authentication device based on the target routing table entry.

3. The method as described in claim 2, characterized in that, The Border device maintains at least two routing table entries for forwarding the user request. When the Border device receives a user request to access the service, it determines at least two routing table entries for forwarding the user request based on the address of the service carried in the user request, and determines the target routing table entry for forwarding the user request from the at least two routing table entries based on a preset load balancing strategy, and forwards the user request to the corresponding authentication device based on the target routing table entry.

4. A service access device, characterized in that, A controller used in a network, the device comprising: The receiving unit is used to receive routing information reported by nodes. When a node detects the creation of a service of a specified type, it constructs the routing information corresponding to the service. The destination address of the routing information is the address of the service, and the next-hop information is the address of the node. The determining unit is used to determine the authentication device that the node is connected to based on the address of the node included in the routing information; A sending unit is configured to send the routing information to the authentication device, wherein the authentication device synchronizes the routing information to the border device in the network, so that the border device generates a routing table entry with the destination address of the service and the next hop information of the authentication device based on the routing information. When the border device receives a user request to access the service, it determines at least two routing table entries for forwarding the user request based on the address of the service carried in the user request, determines the target routing table entry to be used based on a preset load balancing strategy, and forwards the user request to the corresponding authentication device based on the target routing table entry. The specified service type is a ClusterIP type service.

5. A service access device, characterized in that, An authentication device used in a network, the device comprising: The receiving unit is used to receive routing information sent by the controller. When a node detects the creation of a service of a specified type, it constructs routing information with the destination address of the service as the address of the service and the next hop information as the address of the node. Based on the address of the node included in the routing information, it determines the authentication device that the node is connected to and sends the routing information to the authentication device. The specified type of service is a ClusterIP type service. The synchronization unit is used to synchronize the routing information to the border devices in the network, so that the border devices can generate routing table entries with the destination address of the service and the next-hop information of the authentication device based on the routing information. When the border device receives a user request to access the service, it determines at least two routing table entries for forwarding the user request based on the address of the service carried in the user request, determines the target routing table entry to be used based on a preset load balancing strategy, and forwards the user request to the corresponding authentication device based on the target routing table entry.

6. The apparatus as claimed in claim 5, characterized in that, The Border device maintains at least two routing table entries for forwarding the user request. When the Border device receives a user request to access the service, it determines at least two routing table entries for forwarding the user request based on the address of the service carried in the user request, and determines the target routing table entry for forwarding the user request from the at least two routing table entries based on a preset load balancing strategy, and forwards the user request to the corresponding authentication device based on the target routing table entry.

7. A service access device, characterized in that, The service access device includes: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the steps of the method as described in any one of claims 1-3 according to the obtained program instructions.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions for causing the computer to perform the steps of the method as described in any one of claims 1-3.

Images