A kind of based on loongson architecture's China's service grid cloud platform management and control device and method

Abstract

This invention provides a management and control device and method for a service mesh cloud platform based on the Loongson architecture, comprising: a domestically produced hardware support layer processor using the Loongson architecture; a unified management and control layer for receiving user configuration instructions and converting them into standard control signals, while simultaneously collecting resource status data, policy execution status data, and operational status data, and summarizing them into network-wide operational status data; a cloud adaptation layer for converting standard control signals into interface signals; simultaneously collecting resource status data returned by external multi-vendor cloud platforms; a service mesh control plane for parsing service mesh governance policies and generating traffic governance instructions; simultaneously collecting data forwarding status and service operational status and summarizing them into policy execution status data; and a data plane for receiving and executing traffic governance instructions issued by the service mesh control plane, optimizing network forwarding processes based on the Loongson architecture. This invention can improve the efficiency of microservice governance and management, architectural adaptability, and communication security in the context of domestically developed IT applications.

Description

Technical Field

[0001] This invention relates to the field of cloud computing service network technology, specifically to a management and control device and method for a domestically developed service mesh cloud platform based on the Loongson architecture. Background Technology

[0002] With the rapid development of cloud computing and containerization technologies, service mesh has become a core communication, security, and management layer in microservice architectures. It enables key functions such as traffic scheduling, communication encryption, and status monitoring between microservices, providing crucial support for the stable operation of microservice architectures. Currently, major domestic and international cloud service providers and private cloud platforms (such as OpenStack and container clouds) have launched their own service mesh solutions, which are widely used in various cloud computing scenarios, promoting the large-scale deployment of microservice architectures.

[0003] However, existing service mesh technologies still face many unresolved issues in practical applications, making it difficult to meet the demands for domestic deployment and efficient management under the background of information technology application innovation. Specifically:

[0004] Existing service mesh management platforms heavily rely on foreign hardware and software architectures. Most mainstream service mesh management platforms are built on x86 architecture and use foreign operating systems and middleware (such as Linux, Kubernetes, and Istio). Core technologies and hardware depend on foreign supply chains, posing serious supply chain security risks and failing to meet the requirements of domestic self-reliance and controllability under the context of information technology innovation. Furthermore, the support for domestic CPUs (such as Loongson) and domestic operating systems (such as UnionTech UOS) in the existing service mesh ecosystem is insufficient, and related adaptation and optimization are lacking. This prevents the full utilization of the performance advantages of domestic hardware, hindering the promotion and application of service mesh technology in information technology innovation scenarios.

[0005] Secondly, cross-cloud platform management lacks uniformity. Each platform uses independent control interfaces and operation interfaces, lacking unified control standards. This means that in a multi-cloud deployment environment, enterprises need to log in to different cloud platforms to configure, manage, and maintain the service mesh. This not only significantly increases management costs and operational complexity but also makes it difficult to achieve unified service discovery and unified traffic governance in a cross-cloud environment, failing to meet the actual needs of enterprises for multi-cloud collaborative management. Summary of the Invention

[0006] To address the common problems in existing service mesh technologies, such as insufficient compatibility with domestic CPU architectures like Loongson, weak multi-cloud environment compatibility and management capabilities, and a lack of closed-loop management and execution links, this invention proposes a management and control device for a domestically developed service mesh cloud platform based on the Loongson architecture, comprising:

[0007] Domestic hardware support layer, unified management and control layer, cloud adaptation layer, service mesh control plane and data plane;

[0008] The domestically produced hardware support layer processor adopts the LoongArch architecture, is compatible with domestic operating systems and domestic security components, and provides the physical foundation for hardware operation support and data interaction for the unified management and control layer, cloud adaptation layer, service mesh control plane and data plane;

[0009] The unified management and control layer is bidirectionally connected to the cloud adaptation layer and the service mesh control plane, respectively. It is used to receive user configuration instructions and convert them into standard control signals, and send the standard control signals to the cloud adaptation layer and the service mesh control plane. At the same time, it collects resource status data returned by the cloud adaptation layer, policy execution status data returned by the service mesh control plane, and operation status data fed back by the data plane, and summarizes them into network-wide operation status data and displays them.

[0010] The cloud adaptation layer is communicatively connected to the unified management and control layer and external multi-vendor cloud platforms, respectively. It is used to receive standard control signals issued by the unified management and control layer, convert them into interface signals compatible with each external multi-vendor cloud platform, and then issue them to the corresponding external multi-vendor cloud platforms. At the same time, it collects resource status data returned by the external multi-vendor cloud platforms and sends it back to the unified management and control layer.

[0011] The service mesh control plane is bidirectionally connected to the unified management and control layer and the data plane, respectively. It is used to parse the service mesh governance strategy in the standard control signal, generate traffic governance instructions and send them to the data plane. At the same time, it collects the data forwarding status and service operation status returned by the data plane, summarizes them into policy execution status data and sends them back to the unified management and control layer.

[0012] The data plane is deployed on each microservice node and is bidirectionally connected to the service mesh control plane. It is used to receive and execute traffic management instructions issued by the service mesh control plane, optimize the network forwarding process based on the LoongArch architecture, integrate national cryptographic algorithms to encrypt inter-service communication, and feed back the data forwarding status and service running status to the service mesh control plane.

[0013] Optionally, the domestically produced hardware support layer includes:

[0014] Loongson CPU modules support the LoongArch instruction set;

[0015] The domestically produced operating system module is equipped with UnionTech UOS or Kylin OS and has passed the domestic operating system compatibility certification.

[0016] Domestic security components include cryptographic modules integrating SM2 / SM3 / SM4 national cryptographic algorithms and domestic NVMe SSD storage devices that support hardware encryption;

[0017] The redundant power supply module supports dual redundant power inputs and features a standard chassis structure that is dustproof and shockproof.

[0018] Optionally, the unified management and control layer includes:

[0019] The unified management interface module is a visual interactive interface used to receive user configuration commands and display network-wide operational status data.

[0020] The unified management API gateway module is used to convert user configuration commands into standard control signals, send the standard control signals to the cloud adaptation layer and service mesh control plane, and perform legality verification and format conversion on the user configuration commands.

[0021] The unified authentication and authorization module integrates domestic operating system accounts and authentication mechanisms from various cloud platforms, supports role-based access control, and records user operation logs.

[0022] Optionally, the cloud adaptation layer adopts a plug-in architecture, including:

[0023] The unified API interface sublayer defines a bidirectional standard interface, which includes a standard management interface and a standard data return interface, used to shield the interface protocol differences of various external multi-vendor cloud platforms.

[0024] The cloud platform adaptation plugin sublayer is used to receive standard control signals issued by the unified management and control layer, convert them into interface signals compatible with external multi-vendor cloud platforms, and issue them; it is also used to collect resource status data returned by external multi-vendor cloud platforms and perform standardized processing on the resource status data.

[0025] The data forwarding submodule is used to send the standardized resource status data back to the unified management and control layer.

[0026] Optionally, the service mesh control plane is built based on domestic middleware and includes:

[0027] The policy parsing submodule is used to receive standard control signals issued by the unified management and control layer, parse the service mesh governance policy in the standard control signals, and generate traffic governance instructions.

[0028] The instruction issuing submodule is used to issue the traffic governance instruction to the data plane;

[0029] The status aggregation submodule is used to collect the data forwarding status and service operation status returned by the data plane, aggregate them into policy execution status data, and return them to the unified management and control layer.

[0030] Optionally, the data plane is a Sidecar proxy adapted to the LoongArch architecture, deployed on each microservice node, including:

[0031] The policy execution submodule is used to receive traffic management instructions issued by the service mesh control plane and execute the corresponding traffic management operations;

[0032] The network forwarding optimization submodule configures the network I / O processing flow and memory access logic for the LoongArch instruction set.

[0033] The national cryptographic encryption submodule integrates SM2 / SM3 / SM4 national cryptographic algorithms for end-to-end encryption processing of inter-service communication;

[0034] The status feedback submodule is used to collect policy execution results, data forwarding status and service operation status, and feed them back to the service mesh control plane.

[0035] Optionally, the device further includes a monitoring and logging module, which is bidirectionally connected to the unified management and control layer, the service mesh control plane, and the data plane, respectively.

[0036] The monitoring and logging module collects hardware resource load, service mesh performance indicators, and cloud resource usage status through the domestic Prometheus exporter; it is also used to store user operation logs, system running events, and policy execution records in the domestic DM database, supporting SQL queries, audit traceability, and export of compliance reports.

[0037] Optionally, the bidirectional signal connection adopts wired or wireless transmission methods;

[0038] The wired transmission is based on RS485 bus, Ethernet, or power line carrier communication;

[0039] The wireless transmission is based on LoRa, WiFi, or 5G narrowband communication;

[0040] The communication connection uses HTTP / HTTPS protocol or dedicated API communication protocol of each cloud platform.

[0041] Optionally, traffic governance instructions include one or more of the following: weight-based traffic distribution instructions, service circuit breaker triggering instructions, fault injection simulation instructions, request timeout control instructions, and automatic retry instructions.

[0042] The network-wide operational status data includes one or more of the following: service communication latency, data packet forwarding success rate, national cryptographic encryption execution status, cloud resource load rate, policy execution results, and cross-cloud synchronization status.

[0043] Based on the same inventive concept, this invention also provides a management and control method for a service mesh cloud platform based on the Loongson architecture, including:

[0044] The domestic hardware support layer is activated, and the Loongson LoongArch architecture driver, domestic operating system, and domestic security components are loaded.

[0045] The unified management and control layer receives user configuration instructions, and the unified management and control API gateway module converts the user configuration instructions into standard control signals, which are then sent to the cloud adaptation layer and service mesh control plane respectively.

[0046] The cloud adaptation layer receives the standard control signal, converts it into an interface signal compatible with various external multi-vendor cloud platforms, and then sends it out. At the same time, it collects resource status data from each cloud platform, standardizes it, and sends it back to the unified management and control layer.

[0047] The service mesh control plane receives the standard control signals based on domestic middleware, parses and generates traffic governance instructions, and sends them to the data plane deployed on each microservice node.

[0048] The data plane receives the traffic management instructions, optimizes network forwarding based on the Loongson architecture, and integrates national cryptographic algorithms to achieve encrypted inter-service communication.

[0049] The data plane generates data forwarding status and service operation status information and feeds it back to the service mesh control plane; the service mesh control plane then aggregates this information into policy execution status.

[0050] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0051] This invention provides a management and control device and method for a service mesh cloud platform based on the Loongson architecture. By incorporating a domestically produced hardware support layer based on the Loongson architecture, this invention eliminates reliance on foreign commercial architectures such as x86 and ARM at the core hardware level, providing a self-controllable hardware operation and data interaction foundation for the entire management and control device. Through a unified management and control layer with bidirectional signal connections to the cloud adaptation layer and the service mesh control plane, it enables unified reception, conversion, and standardized distribution of user configuration commands. Simultaneously, it can achieve unified collection and aggregation of multi-source data collection from the cloud adaptation layer, policy execution status data from the service mesh control plane, and operational status data from the data plane, enabling centralized management and control of cloud resources and service mesh governance in a multi-cloud environment. Furthermore, through the cloud adaptation layer's communication connections with the unified management and control layer and external multi-vendor cloud platforms, it can transmit standard control signals to different cloud platforms. The cloud platform is compatible with the conversion and distribution of interface signals, and simultaneously collects and standardizes the return of resource status data from multiple external cloud platforms. This not only helps to shield the differences in interface protocols between different cloud platforms and achieve unified management and control commands across cloud platforms, but also facilitates the establishment of a bidirectional data link between the unified management and control layer and the external multi-cloud environment, ensuring the consistency and manageability of multi-cloud resource data. Through the service mesh control plane, an end-to-end link from the unified management and control policy to the microservice execution node can be established, ensuring the accurate implementation of service governance policies. Through the data plane deployed on each microservice node and bidirectionally connected to the service mesh control plane, traffic governance commands can be received and executed. The network forwarding process optimization based on the LoongArch architecture helps to ensure the adaptability of data packet forwarding in the domestic IT innovation environment. The integration of national cryptographic algorithms helps to achieve end-to-end secure encryption of inter-service communication and synchronously complete the feedback of data forwarding status and service operation status. Attached Figure Description

[0052] Figure 1 This invention provides a schematic diagram of the composition of a management and control device for a domestic IT service mesh cloud platform based on the Loongson architecture. Detailed Implementation

[0053] This invention proposes a management and control device and method for a domestic IT service mesh cloud platform based on the Loongson architecture. The specific embodiments of this invention will be further described in detail below with reference to the accompanying drawings.

[0054] Example 1:

[0055] This invention provides a management and control device for a domestic IT service mesh cloud platform based on the Loongson architecture, as shown in the schematic diagram below. Figure 1 As shown, it includes:

[0056] Domestic hardware support layer, unified management and control layer, cloud adaptation layer, service mesh control plane and data plane;

[0057] The domestically produced hardware support layer processor adopts the LoongArch architecture, is compatible with domestic operating systems and domestic security components, and provides the physical foundation for hardware operation support and data interaction for the unified management and control layer, cloud adaptation layer, service mesh control plane and data plane;

[0058] The unified management and control layer is bidirectionally connected to the cloud adaptation layer and the service mesh control plane, respectively. It is used to receive user configuration instructions and convert them into standard control signals, and send the standard control signals to the cloud adaptation layer and the service mesh control plane. At the same time, it collects resource status data returned by the cloud adaptation layer, policy execution status data returned by the service mesh control plane, and operation status data fed back by the data plane, and summarizes them into network-wide operation status data and displays them.

[0059] The cloud adaptation layer is communicatively connected to the unified management and control layer and external multi-vendor cloud platforms, respectively. It is used to receive standard control signals issued by the unified management and control layer, convert them into interface signals compatible with each external multi-vendor cloud platform, and then issue them to the corresponding external multi-vendor cloud platforms. At the same time, it collects resource status data returned by the external multi-vendor cloud platforms and sends it back to the unified management and control layer.

[0060] The service mesh control plane is bidirectionally connected to the unified management and control layer and the data plane, respectively. It is used to parse the service mesh governance strategy in the standard control signal, generate traffic governance instructions and send them to the data plane. At the same time, it collects the data forwarding status and service operation status returned by the data plane, summarizes them into policy execution status data and sends them back to the unified management and control layer.

[0061] The data plane is deployed on each microservice node and is bidirectionally connected to the service mesh control plane. It is used to receive and execute traffic management instructions issued by the service mesh control plane, optimize the network forwarding process based on the LoongArch architecture, integrate national cryptographic algorithms to encrypt inter-service communication, and feed back the data forwarding status and service running status to the service mesh control plane.

[0062] In one implementation, the domestically produced hardware support layer may include:

[0063] Loongson CPU modules support the LoongArch instruction set, such as Loongson 3A6000 and above models;

[0064] The domestically developed operating system module can be equipped with UnionTech UOS or Kylin OS and has passed the domestic operating system compatibility certification.

[0065] Domestic security components may include cryptographic modules that integrate SM2 / SM3 / SM4 national cryptographic algorithms and domestic NVMe SSD storage devices that support hardware encryption;

[0066] The redundant power supply module supports dual redundant power inputs and features a standard chassis structure that is dustproof and shockproof.

[0067] In this implementation, the domestically produced operating system module is equipped with UnionTech UOS or Kylin OS and has passed compatibility certification. It can be well adapted to Loongson CPU and upper-layer functional modules, avoiding system compatibility failures and ensuring the overall stability of the device. The domestic security components, including the national cryptographic algorithm cryptographic module and the hardware-encrypted NVMe SSD storage device, can achieve full-process secure encryption of data transmission and storage, meeting the information security compliance requirements in the domestic IT innovation scenario and preventing data leakage risks. Furthermore, the redundant power supply module supports dual redundant power input and has a dustproof and shockproof standard chassis structure, which can effectively prevent device shutdown due to power failure or harsh environmental factors, thereby ensuring the long-term continuous and stable operation of the control device.

[0068] In one implementation, the unified management layer may include:

[0069] The unified management interface module is a visual interactive interface used to receive user configuration commands and display network-wide operational status data.

[0070] The unified management API gateway module is used to convert user configuration commands into standard control signals, send the standard control signals to the cloud adaptation layer and service mesh control plane, and perform legality verification and format conversion on the user configuration commands.

[0071] The unified authentication and authorization module integrates domestic operating system accounts and authentication mechanisms from various cloud platforms, supports role-based access control, and records user operation logs.

[0072] Specifically, in this implementation, the unified management interface module can adopt the Vue 3.0+ElementPlus+TypeScript technology stack, including a service mesh management sub-interface and a multi-cloud resource management sub-interface;

[0073] The unified management API gateway module can adopt the RESTful / gRPC protocol to uniformly receive control commands from the unified management interface module and perform legality verification and format conversion on the commands.

[0074] In this implementation, the interface module is managed using Vue 3.0 + Element. The Plus+TypeScript technology stack integrates service mesh management and multi-cloud resource management sub-interfaces, providing users with a single visual interactive entry point. Users can complete operations such as service mesh policy configuration and cloud resource status viewing without cross-platform login, intuitively presenting network-wide operational data. This significantly lowers the operational threshold for collaborative management of multi-cloud and service mesh. The unified management API gateway module, relying on the RESTful / gRPC protocol, uniformly receives control commands, performing legality verification, format conversion, and standardized distribution. This effectively shields the interface differences between lower-level modules, ensuring accurate and efficient transmission of control commands to the cloud adaptation layer and service mesh control plane, avoiding execution anomalies caused by non-standard command formats. The unified authentication and authorization module integrates domestic operating system accounts and authentication mechanisms from various cloud platforms, supporting role-based access control and recording user operation logs. This enables end-to-end identity authentication and permission control, ensuring the security of management operations, preventing unauthorized access and unauthorized operations, and meeting the compliance audit and operation traceability needs in the context of domestic IT innovation through log retention. This improves the overall adaptability, security, and operability of the unified management layer.

[0075] In one implementation, the cloud adaptation layer adopts a plug-in architecture and may include:

[0076] The unified API interface sublayer defines a bidirectional standard interface, which includes a standard management interface and a standard data return interface, used to shield the interface protocol differences of various external multi-vendor cloud platforms.

[0077] The cloud platform adaptation plugin sublayer is used to receive standard control signals issued by the unified management and control layer, convert them into interface signals compatible with external multi-vendor cloud platforms, and issue them; it is also used to collect resource status data returned by external multi-vendor cloud platforms and perform standardized processing on the resource status data.

[0078] The data forwarding submodule is used to send the standardized resource status data back to the unified management and control layer;

[0079] In this implementation, the external multi-vendor cloud platform may include a public cloud platform and a private cloud platform;

[0080] The public cloud platform may include Alibaba Cloud, Tencent Cloud, Huawei Cloud, and Baidu Cloud;

[0081] The private cloud platform may include OpenStack and domestically developed container cloud platforms;

[0082] In this implementation, a unified API interface sublayer defines bidirectional standard interfaces, which directly shields the differences in interface protocols between public clouds such as Alibaba Cloud, Tencent Cloud, Huawei Cloud, and Baidu Cloud, as well as private clouds such as OpenStack and domestic container clouds. This allows the upper unified management layer to achieve cross-cloud interaction without needing to adapt to the private protocols of various vendors. The cloud platform adaptation plugin sublayer can complete the conversion of standard control signals to signals compatible with various cloud platforms, as well as the standardized processing of resource status data returned by cloud platforms. This ensures that management commands are accurately sent to the corresponding cloud platforms and that the status data format of heterogeneous clouds is unified, avoiding command failures or abnormal data collection due to protocol incompatibility. The data forwarding submodule can stably transmit the standardized resource status data back to the unified management layer, forming a complete bidirectional link for command issuance and status feedback, ensuring a closed loop in the cross-cloud management process.

[0083] In one implementation, the service mesh control plane is built based on domestic middleware and may include:

[0084] The policy parsing submodule is used to receive standard control signals issued by the unified management and control layer, parse the service mesh governance policy in the standard control signals, and generate traffic governance instructions.

[0085] The instruction issuing submodule is used to issue the traffic governance instruction to the data plane;

[0086] The status aggregation submodule is used to collect the data forwarding status and service operation status returned by the data plane, aggregate them into policy execution status data, and return them to the unified management and control layer.

[0087] In this implementation, the policy parsing submodule accurately receives standard control signals from the unified management and control layer, precisely parses the service mesh governance policies contained therein, and generates corresponding traffic governance instructions. This effectively avoids governance operation failures caused by policy parsing deviations, ensuring that the upper-layer management intent can be accurately translated into executable instructions. The instruction delivery submodule stably delivers the generated traffic governance instructions to the data plane, ensuring that the service mesh governance policies are accurately implemented at each microservice node, achieving efficient transmission of governance instructions. The status aggregation submodule collects the data forwarding status and service operation status returned from the data plane in real time, aggregates them into standardized policy execution status data, and sends it back to the unified management and control layer. This allows the unified management and control layer to clearly understand the actual execution status of each governance policy, facilitating timely adjustment and optimization of policies.

[0088] In one implementation, the data plane can be adapted to the Sidecar proxy of the LoongArch architecture and deployed on each microservice node, including:

[0089] The policy execution submodule is used to receive traffic management instructions issued by the service mesh control plane and execute the corresponding traffic management operations;

[0090] The network forwarding optimization submodule configures the network I / O processing flow and memory access logic for the LoongArch instruction set.

[0091] The national cryptographic encryption submodule integrates SM2 / SM3 / SM4 national cryptographic algorithms for end-to-end encryption processing of inter-service communication;

[0092] The status feedback submodule is used to collect policy execution results, data forwarding status and service operation status, and feed them back to the service mesh control plane.

[0093] In this implementation, the policy execution submodule accurately receives traffic governance commands from the service mesh control plane and completes corresponding governance operations, ensuring that upper-layer governance policies are implemented and executed on the microservice side. The network forwarding optimization submodule customizes network I / O processing flow and memory access logic for the LoongArch instruction set, which can be deeply adapted to Loongson hardware, improving the forwarding efficiency and stability of data between microservices. The national cryptographic encryption submodule integrates SM2 / SM3 / SM4 national cryptographic algorithms to achieve end-to-end encryption of inter-service communication, meeting the security and compliance requirements in the domestic IT innovation scenario and preventing communication data from being stolen or tampered with. The status feedback submodule collects policy execution results, data forwarding, and service operation status in real time and sends them back to the control plane, forming a closed loop of command execution and status feedback. At the same time, the overall architecture is deeply adapted to the Loongson LoongArch architecture, which can solve the problem of insufficient support for domestic hardware in the traditional data plane, ensuring the governance effect while taking into account hardware compatibility, communication security, and operational stability.

[0094] In one implementation, the control device may further include a monitoring and logging module, which is bidirectionally connected to the unified control layer, the service mesh control plane, and the data plane.

[0095] The monitoring and logging module collects hardware resource load, service mesh performance indicators and cloud resource usage status through the domestic Prometheus exporter; it is also used to store user operation logs, system running events and policy execution records in the domestic DM database, supporting SQL queries, audit traceability and compliance report export.

[0096] In this implementation, by adding monitoring and logging modules to establish bidirectional signal connections with the unified management and control layer, service mesh control plane, and data plane respectively, it is possible to achieve full coverage collection of operational data across the entire device chain. By using the domestic Prometheus exporter, hardware resource load, service mesh performance, and cloud resource usage status can be accurately obtained, reflecting the operational status of each link of the device in real time and facilitating timely detection of anomalies. At the same time, user operation logs, system operation events, and policy execution records are uniformly stored in the domestic DM database, which not only achieves domestic and secure storage of log data, avoiding the security risks caused by relying on foreign databases, but also supports SQL queries, audit traceability, and compliance report export. It can quickly locate operational faults and verify operational behaviors, meeting the operation and maintenance troubleshooting and compliance auditing needs in the context of information technology innovation. Overall, it provides reliable data support and traceability guarantee for the stable operation, security management, and compliant use of the device.

[0097] In one implementation, the bidirectional signal connection can be achieved using wired or wireless transmission methods;

[0098] The wired transmission is based on RS485 bus, Ethernet, or power line carrier communication;

[0099] The wireless transmission is based on LoRa, WiFi, or 5G narrowband communication;

[0100] The communication connection uses HTTP / HTTPS protocol or dedicated API communication protocol of each cloud platform.

[0101] For example, the traffic governance instructions may include one or more of the following: weighted traffic distribution instructions, service circuit breaker trigger instructions, fault injection simulation instructions, request timeout control instructions, and automatic retry instructions;

[0102] The network-wide operational status data may include one or more of the following: service communication latency, data packet forwarding success rate, national cryptographic encryption execution status, cloud resource load rate, policy execution results, and cross-cloud synchronization status.

[0103] In this implementation, by setting the signal transmission method, communication protocol, traffic management commands, and network-wide operational status data, the adaptability and accuracy of the control device can be improved. The bidirectional signal connection supports multiple transmission methods, including wired and wireless, which can be flexibly selected according to different deployment environments such as data centers and distributed nodes. It balances communication stability in fixed scenarios with flexibility in remote deployment, adapting to diverse hardware deployment conditions in the context of domestic IT innovation. The communication protocol is compatible with general HTTP / HTTPS protocols and dedicated API protocols of various cloud platforms, ensuring both the universality of basic communication and precise integration with different cloud platforms, avoiding communication compatibility failures. Meanwhile, traffic management commands cover various types, including traffic distribution, service circuit breaking, fault injection, timeout control, and automatic retry, meeting the governance and control needs of microservices across all scenarios. The network-wide operational status data covers multi-dimensional information such as service communication, data forwarding, encryption execution, resource load, policy execution, and cross-cloud synchronization, comprehensively reflecting the actual operational status of the device and cloud platforms. This provides detailed data support for policy adjustment, fault diagnosis, and operation and maintenance management, ensuring the stability, adaptability, comprehensiveness, and accuracy of device communication and control.

[0104] In summary, the proposed management and control device for a domestically developed service mesh cloud platform based on the Loongson architecture enables full-stack domestic service mesh management and control. Based on the LoongArch architecture, it achieves full-stack adaptation from CPU, operating system, middleware to the application layer, realizing independent control from hardware to software. Furthermore, it specifically optimizes the data plane for domestically produced hardware, effectively improving the device's performance and security. Simultaneously, it adopts a cross-cloud unified management and control architecture, enabling unified management and policy distribution for various public and private cloud service meshes through a unified API adaptation layer and web interface. It also seamlessly integrates with existing multi-cloud resource management systems, resolving the disconnect between resource management and service governance. In addition, it specifically optimizes the service mesh data plane for the domestically developed environment, optimizes the instruction set and memory access of the Sidecar proxy for the Loongson architecture, and integrates national cryptographic algorithms, significantly improving the security and forwarding efficiency of inter-service communication. Finally, it employs a modular plug-in architecture, supporting rapid access to more cloud platforms and service mesh standards in the future, possessing good scalability and ecosystem compatibility. Overall, it meets the key domain requirements for domestically developed, highly secure, highly reliable, easily manageable, and scalable service mesh management in the domestically developed scenario.

[0105] Example 2:

[0106] The present invention provides a management and control device for a domestic IT service mesh cloud platform based on the Loongson architecture, using a specific embodiment. The hardware platform configuration is shown in Table 1.

[0107] Table 1 Hardware Platform Configuration

[0108] Components Specifications CPU The Loongson 3A6000 has a clock speed of 2.5GHz, supports the LoongArch instruction set, and features 4 cores and 8 threads. Memory DDR4 32GB, supports ECC verification, frequency 2666MHz storage 1TB NVMe SSD (Chinese model), supports hardware encryption Network card Dual Gigabit Ethernet cards (supporting domestically produced cryptographic modules), with optional 10 Gigabit optical modules. operating system UOS-desktop-1070 (Tongxin Desktop Operating System), kernel version 4.19 and above. Power supply and chassis Supports redundant power supplies; the chassis conforms to national standards and features dustproof and shockproof design.

[0109] The software structure is set as follows:

[0110] (1) Front-end interface (Web UI)

[0111] The technology stack can include: Vue 3.0 + Element Plus + TypeScript + ECharts

[0112] The front-end interface can include: a service mesh management interface, a service topology diagram (used to display the call relationships and traffic status between microservices in real time), policy configuration (supporting the visual configuration and distribution of routing rules, circuit breaker policies, and security policies), a monitoring view (integrated with Prometheus + Grafana to display service performance metrics such as QPS, latency, and error rate), and a multi-cloud resource management interface (where virtual machine management supports instance start-up, shutdown, monitoring, and billing for Alibaba Cloud ECS, Tencent Cloud CVM, Huawei Cloud ECS, and Baidu Cloud BCC; container cluster management supports the creation and management of namespaces, Pods, and Services for Kubernetes clusters; network management supports the configuration and binding of VPCs, subnets, security groups, and elastic public IPs; user permission management supports role-based permission allocation and auditing based on resource groups; and interactive features include drag-and-drop policy configuration, real-time log streaming display, and multiple theme switching, such as light / dark mode).

[0113] (2) Backend services

[0114] The technology stack can include: Spring Boot 2.7 + JDK 11 + MyBatis + Redis (a domestic alternative to Tendis).

[0115] The core modules can include: a unified authentication and authorization module (integrating UOS system accounts with AK / SKs from various cloud platforms to achieve single sign-on, supporting role-based access control such as RBAC, and fine-grained permission management); a service mesh control module (integrating a domestic service mesh control plane, such as Envoy and a domestic control panel, supporting service registration and discovery, load balancing, circuit breaking and degradation, traffic mirroring, and fault injection); a cloud adaptation layer module (developing unified adaptation plugins for various cloud platforms, abstracting them into standard APIs, and supporting cross-platform synchronization and conflict detection of service mesh policies); and a monitoring and logging module (integrating Prometheus exporter to collect service mesh and resource metrics; logs are centrally stored in a domestic database, such as DM Database, supporting SQL queries and audit export).

[0116] (3) Cross-cloud adaptation layer implementation

[0117] Adapt to plugin architecture (unified API interface layer, plugin manager)

[0118] The plugin implements the following functions: converting the service mesh APIs of various cloud platforms into standard interfaces, supporting policy version management and rollback, and supporting asynchronous task queues to ensure the consistency of policy distribution.

[0119] (4) Service Grid Data Plane Optimization

[0120] This mainly includes: Sidecar proxy (for example, the domestic version of Envoy can optimize network I / O processing for the LoongArch instruction set, improve packet forwarding performance; and integrate national cryptographic algorithms (such as SM2 / SM3 / SM4) to support end-to-end encryption of inter-service communication; in addition, it can also support hardware cryptographic module acceleration to reduce encryption latency) and traffic governance strategies (supporting weight-based traffic distribution, supporting chaos engineering testing based on fault injection, and supporting request-level timeout and retry configuration).

[0121] Supported by the aforementioned hardware configuration and software structure, the specific workflow of the management and control device for the domestically developed service mesh cloud platform based on the Loongson architecture is as follows: Step 1 is system initialization and authentication. After system startup, the hardware driver and operating system kernel module are loaded. The system connects to each cloud platform through the unified authentication module and obtains access tokens and permission lists, synchronizing the service mesh instances and resource lists of each cloud platform; Step 2 is service discovery and registration. The system automatically scans for Kubernetes-based services on each cloud platform. Microservice instances tagged with Service or VM are registered to a unified service directory built on the TongWeb domestic middleware. Step 3 is policy configuration and distribution. Users complete the configuration of service mesh policies such as routing rules and security policies through the web interface, convert the policies into a standard format compatible with various cloud platforms, and complete the distribution through the cross-cloud adaptation layer's adaptation plugin. It also supports batch policy distribution and version management to ensure cross-cloud policy consistency. Step 4 is traffic monitoring and governance. The device collects traffic data from each Sidecar agent in real time and aggregates it to the monitoring center. It provides a visual display of CPU, memory, network and other resource usage, and supports intelligent alarms and automatic elastic scaling based on threshold triggers. Step 5 is security and auditing. By default, the national cryptographic algorithm is enabled to encrypt all inter-service communication. User operation logs and system events are recorded throughout the process and stored in a domestic database. Finally, it supports the export of compliant audit reports in PDF and Excel formats.

[0122] This embodiment demonstrates that the service mesh cloud platform management device based on the Loongson architecture proposed in this invention effectively solves the technical problems of existing service mesh management platforms, such as reliance on foreign hardware and software architectures, inconsistent cross-cloud management, insufficient domestic adaptation, and lack of security and compliance. Through a unified interactive design of the front-end interface, the construction of a domestic technology stack for back-end services, the implementation of a plug-in architecture for the cross-cloud adaptation layer, and targeted optimization of the service mesh data plane, it not only achieves full-stack domestic adaptation of the underlying hardware (Loongson LoongArch architecture), operating system, middleware, and database, but also completely eliminates dependence on foreign x86 architectures, operating systems, and middleware, ensuring supply chain security and reliability. In addition to ensuring compliance, the unified management interface, standardized policy distribution, and multi-source data aggregation facilitate unified management and control of service mesh and cloud resources in a multi-cloud environment, significantly reducing multi-cloud operation and maintenance costs and management complexity. At the same time, through the optimization of network forwarding for the Loongson architecture and the integration of national cryptographic algorithms by the Sidecar proxy, the performance and security of inter-service communication can be effectively improved, thereby ensuring the reliability and traceability of device operation. Ultimately, it achieves a deep integration of refined governance of microservice mesh and collaborative management and control of multi-cloud resources in the context of information technology innovation, which can fully meet the actual application needs of key fields such as government affairs, finance, and energy for domestically produced, highly secure, highly reliable, and easily manageable service mesh cloud platform management devices.

[0123] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0124] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0125] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0126] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0127] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit its scope of protection. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that after reading the present invention, they can still make various changes, modifications or equivalent substitutions to the specific implementation methods of the application, but these changes, modifications or equivalent substitutions are all within the scope of protection of the claims pending approval.

Claims

1. A management and control device for a domestic IT service mesh cloud platform based on Loongson architecture, characterized in that, include: Domestic hardware support layer, unified management and control layer, cloud adaptation layer, service mesh control plane and data plane; The domestically produced hardware support layer processor adopts the LoongArch architecture, is compatible with domestic operating systems and domestic security components, and provides the physical foundation for hardware operation support and data interaction for the unified management and control layer, cloud adaptation layer, service mesh control plane and data plane; The unified management and control layer is bidirectionally connected to the cloud adaptation layer and the service mesh control plane, respectively. It is used to receive user configuration instructions and convert them into standard control signals, and send the standard control signals to the cloud adaptation layer and the service mesh control plane. At the same time, it collects resource status data returned by the cloud adaptation layer, policy execution status data returned by the service mesh control plane, and operation status data fed back by the data plane, and summarizes them into network-wide operation status data and displays them. The cloud adaptation layer is communicatively connected to the unified management and control layer and external multi-vendor cloud platforms, respectively. It is used to receive standard control signals issued by the unified management and control layer, convert them into interface signals compatible with each external multi-vendor cloud platform, and then issue them to the corresponding external multi-vendor cloud platforms. At the same time, it collects resource status data returned by the external multi-vendor cloud platforms and sends it back to the unified management and control layer. The service mesh control plane is bidirectionally connected to the unified management and control layer and the data plane, respectively. It is used to parse the service mesh governance strategy in the standard control signal, generate traffic governance instructions and send them to the data plane. At the same time, it collects the data forwarding status and service operation status returned by the data plane, summarizes them into policy execution status data and sends them back to the unified management and control layer. The data plane is deployed on each microservice node and is bidirectionally connected to the service mesh control plane. It is used to receive and execute traffic management instructions issued by the service mesh control plane, optimize the network forwarding process based on the LoongArch architecture, integrate national cryptographic algorithms to encrypt inter-service communication, and feed back the data forwarding status and service running status to the service mesh control plane.

2. The apparatus as claimed in claim 1, characterized in that, The domestically produced hardware support layer includes: Loongson CPU modules support the LoongArch instruction set; The domestically produced operating system module is equipped with UnionTech UOS or Kylin OS and has passed the domestic operating system compatibility certification. Domestic security components include cryptographic modules integrating SM2 / SM3 / SM4 national cryptographic algorithms and domestic NVMe SSD storage devices that support hardware encryption; The redundant power supply module supports dual redundant power inputs and features a standard chassis structure that is dustproof and shockproof.

3. The apparatus as described in claim 1, characterized in that, The unified management and control layer includes: The unified management interface module is a visual interactive interface used to receive user configuration commands and display network-wide operational status data. The unified management API gateway module is used to convert user configuration commands into standard control signals, send the standard control signals to the cloud adaptation layer and service mesh control plane, and perform legality verification and format conversion on the user configuration commands. The unified authentication and authorization module integrates domestic operating system accounts and authentication mechanisms from various cloud platforms, supports role-based access control, and records user operation logs.

4. The apparatus as claimed in claim 1, characterized in that, The cloud adaptation layer adopts a plug-in architecture, including: The unified API interface sublayer defines a bidirectional standard interface, which includes a standard management interface and a standard data return interface, used to shield the interface protocol differences of various external multi-vendor cloud platforms. The cloud platform adaptation plugin sublayer is used to receive standard control signals issued by the unified management and control layer, convert them into interface signals compatible with external multi-vendor cloud platforms, and issue them; it is also used to collect resource status data returned by external multi-vendor cloud platforms and perform standardized processing on the resource status data. The data forwarding submodule is used to send the standardized resource status data back to the unified management and control layer.

5. The apparatus as claimed in claim 1, characterized in that, The service mesh control plane is built based on domestic middleware and includes: The policy parsing submodule is used to receive standard control signals issued by the unified management and control layer, parse the service mesh governance policy in the standard control signals, and generate traffic governance instructions. The instruction issuing submodule is used to issue the traffic governance instruction to the data plane; The status aggregation submodule is used to collect the data forwarding status and service operation status returned by the data plane, aggregate them into policy execution status data, and return them to the unified management and control layer.

6. The apparatus as claimed in claim 1, characterized in that, The data plane is a Sidecar proxy adapted to the LoongArch architecture, deployed on each microservice node, including: The policy execution submodule is used to receive traffic management instructions issued by the service mesh control plane and execute the corresponding traffic management operations; The network forwarding optimization submodule configures the network I / O processing flow and memory access logic for the LoongArch instruction set. The national cryptographic encryption submodule integrates SM2 / SM3 / SM4 national cryptographic algorithms for end-to-end encryption processing of inter-service communication; The status feedback submodule is used to collect policy execution results, data forwarding status and service operation status, and feed them back to the service mesh control plane.

7. The apparatus as claimed in claim 1, characterized in that, The control device also includes a monitoring and logging module, which is bidirectionally connected to the unified control layer, the service mesh control plane, and the data plane. The monitoring and logging module collects hardware resource load, service mesh performance indicators, and cloud resource usage status through the domestic Prometheus exporter; it is also used to store user operation logs, system running events, and policy execution records in the domestic DM database, supporting SQL queries, audit traceability, and export of compliance reports.

8. The apparatus as claimed in claim 1, characterized in that, The bidirectional signal connection adopts either wired or wireless transmission methods; The wired transmission is based on RS485 bus, Ethernet, or power line carrier communication; The wireless transmission is based on LoRa, WiFi, or 5G narrowband communication; The communication connection uses HTTP / HTTPS protocol or dedicated API communication protocol of each cloud platform.

9. The apparatus as claimed in claim 1, characterized in that, The traffic management instructions include one or more of the following: weighted traffic distribution instructions, service circuit breaker trigger instructions, fault injection simulation instructions, request timeout control instructions, and automatic retry instructions. The network-wide operational status data includes one or more of the following: service communication latency, data packet forwarding success rate, national cryptographic encryption execution status, cloud resource load rate, policy execution results, and cross-cloud synchronization status.

10. A management and control method for a service mesh cloud platform based on Loongson architecture, characterized in that, The control device for the domestically developed service mesh cloud platform based on the Loongson architecture, as described in any one of claims 1-9, comprises: The domestic hardware support layer is activated, and the Loongson LoongArch architecture driver, domestic operating system, and domestic security components are loaded. The unified management and control layer receives user configuration instructions, and the unified management and control API gateway module converts the user configuration instructions into standard control signals, which are then sent to the cloud adaptation layer and service mesh control plane respectively. The cloud adaptation layer receives the standard control signal, converts it into an interface signal compatible with various external multi-vendor cloud platforms, and then sends it out. At the same time, it collects resource status data from each cloud platform, standardizes it, and sends it back to the unified management and control layer. The service mesh control plane receives the standard control signals based on domestic middleware, parses and generates traffic governance instructions, and sends them to the data plane deployed on each microservice node. The data plane receives the traffic management instructions, optimizes network forwarding based on the Loongson architecture, and integrates national cryptographic algorithms to achieve encrypted inter-service communication. The data plane generates data forwarding status and service operation status information and feeds it back to the service mesh control plane; the service mesh control plane then aggregates this information into policy execution status.

Images