Configuration-based method and device for isolated operation of microservice, and medium

Abstract

The present application relates to the field of electronic digital data processing. Disclosed are a configuration-based method and device for isolated operation of a microservice, and a medium. The method comprises: defining isolation policies, and generating a configuration file; deploying the configuration file into a Kubernetes cluster, and validating and loading the isolation policies by means of a built-in loader; for the types corresponding to the isolation policies, parsing the isolation policies by means of corresponding parsers, and returning the corresponding parsing results; and calling policy scheduling engines on the basis of the parsing results, and calling corresponding policy executors to perform scheduling operations and execution operations on the isolation policies of the types, so as to realize isolated operation of a microservice. Isolation policies for the operation of a microservice are set at both a deployment level and a network level on the basis of a configuration. The definitions of the isolation policies are configured to realize isolation protection during the operation of the microservice, thereby ensuring minimal interference between microservices.

Description

A configuration-based microservice isolation operation method, device and medium

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on April 1, 2024, with application number 202410382864.8 and invention name “A configuration-based microservice isolation operation method, device and medium”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of electronic digital data processing, and specifically to a configuration-based microservice isolation operation method, device and medium. Background Art

[0003] With the continuous evolution of cloud computing and software development methods, microservices architecture is gaining increasing attention in enterprise application development. Microservices architecture provides better scalability, flexibility, and maintainability by breaking complex applications into small, independent services.

[0004] However, with the widespread application of microservices, a series of problems will arise if microservices are not properly isolated and run.

[0005] First, when microservices share resources or run in the same environment, a single microservice error or failure can impact the entire system, leading to instability. Second, if a microservice has a security vulnerability or is subject to a malicious attack, the security of the entire system may be compromised. Finally, if communication between microservices is uncontrolled or fails, system availability and performance can be impacted.

[0006] Summary of the Invention

[0007] To solve the above problems, this application proposes a configuration-based microservice isolation operation method, including:

[0008] Define the isolation strategy and generate a configuration file. The isolation strategy includes multiple types, including: isolation strategy effective range and microservice deployment strategy;

[0009] Deploy the configuration file to the Kubernetes cluster and verify and load the isolation policy through the built-in loader;

[0010] For the type corresponding to the isolation policy, the isolation policy is parsed by the corresponding parser and the corresponding parsing result is returned;

[0011] According to the analysis results, the policy scheduling engine is called to call the corresponding policy executor for each type of isolation policy to perform scheduling operations and execution operations to achieve isolated operation of microservices.

[0012] In one example, the isolation policy effective range determines the microservice list corresponding to the isolation policy effective range by label selection;

[0013] The microservice deployment strategy configures multiple isolation strategies for microservices within the effective range of the isolation strategy during deployment.

[0014] In one example, the microservice deployment strategy includes: a microservice node scheduling strategy, a microservice affinity strategy, and a microservice network access strategy;

[0015] The microservice node scheduling strategy is used to schedule the microservice to a specified node during deployment.

[0016] The microservice affinity policy configures whether each microservice can be deployed in the same location;

[0017] The microservice network access policy defines the communication rules between microservices, and the communication rules at least include whether communication is allowed.

[0018] In one example, for the type corresponding to the isolation policy, the isolation policy is parsed by a corresponding parser, specifically including:

[0019] Select a corresponding parser for the type of isolation policy, including: policy scope parser, node scheduling parser, microservice affinity policy parser, and network policy parser;

[0020] The isolation policy is converted into a corresponding scheduling policy entity through a corresponding parser.

[0021] In one example, the configuration structure and policy structure of the microservice node scheduling policy are consistent, including type type and rule rule, where the rule is an expression array and its supported operations include In, NotIn, Exists, DoesNotExist, Gt, and Lt;

[0022] The microservice network access policy includes a network ingress policy inPolicy and a network egress policy outPolicy.

[0023] In one example, the method further includes:

[0024] Determine, according to the microservice node scheduling strategy, multiple microservices to be scheduled to the same designated node, and determine, among the multiple microservices, several designated microservices applied to the same software node;

[0025] The microservice affinity policy is used to configure the plurality of specified microservices to be allowed to be deployed at the same location, and the microservice network access policy is used to define the plurality of specified microservices to be allowed to communicate with each other.

[0026] In one example, the method further includes:

[0027] Determining that the application system of the microservice fails or is under attack;

[0028] Determine a basic microservice among the plurality of designated microservices, where the basic microservice is applied to at least a plurality of software nodes;

[0029] The microservice network access policy is used to define dynamic communication between the basic microservice and the multiple specified microservices. Dynamic communication means that the basic microservice can only communicate with other specified microservices in one software node at the same time.

[0030] In one example, the isolation policy is verified and loaded using a built-in loader, specifically including:

[0031] Load the configuration file corresponding to the isolation policy through the LoadConfig method and ParseConfig method provided by the isolation configuration service ConfigService;

[0032] The isolation policy is parsed by a corresponding parser, specifically including:

[0033] Parse the isolation policy through the ProcessConfig method of the corresponding parser PolicyProcessEnginee;

[0034] Call the policy scheduling engine to call the corresponding policy executor for each type of isolation policy to perform scheduling operations, including:

[0035] Call the DeployPolicyProcess method in the DeployPolicyService of the policy scheduling engine and the NetworkPolicyProcess method in the NetworkPolicyService to call the corresponding policy executor for scheduling operations on each type of isolation policy.

[0036] On the other hand, this application also proposes a configuration-based microservice isolation operation device, including:

[0037] at least one processor; and,

[0038] a memory communicatively connected to the at least one processor; wherein,

[0039] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the configuration-based microservice isolation operation method as described in any of the above examples.

[0040] On the other hand, the present application also proposes a non-volatile computer storage medium storing computer executable instructions, wherein the computer executable instructions are configured as: the configuration-based microservice isolation operation method described in any of the above examples.

[0041] The configuration-based microservice isolation operation method proposed in this application can bring the following beneficial effects:

[0042] Based on configuration, set isolation policies for microservice operations at both the deployment and network levels. By defining isolation policies, you can achieve runtime isolation and protection for microservices, minimizing interference between them. This ensures that microservices are independent and isolated at runtime, with high availability and scalability, resulting in a more reliable, high-performance system with enhanced security.

[0043] Based on the Kubernetes scheduling mechanism, we dynamically configure the isolation strategy for microservice operations using configuration. This simplifies the complexity of microservice isolation operation configuration and improves the efficiency of microservice isolation operation deployment. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0045] FIG1 is a flow chart of a configuration-based microservice isolation operation method according to an embodiment of the present application;

[0046] FIG2 is a schematic diagram of a system architecture in one embodiment of the present application;

[0047] FIG3 is a schematic diagram of a method used in an implementation process under one scenario in an embodiment of the present application;

[0048] FIG4 is a schematic diagram of a microservice isolation operation device based on configuration in an embodiment of the present application. DETAILED DESCRIPTION

[0049] To make the purpose, technical solutions, and advantages of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the specific embodiments of this application and the corresponding drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0050] The following describes in detail the technical solutions provided by various embodiments of the present application in conjunction with the accompanying drawings.

[0051] As shown in FIG1 , an embodiment of the present application provides a configuration-based microservice isolation operation method, including:

[0052] S101: Define an isolation policy and generate a configuration file. The isolation policy includes multiple types, including: isolation policy effective range and microservice deployment strategy.

[0053] Defining the isolation strategy, which can also be called defining the isolation configuration, generates an isolation strategy configuration file (referred to as a configuration file for short), thereby defining the isolation strategy of the microservice.

[0054] Specifically, isolation policies include multiple types: isolation policy effectiveness scope, microservice deployment policy, and each configuration file corresponds to one of these types.

[0055] The effective scope of the isolation policy is determined by label selection to determine the microservice list corresponding to the effective scope of the isolation policy. In the microservice list, it is clear which microservices are within the effective scope of the isolation policy.

[0056] Microservice deployment strategy configures isolation strategies for multiple parts of microservices within the scope of the isolation strategy during deployment.

[0057] Furthermore, microservice deployment strategies still include multiple types: microservice node scheduling strategy, microservice affinity strategy, and microservice network access strategy.

[0058] The microservice node scheduling policy is used to configure the scheduling of microservices to specific nodes during deployment. Specifically, after deploying the isolation policy to a specific node, the isolation policy is dispatched to that node using the microservice node scheduling policy. A node can represent a microservice, a single functional module within a microservice, or a single step within a functional module.

[0059] Microservice affinity policy configures whether each microservice can be deployed in the same location to solve the problem of which microservices can be deployed together and which microservices cannot be deployed together.

[0060] Microservice network access policy defines the communication rules between microservices. The communication rules at least include whether communication is allowed. It also defines which microservices are allowed to communicate and which are not.

[0061] Through the cooperation of a total of four types of isolation strategies, the needs of microservices for isolated operation in different scenarios are supported.

[0062] S102: Deploy the configuration file to the Kubernetes cluster, and verify and load the isolation policy through the built-in loader.

[0063] Specifically, the Kubernetes cluster provides the infrastructure for deploying, managing, and scaling microservice architectures to enable microservice operations. Once the defined isolation policy configuration is deployed to the Kubernetes cluster, the isolation configuration loader in the Kubernetes cluster loads the configuration and verifies that its format and content conform to the configuration's specifications. Once these conformances are confirmed, the configuration is loaded.

[0064] S103: For the type corresponding to the isolation policy, the isolation policy is parsed by a corresponding parser, and a corresponding parsing result is returned.

[0065] As mentioned above, isolation policies correspond to multiple types, and each configuration file corresponds to a single type of isolation policy. At this time, the type of isolation policy corresponding to the verified and loaded configuration file is selected, and the corresponding parser is selected to parse the isolation policy to provide data for the next step of policy engine scheduling.

[0066] Specifically, for the type corresponding to the isolation policy, a corresponding parser is selected, and the isolation policy is converted into a corresponding scheduling policy entity through the corresponding parser. After the conversion, the parser returns the parsing result for subsequent processing.

[0067] Among them, the parsers include: policy scope parser, node scheduling parser, microservice affinity policy parser and network policy parser.

[0068] The policy scope parser parses the scope of the configured policy. The node scheduling parser supports parsing microservice node scheduling policies. The microservice affinity policy parser supports parsing microservice affinity policies. The network policy parser supports parsing network access policies between microservices.

[0069] S104: Based on the analysis result, the policy scheduling engine is called to call the corresponding policy executor for each type of isolation policy to perform scheduling operations and execution operations to achieve isolated operation of the microservice.

[0070] The policy engine scheduler calls the policy scheduling engine based on the parsing results returned by the parser, and calls different policy executors to perform scheduling operations on different isolation policies.

[0071] After the scheduling operation, the corresponding policy executor is called to perform execution operations according to different isolation strategies.

[0072] Among them, the policy executors include: node policy executors, microservice affinity policy executors and network policy executors (including network egress policy executors and network ingress policy executors). Through the execution of each executor, it is ensured that microservices are deployed according to the isolation strategy and the isolated operation of microservices is realized.

[0073] Based on configuration, set isolation policies for microservice operations at both the deployment and network levels. By defining isolation policies, you can achieve runtime isolation and protection for microservices, minimizing interference between them. This ensures that microservices are independent and isolated at runtime, with high availability and scalability, resulting in a more reliable, high-performance system with enhanced security.

[0074] Based on the Kubernetes scheduling mechanism, we dynamically configure the isolation strategy for microservice operations using configuration. This simplifies the complexity of microservice isolation operation configuration and improves the efficiency of microservice isolation operation deployment.

[0075] In one embodiment, as shown in Figures 2 and 3, the isolation policy includes multiple types: the isolation policy effective range MicroServiceSelector, the microservice deployment policy DeployPolicy, and the microservice deployment policy includes: the node scheduling policy Node, the microservice affinity policy MicroService, and the network access policy NetworkPolicy.

[0076] Among them, the configuration structure and policy structure of the microservice node scheduling strategy are consistent, including type type and rule rule. Among them, the rule is an expression array, and its supported operations include In, NotIn, Exists, DoesNotExist, Gt, and Lt.

[0077] Network access policies include network ingress policy (inPolicy) and network egress policy (outPolicy).

[0078] When the isolation policy is loaded, the configuration file is loaded through the LoadConfig method and ParseConfig method provided by the isolation configuration service ConfigService.

[0079] When parsing the isolation policy, according to the type of isolation policy, the ProcessConfig method of the corresponding parser PolicyProcessEnginee is selected for parsing. The parser converts the loaded configuration file into the corresponding scheduling policy entity according to its different type, providing data for the next step of policy engine scheduling.

[0080] The main attributes of the parsed scheduling policy entity IsolationPolicyEntity include: IsolationPolicyMetadata is the metadata information that defines some entities, such as name, label, annotation, etc.; IsolationPolicySpec is the definition of isolation policy, mainly including MicroServiceSelector (microservice isolation effective scope definition), DeoloyPolicy (microservice deployment policy definition) and NetworkPolicy (microservice network access policy definition).

[0081] When the policy engine is scheduling, the DeployPolicyProcess method in the policy scheduling engine's microservice deployment policy service DeployPolicyService and the NetworkPolicyProcess method in the network access policy service NetworkPolicyService are called, and different policy executors are called for different configurations to perform scheduling operations.

[0082] When the policy executor is executed, different policy executors are called for execution according to different types of isolation policies. The policy executors include: node policy executor NodePolicyService (used to execute the NodePolicyProcess method), microservice affinity policy executor MicroServicePolicyService (used to execute the MicroServicePolicyProcess method), network policy executor (including InPolicyService and OutPolicyService, which are network entry policy executors and network exit policy executors, respectively used to execute the InPolicyProcess method and the OutPolicyProcess method, respectively). The execution of each policy executor ensures that the microservices are deployed according to the isolation policy and realizes the isolated operation of the microservices.

[0083] In one embodiment, when scheduling according to a microservice node scheduling policy, multiple microservices may be scheduled to the same node (a node in a Kubernetes cluster may refer to a Pod, which is the smallest scheduling unit and may include one or more container instances). In this case, multiple microservices scheduled to the same designated node are determined, and among these multiple microservices, several designated microservices applied to the same software node are determined. A software node may refer to a software application or a functional module within an application.

[0084] At this time, these several designated microservices are closely related to each other, so through the microservice affinity policy, several designated microservices are configured to be allowed to be deployed in the same location, and through the microservice network access policy, it is defined that several designated microservices are allowed to communicate with each other, so as to facilitate these several designated microservices to provide corresponding services to users in the applied software nodes.

[0085] Furthermore, if the microservice application system fails or is attacked at this time, continuing with the current isolation strategy may still not be able to hinder the system's performance to a certain extent.

[0086] Based on this, a basic microservice is determined among several designated microservices, where the basic microservice refers to a microservice that is applied to at least multiple software nodes. That is, the microservice not only serves one software node. Once the basic microservice is affected, the impact on the application system will be greater.

[0087] Therefore, through the microservice network access policy, dynamic communication is defined between the basic microservice and several specified microservices. Dynamic communication means that the basic microservice can only communicate with other specified microservices in a software node at the same time.

[0088] Although it will affect the user experience of each software node, it can further deepen the isolation of important basic microservices. When a microservice fails or is attacked, it reduces the probability of its impact on the basic microservices of the application node where it is located, thereby reducing the impact on the entire application system.

[0089] As shown in FIG4 , an embodiment of the present application further provides a configuration-based microservice isolation operation device, including:

[0090] at least one processor; and,

[0091] a memory communicatively connected to the at least one processor; wherein,

[0092] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the configuration-based microservice isolation operation method as described in any of the above embodiments.

[0093] An embodiment of the present application further provides a non-volatile computer storage medium storing computer-executable instructions, wherein the computer-executable instructions are configured as: the configuration-based microservice isolation operation method described in any of the above embodiments.

[0094] The various embodiments in this application are described in a progressive manner. Similar portions between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the device and medium embodiments are generally similar to the method embodiments, so their descriptions are relatively simple. For relevant portions, refer to the descriptions of the method embodiments.

[0095] The devices and media provided in the embodiments of the present application correspond one-to-one to the methods. Therefore, the devices and media also have similar beneficial technical effects to their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the devices and media will not be repeated here.

[0096] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0097] The present application is described with reference to the flow chart and / or block diagram of the method, device (system), and computer program product according to the embodiment of the present application. It should be understood that each flow process and / or box in the flow chart and / or block diagram and the combination of the flow process and / or box in the flow chart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processing machine or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one flow chart flow or multiple flows and / or one box or multiple boxes of the block diagram.

[0098] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0099] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0100] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0101] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0102] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0103] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0104] The foregoing is merely an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A configuration-based microservice isolation operation method, wherein: include: Define the isolation strategy and generate a configuration file. The isolation strategy includes multiple types, including: isolation strategy effective range and microservice deployment strategy; Deploy the configuration file to the Kubernetes cluster and verify and load the isolation policy through the built-in loader; For the type corresponding to the isolation policy, the isolation policy is parsed by the corresponding parser and the corresponding parsing result is returned; Based on the analysis results, the policy scheduling engine is called to call the corresponding policy executor for each type of isolation policy to perform scheduling operations and execution operations to achieve isolated operation of microservices; The isolation policy effective range is determined by label selection to determine the microservice list corresponding to the isolation policy effective range; The microservice deployment strategy configures multiple isolation strategies for microservices within the scope of the isolation strategy during deployment; The microservice deployment strategy includes: microservice node scheduling strategy, microservice affinity strategy, and microservice network access strategy; The microservice node scheduling strategy is used to schedule the microservice to a specified node during deployment. The microservice affinity policy configures whether each microservice can be deployed in the same location; The microservice network access policy defines the communication rules between microservices, and the communication rules at least include whether communication is allowed; The method further comprises: Determine, according to the microservice node scheduling strategy, multiple microservices to be scheduled to the same designated node, and determine, among the multiple microservices, several designated microservices applied to the same software node; By means of the microservice affinity policy, the plurality of designated microservices are configured to be allowed to be deployed in the same location, and by means of the microservice network access policy, the plurality of designated microservices are defined to be allowed to communicate with each other; The method further comprises: Determining that the application system of the microservice fails or is under attack; Determine a basic microservice among the plurality of designated microservices, where the basic microservice is applied to at least a plurality of software nodes; The microservice network access policy is used to define dynamic communication between the basic microservice and the multiple specified microservices. Dynamic communication means that the basic microservice can only communicate with other specified microservices in one software node at the same time.

2. The method according to claim 1, wherein According to the type corresponding to the isolation policy, the isolation policy is parsed by the corresponding parser, specifically including: Select a corresponding parser for the type of isolation policy, including: policy scope parser, node scheduling parser, microservice affinity policy parser, and network policy parser; The isolation policy is converted into a corresponding scheduling policy entity through a corresponding parser.

3. The method according to claim 1, wherein The configuration structure and policy structure of the microservice node scheduling strategy are consistent, including type type and rule rule, where the rule is an expression array and the supported operations include In, NotIn, Exists, DoesNotExist, Gt, and Lt; The microservice network access policy includes a network ingress policy inPolicy and a network egress policy outPolicy.

4. The method according to claim 1, wherein The isolation policy is verified and loaded through the built-in loader, specifically including: Load the configuration file corresponding to the isolation policy through the LoadConfig method and ParseConfig method provided by the isolation configuration service ConfigService; The isolation policy is parsed by a corresponding parser, specifically including: Parse the isolation policy through the ProcessConfig method of the corresponding parser PolicyProcessEnginee; Call the policy scheduling engine to call the corresponding policy executor for each type of isolation policy to perform scheduling operations, including: Call the DeployPolicyProcess method in the DeployPolicyService of the policy scheduling engine and the NetworkPolicyProcess method in the NetworkPolicyService to call the corresponding policy executor for scheduling operations on each type of isolation policy.

5. A configuration-based microservice isolation operation device, wherein: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the configuration-based microservice isolation operation method as described in any one of claims 1 to 4.

6. A non-volatile computer storage medium storing computer-executable instructions, wherein: The computer executable instructions are configured as: the configuration-based microservice isolation operation method according to any one of claims 1 to 4.

Images