Methods and apparatus for traffic control for application-independent service mesh

Patent metadata

Field	Value
Publication number	US-12199858-B2
Application number	US-202217711964-A
Country	US
Kind code	B2
Filing date	Apr 1, 2022
Priority date	Apr 1, 2022
Publication date	Jan 14, 2025
Grant date	Jan 14, 2025

Abstract

Methods, apparatus, systems, and articles of manufacture are disclosed for traffic control for application-independent service mesh. In one example, processor circuitry to perform operations to instantiate ingress traffic management circuitry to receive ingress traffic events, at least one of the ingress traffic events to request access to a target microservice running on the second endpoint. The processor circuitry further performs operations to instantiate virtual service authorization circuitry to perform a look up of an authorization policy to the target microservice in the microservice catalog. Finally, the processor circuitry performs operations to instantiate endpoint selection circuitry to select the second endpoint to service the ingress traffic event in response to the authorization policy allowing access to the target microservice.

First claim

What is claimed is:

1. At least one non-transitory computer-readable storage medium comprising instructions that cause one or more processor circuits of a machine to at least:
receive, at a first endpoint, an ingress traffic event associated with an entity in a service mesh, the ingress traffic event to request access to a target microservice running on a second endpoint;
look up an authorization policy associated with the target microservice in a microservice catalog, the authorization policy to govern whether at least the entity is permitted to access the target microservice, the microservice catalog to include a list of endpoints of microservices in the service mesh, the list of endpoints including the first endpoint in a first edge domain namespace and the second endpoint in a second edge domain namespace; and
select the second endpoint to service the ingress traffic event based on the authorization policy indicating that the entity is permitted to access the target microservice.

2. The at least one non-transitory computer-readable storage medium of claim 1 , wherein the instructions cause at least one of the one or more processor circuits of the machine to:
determine a routing policy to route the ingress traffic event to the target microservice; and
cause routing of the ingress traffic event to the target microservice in accordance with the routing policy.

3. The at least one non-transitory computer-readable storage medium of claim 1 , wherein the authorization policy is a first authorization policy, the list of endpoints includes at least a third endpoint in a third edge domain namespace, the target microservice is a first target microservice, and the instructions cause at least one of the one or more processor circuits of the machine to:
request access to a second target microservice during service by the first target microservice, the second target microservice running on the third endpoint;
look up a second authorization policy associated with the second target microservice in the microservice catalog; and
select the third endpoint to service the ingress traffic event based on the second authorization policy permitting access to the second target microservice.

4. The at least one non-transitory computer-readable storage medium of claim 3 , wherein the third edge domain namespace is the first edge domain namespace.

5. The at least one non-transitory computer-readable storage medium of claim 1 , wherein the instructions cause at least one of the one or more processor circuits of the machine to:
cause discovery of microservices across at least the first edge domain namespace and the second edge domain namespace; and
based on a discovered microservice, cause a modification of the microservice catalog with information in an entry associated with the discovered microservice, the information including at least a fully qualified domain name corresponding to an endpoint running the discovered microservice.

6. The at least one non-transitory computer-readable storage medium of claim 5 , wherein the instructions cause at least one of the one or more processor circuits of the machine to cause registration of the discovered microservice at least by causing configuration of the fully qualified domain name to a domain name system server.

7. The at least one non-transitory computer-readable storage medium of claim 6 , wherein the instructions cause at least one of the one or more processor circuits of the machine to:
cause observation of the domain name system server for at least one alias update to the fully qualified domain name; and
cause a report of the alias update based on an observed alias update to the fully qualified domain name.

8. The at least one non-transitory computer-readable storage medium of claim 1 , wherein the instructions cause at least one of the one or more processor circuits of the machine to:
obtain telemetry information corresponding to a plurality of endpoints in the list of endpoints in the microservice catalog; and
balance a load of ingress traffic events across the plurality of endpoints in the microservice catalog based, at least in part, on the obtained telemetry information.

9. At least one non-transitory computer-readable storage medium comprising instructions that cause one or more processor circuits of a machine to at least:
obtain an ingress traffic event at a first endpoint, the ingress traffic event to request access to a target microservice running on a second endpoint;
based on deployment of an application, cause population of a microservice catalog with information associated with at least one of (a) one or more microservices associated with the application or (b) one or more endpoints associated with the one or more microservices;
perform a look up of an authorization policy for allowing access to the target microservice in the microservice catalog, the microservice catalog to include a list of endpoints of microservices in a service mesh, the list of endpoints including the first endpoint in a first edge domain namespace and the second endpoint in a second edge domain namespace; and
select the second endpoint to service the ingress traffic event based on the authorization policy allowing access to the target microservice.

10. The at least one non-transitory computer-readable storage medium of claim 1 , wherein the service mesh is an ISTIO service mesh.

11. A method comprising:
receiving, at a first endpoint, an ingress traffic event associated with an entity in a service mesh, the ingress traffic event to request access to a target microservice running on a second endpoint;
searching a microservice catalog for an authorization policy associated with the target microservice, the authorization policy to govern whether at least the entity is permitted to access the target microservice, the microservice catalog to include a list of endpoints of microservices in the service mesh, the list of endpoints including the first endpoint in a first edge domain namespace and the second endpoint in a second edge domain namespace; and
selecting the second endpoint to service the ingress traffic event based on the authorization policy indicating that the entity is permitted to access the target microservice.

12. The method of claim 11 , further including:
determining a routing policy to route the ingress traffic event to the target microservice; and
routing the ingress traffic event to the target microservice in accordance with the routing policy.

13. The method of claim 11 , further including:
discovering microservices across at least the first edge domain namespace and the second edge domain namespace; and
based on a discovered microservice, modifying the microservice catalog with information in an entry associated with the discovered microservice, the information including at least a fully qualified domain name corresponding to an endpoint running the discovered microservice.

14. The method of claim 11 , further including, based on deployment of an applications, populating the microservice catalog with information associated with at least one of (a) one or more microservices associated with the application or (b) one or more endpoints associated with the one or more microservices.

15. An apparatus comprising:
a memory including a microservice catalog, the microservice catalog to include a list of endpoints of microservices in a service mesh, the list of endpoints including a first endpoint in a first edge domain namespace and a second endpoint in a second edge domain namespace; and
processor circuitry including one or more of:
at least one of a central processor u

Assignees

• Intel Corp

Inventors

• S Deepak
• Ramia Kannan Babu
• Ramanathan Palaniappan

Classifications

• H04L45/02 Primary

  Topology update or discovery · CPC title

• H04L47/125

  by balancing the load, e.g. traffic engineering · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L63/0281

  Proxies · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title