Manage the allocation of Internet Protocol (IP) addresses to tenants in a computing environment

Abstract

Described herein are systems, methods, and software for managing Internet Protocol (IP) address allocation for tenants in a computing environment. In one implementation, a logical router associated with a tenant in the computing environment requests a public IP address for a new segment instance from a controller. In response to the request, the controller may select a public IP address from a pool of available IP addresses and update a network address translation (NAT) on the logical router to associate the public IP address with a private IP address assigned to the new segment instance.

Description

[0001] Related Applications

[0002] Claims the benefit of U.S. Patent Application No. 17 / 155,405, filed on January 22, 2021, by VMware, Inc., entitled “MANAGING INTERNET PROTOCOL (IP) ADDRESS ALLOCATION TOTENANTS IN A COMPUTING ENVIRONMENT,” which is incorporated herein by reference in its entirety for all purposes. Background Art

[0003] In a computing environment such as a software defined data center (SDDC), a tenant's workload virtual nodes can be connected to a logical router implemented by the SDDC provider, sometimes referred to as a Tier (layer) -1 or T1 logical router. Each tenant in the data center can be assigned its own T1 logical router to support the operation of the tenant's workload virtual nodes (virtual machines, containers, or other virtualized endpoints). To connect the T1 logical routers to the Internet, each of the T1 logical routers can be connected to a Tier-0 or T0 logical router, where the T0 logical router includes a downlink port connected to one or more T1 logical routers in the environment and an uplink port connected to an external network (such as the Internet).

[0004] For example, a tenant may include a three-tier application including a web segment virtual node, an application segment virtual node, and a database segment virtual node. The virtual nodes may be coupled to a T1 logical router, which in turn communicates with a T0 logical router to provide connectivity to an external network.

[0005] Although the T0 logical router provides a mechanism for tenants to communicate with external networks, difficulties may arise in assigning public Internet Protocol (IP) addresses to tenants and configuring network address translation (NAT) at the T1 logical router to support coupled virtual nodes. Specifically, using segment virtual nodes, tenants may need at least one virtual node to be available from an external network (e.g., the Internet) via a public IP address. However, current mechanisms may make it difficult to quickly assign public IP addresses to new nodes in a computing environment. Specifically, some current implementations may require an application programming interface (API) request or some other request to an Internet service provider (ISP) each time a virtual node needs a new public IP address. These requests may cause delays in efficiently assigning public IP addresses to new virtual nodes. Summary of the invention

[0006] The technology described herein manages the allocation of Internet Protocol (IP) addresses to tenants in a computing environment. In one example, a controller identifies a request for a public IP address for a new node by a logical router associated with a first tenant among a plurality of tenants. In response to the request, the controller may select a public IP address from a pool of available public IP addresses, and may update a network address translation (NAT) rule to associate a private IP address of the node with the IP address. In some examples, the update to the NAT rule may also result in an update to a next hop configuration at a second logical router to forward packets with the public IP address to a logical router associated with the tenant, wherein the second logical router couples the logical router to one or more external networks (e.g., the Internet). BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 A computing environment for managing assignment of Internet Protocol (IP) addresses to tenants in the computing environment is shown according to an implementation.

[0008] Figure 2 A method of managing allocation of IP addresses to tenants in a computing environment according to an implementation is shown.

[0009] Figure 3 A timing diagram of assigning IP addresses to tenants according to an implementation is shown.

[0010] Figure 4 Updates to a network address translation (NAT) data structure are shown according to an implementation.

[0011] Figure 5 An update to a next hop configuration for forwarding packets to an associated logical router is shown according to an implementation.

[0012] Figure 6 A timing diagram of deallocation of IP addresses to tenants is shown, depending on the implementation.

[0013] Figure 7 A computing system for managing allocation of IP addresses to tenants in a computing environment is shown according to an implementation. DETAILED DESCRIPTION

[0014] Figure 1A computing environment 100 for managing Internet Protocol (IP) address allocation to tenants in a computing environment is shown according to an implementation. The computing environment 100 includes a layer-0 logical router 102, layer-1 logical routers 105-107, and a controller 180. The layer-1 logical routers 105-107 each include a corresponding network address translation (NAT) 160-162 and provide connectivity for segments 110-112, 120-122, and 130-132. The layer-0 logical router 102 includes a next-hop association 152, and the controller 180 includes an address pool 150 for allocating public IP addresses to virtual nodes in the segments 110-112, 120-122, and 130-132. The elements of the computing environment 100, including the logical routers, the controller, and the segment virtual nodes, can be executed across one or more host computing systems, such as servers or desktop computing systems. The logical router and controller may each execute on a single computing system, or may execute across multiple computing systems.

[0015] In operation, segments 110-112, 120-122, and 130-132 are deployed to support operations of different tenants, wherein each of segments 110-112, 120-122, and 130-132 may include one or more virtual nodes, such as virtual machines, containers, or some other virtualized endpoints. To support connectivity of the virtual nodes, a layer-1 logical router is provided that may provide domain name services (DNS), dynamic host configuration protocol (DHCP), firewall services, and NAT services (shown by NAT 160-162). NAT 160-162 may be used to identify packets associated with a first address, such as a public Internet Protocol (IP) address, and translate the address to a second IP address or a local IP address. Connected to the layer-1 logical routers 105-107 is a layer-0 logical router 102, wherein the layer-0 logical router may be used to connect each logical router to one or more external networks, such as the Internet. In some implementations, the layer-0 logical router 102 may be provided and managed by a service provider for each tenant in the computing environment 100. The tier-0 logical router 102 may be used to perform next-hop forwarding to each of the tier-1 logical routers, implement additional firewall rules, or provide some other operation with respect to data packets from external networks and the tier-1 logical routers.

[0016] When configuring the network for each tenant associated with each layer-1 logical router, a controller 180 is provided that operates in a control plane separate from the data plane for the individual tenants and can be used to configure NAT, firewall, and other operations provided by the logical router. In order to provide connectivity to some virtual nodes, public IP addresses may be required to allow computing elements on external networks to communicate with the virtual nodes. For example, the layer-1 logical router 105 may represent an organization that requires virtual nodes in the network segment 110 to support incoming connections from one or more computing elements executing on the external network. To support this requirement, a request for the layer-1 logical router 105 can be generated and received by the controller 180. Once received, the controller 180 can select a public IP address to support the request and configure the logical routers 105 and 102 to support the use of the public IP address by the corresponding virtual nodes.

[0017] Here, the controller 180 maintains an address pool 150, wherein the address pool 150 includes available public IP addresses assigned to virtual nodes in the computing environment 100. In some implementations, the address pool 150 can be populated using an application programming interface (API) or some other function that can obtain public IP addresses from an Internet service provider (ISP) or other service. The address pool includes IP addresses that are assigned to a layer-0 router to direct traffic from an external network (e.g., the Internet) to the layer-0 router, but have not yet been assigned to a virtual node in the computing environment. Advantageously, the pool can be used to provide a new virtual node with a public IP address that has been assigned to a layer-0 logical router, rather than requesting a new IP address from an ISP when the new virtual node needs it. When maintaining the address pool 150, the new virtual node can be coupled to a layer-1 logical router in the layer-1 logical routers 105-107. When coupled to a logical port, the layer-1 logical router can determine whether the new virtual node needs a public IP address. In some implementations, a user or administrator associated with a tenant can indicate the type of virtual node or segment that requires an IP address when coupled to a corresponding layer-1 logical router. For example, an administrator associated with tier-1 logical router 105 can indicate that all virtual nodes in network segment 110 should be assigned public IP addresses. In response to identifying a new virtual node for the segment, the tier-1 logical router can generate a request to controller 180 indicating the need for a new public IP address.

[0018] After receiving the request, the controller 180 may identify an available IP address in the address pool 150 and assign the address to the new virtual node. In some implementations, when allocating a public IP address to support the request, the controller 180 may update the NAT 160 and may update the next hop association 152 to support forwarding packets using the public IP address. Specifically, the controller 180 may update the NAT 160 to associate the public IP address with the private IP address allocated by the layer-1 logical router 105. For example, the layer-1 logical router 105 may assign the private IP address 192.168.1.1 to the virtual node and associate the address to a public address, such as 52.1.1.7. In some implementations, a pool of private IP addresses may be made available to the newly connected virtual node at the layer-1 logical router, and a private IP address may be selected from the pool to support the newly connected virtual node. In some examples, this selection may be made by the controller 180. In some implementations, the pools can be different for each of the various segments, where a network segment can be associated with a first pool of IP addresses and an application segment can be associated with a second pool of IP addresses. If the one or more pools meet one or more criteria indicating a limited number of available IP addresses (e.g., falls below a threshold number of private IP addresses), the controller 180 can provide a notification to an administrator associated with the layer-1 logical router, the controller 180 can automatically add one or more additional IP addresses to the pool, or can provide some other functionality.

[0019] In addition to updating NAT 160, controller 180 may also initiate an update of next-hop associations 152, where the routes in the next-hop associations may be used to forward communications associated with the selected public IP address to a corresponding layer-1 router in routers 105-107. Returning to the example of assigning 52.1.1.7 to a segment in layer-1 logical router 105, controller 180 may initiate an update of next-hop associations 152 to ensure that layer-1 logical router 105 is the next hop for packets having 52.1.1.7 as a destination.

[0020] Once NAT and next-hop associations are configured, an incoming packet with a destination of 52.1.1.7 received at the layer-0 logical router 102 from the external network is forwarded to the layer-1 logical router 105. The layer-1 logical router 105 can perform NAT in association with the destination address and forward the packet to the destination virtual node or segment instance of the layer-1 logical router 105.

[0021] In some implementations, once a public IP address is assigned to a virtual node of one of the tenants, the IP address is removed from the address pool 150. Thus, when the controller 180 identifies a second request for a public IP address, a different public IP address may be selected to support the request. In some examples, the number of IP addresses in the pool may meet one or more criteria such that the controller 180 may request and obtain additional IP addresses for the pool. For example, when ten IP addresses remain in the pool, the controller 180 may use an API or other function to update the pool in preparation for additional requests.

[0022] Figure 2 A method 200 for managing IP address allocation to tenants in a computing environment according to an implementation is shown. Figure 1 The systems and elements of the computing environment 100 are referenced in parentheses in the following paragraphs to the steps of the method 200. The steps of the method 200 may be performed entirely by the controller 180, although other control mechanisms may exist in the computing environment.

[0023] As depicted, the method 200 includes identifying (201) a request for a public IP address of a virtual node of a logical router associated with a first tenant of a plurality of tenants. For example, by adding a virtual node, the layer-1 logical router 105 can generate a request for a public IP address identified by the controller 180. The controller 180 can communicate with the layer-1 logical router 105 using a control plane, wherein the control plane communicates configurations outside of a data plane of each node represented as a segment in the computing environment 100. In some implementations, when a virtual node is coupled to the layer-1 logical router 105, the logical router can determine whether the new virtual node requires a public IP address. If the new node does not require a public IP address, a request to the controller 180 may not be required. However, if the new virtual node does require a public IP address, the layer-1 logical router 105 can communicate a request for an IP address to the controller 180 to support the new segment instance.

[0024] In response to the request, the method includes: at the controller, selecting (202) a public IP address from a pool of available public IP addresses. In some implementations, the controller 180 can obtain an IP address from a provider (ISP) and maintain a pool of IP addresses to assign to new segment instances (virtual nodes) in the computing environment 100. The pool may include addresses assigned to a layer-0 logical router to direct traffic from a public network to the layer-0 logical router, but have not yet been assigned to a virtual node in the computing environment. Once selected, the IP address can be removed from the pool so that the same address is not assigned to another request. Advantageously, rather than requesting a new IP address from an ISP when a new virtual node is needed, a pool can be used to provide an already assigned public IP address for the layer-0 logical router to forward packets to the virtual node.

[0025] Once the public IP address is selected, the method 200 further updates (203) the NAT rules at the logical router to associate the private IP address of the virtual node to the public IP address. In some implementations, a layer-1 logical router in a computing environment may maintain NAT rules that are used to associate private IP addresses to public IP addresses of virtual nodes executed for a particular tenant. For example, a NAT rule of a layer-1 logical router 105 may be used to associate a public IP address of a virtual node in a network segment 110 to a private IP address of the virtual node. When a packet is received, the layer-1 logical router 105 may convert the private IP address in the packet and forward the packet to a destination node. In some implementations, the private IP address of the new virtual node may be allocated from a pool of available private IP addresses at the layer-1 logical router. In some examples, the private IP address may be allocated by the controller 180 along with the public IP address. In some embodiments, the controller 180 may monitor the size of the private IP address pool at the layer-1 logical router and determine when the layer-1 logical router requires an additional private IP address. This determination may be based on the number of IP addresses falling below a threshold number, the predicted number of IP addresses required in the near future being greater than the available IP addresses in the pool, or some other criteria. Once additional IP addresses are required, the controller may notify an administrator associated with the layer 1 logical router that additional private IP addresses are required, may automatically add the additional private IP addresses, or may provide some other operation associated with adding IP addresses to the pool. In some implementations, each layer-1 logical router may maintain multiple pools, where each pool may correspond to a different segment. Thus, while a network segment may be associated with a first pool, an application segment may be associated with a second pool. In some implementations, the pools may include different subnets.

[0026] In some implementations, in addition to configuring the NAT rules at the logical router, the controller 180 may also initiate an update to the next hop association 152, where the next hop association 152 is used to identify the logical router for forwarding packets received from the external network. In some examples, each layer-1 logical router in the logical routers 105-107 is assigned its own IP address so that the layer-0 logical router 102 can forward packets to the router. Therefore, when a public IP address is assigned to a virtual node coupled to one of the logical routers 105-107, the next hop association 152 can be updated to associate the public IP address with the IP address of the associated logical router. When the layer-0 logical router 102 receives a packet, the layer-0 logical router 102 can identify the destination IP address of the packet, determine the next hop IP address of the layer-1 logical router associated with the destination IP address, and forward the packet to the corresponding layer-1 logical router.

[0027] In some examples, when allocating IP addresses from the IP address pool 150, the controller 180 may determine when the IP address pool meets one or more criteria for retrieving additional addresses. One or more criteria may include the number of available addresses, wherein the controller 180 may identify when the pool reaches the number of available addresses and use an API or other operation to obtain additional IP addresses from a provider (ISP). In some implementations, the controller 180 may predict the number of IP addresses that need to be assigned to a virtual node during a future time period. The prediction may be based on monitoring the number of requests for public IPs during a recent time period (e.g., the last 15 minutes), during a similar time period (e.g., time of day, time of week, etc.), or based on some other monitoring of requests. For example, the controller 180 may predict that fifteen addresses will be needed in a future time period (e.g., the next five minutes). As a result, the controller 180 may obtain at least the required number of IP addresses for the pool from the ISP using an API before the time period. In some examples, the predicted demand for the pool may include public IPs surrendered from retired virtual nodes, where these IP addresses may be reallocated to other virtual nodes.

[0028] In addition to assigning public IP addresses to various tenants in the computing environment 100, the controller 180 can also be configured to update NAT and next-hop associations based on a segment instance being stopped or initiating a request to remove an assigned IP address. For example, the layer-1 logical router 105 can identify a request to remove an assignment of a public IP address for a virtual node. In response to the request, the NAT can be updated to remove the association between the private IP address and the public IP address, a notification can be provided to the controller to release the public IP address back to the IP address pool, and a notification can be provided to the layer-0 logical router to remove the next-hop association for the public IP address.

[0029] Figure 3 A timing diagram 300 is shown for allocating IP addresses to tenants according to an implementation. The timing diagram 300 includes tier-1 logical routers 105-106, tier-0 logical router 102, and controller 180. For clarity, tier-1 logical router 107 has been omitted.

[0030] As depicted, at step 1, the controller 180 maintains a public address pool, which can include addresses used by computing elements on one or more external networks to communicate with nodes executing behind the tier-0 logical router 102. While maintaining the public address pool, at step 2, the tier-1 logical router 105 generates a request for a public IP address to support a segment behind the tier-1 logical router 105. For example, the tier-1 logical router 105 can initiate a request for a new public IP address to support a network segment of an application behind the tier-1 logical router 105.

[0031] In response to the request, at step 3, the controller 180 can select a public IP address from the pool, and at step 4, update the NAT of the layer-1 logical router 105 and the next hop configuration of the layer-0 logical router 102. In some implementations, the public IP address can be randomly selected from the pool, from a list representing an available address pool, or from some other data structure or manner. Once selected, the NAT of the layer-1 logical router 105 can be updated to associate the selected public IP address with the private IP address of the node behind the layer-1 logical router 105, where the private IP address can be selected by the layer-1 logical router 105 when a request for a virtual node is identified. For example, the layer-1 logical router 105 can monitor when a new virtual node is coupled to a port of the logical router. When coupled, the layer-1 logical router 105 can select a private IP address for the new virtual node and request the public IP address for the NAT association.

[0032] In addition to configuring NAT at the tier-1 logical router 105, the controller 180 can also initiate an update to the next-hop configuration of the tier-0 logical router 102. The update can be used to direct communications associated with the public IP address to the tier-1 logical router 105. When directing packets, the tier-0 logical router 102 can forward the packets to the router's IP address.

[0033] After assigning an IP address to the tier-1 logical router 105 to support the new instance in the segment, at step 5, the controller 180 receives a second request from the tier-1 logical router 106. In response to the request, at step 6, the controller 180 may select a second public IP address from the pool of available IP addresses to support the request. Once selected, at step 7, the controller 180 may update the NAT of the tier-1 logical router 106 and update the next hop configuration of the tier-0 logical router 102. Similar to the above-described operation of configuring the request for the tier-1 logical router 105, the configuration of the tier-1 logical router 106 may update the NAT to associate the private IP address assigned by the tier-1 logical router 106 to the second public IP address. In addition, the configuration of the tier-0 logical router 102 may be used to forward incoming packets having the second public IP address to the tier-1 logical router 106.

[0034] In some implementations, the controller 180 may monitor the size of the pool of available IP addresses. Specifically, when the number of available addresses decreases and meets one or more criteria, in step 8, the controller 180 may request new addresses for the pool to accommodate additional requests from layer-1 routers in the computing environment 100. In some implementations, the pool may also be expanded when a layer-1 logical router relinquishes a public IP address. Specifically, the layer-1 logical router may remove NAT in association with the public IP address and notify the controller 180 so that the controller 180 may add the public IP address back to the available pool. Further, the controller 180 may update the next hop configuration to prevent packets associated with the public IP address from being forwarded to the layer-1 logical router.

[0035] In some implementations, the controller 180 can predict the number of IP addresses that need to be assigned to the virtual node during a future time period. The prediction can be based on monitoring the number of requests for public IPs during a recent period (e.g., the last 15 minutes), during a similar time period (e.g., time of day, time of week, etc.), or based on some other monitoring of requests during any time period. For example, the controller 180 can predict that thirty addresses will be needed in a future time period (e.g., the next five minutes). As a result, the controller 180 can obtain at least the required number of IP addresses for the pool from the ISP. In some examples, the predicted demand for the pool may include public IPs surrendered from retired virtual nodes, where these IP addresses can be reallocated to other virtual nodes. This can allow the controller 180 to maintain the pool using new IPs from the ISP and IPs surrendered from retired virtual nodes.

[0036] Figure 4 Updates to a network address translation (NAT) data structure are shown according to an implementation. Figure 4 Including from Figure 1 The data structure 160 includes columns for a public IP 410 and a private IP 415.

[0037] In operation, a layer-1 logical router in a computing environment may identify a request to assign a public IP address to an instance in a segment, where, in some examples, the instance may include a virtual machine. For example, the layer-1 logical router may identify a new connection and determine whether the connection requires an assignment of a public IP based on configuration information associated with the new connection. In some implementations, the layer-1 logical router may determine a segment associated with the new connection, where the segment may be associated with a need for a new public IP address. In response to the request, the layer-1 logical router may assign a private IP address, where the private IP address may fall within a subnet for the segment associated with the new connection. In addition, the layer-1 logical router may transmit a request to a controller to assign a public IP address from a pool of available public IP addresses.

[0038] Here, for Figure 1 The new connection of network segment 110 is assigned a public IP address 52.1.1.7 by the controller and is also assigned a private IP address 192.168.1.3 by the controller. Once the public IP address is recognized by the controller, the controller can update the NAT at the layer-1 logical router to include the association between the private IP address and the public IP address, wherein the update is used to translate addressing in packets from public IP to private IP and from private IP to public IP.

[0039] Figure 5An update to a next hop configuration for forwarding packets to an associated logical router is shown according to an implementation. Figure 5 An example of a next hop association 152 is included, but other examples may exist. The next hop association 152 includes columns for a public IP 410 and a next hop IP 415 .

[0040] In operation, a request to assign a public IP address to a node supported by the layer-1 logical router is generated by a layer-1 logical router. For example, each layer-1 logical router may represent a tenant in a computing environment, wherein the tenant may include a company, an organization, a group within an organization, or some other entity. Each tenant may use a layer-1 logical router to support one or more segments of an application. For example, a first layer-1 logical router may be used to provide a three-tier application, wherein the application may include a network segment, an application segment, and a database segment. When a new virtual node is added or connected to a layer-1 logical router, the layer-1 logical router may determine whether the virtual node requires a public IP address. The determination may be based on a segment identifier associated with the virtual node, metadata provided by an administrator who initiated the virtual node, or some other information. When a public IP address is required, the layer-1 logical router may assign a private IP address to the virtual node, wherein the private address may be on a local subnet provided by the layer-1 logical router. In addition, the layer-1 logical router may transmit a request to the controller to obtain an available public IP address. Once assigned or selected by the controller from the pool, the controller may update the NAT of the layer-1 logical router to include the association between the private IP address and the public IP address.

[0041] Here, in addition to updating the NAT, the controller may also update the next hop association 152 to forward packets to the appropriate layer-1 logical router based on the destination IP address. Specifically, when a packet from an external network is received at a layer-0 logical router, the layer-0 logical router may identify the destination IP address in the packet and match the destination IP address to a next hop IP address associated with the layer-1 logical router. When a new public IP address 52.1.1.7 is assigned to a node in the computing environment, an update may be provided to the layer-0 logical router that associates the public IP address with the next hop IP address of the layer-1 logical router supporting the new node. In this example, the next hop IP address is 100.64.1.2, which corresponds to the layer-1 logical router 105. Once configured, packets from the external network with the public destination IP address 52.1.1.7 may be forwarded to the logical router 105 with the next hop IP address 100.64.1.2.

[0042] Despite Figure 4 and Figure 5In the example of , it is shown as adding an entry to the data structure, but it should be understood that the entry can be removed from the data structure. In some implementations, when the public IP address is no longer needed, the layer-1 logical router can recognize the request to remove the allocation and update the NAT to remove the entry associated with the public IP address. Further, the layer-1 logical router can transmit a notification to the controller, where the controller can initiate an update to remove the entry from the next hop association associated with the public IP address. The controller can also add the public IP address back to the available IP address pool so that future requests can be assigned the address.

[0043] Figure 6 A timing diagram 600 for deallocating IP addresses to tenants according to an implementation is shown. The timing diagram 600 includes Figure 1 1 and 10. The tier-1 logical routers 105-106, the tier-0 logical router 102, and the controller 180 of the computing environment 100 of FIG.

[0044] In operation, the layer-1 logical routers 105-106 can request and receive public IP addresses to assign to one or more segments supported by these logical routers. These public IP addresses are assigned from the controller 180, where, in step 1, the controller 180 maintains a pool of public IP addresses for these requests. After assigning the IP address, in step 2, the layer-1 logical router 105 identifies a removal request to remove the assigned public IP address. In response to the request, in step 3, the layer-1 logical router 105 updates the local NAT to remove the association of the public IP address with the private IP address of the virtual node coupled to the layer-1 logical router 105. In some implementations, the layer-1 logical router 105 can monitor when the connection with the virtual node no longer exists, and can update the NAT based on the connection being removed. In addition to updating the local NAT, a request can also be transmitted to the controller 180 indicating that the segment provided by the layer-1 logical router no longer requires a public IP address. In response to the request, at the continuation of step 3, the controller 180 can add the public IP address back to the pool of available addresses and update the configuration of the layer-0 logical router 102 to remove the next hop association of the public IP address.

[0045] In addition to the update to the layer-1 logical router 105, at step 4, the layer-1 logical router 106 identifies a removal request for the public IP address. In response to the request, at step 5, the layer-1 logical router updates the local NAT to remove the association between the public IP address and the private IP address. In some implementations, the removal can be performed without communicating with the controller 180, but it should be understood that the controller 180 can initiate the update of the NAT. In addition to updating the NAT, the layer-1 logical router 106 can also transmit a request to the controller 180 to deallocate the public IP address. In response to receiving the request, the controller 180 can initiate an update to the layer-0 logical router 102 to update the next hop configuration and can add the public IP address back to the available pool.

[0046] In some implementations, the pool of available IP addresses at the controller 180 can be maintained to include a minimum or maximum number of IP addresses. When an address is added back to the pool from a layer-1 logical router that deallocated an IP address, the controller 180 can place the IP address back to the provider. Similarly, when a layer-1 logical router employs additional addresses, the controller 180 can request and receive additional IP addresses to be added to the pool.

[0047] Figure 7 A computing system 700 for managing IP address allocation to tenants in a computing environment according to an implementation is shown. Computing system 700 represents any one or more computing systems that a controller may employ to implement the various operational architectures, processes, scenarios, and sequences disclosed herein. Computing system 700 is Figure 1 180, but other examples may exist. Computing system 700 includes storage system 745, processing system 750, and communication interface 760. Processing system 750 is operably linked to communication interface 760 and storage system 745. In some implementations, communication interface 760 may be communicatively linked to storage system 745. Computing system 700 may further include other components, such as a battery and a housing that are not shown for clarity.

[0048] The communication interface 760 includes components that communicate through a communication link, such as a network card, a port, a radio frequency (RF), a processing circuit and software, or some other communication device. The communication interface 760 can be configured to communicate through a metal, wireless or optical link. The communication interface 760 can be configured to use time division multiplexing (TDM), Internet Protocol (IP), Ethernet, optical network, wireless protocol, communication signaling or some other communication format-including combinations thereof. The communication interface 760 can be configured to communicate with one or more server computing systems or desktop computing systems that can provide a platform for logical routers, virtual nodes, etc.

[0049] Processing system 750 includes a microprocessor and other circuits that retrieve and execute operating software from storage system 745. Storage system 745 may include volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Storage system 745 can be implemented as a single storage device, but it can also be implemented across multiple storage devices or subsystems. Storage system 745 may include additional elements, such as a controller for reading operating software from the storage system. Examples of storage media include random access memory, read-only memory, disk, optical disk, and flash memory, and any combination or variation thereof, or any other type of storage media. In some implementations, the storage medium may be a non-transitory storage medium. In some instances, at least a portion of the storage medium may be temporary. It should be understood that the storage medium is not a propagation signal under any circumstances.

[0050] Processing system 750 is typically mounted on a circuit board that may also house a memory system. The operating software for memory system 745 includes computer programs, firmware, or some other form of machine-readable program instructions. The operating software for memory system 745 includes at least one Figure 2 Operation 200 and Figure 3 The operating software on the storage system 745 may further include an operating system, utilities, drivers, network interfaces, applications, or some other type of software. When read and executed by the processing system 750, the operating software on the storage system 745 instructs the computing system 700 to operate as described herein.

[0051] In at least one implementation, the service 730 instructs the processing system 750 to identify a request for a logical router associated with a first tenant in a plurality of tenants to obtain a public IP address for a virtual node. In some implementations, a layer-1 logical router is deployed in a computing environment to provide networking services for different tenants of the computing environment. The tenant may include an organization, a department of one or more organizations, or some other tenant. Each tenant may deploy one or more virtual nodes, which may provide one or more segments to provide different operations. These segments may include network segments, application segments, database segments, or some other segment that may provide the required operations for the tenant. When deployed, one or more of the segments may require a public IP address to receive communications from a computing element on one or more external networks. To support this requirement, the layer-1 logical router may identify when a new connection for a virtual node that requires a public IP address is identified, and transmits a request to receive a public IP address to a controller.

[0052] Once the request is identified, the service 730 can instruct the processing system 750 to select a public IP address from the available public IP address pool and update the NAT rules at the logical router to associate the private IP address of the virtual node with the public IP address. In some implementations, the logical router can assign a private IP address based on the segment of the new virtual node. Once the public IP address is assigned to the virtual node, the NAT maintained by the logical router can be updated to associate the private IP address with the public IP address.

[0053] In addition to updating the NAT, the service 730 can also instruct the processing system 750 to initiate an update to the next hop configuration at a second logical router (e.g., a layer-0 logical router) to transmit packets associated with the public IP address to a logical router associated with the first tenant, wherein the second logical router connects the logical router to one or more external networks. Once configured, packets with the destination public IP address can be forwarded to the associated layer-1 logical router using the next hop association, and the layer-1 logical router can perform address translation using the updated NAT.

[0054] In some implementations, the address allocation service 730 may instruct the processing system 750 to identify when a pool of available IP addresses meets criteria for obtaining additional addresses for the pool. For example, when the pool falls below a threshold number of available IP addresses, the service 730 may instruct the processing system 750 to obtain additional IP addresses from a provider that may be provided in future requests.

[0055] In some examples, in addition to assigning an IP address to a requesting layer-1 logical router, the service 720 can also be used to deallocate a public IP address. In at least one implementation, when a virtual node supported by a layer-1 logical router no longer requires a public IP, the layer-1 logical router can initiate an update to NAT to remove the association between the public IP address and the private IP address of the local network supported by the router. In addition, the layer-1 logical router can provide a notification to the controller indicating that the public IP address is no longer required, wherein the controller can add the public IP address back to the available pool and update the next hop configuration of the layer-0 logical router to remove the entry that directs traffic associated with the public IP address to the layer-1 logical router.

[0056] The included description and drawings depict specific implementations to teach those skilled in the art how to make and use the best mode. For the purpose of teaching the principles of the invention, some conventional aspects have been simplified or omitted. Those skilled in the art will appreciate variations of these implementations that fall within the scope of the invention. Those skilled in the art will also appreciate that the features described above can be combined in various ways to form multiple implementations. Therefore, the present invention is not limited to the specific implementations described above, but is limited only by the claims and their equivalents.

Claims

1. A method for allocating an Internet Protocol (IP) address, comprising: identifying a request by a logical router associated with a first tenant of the plurality of tenants to obtain a public IP address of a virtual node; selecting the public IP address from a pool, the pool comprising a plurality of public IP addresses assigned to a second logical router such that traffic addressed to any one of the plurality of public IP addresses is directed to the second logical router; updating a network address translation (NAT) rule at the logical router to associate the private IP address of the virtual node with the selected public IP address; as well as and updating a next hop configuration at the second logical router to transmit packets associated with the selected public IP address to the logical router associated with the first tenant, wherein the second logical router connects the logical router to one or more external networks and the logical router associated with the first tenant redirects traffic addressed to the selected public IP address to the private IP address of the virtual node.

2. The method of claim 1, wherein the one or more external networks comprises the Internet.

3. The method of claim 1, wherein the virtual node comprises a virtual machine in the tenant's segment.

4. The method of claim 1, further comprising: identifying a second request from a second logical router associated with a second tenant of the plurality of tenants to obtain a second public IP address for a new virtual node; selecting the second public IP address from the pool; as well as The NAT rules at the second logical router are updated to associate the second private IP address of the second virtual node with the selected second public IP address.

5. The method of claim 1, further comprising: In response to selecting the public IP address, removing the selected public IP address from the pool.

6. The method of claim 1, further comprising: identifying when the pool meets one or more size criteria; as well as Obtain one or more additional IP addresses for the pool from a service provider.

7. The method of claim 1, wherein the one or more size criteria include a number of IP addresses in the pool.

8. The method of claim 1, further comprising: identifying a request to remove the selected public IP address from the virtual node; updating the NAT rule at the logical router to remove an association between the private IP address and the selected public IP address; updating the next hop configuration at the second logical router to stop transmitting packets associated with the selected public IP address to the logical router associated with the first tenant; as well as The selected public IP address is added to the pool.

9. A computing device comprising: Storage systems; a processing system operatively coupled to the storage system; as well as program instructions stored on the storage system, which, when executed by the processing system, instruct the computing device to: identifying a request by a logical router associated with a first tenant of the plurality of tenants to obtain a public IP address of a virtual node; selecting the public IP address from a pool, the pool comprising a plurality of public IP addresses assigned to a second logical router such that traffic addressed to any one of the plurality of public IP addresses is directed to the second logical router; updating a network address translation (NAT) rule at the logical router to associate the private IP address of the virtual node with the selected public IP address; as well as and updating a next hop configuration at the second logical router to transmit packets associated with the selected public IP address to the logical router associated with the first tenant, wherein the second logical router connects the logical router to one or more external networks and the logical router associated with the first tenant redirects traffic addressed to the selected public IP address to the private IP address of the virtual node.

10. The computing device of claim 9, wherein the one or more external networks comprises the Internet.

11. The computing device of claim 9, wherein the virtual node comprises a virtual machine in the tenant's segment.

12. The computing device of claim 9, wherein the program instructions further instruct the computing device to: identifying a second request from a second logical router associated with a second tenant of the plurality of tenants to obtain a second public IP address for a new virtual node; selecting the second public IP address from the pool; and The NAT rules at the second logical router are updated to associate the second private IP address of the second virtual node with the selected second public IP address.

13. The computing device of claim 9, wherein the program instructions further instruct the computing device to: In response to selecting the public IP address, removing the selected public IP address from the pool.

14. The computing device of claim 9, wherein the program instructions further instruct the computing device to: identifying when the pool meets one or more size criteria; and Obtain one or more additional IP addresses for the pool from a service provider.

15. The computing device of claim 14, wherein the one or more size criteria include a number of IP addresses in the pool.

16. The computing device of claim 9, wherein the program instructions further instruct the computing device to: identifying a request to remove the selected public IP address from the virtual node; updating the NAT rule at the logical router to remove an association between the private IP address and the selected public IP address; updating the next hop configuration at the second logical router to stop transmitting packets associated with the selected public IP address to the logical router associated with the first tenant; as well as The selected public IP address is added to the pool.

17. An apparatus comprising: Storage systems; as well as program instructions stored on the storage system, which, when executed by the processing system, instruct the processing system to: identifying a request by a logical router associated with a first tenant of the plurality of tenants to obtain a public IP address of a virtual node; selecting the public IP address from a pool, the pool comprising a plurality of public IP addresses assigned to a second logical router such that traffic addressed to any one of the plurality of public IP addresses is directed to the second logical router; In response to selecting the public IP address, removing the selected public IP address from the pool; updating a network address translation (NAT) rule at the logical router to associate the private IP address of the virtual node with the selected public IP address; as well as and updating a next hop configuration at the second logical router to transmit packets associated with the selected public IP address to the logical router associated with the first tenant, wherein the second logical router connects the logical router to one or more external networks and the logical router associated with the first tenant redirects traffic addressed to the selected public IP address to the private IP address of the virtual node.

18. The apparatus of claim 17, wherein the program instructions further instruct the processing system to: identifying a request to remove the selected public IP address from the virtual node; updating the NAT rule at the logical router to remove an association between the private IP address and the selected public IP address; updating the next hop configuration at the second logical router to stop transmitting packets associated with the selected public IP address to the logical router associated with the first tenant; as well as The selected public IP address is added to the pool.

Images