Containerized Routing Process for Cross-Cluster VPN Connectivity

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing container networking solutions lack the ability to seamlessly connect workloads across different clusters and with physical routers, limiting connectivity and scalability in virtualized computing environments.

Innovation Solution

Implement a containerized routing protocol daemon (cRPD) and a virtual router with a containerized control plane to create a virtualized provider edge (PE) router, enabling standard VPN technologies to facilitate connectivity between containerized workloads and physical devices, and support various types of virtual private networks (VPNs).

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If container networking solutions are implemented, then container isolation and portability are improved, but connectivity between different clusters and physical routers deteriorates

Engineering Contradiction:

Improvecontainer portabilityVSAvoidnetwork connectivity

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent introduces a border gateway protocol (BGP) speaker as an intermediary component that sits between the container networking stack and external networks. This BGP speaker enables route exchange and connectivity between containerized workloads and physical networks without compromising container isolation, thereby resolving the contradiction between portability and connectivity reliability

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The networking stack is segmented into distinct layers: container network interface (CNI) plugins for container-level networking, a BGP speaker for inter-cluster routing, and underlying physical network infrastructure. This segmentation allows each layer to operate independently, maintaining container portability while enabling reliable external connectivity through the BGP routing layer

Inventive Principle:

Principle #1Segmentation

2Adaptability or versatility

If standard VPN technologies are used, then connectivity across diverse networks is improved, but device complexity increases

Engineering Contradiction:

Improvenetwork compatibilityVSAvoidrouting infrastructure

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent virtualizes provider edge (PE) router functionality through software implementation rather than requiring physical PE routers. The BGP speaker component copies the essential routing functions of traditional PE routers in a virtualized form, enabling standard VPN technologies to work across diverse networks while reducing hardware complexity

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The BGP speaker is designed as a universal component that can handle multiple routing protocols and VPN types (L2VPN, L3VPN, EVPN) through a single implementation. This multi-functional design enables broad network compatibility without requiring separate specialized devices for each VPN type, thereby reducing overall system complexity

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentEP4149064B1Containerized routing protocol process for virtual private networks

Publication Date: 2026.05.13 JUNIPER NETWORKS INC

Figure 1
Figure 2
Figure 3

AI summary

In general, this disclosure describes techniques for leveraging a containerized routing protocol process to implement virtual private networks using routing protocols. In an example, a system comprises a container orchestration system for a cluster of computing devices, the cluster of computing devices including a computing device, wherein the container orchestration system is configured to: deploy a containerized application to a compute node; and in response to deploying the containerized application to the compute node, configure in the compute node a virtual routing and forwarding (VRF) instance to implement a virtual private network (VPN) for the containerized application.