Cross-VPC SDN Policy Enforcement via Intermediary Controller
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for defining policies in a software-defined network (SDN) for enforcing traffic to and from sets of containers in a Kubernetes container cluster, which current technologies do not effectively address.
Innovation Solution
A method is provided where a second SDN controller cluster, residing in a second VPC, receives resource identifiers from adapters deployed in the first VPC. Using these identifiers, the second SDN controller cluster defines and distributes service policies to network elements to enforce on data messages associated with machines in the first VPC.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a second SDN controller cluster resides in a second VPC to define service policies for containers in a first VPC, then policy enforcement capability across VPCs is improved, but system complexity increases
Solution Approach 1:
A third SDN controller cluster operates in the first VPC as an intermediary between the second SDN controller cluster (in the second VPC) and the network elements (in the first VPC). The third SDN controller cluster receives service policies from the second SDN controller cluster and distributes them to network elements, thereby enabling cross-VPC policy enforcement while reducing the complexity of direct remote control.
Solution Approach 2:
The system is divided into multiple controller clusters with distinct responsibilities: the first SDN controller cluster manages the first VPC infrastructure, the second SDN controller cluster defines service policies remotely, and the third SDN controller cluster handles local policy distribution. This segmentation allows each component to focus on specific functions, improving overall system manageability.
2Productivity
If a third SDN controller cluster is introduced to distribute policies locally, then policy distribution efficiency is improved, but the number of controller clusters increases
Solution Approach 1:
The third SDN controller cluster acts as a local intermediary that receives service policies from the remote second SDN controller cluster and efficiently distributes them to network elements within the first VPC. This intermediary role enables fast local policy deployment without requiring the remote controller to directly manage every network element.
Solution Approach 2:
The third SDN controller cluster serves multiple functions: it receives service policies from the second SDN controller cluster, determines which policies are applicable to network elements in the first VPC, and distributes them accordingly. This multi-functionality justifies the addition of another controller cluster.
Data Source
AI summary
Some embodiments provide a method of implementing service rules for a container cluster that is configured by a first SDN controller cluster. The method registers for event notification from an application programming interface (API) server to receive notification regarding events associated with resources deployed in the container cluster. The method forwards to a second SDN controller cluster resource identifiers collected through the registration for resources of the container cluster. The second SDN controller cluster defines service policies that are not defined by the first SDN controller cluster. The method receives, from the second SDN controller cluster, service policies defined by the second SDN controller cluster based on the resource identifiers. The method distributes service rules defined based on the service policies to network elements in the container cluster to enforce on data messages associated with machines deployed in the container cluster configured by the first SDN controller cluster.