Distributed SDN Controller for Cloud Data Center Network Tenancy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Customers face challenges in migrating applications to public cloud computing infrastructure due to single network tenancy issues, which affect security, separation of network services, and scalability limitations, particularly with the native gateways of public cloud computing infrastructure only able to handle a limited number of Border Gateway Protocol (BGP) routes.
Innovation Solution
Deploying a distributed network controller within the public cloud as microservices within a virtual private cloud (VPC) and replacing the container network interface, extending the BGP-based control plane and Multiprotocol Label Switching (MPLS)-based data plane to maintain network tenancy between on-premise and public cloud environments, using a distributed SDN controller to configure virtual routers for packetized communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If native gateways are used in public cloud computing infrastructure, then network connectivity is provided, but the number of BGP routes is limited to approximately 400 routes
Solution Approach 1:
The network control functionality is segmented from the native gateway into a distributed SDN controller that runs as microservices within the VPC. This segmentation allows the control plane to independently manage BGP routing without being constrained by the data plane gateway's route table limitations, enabling support for thousands of routes through distributed control logic.
Solution Approach 2:
A distributed SDN controller acts as an intermediary between the VPC network and external networks. This controller implements BGP routing functionality that can handle large numbers of routes, mediating between the limited-capability native gateway and the requirements for scalable network connectivity, thereby overcoming the 400-route limitation.
2Device complexity
If single network tenancy is used in public cloud, then infrastructure simplicity is maintained, but security and separation of network services are compromised
Solution Approach 1:
The network control plane is segmented into tenant-isolated SDN controller instances that run as microservices within each VPC. This segmentation maintains infrastructure simplicity by using the cloud provider's existing infrastructure while achieving security through logical isolation of control functions per tenant, allowing each tenant to have dedicated routing control without requiring separate physical infrastructure.
Solution Approach 2:
Each tenant's SDN controller instance provides localized network control with tenant-specific security policies and routing decisions. This local quality approach maintains overall infrastructure simplicity while achieving strong security boundaries, as each tenant's network services are controlled by dedicated controller logic that enforces tenant isolation and security requirements.
3Quantity of substance
If applications are migrated to public cloud, then infrastructure costs are reduced, but visibility and control over network communications are lost
Solution Approach 1:
The SDN controller deployed within the VPC provides self-service network control capabilities to the customer. The controller maintains visibility into network communications by inspecting packets at the virtual router level and enables control through programmable routing policies, allowing customers to retain network management capabilities while benefiting from reduced infrastructure costs in the public cloud.
Solution Approach 2:
The distributed SDN controller serves as an intermediary between the public cloud infrastructure and customer applications. It maintains visibility and control by intercepting and managing network packets between virtual routers, enabling customers to monitor and control network communications without requiring ownership of the underlying physical infrastructure.
Data Source
AI summary
An example system includes first servers deployed in a public cloud computing infrastructure and second servers deployed external to the public cloud computing infrastructure connected to the first servers via a layer 3 network. The first servers include first virtual routers to implement one or more virtual networks and first virtual execution elements. The first virtual execution elements execute a network controller that includes a plurality of microservices. A network device manages network routing for the second servers. The network controller is configured to exchange routing information with the network device. The network controller is configured to configure, based on the routing information, the first virtual routers to configure a virtual network of the one or more virtual networks for packetized communications among the first virtual execution elements executing on the first servers in the public cloud computing infrastructure and the second servers.