Kubernetes Subnet Connectivity Modes for Multi-Tenant Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing containerized workload deployments in multi-tenant networks lack effective mechanisms for hierarchical network isolation, leading to inadequate security and flexibility in addressing the connectivity needs of different tenants and their sub-tenants.
Innovation Solution
Implementing custom resource definitions (CRDs) within Kubernetes to create subnets with different connectivity modes (private, project, and public) and assign nodes to these subnets, using subnet custom and port custom resources to manage IP address allocation and network isolation levels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If multiple tenants share the same networking environment in a public cloud, then resource utilization and cost efficiency are improved, but network security isolation between tenants deteriorates
Solution Approach 1:
The patent segments the networking environment into multiple virtual private clouds (VPCs), each isolated from others. Within each VPC, further segmentation into subnets with different connectivity modes (public, private, isolated) creates hierarchical isolation layers. This segmentation allows multiple tenants to share resources while maintaining security boundaries through VPC and subnet dividers.
Solution Approach 2:
The patent introduces VPCs and subnets as intermediary structures between the physical network and individual workloads. These intermediaries provide controlled access points and isolation boundaries, allowing traffic to be routed through defined paths while maintaining security. The subnet port custom resources act as intermediaries for assigning workloads to appropriate subnets.
2Object-affected harmful factors
If network isolation is implemented at the VPC level, then security between tenants is improved, but connectivity flexibility and addressability within the cloud deteriorates
Solution Approach 1:
The patent segments network isolation into multiple levels: VPC-level isolation for tenant separation, and subnet-level isolation for workload-specific connectivity control. This hierarchical segmentation allows fine-grained control over connectivity, enabling workloads to have different access requirements within the same VPC while maintaining overall tenant security.
Solution Approach 2:
The patent applies local quality by providing different connectivity modes (public, private, isolated) to different subnets within the same VPC. Each subnet can have customized connectivity characteristics tailored to specific workload requirements, allowing some workloads to be highly accessible while others remain restricted, all within the secured VPC boundary.
3Manufacturing precision
If hierarchical isolation constructs are implemented, then security and isolation precision are improved, but system complexity and configuration difficulty deteriorates
Solution Approach 1:
The patent implements universal customization through subnet custom resource objects that can be deployed across different VPCs and subnet types. The same custom resource framework handles public subnets, private subnets, and isolated subnets uniformly, reducing configuration complexity despite the hierarchical structure. This multi-functional approach allows a single toolset to manage all isolation levels.
Solution Approach 2:
The patent uses copying by providing templates and examples for subnet custom resource objects that can be replicated across different environments. Users can copy proven subnet configurations and modify them for specific needs, reducing the complexity of creating new isolated environments from scratch. The subnet port custom resources also serve as copyable templates for workload assignments.
Data Source
AI summary
The disclosure provides a method for isolated environments for containerized workloads within a virtual private cloud in a networking environment. The method generally includes defining, by a user, a subnet custom resource object for creating a subnet in the virtual private cloud, wherein defining the subnet custom resource object comprises defining a connectivity mode for the subnet; deploying the subnet custom resource object such that the subnet is created in the virtual private cloud with the connectivity mode specified for the subnet; defining, by the user, a subnet port custom resource object for assigning a node to the subnet, wherein one or more containerized workloads are running on the node; and deploying the subnet port custom resource object such that the node is assigned to the subnet.