Pod Egress IP Routing for Consistent Source Addresses

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In software-defined networking (SDN) environments, the use of network address translation (SNAT) for egress packets from pods within a cluster results in all pods on the same node sharing the same egress IP address, leading to difficulties in applying differentiated firewall policies and managing dynamic IP addresses, which is undesirable for network security and management.

Innovation Solution

Allocate unique egress IP addresses to pod sets, allowing pods to have distinct egress IP addresses even when running on different nodes, and configure routers with static routes to ensure these addresses are routable across multiple subnets for high availability.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If SNAT is used for egress packets from pods within a cluster, then all pods on the same node share the same egress IP address, but this leads to difficulties in applying differentiated firewall policies and managing dynamic IP addresses

Engineering Contradiction:

Improveease of applying firewall policiesVSAvoidconsistency of egress IP addresses

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent segments the egress IP address space by assigning a dedicated egress IP address to each pod rather than sharing a common egress IP address for all pods on a node. This segmentation enables differentiated firewall policies to be applied to each pod based on its unique egress IP address, while maintaining the benefits of SNAT for cluster egress traffic.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements local quality by assigning each pod a unique egress IP address that is locally significant to that specific pod. This allows each pod to have its own egress identity, enabling fine-grained security policies and consistent IP address management at the pod level while still utilizing the node's networking infrastructure.

Inventive Principle:

Principle #3Local quality

2Device complexity

If a single egress IP address is used for all pods on a node, then network address translation is simplified, but network security and management efficiency are compromised

Engineering Contradiction:

Improvecomplexity of network address translationVSAvoidnetwork security

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary mechanism where the node's networking infrastructure acts as a mediator between the pod's internal IP address and the external network. The node performs SNAT to translate the pod's internal IP to its unique egress IP address, providing both security differentiation and network simplification through this intermediary translation layer.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Adaptability or versatility

If pods can move between nodes dynamically, then workload flexibility is improved, but egress IP address consistency becomes difficult to maintain

Engineering Contradiction:

Improvepod mobilityVSAvoidconsistency of egress IP addresses

Core Design Contradiction:

Adaptability or versatilityVSStability of the object's composition

Solution Approach 1:

The patent implements a copying mechanism where each pod receives a copy of a unique egress IP address from the node it is deployed on. This copied IP address remains consistent with the pod's identity even when the pod migrates between nodes, as each node provides the pod with its own dedicated egress IP address that is tied to the pod rather than the physical node.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The patent implements dynamics by allowing the egress IP address assignment to be dynamic at pod deployment time while maintaining consistency throughout the pod's lifecycle. The system dynamically assigns a unique egress IP address to each pod when it is scheduled on a node, and this address remains stable even if the pod is rescheduled on a different node, providing both flexibility and consistency.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS12587499B2High-availability egress access with consistent source IP addresses for workloads

Publication Date: 2026.03.24 VMWARE INC

AI summary

Systems and methods for configuring an egress node for an egress pod set comprising one or more pods are provided. The egress pod set may be allocated one or more egress internet protocol (IP) addresses. The egress node may be selected among nodes of a cluster including the one or more pods. The egress node may be configured as the routing destination for an egress IP address selected among the one or more egress internet protocol (IP) addresses.