Stateful Service Containers via Network Virtualization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing sidecar container architectures in micro-services applications are inflexible due to their dependency on attached proxies, limiting mobility and requiring fixed service deployments, and legacy virtual machines rely on middleboxes for inline services like load balancing and intrusion detection, which complicates deployment and mobility.
Innovation Solution
A method is introduced to configure multiple sets of service containers on a host computer to perform service operations such as firewall and load balancing on data messages, with a module identifying necessary operations and directing messages to appropriate containers, allowing for flexible deployment and migration across machines and networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sidecar containers are deployed in series with forwarding across individual service containers, then service operations such as authentication, service discovery, encryption, and load balancing can be handled, but mobility of the container is restricted due to dependency on the attached sidecar proxy and service deployment is fixed
Solution Approach 1:
The patent extracts the sidecar proxy dependency from the container architecture by introducing a network virtualization layer that provides service operations independently of container attachment. This allows containers to move freely while maintaining service capabilities through the virtualized network infrastructure.
Solution Approach 2:
The network virtualization layer provides universal service operations (authentication, service discovery, encryption, load balancing) that can serve multiple containers simultaneously without requiring each container to have its own dedicated sidecar proxy, enabling both reliable service handling and container mobility.
2Reliability
If middleboxes are used for inline services in virtual machines running legacy applications, then services such as load balancing and intrusion detection can be deployed, but deployment complexity increases and mobility is limited due to inability to modify VM images
Solution Approach 1:
The patent introduces a network virtualization intermediary layer between the legacy VMs and the network infrastructure. This mediator provides inline services (load balancing, intrusion detection) without requiring modification of VM images, simplifying deployment while maintaining service capabilities.
3Reliability
If fixed service deployment is used with sidecar proxies, then service operations can be performed reliably, but service bottlenecks occur and scalability is limited
Solution Approach 1:
The patent segments the service operation functionality from individual containers and centralizes it in the network virtualization layer. This segmentation eliminates service bottlenecks by allowing parallel service operations across multiple containers without requiring each container to maintain its own service chain, thereby improving scalability while maintaining reliability.
Data Source
AI summary
Some embodiments provide a method for performing services on a host computer that executes several machines in a datacenter. The method configures a first set of one or more service containers for a first machine executing on the host computer, and a second set of one or more service containers for a second machine executing on the host computer. Each configured service container performs a service operation (e.g., a middlebox service operation, such as firewall, load balancing, encryption, etc.) on data messages associated with a particular machine (e.g., on ingress and/or egress data messages to and/or from the particular machine). For each particular machine, the method also configures a module along the particular machine's datapath to identify a subset of service operations to perform on a set of data messages associated with the particular machine, and to direct the set of data messages to a set of service containers configured for the particular machine to perform the identified set of service operations on the set of data messages. In some embodiments, the first and second machines are part of one logical network or one virtual private cloud that is deployed over a common physical network in the datacenter.