Subnet Port Objects for Container Workload Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant networking environments, there is a need to efficiently assign containerized workloads to isolated network constructs to ensure network isolation and security between different tenants and sub-tenants.
Innovation Solution
The method involves using custom resources such as subnet port and network interface custom resources to assign containerized workloads to specific subnets within a virtual private cloud (VPC) in a Kubernetes cluster, thereby achieving network isolation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If containerized workloads are assigned to isolated network constructs in multi-tenant environments, then network isolation and security are improved, but device complexity and configuration difficulty increase
Solution Approach 1:
The patent segments the network into multiple isolated subnets, with each subnet serving specific containerized workloads. This segmentation enables network isolation between different tenants and sub-tenants, allowing workloads to be assigned to appropriate subnets based on security requirements while maintaining manageable complexity through structured organization.
Solution Approach 2:
The patent introduces subnet port objects and network interface objects as intermediary components that simplify the assignment of containerized workloads to subnets. These intermediary objects abstract the complex network configuration details, providing a standardized interface for workload assignment while maintaining the underlying network isolation architecture.
2Adaptability or versatility
If custom resources are used to assign workloads to subnets, then assignment flexibility and control are improved, but ease of operation deteriorates due to additional configuration steps
Solution Approach 1:
The patent creates universal subnet port objects and network interface objects that can be used across different tenants and sub-tenants in multi-tenant environments. These objects provide multi-functional capabilities, enabling standardized workload assignment to subnets while maintaining the flexibility to accommodate different network isolation requirements through a common interface.
Solution Approach 2:
The patent performs preliminary creation of subnet port objects and network interface objects before assigning containerized workloads. This preliminary action prepares the network infrastructure in advance, allowing workloads to be assigned to pre-configured subnets without complex real-time configuration, thereby improving ease of operation while maintaining assignment flexibility.
Data Source
AI summary
The disclosure provides a method for assigning containerized workloads to isolated network constructs within a networking environment associated with a container-based cluster. The method generally includes receiving, at the container-based cluster, a subnet port custom resource specification to initiate creation of a subnet port object to assign a node to a subnet within the networking environment, wherein one or more containerized workloads are running on the node, in response to receiving the subnet port custom resource specification, creating the subnet port object, and modifying a state of the container-based cluster to match a first intended state of the container-based cluster at least specified in the subnet port object, wherein modifying the state comprises assigning the node to the subnet in the networking environment.