Subnet Port Objects for Multi-Tenant Network Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant cloud environments, there is a need to efficiently network isolate containerized workloads across different tenants and sub-tenants, ensuring secure and efficient resource allocation within virtual private clouds (VPCs) and subnets.
Innovation Solution
The method involves using custom resources such as subnet port and network interface custom resource specifications to assign containerized workloads to isolated network constructs within a Kubernetes cluster. This includes creating subnet port objects to assign nodes to subnets and network interface objects to define network attachments for VMs, enabling efficient connection to VPC subnets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If containerized workloads are deployed in a multi-tenant cloud environment, then resource utilization and scalability are improved, but network security and isolation between tenants deteriorate
Solution Approach 1:
The patent implements network isolation by segmenting the multi-tenant network into multiple Virtual Private Clouds (VPCs), each VPC further divided into subnets. Containerized workloads are assigned to specific subnets based on tenant and sub-tenant identifiers, creating hierarchical network segments that enforce isolation while allowing resource sharing at higher levels.
Solution Approach 2:
The patent introduces subnet port objects and network interface objects as intermediary components between containerized workloads and the physical network infrastructure. These objects act as mediators that enforce network policies, control traffic flow, and maintain isolation boundaries while enabling flexible resource allocation across multiple tenants.
2Reliability
If network isolation is implemented for each tenant and sub-tenant, then security is improved, but network complexity and configuration overhead increase
Solution Approach 1:
The patent creates reusable subnet port objects and network interface objects that can be instantiated multiple times with different parameters. A single subnet port object template can serve multiple containerized workloads across different tenants by configuring tenant-specific attributes, reducing the need to create unique network configurations for each workload while maintaining isolation.
Solution Approach 2:
The patent implements a nested hierarchical structure where subnets are nested within VPCs, and containerized workloads are nested within subnets. This nested organization allows network isolation to be enforced at multiple levels simultaneously, where inner levels (workloads) inherit isolation properties from outer levels (VPCs), simplifying overall network management while maintaining security.
3Ease of operation
If custom resources are created for subnet port and network interface assignment, then network management flexibility is improved, but system complexity and processing overhead increase
Solution Approach 1:
The patent pre-defines subnet port object templates and network interface object templates with standardized structures and validation rules. These templates are created in advance with all necessary attributes and constraints, allowing rapid instantiation of network configurations without requiring complex runtime processing or ad-hoc configuration for each workload assignment.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
The disclosure provides a method for assigning containerized workloads to isolated network constructs within a networking environment (100) associated with a container-based cluster. The method generally includes receiving, at the container-based cluster, a subnet port custom resource specification to initiate creation of a subnet port object to assign a node to a subnet within the networking environment (100), wherein one or more containerized workloads are running on the node, in response to receiving the subnet port custom resource specification, creating the subnet port object, and modifying a state of the container-based cluster to match a first intended state of the container-based cluster at least specified in the subnet port object, wherein modifying the state comprises assigning the node to the subnet in the networking environment (100).