Transparent, on-demand route determination and delegated authorization in a large-scale, decentralized service mesh

1 . A system, comprising:

at least one processor; and

at least one memory that stores executable instructions that, when executed by the at least one processor, facilitate performance of operations, comprising:

executing a containerized application that comprises a microservice of a group of microservices maintained by a decentralized service mesh architecture, wherein the group of microservices executes on nodes;

intercepting, by a kernel-space application of a node of the nodes, a call from the microservice that is directed to a remote endpoint that is external to the decentralized service mesh architecture, wherein the kernel-space application operates in a kernel space of the node, and wherein the microservice executes in a user space of the node;

performing, by the kernel-space application, an authorization check on the call based on an identification of the microservice and a virtual address of the remote endpoint identified in the call, to produce an authorization result;

determining, by the kernel-space application, connectivity information of the remote endpoint based on the virtual address of the remote endpoint identified in the call; and

relaying, by the kernel-space application, network traffic between the microservice and the remote endpoint, based on the authorization result indicating that the call is authorized and using the connectivity information.

2 . The system of claim 1 , wherein the intercepting occurs based on identifying the virtual address of the remote endpoint in the call.

3 . The system of claim 2 , wherein the call is a first call, wherein the intercepting is a first intercepting, wherein the virtual address is a first virtual address, wherein the remote endpoint is a first remote endpoint, and wherein the operations further comprise:

refraining from performing a second intercepting of a second call based on the second call omitting an identification of a second virtual address of a second remote endpoint, wherein the second virtual address comprises the first virtual address or another virtual address other than the first virtual address, and wherein the second remote endpoint comprises the first remote endpoint or another remote endpoint other than the first remote endpoint.

4 . The system of claim 2 , wherein the kernel-space application is configured to access identifications of virtual addresses for remote endpoints that are in use by the system.

5 . The system of claim 1 , wherein the operations further comprise:

sharing, by a user-space application that executes in the user space of the node and with the kernel-space application, authorization data and routing data via a system call, wherein the authorization data is representative of an authorization to relay the network traffic, wherein the routing data is representative of at least one route via which the network traffic is able to be relayed, and wherein the kernel-space application uses the authorization data and uses the routing data in performing the relaying of the network traffic.

6 . The system of claim 1 , wherein the kernel space of the node comprises a memory address space of the node in which an operating system kernel of the node operates.

7 . The system of claim 1 , wherein the user space of the node comprises a memory address space of the node in which user applications of the node operate.

8 . A method, comprising:

intercepting, by a kernel-space application of a system comprising at least one processor, a call from a microservice that is directed to a remote endpoint that is external to a decentralized service mesh architecture that comprises the microservice;

performing, by the kernel-space application, an authorization check on the call based on an identification of the microservice and a virtual address of the remote endpoint identified in the call, to produce an authorization result;

determining, by the kernel-space application, connectivity information of the remote endpoint based on the virtual address; and

relaying, by the kernel-space application, network traffic between the microservice and the remote endpoint, based on the authorization result indicating that the call is authorized and using the connectivity information.

9 . The method of claim 8 , wherein the relaying of the network traffic between the microservice and the remote endpoint comprises extending the decentralized service mesh architecture to comprise the remote endpoint.

10 . The method of claim 8 , wherein control and management plane functions of the decentralized service mesh architecture are distributed across a group of nodes that comprises a node via which the kernel-space application executes.

11 . The method of claim 8 , wherein the network route to the remote endpoint comprises a connectivity mechanism that satisfies a security criterion.

12 . The method of claim 8 , wherein a group of nodes that comprises a node via which the kernel-space application executes, and wherein respective nodes of the group of nodes comprise respective instances of the kernel-space application.

13 . The method of claim 8 , wherein the kernel-space application responds to network events associated with the microservice.

14 . The method of claim 8 , wherein authorization of the microservice and determining the connectivity information of the remote endpoint are performed based on the call.

15 . A non-transitory computer-readable medium comprising instructions that, in response to execution, cause a system comprising at least one processor to perform operations, comprising:

intercepting, by a kernel-space application, a call from a user-space application that is directed to a remote endpoint;

authorizing, by the kernel-space application, the call based on an identification of the user-space application and a virtual address of the remote endpoint identified in the call, to produce an authorization result;

determining, by the kernel-space application, connectivity information of the remote endpoint based on the virtual address; and

relaying, by the kernel-space application, network traffic between the user-space application and the remote endpoint, based on the authorizing of the call and using the connectivity information.

16 . The non-transitory computer-readable medium of claim 15 , wherein the user-space application is a first user-space application, wherein the network traffic is first network traffic, wherein the remote endpoint is a first remote endpoint, and wherein the operations further comprise:

intercepting and relaying, by the kernel-space application, second network traffic between a second user-space application and a second remote endpoint, wherein the second user-space application comprises the first user-space application or another user-space application, and wherein the second remote endpoint comprises the first remote endpoint or another remote endpoint.

17 . The non-transitory computer-readable medium of claim 15 , wherein the microservice omits a capability to directly communicate with the remote endpoint.

18 . The non-transitory computer-readable medium of claim 15 , wherein the intercepting occurs based on identifying the virtual address of the remote endpoint in the call.

19 . The non-transitory computer-readable medium of claim 18 , wherein identifications of virtual addresses for remote endpoints that are in use by the system are accessible by the kernel-space application.

20 . The non-transitory computer-readable medium of claim 15 , wherein the user-space application is a first user-space application, and wherein the operations further comprise:

sharing, by a second user-space application and with the kernel-space application, authorization data and routing data via a system call, wherein the authorization data is representative of an authorization to relay the network traffic, wherein the routing data is representative of at least one route via which the network traffic is able to be relayed, and wherein the kernel-space application uses the authorization data and uses the routing data in performing the relaying of the network traffic.