Techniques for identity and policy based routing
View Patent ↗Techniques for identity and policy based routing are presented. A resource is initiated on a device with a resource identity and role assignments along with policies are obtained for the resource. A customized network is created for the resource using a device address for the device, the resource identity, the role assignments, and the policies.
1. A method implemented in a non-transitory machine-readable storage medium and processed by one or more processors configured to perform the method, comprising:
initiating a workload on a first device;
authenticating the workload to an identity service to establish a workload identity;
setting access privileges, role assignments, and policies as acquired from the identity service and in response to the workload identity;
registering the workload via the workload identity as a customized network, the customized network based on: the workload identity, the role assignments, and the policies and the customized network is a Virtual Private Network (VPN) that defines all resources and devices that the workload can see and can access and at least some devices dynamically register and join the VPN and initially the customized network just includes the workload by itself on an initial device and subsequently other workloads and devices dynamically register and join in the customized network; and
building one or more network routes for the workload that identifies network access routes to other devices and/or other workloads on the customized network based on: the workload identity, the role assignments, and the policies.
2. The method of claim 1 further comprising, pushing the network routes as a customized network routing table to one or more network routers for enforcement.
3. The method of claim 1 further comprising:
detecting a new role assigned to the workload identity on the first device;
contacting the identity service with the new role to acquire one or more new routes for the workload to a new customized network based on the new role; and
dynamically pushing the new routes to one or more network routers permitting the workload to dynamically join and participate in the new customized network.
4. The method of claim 1 further comprising:
detecting a new workload that dynamically authenticates with the identity service with a particular identity and a particular role that is assigned to the workload;
receiving an indication from the identity service that the new workload belongs in the customized network; and
dynamically updating the one or more network routes to expose the new workload to the workload within the customized network and vice versa.
5. The method of claim 1 , wherein initiating further includes provisioning network services to support the workload on the first device, the network services having one or more of the roles assigned to the workload to ensure that the network services participate in the customized network with the workload.
6. The method of claim 1 , wherein authenticating further includes acquiring credentials from a principal associated with the workload and passing the credentials to the identity service to establish the workload identity within the identity service.
7. The method of claim 1 , wherein setting further includes identifying the policies as connection instructions within the customized network for the workload to use when connecting to the other devices and/or the other workloads.
8. The method of claim 1 , wherein registering further includes registering the workload as the customized network with the identity service.
9. The method of claim 1 , wherein building further includes passing the workload identity, the role assignments, and the policies to a network driver and a network card associated with the first device to build the one or more network routes.
10. A method implemented in a non-transitory machine-readable storage medium and processed by one or more processors configured to perform the method, comprising:
receiving a network registration request having a resource identity for a resource and a machine address that has the resource;
acquiring role assignments and policies for the resource based on the resource identity; and
building customized routes for a custom network having the resource identity based on the role assignments, the policies, and the machine address, the custom network a virtual network that defines all resources and devices that the workload can see and access and other workloads and other devices dynamically register and join the virtual network and initially the custom network just includes the workload by itself on an initial device and subsequently the other workloads and the other devices dynamically register and join in the custom network.
11. The method of claim 10 further comprising, pushing the customized routes to one or more network routers as one or more routing tables.
12. The method of claim 10 further comprising, dynamically updating the customized routes in response to a changed role communicated by an identity service.
13. The method of claim 10 , wherein receiving further includes obtaining the network registration request from a network driver via a network card on the machine of the resource.
14. The method of claim 10 , wherein receiving further includes identifying the resource as an end-user.
15. The method of claim 10 , wherein acquiring further includes obtaining the role assignments and polices from an identity service when the identity service is provided the resource identity.
16. The method of claim 10 , wherein building further includes creating the customized routes in a target format recognized by a target router that is to enforce the customized routes.
17. A multi-processor implemented system, comprising:
a memory having a provisioning service configured to execute on one or more processors from the memory;
the memory having an identity service configured to execute on one or more of the processors from the memory; and
the memory having a registration service configured to execute on one or more of the processors from the memory;
the provision service is configured to instantiate a resource on a first device, the identity service is configured to authenticated the resource and supply a resource identity along with role assignments and policies, the registration service is configured to use the resource identity, the role assignments and the policies to build custom routes for a custom network that the resource belongs to and the custom network is a virtual network having all resources and devices defined that the workload can see and can access and other workloads and other devices dynamically register and join the custom network and initially the custom network just includes the workload by itself on an initial device and subsequently other workloads and devices dynamically register and join in the custom network.
18. The system of claim 17 , wherein the provisioning service is to initiate a network driver on the first device that participates in the customized network and that securely communicates with the registration service to initiate the building of the custom routes.
19. The system of claim 17 , wherein the provisioning service is configured to contact the identity service for the resource identity, the role assignments and the policies.
20. The system of claim 17 , wherein the registration service is configured to verify the resource identity, the role assignments, and the policies via the identity service.