Per-application VPN in container based environments
One or more VPN tunnels are established in a site-to-site configuration. A VPN transition subnet is defined and associated with each VPN tunnel. Once the VPN tunnel(s) and the LAN(s) have been configured, a per-application VPN policy can be specified for any applications that require site-to-site VPN access. Whenever a new application is launched, a container is created for executing the VM. The VPN management system reads the VPN policy to determine whether the application is permitted to access any VPN tunnels. If the application is permitted to access a VPN tunnel, a vNIC is generated on the VM for the container of the application and/or a new IP address on the vNIC is assigned to the container. The new IP address and/or the new vNIC are then added to the VPN transition subnet associated with the VPN tunnel to enable the application to access the VPN tunnel.
1. A method for enabling per-application virtual private network (VPN) capability for containers, the method comprising:
establishing a VPN tunnel of a site-to-site configuration and associating a local area network (LAN) with the VPN tunnel, wherein the VPN tunnel and the LAN are established by invoking one or more application programming interfaces (APIs) of a network virtualization software;
receiving a per-application VPN policy that specifies which applications are permitted to access one or more VPN tunnels and storing the per-application VPN policy;
detecting a launch of an application on a virtual machine (VM) and creating a container to execute the application on the VM;
determining, based on the per-application VPN tunnel policy, that the application being launched is permitted to access the VPN tunnel;
generating a virtual Network Interface Controller (vNIC) for the container of the application on the VM and assigning a new Internet Protocol (IP) address on the vNIC to the container, wherein the vNIC is created for the container using a hypervisor hosting the VM; and
connecting the vNIC to the LAN associated with the VPN tunnel based on the per-application VPN policy to enable the application running in the container to access the VPN tunnel.
2. The method of claim 1 , wherein the vNIC is dedicated to the container executing the application.
3. The method of claim 1 , wherein the vNIC is shared between the container executing the application and a second container executing one or more other applications.
4. The method of claim 1 , further comprising:
determining that the per-application VPN tunnel policy has been modified to no longer permit the application to access the VPN tunnel;
disconnecting the IP address of the container from the LAN associated with the VPN tunnel to disable the application running in the container from accessing the VPN tunnel.
5. The method of claim 1 , wherein the LAN is a subnet of a local network in the data center that is configured to link to a VPN tunnel in a remote location.
6. A computing device, comprising:
at least one processor; and
memory including instructions that, when executed by the at least one processor, cause the computing device to:
establish a VPN tunnel of a site-to-site configuration and associate a local area network (LAN) with the VPN tunnel, wherein the VPN tunnel and the LAN are established by invoking one or more application programming interfaces (APIs) of a network virtualization software;
receive a per-application VPN policy that specifies which applications are permitted to access one or more VPN tunnels and store the per-application VPN policy;
detect a launch of an application on a virtual machine (VM) and create a container to execute the application on the VM;
determine, based on the per-application VPN tunnel policy, that the application being launched is permitted to access the VPN tunnel;
generate a virtual Network Interface Controller (vNIC) for the container of the application on the VM and assign a new Internet Protocol (IP) address on the vNIC to the container, wherein the vNIC is created for the container using a hypervisor hosting the VM; and
connect the vNIC to the LAN associated with the VPN tunnel based on the per-application VPN policy to enable the application running in the container to access the VPN tunnel.
7. The computing device of claim 6 , wherein the vNIC is dedicated to the container executing the application.
8. The computing device of claim 6 , wherein the vNIC is shared between the container executing the application and a second container executing one or more other applications.
9. The computing device of claim 6 , wherein the memory further includes instructions that, when executed by the at least one processor, cause the computing device to:
determine that the per-application VPN tunnel policy has been modified to no longer permit the application to access the VPN tunnel;
disconnect the IP address of the container from the LAN associated with the VPN tunnel to disable the application running in the container from accessing the VPN tunnel.
10. The computing device of claim 6 , wherein the LAN is a subnet of a local network in the data center that is configured to link to a VPN tunnel in a remote location.
11. A non-transitory computer readable storage medium comprising one or more sequences of instructions, the instructions when executed by one or more processors causing the one or more processors to execute the operations of:
establishing a VPN tunnel of a site-to-site configuration and associating a local area network (LAN) with the VPN tunnel, wherein the VPN tunnel and the LAN are established by invoking one or more application programming interfaces (APIs) of a network virtualization software;
receiving a per-application VPN policy that specifies which applications are permitted to access one or more VPN tunnels and storing the per-application VPN policy;
detecting a launch of an application on a virtual machine (VM) and creating a container to execute the application on the VM;
determining, based on the per-application VPN tunnel policy, that the application being launched is permitted to access the VPN tunnel;
generating a virtual Network Interface Controller (vNIC) for the container of the application on the VM and assigning a new Internet Protocol (IP) address on the vNIC to the container, wherein the vNIC is created for the container using a hypervisor hosting the VM; and
connecting the vNIC to the LAN associated with the VPN tunnel based on the per-application VPN policy to enable the application running in the container to access the VPN tunnel.
12. The non-transitory computer readable storage medium of claim 11 , wherein the vNIC is dedicated to the container executing the application.
13. The non-transitory computer readable storage medium of claim 11 , wherein the vNIC is shared between the container executing the application and a second container executing one or more other applications.
14. The non-transitory computer readable storage medium of claim 11 , wherein the LAN is a subnet of a local network in the data center that is configured to link to a VPN tunnel in a remote location.