Systems and methods for on-demand flow-based policy enforcement in multi-cloud environments

1. A system comprising:

one or more processors; and

at least one computer-readable storage medium having stored therein instructions which, when executed by the one or more processors, cause the system to:

discover a path from a first endpoint in a first cloud to a second endpoint in a second cloud;

determine runtime policy table capacities associated with nodes in the path, wherein corresponding runtime policy table capacities for the nodes in the path indicate a total capacity of each of the nodes for implementing rules of policies;

determine policy distribution for splitting the policies on a per-node basis across at least a portion of a plurality of nodes in the path and enforcement for traffic from the first endpoint to the second endpoint according to the runtime policy table capacities associated with the nodes in the path;

install the policies on a set of the nodes in the path based on the policy distribution and the enforcement; and

apply the policies to data transmitted from the first endpoint in the first cloud to the second endpoint in the second cloud.

2. The system of claim 1 , wherein the discovering the path further comprises determining the plurality of nodes in the path.

3. The system of claim 2 , wherein determining the runtime policy table capacities and the policy distribution and enforcement comprises:

performing a runtime check on a respective policy table capacity of a subset of nodes from the plurality of nodes in the path;

determining, based on the runtime check, at least one node from the subset of nodes on which to install at least a portion of the policies;

running a destination address of the second endpoint against one or more routing tables in the path leading to the node; and

fetching a widest subnet in the path that includes a respective address of the node.

4. The system of claim 3 , wherein installing policies comprises installing a policy enabling traffic for the widest subnet, the policy being installed at one of the first endpoint, the second endpoint, or the node in the path.

5. The system of claim 3 , further comprising additional instructions stored in the at least one computer-readable storage medium which, when executed by the one or more processors, cause the system to:

install, at the node, one or more filters which only allow traffic from the first endpoint to the second endpoint for one or more specified ports in a contract between a first endpoint group including the first endpoint and a second endpoint group including the second endpoint.

6. The system of claim 1 , wherein the policy distribution and enforcement comprises a funnel enforcement installed at the first endpoint.

7. The system of claim 1 , further comprising additional instructions stored in the at least one computer-readable storage medium which, when executed by the one or more processors, cause the system to:

determine an age of one or more policies installed on at least one of the first endpoint, the second endpoint and one or more of the nodes in the path; and

in response to the age of a policy being greater than a threshold age, removing the policy.

8. A non-transitory computer-readable storage medium comprising:

instructions stored therein instructions which, when executed by one or more processors, cause the one or more processors to:

discover a path from a first endpoint in a first cloud to a second endpoint in a second cloud;

obtain runtime policy table capacities associated with nodes in the path, wherein corresponding runtime policy table capacities for the nodes in the path indicate a total capacity of each of the nodes for implementing rules of policies;

determine policy distribution for splitting the policies on a per-node basis across at least a portion of a plurality of nodes in the path and enforcement for traffic from the first endpoint to the second endpoint according to the runtime policy table capacities;

install a set of the policies on a set of the nodes in the path based on the determined policy distribution and enforcement in the path, the set of policies being associated with the traffic from the first endpoint to the second endpoint; and

apply the set of the policies to traffic from the first endpoint in the first cloud to the second endpoint in the second cloud.

9. The non-transitory computer-readable storage medium of claim 8 , wherein discovering the path comprises identifying the plurality of nodes in the path.

10. The non-transitory computer-readable storage medium of claim 9 , storing additional instructions which, when executed by the one or more processors, cause the one or more processors to:

perform a runtime check on a respective policy table capacity of a subset of nodes of the plurality of nodes in the path;

determine, based on the runtime check, at least one node from the subset of nodes to install at least some of the set of policies;

run a destination address of the second endpoint against routing tables in the path leading to the node; and

fetch a widest subnet in the path that includes at least one of the node and an address associated with the node.

11. The non-transitory computer-readable storage medium of claim 10 , wherein installing the set of policies comprises installing a policy enabling traffic for the widest subnet at the first endpoint.

12. The non-transitory computer-readable storage medium of claim 10 , storing additional instructions which, when executed by the one or more processors, cause the one or more processors to:

install, at the node, one or more filters which only allow traffic from the first endpoint to the second endpoint for one or more specified ports in a contract between a first endpoint group including the first endpoint and a second endpoint group including the second endpoint.

13. The non-transitory computer-readable storage medium of claim 8 , wherein the policy distribution and enforcement comprises a funnel enforcement installed at the first endpoint.

14. The non-transitory computer-readable storage medium of claim 8 , storing additional instructions which, when executed by the one or more processors, cause the one or more processors to:

determine an age of one or more policies installed on at least one of the first endpoint, the second endpoint, and the set of nodes in the path; and

in response to the age of a policy being greater than a threshold age, remove the policy.

15. A method comprising:

discovering a path from a first endpoint in a first cloud to a second endpoint in a second cloud;

determining runtime policy table capacities associated with nodes in the path, wherein corresponding runtime policy table capacities for the nodes in the path indicate a total capacity of each of the nodes for implementing rules of policies;

determining a policy distribution for splitting the policies on a per-node basis across at least a portion of a plurality of nodes in the path and enforcement based on the runtime policy table capacities;

based on the policy distribution and enforcement, installing a set of the policies for traffic from the first endpoint to the second endpoint across a set of nodes in the path; and

applying the set of the policies to traffic from the first endpoint in the first cloud to the second endpoint in the second cloud.

16. The method of claim 15 , wherein discovering the path comprises determining the plurality of nodes in the path.

17. The method of claim 16 , further comprising:

performing a runtime check on a respective policy table capacity of a subset of nodes of the plurality of nodes in the path;

determining, based on the runtime check, at least one node of the plurality of nodes to install the set of policies;

running a destination address of the second endpoint against routing tables in the path leading to the node; and

fetching a widest subnet in the path that includes at least one of the node and an address associated with the node.

18. The method of claim 17 , wherein installing the set of policies comprises installing a policy enabling traffic for the widest subnet, the policy being installed at one of the first endpoint, the second endpoint, and the node in the path.

19. The method of claim 18 , further comprising:

installing, at the node, one or more filters which only allow traffic from the first endpoint to the second endpoint for one or more specified ports in a contract between a first endpoint group including the first endpoint and a second endpoint group including the second endpoint.

20. The method of claim 15 , further comprising:

determining an age of one or more policies installed on at least one of the first endpoint, the second endpoint, and the set of nodes; and

in response the age of a policy being greater than a threshold age, removing the policy.