Scalable multi-tenant underlay network supporting multi-tenant overlay network
Techniques are disclosed for scalable virtualization of tenants and subtenants on a virtualized computing infrastructure. In one example, a first controller for the virtualized computing infrastructure configures underlay network segments in the virtualized computing infrastructure by configuring respective Virtual Extensible Local Area Network (VXLAN) segments of a plurality of VXLAN segments of a VXLAN in a switch fabric comprising network switches. Each VXLAN segment provides underlay network connectivity among a different subset of host computing devices of the virtualized computing infrastructure to enable orchestration of multiple tenants in the VXLAN. A second controller for a first subset of the host computing devices has underlay network connectivity through operation of a first VXLAN segment. The second controller configures overlay networks in the first subset of the host computing devices to enable orchestration of multiple subtenants in the first subset of the host computing devices.
1. A method comprising:
configuring, by a first controller for a virtualized computing infrastructure, a plurality of underlay network segments in the virtualized computing infrastructure by configuring respective Virtual Extensible Local Area Network (VXLAN) segments of a plurality of VXLAN segments of a VXLAN in a switch fabric comprising network switches for the virtualized computing infrastructure, thereby enabling orchestration of multiple tenants in the VXLAN,
wherein each VXLAN segment of the plurality of VXLAN segments provides underlay network connectivity among a different subset of host computing devices of the virtualized computing infrastructure; and
configuring, by a second controller for a first subset of the host computing devices having underlay network connectivity by operation of a first VXLAN segment of the plurality of VXLAN segments, a plurality of overlay networks in the first subset of the host computing devices, thereby enabling orchestration of multiple subtenants of a tenant of the multiple tenants in the first subset of the host computing devices, the second controller different from the first controller.
2. The method of claim 1 , further comprising:
assigning, to each underlay network segment of the plurality of underlay network segments, a different tenant of the multiple tenants; and
controlling, by the first controller, forwarding of network traffic for the tenant to the corresponding underlay network segment of the plurality of underlay network segments to which the tenant is assigned.
3. The method of claim 1 , further comprising:
assigning, to each overlay network of the plurality of overlay networks in the first subset of the host computing devices, a different subtenant of the multiple subtenants;
controlling, by the second controller, for each subtenant of the multiple subtenants, forwarding of network traffic for the subtenant to the corresponding overlay network of the plurality of overlay networks in the first subset of the host computing devices to which the subtenant is assigned.
4. The method of claim 1 , further comprising:
for a first overlay network of the plurality of overlay networks in the first subset of the host computing devices, configuring a plurality of virtual routers configured to process network traffic for a subtenant of the multiple subtenants assigned to the first overlay network.
5. The method of claim 4 , further comprising:
assigning, to the first subset of the host computing devices having underlay network connectivity by operation of the first VXLAN segment of the plurality of VXLAN segments, a plurality of floating IP (FIP) addresses;
assigning, to the first overlay network of the plurality of overlay networks in the first subset of the host computing devices, a subset of the plurality of FIP addresses; and
assigning, to each virtual router of the plurality of virtual routers of the first overlay network, an FIP address of the subset of the plurality of FIP addresses.
6. The method of claim 1 , further comprising provisioning, for the first VXLAN segment of the plurality of VXLAN segments, a Source Network Address Translation (SNAT) gateway between a VXLAN Tunnel End Point (VTEP) for the first VXLAN segment and the plurality of overlay networks.
7. The method of claim 1 ,
assigning, by the first controller and to the first VXLAN segment of the plurality of VXLAN segments, the tenant of the multiple tenants;
assigning, by the second controller and to a first overlay network of the plurality of overlay networks in the first subset of the host computing devices, a first subtenant of the multiple subtenants of the tenant;
controlling, by the first controller, forwarding of network traffic for the first subtenant to the first VXLAN segment of the plurality of VXLAN segments; and
controlling, by the second controller, forwarding of the network traffic for the first subtenant to the first overlay network of the plurality of overlay networks in the first subset of the host computing devices.
8. A system comprising:
a first controller for a virtualized computing infrastructure, the first controller executing on processing circuitry and configured to configure a plurality of underlay network segments in the virtualized computing infrastructure by configuring respective Virtual Extensible Local Area Network (VXLAN) segments of a plurality of VXLAN segments of a VXLAN in a switch fabric comprising network switches for the virtualized computing infrastructure, thereby enabling orchestration of multiple tenants in the VXLAN, wherein each VXLAN segment of the plurality of VXLAN segments provides underlay network connectivity among a different subset of host computing devices of the virtualized computing infrastructure; and
a second controller for a first subset of the host computing devices having underlay network connectivity by operation of a first VXLAN segment of the plurality of VXLAN segments, the second controller configured to configure a plurality of overlay networks in the first subset of the host computing devices, thereby enabling orchestration of multiple subtenants of a tenant of the multiple tenants in the first subset of the host computing devices, wherein the second controller is different from the first controller.
9. The system of claim 8 , wherein the first controller is further configured to:
assign, to each underlay network segment of the plurality of underlay network segments, a different tenant of the multiple tenants; and
control, for each subtenant of the multiple subtenants, forwarding of network traffic for the tenant to the corresponding underlay network segment of the plurality of underlay network segments to which the tenant is assigned.
10. The system of claim 8 , wherein the second controller is further configured to:
assign, to each overlay network of the plurality of overlay networks in the first subset of the host computing devices, a different subtenant of the multiple subtenants;
control forwarding of network traffic for the subtenant to the corresponding overlay network of the plurality of overlay networks in the first subset of the host computing devices to which the subtenant is assigned.
11. The system of claim 8 , wherein the second controller is further configured to:
for a first overlay network of the plurality of overlay networks in the first subset of the host computing devices, configure a plurality of virtual routers configured to process network traffic for a subtenant of the multiple subtenants assigned to the first overlay network.
12. The system of claim 11 ,
wherein the first controller is further configured to assign, to the first subset of the host computing devices having underlay network connectivity by operation of the first VXLAN segment of the plurality of VXLAN segments, a plurality of floating IP (FIP) addresses;
wherein the second controller is further configured to assign, to the first overlay network of the plurality of overlay networks in the first subset of the host computing devices, a subset of the plurality of FIP addresses; and
wherein the second controller is further configured to assign, to each virtual router of the plurality of virtual routers of the first overlay network, an FIP address of the subset of the plurality of FIP addresses.
13. The system of claim 8 , wherein the second controller is further configured to provision, for the first VXLAN segment of the plurality of VXLAN segments, a Source Network Address Translation (SNAT) gateway between a VXLAN Tunnel End Point (VTEP) for the first VXLAN segment and the plurality of overlay networks.
14. A non-transitory, computer-readable medium comprising instructions that, when executed, cause processing circuitry to execute:
a first controller for a virtualized computing infrastructure, the first controller configured to configure a plurality of underlay network segments in the virtualized computing infrastructure by configuring respective Virtual Extensible Local Area Network (VXLAN) segments of a plurality of VXLAN segments of a VXLAN in a switch fabric comprising network switches for the virtualized computing infrastructure, thereby enabling orchestration of multiple tenants in the VXLAN, wherein each VXLAN segment of the plurality of VXLAN segments provides underlay network connectivity among a different subset of host computing devices of the virtualized computing infrastructure; and
a second controller for a first subset of the host computing devices having underlay network connectivity by operation of a first VXLAN segment of the plurality of VXLAN segments, the second controller configured to configure a plurality of overlay networks in the first subset of the host computing devices, thereby enabling orchestration of multiple subtenants of a tenant of the multiple tenants in the first subset of the host computing devices, wherein the second controller is different from the first controller.
15. The computer-readable medium of claim 14 , wherein the first controller is further configured to:
assign, to each underlay network segment of the plurality of underlay network segments, a different tenant of the multiple tenants; and
control forwarding of network traffic for the tenant to the corresponding underlay network segment of the plurality of underlay network segments to which the tenant is assigned.
16. The computer-readable medium of claim 14 , wherein the second controller is further configured to:
assign, to each overlay network of the plurality of overlay networks in the first subset of the host computing devices, a different subtenant of the multiple subtenants;
control, for each subtenant of the multiple subtenants, forwarding of network traffic for the subtenant to the corresponding overlay network of the plurality of overlay networks in the first subset of the host computing devices to which the subtenant is assigned.
17. The computer-readable medium of claim 14 , wherein the second controller is further configured to:
configure, for a first overlay network of the plurality of overlay networks in the first subset of the host computing devices, a plurality of virtual routers configured to process network traffic for a subtenant of the multiple subtenants assigned to the first overlay network.
18. The computer-readable medium of claim 17 ,
wherein the first controller is further configured to assign, to the first subset of the host computing devices having underlay network connectivity by operation of the first VXLAN segment of the plurality of VXLAN segments, a plurality of floating IP (FIP) addresses;
wherein the second controller is further configured to assign, to the first overlay network of the plurality of overlay networks in the first subset of the host computing devices, a subset of the plurality of FIP addresses; and
wherein the second controller is further configured to assign, to each virtual router of the plurality of virtual routers of the first overlay network, an FIP address of the subset of the plurality of FIP addresses.
19. The computer-readable medium of claim 15 , wherein the second controller is further configured to provision, for the first VXLAN segment of the plurality of VXLAN segments, a Source Network Address Translation (SNAT) gateway between a VXLAN Tunnel End Point (VTEP) for the first VXLAN segment and the plurality of overlay networks.