Allocation and management of tunnel endpoints in software defined networks
Described herein are systems and methods for allocating to tunnel endpoints to virtual machines on a host. In one example, a host identifies when a new virtual machine is coupled to a virtual switch and determines a tenant associated with the new virtual machine. The host further determines whether a tunnel endpoint is allocated to the tenant and, when a tunnel endpoint has not been allocated, allocates a new tunnel endpoint to the tenant and maps the new virtual machine to the new tunnel endpoint.
1. A method comprising:
identifying a connection of a virtual machine to a port of a virtual switch on a host;
identifying a tenant of a plurality of tenants associated with the virtual machine;
determining that a tunnel endpoint is not allocated to the tenant on the host; and
in response to determining that a tunnel endpoint is not allocated to the tenant:
initiating a tunnel endpoint on the host for the tenant; and
directing traffic for the virtual machine to the initiated tunnel endpoint.
2. The method of claim 1 further comprising:
identifying a second connection of a second virtual machine to a second port of the virtual switch on the host;
identifying a second tenant of the plurality of tenants associated with the second virtual machine;
determining that a second tunnel endpoint is allocated to the second tenant on the host; and
in response to determining that a second tunnel endpoint is allocated to the tenant, directing traffic for the second virtual machine to the second tunnel endpoint.
3. The method of claim 1 , wherein the tunnel endpoint is associated with a tenant identifier.
4. The method of claim 1 , wherein the tunnel endpoint is associated with a tenant identifier, and wherein the tenant identifier comprises at least a source encapsulation internet protocol (IP) address and a virtual local area network (VLAN) tag.
5. The method of claim 1 , wherein the tunnel endpoint is associated with a tenant identifier, and wherein the method further comprises:
after directing traffic for the virtual machine to the tunnel endpoint, obtaining a packet from the virtual machine;
generating a second packet that encapsulates the first packet, wherein the second packet comprises the tenant identifier.
6. The method of claim 5 further comprising:
determining a quality of service associated with the second packet; and
assigning the second packet to an egress queue based on the quality of service.
7. The method of claim 1 further comprising:
identifying a second connection of a second virtual machine to a second port of the virtual switch on the host;
identifying a second tenant of the plurality of tenants associated with the second virtual machine;
determining that a second tunnel endpoint is not allocated to the second tenant on the host; and
in response to determining that a second tunnel endpoint is not allocated to the tenant:
initiating a second tunnel endpoint on the host for the second tenant; and
directing traffic for the second virtual machine to the second initiated tunnel endpoint.
8. The method of claim 1 , wherein the second packet comprises a Virtual Extensible Local Area Network (VXLAN) packet or a Generic Network Virtualization Encapsulation (GENEVE) packet.
9. A computing apparatus comprising:
one or more non-transitory computer readable storage media;
a processing system operatively coupled to the one or more non-transitory computer readable storage media; and
program instructions stored on the one or more non-transitory computer readable storage media that, when executed by the processing system, direct the processing system to:
identify a connection of a virtual machine to a port of a virtual switch on a host;
identify a tenant of a plurality of tenants associated with the virtual machine;
determine that a tunnel endpoint is not allocated to the tenant on the host; and
in response to determining that a tunnel endpoint is not allocated to the tenant:
initiate a tunnel endpoint on the host for the tenant; and
direct traffic for the virtual machine to the initiated tunnel endpoint.
10. The computing apparatus of claim 9 , wherein the program instructions further direct the processing system to:
identify a second connection of a second virtual machine to a second port of the virtual switch on the host;
identify a second tenant of the plurality of tenants associated with the second virtual machine;
determine that a second tunnel endpoint is allocated to the second tenant on the host; and
in response to determining that a second tunnel endpoint is allocated to the tenant, direct traffic for the second virtual machine to the second tunnel endpoint.
11. The computing apparatus of claim 9 , wherein the tunnel endpoint is associated with a tenant identifier.
12. The computing apparatus of claim 9 , wherein the tunnel endpoint is associated with a tenant identifier, and wherein the tenant identifier comprises at least a source encapsulation internet protocol (IP) address and a virtual local area network (VLAN) tag.
13. The computing apparatus of claim 9 , wherein the tunnel endpoint is associated with a tenant identifier, and wherein the program instructions further direct the processing system to:
after directing traffic for the virtual machine to the tunnel endpoint, obtain a packet from the virtual machine;
generate a second packet that encapsulates the first packet, wherein the second packet comprises the tenant identifier.
14. The computing apparatus of claim 13 , wherein the program instructions further direct the processing system to:
determine a quality of service associated with the second packet; and
assign the second packet to an egress queue based on the quality of service.
15. The computing apparatus of claim 9 , wherein the program instructions further direct the processing system to:
identify a second connection of a second virtual machine to a second port of the virtual switch on the host;
identify a second tenant of the plurality of tenants associated with the second virtual machine;
determine that a second tunnel endpoint is not allocated to the second tenant on the host; and
in response to determining that a second tunnel endpoint is not allocated to the tenant:
initiate a second tunnel endpoint on the host for the second tenant; and
direct traffic for the second virtual machine to the second initiated tunnel endpoint.
16. The computing apparatus of claim 9 , wherein the second packet comprises a Virtual Extensible Local Area Network (VXLAN) packet or a Generic Network Virtualization Encapsulation (GENEVE) packet.
17. The computing apparatus of claim 9 , wherein the tunnel endpoint is associated with a tenant identifier, and wherein the program instructions further direct the processing system to notify a control system of the tenant identifier associated with the tenant.
18. An apparatus comprising:
one or more non-transitory computer readable storage media;
a processing system operatively coupled to the one or more non-transitory computer readable storage media; and
program instructions stored on the one or more non-transitory computer readable storage media that, when executed by the processing system, direct the processing system to:
identify a connection of a virtual machine to a port of a virtual switch on a host;
identify a tenant of a plurality of tenants associated with the virtual machine;
determine whether a tunnel endpoint is allocated to the tenant on the host; and
when a tunnel endpoint is not allocated to the tenant:
initiate a tunnel endpoint on the host for the tenant; and
direct traffic for the virtual machine to the initiated tunnel endpoint; and
when a tunnel endpoint is allocated to the tenant:
direct traffic for the virtual machine to the tunnel endpoint.
19. The apparatus of claim 18 , wherein the tunnel endpoint is associated with a tenant identifier, and wherein the tenant identifier comprises at least a source encapsulation internet protocol (IP) address and a virtual local area network (VLAN) tag.
20. The apparatus of claim 18 , wherein the tunnel endpoint is associated with a tenant identifier, and wherein the program instructions further direct the processing system to:
after directing traffic for the virtual machine to the tunnel endpoint, obtain a packet from the virtual machine;
generate a second packet that encapsulates the first packet, wherein the second packet comprises the tenant identifier.