Container-based network policy configuration in software-defined networking (SDN) environments

1. A method for a computer system to perform container-based network policy configuration in a software-defined networking (SDN) environment, wherein the method comprises:

in response to detecting a first request to assign a container-based resource with a first label via a container orchestration system, assigning a logical network element associated with the container-based resource with a second label; and

in response to detecting a second request to configure a container-based network policy associated with the container-based resource via the container orchestration system,

identifying the logical network element by mapping the first label assigned to the container-based resource to the second label assigned to the logical network element; and

configuring the container-based network policy to be applicable to network traffic that is forwarded via the logical network element.

2. The method of claim 1 , wherein assigning the logical network element with the second label comprises:

based on the first label that specifies a key-value pair associated with the container-based resource, assigning the logical network element with the second label that also specifies the key-value pair.

3. The method of claim 1 , wherein detecting the second request comprises:

detecting the second request in the form of a custom resource definition (CRD) that selects the container-based resource using the first label.

4. The method of claim 1 , wherein identifying the logical network element comprises:

mapping (a) the first label assigned to the container-based resource in the form of a node to (b) the second label assigned to the logical network element in the form of a logical switch port that connects the node to a logical switch.

5. The method of claim 1 , wherein identifying the logical network element comprises:

mapping (a) the first label assigned to the container-based resource in the form of a pod of one or more containers to (b) the second label assigned to the logical network element in the form of a logical switch port that connects the pod to a logical switch.

6. The method of claim 1 , wherein configuring the container-based network policy cause the processor to:

configuring the container-based network policy in the form of a firewall rule to allow or block traffic between the container-based resource and a second container-based resource.

7. The method of claim 6 , wherein the method further comprises:

configuring the firewall rule to allow or block traffic between (a) a first group that includes the logical network element and (b) a second group that includes a second logical network element associated with the second container-based resource.

8. A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a computer system, cause the processor to perform a method of container-based network policy configuration in a software-defined networking (SDN) environment, wherein the method comprises:

in response to detecting a first request to assign a container-based resource with a first label via a container orchestration system, assigning a logical network element associated with the container-based resource with a second label; and

in response to detecting a second request to configure a container-based network policy associated with the container-based resource via the container orchestration system,

identifying the logical network element by mapping the first label assigned to the container-based resource to the second label assigned to the logical network element; and

configuring the container-based network policy to be applicable to network traffic that is forwarded via the logical network element.

9. The non-transitory computer-readable storage medium of claim 8 , wherein assigning the logical network element with the second label comprises:

based on the first label that specifies a key-value pair associated with the container-based resource, assigning the logical network element with the second label that also specifies the key-value pair.

10. The non-transitory computer-readable storage medium of claim 8 , wherein detecting the second request comprises:

detecting the second request in the form of a custom resource definition (CRD) that selects the container-based resource using the first label.

11. The non-transitory computer-readable storage medium of claim 8 , wherein identifying the logical network element comprises:

mapping (a) the first label assigned to the container-based resource in the form of a node to (b) the second label assigned to the logical network element in the form of a logical switch port that connects the node to a logical switch.

12. The non-transitory computer-readable storage medium of claim 8 , wherein identifying the logical network element comprises:

mapping (a) the first label assigned to the container-based resource in the form of a pod of one or more containers to (b) the second label assigned to the logical network element in the form of a logical switch port that connects the pod to a logical switch.

13. The non-transitory computer-readable storage medium of claim 8 , wherein configuring the container-based network policy cause the processor to:

configuring the container-based network policy in the form of a firewall rule to allow or block traffic between the container-based resource and a second container-based resource.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the method further comprises:

configuring the firewall rule to allow or block traffic between (a) a first group that includes the logical network element and (b) a second group that includes a second logical network element associated with the second container-based resource.

15. A computer system, comprising:

a processor; and

a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to:

in response to detecting a first request to assign a container-based resource with a first label via a container orchestration system, assigning a logical network element associated with the container-based resource with a second label; and

in response to detecting a second request to configure a container-based network policy associated with the container-based resource via the container orchestration system,

identifying the logical network element by mapping the first label assigned to the container-based resource to the second label assigned to the logical network element; and

configuring the container-based network policy to be applicable to network traffic that is forwarded via the logical network element.

16. The computer system of claim 15 , wherein the instructions for assigning the logical network element with the second label cause the processor to:

based on the first label that specifies a key-value pair associated with the container-based resource, assign the logical network element with the second label that also specifies the key-value pair.

17. The computer system of claim 15 , wherein the instructions for detecting the second request cause the processor to:

detect the second request in the form of a custom resource definition (CRD) that selects the container-based resource using the first label.

18. The computer system of claim 15 , wherein the instructions for identifying the logical network element cause the processor to:

map (a) the first label assigned to the container-based resource in the form of a node to (b) the second label assigned to the logical network element in the form of a logical switch port that connects the node to a logical switch.

19. The computer system of claim 15 , wherein the instructions for identifying the logical network element cause the processor to:

map (a) the first label assigned to the container-based resource in the form of a pod of one or more containers to (b) the second label assigned to the logical network element in the form of a logical switch port that connects the pod to a logical switch.

20. The computer system of claim 15 , wherein the instructions for configuring the container-based network policy cause the processor to:

configure a network policy in the form of a firewall rule to allow or block traffic between the container-based resource and a second container-based resource.

21. The computer system of claim 20 , wherein the instructions further cause the processor to:

configure the firewall rule to allow or deny communication between (a) a first group that includes the logical network element and (b) a second group that includes a second logical network element associated with the second container-based resource.