Data plane isolation for virtual machine (VM) mobility operations
Techniques for implementing data plane isolation for VM mobility operations are provided. In one set of embodiments, these techniques include creating a virtual network path between a source host system and a destination host system participating in a VM mobility operation, which allows the host systems to exchange data for carrying out the operation without exposing their physical IP addresses to each other and without requiring the use of intermediate proxies. In certain embodiments, the virtual network path can be dynamically established upon initiation of the VM mobility operation and dynamically rolled back upon operation completion, thereby reducing the overhead of virtual path management.
1. A method comprising:
receiving, by a first computer system and a second computer system, a request to migrate a virtual machine (VM) from a source host system to a destination host system, the request being sent by global mobility manager, the global mobility manager being configured to allocate virtual addresses and routes in a networking routing table;
creating, by the first and second computer systems, a virtual network path between the source and destination host systems, the virtual network path enabling the source and destination host systems to migrate the VM without exposing a physical Internet Protocol (IP) address of the source host system to the destination host system or a physical IP address of the destination host system to the source host system; and
once the VM has been migrated, tearing down, by the first and second computer systems, the virtual network path;
wherein the first computer system and the second computer system reside in different virtual infrastructure management domains and are connected via a wide area network.
2. The method of claim 1 wherein the first computer system and first host system reside at a first site, wherein the second computer system and the second host system reside at a second site, and wherein the first and second sites are part of different virtual infrastructure (VI) management domains.
3. The method of claim 1 wherein creating the virtual network path comprises:
allocating, by the first computer system, a virtual IP address to the source host system from a first virtual IP subnet assigned to the first site;
allocating, by the second computer system, a virtual IP address to the destination host system from a second virtual IP subnet assigned to the second site;
sending, by the first computer system, the virtual IP address allocated to the source host system to the second computer system; and
sending, by the second computer system, the virtual IP address allocated to the destination host system to the first computer system.
4. The method of claim 3 wherein the first and second virtual IP subnets are assigned by a third computer system configured to ensure that the virtual network path can be created without conflicts in the virtual IP addresses allocated to the source and destination host systems.
5. The method of claim 3 wherein creating the virtual network path further comprises:
programming, by the first computer system, one or more network address translation (NAT) rules in a first gateway at the first site for translating between the virtual IP address allocated to the source host system and a physical IP address of the source host system; and
programming, by the second computer system, one or more NAT rules in a second gateway at the second site for translating between the virtual IP address allocated to the destination host system and a physical IP address of the destination host system.
6. The method of claim 4 wherein creating the virtual network path further comprises:
programming, by the first computer system, one or more routes in a network routing table of the source host system for forwarding all network traffic destined for the virtual IP address allocated to the destination host system to the first gateway; and
programming, by the second computer system, one or more routes in a network routing table of the destination host system for forwarding all network traffic destined for the virtual IP address allocated to the source host system to the second gateway.
7. The method of claim 4 wherein, upon creation of the virtual network path, a first VI management server at the first site sends a first migration specification to the source host system that specifies the VM and the virtual IP address allocated to the destination host system and sends a second migration specification to a second VI management server at the second site that specifies the VM and the virtual IP address allocated to the source host system, and wherein the second VI management server sends the second migration specification to the destination host system.
8. A non-transitory computer readable storage medium having stored thereon program code executable by a first computer system and a second computer system, the program code embodying a method comprising:
receiving a request to migrate a virtual machine (VM) from a source host system to a destination host system, the request being sent by global mobility manager, the global mobility manager being configured to allocate virtual addresses and routes in a networking routing table;
creating a virtual network path between the source and destination host systems, the virtual network path enabling the source and destination host systems to migrate the VM without exposing a physical Internet Protocol (IP) address of the source host system to the destination host system or a physical IP address of the destination host system to the source host system; and
once the VM has been migrated, tearing down the virtual network path;
wherein the first computer system and the second computer system reside in different virtual infrastructure management domains and are connected via a wide area network.
9. The non-transitory computer readable storage medium of claim 8 wherein the first computer system and first host system reside at a first site, wherein the second computer system and the second host system reside at a second site, and wherein the first and second sites are part of different virtual infrastructure (VI) management domains.
10. The non-transitory computer readable storage medium of claim 8 wherein creating the virtual network path comprises:
allocating, by the first computer system, a virtual IP address to the source host system from a first virtual IP subnet assigned to the first site;
allocating, by the second computer system, a virtual IP address to the destination host system from a second virtual IP subnet assigned to the second site;
sending, by the first computer system, the virtual IP address allocated to the source host system to the second computer system, and
sending, by the second computer system, the virtual IP address allocated to the destination host system to the first computer system.
11. The non-transitory computer readable storage medium of claim 10 wherein the first and second virtual IP subnets are assigned by a third computer system configured to ensure that the virtual network path can be created without conflicts in the virtual IP addresses allocated to the source and destination host systems.
12. The non-transitory computer readable storage medium of claim 10 wherein creating the virtual network path further comprises:
programming, by the first computer system, one or more network address translation (NAT) rules in a first gateway at the first site for translating between the virtual IP address allocated to the source host system and a physical IP address of the source host system; and
programming, by the second computer system, one or more NAT rules in a second gateway at the second site for translating between the virtual IP address allocated to the destination host system and a physical IP address of the destination host system.
13. The non-transitory computer readable storage medium of claim 10 wherein creating the virtual network path further comprises:
programming, by the first computer system, one or more routes in a network routing table of the source host system for forwarding all network traffic destined for the virtual IP address allocated to the destination host system to the first gateway; and
programming, by the second computer system, one or more routes in a network routing table of the destination host system for forwarding all network traffic destined for the virtual IP address allocated to the source host system to the second gateway.
14. The non-transitory computer readable storage medium of claim 11 wherein, upon creation of the virtual network path, a first VI management server at the first site sends a first migration specification to the source host system that specifies the VM and the virtual IP address allocated to the destination host system and sends a second migration specification to a second VI management server at the second site that specifies the VM and the virtual IP address allocated to the source host system, and wherein the second VI management server sends the second migration specification to the destination host system.
15. A first computer system comprising:
a processor; and
a non-transitory computer readable medium having stored thereon program code that causes the processor to, in conjunction with a second computer system:
receive a request to migrate a virtual machine (VM) from a source host system to a destination host system, the request being sent by global mobility manager, the global mobility manager being configured to allocate virtual addresses and routes in a networking routing table;
create a virtual network path between the source and destination host systems, the virtual network path enabling the source and destination host systems to migrate the VM without exposing a physical Internet Protocol (IP) address of the source host system to the destination host system or a physical IP address of the destination host system to the source host system; and
once the VM has been migrated, tear down the virtual network path
wherein the first computer system and the second computer system reside in different virtual infrastructure management domains and are connected via a wide area network.
16. The first computer system of claim 15 wherein the first computer system and first host system reside at a first site, wherein the second computer system and the second host system reside at a second site, and wherein the first and second sites are part of different virtual infrastructure (VI) management domains.
17. The first computer system of claim 15 wherein as part of creating the virtual network path, the first computer system allocates a virtual IP address to the source host system from a first virtual IP subnet assigned to the first site, the second computer system allocates a virtual IP address to the destination host system from a second virtual IP subnet assigned to the second site, the first computer system sends the virtual IP address allocated to the source host system to the second computer system, and 7 the second computer system sends the virtual IP address allocated to the destination host system to the first computer system.
18. The first computer system of claim 17 wherein the first and second virtual IP subnets are assigned by a third computer system configured to ensure that the virtual network path can be created without conflicts in the virtual IP addresses allocated to the source and destination host systems.
19. The first computer system of claim 17 wherein as part of creating the virtual network path, the first computer system further programs one or more network address translation (NAT) rules in a first gateway at the first site for translating between the virtual IP address allocated to the source host system and a physical IP address of the source host system, and the second computer system further programs one or more NAT rules in a second gateway at the second site for translating between the virtual IP address allocated to the destination host system and a physical IP address of the destination host system.
20. The first computer system of claim 17 wherein as part of creating the virtual network path, the first computer system further programs one or more routes in a network routing table of the source host system for forwarding all network traffic destined for the virtual IP address allocated to the destination host system to the first gateway, and the second computer system further programs one or more routes in a network routing table of the destination host system for forwarding all network traffic destined for the virtual IP address allocated to the source host system to the second gateway.
21. The first computer system of claim 18 wherein, upon creation of the virtual network path, a first VI management server at the first site sends a first migration specification to the source host system that specifies the VM and the virtual IP address allocated to the destination host system and sends a second migration specification to a second VI management server at the second site that specifies the VM and the virtual IP address allocated to the source host system, and wherein the second VI management server sends the second migration specification to the destination host system.