Granted Patent B2

US 12,267,212 · App. 18/098,072 · Granted Apr 1, 2025

Inventors: Zhengsheng Zhou (Beijing, CN); Jianjun Shen (Redwood City, CA); Quan Tian (Beijing, CN); Wenfeng Liu (Beijing, CN); Donghai Han (Beijing, CN)

Assignee: VMWare LLC

H04L41/122H04L41/0894

Abstract

Claims (28)

1. A method of implementing service rules for a container cluster that is configured by a first software defined network (SDN) controller cluster, the method comprising:

registering for event notification from an application programming interface (API) server to receive notification regarding a set of events associated with resources deployed in the container cluster;

forwarding to a second SDN controller cluster a plurality of resource identifiers that are collected through the registration for a plurality of resources of the container cluster, the second SDN controller cluster defining service policies that are not defined by the first SDN controller cluster;

receiving, from the second SDN controller cluster, a set of service policies defined by the second SDN controller cluster based on the plurality of resource identifiers; and

distributing service rules defined based on the received set of service policies to network elements in the container cluster, said network elements enforcing the service rules on data messages associated with machines deployed in the container cluster configured by the first SDN controller cluster;

wherein the set of service policies is received by a set of one or more adapters residing in the container cluster and the set of one or more adapters forwards the set of service policies to a third SDN controller cluster that resides in the container cluster but does not configure the container cluster.

2. The method of claim 1 , wherein the notification regarding the set of events comprises notification of one or more updates to the plurality of resource identifiers, the method further comprising receiving the plurality resource identifiers from the API server.

3. The method of claim 1 , wherein the plurality of resource identifiers comprises a plurality of network addresses for the plurality of resources.

4. The method of claim 3 , wherein the plurality of resources comprise one or more of pods and nodes hosting one or more pods in the container cluster.

5. The method of claim 1 , wherein the third SDN controller cluster distributes the set of service policies to a particular agent operating on a particular node in the container cluster, the particular agent is designated as a master agent of the container cluster and the particular node is designated as a master node of the container cluster, and the particular agent uses the set of service policies to define the service rules.

6. The method of claim 5 , wherein the particular agent distributes the service rules to secondary agents operating on secondary nodes in the container cluster for the secondary agents to distribute the service rules to network elements operating in their respective nodes.

7. The method of claim 5 , wherein the particular agent distributes the service rules to network elements operating on the particular node and secondary nodes in the container cluster for the network elements to enforce the service rules.

8. The method of claim 1 , wherein the third SDN controller cluster determines which service policies in the set of service policies are to be enforced at each of the network elements in the container cluster and distributes, to each of a plurality of nodes hosting the network elements, at least a subset of service policies applicable at the node.

9. The method of claim 8 , wherein, at each node, an agent receives the subset of service policies and uses the subset of service policies to define a set of service rules to enforce at the node.

10. The method of claim 9 , wherein, at each node, the agent distributes the set of service rules to network elements operating on the node for the network elements to enforce the set of service rules.

11. The method of claim 9 , wherein, at each node, the agent uses the subset of service policies to define the set of service rules by translating the subset of service policies to Open vSwitch (OVS) flows to enforce at the node.

12. The method of claim 1 , wherein the service rules are to be enforced on data messages exchanged between the machines in the container cluster and machines configured by a third SDN controller cluster.

13. The method of claim 12 , wherein the container cluster is a first container cluster, and the set of service policies is defined by the second SDN controller cluster based also on resource identifiers for resources, deployed in a second container cluster configured by the third SDN controller cluster, sent to the second SDN controller cluster by a set of one or more adapters deployed in the second container cluster.

14. The method of claim 1 , wherein distributing the service rules to the network elements in the container cluster comprises distributing a subset of the service rules to at least two network elements that implement a distributed network element.

15. The method of claim 14 , therein the distributed network element comprises one of a logical switch, a logical router, a logical middlebox service network element.

16. A non-transitory machine readable medium storing a program for execution by at least one processing unit for implementing service rules for a container cluster that is configured by a first software defined network (SDN) controller cluster, the program comprising sets of instructions for:

registering for event notification from an application programming interface (API) server to receive notification regarding a set of events associated with resources deployed in the container cluster;

forwarding to a second SDN controller cluster a plurality of resource identifiers that are collected through the registration for a plurality of resources of the container cluster, the second SDN controller cluster defining service policies that are not defined by the first SDN controller cluster;

receiving, from the second SDN controller cluster, a set of service policies defined by the second SDN controller cluster based on the plurality of resource identifiers; and

distributing service rules defined based on the received set of service policies to network elements in the container cluster, said network elements enforcing the service rules on data messages associated with machines deployed in the container cluster configured by the first SDN controller cluster;

wherein the set of service policies is received by a set of one or more adapters residing in the container cluster and the set of one or more adapters forwards the set of service policies to a third SDN controller cluster that resides in the container cluster but does not configure the container cluster.

17. The non-transitory machine readable medium of claim 16 , wherein the set of service policies is received by a set of one or more adapters residing in the container cluster.

18. The non-transitory machine readable medium of claim 17 , wherein the set of adapters forwards the set of service policies to a third SDN controller cluster that resides in the container cluster but does not configure the container cluster.

Assignments (2)

Continuity (1)

References Cited (332)

Cited By (1)

US 12,487,847