Techniques for a virtual bootstrap environment using a distributed virtual private network
Techniques are disclosed for establishing a distributed virtual private network within a virtual bootstrap environment. A distributed computing system can generate a virtual cloud network in a data center of a host region. The virtual cloud network can include a plurality of host instances, including an instance hosting a virtual private network router. A second instance can provide a secondary network address to the virtual private network router. A third instance can send a request addressed to the secondary network address. The virtual cloud network may route the request to the virtual private network router according to a default route of a routing table. The request may then be forwarded by the virtual private network router to the secondary address using a networking tunnel established between the first instance and the second instance.
1 . A method, comprising:
generating, by a distributed computing system of a cloud service provider, a virtual cloud network in a data center of a host region, the virtual cloud network comprising a plurality of host instances each having primary network addresses associated with a routing table of the virtual cloud network;
implementing, on a first instance of the plurality of host instances, a virtual private network router;
sending, by a second instance of the plurality of host instances, a secondary network address of the second instance to the virtual private network router, the second instance of the plurality of host instances comprising a netmesh component used to send the secondary network address;
sending, from a third instance of the plurality of host instances, a request addressed to the secondary network address;
routing the request to the virtual private network router according to a default route of the routing table, the default route identifying the primary network address of the first instance of the plurality of host instances;
establishing a networking tunnel between the first instance of the plurality of host instances and the second instance of the plurality of host instances according to the secondary network address exposed by the netmesh component; and
forwarding, by the virtual private network router using the networking tunnel, the request to the second instance of the plurality of host instances.
2 . The method of claim 1 , further comprising:
provisioning, by a first service hosted in the virtual cloud network, a network host in a data center of a target region, the network host comprising an additional netmesh component;
establishing a first network connection between the first instance and network host in a target region;
receiving, from the network host using the first network connection, routing information comprising a network address of a target region instance; and
provisioning, by the first service hosted in the virtual cloud network and using the network address of the target region instance and the first network connection, a target region service at the target region instance, wherein a portion of traffic for the provisioning is routed to the target region instance using the additional netmesh component of the network host.
3 . The method of claim 2 , further comprising:
sending, from the third instance of the plurality of host instances, a second request addressed to the network address of the target region instance; and
routing the second request to the target region instance according to the routing information and using the first network connection.
4 . The method of claim 2 , further comprising:
establishing a second network connection between the third instance of the plurality of host instances and the network host; and
sending, from the third instance, a second request addressed to the network address of the target region instance, the second request sent using the second network connection.
5 . The method of claim 2 , wherein provisioning the network host comprises provisioning the network host using an out-of-band network connection between the first service and the data center of the target region.
6 . The method of claim 2 , wherein the first network connection is a first IPSec tunnel, and wherein establishing the first network connection comprises terminating the first IPSec tunnel at the network host.
7 . The method of claim 4 , wherein the second network connection is a second IPSec tunnel, and wherein establishing the second network connection comprises terminating the second IPSec tunnel at the network host.
8 . The method of claim 1 , wherein the request is an anycast request.
9 . The method of claim 1 , wherein the networking tunnel comprises an IP-in-IP tunnel.
10 . A computing system comprising:
one or more processors; and
one or more memories storing computer-executable instructions that, when executed with the one or more processors, cause the computing system to at least:
generate a virtual cloud network in a data center of a host region, the virtual cloud network comprising a plurality of host instances each having primary network addresses associated with a routing table of the virtual cloud network;
implement, on a first instance of the plurality of host instances, a virtual private network router;
send, by a second instance of the plurality of host instances, a secondary network address of the second instance to the virtual private network router, the second instance of the plurality of host instances comprising a netmesh component used to send the secondary network address;
send, from a third instance of the plurality of host instances, a request addressed to the secondary network address;
route the request to the virtual private network router according to a default route of the routing table, the default route identifying the primary network address of the first instance of the plurality of host instances;
establish a networking tunnel between the first instance of the plurality of host instances and the second instance of the plurality of host instances according to the secondary network address exposed by the netmesh component; and
forward, by the virtual private network router using the networking tunnel, the request to the second instance of the plurality of host instances.
11 . The computing system of claim 10 , wherein the one or more memories store additional instructions that, when executed with the one or more processors, further cause the computing system to at least:
provision, by a first service hosted in the virtual cloud network, a network host in a data center of a target region, the network host comprising an additional netmesh component;
establish a first network connection between the first instance and the virtual private network host in a target region;
receive, from the network host using the first network connection, routing information comprising a network address of a target region instance; and
provisioning, by the first service hosted in the virtual cloud network and using the network address of the target region instance and the first network connection, a target region service at the target region instance, wherein a portion of traffic for the provisioning is routed to the target region instance using the additional netmesh component of the network host.
12 . The computing system of claim 11 , wherein the one or more memories store additional instructions that, when executed with the one or more processors, further cause the computing system to at least:
send, from the third instance of the plurality of host instances, a second request addressed to the network address of the target region instance; and
route the second request to the target region instance according to the routing information and using the first network connection.
13 . The computing system of claim 11 , wherein the one or more memories store additional instructions that, when executed with the one or more processors, further cause the computing system to at least:
establish a second network connection between the third instance of the plurality of host instances and the network host; and
send, from the third instance, a second request addressed to the network address of the target region instance, the second request sent using the second network connection.
14 . The computing system of claim 11 , wherein provisioning the network host comprises provisioning the network host using an out-of-band network connection between the first service and the data center of the target region.
15 . The computing system of claim 11 , wherein the first network connection is a first IPSec tunnel, and wherein establishing the first network connection comprises terminating the first IPSec tunnel at the network host.
16 . A non-transitory computer-readable medium storing computer-executable instructions that, when executed with one or more processors, cause a computing system to at least:
generate a virtual cloud network in a data center of a host region, the virtual cloud network comprising a plurality of host instances each having primary network addresses associated with a routing table of the virtual cloud network;
implement, on a first instance of the plurality of host instances, a virtual private network router;
send, by a second instance of the plurality of host instances, a secondary network address of the second instance to the virtual private network router, the second instance of the plurality of host instances comprising a netmesh component used to send the secondary network address;
send, from a third instance of the plurality of host instances, a request addressed to the secondary network address;
route the request to the virtual private network router according to a default route of the routing table, the default route identifying the primary network address of the first instance of the plurality of host instances;
establish a networking tunnel between the first instance of the plurality of host instances and the second instance of the plurality of host instances according to the secondary address exposed by the netmesh component; and
forward, by the virtual private network router using the networking tunnel, the request to the second instance of the plurality of host instances.
17 . The non-transitory computer-readable medium of claim 16 , storing further instructions that, when executed with the one or more processors, cause the computing system to further:
provision, by a first service hosted in the virtual cloud network, a network host in a data center of a target region, the network host comprising an additional netmesh component;
establish a first network connection between the first instance and the virtual private network host in a target region;
receive, from the network host using the first network connection, routing information comprising a network address of a target region instance; and
provisioning, by the first service hosted in the virtual cloud network and using the network address of the target region instance and the first network connection, a target region service at the target region instance, wherein a portion of traffic for the provisioning is routed to the target region instance using the additional netmesh component of the network host.
18 . The non-transitory computer-readable medium of claim 17 , storing further instructions that, when executed with the one or more processors, cause the computing system to further:
send, from the third instance of the plurality of host instances, a second request addressed to the network address of the target region instance; and
route the second request to the target region instance according to the routing information and using the first network connection.
19 . The non-transitory computer-readable medium of claim 17 , storing further instructions that, when executed with the one or more processors, cause the computing system to further:
establish a second network connection between the third instance of the plurality of host instances and the network host; and
send, from the third instance, a second request addressed to the network address of the target region instance, the second request sent using the second network connection.
20 . The non-transitory computer-readable medium of claim 17 , wherein the first network connection is a first IPSec tunnel, and wherein establishing the first network connection comprises terminating the first IPSec tunnel at the network host.