Granted Patent B2

US 12,627,632 · App. 18/121,548 · Granted May 12, 2026

Inventors: Xiaopei Liu (Beijing, CN); Danting Liu (Beijing, CN); Jianjun Shen (Redwood City, CA); Qian Sun (Beijing, CN); Wenfeng Liu (Beijing, CN); Donghai Han (Beijing, CN)

Assignee: VMware LLC

H04L61/5007H04L12/4641H04L61/2503H04L2101/668

Abstract

Claims (87)

1 . A method comprising:

managing, by an orchestration control plane implemented by a container orchestrator in a virtual private cloud (VPC) networking environment, a container-based cluster comprising a plurality of containers, the plurality of containers comprising a first container on a first virtual machine (VM) executing a first containerized workload, wherein the first container is managed by a first container engine running on the first VM on a first host;

providing, within the VPC networking environment, a plurality of available connectivity modes for the first workload on the first container, the plurality of available connectivity modes comprising:

a first connectivity mode in which internet protocol (IP) addresses are directly addressable only within the VPC;

a second connectivity mode in which IP addresses are directly addressable only within a first level isolation construct that includes the VPC; and

a third connectivity mode in which IP addresses are directly addressable only within a second level isolation construct that includes the VPC and the first level isolation construct;

identifying a subnet custom resource definition (CRD) object specifying a selected connectivity mode to create an isolated environment for the first containerized workload;

providing an isolated environment for the first containerized workload by creating a subnet based on a subnet custom resource definition (CRD) object, wherein addressability of IP addresses within the subnet is based on the connectivity mode specified by the subnet CRD object; and

assigning the first containerized workload to the subnet by deploying a subnet port CRD object that associates the subnet with the first VM.

2 . The method of claim 1 , wherein:

the VPC networking environment is divided into one or more second level isolation constructs, including the second level isolation construct;

each of the one or more second level isolation constructs is divided into one or more first level isolation constructs, including the first level isolation construct; and

each of the one or more first level isolation constructs is divided into one or more VPCs, including the VPC.

3 . The method of claim 1 , wherein:

the connectivity mode specified for the subnet is the first connectivity mode;

creating the subnet in the VPC comprises assigning one or more private IP addresses in a private IP classless inter-domain routing (CIDR) block to the subnet, the one or more private IP addresses addressable within the VPC;

assigning the first VM to the subnet comprises assigning a private IP address of the one or more private IP addresses assigned to the subnet to the first VM; and

the first VM is directly addressable by the private IP address within the VPC and not outside the VPC.

4 . The method of claim 1 , wherein:

the connectivity mode specified for the subnet is the second connectivity mode;

creating the subnet in the VPC comprises assigning one or more project IP addresses in a project IP CIDR block to the subnet, the one or more project IP addresses addressable within the first level isolation construct;

assigning the first VM to the subnet comprises assigning a project IP address of the one or more project IP addresses assigned to the subnet to the first VM; and

the first VM is directly addressable by the project IP address within the first level isolation construct and not outside the first level isolation construct.

5 . The method of claim 1 , wherein:

the connectivity mode specified for the subnet is the third connectivity mode;

creating the subnet in the VPC with the connectivity mode specified for the subnet comprises assigning one or more public IP addresses in a public IP CIDR block to the subnet, the one or more public IP addresses addressable within the second level isolation construct;

assigning the first VM to the subnet comprises assigning a public IP address of the one or more public IP addresses assigned to the subnet to the first VM; and

the first VM is directly addressable by the public IP address within the second level isolation construct and not outside the second level isolation construct.

6 . The method of claim 1 , further comprising performing network address translation at a first gateway associated with the VPC to translate IP addresses addressable within the VPC.

7 . The method of claim 6 , further comprising performing network address translation at a second gateway associated with the first level isolation construct to translate IP addresses addressable within the first level isolation construct.

8 . The method of claim 7 , further comprising performing network address translation at a third gateway associated with the second level isolation construct to translate IP addresses addressable within the second level isolation construct.

9 . A system comprising:

one or more processors; and

at least one computer-readable medium storing instructions executable by the one or more processors to perform operations comprising:

managing, by an orchestration control plane implemented by a container orchestrator in a virtual private cloud (VPC) networking environment, a container-based cluster comprising a plurality of containers, the plurality of containers comprising a first container on a first virtual machine (VM) executing a first containerized workload, wherein the first container is managed by a first container engine running on the first VM on a first host;

providing, within the VPC networking environment, a plurality of available connectivity modes for the first workload on the first container, the plurality of available connectivity modes comprising:

a first connectivity mode in which internet protocol (IP) addresses are directly addressable only within the VPC;

a second connectivity mode in which IP addresses are directly addressable only within a first level isolation construct that includes the VPC; and

a third connectivity mode in which IP addresses are directly addressable only within a second level isolation construct that includes the VPC and the first level isolation construct;

identifying a subnet custom resource definition (CRD) object specifying a selected connectivity mode to create an isolated environment for the first containerized workload;

providing an isolated environment for the first containerized workload by creating a subnet based on a subnet custom resource definition (CRD) object, wherein addressability of IP addresses within the subnet is based on the connectivity mode specified by the subnet CRD object; and

assigning the first containerized workload to the subnet by deploying a subnet port CRD object that associates the subnet with the first VM.

10 . The system of claim 9 , wherein:

the VPC networking environment is divided into one or more second level isolation constructs, including the second level isolation construct;

each of the one or more second level isolation constructs is divided into one or more first level isolation constructs, including the first level isolation construct; and

each of the one or more first level isolation constructs is divided into one or more VPCs, including the VPC.

11 . The system of claim 9 , wherein:

the connectivity mode specified for the subnet is the first connectivity mode;

creating the subnet in the VPC comprises assigning one or more private IP addresses in a private IP classless inter-domain routing (CIDR) block to the subnet, the one or more private IP addresses addressable within the VPC;

assigning the first VM to the subnet comprises assigning a private IP address of the one or more private IP addresses assigned to the subnet to the first VM; and

the first VM is directly addressable by the private IP address within the VPC and not outside the VPC.

12 . The system of claim 9 , wherein:

the connectivity mode specified for the subnet is the second connectivity mode;

creating the subnet in the VPC comprises assigning one or more project IP addresses in a project IP CIDR block to the subnet, the one or more project IP addresses addressable within the first level isolation construct;

assigning the first VM to the subnet comprises assigning a project IP address of the one or more project IP addresses assigned to the subnet to the first VM; and

the first VM is directly addressable by the project IP address within the first level isolation construct and not outside the first level isolation construct.

13 . The system of claim 9 , wherein:

the connectivity mode specified for the subnet is the third connectivity mode;

creating the subnet in the VPC with the connectivity mode specified for the subnet comprises assigning one or more public IP addresses in a public IP CIDR block to the subnet, the one or more public IP addresses addressable within the second level isolation construct;

assigning the first VM to the subnet comprises assigning a public IP address of the one or more public IP addresses assigned to the subnet to the first VM; and

the first VM is directly addressable by the public IP address within the second level isolation construct and not outside the second level isolation construct.

14 . The system of claim 9 , wherein the operations further comprise performing network address translation at a first gateway associated with the VPC to translate IP addresses addressable within the VPC.

15 . The system of claim 14 , wherein the operations further comprise performing network address translation at a second gateway associated with the first level isolation construct to translate IP addresses addressable within the first level isolation construct.

16 . The system of claim 15 , wherein the operations further comprise performing network address translation at a third gateway associated with the second level isolation construct to translate IP addresses addressable within the second level isolation construct.

17 . A non-transitory computer-readable medium comprising instructions executable by one or more processors to perform operations comprising:

managing, by an orchestration control plane implemented by a container orchestrator in a virtual private cloud (VPC) networking environment, a container-based cluster comprising a plurality of containers, the plurality of containers comprising a first container on a first virtual machine (VM) executing a first containerized workload, wherein the first container is managed by a first container engine running on the first VM on a first host;

providing, within the VPC networking environment, a plurality of available connectivity modes for the first workload on the first container, the plurality of available connectivity modes comprising:

a first connectivity mode in which internet protocol (IP) addresses are directly addressable only within the VPC;

a second connectivity mode in which IP addresses are directly addressable only within a first level isolation construct that includes the VPC; and

a third connectivity mode in which IP addresses are directly addressable only within a second level isolation construct that includes the VPC and the first level isolation construct;

identifying a subnet custom resource definition (CRD) object specifying a selected connectivity mode to create an isolated environment for the first containerized workload;

providing an isolated environment for the first containerized workload by creating a subnet based on a subnet custom resource definition (CRD) object, wherein addressability of IP addresses within the subnet is based on the connectivity mode specified by the subnet CRD object; and

assigning the first containerized workload to the subnet by deploying a subnet port-custom resource CRD object that associates the subnet with the first VM.

18 . The non-transitory computer-readable medium of claim 17 , wherein:

the VPC networking environment is divided into one or more second level isolation constructs, including the second level isolation construct;

each of the one or more second level isolation constructs is divided into one or more first level isolation constructs, including the first level isolation construct; and

each of the one or more first level isolation constructs is divided into one or more VPCs, including the VPC.

19 . The non-transitory computer-readable medium of claim 17 , wherein:

the connectivity mode specified for the subnet is the first connectivity mode;

creating the subnet in the VPC comprises assigning one or more private IP addresses in a private IP classless inter-domain routing (CIDR) block to the subnet, the one or more private IP addresses addressable within the VPC;

assigning the first VM to the subnet comprises assigning a private IP address of the one or more private IP addresses assigned to the subnet to the first VM; and

the first VM is directly addressable by the private IP address within the VPC and not outside the VPC.

20 . The non-transitory computer-readable medium of claim 17 , wherein:

the connectivity mode specified for the subnet is the second connectivity mode;

creating the subnet in the VPC comprises assigning one or more project IP addresses in a project IP CIDR block to the subnet, the one or more project IP addresses addressable within the first level isolation construct;

assigning the first VM to the subnet comprises assigning a project IP address of the one or more project IP addresses assigned to the subnet to the first VM; and

the first VM is directly addressable by the project IP address within the first level isolation construct and not outside the first level isolation construct.

Assignments (2)

Continuity (1)

References Cited (9)