Connectivity between logical router pods
Some embodiments provide a method for implementing a logical router of a logical network at a first Pod executing on a first node of a Kubernetes cluster to implement data message forwarding for the logical router. The method receives a data message for processing by the logical router. The method determines that the data message requires layer 7 (L7) service processing at the logical router. The method selects a second Pod from multiple Pods that perform L 7 service for the logical router. Each of the Pods executes on a different node of the cluster. The method forwards the data message to the second Pod via a layer 2 (L2) construct that connects the first and second Pods.
1 . A method for implementing a logical router of a logical network, the method comprising:
at a first Pod executing on a first node of a Kubernetes cluster to implement data message forwarding for the logical router:
receiving a data message for processing by the logical router;
determining that the data message requires layer 7 (L7) service processing at the logical router;
selecting a second Pod from a plurality of Pods that perform L7 service for the logical router, each Pod of the plurality of Pods executing on a different node of the cluster;
retrieving a security key specific to a type of L7 security service implemented by the second Pod, the security key being selected from a set of pre-defined keys based on a service configuration;
providing datapath interface attributes to the second Pod using a Kubernetes ConfigMap, the datapath interface attributes including a MAC address, VLAN identifier, and IP address for configuring a second interface on the second Pod for L2 communication with the first Pod; and
forwarding the data message to the second Pod via a layer 2 (L2) construct that connects the first and second Pods.
2 . The method of claim 1 , wherein the second Pod executes on the first node along with the first Pod.
3 . The method of claim 1 , wherein the second Pod executes on a second, different node than the first Pod.
4 . The method of claim 3 , wherein one of the other Pods that performs L7 service processing for the logical router executes on the first Pod.
5 . The method of claim 1 , wherein selecting the second Pod from the plurality of Pods comprises performing a load balancing operation to select the second Pod.
6 . The method of claim 1 further comprising:
receiving the data message back from the second Pod after the second Pod performs the L7 service on the data message, and
forwarding the processed data message to a destination of the data message.
7 . The method of claim 1 , wherein the L2 construct that connects the first and second Pods comprises a virtual switch executing on the first node.
8 . The method of claim 7 , wherein the virtual switch is an Open vSwitch (OVS) bridge.
9 . The method of claim 7 , wherein:
the second Pod also executes on the first node; and
the first and second Pods both have ports connected to the virtual switch.
10 . The method of claim 7 , wherein:
the virtual switch is a first virtual switch;
the second Pod executes on a second, different node; and
the L2 construct further comprises a second virtual switch executing on the second node and a tunnel between the first and second virtual switches.
11 . The method of claim 7 , wherein the first Pod comprises separate interfaces connected to the virtual switch for connections to each of the plurality of Pods.
12 . The method of claim 7 , wherein the first Pod comprises a single interface connected to the virtual switch for connections to all of the Pods in the plurality of Pods.
13 . The method of claim 12 , wherein traffic for each of the Pods in the plurality of Pods uses a different sub-interface enabled by a different VLAN tag.
14 . The method of claim 1 , wherein:
the data message is a first data message and the plurality of Pods is a first plurality of Pods;
the first Pod implements data message forwarding for a plurality of logical routers of the logical network; and
the method further comprises:
receiving a second data message for processing by a second logical router;
determining that the second data message requires layer 7 (L7) service processing at the second logical router;
selecting a third Pod from a second plurality of Pods that perform an L7 service for the second logical router, each Pod of the second plurality of Pods executing on a different node of the cluster; and
forwarding the second data message to the third Pod via a layer 2 (L2) construct that connects the first and third Pods.
15 . The method of claim 14 , wherein the L2 construct that connects the first and second Pods is the same as the L2 construct that connects the first and third Pods.
16 . The method of claim 1 , wherein:
the plurality of Pods is a first plurality of Pods that perform a first L7 service for the logical router; and
a second plurality of Pods performs a second L7 service for the logical router.
17 . A non-transitory machine-readable medium storing a program which when executed by at least one processing unit implements a logical router of a logical network, the program executing in a first Pod that executes on a first node of a Kubernetes cluster to implement data message forwarding for the logical router:
receiving a data message for processing by the logical router;
determining that the data message requires layer 7 (L7) service processing at the logical router;
selecting a second Pod from a plurality of Pods that perform L7 service for the logical router, each Pod of the plurality of Pods executing on a different node of the cluster;
retrieving a security key specific to a type of L7 security service implemented by the second Pod, the security key being selected from a set of pre-defined keys based on a service configuration;
providing datapath interface attributes to the second Pod using a Kubernetes ConfigMap, the datapath interface attributes including a MAC address, VLAN identifier, and IP address for configuring a second interface on the second Pod for L2 communication with the first Pod; and
forwarding the data message to the second Pod via a layer 2 (L2) construct that connects the first and second Pods.
18 . The non-transitory machine-readable medium of claim 17 , wherein the set of instructions for selecting the second Pod from the plurality of Pods comprises a set of instructions for performing a load balancing operation to select the second Pod.
19 . The non-transitory machine-readable medium of claim 17 , wherein the program further comprises sets of instructions for:
receiving the data message back from the second Pod after the second Pod performs the L7 service on the data message, and
forwarding the processed data message to a destination of the data message.
20 . The non-transitory machine-readable medium of claim 17 , wherein:
the second Pod also executes on the first node;
the L2 construct that connects the first and second Pods comprises a virtual switch executing on the first node; and
the first and second Pods both have ports connected to the virtual switch.
21 . The non-transitory machine-readable medium of claim 17 , wherein:
the second Pod executes on a second, different node; and
the L2 construct that connects the first and second Pods comprises a first virtual switch executing on the first node, a second virtual switch executing on the second node, and a tunnel between the first and second virtual switches.
22 . The non-transitory machine-readable medium of claim 17 , wherein:
the L2 construct that connects the first and second Pods comprises a virtual switch executing on the first node; and
the first Pod comprises separate interfaces connected to the virtual switch for connections to each of the plurality of Pods.
23 . The non-transitory machine-readable medium of claim 17 , wherein:
the L2 construct that connects the first and second Pods comprises a virtual switch executing on the first node;
the first Pod comprises a single interface connected to the virtual switch for connections to all of the Pods in the plurality of Pods; and
traffic for each of the Pods in the plurality of Pods uses a different sub-interface enabled by a different VLAN tag.
24 . The non-transitory machine-readable medium of claim 17 , wherein:
the plurality of Pods is a first plurality of Pods that perform a first L7 service for the logical router; and
a second plurality of Pods performs a second L7 service for the logical router.