Definition of logical router service rules
Some embodiments provide a method for configuring a logical router implemented in a Kubernetes cluster. The method receives configuration data specifying a service rule for the logical router. The service rule requires processing of L5-L7 headers of data messages sent to the logical router. Based on the service rule, the method defines (i) a redirection rule specifying a set of data messages to which the service rule applies based on L2-L4 header values and (ii) an L5-L7 processing rule for application of the service rule. the method provides the redirection rule to a first set of Pods in the cluster and the L5-L7 processing rule to a second set of Pods in the cluster.
1 . A method for configuring a logical router implemented in a Kubernetes cluster, the method comprising:
receiving configuration data specifying a service rule for the logical router, the service rule requiring processing of layer 5 to layer 7 (L5-L7) headers of data messages sent to the logical router;
based on the service rule, defining (i) a redirection rule specifying a set of data messages to which the service rule applies based on layer 2 to layer 4 (L2-L4) header values and (ii) an L5-L7 processing rule for application of the service rule; and
providing the redirection rule to a first set of Pods in the Kubernetes cluster and the L5-L7 processing rule to a second set of Pods in the Kubernetes cluster.
2 . The method of claim 1 , wherein the method is performed by a central controller cluster of a network management system external to the Kubernetes cluster.
3 . The method of claim 1 , wherein:
the first set of Pods performs L2-L4 processing for the logical router in addition to a plurality of additional logical routers, and
the second set of Pods performs a particular L7 service for the logical router.
4 . The method of claim 1 , wherein providing the redirection rule comprises providing the redirection rule to a configuration database on each Pod of the first set of Pods.
5 . The method of claim 4 , wherein network management system agents executing on each of the Pods of the first set of Pods configure datapaths executing on each of said Pods to apply the redirection rule to data messages sent to the logical router.
6 . The method of claim 4 , further comprising:
providing the L5-L7 processing rule to the configuration databases on at least one subset of the first set of Pods.
7 . The method of claim 6 , wherein database clients executing on the Pods of the second set of Pods retrieve the L5-L7 processing rule from the configuration databases on the at least one subset of the first set of Pods.
8 . The method of claim 1 , wherein:
upon receiving a data message for processing by the logical router, a first Pod in the first set of Pods applies the redirection rule, and
in response to the data message matching the redirection rule, the first Pod forwards the data message to a second Pod in the second set of Pods.
9 . The method of claim 8 , wherein:
the second Pod applies the L5-L7 processing rule to the data message, and
in response to the L5-L7 processing rule not specifying to drop the data message, the second Pod returns the data message to the first Pod for L2-L4 processing.
10 . The method of claim 1 , wherein:
the service rule specifies to drop data messages directed to a particular network address in response to L7 headers of the data messages not meeting a set of requirements,
the redirection rule further specifies to redirect data messages having the particular network address as a destination address to the second set of Pods, and
the L5-L7 processing rule specifies to drop data messages having the particular network address as a destination address in response to L7 headers of the data messages not meeting the set of requirements.
11 . The method of claim 10 , further comprising:
examining L7 headers of data messages to determine whether the examined L7 headers meet the set of requirements; and
examining L2-L4 headers of data messages to determine whether the data messages match the redirection rule, wherein the examining of the L7 headers uses greater processing resources than the examining of the L2-L4 headers.
12 . A non-transitory machine-readable medium storing a program which when executed by at least one processing unit configures a logical router implemented in a Kubernetes cluster, the program comprising sets of instructions for:
receiving configuration data specifying a service rule for the logical router, the service rule requiring processing of layer 5 to layer 7 (L5-L7) headers of data messages sent to the logical router;
based on the service rule, defining (i) a redirection rule specifying a set of data messages to which the service rule applies based on layer 2 to layer 4 (L2-L4) header values and (ii) an L5-L7 processing rule for application of the service rule; and
providing the redirection rule to a first set of Pods in the Kubernetes cluster and the L5-L7 processing rule to a second set of Pods in the Kubernetes cluster.
13 . The non-transitory machine-readable medium of claim 12 , wherein the program is a centralized network controller of a network management system external to the Kubernetes cluster.
14 . The non-transitory machine-readable medium of claim 12 , wherein:
the first set of Pods performs L2-L4 processing for the logical router in addition to a plurality of additional logical routers, and
the second set of Pods performs a particular L7 service for the logical router.
15 . The non-transitory machine-readable medium of claim 12 , wherein providing the redirection rule comprises providing the redirection rule to a configuration database on each Pod of the first set of Pods.
16 . The non-transitory machine-readable medium of claim 15 , wherein network management system agents executing on each of the Pods of the first set of Pods configure datapaths executing on each of said Pods to apply the redirection rule to data messages sent to the logical router.
17 . The non-transitory machine-readable medium of claim 15 , wherein the program further comprises sets of instructions for:
providing the L5-L7 processing rule to the configuration databases on at least one subset of the first set of Pods, database clients executing on the Pods of the second set of Pods retrieving the L5-L7 processing rule from the configuration databases on the at least one subset of the first set of Pods.
18 . The non-transitory machine-readable medium of claim 12 , wherein:
upon receiving a data message for processing by the logical router, a first Pod in the first set of Pods applies the redirection rule,
in response to the data message matching the redirection rule, the first Pod forwards the data message to a second Pod in the second set of Pods,
the second Pod applies the L5-L7 processing rule to the data message, and
in response to the L5-L7 processing rule not specifying to drop the data message, the second Pod returns the data message to the first Pod for L2-L4 processing.
19 . The non-transitory machine-readable medium of claim 12 , wherein:
the service rule specifies to drop data messages directed to a particular network address in response to L7 headers of the data messages not meeting a set of requirements,
the redirection rule further specifies to redirect data messages having the particular network address as a destination address to the second set of Pods, and
the L5-L7 processing rule specifies to drop data messages having the particular network address as a destination address in response to L7 headers of the data messages not meeting the set of requirements.
20 . The non-transitory machine-readable medium of claim 19 , wherein the program further comprises sets of instructions for:
examining L7 headers of data messages to determine whether the examined L7 headers meet the set of requirements; and
examining L2-L4 headers of data messages to determine whether the data messages match the redirection rule, wherein the examining of the L7 headers uses greater processing resources than the examining of the L2-L4 headers.