Scalable multi-tenant underlay network supporting multi-tenant overlay network
Techniques are disclosed for scalable virtualization of tenants and subtenants on a virtualized computing infrastructure. In one example, a first controller for the virtualized computing infrastructure configures underlay network segments in the virtualized computing infrastructure by configuring respective Virtual Extensible Local Area Network (VXLAN) segments of a plurality of VXLAN segments of a VXLAN in a switch fabric comprising network switches. Each VXLAN segment provides underlay network connectivity among a different subset of host computing devices of the virtualized computing infrastructure to enable orchestration of multiple tenants in the VXLAN. A second controller for a first subset of the host computing devices has underlay network connectivity through operation of a first VXLAN segment. The second controller configures overlay networks in the first subset of the host computing devices to enable orchestration of multiple subtenants in the first subset of the host computing devices.
1. A method comprising:
configuring, by a controller for a virtualized computing infrastructure, a plurality of Virtual Extensible Local Area Network (VXLAN) segments in a switch fabric, thereby enabling orchestration of respective tenants in the plurality of VXLAN segments,
wherein each VXLAN segment of the plurality of VXLAN segments provides underlay network connectivity among a different subset of host computing devices of the virtualized computing infrastructure, and
wherein a plurality of overlay networks are configured in a first subset of the host computing devices having underlay network connectivity by operation of a first VXLAN segment of the plurality of VXLAN segments, thereby enabling orchestration of multiple subtenants of a first tenant in the first subset of the host computing devices; and
assigning, by the controller and to the first VXLAN segment, a plurality of floating IP (FIP) addresses for configuring overlay networks of the plurality of overlay networks configured in the first subset of the host computing devices.
2. The method of claim 1 , further comprising assigning, by the controller and to each overlay network of the plurality of overlay networks configured in the first subset of the host computing devices, a different subset of the plurality of FIP addresses.
3. The method of claim 2 , further comprising assigning, by the controller and to each virtual router of a plurality of virtual routers of a first overlay network of the plurality of overlay networks, a different FIP address of a first subset of the plurality of FIP addresses, the first subset assigned to the first overlay network.
4. The method of claim 1 , wherein the plurality of FIP addresses comprises a first plurality of FIP addresses, the method further comprising:
assigning, by the controller and to a second VXLAN segment of the plurality of VXLAN segments, a second plurality of FIP addresses for configuring overlay networks of the plurality of overlay networks configured in a second subset of the host computing devices having underlay network connectivity by operation of the second VXLAN segment, wherein the second plurality of FIP addresses are different from the first plurality of FIP addresses.
5. The method of claim 1 , wherein the plurality of FIP addresses comprises a first plurality of FIP addresses, the method further comprising:
assigning, by the controller and to a second VXLAN segment of the plurality of VXLAN segments, a second plurality of FIP addresses for configuring overlay networks of the plurality of overlay networks configured in a second subset of the host computing devices having underlay network connectivity by operation of the second VXLAN segment, wherein the second plurality of FIP addresses are the same as the first plurality of FIP addresses.
6. The method of claim 1 , further comprising:
assigning, by the controller and to each VXLAN segment of the plurality of VXLAN segments, a different tenant of the respective tenants; and
controlling, by the controller, forwarding of network traffic for each tenant of the respective tenants to the corresponding VXLAN segment of the plurality of VXLAN segments to which the tenant is assigned.
7. The method of claim 1 , further comprising:
assigning, by the controller and to each overlay network of the plurality of overlay networks in the first subset of the host computing devices, a different subtenant of the multiple subtenants of the first tenant; and
controlling, by the controller, forwarding of network traffic for each subtenant of the multiple subtenants of the first tenant to the corresponding overlay network of the plurality of overlay networks in the first subset of the host computing devices to which the subtenant is assigned.
8. The method of claim 1 , further comprising provisioning, by the controller and for the first VXLAN segment, a Source Network Address Translation (SNAT) gateway between a VXLAN Tunnel Endpoint (VTEP) of the first VXLAN segment and the plurality of overlay networks of the first VXLAN segment.
9. The method of claim 8 , wherein provisioning, for the first VXLAN segment, the SNAT gateway comprises provisioning, in a virtual router of the first subset of the host computing devices, the SNAT gateway.
10. The method of claim 1 , further comprising configuring, for a first overlay network of the plurality of overlay networks in the first subset of the host computing devices, a plurality of virtual routers configured to process network traffic for a subtenant of the multiple subtenants that is assigned to the first overlay network.
11. A computing system comprising processing circuitry having access to a memory, the processing circuitry configured to execute a controller for a virtualized computing infrastructure, the controller configured to:
configure a plurality of Virtual Extensible Local Area Network (VXLAN) segments in a switch fabric, thereby enabling orchestration of respective tenants in the plurality of VXLAN segments,
wherein each VXLAN segment of the plurality of VXLAN segments provides underlay network connectivity among a different subset of host computing devices of the virtualized computing infrastructure, and
wherein a plurality of overlay networks are configured in a first subset of the host computing devices having underlay network connectivity by operation of a first VXLAN segment of the plurality of VXLAN segments, thereby enabling orchestration of multiple subtenants of a first tenant in the first subset of the host computing devices; and
assign, to the first VXLAN segment, a plurality of floating IP (FIP) addresses for configuring overlay networks of the plurality of overlay networks configured in the first subset of the host computing devices.
12. The computing system of claim 11 , wherein the controller is further configured to assign, to each overlay network of the plurality of overlay networks configured in the first subset of the host computing devices, a different subset of the plurality of FIP addresses.
13. The computing system of claim 11 , wherein the controller is further configured to assign, to each virtual router of a plurality of virtual routers of a first overlay network of the plurality of overlay networks, a different FIP address of a first subset of the plurality of FIP addresses, the first subset assigned to the first overlay network.
14. The computing system of claim 11 , wherein the plurality of FIP addresses comprises a first plurality of FIP addresses, wherein the controller is further configured to:
assign, to a second VXLAN segment of the plurality of VXLAN segments, a second plurality of FIP addresses for configuring overlay networks of the plurality of overlay networks configured in a second subset of the host computing devices having underlay network connectivity by operation of the second VXLAN segment, wherein the second plurality of FIP addresses are different from the first plurality of FIP addresses.
15. The computing system of claim 11 , wherein the plurality of FIP addresses comprises a first plurality of FIP addresses, wherein the controller is further configured to:
assign, to a second VXLAN segment of the plurality of VXLAN segments, a second plurality of FIP addresses for configuring overlay networks of the plurality of overlay networks configured in a second subset of the host computing devices having underlay network connectivity by operation of the second VXLAN segment, wherein the second plurality of FIP addresses are the same as the first plurality of FIP addresses.
16. The computing system of claim 11 , wherein the controller is further configured to:
assign, to each VXLAN segment of the plurality of VXLAN segments, a different tenant of the respective tenants; and
control forwarding of network traffic for each tenant of the respective tenants to the corresponding VXLAN segment of the plurality of VXLAN segments to which the tenant is assigned.
17. The computing system of claim 11 , wherein the controller is further configured to:
assign, to each overlay network of the plurality of overlay networks in the first subset of the host computing devices, a different subtenant of the multiple subtenants of the first tenant; and
control forwarding of network traffic for each subtenant of the multiple subtenants of the first tenant to the corresponding overlay network of the plurality of overlay networks in the first subset of the host computing devices to which the subtenant is assigned.
18. The computing system of claim 11 , wherein the controller is further configured to provision, for the first VXLAN segment, a Source Network Address Translation (SNAT) gateway between a VXLAN Tunnel Endpoint (VTEP) of the first VXLAN segment and the plurality of overlay networks of the first VXLAN segment.
19. The computing system of claim 18 , wherein, to provision, for the first VXLAN segment, the SNAT gateway, the controller is configured to provision, in a virtual router of the first subset of the host computing devices, the SNAT gateway.
20. Non-transitory, computer-readable media comprising instructions that, when executed, are configured to cause processing circuitry to:
configure a plurality of Virtual Extensible Local Area Network (VXLAN) segments in a switch fabric, thereby enabling orchestration of respective tenants in the plurality of VXLAN segments,
wherein each VXLAN segment of the plurality of VXLAN segments provides underlay network connectivity among a different subset of host computing devices of virtualized computing infrastructure, and
wherein a plurality of overlay networks are configured in a first subset of the host computing devices having underlay network connectivity by operation of a first VXLAN segment of the plurality of VXLAN segments, thereby enabling orchestration of multiple subtenants of a first tenant in the first subset of the host computing devices; and
assign, to the first VXLAN segment, a plurality of floating IP (FIP) addresses for configuring overlay networks of the plurality of overlay networks configured in the first subset of the host computing devices.