Implementing a service mesh in the hypervisor

1 . A method comprising:

receiving, by a processing device executing a hypervisor, a packet from a first container, wherein the packet comprises a header including a first network address associated with a second container having a current location at a second network address, and wherein the first container and the second container reside within a same virtual machine;

identifying, by the hypervisor, a network policy comprising a mapping between the first network address and the second network address;

performing, by the hypervisor and based on the network policy, a network address translation to modify the header of the packet to include the second network address corresponding to the second container; and

in response to the second container moving to a new location at a third network address, modifying the network policy to map the first network address to the third network address,

wherein identifying the network policy comprises identifying the network policy from a plurality of network policies, each of the plurality of network policies having a corresponding network address, and

wherein the network policy indicates a threshold number of times the packet is to be subsequently provided to the second container.

2 . The method of claim 1 , further comprising:

providing the packet to the second container at the second network address of the modified header.

3 . The method of claim 2 , wherein the packet is received from a first service executing in the first container and provided to a second service executing in the second container, wherein the first service uses a first programming language and the second service uses a second programming language that is different than the first programming language.

4 . The method of claim 1 , further comprising: receiving the network policy from the container orchestration system.

5 . The method of claim 1 , wherein identifying the network policy comprises:

identifying the network policy from the plurality of network policies in view of the corresponding network address of the network policy matching the first network address.

6 . The method of claim 1 , wherein the network policy correlates the first network address received from the first container with the second network address corresponding to the current location of the second container.

7 . A system comprising:

a memory; and

a processing device, operatively coupled to the memory, to:

receive, by a hypervisor, a packet from a first container, wherein the packet comprises a header including a first network address associated with a second container having a current location at a second network address, and wherein the first container and the second container reside within a same virtual machine;

identify, by the hypervisor, a network policy comprising a mapping between the first network address and the second network address;

perform, by the hypervisor and based on the network policy, a network address translation to modify the header of the packet to include the second network address corresponding to the second container; and

in response to the second container moving to a new location at a third network address, modify the network policy to map the first network address to the third network address,

wherein, to identify the network policy, the processing device is to identify a plurality of network policies, each of the plurality of network policies having a corresponding network address, and

wherein the network policy indicates a threshold number of times the packet is to be subsequently provided to the second container.

8 . The system of claim 7 , wherein the processing device is further to:

provide the packet to the second container; and

determine whether the packet has been successfully delivered to the second container.

9 . The system of claim 7 , wherein to determine whether the packet was successfully delivered to the second container, the processing device is further to:

receive, from the second container, an indication that the delivery of the packet was unsuccessful.

10 . The system of claim 9 , wherein the processing device is further to:

determine whether a number of times the packet has been subsequently provided to the second container satisfies the threshold number of times indicated by the network policy; and

in response to determining that the number of times the packet has been subsequently provided satisfies the threshold number of times, determine to not subsequently provide the packet to the second container.

11 . The system of claim 7 , wherein the packet is received from a first application executing in the first container and provided to a second application executing in the second container, wherein the first application uses a first programming language and the second application uses a second programming language that is different than the first programming language.

12 . A non-transitory computer-readable storage medium including instructions that, when executed by a processing device, cause the processing device to:

receive, by a hypervisor, a packet from a first container, wherein the packet comprises a header including a first network address associated with a second container having a current location at a second network address, and wherein the first container and the second container reside within a same virtual machine;

identify, by the hypervisor, a network policy comprising a mapping between the first network address and the second network address;

perform, by the processing device running the hypervisor and based on the network policy, a network address translation to modify the header for the packet to include the second network address; and

in response to the second container moving to a new location at a third network address, modify the network policy to map the first network address to the third network address,

wherein, to identify the network policy, the instructions cause the processing device to identify a plurality of network policies, each of the plurality of network policies having a corresponding network address, and

wherein the network policy indicates a threshold number of times the packet is to be subsequently provided to the second container.

13 . The non-transitory computer-readable storage medium of claim 12 , wherein the instructions further cause the processing device to:

provide the packet to the second container at the second destination addresses.

14 . The non-transitory computer-readable storage medium of claim 12 , wherein the instructions further cause the processing device to:

install a forwarding rule to a memory associated with the processing device, the forwarding rule to cause the processing device to perform the network address translation on subsequent packets received from the first container.

15 . The non-transitory computer-readable storage medium of claim 14 , wherein the instructions further cause the processing device to:

detect a disconnect by the first container; and

remove the forwarding rule from the memory associated with the processing device.