Network virtualization for container-based cloud computation using locator-identifier separation protocol
At least one processing device comprises a processor coupled to a memory and implements virtualization infrastructure including a first container comprising a software agent of a locator-identifier separation protocol. The software agent is configured to communicate with a locator-identifier mapping system that associates identifiers of respective endpoints with respective locators in accordance with the locator-identifier separation protocol. The endpoints comprise respective ones of a plurality of additional containers of the virtualization infrastructure. The first container may be coupled to the plurality of additional containers via a bridge element that combines virtual interfaces of respective ones of the additional containers into a single physical network interface. The first container may additionally be coupled to a network via a router configured to operate in accordance with the locator-identifier separation protocol as an ingress tunnel router with respect to inbound packets and as an egress tunnel router with respect to outbound packets.
1. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory;
said at least one processing device implementing virtualization infrastructure including a first container comprising a software agent of a locator-identifier separation protocol;
the software agent being configured:
to communicate with a locator-identifier mapping system that associates identifiers of respective endpoints with respective locators in accordance with the locator-identifier separation protocol, wherein the endpoints comprise respective ones of a plurality of additional containers of the virtualization infrastructure;
to generate an endpoint identifier and locator pair for each of at least a subset of the additional containers implemented on a same host machine, wherein a same locator is used in the endpoint identifier and locator pairs generated for each of the subset of the additional containers implemented on the same host machine; and
to provide the generated endpoint identifier and locator pairs to the locator-identifier mapping system to register respective ones of the subset of the additional containers as endpoints in the locator-identifier mapping system;
wherein generating the endpoint identifier and locator pairs for the subset of the additional containers comprises associating tenant identifiers with each of the generated endpoint identifier and locator pairs;
wherein the first container comprises a dedicated container controlled by a cloud controller that is maintained persistently while the subset of the additional containers are spawned and taken down responsive to changing demands of one or more cloud tenants;
wherein the first container and the subset of the additional containers are associated with a common container repository such that the first container has knowledge of the subset of the additional containers implemented on the same host machine; and
wherein the first container utilizes the knowledge of the subset of the additional containers implemented on the same host machine and the tenant identifiers associated with the generated endpoint identifier and locator pairs to control routing to the subset of additional containers to enforce one or more policies for different ones of the one or more cloud tenants.
2. The apparatus of claim 1 wherein the first container and the plurality of additional containers are implemented on a single physical processing device and are associated with the common container repository.
3. The apparatus of claim 1 wherein the first container and the plurality of additional containers comprise respective Docker containers.
4. The apparatus of claim 1 wherein the plurality of additional containers have respective private IP addresses that are made externally addressable via the software agent.
5. The apparatus of claim 1 wherein the plurality of additional containers comprise respective cloud compute nodes.
6. The apparatus of claim 1 wherein first container is coupled to the plurality of additional containers via a bridge element that combines virtual interfaces of respective ones of the additional containers into a single physical network interface.
7. The apparatus of claim 6 wherein the bridge element comprises a pseudonetwork bridge.
8. The apparatus of claim 1 wherein the first container is coupled to a network via a router configured to operate in accordance with the locator-identifier separation protocol as an ingress tunnel router with respect to inbound packets directed to the additional containers via the first container and as an egress tunnel router with respect to outbound packets directed from the additional containers via the first container.
9. The apparatus of claim 1 wherein the locator comprises a network address of a bridge element coupled between the first container and the plurality of additional containers.
10. The apparatus of claim 1 wherein the first container is configured:
responsive to receipt of an outbound packet from a given one of the additional containers for delivery to an outside endpoint, to encapsulate the outbound packet to form a tunnel in accordance with the locator-identifier separation protocol and to forward the encapsulated packet; and
responsive to receipt of an inbound packet from an outside endpoint for delivery to a given one of the additional containers, to decapsulate the inbound packet from a tunnel in accordance with the locator-identifier separation protocol and to forward the decapsulated packet.
11. The apparatus of claim 1 wherein the locator-identifier separation protocol comprises Locator/ID Separation Protocol (LISP) and further wherein the identifiers comprise respective LISP Endpoint Identifiers (EIDs) and the locators comprise respective LISP Routing Locators (RLOCs).
12. The apparatus of claim 1 wherein the locator-identifier mapping system comprises one or more mapping servers each implementing at least a portion of a mapping database having a plurality of entries each comprising one of the endpoint identifiers in association with one of the locators.
13. An information processing system comprising the apparatus of claim 1 .
14. A method comprising:
providing virtualization infrastructure including a first container comprising a software agent of a locator-identifier separation protocol; and
configuring the software agent:
to communicate with a locator-identifier mapping system that associates identifiers of respective endpoints with respective locators in accordance with the locator-identifier separation protocol, wherein the endpoints comprise respective ones of a plurality of additional containers of the virtualization infrastructure;
to generate an endpoint identifier and locator pair for each of at least a subset of the additional containers implemented on a same host machine, wherein a same locator is used in the endpoint identifier and locator pairs generated for each of the subset of the additional containers implemented on the same host machine; and
to provide the generated endpoint identifier and locator pairs to the locator-identifier mapping system to register respective ones of the subset of the additional containers as endpoints in the locator-identifier mapping system;
wherein the providing and configuring are performed by at least one processing device comprising a processor coupled to a memory;
wherein generating the endpoint identifier and locator pairs for the subset of the additional containers comprises associating tenant identifiers with each of the generated endpoint identifier and locator pairs;
wherein the first container comprises a dedicated container controlled by a cloud controller that is maintained persistently while the subset of the additional containers are spawned and taken down responsive to changing demands of one or more cloud tenants;
wherein the first container and the subset of the additional containers are associated with a common container repository such that the first container has knowledge of the subset of the additional containers implemented on the same host machine; and
wherein the first container utilizes the knowledge of the subset of the additional containers implemented on the same host machine and the tenant identifiers associated with the generated endpoint identifier and locator pairs to control routing to the subset of additional containers to enforce one or more policies for different ones of the one or more cloud tenants.
15. The method of claim 14 further comprising:
responsive to receipt of an outbound packet in the first container from a given one of the additional containers for delivery to an outside endpoint, encapsulating the outbound packet to form a tunnel in accordance with the locator-identifier separation protocol and forwarding the encapsulated packet; and
responsive to receipt of an inbound packet in the first container from an outside endpoint for delivery to a given one of the additional containers, decapsulating the inbound packet from a tunnel in accordance with the locator-identifier separation protocol and forwarding the decapsulated packet.
16. A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the processing device:
to provide virtualization infrastructure including a first container comprising a software agent of a locator-identifier separation protocol; and
to configure the software agent:
to communicate with a locator-identifier mapping system that associates identifiers of respective endpoints with respective locators in accordance with the locator-identifier separation protocol, wherein the endpoints comprise respective ones of a plurality of additional containers of the virtualization infrastructure;
to generate an endpoint identifier and locator pair for each of at least a subset of the additional containers implemented on a same host machine, wherein a same locator is used in the endpoint identifier and locator pairs generated for each of the subset of the additional containers implemented on the same host machine; and
to provide the generated endpoint identifier and locator pairs to the locator-identifier mapping system to register respective ones of the subset of the additional containers as endpoints in the locator-identifier mapping system;
wherein generating the endpoint identifier and locator pairs for the subset of the additional containers comprises associating tenant identifiers with each of the generated endpoint identifier and locator pairs;
wherein the first container comprises a dedicated container controlled by a cloud controller that is maintained persistently while the subset of the additional containers are spawned and taken down responsive to changing demands of one or more cloud tenants;
wherein the first container and the subset of the additional containers are associated with a common container repository such that the first container has knowledge of the subset of the additional containers implemented on the same host machine; and
wherein the first container utilizes the knowledge of the subset of the additional containers implemented on the same host machine and the tenant identifiers associated with the generated endpoint identifier and locator pairs to control routing to the subset of additional containers to enforce one or more policies for different ones of the one or more cloud tenants.
17. The apparatus of claim 1 wherein the software agent is further configured to utilize the tenant identifier of a given endpoint identifier and locator pair to enforce isolation of the given additional container in the virtualization infrastructure.
18. The apparatus of claim 1 wherein the software agent is further configured to utilize the tenant identifier of a given endpoint identifier and locator pair to enforce quality of service level weighting of operations in the locator-identifier separation protocol.
19. The apparatus of claim 1 wherein, responsive to the host machine moving from a first geographic location to a second geographic location, the software agent is configured to update the locators of the generated endpoint identifier and locator pairs for the subset of the additional containers.
20. The apparatus of claim 19 wherein the locators of the generated endpoint identifier and locator pairs are utilized to provide location-based services for applications running in the subset of the additional containers.