Reprogramming network infrastructure in response to VM mobility
The disclosure provides an approach for dynamically reprogramming network and network infrastructure in response to VM mobility. The approach provides a hypervisor layer that can observe changes in VM-host relationships and reprogram the associated network and network infrastructure to maintain network communication. The hypervisor layer notifies an elastic network interface of a new IP address to include within its whitelist in response to VM migration to that elastic network interface.
1. A method of dynamically reprogramming network infrastructure, the method comprising:
providing a virtual machine (VM) on a first host;
migrating the VM from the first host to a second host;
connecting the VM to a second hypervisor on the second host, and associating the VM with a second elastic network interface (ENI) of the second host;
responsive to the connecting, extracting an identifier of the VM and an identifier of the second ENI;
transmitting the identifier of the VM and the identifier of the second ENI to a controller; and
adding, by the controller, the identifier of the VM to a second list associated with the second ENI.
2. The method of claim 1 , further comprising:
receiving, by the second ENI, a network packet;
comparing, by the second ENI, the destination address of the packet to the second list; and
responsive to the comparing:
blocking the packet, by the second ENI, if the destination address is not on the second list;
transmitting the packet toward the destination address, by the second ENI, if the destination address is on the second list.
3. The method of claim 1 , further comprising:
receiving, by the second ENI, a network packet;
comparing, by the second ENI, the source address of the packet to the second list; and
responsive to the comparing:
blocking the packet, by the second ENI, if the source address is not on the second list;
transmitting the packet toward a destination address of the packet, by the second ENI, if the source address is on the second list.
4. The method of claim 1 , wherein the extracting and the transmitting are performed by a second daemon within the second hypervisor, the second daemon configured to monitor port-connect events between virtual machines and the second hypervisor.
5. The method of claim 1 , wherein the adding the identifier of the VM to the second list associated with the second ENI comprises adding the IP address of the VM to a master list maintained by the controller, the master list containing all white lists of all ENIs of the computer system.
6. The method of claim 1 , wherein the adding the identifier of the VM to the second list associated with the second ENI comprises adding the IP address of the VM to a local list maintained by the second ENI.
7. The method of claim 1 , wherein the adding the identifier of the VM to the second list associated with the second ENI comprises removing the identifier of the VM from a first list associated with a first ENI of the first host.
8. The method of claim 1 , wherein the connecting comprises associating the VM to a port of the second hypervisor, and associating the port to the second ENI.
9. The method of claim 1 , wherein the identifier of the VM is an IP address of the VM, and wherein the identifier of the second ENI is an IP address of the second ENI.
10. The method of claim 1 , wherein the providing the VM on the first host comprises:
providing the first host, the first host including a first hypervisor that has a first port, the VM being connected to the hypervisor through the first port, the first host further including a first ENI, the first ENI having a first list, and the first list containing an identifier of the VM; and
providing a first daemon with the first hypervisor, the first daemon configured to monitor port-connect events between virtual machines and the first hypervisor.
11. A non-transitory computer readable medium comprising instructions to be executed in a processor of a computer system, the instructions when executed in the processor cause the computer system to carry out a method of dynamically reprogramming network infrastructure, the method comprising:
providing a virtual machine (VM) on a first host;
migrating the VM from the first host to a second host;
connecting the VM to a second hypervisor on the second host, and associating the VM with a second elastic network interface (ENI) of the second host;
responsive to the connecting, extracting an identifier of the VM and an identifier of the second ENI;
transmitting the identifier of the VM and the identifier of the second ENI to a controller; and
adding, by the controller, the identifier of the VM to a second list associated with the second ENI.
12. The non-transitory computer readable medium of claim 11 , further comprising:
receiving, by the second ENI, a network packet;
comparing, by the second ENI, the destination address of the packet to the second list; and
responsive to the comparing:
blocking the packet, by the second ENI, if the destination address is not on the second list;
transmitting the packet toward the destination address, by the second ENI, if the destination address is on the second list.
13. The method of claim 11 , further comprising:
receiving, by the second ENI, a network packet;
comparing, by the second ENI, the source address of the packet to the second list; and
responsive to the comparing:
blocking the packet, by the second ENI, if the source address is not on the second list;
transmitting the packet toward a destination address of the packet, by the second ENI, if the source address is on the second list.
14. The non-transitory computer readable medium of claim 11 , wherein the extracting and the transmitting are performed by a second daemon within the second hypervisor, the second daemon configured to monitor port-connect events between virtual machines and the second hypervisor.
15. The non-transitory computer readable medium of claim 11 , wherein the adding the identifier of the VM to the second list associated with the second ENI comprises adding the IP address of the VM to a master list maintained by the controller, the master list containing all white lists of all ENIs of the computer system.
16. The non-transitory computer readable medium of claim 11 , wherein the adding the identifier of the VM to the second list associated with the second ENI comprises adding the IP address of the VM to a local list maintained by the second ENI.
17. The non-transitory computer readable medium of claim 11 , wherein the adding the identifier of the VM to the second list associated with the second ENI comprises removing the identifier of the VM from a first list associated with a first ENI of the first host.
18. The non-transitory computer readable medium of claim 11 , wherein the connecting comprises associating the VM to a port of the second hypervisor, and associating the port to the second ENI.
19. The non-transitory computer readable medium of claim 11 , wherein the providing the VM on the first host comprises:
providing the first host, the first host including a first hypervisor that has a first port, the VM being connected to the hypervisor through the first port, the first host further including a first ENI, the first ENI having a first list, and the first list containing an identifier of the VM; and
providing a first daemon with the first hypervisor, the first daemon configured to monitor port-connect events between virtual machines and the first hypervisor.
20. A computer system comprising:
a first host comprising a virtual machine (VM)
a second host comprising a second hypervisor and a second elastic network interface (ENI);
a controller; and
a processor, wherein the processor is programmed to carry out a method of dynamically reprogramming network infrastructure, the method comprising:
migrating the VM from the first host to the second host;
connecting the VM to the second hypervisor on the second host, and associating the VM with the ENI of the second host;
responsive to the connecting, extracting an identifier of the VM and an identifier of the second ENI;
transmitting the identifier of the VM and the identifier of the second ENI to the controller; and
adding, by the controller, the identifier of the VM to a second list associated with the second ENI.