Container-based network policy configuration in software-defined networking (SDN) environments
Example methods and systems for container-based network policy configuration in a software-defined networking (SDN) environment are disclosed. One example method may comprise: in response to detecting a first request to assign a container-based resource with a first label via a container orchestration system, assigning a logical network element associated with the container-based resource with a second label. The example method may also comprise: in response to detecting a second request to configure a container-based network policy associated with the container-based resource via the container orchestration system, identifying the logical network element by mapping the first label to the second label; and configuring the container-based network policy to be applicable to network traffic that is forwarded via the logical network element.
1. A method for a computer system to perform container-based network policy configuration in a software-defined networking (SDN) environment, wherein the method comprises:
in response to detecting a first request to assign a container-based resource with a first label via a container orchestration system, assigning a logical network element associated with the container-based resource with a second label; and
in response to detecting a second request to configure a container-based network policy associated with the container-based resource via the container orchestration system,
identifying the logical network element by mapping the first label assigned to the container-based resource to the second label assigned to the logical network element; and
configuring the container-based network policy to be applicable to network traffic that is forwarded via the logical network element.
2. The method of claim 1 , wherein assigning the logical network element with the second label comprises:
based on the first label that specifies a key-value pair associated with the container-based resource, assigning the logical network element with the second label that also specifies the key-value pair.
3. The method of claim 1 , wherein detecting the second request comprises:
detecting the second request in the form of a custom resource definition (CRD) that selects the container-based resource using the first label.
4. The method of claim 1 , wherein identifying the logical network element comprises:
mapping (a) the first label assigned to the container-based resource in the form of a node to (b) the second label assigned to the logical network element in the form of a logical switch port that connects the node to a logical switch.
5. The method of claim 1 , wherein identifying the logical network element comprises:
mapping (a) the first label assigned to the container-based resource in the form of a pod of one or more containers to (b) the second label assigned to the logical network element in the form of a logical switch port that connects the pod to a logical switch.
6. The method of claim 1 , wherein configuring the container-based network policy cause the processor to:
configuring the container-based network policy in the form of a firewall rule to allow or block traffic between the container-based resource and a second container-based resource.
7. The method of claim 6 , wherein the method further comprises:
configuring the firewall rule to allow or block traffic between (a) a first group that includes the logical network element and (b) a second group that includes a second logical network element associated with the second container-based resource.
8. A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a computer system, cause the processor to perform a method of container-based network policy configuration in a software-defined networking (SDN) environment, wherein the method comprises:
in response to detecting a first request to assign a container-based resource with a first label via a container orchestration system, assigning a logical network element associated with the container-based resource with a second label; and
in response to detecting a second request to configure a container-based network policy associated with the container-based resource via the container orchestration system,
identifying the logical network element by mapping the first label assigned to the container-based resource to the second label assigned to the logical network element; and
configuring the container-based network policy to be applicable to network traffic that is forwarded via the logical network element.
9. The non-transitory computer-readable storage medium of claim 8 , wherein assigning the logical network element with the second label comprises:
based on the first label that specifies a key-value pair associated with the container-based resource, assigning the logical network element with the second label that also specifies the key-value pair.
10. The non-transitory computer-readable storage medium of claim 8 , wherein detecting the second request comprises:
detecting the second request in the form of a custom resource definition (CRD) that selects the container-based resource using the first label.
11. The non-transitory computer-readable storage medium of claim 8 , wherein identifying the logical network element comprises:
mapping (a) the first label assigned to the container-based resource in the form of a node to (b) the second label assigned to the logical network element in the form of a logical switch port that connects the node to a logical switch.
12. The non-transitory computer-readable storage medium of claim 8 , wherein identifying the logical network element comprises:
mapping (a) the first label assigned to the container-based resource in the form of a pod of one or more containers to (b) the second label assigned to the logical network element in the form of a logical switch port that connects the pod to a logical switch.
13. The non-transitory computer-readable storage medium of claim 8 , wherein configuring the container-based network policy cause the processor to:
configuring the container-based network policy in the form of a firewall rule to allow or block traffic between the container-based resource and a second container-based resource.
14. The non-transitory computer-readable storage medium of claim 13 , wherein the method further comprises:
configuring the firewall rule to allow or block traffic between (a) a first group that includes the logical network element and (b) a second group that includes a second logical network element associated with the second container-based resource.
15. A computer system, comprising:
a processor; and
a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to:
in response to detecting a first request to assign a container-based resource with a first label via a container orchestration system, assigning a logical network element associated with the container-based resource with a second label; and
in response to detecting a second request to configure a container-based network policy associated with the container-based resource via the container orchestration system,
identifying the logical network element by mapping the first label assigned to the container-based resource to the second label assigned to the logical network element; and
configuring the container-based network policy to be applicable to network traffic that is forwarded via the logical network element.
16. The computer system of claim 15 , wherein the instructions for assigning the logical network element with the second label cause the processor to:
based on the first label that specifies a key-value pair associated with the container-based resource, assign the logical network element with the second label that also specifies the key-value pair.
17. The computer system of claim 15 , wherein the instructions for detecting the second request cause the processor to:
detect the second request in the form of a custom resource definition (CRD) that selects the container-based resource using the first label.
18. The computer system of claim 15 , wherein the instructions for identifying the logical network element cause the processor to:
map (a) the first label assigned to the container-based resource in the form of a node to (b) the second label assigned to the logical network element in the form of a logical switch port that connects the node to a logical switch.
19. The computer system of claim 15 , wherein the instructions for identifying the logical network element cause the processor to:
map (a) the first label assigned to the container-based resource in the form of a pod of one or more containers to (b) the second label assigned to the logical network element in the form of a logical switch port that connects the pod to a logical switch.
20. The computer system of claim 15 , wherein the instructions for configuring the container-based network policy cause the processor to:
configure a network policy in the form of a firewall rule to allow or block traffic between the container-based resource and a second container-based resource.
21. The computer system of claim 20 , wherein the instructions further cause the processor to:
configure the firewall rule to allow or deny communication between (a) a first group that includes the logical network element and (b) a second group that includes a second logical network element associated with the second container-based resource.