Service chaining for virtual execution elements
Techniques are described for providing a controller to configure, within a given namespace, a virtual network for a pod and an application service address for an application service to enable access to the pod. For example, the controller may configure in each namespace a virtual network for a logically-related group of one or more containers (“pod”) and application service address for an application service that is an abstraction which defines a logical set of pods and a policy by which to access the pods (e.g., load balancing). Techniques are also described for providing a controller to configure controller configures the service chain by configuring the left interface of a service node with a virtual routing and forwarding instance (VRF) identifying the pod of a first namespace and the right interface of the service node with a VRF identifying the application service of a second namespace.
1. A method comprising:
creating, by a controller of a multi-tenant virtualized data center, a plurality of namespaces, each of the plurality of namespaces being associated with a different one of a plurality of tenants in the multi-tenant virtualized data center, wherein the plurality of namespaces includes a first namespace associated with a first tenant and a second namespace associated with a second tenant;
isolating, by the controller, a first application service of the first tenant from a second application service of the second tenant by:
configuring, by the controller, a first plurality of networks each associated with the first namespace, wherein configuring the first plurality of networks includes allocating a virtual network address for one or more first virtual execution elements, and mapping an application service address of the first application service with the one or more first virtual execution elements to provide access to the one or more first virtual execution elements,
configuring, by the controller, a second plurality of networks each associated with the second namespace, wherein configuring the second plurality of networks includes allocating a virtual network address for one or more second virtual execution elements, and mapping an application service address of the second application service with the one or more second virtual execution elements to provide access to the one or more second virtual execution elements; and
configuring a multi-tenant service chain between the one or more first virtual execution elements of the first namespace and the second application service of the second namespace.
2. The method of claim 1 ,
wherein the first virtual execution elements comprise a first logically-related group of one or more containers,
wherein the first application service provides load balancing for the first logically-related group of one or more containers,
wherein the second virtual execution elements comprise a second logically-related group of one or more containers, and
wherein the second application service provides load balancing for the second logically-related group of one or more containers.
3. The method of claim 2 ,
wherein the first logically-related group of one or more containers and the second logically-related group of one or more containers are Kubernetes containers within a pod, and
wherein the first application service and the second application service are Kubernetes services.
4. The method of claim 2 ,
wherein the multi-tenant service chain causes traffic received by a service node and from the first logically-related group of one or more containers to be processed by the service node and steered to the second application service.
5. The method of claim 4 , wherein the multi-tenant service chain further steers the traffic through a plurality of service nodes including the service node.
6. The method of claim 4 , wherein generating the multi-tenant service chain further comprises:
configuring, by the controller and for the service node, a left virtual routing and forwarding instance (VRF) associated with the first logically-related group of one or more containers; and
configuring, by the controller and for the service node, a right VRF associated with the second application service.
7. The method of claim 1 ,
wherein configuring the first plurality of networks comprises:
sending, by the controller and to a first computing device of the multi-tenant virtualized data center, first configuration data to configure a first application service address for the first application service, and
wherein configuring the second plurality of networks comprises:
sending, by the controller and to a second computing device of the multi-tenant virtualized data center, second configuration data to configure a second application service address for the second application service.
8. The method of claim 7 ,
wherein the first configuration data comprises a first mapping of the first application service address and one or more virtual network interfaces to access the one or more first virtual execution elements; and
wherein the second configuration data comprises a second mapping of the second application service address and one or more virtual network interfaces to access the one or more second virtual execution elements.
9. The method of claim 7 , further comprising:
instantiating, by the first computing device, a first virtual execution element as a first logically-related group of one or more containers;
configuring, by the first computing device and for a first virtual router, a first application service address for the first application service to enable load balancing for the first virtual execution element via the first application service address;
instantiating, by the second computing device and for a second virtual router, a second virtual execution element as a second logically-related group of one or more containers; and
configuring, by the second computing device and for the second virtual router, a second application service address for the second application service to enable load balancing for the second virtual execution element via the second application service address.
10. A controller comprising:
one or more processors coupled to a memory device, wherein the one or more processors are configured to:
create a plurality of namespaces, each of the plurality of namespaces being associated with a different one of a plurality of tenants in a multi-tenant virtualized data center, wherein the plurality of namespaces includes a first namespace associated with a first tenant and a second namespace associated with a second tenant;
isolate a first application service of the first tenant from a second application service of the second tenant by:
configuring a first plurality of networks each associated with the first namespace, wherein configuring the first plurality of networks includes allocating a virtual network address for one or more first virtual execution elements, and mapping an application service address of the first application service with the one or more first virtual execution elements to provide access to the one or more first virtual execution elements; and
configuring a second plurality of networks each associated with the second namespace, wherein configuring the second plurality of networks includes allocating a virtual network address for one or more second virtual execution elements, and mapping an application service address of the second application service with the one or more second virtual execution elements to provide access to the one or more second virtual execution elements; and
configure a multi-tenant service chain between the one or more first virtual execution elements of the first namespace and the second application service of the second namespace.
11. The controller of claim 10 ,
wherein the first virtual execution elements comprise a first logically-related group of one or more containers,
wherein the first application service provides load balancing for the first logically-related group of one or more containers,
wherein the second virtual execution elements comprise a second logically-related group of one or more containers, and
wherein the second application service provides load balancing for the second logically-related group of one or more containers.
12. The controller of claim 11 ,
wherein the first logically-related group of one or more containers and the second logically-related group of one or more containers are Kubernetes containers within a pod, and
wherein the first application service and the second application service are Kubernetes services.
13. The controller of claim 11 ,
wherein the multi-tenant service chain causes traffic received by a service node and from the first logically-related group of one or more containers to be processed by the service node and steered to the second application service.
14. The controller of claim 13 , wherein the multi-tenant service chain further steers the traffic through a plurality of service nodes including the service node.
15. The controller of claim 13 , wherein, to generate the multi-tenant service chain, the one or more processors are further configured to:
configure, for the service node, a left virtual routing and forwarding instance (VRF) associated with the first logically-related group of one or more containers; and
configure, for the service node, a right VRF associated with the second application service.
16. The controller of claim 10 ,
wherein, to configure the first plurality of networks, the one or more processors are further configured to:
send, to a first computing device of the multi-tenant virtualized data center, first configuration data to configure an application service address for the first application service, and
wherein, to configure the second plurality of networks, the one or more processors are further configured to:
send, to a second computing device of the multi-tenant virtualized data center, second configuration data to configure an application service address for the second application service.
17. The controller of claim 16 ,
wherein the first configuration data comprises a first mapping of the first application service address and one or more virtual network interfaces to access the one or more first virtual execution elements; and
wherein the second configuration data comprises a second mapping of the second application service address and one or more virtual network interfaces to access the one or more second virtual execution elements.
18. A computing device comprising:
one or more processors coupled to a memory device, wherein the one or more processors are configured to:
receive, from a controller, configuration data comprising a virtual network address allocated for a virtual execution element and a mapping of the virtual execution element with an application service address of an application service, wherein the virtual execution element and the application service is included within a first namespace;
instantiate, based on the configuration data, the virtual execution element as a logically-related group of one or more containers;
configure, based on the configuration data, the application service address for the application service to enable access to the virtual execution element via the application service address;
attach, based on the configuration data, a virtual network interface to the virtual execution element to enable packetized communications by the virtual execution element on a virtual network; and
steer the packetized communications along a multi-tenant service chain between the virtual execution element of the first namespace and a second application service included within a second namespace.
19. The computing device of claim 18 , wherein the configuration data comprises a mapping of the application service address and a virtual network interface to access the virtual execution element.
20. The computing device of claim 18 ,
wherein the logically-related group of one or more containers is a group of one or more Kubernetes containers within a pod, and
wherein the application service is a Kubernetes service.