Routing application control and data-plane traffic in support of cloud-native applications
Techniques for using computer networking protocol extensions to route control-plane traffic and data-plane traffic associated with a common application are described herein. For instance, a traffic flow associated with an application may be established such that control-plane traffic is sent to a control-plane node associated with the application and data-plane traffic is sent to a data-plane node associated with the application. When a client device sends an authentication request to connect to the application, the control-plane node may send an indication of a hostname to be used by the client device to send data-plane traffic to the data-node. As such, when a packet including the hostname corresponding with the data-plane node is received, the packet may be forwarded to the data-plane node.
1. A method comprising:
establishing a traffic flow associated with an application such that:
control-plane traffic of the traffic flow is sent to a control-plane node associated with the application; and
data-plane traffic of the traffic flow is sent to a data-plane node associated with the application;
receiving, from a client device, a first packet including a first hostname that is associated with the application;
based at least in part on the first packet including the first hostname, sending the first packet to the control-plane node associated with the application;
receiving, from the client device, a second packet including a second hostname that corresponds with the data-plane node associated with the application, the second hostname provided to the client device by the control-plane node; and
based at least in part on the second packet including the second hostname, sending the second packet to the data-plane node associated with the application.
2. The method of claim 1 , further comprising receiving, by the client device, an indication of the second hostname from the control-plane node associated with the application, the second hostname to be used by the client device to send the data-plane traffic to the data-plane node associated with the application.
3. The method of claim 2 , wherein the control-plane node sends the indication of the second hostname to the client device based at least in part on authenticating the client device or a user of the client device.
4. The method of claim 1 , wherein the first hostname is included in a server name index (SNI) field of the first packet and the second hostname is included in the SNI field of the second packet.
5. The method of claim 1 , wherein the first hostname is included in an encrypted client hello (ECH) field of the first packet and the second hostname is included in the ECH field of the second packet.
6. The method of claim 1 , wherein the control-plane node is hosted on a first server device of a networked computing environment that is hosting the application and the data-plane node is hosted on a second server device of the networked computing environment that is different from the first server device.
7. The method of claim 1 , wherein the control-plane traffic and the data-plane traffic are sent to the control-plane node and the data-plane node, respectively, by at least one of a load balancer or a proxy associated with a content delivery network that is hosting the application.
8. A system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing instructions that, when executed by the one or more processors, cause the system to perform operations comprising:
establishing a traffic flow associated with an application such that:
control-plane traffic of the traffic flow is sent to a control-plane node associated with the application; and
data-plane traffic of the traffic flow is sent to a data-plane node associated with the application;
receiving, from a client device, a first packet including a first hostname that is associated with the application;
based at least in part on the first packet including the first hostname, sending the first packet to the control-plane node associated with the application;
receiving, from the client device, a second packet including a second hostname that corresponds with the data-plane node associated with the application, the second hostname provided to the client device by the control-plane node; and
based at least in part on the second packet including the second hostname, sending the second packet to the data-plane node associated with the application.
9. The system of claim 8 , the operations further comprising receiving, by the client device, an indication of the second hostname from the control-plane node associated with the application, the second hostname to be used by the client device to send the data-plane traffic to the data-plane node associated with the application.
10. The system of claim 9 , wherein the control-plane node sends the indication of the second hostname to the client device based at least in part on authenticating the client device or a user of the client device.
11. The system of claim 8 , wherein the first hostname is included in a server name index (SNI) field of the first packet and the second hostname is included in the SNI field of the second packet.
12. The system of claim 8 , wherein the first hostname is included in an encrypted client hello (ECH) field of the first packet and the second hostname is included in the ECH field of the second packet.
13. The system of claim 8 , wherein the control-plane node is hosted on a first server device of a networked computing environment that is hosting the application and the data-plane node is hosted on a second server device of the networked computing environment that is different from the first server device.
14. The system of claim 8 , wherein the control-plane traffic and the data-plane traffic are sent to the control-plane node and the data-plane node, respectively, by at least one of a load balancer or a proxy associated with a content delivery network that is hosting the application.
15. One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
establishing a traffic flow associated with an application such that:
control-plane traffic of the traffic flow is sent to a control-plane node associated with the application; and
data-plane traffic of the traffic flow is sent to a data-plane node associated with the application;
receiving, from a client device, a first packet including a first hostname that is associated with the application;
based at least in part on the first packet including the first hostname, sending the first packet to the control-plane node associated with the application;
receiving, from the client device, a second packet including a second hostname that corresponds with the data-plane node associated with the application, the second hostname provided to the client device by the control-plane node; and
based at least in part on the second packet including the second hostname, sending the second packet to the data-plane node associated with the application.
16. The one or more non-transitory computer-readable media of claim 15 , the operations further comprising:
receiving, by the client device, an indication of the second hostname from the control-plane node associated with the application, the second hostname to be used by the client device to send the data-plane traffic to the data-plane node associated with the application; and
wherein the control-plane node sends the indication of the second hostname to the client device based at least in part on authenticating the client device or a user of the client device.
17. The one or more non-transitory computer-readable media of claim 15 , wherein the first hostname is included in a server name index (SNI) field of the first packet and the second hostname is included in the SNI field of the second packet.
18. The one or more non-transitory computer-readable media of claim 15 , wherein the first hostname is included in an encrypted client hello (ECH) field of the first packet and the second hostname is included in the ECH field of the second packet.
19. The one or more non-transitory computer-readable media of claim 15 , wherein the control-plane node is hosted on a first server device of a networked computing environment that is hosting the application and the data-plane node is hosted on a second server device of the networked computing environment that is different from the first server device.
20. The one or more non-transitory computer-readable media of claim 15 , wherein the control-plane traffic and the data-plane traffic are sent to the control-plane node and the data-plane node, respectively, by at least one of a load balancer or a proxy associated with a content delivery network that is hosting the application.