Data interfaces with isolation for containers deployed to compute nodes

1. A computing device comprising:

a virtual router comprising processing circuitry and configured to implement, in a computing infrastructure that includes the computing device, a virtual network to enable communications among virtual network endpoints connected via the virtual network; and

a pod comprising a containerized application,

wherein the virtual router and the pod are configured to create a Unix domain socket using a file system resource of a file system of the computing device, wherein the file system resource is accessible by the pod and by the virtual router and is not accessible by any other pods deployed to the computing device.

2. The computing device of claim 1 , wherein the file system resource comprises a socket directory for the Unix domain socket.

3. The computing device of claim 1 , wherein the virtual router and the pod are configured to use the Unix domain socket as a control channel to exchange control communications for a data interface between the virtual router and the pod.

4. The computing device of claim 3 , wherein the data interface comprises a data plane development kit (DPDK) interface.

5. The computing device of claim 3 , wherein the data interface is for a virtual network interface configured in the virtual router for the pod to communicate with other virtual network endpoints of the virtual network.

6. The computing device of claim 1 , further comprising:

a container network interface module (CNI) comprising processing circuitry; and

a virtual router agent for the virtual router, the virtual router agent comprising processing circuitry,

wherein the CNI is configured to send socket description data that indicates the file system resource to the virtual router agent, and

wherein the virtual router agent provides the socket description data to the virtual router to create the Unix domain socket.

7. The computing device of claim 6 , wherein the CNI is configured to generate the socket description data that indicates the file system resource based on a pod identifier for the pod.

8. The computing device of claim 7 , further comprising:

an orchestration agent comprising processing circuitry, wherein the orchestration agent is an agent of an orchestrator for the computing infrastructure that includes the computing device,

wherein the CNI is configured to receive the pod identifier from the orchestrator via the orchestration agent.

9. The computing device of claim 6 , wherein the virtual router agent is configured to create a virtual network interface in the virtual router that uses a data interface between the virtual router and the pod created using the Unix domain socket.

10. The computing device of claim 1 , further comprising:

a container network interface module (CNI) comprising processing circuitry; and

an orchestration agent comprising processing circuitry, wherein the orchestration agent is an agent of an orchestrator for the computing infrastructure that includes the computing device,

wherein the file system resource comprises a socket directory for the Unix domain socket, and

wherein the CNI is configured to receive a pod identifier for the pod from the orchestrator via the orchestration agent and to generate, based on the pod identifier, socket description data that indicates the socket directory and a socket name for the Unix domain socket.

11. The computing device of claim 1 , wherein the file system resource is a directory having a directory path that includes at least a portion of a pod identifier for the pod.

12. The computing device of claim 1 , further comprising:

a virtual router agent for the virtual router, the virtual router agent comprising processing circuitry and configured to:

receive interface configuration data from a network controller for the computing infrastructure, wherein the interface configuration data is for a virtual network interface for the pod, and wherein the interface configuration data indicates an interface type of the virtual network interface is a DPDK interface; and

in response to a determination the virtual network interface is a DPDK interface, configure the virtual network interface in the virtual router as a DPDK interface.

13. The computing device of claim 1 , further comprising:

a virtual router agent for the virtual router, the virtual router agent comprising processing circuitry and configured to:

receive interface configuration data from a network controller for the computing infrastructure, wherein the interface configuration data is for a virtual network interface for the pod, and wherein the interface configuration data indicates a vhost mode for the pod for exchanging control communications via the Unix domain socket; and

in response to a determination the vhost mode for the pod is not compatible with a vhost mode for the virtual router, output an error.

14. The computing device of claim 1 , further comprising:

a container network interface module (CNI) comprising processing circuitry;

a virtual router agent for the virtual router, the virtual router agent comprising processing circuitry,

wherein the CNI is configured to obtain, from an orchestrator, using a webhook, socket description data that indicates the file system resource,

wherein the CNI is configured to send the socket description data to the virtual router agent, and

wherein the virtual router agent provides the socket description data to the virtual router to create the Unix domain socket.

15. A method comprising:

obtaining, by an orchestrator, a pod specification for a pod, wherein the pod specification includes data for generating socket description data that indicates a file system resource of a file system of a computing device to be used by the pod, when the pod is deployed to the computing device, for creating a Unix domain socket, wherein the file system resource is accessible by the pod and not accessible by any other pods deployed to the computing device; and

outputting, by the orchestrator, the pod specification to an orchestration agent executing on the computing device, wherein the orchestration agent is an agent of the orchestrator.

16. The method of claim 15 , further comprising:

deploying, by the orchestration agent, the pod to the computing device; and

mounting, by the orchestration agent, the file system resource into the pod.

17. The method of claim 15 , wherein the socket description data includes a mountPath for a shared directory to be shared by the pod and a virtual router of the computing device and a subPathExpr that is a pod identifier for the pod.

18. A method comprising:

creating, by a virtual router and a pod executing on a computing device, a Unix domain socket using a socket directory of a file system of the computing device, wherein the socket directory is accessible by the pod and by the virtual router and is not accessible by any other pods deployed to the computing device;

implementing, by the virtual router, in a computing infrastructure that includes the computing device, a virtual network to enable communications among virtual network endpoints connected via the virtual network; and

exchanging, by the virtual router and the pod, using the Unix domain socket, control communications for a data plane development kit (DPDK) interface between the virtual router and the pod.

19. The method of claim 18 , wherein the DPDK interface is for a virtual network interface configured in the virtual router for the pod to communicate with other virtual network endpoints of the virtual network.

20. The method of claim 18 , wherein a path of the socket directory is based on an identifier for the pod.