System and method for zero trust orchestration of an edge gateway within a cloud or multi-cloud network
An edge gateway deployed within an overlay network interconnecting a first public cloud network with an on-premises network is described. Coupled to a controller, the edge gateway is configured to receive a configuration file and attestation data from a controller, analyze the configuration file to obtain at least a first network address being used as an interface for secure communications with the controller, establish a secure interconnect with the controller based on the attestation data, and conduct a provisioning operation to initiate a request to the controller for edge gateway software thereby automated provisioning the edge gateway without human intervention. The edge gateway experiences automated provisioning based on a configuration file and attestation data upload.
1. An overlay network interconnecting a first public cloud network with an on-premises network, comprising:
a non-transitory storage medium comprising a controller deployed within a cloud computing platform; and
an edge gateway communicatively coupled to the controller, the edge gateway is configured to:
receive a configuration file and attestation data from a controller, the configuration file comprising:
a first network address assigned to a first controller interface associated with a secure interconnect,
a second network address assigned to a second controller interface associated with a local area network (LAN) interconnect that supports communications between the controller and computing devices of a datacenter, and
a third network address assigned to a third controller interface associated with a wide area network (WAN) interconnect that supports communications between the controller and computing devices accessible over a public network,
analyze the configuration file to obtain at least a first network address being used as an interface for secure communications with the controller,
establish the secure interconnect with the controller based on the attestation data and the digital certificate of the configuration file, and
conduct a provisioning operation to initiate a request to the controller for edge gateway software thereby facilitating automated provisioning of the edge gateway without human intervention.
2. The overlay network of claim 1 , wherein the edge gateway is an instance operating on an on-premises network and is configured to establish communications with cloud components associated with the overlay network.
3. The overlay network of claim 2 , wherein the edge gateway is communicatively coupled to a first transit virtual private cloud network of a first public cloud network provided by a first cloud service provider, the first transit private cloud network is configured for communicatively coupling to a second transit virtual private cloud network being part of a second public cloud network provided by a second cloud service provider different from the first cloud service provider.
4. The overlay network of claim 1 , wherein the edge gateway analyzes the configuration file by at least parsing the configuration file for network topology information for use in provisioning an interface configuration of the edge gateway.
5. The overlay network of claim 4 , wherein the network topology information includes a plurality of Classless Inter-Domain Routings (CIDRs) each uniquely associated with an interface supported by the edge gateway.
6. The overlay network of claim 5 , wherein the plurality of CIDRs include (1) a first CIDR associated with a management interface for communicative coupling to the connector, (2) a second CIDR associated with a Local Area Network (LAN) interface, and (3) a third CIDR associated with a Wide Area Network (WAN) interface.
7. The overlay network of claim 1 , wherein the edge gateway is configured to control a propagation of data between a transit gateway of a transit virtual private cloud network deployed within a first public cloud network and one or more computing devices deployed within the on-premises network.
8. A non-transitory storage medium operating as an edge gateway instance, comprising:
gateway configuration logic configured to receive a configuration file comprising:
a first network address assigned to a first controller interface associated with a secure interconnect,
a second network address assigned to a second controller interface associated with a local area network (LAN) interconnect that supports communications between the controller and computing devices of a datacenter, and
a third network address assigned to a third controller interface associated with a wide area network (WAN) interconnect that supports communications between the controller and computing devices accessible over a public network,
security logic configured to establish the secure interconnect from the edge gateway with the controller based on the attestation data and the digital certificate of the configuration file; and
provisioning logic configured to initiate a request to the controller for edge gateway software for automated provisioning of the edge gateway.
9. The non-transitory storage medium of claim 8 , wherein the edge gateway is an instance operating on an on-premises network that establishes communications with an overlay network.
10. The non-transitory storage medium of claim 8 , wherein the overlay network enables connectivity between at least a first public cloud network provided by a first cloud service provider and a second public cloud network provided by a second cloud service provider different from the first cloud service provider.
11. The non-transitory storage medium of claim 8 , wherein the analysis of the configuration file by the gateway configuration logic comprises parsing the configuration file for network topology information.
12. The non-transitory storage medium of claim 11 , wherein the network topology information includes a Classless Inter-Domain Routing (CIDR) for each interface supported by the edge gateway.
13. The non-transitory storage medium of claim 12 , wherein the CIDRs associated with each interface of a plurality of interfaces supported by the edge gateway instance include (1) a first CIDR associated with a management interface, (2) a second CIDR associated with a Local Area Network (LAN) interface, and (3) a third CIDR associated with a Wide Area Network (WAN) interface.
14. The non-transitory storage medium of claim 8 , wherein the security logic to establish a secure interconnect to the controller based on the attestation data.
15. The non-transitory storage medium of claim 14 , wherein the attestation data includes an one-time token (OTP).
16. The non-transitory storage medium of claim 8 , wherein the provisioning logic is configured to initiate the request to the controller for edge gateway software after establishment of a secure communication session between the controller and the edge gateway through use of the attestation data.
17. An edge gateway implemented by a computer processing unit (CPU) coupled to a memory, the edge gateway comprising:
gateway configuration logic deployed within a cloud computing platform and maintained within a non-transitory storage medium and configured to receive attestation data and a configuration file comprising:
a first network address assigned to a first controller interface associated with a secure interconnect,
a second network address assigned to a second controller interface associated with a local area network (LAN) interconnect that supports communications between the controller and computing devices of a datacenter, and
a third network address assigned to a third controller interface associated with a wide area network (WAN) interconnect that supports communications between the controller and computing devices accessible over a public network,
security logic configured to establish the secure interconnect with the controller based on the attestation data and the digital certificate of the configuration file; and
provisioning logic configured to initiate a request to the controller for edge gateway software for automated provisioning of the edge gateway.
18. The edge gateway of claim 17 being an instance operating on an on-premises network that establishes communications with an overlay network.
19. The edge gateway of claim 17 being deployed as part of an overlay network that establishes connectivity between at least a first public cloud network provided by a first cloud service provider and a second public cloud network provided by a second cloud service provider different from the first cloud service provider.
20. The edge gateway of claim 17 , wherein the gateway configuration logic conduct the analysis of the configuration file by at least parsing the configuration file for network topology information.
21. The edge gateway of claim 20 , wherein the network topology information includes a plurality of Classless Inter-Domain Routings (CIDRs) with each CIDR associated with an interface that enables data to be transmitted from a source external from the edge gateway.
22. The edge gateway of claim 21 , wherein the plurality of CIDRs include (1) a first CIDR associated with a management interface, (2) a second CIDR associated with a Local Area Network (LAN) interface, and (3) a third CIDR associated with a Wide Area Network (WAN) interface.
23. The edge gateway of claim 17 , wherein the security logic to establish a secure interconnect to the controller based on the attestation data.
24. The edge gateway of claim 23 , wherein the attestation data includes an one-time token (OTP).
25. The edge gateway of claim 17 , wherein the provisioning logic is configured to initiate the request to the controller for edge gateway software after establishment of a secure communication session between the controller and the edge gateway through use of the attestation data.
26. A computerized method comprising:
receiving a configuration file and attestation data from a controller, the configuration file comprising:
a first network address assigned to a first controller interface associated with a secure interconnect,
a second network address assigned to a second controller interface associated with a local area network (LAN) interconnect that supports communications between the controller and computing devices of a datacenter, and
a third network address assigned to a third controller interface associated with a wide area network (WAN) interconnect that supports communications between the controller and computing devices accessible over a public network,
conducting analytics on the configuration file to obtain at least a first network address, wherein the first network address being used as an interface for secure communications with the controller;
establishing the secure interconnect from the edge gateway with the controller based on the attestation data and the digital certificate of the configuration file; and
initiating a request from the edge gateway to the controller for edge gateway software so to as automate provisioning of the edge gateway.