Automatic policy configuration for packet flows
Techniques are disclosed for providing automatic policy configuration for packet flows. For example, a computing device comprises a virtual node and one or more virtual execution elements coupled to the virtual node. The computing device may also comprise one or more processors configured to: receive a packet originating from an application workload hosted on the one or more virtual execution elements and destined for a remote destination device; determine the packet is part of a new packet flow; in response, configure, by a kernel of the computing device and without sending the packet to a user space of the computing device, a policy for a forward packet flow for the new packet flow; configure, by the kernel, a policy for a reverse packet flow associated with the forward packet flow; and send the packet toward the remote destination device in accordance with the policy for the forward packet flow.
1. A method comprising:
receiving, by a computing device, a packet originating from an application workload and destined for a destination device;
determining, by the computing device, the packet is part of a packet flow;
determining, by the computing device, the application workload is locally hosted on the computing device;
based on determining the packet is part of the packet flow and determining the application workload is locally hosted on the computing device, configuring, by a kernel of the computing device and without sending the packet to a user space of the computing device, a policy for a forward packet flow for the packet flow, wherein the policy for the forward packet flow is configured outside the user space by the kernel; and
sending, by the computing device, the packet toward the destination device in accordance with the policy for the forward packet flow.
2. The method of claim 1 , wherein configuring the policy for the forward packet flow comprises:
configuring, by the computing device and based on a lookup of a destination address of the packet within forwarding information of the computing device, a next hop for the forward packet flow.
3. The method of claim 1 , further comprising based on determining the packet is part of the packet flow, configuring, by the kernel of the computing device, a policy for a reverse packet flow.
4. The method of claim 3 , wherein:
configuring the policy for the reverse packet flow comprises mapping, by the computing device, a zone associated with the application workload with an identifier of a virtual network of the application workload, and
sending the packet toward the destination device in accordance with the policy for the forward packet flow comprises inserting, by the computing device, the identifier of the virtual network of the application workload into the packet prior to sending the packet toward the destination device.
5. The method of claim 4 , wherein the packet originating from the application workload and destined for the destination device comprises a forward packet, the method further comprising:
receiving, by the computing device, a reverse packet originating from the destination device and destined to the application workload, wherein the reverse packet specifies the identifier of the virtual network of the application workload;
determining, by the computing device and from the identifier of the virtual network of the application workload specified by the reverse packet, the zone associated with the application workload;
performing, by the computing device, a lookup of a flow table using the zone to determine the policy for the reverse packet flow; and
sending, by the computing device, the reverse packet to the application workload in accordance with the policy for the reverse packet flow.
6. The method of claim 4 , wherein the identifier of the virtual network comprises at least one of a Virtual Extensible Local Area Network (VXLAN) tag or a Multiprotocol Label Switching (MPLS) label.
7. The method of claim 1 , further comprising:
storing, by the computing device and for the policy for the forward packet flow, a respective hash entry in a flow entry hash map to track a least recently used policy;
determining, by the computing device, the policy for the forward packet flow is the least recently used policy; and
in response to determining the policy for the forward packet flow is the least recently used policy, removing, by the kernel or the user space of the computing device, the least recently used policy.
8. The method of claim 1 , further comprising:
configuring, by the computing device, a maximum number of flows to be created for a virtual interface to the application workload;
receiving, by the computing device, a subsequent packet originating from the application workload and destined for a second destination device;
determining, by the computing device, the maximum number of flows to be created for the virtual interface to the application workload is exceeded; and
sending, by the kernel of the computing device, the subsequent packet to a user space of the computing device to configure a policy for a forward packet flow for the subsequent packet.
9. A computing device, comprising:
a memory that stores instructions; and
processing circuitry coupled to the memory that executes the instructions to:
receive a packet originating from an application workload and destined for a destination device;
determine the packet is part of a packet flow;
determine the application workload is locally hosted on the computing device;
based on determining the packet is part of the packet flow and determining the application workload is locally hosted on the computing device, configure, with a kernel of the computing device and without sending the packet to a user space of the computing device, a policy for a forward packet flow for the packet flow, wherein the policy for the forward packet flow is configured outside the user space with the kernel; and
send the packet toward the destination device in accordance with the policy for the forward packet flow.
10. The computing device of claim 9 , wherein to configure the policy for the forward packet flow the processing circuitry further executes the instructions to configure, based on a lookup of a destination address of the packet within forwarding information of the computing device, a next hop for the forward packet flow.
11. The computing device of claim 9 , wherein the processing circuitry further executes the instructions to configure, with the kernel of the computing device and based on determining the packet is part of the packet flow, a policy for a reverse packet flow.
12. The computing device of claim 11 , wherein:
to configure the policy for the reverse packet flow the processing circuitry further executes the instructions to map a zone associated with the application workload with an identifier of a virtual network of the application workload, and
to send the packet toward the destination device in accordance with the policy for the forward packet flow the processing circuitry further executes the instructions to insert the identifier of the virtual network of the application workload into the packet prior to sending the packet toward the destination device.
13. The computing device of claim 12 , wherein the packet originating from the application workload and destined for the destination device comprises a forward packet and the processing circuitry further executes the instructions to:
receive a reverse packet originating from the destination device and destined to the application workload, wherein the reverse packet specifies the identifier of the virtual network of the application workload;
determine, from the identifier of the virtual network of the application workload specified by the reverse packet, the zone associated with the application workload;
perform a lookup of a flow table using the zone to determine the policy for the reverse packet flow; and
send the reverse packet to the application workload in accordance with the policy for the reverse packet flow.
14. The computing device of claim 12 , wherein the identifier of the virtual network comprises at least one of a Virtual Extensible Local Area Network (VXLAN) tag or a Multiprotocol Label Switching (MPLS) label.
15. The computing device of claim 9 , wherein the processing circuitry further executes the instructions to:
store, for the policy for the forward packet flow, a respective hash entry in a flow entry hash map to track a least recently used policy;
determine the policy for the forward packet flow is the least recently used policy; and
in response to determining the policy for the forward packet flow is the least recently used policy, remove, with the kernel or the user space of the computing device, the least recently used policy.
16. The computing device of claim 9 , wherein the processing circuitry further executes the instructions to:
configure a maximum number of flows to be created for a virtual interface to the application workload;
receive a subsequent packet originating from the application workload and destined for a second destination device;
determine the maximum number of flows to be created for the virtual interface to the application workload is exceeded; and
send, with the kernel of the computing device, the subsequent packet to a user space of the computing device to configure a policy for a forward packet flow for the subsequent packet.
17. Non-transitory computer-readable storage media comprising instructions, that when executed by processing circuitry of a computing device, cause the processing circuitry to:
receive a packet originating from an application workload and destined for a destination device;
determine the packet is part of a packet flow;
determine the application workload is locally hosted on the computing device;
based on determining the packet is part of the packet flow and determining the application workload is locally hosted on the computing device, configure, with a kernel of the computing device and without sending the packet to a user space of the computing device, a policy for a forward packet flow for the packet flow, wherein the policy for the forward packet flow is configured outside the user space with the kernel; and
send the packet toward the destination device in accordance with the policy for the forward packet flow.
18. The non-transitory computer-readable storage media of claim 17 , wherein the instructions, when further executed by processing circuitry of the computing device, cause the processing circuitry to configure, based on a lookup of a destination address of the packet within forwarding information of the computing device, a next hop for the forward packet flow.
19. The non-transitory computer-readable storage media of claim 17 , wherein the instructions, when further executed by processing circuitry of the computing device, cause the processing circuitry to configure, with the kernel of the computing device and based on determining the packet is part of the packet flow, a policy for a reverse packet flow.
20. The non-transitory computer-readable storage media of claim 19 , wherein:
to configure the policy for the reverse packet flow the instructions, when further executed by processing circuitry of the computing device, cause the processing circuitry to map a zone associated with the application workload with an identifier of a virtual network of the application workload, and
to send the packet toward the destination device in accordance with the policy for the forward packet flow the instructions, when further executed by processing circuitry of the computing device, cause the processing circuitry to insert the identifier of the virtual network of the application workload into the packet prior to sending the packet toward the destination device.