Distributed transit gateway
Provided are a method, system, and computer program product in which a cross virtual private cloud (VPC) network connectivity is configured, wherein one or more policies have been defined by entities in the VPC. Policy changes are monitored, and based on the one or more policies, an adding of endpoints or topology information from a source VPC to a target VPC is performed, in response to a policy definition allowing the adding of the endpoints. Operations are performed for removing external endpoints or topology information from an affected VPC, in response to receiving a denial indication.
1. A method, comprising:
configuring a cross virtual private cloud network connectivity, wherein one or more policies have been defined by entities in a plurality of virtual private clouds (VPCs);
monitoring policy changes, and based on the one or more policies, adding endpoints or topology information from a source VPC to a target VPC, in response to a policy definition allowing the adding of the endpoints;
removing external endpoints or topology information from an affected VPC, in response to receiving a denial indication, wherein the source VPC, the target VPC, and the affected VPC are included in the plurality of VPCs; and
determining export routes in a local router, by performing:
monitoring, by a policy propagator, changes in a policy database;
in response to a new transit gateway instance being created, adding other VPCs to the new transit gateway instance; and
exporting, by the policy propagator, routes in the local router to a controller, and monitoring the changes in the local router, wherein in response to a new route being learned or an old route being withdrawn, synchronizing changes to the controller, wherein the local router saves an endpoint information of a local VPC in a local information table, and wherein an external router saves the endpoint information of the other VPCs added to the new transit gateway instance.
2. The method of claim 1 , the method further comprising:
on each worker node of a plurality of worker nodes, monitoring topology information changes, and besides adding or removing corresponding entries in an associated VPC also examining the one or more polices to add or remove external entries in affected VPCs.
3. The method for claim 1 , the method further comprising:
while forwarding a packet, first using a local topology information to determine a destination endpoint, and then forwarding the packet accordingly.
4. The method of claim 1 , the method further comprising:
in response to determining that a destination is not associated with any endpoint in local topology, using external topology information to determine a destination endpoint and forward a packet accordingly.
5. The method of claim 1 , wherein the one or more policies defined by entities in the plurality of VPCs include what to import and what to export.
6. The method of claim 1 , wherein a workflow includes a routes propagation mechanism and a packet forwarding mechanism.
7. The method of claim 1 , wherein a controller includes a policy manager and is coupled to a policy database, and each node of a plurality of nodes includes a policy propagator and a topology information.
8. A system, comprising:
a memory; and
a processor coupled to the memory, wherein the processor performs operations, the operations comprising:
configuring a cross virtual private cloud network connectivity, wherein one or more policies have been defined by entities in a plurality of virtual private clouds (VPCs);
monitoring policy changes, and based on the one or more policies, adding endpoints or topology information from a source VPC to a target VPC, in response to a policy definition allowing the adding of the endpoints;
removing external endpoints or topology information from an affected VPC, in response to receiving a denial indication, wherein the source VPC, the target VPC, and the affected VPC are included in the plurality of VPCs; and
determining export routes in a local router, by performing:
monitoring, by a policy propagator, changes in a policy database;
in response to a new transit gateway instance being created, adding other VPCs to the new transit gateway instance; and
exporting, by the policy propagator, routes in the local router to a controller, and monitoring the changes in the local router, wherein in response to a new route being learned or an old route being withdrawn, synchronizing changes to the controller, wherein the local router saves an endpoint information of a local VPC in a local information table, and wherein an external router saves the endpoint information of the other VPCs added to the new transit gateway instance.
9. The system of claim 8 , the operations further comprising:
on each worker node of a plurality of worker nodes, monitoring topology information changes, and besides adding or removing corresponding entries in an associated VPC also examining the one or more polices to add or remove external entries in affected VPCs.
10. The system for claim 8 , the operations further comprising:
while forwarding a packet, first using a local topology information to determine a destination endpoint, and then forwarding the packet accordingly.
11. The system of claim 8 , the operations further comprising:
in response to determining that a destination is not associated with any endpoint in local topology, using external topology information to determine a destination endpoint and forward a packet accordingly.
12. The system of claim 8 , wherein the one or more policies defined by entities in the plurality of VPCs include what to import and what to export.
13. The system of claim 8 , wherein a workflow includes a routes propagation mechanism and a packet forwarding mechanism.
14. The system of claim 8 , wherein a controller includes a policy manager and is coupled to a policy database, and each node of a plurality of nodes includes a policy propagator and a topology information.
15. A computer program product, the computer program product comprising a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code when executed is configured to perform operations, the operations comprising:
configuring a cross virtual private cloud network connectivity, wherein one or more policies have been defined by entities in a plurality of virtual private clouds (VPCs);
monitoring policy changes, and based on the one or more policies, adding endpoints or topology information from a source VPC to a target VPC, in response to a policy definition allowing the adding of the endpoints;
removing external endpoints or topology information from an affected VPC, in response to receiving a denial indication, wherein the source VPC, the target VPC, and the affected VPC are included in the plurality of VPCs; and
determining export routes in a local router, by performing:
monitoring, by a policy propagator, changes in a policy database;
in response to a new transit gateway instance being created, adding other VPCs to the new transit gateway instance; and
exporting, by the policy propagator, routes in the local router to a controller, and monitoring the changes in the local router, wherein in response to a new route being learned or an old route being withdrawn, synchronizing changes to the controller, wherein the local router saves an endpoint information of a local VPC in a local information table, and wherein an external router saves the endpoint information of the other VPCs added to the new transit gateway instance.
16. The computer program product of claim 15 , the operations further comprising:
on each worker node of a plurality of worker nodes, monitoring topology information changes, and besides adding or removing corresponding entries in an associated VPC also examining the one or more polices to add or remove external entries in affected VPCs.
17. The computer program product for claim 15 , the operations further comprising:
while forwarding a packet, first using a local topology information to determine a destination endpoint, and then forwarding the packet accordingly.
18. The computer program product of claim 15 , the operations further comprising:
in response to determining that a destination is not associated with any endpoint in local topology, using external topology information to determine a destination endpoint and forward a packet accordingly.
19. The computer program product of claim 15 , wherein the one or more policies defined by entities in the plurality of VPCs include what to import and what to export.
20. The computer program product of claim 15 , wherein a workflow includes a routes propagation mechanism and a packet forwarding mechanism.