Facilitating software-defined networking communications in a container-based networked computing environment

• US 10,037,220 B2
• Filed: 11/20/2015
• Issued: 07/31/2018
• Est. Priority Date: 11/20/2015
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Amulothu, Venkata S., Kapur, Ashish, Shukla, Vishal
• Primary Examiner(s): Lagor, Alexander
• Assistant Examiner(s): Ahsan, Syed M
• Application Number:
  US14/946,948
• Publication Number:
  US 20170149843A1
• Time in Patent Office: 984 Days
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

Aspects of the present invention provide an approach for facilitating a software-defined networking (SDN) communication in a container-based networked computing environment. In an embodiment, a SDN policy agent is created in the container-based networked computing environment. This SDN policy agent is created as a container virtual machine (VM) in the container-based networked computing environment. When a request is made by a VM to establish a SDN connection with the SDN controller for the server, the SDN controller forwards the request to the SDN policy agent. The SDN policy agent is responsible for determining whether the VM is eligible to establish the connection. If the SDN policy agent determines that the VM is eligible, the VM is allowed to become part of the SDN network.

Claims

1. A method for facilitating a software-defined networking (SDN) communication in a container-based networked computing environment, comprising:

creating a SDN policy agent in the container-based networked computing environment, the SDN policy agent being a container virtual machine (VM) that is dedicated for providing SDN communications to other container VMs in the container-based networked computing environment, the SDN policy agent and of the other container VMs being VM instances that are based upon a software abstraction layer and run on a common operating system that runs on a single physical machine in the container-based networked computing environment;

inserting, in response to the creating of the SDN policy agent, an address corresponding to the SDN policy agent into a kernel of an operating system of the container-based networked computing environment using a hosting utility;

forwarding, in response to a request by a container of the other container VMs in the container-based networked computing environment to establish a SDN connection with a SDN controller, an authentication request to the SDN policy agent;

accessing, in response to the request, the kernel by the SDN controller to retrieve the address using the hosting utility;

determining, by the SDN policy agent, whether the container is eligible to establish the connection; and

establishing, by the SDN policy agent, the connection between the container and the SDN controller in response to a determination that the VM is eligible.

2. The method of claim 1, further comprising:

setting, prior to the creating of the SDN policy agent, a default address for the SDN policy agent in a virtual switch of an operating system of the container-based networked computing environment;

establishing, during the creating of the SDN policy agent, a location of the SDN policy agent to be the default address; and

accessing, in response to the request, the virtual switch by the SDN controller to retrieve the address.

3. The method of claim 1, further comprising:

forwarding, in response to the request by the container, a challenge packet in the request to the SDN policy agent by the SDN controller;

hashing, by the SDN policy agent, the challenge packet to obtain a password; and

performing the determining based on the password.

4. The method of claim 1, further comprising, marking, in response to a determination that the container is not eligible to establish the connection, the container to the SDN controller.

5. The method of claim 1, wherein the networked computing environment is a cloud computing environment and wherein the container is a cloud resource.

6. A system for facilitating a software-defined networking (SDN) communication, comprising:

a physical server having an operating system;

a plurality of containers running on the physical server, each container of the plurality of containers being a virtual machine (VM) running on the operating system;

a communications port that connects the physical server to a network;

a SDN controller, configured to;

insert, in response to the creating of a SDN policy agent, an address corresponding to the SDN policy agent into a kernel of an operating system of the container-based networked computing environment using a hosting utility;

forward, in response to a request by a VM in one of the plurality of containers to establish a connection with the SDN controller, an authentication request;

access, in response to the request, the kernel to retrieve the address using the hosting utility; and

provide, in response to the authentication request being approved, a virtualized network connection between the VM and the communications port; and

the SDN policy agent, the SDN policy agent being a container virtual machine (VM) that is dedicated for providing SDN communications to other container VMs comprising the plurality of containers on the physical server, the SDN policy agent and of the other container VMs being VM instances that are based upon a software abstraction layer and run on a common operating system that runs on a single physical machine in the container-based networked computing environment, the SDN policy agent being configured to;

obtain the authentication request sent by the SDN controller;

determine whether the VM is eligible to establish the connection; and

establish the connection between the VM and the SDN controller in response to a determination that the VM is eligible.

7. The system of claim 6, further comprising:

setting, prior to the creating of the SDN policy agent, a default address for the SDN policy agent in a virtual switch of an operating system of the container-based networked computing environment;

establishing, during the creating of the SDN policy agent, a location of the SDN policy agent to be the default address; and

accessing, in response to the request, the virtual switch by the SDN controller to retrieve the address.

8. The system of claim 6, further comprising:

forwarding, in response to the request by the container, a challenge packet in the request to the SDN policy agent by the SDN controller;

hashing, by the SDN policy agent, the challenge packet to obtain a password; and

performing the determining based on the password.

9. The system of claim 6, further comprising, marking, in response to a determination that the container is not eligible to establish the connection, the container to the SDN controller.

10. The system of claim 6, wherein the networked computing environment is a cloud computing environment and wherein the container is a cloud resource.

11. A computer program product embodied in a computer readable medium that, when executed by a computer device, performs a method for facilitating a software-defined networking (SDN) communication in a container-based networked computing environment, the method comprising:

creating a SDN policy agent in the container-based networked computing environment, the SDN policy agent being a container virtual machine (VM) that is dedicated for providing SDN communications to other container VMs in the container-based networked computing environment, the SDN policy agent and of the other container VMs being VM instances that are based upon a software abstraction layer and run on a common operating system that runs on a single physical machine in the container-based networked computing environment;

insert, in response to the creating of the SDN policy agent, an address corresponding to the SDN policy agent into a kernel of an operating system of the container-based networked computing environment using a hosting utility;

forwarding, in response to a request by a VM of the other container VMs in the container-based networked computing environment to establish a SDN connection with a SDN controller, an authentication request to the SDN policy agent;

access, in response to the request, the kernel by the SDN controller to retrieve the address using the hosting utility;

determining, by the SDN policy agent, whether the VM is eligible to establish the connection; and

establishing, by the SDN policy agent, the connection between the VM and the SDN controller in response to a determination that the VM is eligible.

12. The program product of claim 11, the method further comprising:

setting, prior to the creating of the SDN policy agent, a default address for the SDN policy agent in a virtual switch of an operating system of the container-based networked computing environment;

establishing, during the creating of the SDN policy agent, a location of the SDN policy agent to be the default address; and

accessing, in response to the request, the virtual switch by the SDN controller to retrieve the address.

13. The program product of claim 11, the method further comprising:

forwarding, in response to the request by the container, a challenge packet in the request to the SDN policy agent by the SDN controller;

hashing, by the SDN policy agent, the challenge packet to obtain a password; and

performing the determining based on the password.

14. The program product of claim 11, the method further comprising, marking, in response to a determination that the container is not eligible to establish the connection, the container to the SDN controller.

15. The program product of claim 11, wherein the networked computing environment is a cloud computing environment and wherein the container is a cloud resource.