Juniper Networks, Inc.

Pranav Cherukupalli

Prasad Miriyala

Michael Henkel

Ankur Tandon

Fnu Nadeem

Sajeesh Mathew

Sayali Mane

Khushi Vaidya

In general, techniques are described for a SDN architecture system that implements an integrated gateway service. In an example, network controller comprises processing circuitry and memory and is configured to: configure a virtual network in a cluster of nodes of a compute infrastructure, the cluster of nodes managed in part by the network controller; receive a manifest for a gateway service instance that abstracts a transit gateway resource configurable in a plurality of different types of compute infrastructures, wherein the manifest specifies an intended state of a transit gateway object of the gateway service instance; and reconcile the intended state of the transit gateway object for the gateway service instance by sending configuration data, generated based on the transit gateway object, to an interface for the compute infrastructure to configure a transit gateway to forward network packets between a compute infrastructure node of the compute infrastructure and the virtual network.

Integrated gateway service

In an example, a validation system comprises processing circuitry having access to a storage device and is configured to obtain flow records indicative of packet flows among workloads deployed to a cluster of one or more computing devices configured with a network policy, wherein each flow record of the flow records indicates a corresponding packet flow was allowed or denied by the cluster; receive an updated network policy; determine whether a corresponding packet flow for a flow record of the flow records has a discrepancy with the updated network policy; and in response to determining the corresponding packet flow for the flow record of the flow records has a discrepancy with the updated network policy, output an indication of an error.

Network policy validation

In general, techniques are described for performing network segmentation for container orchestration platforms. A network controller comprising a memory and processing circuitry may be configured to perform the techniques. The memory may be configured to store a request, conforming to a container orchestration platform, to configure a new pod of a plurality of pods with a primary interface to communicate on a virtual network to segment a network formed by the plurality of pods. The processing circuitry may be configured to configure, responsive to the request, the new pod with the primary interface to enable communications via the virtual network.

Network segmentation for container orchestration platforms

Growing community of inventors

Milpitas, CA, United States of America

Pranav Cherukupalli