Vmware, Inc.

Wenying Dong

Quan Tian

Jianjun Shen

Antonin Mathieu Bas

Ran Gu

Ruochen Shen

Yu Wang

Rahul Jain

Xu Bin Liu

Lan Luo

Srikar Tati

Mengdie Song

Described herein are systems, methods, and software to manage multicast communications for containers in a computing network. In one example, a first node is configured to monitor for registration packets from pods on the first node to join a multicast group. The first node further identifies a registration packet from a first pod of the pods, wherein the registration packet indicates a multicast IP address, and configures one or more forwarding rules in a virtual switch to direct packets with the multicast IP address as a destination IP address to a virtual interface for the first pod. Once configured, the first node is further configured to receive a packet with the multicast IP address as the destination and direct the packet based on the one or more or more forwarding rules.

Managing multicast connections for containers in a computing network

The disclosure provides approaches for managing multicast group membership at a node. An approach includes policing whether a pod can join a multicast group based on one or more rules. The approach further includes updating forwarding tables of a virtual switch based on whether the pod is allowed to join the multicast group.

Multicast group membership control for a container environment

The disclosure provides a method for authenticating a network agent deployed in a networking environment. The method generally includes receiving, by a network controller in the networking environment, a name of an external node where the network agent is running and a token associated with the external node; in response to receiving the name of the external node, obtaining, by the network controller, a secret associated with the token; parsing, by the network controller, the secret to determine an expected external node name corresponding to the token; comparing the expected external node name with the received external node name; and trusting the network agent when the expected external node name and the received external node name match.

Securing connections between a networking and security controller and distributed agents in a container-based cluster

Some embodiments provide a method for an agent executing on a Kubernetes node in a cluster. The method instructs a forwarding element that also executes on the node to process a flow tracing packet. From the forwarding element, the method receives a message indicating a set of flow entries matched by the flow tracing packet as the forwarding element processes the flow tracing packet. For each flow entry of at least a subset of the flow entries matched by the flow tracing packet, the method generates mapping data that maps elements of the flow entry to Kubernetes concepts implemented in the cluster. The method reports data regarding the set of flow entries along with the generated mapping data.

Flow tracing operation in container cluster

Some embodiments provide a method for a module executing on a Kubernetes node in a cluster. The method retrieves data regarding ongoing connections processed by a forwarding element executing on the node. The method maps the retrieved data to Kubernetes concepts implemented in the cluster. The method exports the retrieved data along with the Kubernetes concepts to an aggregator that receives data regarding ongoing connections from a plurality of nodes in the cluster.

Connection tracking for container cluster

Some embodiments provide a method that receives a request for flow entries associated with a particular Kubernetes concept. The method identifies flow entries that match the request. For each flow entry that matches the request, the method generates mapping data that maps elements of the flow entry to additional Kubernetes concepts. The method provides the flow entries with the mapping data in response to the request.

Growing community of inventors

Beijing, China

Wenying Dong