Abstract: Some embodiments provide a method for configuring a logical router implemented in a Kubernetes cluster. The method receives configuration data specifying a service rule for the logical router. The service rule requires processing of L5-L7 headers of data messages sent to the logical router. Based on the service rule, the method defines (i) a redirection rule specifying a set of data messages to which the service rule applies based on L2-L4 header values and (ii) an L5-L7 processing rule for application of the service rule. the method provides the redirection rule to a first set of Pods in the cluster and the L5-L7 processing rule to a second set of Pods in the cluster.

Abstract: Some embodiments provide a method for configuring logical routers of a logical network. The logical routers are implemented in a Kubernetes cluster as a first set of Pods that each perform logical forwarding operations for the logical routers and a second set of Pods that each perform L7 service operations for a respective logical router. From a Kubernetes control plane component, the method receives a notification that the first set requires scaling to include an additional Pod. The first-set Pods process data messages between the logical network and external networks. Within the network management system, the method defines at least one new interface for processing data messages between the logical network and external networks. The method configures the at least one interface on the additional Pod to communicate with external physical routers to receive traffic from the external networks and send traffic to the external networks.

Abstract: Some embodiments provide a method for implementing a logical router of a logical network at a first Pod executing on a first node of a Kubernetes cluster to implement data message forwarding for the logical router. The method receives a data message for processing by the logical router. The method determines that the data message requires layer 7 (L7) service processing at the logical router. The method selects a second Pod from multiple Pods that perform L7 service for the logical router. Each of the Pods executes on a different node of the cluster. The method forwards the data message to the second Pod via a layer 2 (L2) construct that connects the first and second Pods.

Abstract: Some embodiments provide a method for a data message processing device that includes multiple network interfaces associated with at least two different non-uniform memory access (NUMA) nodes. The method receives a data message at a first network interface associated with a particular one of the NUMA nodes. Based on processing of the data message, the method identifies multiple equivalent output options for the data message. Each of the output options is associated with a respective one of the NUMA nodes. The method selects an equivalent output option for the data message that is associated with the particular NUMA node.

Abstract: Some embodiments provide a method for implementing a logical router of a logical network at a first Pod executing on a first node of a Kubernetes cluster to implement data message forwarding for the logical router. The method receives a data message for processing by the logical router. The method determines that the data message requires layer 7 (L7) service processing at the logical router. The method selects a second Pod from multiple Pods that perform L7 service for the logical router. Each of the Pods executes on a different node of the cluster. The method forwards the data message to the second Pod via a layer 2 (L2) construct that connects the first and second Pods.

Abstract: Some embodiments provide a method for a data message processing device that includes multiple network interfaces associated with at least two different non-uniform memory access (NUMA) nodes. The method receives a data message at a first network interface associated with a particular one of the NUMA nodes. Based on processing of the data message, the method identifies multiple output options for the data message. Each of the output options has an equal forwarding cost and each output option is associated with a respective one of the NUMA nodes. The method selects an output option for the data message that is associated with the particular NUMA node to avoid cross-NUMA node processing of the data message.

Abstract: Some embodiments of the invention provide a method for implementing an edge device that handles data traffic between a logical network and an external network. The method monitors resource usage of a node pool that includes multiple nodes that each executes a respective set of pods. Each of the pods is for performing a respective set of data message processing operations for at least one of multiple logical routers. The method determines that a particular node in the node pool has insufficient resources for the particular node's respective set of pods to adequately perform their respective sets of data message processing operations. Based on the determination, the method automatically provides additional resources to the node pool by instantiating at least one additional node in the node pool.

Abstract: Some embodiments provide a method for a data message processing device that includes multiple network interfaces associated with at least two different non-uniform memory access (NUMA) nodes. The method receives a data message at a first network interface associated with a particular one of the NUMA nodes. Based on processing of the data message, the method identifies multiple output options for the data message. Each of the output options has an equal forwarding cost and each output option is associated with a respective one of the NUMA nodes. The method selects an output option for the data message that is associated with the particular NUMA node to avoid cross-NUMA node processing of the data message.

Abstract: Some embodiments provide a method for configuring a logical router implemented in a Kubernetes cluster. The method receives configuration data specifying a service rule for the logical router. The service rule requires processing of L5-L7 headers of data messages sent to the logical router. Based on the service rule, the method defines (i) a redirection rule specifying a set of data messages to which the service rule applies based on L2-L4 header values and (ii) an L5-L7 processing rule for application of the service rule. the method provides the redirection rule to a first set of Pods in the cluster and the L5-L7 processing rule to a second set of Pods in the cluster.

Abstract: Some embodiments provide a method for configuring logical routers of a logical network. The logical routers are implemented in a Kubernetes cluster as a first set of Pods that each perform logical forwarding operations for the logical routers and a second set of Pods that each perform L7 service operations for a respective logical router. From a Kubernetes control plane component, the method receives a notification that the first set requires scaling to include an additional Pod. The first-set Pods process data messages between the logical network and external networks. Within the network management system, the method defines at least one new interface for processing data messages between the logical network and external networks. The method configures the at least one interface on the additional Pod to communicate with external physical routers to receive traffic from the external networks and send traffic to the external networks.

Abstract: Some embodiments provide a method for configuring a logical network in a Kubernetes cluster, at a network management system external to the Kubernetes cluster. The method receives a definition of a logical router for the logical network. The logical router definition specifies a set of one or more L7 services to be performed on data messages processed by the logical router. Via a control plane of the Kubernetes cluster, the method defines (i) a first CR instance associated with a first CRD for implementing logical forwarding for the logical router and (ii) for each L7 service, a separate CR instance associated with a second CRD for implementing the L7 service.

Abstract: Some embodiments provide a method for implementing a logical router of a logical network at a first Pod executing on a first node of a Kubernetes cluster to implement data message forwarding for the logical router. The method receives a data message for processing by the logical router. The method determines that the data message requires layer 7 (L7) service processing at the logical router. The method selects a second Pod from multiple Pods that perform L7 service for the logical router. Each of the Pods executes on a different node of the cluster. The method forwards the data message to the second Pod via a layer 2 (L2) construct that connects the first and second Pods.

Abstract: Some embodiments provide a method for configuring a first Pod in a container cluster to perform layer 7 (L7) services for a logical router. At a second Pod that performs logical forwarding operations for the logical router, the method receives configuration data for the logical router from a network management system that defines a logical network for which the logical router routes data messages and performs L7 services. The method provides a set of Pod definition data to a cluster controller to create the first Pod. After creation of the first Pod, the method provides to the first Pod (i) networking information to enable a connection between the first and second Pods and (ii) configuration data defining the L7 services for the first Pod to perform the L7 services on data traffic sent from the second Pod to the first Pod.

Abstract: Some embodiments provide a method for monitoring a first service that executes in a Pod on a node of a Kubernetes deployment. At a second service executing on the node, the method monitors a storage of the node that stores core dump files to detect when a core dump file pertaining to the first service is written to the storage. Upon detection of the core dump file being written to the storage, the method automatically (i) generates an image of the first service based on data in the core dump file and (ii) instantiates a new container on the node to analyze the generated image in order to debug the first service.

Abstract: Some embodiments of the invention provide a method for implementing an edge device that handles data traffic between a logical network and an external network. The method monitors resource usage of a node pool that includes multiple nodes that each executes a respective set of pods. Each of the pods is for performing a respective set of data message processing operations for at least one of multiple logical routers. The method determines that a particular node in the node pool has insufficient resources for the particular node's respective set of pods to adequately perform their respective sets of data message processing operations. Based on the determination, the method automatically provides additional resources to the node pool by instantiating at least one additional node in the node pool.

Abstract: Some embodiments provide a method for configuring logical routers of a logical network. The logical routers are implemented in a Kubernetes cluster as a first set of Pods that each perform logical forwarding operations for the logical routers and a second set of Pods that each perform L7 service operations for a respective logical router. From a Kubernetes control plane component, the method receives a notification that the first set requires scaling to include an additional Pod. The first-set Pods process data messages between the logical network and external networks. Within the network management system, the method defines at least one new interface for processing data messages between the logical network and external networks. The method configures the at least one interface on the additional Pod to communicate with external physical routers to receive traffic from the external networks and send traffic to the external networks.

Abstract: Some embodiments of the invention provide a system for implementing multiple logical routers. The system includes a Kubernetes cluster that includes multiple nodes, with each node executing a set of pods. The set of pods include a first pod for performing a first set of data message processing operations for the multiple logical routers and at least one respective separate pod for each respective logical router of the multiple logical routers. Each respective pod is for performing a respective second set of data message processing operations for the respective logical router.

Abstract: Example methods and systems for multicast packet handling based on flow cache information are described. In one example, a network element may configure flow cache information associated with a multicast flow. The flow cache information may specify a set of actions that is configured based on a sequence of function calls. In response to detecting a multicast packet associated with the multicast flow, fast-path processing may be performed based on the flow cache information. This may include executing a replication action to generate a first packet replica and a second packet replica. First processing action(s) may be executed to process the first packet replica to generate and send a first output packet towards a first multicast destination. Second processing action(s) may be executed to process the second packet replica to generate and send a first output packet towards a second multicast destination.

Abstract: Some embodiments of the invention provide a method for implementing an edge device that handles data traffic between a logical network and an external network. The method monitors resource usage of a node pool that includes multiple nodes that each executes a respective set of pods. Each of the pods is for performing a respective set of data message processing operations for at least one of multiple logical routers. The method determines that a particular node in the node pool has insufficient resources for the particular node's respective set of pods to adequately perform their respective sets of data message processing operations. Based on the determination, the method automatically provides additional resources to the node pool by instantiating at least one additional node in the node pool.

Abstract: Some embodiments of the invention provide a system for implementing multiple logical routers. The system includes a Kubernetes cluster that includes multiple nodes, with each node executing a set of pods. The set of pods include a first pod for performing a first set of data message processing operations for the multiple logical routers and at least one respective separate pod for each respective logical router of the multiple logical routers. Each respective pod is for performing a respective second set of data message processing operations for the respective logical router.