Policy controlled service routing

Abstract

Metadata associated with a workload is determined. The workload is associated with a consumer of a service. One or more policies associated with the metadata are retrieved. An agent is configured to perform policy-controlled service routing of communications comprising the data packets with respect to the workload based on the one or more policies.

What is claimed is: 
     
         1 . A system, comprising:
 a processor; and   a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to:
 configure an agent to perform policy-controlled service routing of communications comprising data packets with respect to a workload based on one or more policies associated with metadata associated with the workload, wherein the agent and the workload are hosted on a server, wherein the metadata associated with the workload indicates a particular role for the workload within a computing environment, wherein based on a first policy of the one or more policies associated with the metadata associated with the workload, the agent is configured to permit the workload to communicate with a first set of one or more servers; 
 receive from a remote policy data store an updated version of the first policy associated with the metadata associated with the workload, wherein the updated version of first policy associated with the metadata associated with the workload indicates that the workload has a different role for the workload within the computing environment; and 
 reconfigure the agent to perform policy-controlled service routing of communications with respect to the workload based on the updated version of the first policy associated with the metadata associated with the workload, wherein the workload is permitted to communicate with a second set of one or more servers instead of being permitted to communicate with the first set of one or more servers. 
   
     
     
         2 . The system of  claim 1 , wherein the metadata associated with the workload is based at least in part on an attribute of the workload. 
     
     
         3 . The system of  claim 1 , wherein to configure the agent, the instructions further cause the processor to:
 determine one or more endpoints associated with one or more retrieved policies;   update an access control list based on the determined one or more endpoints; and   provide access from the workload to the determined one or more endpoints.   
     
     
         4 . The system of  claim 1 , wherein the instructions further cause the processor to:
 receive an indication of an update to one of the one or more policies;   modify an access control list based on the indication; and   provide access from the workload to one or more endpoints based on the modified access control list.   
     
     
         5 . The system of  claim 1 , wherein the metadata associated with the workload includes a particular key-value pair, wherein the particular key-value pair indicates the particular role for the workload within the computing environment. 
     
     
         6 . The system of  claim 1 , wherein to configure the agent, the instructions further cause the processor to:
 determine one or more endpoints associated with one or more retrieved policies;   modify an endpoint call associated with the one or more endpoints based on the one or more policies; and   provide access to the one or more endpoints using the modified endpoint call.   
     
     
         7 . The system of  claim 1 , wherein the one or more policies include a load balancing policy. 
     
     
         8 . The system of  claim 1 , wherein the one or more policies include an encryption requirement associated with traffic between the workload and an endpoint. 
     
     
         9 . The system of  claim 1 , wherein an orchestrator is configured to attach to the workload the metadata associated with the workload. 
     
     
         10 . The system of  claim 1 , wherein a second policy of the one or more policies associated with the metadata attached to the workload indicates that workloads having the particular label are permitted to communicate with a particular endpoint using a particular endpoint call. 
     
     
         11 . The system of  claim 1 , wherein the orchestrator is configured to update the metadata associated with the workload. 
     
     
         12 . The system of  claim 11 , wherein the agent is configured to perform policy-controlled service routing of communications with respect to the workload based on the updated metadata associated with the workload. 
     
     
         13 . The system of  claim 1 , further comprising a proxy to redirect traffic to/from the workload. 
     
     
         14 . A method, comprising:
 configuring an agent to perform policy-controlled service routing of communications comprising data packets with respect to a workload based on one or more policies associated with the metadata associated with the workload, wherein the agent and the workload are hosted on a server, wherein the metadata associated with the workload indicates a particular role for the workload within a computing environment, wherein based on a first policy of the one or more policies associated with the metadata associated with the workload, the agent is configured to permit the workload to communicate with a first set of one or more servers;   receiving from a remote policy data store an updated version of the first policy associated with the metadata associated with the workload, wherein the updated version of first policy associated with the metadata associated with the workload indicates that the workload has a different role for the workload within the computing environment; and   reconfiguring the agent to perform policy-controlled service routing of communications with respect to the workload based on the updated version of the first policy associated with the metadata associated with the workload, wherein the workload is permitted to communicate with a second set of one or more servers instead of being permitted to communicate with the first set of one or more servers.   
     
     
         15 . The method of  claim 14 , wherein configuring the agent comprises:
 determining one or more endpoints associated with the one or more policies;   updating an access control list based on the determined one or more endpoints; and   providing access from the workload to the determined one or more endpoints.   
     
     
         16 . The method of  claim 14 , wherein configuring the agent comprises:
 receiving an indication of an update to one of the one or more policies;   modifying an access control list based on the indication; and   providing access from the workload to one or more endpoints based on the modified access control list.   
     
     
         17 . The method of  claim 14 , wherein the metadata associated with the workload includes a particular key-value pair, wherein the particular key-value pair indicates the particular role for the workload within the computing environment. 
     
     
         18 . The method of  claim 14 , wherein configuring the agent comprises:
 determining one or more endpoints associated with one or more policies;   modifying an endpoint call associated with one or more endpoints based on the one or more policies; and   providing access to the one or more endpoints using the modified endpoint call.   
     
     
         19 . The method of  claim 14 , wherein the one or more policies include a load balancing policy. 
     
     
         20 . A non-transitory computer readable storage medium comprising computer instructions, which when executed by a processor cause the processor to perform the steps of:
 configuring an agent to perform policy-controlled service routing of communications comprising data packets with respect to a workload based on one or more policies associated with the metadata associated with the workload, wherein the agent and the workload are hosted on a server, wherein the metadata associated with the workload indicates a particular role for the workload within a computing environment, wherein based on a first policy of the one or more policies associated with the metadata associated with the workload, the agent is configured to is permit the workload to communicate with a first set of one or more servers;   receiving from a remote policy data store an updated version of the first policy associated with the metadata associated with the workload, wherein the updated version of first policy associated with the metadata associated with the workload indicates that the workload has a different role for the workload within the computing environment; and   reconfiguring the agent to perform policy-controlled service routing of communications with respect to the workload based on the updated version of the first policy associated with the metadata associated with the workload, wherein the workload is permitted to communicate with a second set of one or more servers instead of being permitted to communicate with the first set of one or more servers.