Providing networking and security to workloads via a control virtual private cloud shared across multiple virtual private clouds

One or more non-transitory computer-readable storage media storing one or more programs configured to be executed by one or more processors to enforce policies on virtual machines across virtual private clouds using a plurality of control virtual private clouds, each of the plurality of control virtual private clouds comprising a corresponding proxy control plane, the one or more programs including instructions for:

• at each of the proxy control planes of the plurality of control virtual private clouds, wherein each of the proxy control planes is directly in communication with at least two corresponding virtual machines on at least two corresponding virtual private clouds other than the plurality of control virtual private clouds, each of the virtual private clouds comprising a logically isolated set of resources having its own corresponding set of network policies:
• receiving, at the corresponding proxy control plane, a policy from a controller;
• and
• directly transmitting, from the corresponding proxy control plane, without passing any intermediary proxy control plane local to a first virtual private cloud of the at least two corresponding virtual private clouds and without passing any intermediary proxy control plane local to a second virtual private cloud of the at least two corresponding virtual private clouds, a first rule of the policy to a first virtual machine of the first virtual private cloud and a second rule of the policy to a second virtual machine of the second virtual private cloud;
• at the first virtual machine of the first virtual private cloud:
• receiving the first rule from the corresponding proxy control plane;
• and
• enforcing, via a first local control plane agent in the first virtual machine, the first rule at the first virtual machine;
• at the second virtual machine of the second virtual private cloud:
• receiving the second rule from the corresponding proxy control plane;
• and
• enforcing, via a second local control plane agent in the second virtual machine, the second rule at the second virtual machine.

A system for enforcing policies on virtual machines across virtual private clouds using a plurality of control virtual private clouds, each of the plurality of control virtual private clouds comprising a corresponding proxy control plane, the system comprising:

• one or more non-transitory memories storing executable instructions;
• and
• one or more processors configured to execute the instructions to cause the system to:
• at each of the proxy control planes of the plurality of control virtual private clouds, wherein each of the proxy control planes is directly in communication with at least two corresponding virtual machines on at least two corresponding virtual private clouds other than the plurality of control virtual private clouds, each of the virtual private clouds comprising a logically isolated set of resources having its own corresponding set of network policies:
• receive, at the corresponding proxy control plane, a policy from a controller;
• and
• directly transmit, from the corresponding proxy control plane, without passing any intermediary proxy control plane local to a first virtual private cloud of the at least two corresponding virtual private clouds and without passing any intermediary proxy control plane local to a second virtual private cloud of the at least two corresponding virtual private clouds, a first rule of the policy to a first virtual machine of the first virtual private cloud and a second rule of the policy to a second virtual machine of the second virtual private cloud;
• at the first virtual machine of the first virtual private cloud:
• receive the first rule from the corresponding proxy control plane;
• and
• enforce, via a first local control plane agent in the first virtual machine, the first rule at the first virtual machine;
• at the second virtual machine of the second virtual private cloud:
• receive the second rule from the corresponding proxy control plane;
• and
• enforce, via a second local control plane agent in the second virtual machine, the second rule at the second virtual machine.