Automating secured deployment of containerized workloads on edge devices

A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations, the operations comprise:

• receiving, by a software defined wide area network (SD-WAN) edge device and from a remote manager, resource quotas dictating a limit on resources of the SD-WAN edge device for allocating to a compute service to be enabled at the SD-WAN edge device;
• performing, by the SD-WAN edge device, pre-deployment checks including confirming availability of the resources for the compute service at the SD-WAN device satisfying the resource quotas beyond resources dedicated to core services of the SD-WAN device, wherein the pre-deployment checks comprise determining that a buffer size for SD-WAN network function virtualization (NFV) at the SD-WAN edge device is larger than a memory limit specified in the resource quotas;
• in response to confirming the availability of resources satisfying the resource quotas, setting up, by the SD-WAN edge device, one or more security constructs to isolate SD-WAN network functions (NFs) at the SD-WAN edge device from the compute service at the SD-WAN edge device, the one or more security constructs to enable the compute service to deploy one or more containerized workloads in isolation from the core services;
• attaching, by the SD-WAN edge device, the compute service to a SD-WAN to enable availability of the one or more containerized workloads on the SD-WAN;
• and
• sending, by the SD-WAN edge device and to the remote manager, an acknowledgement that the compute service is enabled at the SD-WAN edge device;
• after sending the acknowledgement to the remote manager, updating, by the SD-WAN edge device, one or more firewall policies at the SD-WAN edge device based on one or more firewall policy updates from the remote manager.

A computer-implemented system, comprising:

• one or more computers;
• and
• one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations, the one or more operations comprise:
• receiving, by a software defined wide area network (SD-WAN) edge device and from a remote manager, resource quotas dictating a limit on resources of the SD-WAN edge device for allocating to a compute service to be enabled at the SD-WAN edge device;
• performing, by the SD-WAN edge device, pre-deployment checks including confirming availability of the resources for the compute service at the SD-WAN device satisfying the resource quotas beyond resources dedicated to core services of the SD-WAN device, wherein the pre-deployment checks comprise determining that a buffer size for SD-WAN network function virtualization (NFV) at the SD-WAN edge device is larger than a memory limit specified in the resource quotas;
• in response to confirming the availability of resources satisfying the resource quotas, setting up, by the SD-WAN edge device, one or more security constructs to isolate SD-WAN network functions (NFs) at the SD-WAN edge device from the compute service at the SD-WAN edge device, the one or more security constructs to enable the compute service to deploy one or more containerized workloads in isolation from the core services;
• attaching, by the SD-WAN edge device, the compute service to a SD-WAN to enable availability of the one or more containerized workloads on the SD-WAN;
• and
• sending, by the SD-WAN edge device and to the remote manager, an acknowledgement that the compute service is enabled at the SD-WAN edge device;
• after sending the acknowledgement to the remote manager, updating, by the SD-WAN edge device, one or more firewall policies at the SD-WAN edge device based on one or more firewall policy updates from the remote manager.