Multiple connectivity modes for containerized workloads in a multi-tenant network

A system comprising:

• one or more processors;
• and
• at least one computer-readable medium storing instructions executable by the one or more processors to perform operations comprising:
• managing, by an orchestration control plane implemented by a container orchestrator in a virtual private cloud (VPC) networking environment, a container-based cluster comprising a plurality of containers, the plurality of containers comprising a first container on a first virtual machine (VM) executing a first containerized workload, wherein the first container is managed by a first container engine running on the first VM on a first host;
• providing, within the VPC networking environment, a plurality of available connectivity modes for the first workload on the first container, the plurality of available connectivity modes comprising:
• a first connectivity mode in which internet protocol (IP) addresses are directly addressable only within the VPC;
• a second connectivity mode in which IP addresses are directly addressable only within a first level isolation construct that includes the VPC;
• and
• a third connectivity mode in which IP addresses are directly addressable only within a second level isolation construct that includes the VPC and the first level isolation construct;
• identifying a subnet custom resource definition (CRD) object specifying a selected connectivity mode to create an isolated environment for the first containerized workload;
• providing an isolated environment for the first containerized workload by creating a subnet based on a subnet custom resource definition (CRD) object, wherein addressability of IP addresses within the subnet is based on the connectivity mode specified by the subnet CRD object;
• and
• assigning the first containerized workload to the subnet by deploying a subnet port CRD object that associates the subnet with the first VM.

A non-transitory computer-readable medium comprising instructions executable by one or more processors to perform operations comprising:

• managing, by an orchestration control plane implemented by a container orchestrator in a virtual private cloud (VPC) networking environment, a container-based cluster comprising a plurality of containers, the plurality of containers comprising a first container on a first virtual machine (VM) executing a first containerized workload, wherein the first container is managed by a first container engine running on the first VM on a first host;
• providing, within the VPC networking environment, a plurality of available connectivity modes for the first workload on the first container, the plurality of available connectivity modes comprising:
• a first connectivity mode in which internet protocol (IP) addresses are directly addressable only within the VPC;
• a second connectivity mode in which IP addresses are directly addressable only within a first level isolation construct that includes the VPC;
• and
• a third connectivity mode in which IP addresses are directly addressable only within a second level isolation construct that includes the VPC and the first level isolation construct;
• identifying a subnet custom resource definition (CRD) object specifying a selected connectivity mode to create an isolated environment for the first containerized workload;
• providing an isolated environment for the first containerized workload by creating a subnet based on a subnet custom resource definition (CRD) object, wherein addressability of IP addresses within the subnet is based on the connectivity mode specified by the subnet CRD object;
• and
• assigning the first containerized workload to the subnet by deploying a subnet port-custom resource CRD object that associates the subnet with the first VM.