Resource-path-based, dynamic group membership support for membership groups

A computer-implemented method for providing dynamic mechanisms for resource-path-based, dynamic group membership support for local and external membership groups, the method comprising:

• detecting, by a group resolver implemented in a management and control plane, that information about an object stored in the management and control plane was created or updated;
• wherein the object represents any one of:
• a logical component implemented in a local datacenter, an attribute object created for an external entity, or an external service object created for an external service;
• determining whether a Universal Resource Identifier (“URI”) of the object matches a URI regular expression and other conditions specified in membership criteria created for a membership group;
• in response to determining that a URI of the object matches a URI regular expression and other conditions specified in membership criteria created for a membership group:
• distributing the information about the object to one or more network agents implemented in one or more transport nodes to cause the one or more network agents to automatically update a group membership policy associated with the membership group;
• and
• wherein the group membership policy affects packet forwarding behavior of a forwarding node.