Securely publishing applications from private networks

One or more non-transitory machine-readable medium having program code stored thereon, the program code comprising instructions to:

• onboard an application of a tenant for presenting access to the application, wherein the instructions to onboard the application comprise instructions to,
• determine a domain name for the application;
• assign a first network address to the application from a first routable address space of a network fabric;
• assign from the first routable address space a network address aggregate to each application connector deployed in each network for the application;
• for each instance of the application, assign the application instance a network address from the network address aggregate of the corresponding application connector;
• and
• create a route to each instance of the application through the network fabric without exposing private network addresses in each network, wherein the instructions to create the route comprise instructions to,
• set, in a first domain name system (DNS) entry, the domain name of the application to resolve to the first network address;
• for each application connector, configure a first destination network address translation (NAT) rule in the network fabric to translate the first network address to the network address assigned to the corresponding instance of the application;
• and
• instruct each application connector to configure a second destination NAT rule on the application connector to translate the network address assigned to the application instance of the application connector to the private network address of the application instance.

A system comprising:

• a plurality of application connectors deployed across a plurality of networks of a tenant, wherein the plurality of application connectors is assigned first network address aggregates from a first routable address space of a network fabric that is distinct from the plurality of networks;
• and
• a first controller programmed to communicate with network elements of the network fabric to create routes to instances of an application fronted by the plurality of deployed application connectors, wherein the first controller programmed to create the routes comprises,
• the first controller programmed to communicate with the plurality of deployed application connectors to establish tunnels with a first subset of the network fabric network elements;
• the first controller or a second controller programmed to,
• assign the application a first network address from the first routable address space;
• for each application instance fronted by a corresponding one of the plurality of deployed application connectors, assign a second network address to the application instance from the network address aggregate assigned to the corresponding one of the plurality of deployed application connectors;
• set a domain name system entry to resolve a domain name of the application to the first network address;
• for each of the plurality of networks hosting the application, configure in each of the plurality of application connectors deployed in the network for the application a first destination network address translation (NAT) rule to translate the second network address assigned to the application instance fronted by the application connector to a private network address assigned to the application instance hosted in the network;
• and
• configure in the network fabric, for each of the plurality of application connectors, a second destination NAT rule to translate the first network address to the second network address assigned to the application instance fronted by the deployed application connectors.